Add zip-free decrypt + re-wrap primitives for decomposed results

[chrisbendel]

Card 71 needs researchers to decrypt shared results without re-encryption. This adds the primitives the re-wrap flow depends on:

• crypto.ts: unwrapAesKey (exposes the raw AES bytes), wrapAesKey (re-wrap a file's key for another recipient), decryptFileBody, and decryptFile (zip-free single-file decrypt returning {contents, rawAesKey}).
• reader.ts: ResultsReader gains extractFilesWithKeys (returns each file's raw AES key for re-wrapping) and an additionalKeys override map, letting a recipient absent from the original manifest (e.g. a researcher granted access later) decrypt the same ciphertext through the normal fingerprint path.

ResultsReader/ResultsWriter are refactored onto these primitives with no behavior change. Wrap/unwrap, standalone decrypt, and the researcher override-key re-wrap round-trip are covered by crypto.test.ts.

[Copilot]

Pull request overview

Adds lower-level crypto primitives to support zip-free decryption and AES key re-wrapping (so new recipients can decrypt existing encrypted results without re-encrypting file bodies), and refactors the existing zip-based ResultsReader/ResultsWriter to use those primitives. Also introduces pnpm overrides to bump a few dependency versions.

Changes:

• Add job-results/crypto.ts with unwrapAesKey, wrapAesKey, decryptFileBody, and decryptFile (returns { contents, rawAesKey }).
• Refactor ResultsReader/ResultsWriter onto the new crypto primitives and add “override keys” support for recipients not present in the original manifest.
• Add vitest coverage for wrap/unwrap, standalone decrypt, and the re-wrap override flow; update pnpm overrides/lockfile.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Adds dependency overrides for esbuild, vite, and ws.
pnpm-lock.yaml	Lockfile updates reflecting the new overrides and resolved versions.
job-results/writer.ts	Uses wrapAesKey primitive instead of an in-class RSA wrap helper; clarifies AES-CBC rationale.
job-results/reader.ts	Uses unwrapAesKey + decryptFileBody, adds extractFilesWithKeys and additionalKeys override support.
job-results/index.ts	Re-exports the new job-results/crypto API surface.
job-results/crypto.ts	New module containing unwrap/wrap and zip-free decrypt primitives.
job-results/crypto.test.ts	New tests for wrap/unwrap, decryptFile, and researcher override-key re-wrap flow.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.