Function decryptSecrets

packages/encryption/src/encryption.ts:245–256

(
  encryptedSecrets: Record<string, EncryptedEnvelope>,
  privateKeyPem: string | Buffer
)

 * Decrypt all encrypted secrets and return them as a plain Record<string, string>.
 */
export function decryptSecrets(
  encryptedSecrets: Record<string, EncryptedEnvelope>,
  privateKeyPem: string | Buffer
): Record<string, string> {
  const result: Record<string, string> = {};

  for (const [key, envelope] of Object.entries(encryptedSecrets)) {
    result[key] = decryptWithPrivateKey(envelope, privateKeyPem);
  }

  return result;
}

/**
 * Merge plaintext env vars with decrypted secrets.