// Package crypto implements lattice-based cryptographic primitives using
// dendrite's accretion/dissolution dynamics as the physical substrate.
//
// The structural identity: dendrite's lattice IS a lattice-crypto system.
// Constraint envelopes are the short basis (trapdoor). Spore fingerprints
// are the public basis. ContextualLockIn is the BDD margin. Dissolution
// is discrete Gaussian sampling. The CVP decision is Node.Bond().
//
// Security rests on the assumption that recovering specific constraint
// implementations from a spore's structural fingerprint is at least as
// hard as CVP on the constraint graph. This is plausible but unproven —
// see PLAN-lattice-crypto.md for the honest assessment.
package crypto

import "git.mleku.dev/mleku/dendrite/pkg/ratio"

// SecurityLevel specifies cryptographic strength.
type SecurityLevel uint8

const (
	Security128 SecurityLevel = iota
	Security192
	Security256
)

// Params holds the parameters for a DendriteLWE instance.
type Params struct {
	// N is the lattice dimension — number of constraint sites.
	// Higher N = harder CVP = more security.
	N int

	// Q is the modulus for arithmetic operations.
	// Integer-valued ratio (Denom == 1).
	Q ratio.Ratio

	// SmoothingParam is the dissolution threshold below which
	// the lattice structure disappears into noise. This is eta_eps.
	// Elements with ContextualLockIn < SmoothingParam are dissolved.
	SmoothingParam ratio.Ratio

	// NoiseWidth controls the spread of the discrete Gaussian.
	// More noise = more security, less noise = more reliable decryption.
	// Must satisfy: SmoothingParam < NoiseWidth < 1.
	NoiseWidth ratio.Ratio

	// MaxWalkSteps limits Brownian walk length during encryption.
	MaxWalkSteps int

	// DissolutionPasses is how many dissolution scans to run
	// after bonding, to add the LWE noise term.
	DissolutionPasses int
}

// DefaultParams returns parameters for a given security level.
//
//	128-bit: N=256,  Q=127/1, noise=3/10, smoothing=2/10
//	192-bit: N=384,  Q=251/1, noise=3/10, smoothing=2/10
//	256-bit: N=512,  Q=509/1, noise=3/10, smoothing=2/10
func DefaultParams(level SecurityLevel) Params {
	switch level {
	case Security192:
		return Params{
			N:                 384,
			Q:                 ratio.FromInt(251),
			SmoothingParam:    ratio.New(2, 10),
			NoiseWidth:        ratio.New(3, 10),
			MaxWalkSteps:      1600, // 10^2 × 2^4 — epoch-aligned
			DissolutionPasses: 3,
		}
	case Security256:
		return Params{
			N:                 512,
			Q:                 ratio.FromInt(509),
			SmoothingParam:    ratio.New(2, 10),
			NoiseWidth:        ratio.New(3, 10),
			MaxWalkSteps:      2000, // 10^3 × 2^1 — already epoch-aligned
			DissolutionPasses: 4,
		}
	default: // Security128
		return Params{
			N:                 256,
			Q:                 ratio.FromInt(127),
			SmoothingParam:    ratio.New(2, 10),
			NoiseWidth:        ratio.New(3, 10),
			MaxWalkSteps:      1024, // 2^10 — epoch-aligned with N=256=2^8
			DissolutionPasses: 2,
		}
	}
}

// Valid reports whether the parameters are internally consistent.
func (p Params) Valid() bool {
	if p.N <= 0 {
		return false
	}
	if !p.Q.IsPositive() || p.Q.Denom != 1 {
		return false // Q must be a positive integer
	}
	if !p.SmoothingParam.IsPositive() {
		return false
	}
	if !p.NoiseWidth.IsPositive() {
		return false
	}
	// SmoothingParam < NoiseWidth < 1
	if !p.SmoothingParam.Less(p.NoiseWidth) {
		return false
	}
	if !p.NoiseWidth.Less(ratio.One) {
		return false
	}
	if p.MaxWalkSteps <= 0 {
		return false
	}
	if p.DissolutionPasses <= 0 {
		return false
	}
	return true
}