Function decrypt

packages/security/src/encryption.ts:36–62

(encryptedValue: string, key: Buffer)

 * or when the GCM auth tag does not verify (tampered ciphertext, wrong key).
 */
export async function decrypt(encryptedValue: string, key: Buffer): Promise<{ decrypted: string }> {
  assertKey(key)

  const parts = encryptedValue.split(':')
  if (parts.length < 3) {
    throw new Error('Invalid encrypted value format. Expected "iv:encrypted:authTag"')
  }

  const ivHex = parts[0]
  const authTagHex = parts[parts.length - 1]
  const encrypted = parts.slice(1, -1).join(':')

  if (!ivHex || !authTagHex) {
    throw new Error('Invalid encrypted value format. Expected "iv:encrypted:authTag"')
  }

  const iv = Buffer.from(ivHex, 'hex')
  const authTag = Buffer.from(authTagHex, 'hex')

  const decipher = createDecipheriv('aes-256-gcm', key, iv, { authTagLength: 16 })
  decipher.setAuthTag(authTag)

  let decrypted = decipher.update(encrypted, 'hex', 'utf8')
  decrypted += decipher.final('utf8')

  return { decrypted }
}

function assertKey(key: Buffer): void {
  if (key.length !== 32) {