package com.peachpasswords.ui.vault

import com.peachpasswords.vault.PeachPayloadCodec
import com.peachpasswords.vault.PeachScript
import com.peachpasswords.vault.VaultEntry
import com.peachpasswords.vault.VaultSettings

/**
 * PeachScript export (MF-2) — writes the browser's PCHS binary payload
 * (Argon2id + AES-256-GCM, zstd sections, BLAKE3 checksum, size-bucket padding,
 * string-table entry packing) re-encoded into Private-Use-Area text. The output
 * is importable by the browser extension and carries the full entry field set.
 *
 * The heavy lifting lives in [PeachPayloadCodec] (binary) and [PeachScript]
 * (PUA codec); this object is just the export entry point the UI calls.
 */
object PeachScriptExport {

    /**
     * Encrypted PeachScript export of [entries], protected by [backupPassword].
     * PeachScript is always encrypted (the browser format has no plaintext mode).
     */
    fun buildEncrypted(
        entries: List<VaultEntry>,
        backupPassword: String,
        settings: VaultSettings = VaultSettings(),
        licenseKey: String? = null,
        licenseActivatedAt: Long? = null,
    ): String =
        PeachScript.encode(
            PeachPayloadCodec.buildPayload(
                entries = entries,
                passphrase = backupPassword,
                settings = settings,
                licenseKey = licenseKey,
                licenseActivatedAt = licenseActivatedAt,
            ),
        )
}