pub fn open_payload_with_wrapped(
payload: &EncryptedCommonsPayload,
recipient_secret: &[u8; 32],
wrapped_dek: &[u8],
) -> Result<Vec<u8>, String>Expand description
Open a payload directly from a recipient’s secret + the credential’s wrapped DEK. The end-to-end decrypt path: unwrap the sealed DEK, then open the payload. If the wrapped DEK is absent (revoked), the caller has nothing to pass here — that is the crypto-enforced revocation.