import { QnspClient } from "@cuilabs/qnsp";

const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });

// Vault with retention lock (immutable until expiry)
const secret = await qnsp.vault.createSecret({
  name: `trade-confirm:${tradeId}`,
  payloadB64: confirmDocBase64,
  retention: {
    lockUntil: "2030-12-31",  // SEC 17a-4: minimum 3 years
    immutable: true,           // WORM enforcement
  },
  metadata: {
    pqcAlgorithm: "ml-kem-768",
    regulatoryClass: "sec-17a-4",
  },
});

// Audit event is itself ML-DSA-signed by audit-service
await qnsp.audit.logEvent({
  eventType: "trade.confirm.archived",
  payload: { tradeId, secretId: secret.id, retainUntil: "2030-12-31" },
});