using Panda.Pusl.Client;

var options = new PuslOptions
{
    ServiceId = "your_service_identifier",
};

using var client = new PuslClient(options);

Console.WriteLine("Get a key: " + client.GetKeyUrl());
Console.Write("Enter key: ");
var key = Console.ReadLine() ?? "";

var result = await client.ValidateAsync(key);

if (!result.Success)
{
    Console.WriteLine($"Auth failed [{result.ReasonCode}]: {result.Error}");
    return result.Reason == PuslReason.InvalidKey ? 2 : 1;
}

Console.WriteLine($"Authenticated. Premium: {result.IsPremium}");
Console.WriteLine($"Expires: {client.GetExpiryFormatted()}");

Console.ReadLine();
await client.DisconnectAsync();
return 0;

// Only INVALID_KEY means the key is bad. Everything else is transient, so
// back off and retry instead of telling a paying user their key is wrong.
static async Task<PuslResult> Authenticate(PuslClient client, string key)
{
    var result = await client.ValidateAsync(key);

    for (var attempt = 1; attempt <= 3; attempt++)
    {
        if (result.Success || result.Reason == PuslReason.InvalidKey) break;

        // A 404 is the slug being rejected, and it stays rejected.
        if (result.HttpStatus == 404) break;

        var wait = TimeSpan.FromSeconds(result.RetryAfterSeconds ?? attempt * 5);
        await Task.Delay(wait);

        result = await client.ValidateAsync(key);
    }

    return result;
}

// Fires when a live session drops on its own: "network", "protocol",
// "slug_rejected", "session_closed", or a reason the server sent.
client.SessionEnded += (_, reason) => _revoked = reason;

// IsConnected is false the moment the heartbeat stops coming back.
if (!client.IsConnected || _revoked is not null)
{
    // Stop doing the paid work. Do not call Environment.Exit here.
}

client.ExpiresAt            // "2026-08-09T22:15:00.000Z", null = lifetime
client.ExpiresAtUnix       // 1786429200, null = lifetime
client.GetTimeLeft()       // 604800 seconds, null = lifetime, floored at 0
client.IsExpired()         // false for a lifetime key
client.GetExpiryFormatted()// "7d 0h 0m" | "Lifetime" | "Expired"

// null means LIFETIME, never "expired".
if (client.GetTimeLeft() is { } left && left < 86_400)
    Warn($"Key expires in {client.GetExpiryFormatted()}");

var options = new PuslOptions
{
    ServiceId  = "your_service_identifier",

    // Must match the server. Rotate them together.
    VerifyKey  = "pusl_v4_vk_...",
    SlugSecret = "pusl_v4_ss_...",

    // Public half of the server signing key. A wrong value fails every
    // handshake with IDENTITY.
    ServerPublicKeyHex = "4dd84e1d...",

    // Set this only if heartbeats come back 404.
    SessionSlugServiceId = null,

    // Leave null unless your product already has a device identity.
    Hwid = null,

    Executor = "MyApp/1.4.0",
    Debug    = false,
};

// panda_v5.h
#pragma once

#ifdef PANDA_V5_EXPORTS
#define PANDA_API extern "C" __declspec(dllexport)
#else
#define PANDA_API extern "C" __declspec(dllimport)
#endif

// Connect to server, validate key, start heartbeat.
PANDA_API bool Validate(const char* service, const char* key);

// Returns the GetKey URL with auto-HWID appended.
PANDA_API const char* Get_Key(const char* service);

// Check if the session is still alive (heartbeat ok, not expired).
// Fails if the internal thread detects debugging or heartbeat drops.
PANDA_API bool IsValid();

// Graceful disconnect.
PANDA_API void Shutdown();

// Get the last error message string.
PANDA_API const char* PandaGetLastError();