-module(aws@internal@crypto).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/aws/internal/crypto.gleam").
-export([sha256/1, md5/1, hmac_sha256/2, hex_encode/1, sha1/1, crc32/1, crc32c/1, crc32_be_bytes/1]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

-file("src/aws/internal/crypto.gleam", 2).
-spec sha256(bitstring()) -> bitstring().
sha256(Data) ->
    aws_ffi:sha256(Data).

-file("src/aws/internal/crypto.gleam", 9).
?DOC(
    " Raw MD5 digest. Used by the `@httpChecksumRequired` body-checksum\n"
    " helper in `aws/internal/codec/rest` — not by SigV4. MD5 is not a\n"
    " security primitive; the wire spec requires it here so the SDK can\n"
    " emit `Content-MD5: base64(md5(body))` for traits that demand it.\n"
).
-spec md5(bitstring()) -> bitstring().
md5(Data) ->
    aws_ffi:md5(Data).

-file("src/aws/internal/crypto.gleam", 12).
-spec hmac_sha256(bitstring(), bitstring()) -> bitstring().
hmac_sha256(Key, Data) ->
    aws_ffi:hmac_sha256(Key, Data).

-file("src/aws/internal/crypto.gleam", 15).
-spec hex_encode(bitstring()) -> binary().
hex_encode(Data) ->
    aws_ffi:hex_encode(Data).

-file("src/aws/internal/crypto.gleam", 24).
?DOC(
    " Raw SHA-1 digest. Used by the AWS multi-algorithm checksum\n"
    " feature (`aws.protocols#httpChecksum`) when the caller picks\n"
    " `sha1` — the SDK sets `x-amz-checksum-sha1: base64(sha1(body))`\n"
    " on the request. SHA-1 isn't a security primitive on AWS's side\n"
    " either; it's a payload-integrity check, and we expose it\n"
    " without warnings because the wire spec mandates it.\n"
).
-spec sha1(bitstring()) -> bitstring().
sha1(Data) ->
    aws_ffi:sha1(Data).

-file("src/aws/internal/crypto.gleam", 33).
?DOC(
    " Raw CRC-32 (IEEE 802.3, the same polynomial as zlib / gzip).\n"
    " Returned as an `Int` because that's the natural Erlang form\n"
    " (`erlang:crc32/1` returns an unsigned 32-bit integer). Callers\n"
    " wanting the AWS wire form should base64-encode the big-endian\n"
    " 4-byte representation; see `crc32_be_bytes` for the helper\n"
    " that produces the bytes ready for `bit_array.base64_encode`.\n"
).
-spec crc32(bitstring()) -> integer().
crc32(Data) ->
    erlang:crc32(Data).

-file("src/aws/internal/crypto.gleam", 42).
?DOC(
    " Raw CRC-32C (Castagnoli polynomial 0x1EDC6F41, the iSCSI / SCTP\n"
    " variant). Returned as an unsigned 32-bit `Int`. Implemented in\n"
    " pure Erlang (`aws_ffi.crc32c`) because OTP's stdlib doesn't\n"
    " expose this polynomial. Used by AWS multi-algorithm checksum\n"
    " (`crc32c` variant) — base64 of the BE 4-byte form goes into\n"
    " `x-amz-checksum-crc32c`.\n"
).
-spec crc32c(bitstring()) -> integer().
crc32c(Data) ->
    aws_ffi:crc32c(Data).

-file("src/aws/internal/crypto.gleam", 50).
?DOC(
    " Big-endian 4-byte encoding of a CRC-32 value, ready to feed\n"
    " into `bit_array.base64_encode`. AWS's\n"
    " `x-amz-checksum-crc32: <base64>` header expects exactly four\n"
    " bytes (not the hex form most other CRC libraries print). Pure\n"
    " Gleam — no FFI hop — because Gleam's `BitArray` literal\n"
    " syntax handles the bit packing inline.\n"
).
-spec crc32_be_bytes(integer()) -> bitstring().
crc32_be_bytes(Value) ->
    <<Value:32/big>>.