% Socket for accepting connections
    listen_socket,

    % Listener PID from enoise_cable:listen
    listener_pid,

    % Map of Socket -> {IP, Port}
    socket_to_peer = #{},
    % Map of {IP, Port} -> Socket
    peer_to_socket = #{}

    % Map of ConnPid -> {IP, Port}
    conn_to_peer = #{},
    % Map of {IP, Port} -> ConnPid
    peer_to_conn = #{}

    % Check that we have a handler

    % Check that we have a handler and keypair

        KeyPair =:= undefined ->
            {stop, {error, no_keypair_provided}};

            % Open a listening socket
            ListenOpts = [
                binary,
                {packet, 0},
                {active, false},
                {reuseaddr, true}
            ],
            {ok, ListenSocket} = gen_tcp:listen(Port, ListenOpts),
            {ok, ListenPort} = inet:port(ListenSocket),

            % Start enoise_cable listener
            TcpOpts = [{reuseaddr, true}],
            case enoise_cable:listen(Port, TcpOpts) of
                {ok, ListenerPid} ->
                    {ok, ListenPort} = enoise_cable:port(ListenerPid),

            % Capture the correct process ID for the transport server
            TransportPid = self(),
            io:format("[Transport] Starting server on port ~p (pid: ~p)~n", [
                ListenPort, TransportPid
            ]),

                    % Capture the correct process ID for the transport server
                    TransportPid = self(),
                    io:format("[Transport] Starting encrypted server on port ~p (pid: ~p)~n", [
                        ListenPort, TransportPid
                    ]),

            % Start accepting connections in a separate process
            spawn_link(fun() -> accept_loop(ListenSocket, TransportPid) end),

                    % Start accepting connections in a separate process
                    spawn_link(fun() -> accept_loop(ListenerPid, KeyPair, TransportPid) end),

            % Initialize state
            {ok, #state{
                listen_socket = ListenSocket,
                listen_port = ListenPort,
                key_pair = KeyPair,
                event_handler = Handler,
                socket_to_peer = #{},
                peer_to_socket = #{}
            }}

                    % Initialize state
                    {ok, #state{
                        listener_pid = ListenerPid,
                        listen_port = ListenPort,
                        key_pair = KeyPair,
                        event_handler = Handler,
                        conn_to_peer = #{},
                        peer_to_conn = #{}
                    }};
                {error, Reason} ->
                    {stop, Reason}
            end

handle_call({dial, Host, Port}, _From, State) ->

handle_call({dial, Host, Port}, _From, State = #state{key_pair = KeyPair}) ->

    io:format("[Transport] Attempting to connect to ~p:~p~n", [ActualHost, Port]),

    io:format("[Transport] Attempting encrypted connection to ~p:~p~n", [ActualHost, Port]),

    spawn_link(fun() -> do_dial(ActualHost, Port, TransportPid) end),

    spawn_link(fun() -> do_dial(ActualHost, Port, KeyPair, TransportPid) end),

handle_call({send, Peer, Binary}, _From, State = #state{peer_to_socket = PtoS}) ->
    % Find socket by peer address directly
    case maps:get(Peer, PtoS, undefined) of

handle_call({send, Peer, Binary}, _From, State = #state{peer_to_conn = PtoC}) ->
    % Find connection pid by peer address directly
    case maps:get(Peer, PtoC, undefined) of

        Socket ->

        ConnPid ->

                "[Transport] Sending ~p bytes to ~p via socket ~p~n",
                [byte_size(Binary), Peer, Socket]

                "[Transport] Sending ~p bytes to ~p via encrypted connection ~p~n",
                [byte_size(Binary), Peer, ConnPid]

            Result = gen_tcp:send(Socket, Binary),

            Result = enoise_cable:send(ConnPid, Binary),

%% Handle new connection from dial operation

%% Handle new connection from dial operation or accept

    {new_connection, Socket, PeerAddr},
    State = #state{event_handler = Handler, socket_to_peer = StoP, peer_to_socket = PtoS}

    {new_connection, ConnPid, PeerAddr},
    State = #state{event_handler = Handler, conn_to_peer = CtoP, peer_to_conn = PtoC}

    io:format("[Transport] New connection established with ~p~n", [PeerAddr]),

    io:format("[Transport] New encrypted connection established with ~p (conn: ~p)~n", [
        PeerAddr, ConnPid
    ]),

    % Store mapping of Socket -> PeerAddr and PeerAddr -> Socket
    NewStoP = maps:put(Socket, PeerAddr, StoP),
    NewPtoS = maps:put(PeerAddr, Socket, PtoS),

    % Monitor the connection process so we know when it dies
    erlang:monitor(process, ConnPid),

    % Start a socket loop to handle incoming data
    TransportPid = self(),
    spawn_link(fun() -> socket_loop(Socket, PeerAddr, TransportPid) end),

    % Store mapping of ConnPid -> PeerAddr and PeerAddr -> ConnPid
    NewCtoP = maps:put(ConnPid, PeerAddr, CtoP),
    NewPtoC = maps:put(PeerAddr, ConnPid, PtoC),

    {noreply, State#state{socket_to_peer = NewStoP, peer_to_socket = NewPtoS}};
%% Handle incoming message from a peer
handle_info({peer_data, _Socket, PeerAddr, Data}, State = #state{event_handler = Handler}) ->
    io:format("[Transport] Received ~p bytes from ~p~n", [byte_size(Data), PeerAddr]),
    % Forward data to handler
    Handler ! {peerData, PeerAddr, Data},

    {noreply, State};
%% Handle peer disconnection

    {noreply, State#state{conn_to_peer = NewCtoP, peer_to_conn = NewPtoC}};
%% Handle incoming encrypted message from enoise_cable
handle_info({cable_transport, ConnPid, Data}, State = #state{event_handler = Handler, conn_to_peer = CtoP}) ->
    case maps:get(ConnPid, CtoP, undefined) of
        undefined ->
            io:format("[Transport] Received data from unknown connection ~p~n", [ConnPid]),
            {noreply, State};
        PeerAddr ->
            io:format("[Transport] Received ~p bytes from ~p~n", [byte_size(Data), PeerAddr]),
            % Forward data to handler
            Handler ! {peerData, PeerAddr, Data},
            {noreply, State}
    end;
%% Handle connection process termination

    {peer_closed, Socket, PeerAddr},

    {'DOWN', _Ref, process, ConnPid, _Reason},

        socket_to_peer = StoP,
        peer_to_socket = PtoS

        conn_to_peer = CtoP,
        peer_to_conn = PtoC

    io:format("[Transport] Connection closed by peer ~p~n", [PeerAddr]),
    % Clean up mappings
    NewStoP = maps:remove(Socket, StoP),
    NewPtoS = maps:remove(PeerAddr, PtoS),

    case maps:get(ConnPid, CtoP, undefined) of
        undefined ->
            io:format("[Transport] Unknown connection ~p terminated~n", [ConnPid]),
            {noreply, State};
        PeerAddr ->
            io:format("[Transport] Connection closed with peer ~p~n", [PeerAddr]),
            % Clean up mappings
            NewCtoP = maps:remove(ConnPid, CtoP),
            NewPtoC = maps:remove(PeerAddr, PtoC),

    % Notify handler of lost peer
    if
        PeerAddr =/= undefined -> Handler ! {peerLost, PeerAddr};
        true -> ok
    end,

            % Notify handler of lost peer
            Handler ! {peerLost, PeerAddr},

    {noreply, State#state{socket_to_peer = NewStoP, peer_to_socket = NewPtoS}};

            {noreply, State#state{conn_to_peer = NewCtoP, peer_to_conn = NewPtoC}}
    end;

terminate(_Reason, #state{listen_socket = ListenSocket}) ->
    gen_tcp:close(ListenSocket),

terminate(_Reason, #state{listener_pid = ListenerPid}) ->
    catch enoise_cable:close(ListenerPid),

accept_loop(ListenSocket, TransportPid) ->

accept_loop(ListenerPid, KeyPair, TransportPid) ->

        "[Transport] Waiting for connections on ~p (transport pid: ~p)~n",
        [ListenSocket, TransportPid]

        "[Transport] Waiting for encrypted connections (listener: ~p, transport: ~p)~n",
        [ListenerPid, TransportPid]

    case gen_tcp:accept(ListenSocket) of
        {ok, Socket} ->
            io:format("[Transport] Accepted new connection: ~p~n", [Socket]),
            {ok, {PeerIP, PeerPort}} = inet:peername(Socket),

    Opts = [{keypair, KeyPair}],
    case enoise_cable:accept(ListenerPid, Opts) of
        {ok, ConnPid} ->
            io:format("[Transport] Accepted new encrypted connection: ~p~n", [ConnPid]),
            % Set the controlling process to the transport gen_server
            % so it receives {cable_transport, ConnPid, Data} messages
            ok = enoise_cable:controlling_process(ConnPid, TransportPid),
            % Get the peer address from the connection
            {ok, {PeerIP, PeerPort}} = enoise_cable:peername(ConnPid),

            TransportPid ! {new_connection, Socket, PeerAddr},
            accept_loop(ListenSocket, TransportPid);

            io:format("[Transport] Peer address: ~p~n", [PeerAddr]),
            TransportPid ! {new_connection, ConnPid, PeerAddr},
            accept_loop(ListenerPid, KeyPair, TransportPid);

            accept_loop(ListenSocket, TransportPid)
    end.
%% Socket receive loop
socket_loop(Socket, PeerAddr, TransportPid) ->
    case gen_tcp:recv(Socket, 0) of
        {ok, Data} ->
            TransportPid ! {peer_data, Socket, PeerAddr, Data},
            socket_loop(Socket, PeerAddr, TransportPid);
        {error, closed} ->
            io:format("[Transport] Socket ~p closed by peer~n", [Socket]),
            TransportPid ! {peer_closed, Socket, PeerAddr};
        {error, Reason} ->
            io:format("[Transport] Socket error: ~p~n", [Reason]),
            TransportPid ! {peer_closed, Socket, PeerAddr}

            accept_loop(ListenerPid, KeyPair, TransportPid)

do_dial(Host, Port, TransportPid) ->
    case gen_tcp:connect(Host, Port, [binary, {packet, 0}, {active, false}]) of
        {ok, Socket} ->
            io:format("[Transport] Connected to ~p:~p~n", [Host, Port]),
            {ok, {PeerIP, PeerPort}} = inet:peername(Socket),
            PeerAddr = {PeerIP, PeerPort},
            % Transfer socket ownership to the transport gen_server before we exit
            % Otherwise the socket will be closed when this process terminates
            ok = gen_tcp:controlling_process(Socket, TransportPid),
            TransportPid ! {new_connection, Socket, PeerAddr},
            % The transport gen_server will spawn socket_loop when it handles {new_connection, ...}

do_dial(Host, Port, KeyPair, TransportPid) ->
    Opts = [{keypair, KeyPair}],
    case enoise_cable:connect(Host, Port, Opts) of
        {ok, ConnPid} ->
            io:format("[Transport] Encrypted connection established to ~p:~p (conn: ~p)~n", [
                Host, Port, ConnPid
            ]),
            % Set the controlling process to the transport gen_server
            % so it receives {cable_transport, ConnPid, Data} messages
            ok = enoise_cable:controlling_process(ConnPid, TransportPid),
            % Use Host/Port as the peer address since we don't have the actual remote address
            PeerAddr = {Host, Port},
            TransportPid ! {new_connection, ConnPid, PeerAddr},

    TransportKp = create_or_load_transport_keypair(StorePath),

        {key_pair, TransportKp},

create_or_load_transport_keypair(Location) ->
    Fname = filename:join(Location, "transport_secret"),
    case file:read_file(Fname) of
        %% load existing
        {ok, Content} when byte_size(Content) =:= 32 ->
            io:format("[Transport] Loaded existing Curve25519 keypair~n"),
            enoise_keypair:new(dh25519, Content);
        %% generate new keypair
        {error, enoent} ->
            Kp = enoise_keypair:new(dh25519),
            {kp, dh25519, Secret, _Public} = Kp,
            ok = file:write_file(Fname, Secret),
            ok = file:change_mode(Fname, 8#0400),
            io:format("[Transport] Created fresh Curve25519 keypair~n"),
            Kp
    end.

    port/1

    port/1,
    peername/1

%% @doc Get the peer address (IP, Port) from a connection
-spec peername(pid()) -> {ok, {inet:ip_address(), inet:port_number()}} | {error, term()}.
peername(ConnPid) ->
    gen_server:call(ConnPid, get_peername).

    io:format(user, "[enoise_cable CLIENT ~p] Connecting to ~p:~p...~n", [self(), Host, Port]),

            io:format(user, "[enoise_cable] TCP connect succeeded, starting handshake...~n", []),

                    io:format(user, "[enoise_cable] Client handshake complete~n", []),

                    io:format(user, "[enoise_cable] Client handshake failed: ~p~n", [Reason]),

            io:format(user, "[enoise_cable] TCP connect failed: ~p~n", [Reason]),

    io:format(user, "[enoise_cable SERVER ~p] New gen_server accepting TCP connection...~n", [
        self()
    ]),

            io:format(user, "[enoise_cable] TCP accept succeeded, setting socket opts...~n", []),

            io:format(user, "[enoise_cable] Starting handshake...~n", []),

                    io:format(user, "[enoise_cable] Handshake complete~n", []),
                    % We're already the controlling process since we did the accept in our process
                    io:format(user, "[enoise_cable] Replying to caller~n", []),
                    % Reply to the original caller

                    io:format(user, "[enoise_cable] Handshake failed: ~p~n", [Reason]),

    % enoise now handles cable framing (length + segmentation)
    io:format(user, "[enoise_cable] Sending message: ~p bytes~n", [byte_size(Message)]),
    case enoise:send(EConn, Message) of
        ok ->
            io:format(user, "[enoise_cable] Message sent~n", []),
            {reply, ok, State};
        {error, Reason} ->
            {reply, {error, Reason}, State}
    end;

    Res = enoise:send(EConn, Message),
    {reply, Res, State};

        {error, Reason} ->
            {reply, {error, Reason}, State}
    end;
handle_call(get_peername, _From, State = #state{mode = connection, socket = Socket}) ->
    case inet:peername(Socket) of
        {ok, {IP, Port}} ->
            {reply, {ok, {IP, Port}}, State};

    io:format(user, "[enoise_cable] Received complete message: ~p bytes~n", [byte_size(Data)]),

            io:format(user, "[enoise_cable] WARNING: EConn mismatch! Ignoring message.~n", []),