package com.peachpasswords.ui.vault

import com.peachpasswords.vault.PeachPayloadCodec
import com.peachpasswords.vault.PeachScript
import com.peachpasswords.vault.VaultEntry

/**
 * PeachScript export (MF-2) — writes the browser's PCHS binary payload
 * (Argon2id + AES-256-GCM, zstd sections, BLAKE3 checksum, size-bucket padding,
 * string-table entry packing) re-encoded into Private-Use-Area text. The output
 * is importable by the browser extension and carries the full entry field set.
 *
 * The heavy lifting lives in [PeachPayloadCodec] (binary) and [PeachScript]
 * (PUA codec); this object is just the export entry point the UI calls.
 */
object PeachScriptExport {

    /**
     * Encrypted PeachScript export of [entries], protected by [backupPassword].
     * PeachScript is always encrypted (the browser format has no plaintext mode).
     */
    fun buildEncrypted(entries: List<VaultEntry>, backupPassword: String): String =
        PeachScript.encode(PeachPayloadCodec.buildPayload(entries, backupPassword))
}