// In your React / Vue / Svelte component (zero native deps)
import { ml_kem768 } from "@noble/post-quantum/ml-kem";
import { ml_dsa65 } from "@noble/post-quantum/ml-dsa";

// 1. Browser fetches the server's ML-KEM-768 public key
const serverPubKey = await fetch("/api/qnsp/pubkey").then(r => r.bytes());

// 2. Browser does the encapsulation locally
const { cipherText, sharedSecret } = ml_kem768.encapsulate(serverPubKey);

// 3. Encrypt the payload locally with the shared secret (AES-256-GCM)
const ciphertext = await encryptAesGcm(sharedSecret, sensitivePayload);

// 4. POST to your server — server never sees plaintext
await fetch("/api/qnsp/vault", {
  method: "POST",
  body: JSON.stringify({ cipherText, payloadCipher: ciphertext }),
});

import { QnspClient } from "@cuilabs/qnsp";

// In your Next.js / Express / Fastify route
export async function POST(req: Request) {
  const { cipherText, payloadCipher } = await req.json();
  const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });

  // QNSP unwraps via tenant key (cipherText) → decrypts payloadCipher → stores
  const secret = await qnsp.vault.createSecretFromKemHandshake({
    cipherText,
    payloadCipher,
  });

  return Response.json({ secretId: secret.id });
}