interface ClientConfig {
  baseURL: string;
  clientConfigId: string;
  clientConfigSecret: string;
  timeout?: number;        // Default: 30000ms
  retryConfig?: {
    maxRetries: number;    // Default: 3
    backoffFactor: number; // Default: 0.1
    statusForcelist: number[]; // Default: [500, 502, 503, 504, 429]
  };
  privateKey?: string;     // RSA private key for request encryption
}

import { APIClient } from '@xyphos/client'

// Initialize with basic config
const client = new APIClient({
  baseURL: 'http://localhost:8080',
  clientConfigId: 'your-client-id',
  clientConfigSecret: 'your-client-secret'
})

// Or with full configuration including encryption
const secureClient = new APIClient({
  baseURL: 'http://localhost:8080',
  clientConfigId: 'your-client-id',
  clientConfigSecret: 'your-client-secret',
  timeout: 30000,
  retryConfig: {
    maxRetries: 3,
    backoffFactor: 0.1,
    statusForcelist: [500, 502, 503, 504, 429]
  },
  privateKey: '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----'
})

// 🔐 Encrypt data
const { ciphertext, keyVersion } = await client.encrypt({
  projectId: 'my-project',
  locationId: 'us-west1',
  keyringId: 'app-keys',
  keyId: 'encryption-key',
  plaintext: 'super secret message'
})

// 🔓 Decrypt data
const { plaintext } = await client.decrypt({
  projectId: 'my-project',
  locationId: 'us-west1',
  keyringId: 'app-keys',
  keyId: 'encryption-key',
  keyVersion: keyVersion,
  ciphertext: ciphertext
})

// Custom retry configuration
const client = new APIClient({
  // ... other config
  retryConfig: {
    maxRetries: 5,                    // Maximum number of retry attempts
    backoffFactor: 0.2,              // Exponential backoff multiplier
    statusForcelist: [500, 502, 503]  // Status codes that trigger retries
  }
})

// The client will automatically:
// 1. Encrypt request bodies using RSA-OAEP
// 2. Decrypt encrypted responses
// 3. Handle key rotation and management
const encryptedClient = new APIClient({
  // ... other config
  privateKey: process.env.CLIENT_PRIVATE_KEY
})

// All requests/responses will be automatically encrypted
const result = await encryptedClient.encrypt({
  projectId: 'my-project',
  keyringId: 'app-keys',
  keyId: 'encryption-key',
  plaintext: 'This request will be encrypted'
})

try {
  await client.encrypt(/*...*/)
} catch (error) {
  if (error instanceof AuthenticationError) {
    // Handle authentication failure
  } else if (error instanceof PermissionError) {
    // Handle permission issues
  } else if (error instanceof NotFoundError) {
    // Handle missing resources
  } else if (error instanceof InvalidInputError) {
    // Handle invalid input
  } else if (error instanceof KMSError) {
    // Handle general KMS errors
  }
}