package main

import (
	"context"
	"os"

	"github.com/cuilabs/qnsp-go/qnsp"
)

func main() {
	ctx := context.Background()
	q, _ := qnsp.NewClient(qnsp.WithAPIKey(os.Getenv("QNSP_API_KEY")))

	// Generate an ML-DSA-65 signing key for service identity
	key, _ := q.KMS().CreateKey(ctx, &qnsp.CreateKeyRequest{
		Algorithm: "ml-dsa-65",
		Purpose:   "signing",
		Tags:      map[string]string{"service": "payments-api"},
	})

	// Issue an mTLS cert signed by that key, valid for the mesh
	cert, _ := q.KMS().IssueCert(ctx, &qnsp.IssueCertRequest{
		KeyID:    key.KeyID,
		Subject:  "spiffe://qnsp.cuilabs.io/payments-api",
		ValidFor: "72h",
		KemGroup: "X25519MLKEM768",  // hybrid PQC TLS
	})

	// Hand 'cert' to your gRPC/HTTP server's TLS config
	_ = cert
}