#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub enum ChannelType {
    /// Short-lived channel that auto-closes after inactivity.
    Ephemeral {
        /// Seconds of inactivity before auto-close (default: 300).
        auto_close_secs: u64,
    },
    /// Long-lived channel with periodic heartbeats.
    Persistent {
        /// Seconds between heartbeats.
        heartbeat_interval: u64,
    },
    /// Pub/sub channel for one-to-many messaging.
    Broadcast {
        /// Maximum number of subscribers.
        max_subscribers: u32,
    },
    /// Payment channel with escrow for economic transactions.
    Payment {
        /// Escrow amount in micro-MINT.
        escrow_amount: u64,
    },
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub enum ChannelState {
    /// Initial state — channel created, handshake not started.
    Init,
    /// Challenge issued by the responder; awaiting signed response.
    ChallengeIssued {
        /// The 32-byte random challenge.
        challenge: [u8; 32],
    },
    /// Initiator has responded with an Ed25519 signature over the transcript.
    ///
    /// The 64-byte signature is stored (as bytes) so the responder can include
    /// it in audit logs and so future verification paths can re-check the proof.
    ChallengeResponded {
        /// The 64-byte Ed25519 signature from the initiator, serialized as bytes.
        signature: Vec<u8>,
    },
    /// Handshake confirmed by both parties.
    Confirmed,
    /// Channel is open and ready for message exchange.
    Open {
        /// Unix timestamp when the channel was opened.
        opened_at: u64,
    },
    /// Channel close has been requested.
    Closing {
        /// Unix timestamp when close was requested.
        close_requested_at: u64,
    },
    /// Channel is closed and no longer usable.
    Closed,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Channel {
/// Unique channel identifier (UUID v4).

pub channel_id: String,
/// The channel type and its parameters.

pub channel_type: ChannelType,
/// OAS DID of the channel initiator.

pub initiator_did: String,
/// OAS DID of the channel responder.

pub responder_did: String,
/// Source organization zone.

pub source_zone: String,
/// Target organization zone.

pub target_zone: String,
/// Current channel state.

pub state: ChannelState,
/// Unix timestamp when the channel was created.

pub created_at: u64,
/// Unix timestamp of the last activity on this channel.

pub last_activity: u64,
/// Number of messages sent on this channel.

pub messages_sent: u64,
/// Number of messages received on this channel.

pub messages_received: u64
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub enum HandshakeMessage {
    /// Step 1: Channel open request from the initiator.
    Request {
        /// Requested channel type.
        channel_type: ChannelType,
        /// OAS DID of the initiator.
        initiator_did: String,
        /// Source zone of the initiator.
        source_zone: String,
    },
    /// Step 2: Challenge from the responder.
    Challenge {
        /// 32-byte cryptographic random challenge.
        challenge: [u8; 32],
    },
    /// Step 3: Challenge response from the initiator.
    Response {
        /// 64-byte Ed25519 signature over the domain-separated transcript.
        ///
        /// Signed by the initiator's long-term Ed25519 key (resolved via DID).
        /// The responder verifies this against the initiator's published key.
        /// Serialized as bytes (Vec<u8>) because serde only derives [u8; N] for N <= 32.
        challenge_response: Vec<u8>,
        /// Key material for session key derivation.
        session_key_material: Vec<u8>,
    },
    /// Step 4: Confirmation from the responder.
    Confirm {
        /// Key material for session key derivation.
        session_key_material: Vec<u8>,
    },
    /// Step 5: Channel is now open.
    Open,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ChannelManager {

}

pub fn new() -> Self;

pub fn initiate(
        &mut self,
        channel_type: ChannelType,
        initiator_did: String,
        responder_did: String,
        source_zone: String,
        target_zone: String,
    ) -> Result<(String, HandshakeMessage), CzacError>;

pub fn handle_handshake(
        &mut self,
        channel_id: &str,
        message: HandshakeMessage,
    ) -> Result<Option<HandshakeMessage>, CzacError>;

pub fn handle_handshake_with_signing_key(
        &mut self,
        channel_id: &str,
        received_challenge: [u8; 32],
        signing_key: &SigningKey,
    ) -> Result<HandshakeMessage, CzacError>;

pub fn handle_handshake_with_verifying_key(
        &mut self,
        channel_id: &str,
        challenge: [u8; 32],
        challenge_response: Vec<u8>,
        verifying_key_bytes: &[u8; 32],
        session_key_material: Vec<u8>,
    ) -> Result<HandshakeMessage, CzacError>;

pub fn close(&mut self, channel_id: &str) -> Result<(), CzacError>;

pub fn get(&self, channel_id: &str) -> Option<&Channel>;

pub fn get_mut(&mut self, channel_id: &str) -> Option<&mut Channel>;

pub fn channels_for_zone_pair(&self, source: &str, target: &str) -> Vec<&Channel>;

pub fn cleanup_expired(&mut self, now: u64) -> Vec<String>;

pub fn len(&self) -> usize;

pub fn is_empty(&self) -> bool;

transcript = DOMAIN_TAG
             || channel_id || "\n"
             || source_zone || "\n"
             || target_zone || "\n"
             || challenge (32 bytes, raw)

pub fn build_handshake_transcript(
    channel_id: &str,
    source_zone: &str,
    target_zone: &str,
    challenge: &[u8; 32],
) -> Vec<u8>;

pub fn verify_handshake_signature(
    verifying_key_bytes: &[u8; 32],
    transcript: &[u8],
    signature_bytes: &[u8],
) -> Result<(), CzacError>;