///|
/// SHA-256 initial hash values (FIPS 180-4).
let sha256_h0 : Array[UInt] = [
  0x6a09e667U, 0xbb67ae85U, 0x3c6ef372U, 0xa54ff53aU, 0x510e527fU, 0x9b05688cU, 0x1f83d9abU,
  0x5be0cd19U,
]

///|
/// SHA-256 round constants (first 64 bits of fractional parts of cube roots of first 64 primes).
let sha256_k : Array[UInt] = [
  0x428a2f98U, 0x71374491U, 0xb5c0fbcfU, 0xe9b5dba5U, 0x3956c25bU, 0x59f111f1U, 0x923f82a4U,
  0xab1c5ed5U, 0xd807aa98U, 0x12835b01U, 0x243185beU, 0x550c7dc3U, 0x72be5d74U, 0x80deb1feU,
  0x9bdc06a7U, 0xc19bf174U, 0xe49b69c1U, 0xefbe4786U, 0x0fc19dc6U, 0x240ca1ccU, 0x2de92c6fU,
  0x4a7484aaU, 0x5cb0a9dcU, 0x76f988daU, 0x983e5152U, 0xa831c66dU, 0xb00327c8U, 0xbf597fc7U,
  0xc6e00bf3U, 0xd5a79147U, 0x06ca6351U, 0x14292967U, 0x27b70a85U, 0x2e1b2138U, 0x4d2c6dfcU,
  0x53380d13U, 0x650a7354U, 0x766a0abbU, 0x81c2c92eU, 0x92722c85U, 0xa2bfe8a1U, 0xa81a664bU,
  0xc24b8b70U, 0xc76c51a3U, 0xd192e819U, 0xd6990624U, 0xf40e3585U, 0x106aa070U, 0x19a4c116U,
  0x1e376c08U, 0x2748774cU, 0x34b0bcb5U, 0x391c0cb3U, 0x4ed8aa4aU, 0x5b9cca4fU, 0x682e6ff3U,
  0x748f82eeU, 0x78a5636fU, 0x84c87814U, 0x8cc70208U, 0x90befffaU, 0xa4506cebU, 0xbef9a3f7U,
  0xc67178f2U,
]

///|
/// SHA-256 state.
pub(all) struct Sha256 {
  mut h : Array[UInt]
  mut buffer : Array[Byte]
  mut total_len : UInt64
}

///|
/// Create a new SHA-256 hasher.
pub fn Sha256::new() -> Sha256 {
  { h: sha256_h0.copy(), buffer: [], total_len: 0UL }
}

///|
/// Feed data into the hasher.
pub fn Sha256::write(self : Sha256, data : Bytes) -> Unit {
  let mut i = 0
  while i < data.length() {
    self.buffer.push(data[i])
    if self.buffer.length() == 64 {
      self.process_block(self.buffer)
      self.buffer = []
    }
    i += 1
  }
  self.total_len += data.length().to_uint64()
}

///|
fn rotr(x : UInt, n : Int) -> UInt {
  (x >> n) | (x << (32 - n))
}

///|
fn Sha256::process_block(self : Sha256, block : Array[Byte]) -> Unit {
  let w : Array[UInt] = Array::make(64, 0U)
  let mut i = 0
  while i < 16 {
    w[i] = (block[i * 4].to_uint() << 24) |
      (block[i * 4 + 1].to_uint() << 16) |
      (block[i * 4 + 2].to_uint() << 8) |
      block[i * 4 + 3].to_uint()
    i += 1
  }
  while i < 64 {
    let s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3)
    let s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10)
    w[i] = w[i - 16] + s0 + w[i - 7] + s1
    i += 1
  }
  let mut a = self.h[0]
  let mut b = self.h[1]
  let mut c = self.h[2]
  let mut d = self.h[3]
  let mut e = self.h[4]
  let mut f = self.h[5]
  let mut g = self.h[6]
  let mut h = self.h[7]
  i = 0
  while i < 64 {
    let s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)
    let ch = (e & f) ^ (e.lnot() & g)
    let temp1 = h + s1 + ch + sha256_k[i] + w[i]
    let s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)
    let maj = (a & b) ^ (a & c) ^ (b & c)
    let temp2 = s0 + maj
    h = g
    g = f
    f = e
    e = d + temp1
    d = c
    c = b
    b = a
    a = temp1 + temp2
    i += 1
  }
  self.h[0] += a
  self.h[1] += b
  self.h[2] += c
  self.h[3] += d
  self.h[4] += e
  self.h[5] += f
  self.h[6] += g
  self.h[7] += h
}

///|
/// Finalize and return the 32-byte digest.
pub fn Sha256::finalize(self : Sha256) -> Bytes {
  // Save original buffer length before padding
  let bit_len = self.total_len * 8UL
  // Append 0x80
  self.buffer.push(b'\x80')
  // Pad until length ≡ 56 (mod 64)
  while self.buffer.length() % 64 != 56 {
    self.buffer.push(b'\x00')
  }
  // Append 64-bit big-endian length
  for i in [0, 1, 2, 3, 4, 5, 6, 7] {
    let shift = (7 - i) * 8
    self.buffer.push(((bit_len >> shift) & 0xFFUL).to_byte())
  }
  // Process remaining blocks
  let mut start = 0
  while start < self.buffer.length() {
    let block : Array[Byte] = []
    for j in 0..<64 {
      block.push(self.buffer[start + j])
    }
    self.process_block(block)
    start += 64
  }
  // Output
  let result : Array[Byte] = []
  for i in 0..<8 {
    let val = self.h[i]
    result.push(((val >> 24) & 0xFFU).to_byte())
    result.push(((val >> 16) & 0xFFU).to_byte())
    result.push(((val >> 8) & 0xFFU).to_byte())
    result.push((val & 0xFFU).to_byte())
  }
  Bytes::from_array(result)
}

///|
/// One-shot SHA-256 hash of a byte string.
pub fn sha256(data : Bytes) -> Bytes {
  let h = Sha256::new()
  h.write(data)
  h.finalize()
}

///|
/// One-shot SHA-256 hash of a MoonBit String, returned as hex.
pub fn sha256_hex(data : String) -> String {
  let digest = sha256(@utf8.encode(data))
  let hex_chars : Array[Char] = [
    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f',
  ]
  let sb : Array[Char] = []
  for i in 0..> 4) & 0xF])
    sb.push(hex_chars[b & 0xF])
  }
  String::from_array(sb)
}