src/lib/server/auth/decode-path.ts

/**
 * Decode a URL pathname the way SvelteKit does before matching routes: every
 * segment between literal `%25` sequences is decoded, so `/%61dmin` becomes
 * `/admin`. Throws `URIError` on a malformed escape sequence.
 */
export function decodePathname(pathname: string): string {
	return pathname.split('%25').map(decodeURIComponent).join('%25');
}