@spec decrypt_from_sender(pid(), String.t(), binary(), atom()) ::
  {:ok, binary()} | {:error, term()}

Decrypts an incoming message.

@spec decrypt_from_sender_sync(
  any(),
  any(),
  String.t(),
  binary(),
  atom() | String.t()
) ::
  {:ok, binary(), any()} | {:error, term()}

Decrypts an incoming message without GenServer calls (safe inside Session handlers).

@spec encrypt_for_recipient(pid(), String.t(), binary()) ::
  {:ok, binary(), :prekey | :whisper} | {:error, term()}

Encrypts a message for a recipient.

Will fetch prekeys and create a session if needed. Returns the encrypted payload and whether it's a prekey message.

@spec encrypt_for_recipient_sync(any(), any(), String.t(), binary(), map()) ::
  {:ok, binary(), :prekey | :whisper, any()} | {:error, term()}

Encrypts a message for a recipient (synchronous version - no GenServer calls).

This avoids deadlock when called from within a GenServer handle_call.

@spec pad_message(binary()) :: binary()

Pads plaintext according to WhatsApp's padding scheme.

WhatsApp uses PKCS7-like padding with random suffix to obscure message length.

@spec unpad_message(binary()) :: binary()

Unpads a decrypted message.