export-keepass-csv() {
    if test -z "$1"; then
        echo "\$1 is empty." >&2
        return 1
    fi

    OUTPUT_FILE="$1"
    PASS_DIR="${PASSWORD_STORE_DIR:-$HOME/.password-store}"

    # Validate PASS_DIR exists
    if [[ ! -d "$PASS_DIR" ]]; then
        echo "Error: Password store directory not found: $PASS_DIR" >&2
        return 1
    fi

    # Header (already properly quoted)
    echo '"Group","Title","Username","Password","URL","Notes","TOTP"' > "$OUTPUT_FILE"

    # Use process substitution to avoid subshell
    while read -r FILE; do
        echo "Parse pass file: ${FILE#$PASS_DIR/}"

        REL_PATH="${FILE#$PASS_DIR/}"
        REL_PATH="${REL_PATH%.gpg}"
        GROUP="Root/Pass/$(dirname $REL_PATH)"
        FOLDER="$(dirname "$GROUP")"
        TITLE="$(basename "$REL_PATH")"
        ENTRY="$(pass show "$REL_PATH")"

        # Extract password (first line)
        PASSWORD="$(printf '%s' "$ENTRY" | head -n1)"

        # Initialize fields
        USERNAME=""
        URL="https://$TITLE"
        NOTES=""
        TOTP=""

        # Parse additional key-value lines (skip first line)
        while IFS= read -r LINE; do
            case "$LINE" in
                username:*) USERNAME="${LINE#username: }" ;;
                Username:*) USERNAME="${LINE#Username: }" ;;
                notes:*)     NOTES="${LINE#notes: }" ;;
                Notes:*)     NOTES="${LINE#Notes: }" ;;
                url:*)       URL="${LINE#url: }" ;;
                Url:*)       URL="${LINE#Url: }" ;;
                totp:*)      TOTP="${LINE#totp: }" ;;
            esac
        done <<< "$(printf '%s\n' "$ENTRY" | tail -n +2)"

        # If password starts with otpauth://, extract the secret and set as TOTP
        if [[ "$PASSWORD" == otpauth://* ]]; then
            # Extract secret from otpauth URL using query parameter parsing
            SECRET=$(echo "$PASSWORD" | sed -n 's/.*secret=\([^&]*\).*/\1/p' | tr '[:lower:]' '[:upper:]')
            if [[ -n "$SECRET" ]]; then
                TOTP="$SECRET"
            fi
        fi

        # Use fallback username based on folder
        if [[ "$USERNAME" == "" ]]; then
            if [[ "$FOLDER" == *"private"* ]]; then
                USERNAME="$FALLBACK_USERNAME_private"
            elif [[ "$FOLDER" == *"mint-system"* ]]; then
                USERNAME="$FALLBACK_USERNAME_mint_system"
            elif [[ "$FOLDER" == *"sozialinfo"* ]]; then
                USERNAME="$FALLBACK_USERNAME_sozialinfo"
            fi
        fi

        # Function to escape double quotes and wrap in quotes for CSV
        PASSWORD_CSV=$(printf '%s' "$PASSWORD" | sed 's/"/""/g; s/.*/"&"/')
        USERNAME_CSV=$(printf '%s' "$USERNAME" | sed 's/"/""/g; s/.*/"&"/')
        NOTES_CSV=$(printf '%s' "$NOTES" | sed 's/"/""/g; s/.*/"&"/')
        TOTP_CSV=$(printf '%s' "$TOTP" | sed 's/"/""/g; s/.*/"&"/')

        # URL is usually safe, but still escape if needed
        URL_CSV=$(printf '%s' "$URL" | sed 's/"/""/g; s/.*/"&"/')

        # Group and Title should also be escaped
        GROUP_CSV=$(printf '%s' "$GROUP" | sed 's/"/""/g; s/.*/"&"/')
        TITLE_CSV=$(printf '%s' "$TITLE" | sed 's/"/""/g; s/.*/"&"/')

        # Write to CSV
        printf '%s,%s,%s,%s,%s,%s,%s\n' \
            "$GROUP_CSV" \
            "$TITLE_CSV" \
            "$USERNAME_CSV" \
            "$PASSWORD_CSV" \
            "$URL_CSV" \
            "$NOTES_CSV" \
            "$TOTP_CSV" >> "$OUTPUT_FILE"

    done < <(find "$PASS_DIR" -name "*.gpg" ! -name ".gpg" -print)

    echo "All pass entries exported to $OUTPUT_FILE."
}