import { QnspClient } from "@cuilabs/qnsp";

const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });

// 1. Vault the source PDF (ML-KEM-768-wrapped AES-256-GCM)
const secret = await qnsp.vault.createSecret({
  name: `contract:${contractId}`,
  payloadB64: pdfBase64,
  retention: { lockUntil: "2055-12-31" },
});

// 2. Extract + index clauses for encrypted search
await qnsp.search.upsertVectors("contracts", [{
  id: contractId,
  vector: clauseEmbedding,
  metadata: { counterparty, signedAt },
}]);

// 3. Audit
await qnsp.audit.logEvent({
  eventType: "contract.created",
  payload: { contractId, secretId: secret.id },
});

const hits = await qnsp.search.query("contracts", {
  vector: queryEmbedding,
  topK: 20,
  filter: { counterparty: "Acme Corp" },
});

// hits[].id maps back to vault secret IDs — fetch under access control
for (const hit of hits.matches) {
  const secret = await qnsp.vault.getSecret(`contract:${hit.id}`);
  // decrypted plaintext is in secret.payloadB64
}