Function decrypt

packages/shared/crypto.ts:52–77

(
  ciphertext: string,
  key: string
)

 * Returns the original compressed base64url string.
 */
export async function decrypt(
  ciphertext: string,
  key: string
): Promise<string> {
  const combined = base64urlToBytes(ciphertext);
  const rawKey = base64urlToBytes(key);

  const iv = combined.slice(0, 12);
  const encrypted = combined.slice(12);

  const cryptoKey = await crypto.subtle.importKey(
    'raw',
    rawKey.buffer as ArrayBuffer,
    { name: 'AES-GCM', length: 256 },
    false,
    ['decrypt']
  );

  const decrypted = await crypto.subtle.decrypt(
    { name: 'AES-GCM', iv },
    cryptoKey,
    encrypted
  );

  return new TextDecoder().decode(decrypted);
}

// --- Helpers ---