@lindorm/aes 0.7.2 → 0.8.0

package/dist/internal/utils/content-primitive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-primitive.d.ts","sourceRoot":"","sources":["../../../src/internal/utils/content-primitive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMpE,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,QAAQ,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,QAAQ,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAeF,eAAO,MAAM,oBAAoB,GAC/B,SAAS,2BAA2B,KACnC,sBAmBF,CAAC;AAOF,eAAO,MAAM,oBAAoB,GAAI,SAAS,2BAA2B,KAAG,MAY3E,CAAC"}

package/dist/internal/utils/content-primitive.js

@@ -0,0 +1,47 @@
+import { AesError } from "../../errors/index.js";
+import { decryptAes } from "./encryption.js";
+import { encryptAesContent } from "./encrypt-content.js";
+import { getEncryptionKey } from "./get-key/get-encryption-key.js";
+export const encryptContentDirect = (options) => {
+    const { aad, content, encryption, initialisationVector, kryptos } = options;
+    const keyResult = getEncryptionKey({ encryption, kryptos });
+    assertDirectKey(keyResult);
+    const result = encryptAesContent({
+        aad,
+        contentEncryptionKey: keyResult.contentEncryptionKey,
+        data: content,
+        encryption,
+        initialisationVector,
+    });
+    return {
+        ciphertext: result.content,
+        iv: result.initialisationVector,
+        tag: result.authTag,
+    };
+};
+export const decryptContentDirect = (options) => {
+    const { aad, ciphertext, encryption, initialisationVector, kryptos, tag } = options;
+    return decryptAes({
+        aad,
+        authTag: tag,
+        content: ciphertext,
+        contentType: "application/octet-stream",
+        encryption,
+        initialisationVector,
+        kryptos,
+    });
+};
+const assertDirectKey = (keyResult) => {
+    const wrapped = keyResult.publicEncryptionKey !== undefined ||
+        keyResult.publicEncryptionJwk !== undefined ||
+        keyResult.publicEncryptionIv !== undefined ||
+        keyResult.pbkdfSalt !== undefined;
+    if (wrapped) {
+        throw new AesError("Content primitive requires a direct key", {
+            code: "content_primitive_requires_direct_key",
+            title: "Content Primitive Requires Direct Key",
+            details: "encryptContent/decryptContent are the COSE_Encrypt0 (direct) seam and require the key to be used directly as the content-encryption key (a 'dir' oct key). Key-wrapping or key-agreement algorithms produce recipient material a header-less result cannot carry; use a wire format for those.",
+        });
+    }
+};
+//# sourceMappingURL=content-primitive.js.map

package/dist/internal/utils/content-primitive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-primitive.js","sourceRoot":"","sources":["../../../src/internal/utils/content-primitive.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAsCnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAoC,EACZ,EAAE;IAC1B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,eAAe,CAAC,SAAS,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,GAAG;QACH,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,IAAI,EAAE,OAAO;QACb,UAAU;QACV,oBAAoB;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,OAAO;QAC1B,EAAE,EAAE,MAAM,CAAC,oBAAoB;QAC/B,GAAG,EAAE,MAAM,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAoC,EAAU,EAAE;IACnF,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAEpF,OAAO,UAAU,CAAS;QACxB,GAAG;QACH,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,0BAA0B;QACvC,UAAU;QACV,oBAAoB;QACpB,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAKxB,EAAQ,EAAE;IACT,MAAM,OAAO,GACX,SAAS,CAAC,mBAAmB,KAAK,SAAS;QAC3C,SAAS,CAAC,mBAAmB,KAAK,SAAS;QAC3C,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAC1C,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC;IAEpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,yCAAyC,EAAE;YAC5D,IAAI,EAAE,uCAAuC;YAC7C,KAAK,EAAE,uCAAuC;YAC9C,OAAO,EACL,gSAAgS;SACnS,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC"}

package/dist/internal/utils/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../src/internal/utils/content.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEzE,eAAO,MAAM,oBAAoB,GAAI,SAAS,GAAG,KAAG,cAgBnD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,GAAG,EAAE,aAAa,cAAc,KAAG,MAgB3E,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,UAAU,GAAG,MAAM,EACxD,SAAS,MAAM,EACf,cAAa,cAA6B,KACzC,CAgBF,CAAC"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../src/internal/utils/content.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEzE,eAAO,MAAM,oBAAoB,GAAI,SAAS,GAAG,KAAG,cAoBnD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,GAAG,EAAE,aAAa,cAAc,KAAG,MAoB3E,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,UAAU,GAAG,MAAM,EACxD,SAAS,MAAM,EACf,cAAa,cAA6B,KACzC,CAoBF,CAAC"}

package/dist/internal/utils/content.js

@@ -11,7 +11,10 @@ export const calculateContentType = (content) => {
         return "application/json";
     }
     throw new AesError("Invalid content type", {
-        debug: { content, type: typeof content },
+        code: "invalid_content_type",
+        title: "Invalid Content Type",
+        details: "The content is not a supported type; expected a string, Buffer, array, boolean, number, or object.",
+        data: { type: typeof content },
     });
 };
 export const contentToBuffer = (content, contentType) => {
@@ -24,7 +27,10 @@ export const contentToBuffer = (content, contentType) => {
             return Buffer.from(content, "utf8");
         default:
             throw new AesError("Invalid content type", {
-                debug: { content, type: typeof content },
+                code: "invalid_content_type",
+                title: "Invalid Content Type",
+                details: "The content type is not a supported value for serialisation; expected application/json, application/octet-stream, or text/plain.",
+                data: { contentType, type: typeof content },
             });
     }
 };
@@ -38,7 +44,10 @@ export const parseContent = (content, contentType = "text/plain") => {
             return content.toString("utf8");
         default:
             throw new AesError("Unexpected content type", {
-                debug: { contentType },
+                code: "unexpected_content_type",
+                title: "Unexpected Content Type",
+                details: "The content type is not a supported value for parsing; expected application/json, application/octet-stream, or text/plain.",
+                data: { contentType },
             });
     }
 };

package/dist/internal/utils/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/internal/utils/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAY,EAAkB,EAAE;IACnE,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;QACzC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,OAAO,EAAE;KACzC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAY,EAAE,WAA2B,EAAU,EAAE;IACnF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAEtD,KAAK,0BAA0B;YAC7B,OAAO,OAAO,CAAC;QAEjB,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtC;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,OAAO,EAAE;aACzC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAe,EACf,cAA8B,YAAY,EACvC,EAAE;IACL,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;QAEnD,KAAK,0BAA0B;YAC7B,OAAO,OAAY,CAAC;QAEtB,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAM,CAAC;QAEvC;YACE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;gBAC5C,KAAK,EAAE,EAAE,WAAW,EAAE;aACvB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/internal/utils/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAY,EAAkB,EAAE;IACnE,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;QACzC,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EACL,oGAAoG;QACtG,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,OAAO,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAY,EAAE,WAA2B,EAAU,EAAE;IACnF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAEtD,KAAK,0BAA0B;YAC7B,OAAO,OAAO,CAAC;QAEjB,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtC;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,sBAAsB;gBAC7B,OAAO,EACL,kIAAkI;gBACpI,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,OAAO,EAAE;aAC5C,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAe,EACf,cAA8B,YAAY,EACvC,EAAE;IACL,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;QAEnD,KAAK,0BAA0B;YAC7B,OAAO,OAAY,CAAC;QAEtB,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAM,CAAC;QAEvC;YACE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;gBAC5C,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EACL,4HAA4H;gBAC9H,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}

package/dist/internal/utils/data/auth-tag-hmac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-tag-hmac.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag-hmac.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAkBpF,eAAO,MAAM,iBAAiB,GAAI,8DAM/B,iBAAiB,KAAG,MAiBtB,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,uEAO/B,iBAAiB,KAAG,IAYtB,CAAC"}
+{"version":3,"file":"auth-tag-hmac.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag-hmac.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAwBpF,eAAO,MAAM,iBAAiB,GAAI,8DAM/B,iBAAiB,KAAG,MAiBtB,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,uEAO/B,iBAAiB,KAAG,IAiBtB,CAAC"}

package/dist/internal/utils/data/auth-tag-hmac.js

@@ -9,7 +9,12 @@ const shaHash = (encryption) => {
         case "A256CBC-HS512":
             return "SHA512";
         default:
-            throw new AesError("Unexpected algorithm");
+            throw new AesError("Unexpected algorithm", {
+                code: "unsupported_encryption",
+                title: "Unsupported Encryption",
+                details: "HMAC auth tag generation is only supported for AES-CBC-HMAC variants (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512).",
+                data: { encryption },
+            });
     }
 };
 export const createHmacAuthTag = ({ aad, content, hashKey, initialisationVector, encryption, }) => {
@@ -35,6 +40,10 @@ export const assertHmacAuthTag = ({ aad, authTag, content, encryption, hashKey,
     });
     if (generated.length === authTag.length && timingSafeEqual(generated, authTag))
         return;
-    throw new AesError("Auth tag verification failed");
+    throw new AesError("Auth tag verification failed", {
+        code: "auth_tag_verification_failed",
+        title: "Auth Tag Verification Failed",
+        details: "The computed HMAC auth tag does not match the provided tag, indicating tampered or corrupted ciphertext.",
+    });
 };
 //# sourceMappingURL=auth-tag-hmac.js.map

package/dist/internal/utils/data/auth-tag-hmac.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-tag-hmac.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag-hmac.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGpD,MAAM,OAAO,GAAG,CAAC,UAA6B,EAAgB,EAAE;IAC9D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAChC,GAAG,EACH,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,UAAU,GACQ,EAAU,EAAE;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAKtD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAChC,GAAG,EACH,OAAO,EACP,OAAO,EACP,UAAU,EACV,OAAO,EACP,oBAAoB,GACF,EAAQ,EAAE;IAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,GAAG;QACH,OAAO;QACP,UAAU;QACV,OAAO;QACP,oBAAoB;KACrB,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO;IAEvF,MAAM,IAAI,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AACrD,CAAC,CAAC"}
+{"version":3,"file":"auth-tag-hmac.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag-hmac.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGpD,MAAM,OAAO,GAAG,CAAC,UAA6B,EAAgB,EAAE;IAC9D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAElB;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EACL,qHAAqH;gBACvH,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAChC,GAAG,EACH,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,UAAU,GACQ,EAAU,EAAE;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAKtD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAChC,GAAG,EACH,OAAO,EACP,OAAO,EACP,UAAU,EACV,OAAO,EACP,oBAAoB,GACF,EAAQ,EAAE;IAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,GAAG;QACH,OAAO;QACP,UAAU;QACV,OAAO;QACP,oBAAoB;KACrB,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO;IAEvF,MAAM,IAAI,QAAQ,CAAC,8BAA8B,EAAE;QACjD,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,8BAA8B;QACrC,OAAO,EACL,0GAA0G;KAC7G,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/internal/utils/data/auth-tag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-tag.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGpF,eAAO,MAAM,aAAa,GAAI,sEAO3B,iBAAiB,KAAG,MAqBtB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,iFAQ3B,iBAAiB,KAAG,IA4BtB,CAAC"}
+{"version":3,"file":"auth-tag.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAIpF,eAAO,MAAM,aAAa,GAAI,sEAO3B,iBAAiB,KAAG,MA2BtB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,iFAQ3B,iBAAiB,KAAG,IAyCtB,CAAC"}

package/dist/internal/utils/data/auth-tag.js

@@ -1,10 +1,10 @@
 import { AesError } from "../../../errors/index.js";
+import { getAesDescriptor } from "../aes-descriptor.js";
 import { assertHmacAuthTag, createHmacAuthTag } from "./auth-tag-hmac.js";
 export const createAuthTag = ({ aad, encryption, cipher, content, hashKey, initialisationVector, }) => {
-    switch (encryption) {
-        case "A128CBC-HS256":
-        case "A192CBC-HS384":
-        case "A256CBC-HS512":
+    const { mode } = getAesDescriptor(encryption);
+    switch (mode) {
+        case "cbc-hmac":
             return createHmacAuthTag({
                 aad,
                 content,
@@ -12,22 +12,29 @@ export const createAuthTag = ({ aad, encryption, cipher, content, hashKey, initi
                 hashKey,
                 initialisationVector,
             });
-        case "A128GCM":
-        case "A192GCM":
-        case "A256GCM":
+        case "gcm":
+        case "ccm":
             return cipher.getAuthTag();
         default:
-            throw new AesError("Unexpected algorithm");
+            throw new AesError("Unexpected algorithm", {
+                code: "unsupported_encryption",
+                title: "Unsupported Encryption",
+                details: "Auth tag creation is only supported for AES-CBC-HMAC, AES-GCM, and AES-CCM variants.",
+                data: { encryption },
+            });
     }
 };
 export const assertAuthTag = ({ aad, authTag, content, hashKey, decipher, encryption, initialisationVector, }) => {
     if (!authTag) {
-        throw new AesError("Auth tag is missing");
+        throw new AesError("Auth tag is missing", {
+            code: "missing_auth_tag",
+            title: "Missing Auth Tag",
+            details: "Authenticated decryption requires an auth tag to verify ciphertext integrity, but none was provided.",
+        });
     }
-    switch (encryption) {
-        case "A128CBC-HS256":
-        case "A192CBC-HS384":
-        case "A256CBC-HS512":
+    const { mode } = getAesDescriptor(encryption);
+    switch (mode) {
+        case "cbc-hmac":
             assertHmacAuthTag({
                 aad,
                 authTag,
@@ -37,13 +44,17 @@ export const assertAuthTag = ({ aad, authTag, content, hashKey, decipher, encryp
                 initialisationVector,
             });
             return;
-        case "A128GCM":
-        case "A192GCM":
-        case "A256GCM":
+        case "gcm":
+        case "ccm":
             decipher.setAuthTag(authTag);
             return;
         default:
-            throw new AesError("Unexpected algorithm");
+            throw new AesError("Unexpected algorithm", {
+                code: "unsupported_encryption",
+                title: "Unsupported Encryption",
+                details: "Auth tag verification is only supported for AES-CBC-HMAC, AES-GCM, and AES-CCM variants.",
+                data: { encryption },
+            });
     }
 };
 //# sourceMappingURL=auth-tag.js.map

package/dist/internal/utils/data/auth-tag.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-tag.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC5B,GAAG,EACH,UAAU,EACV,MAAM,EACN,OAAO,EACP,OAAO,EACP,oBAAoB,GACF,EAAU,EAAE;IAC9B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,iBAAiB,CAAC;gBACvB,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,oBAAoB;aACrB,CAAC,CAAC;QAEL,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAQ,MAAoB,CAAC,UAAU,EAAE,CAAC;QAE5C;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC5B,GAAG,EACH,OAAO,EACP,OAAO,EACP,OAAO,EACP,QAAQ,EACR,UAAU,EACV,oBAAoB,GACF,EAAQ,EAAE;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,iBAAiB,CAAC;gBAChB,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,oBAAoB;aACrB,CAAC,CAAC;YACH,OAAO;QAET,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACX,QAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO;QAET;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"auth-tag.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/auth-tag.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC5B,GAAG,EACH,UAAU,EACV,MAAM,EACN,OAAO,EACP,OAAO,EACP,oBAAoB,GACF,EAAU,EAAE;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,iBAAiB,CAAC;gBACvB,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,oBAAoB;aACrB,CAAC,CAAC;QAGL,KAAK,KAAK,CAAC;QACX,KAAK,KAAK;YACR,OAAQ,MAAoB,CAAC,UAAU,EAAE,CAAC;QAE5C;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EACL,sFAAsF;gBACxF,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC5B,GAAG,EACH,OAAO,EACP,OAAO,EACP,OAAO,EACP,QAAQ,EACR,UAAU,EACV,oBAAoB,GACF,EAAQ,EAAE;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE;YACxC,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,kBAAkB;YACzB,OAAO,EACL,sGAAsG;SACzG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,iBAAiB,CAAC;gBAChB,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,oBAAoB;aACrB,CAAC,CAAC;YACH,OAAO;QAKT,KAAK,KAAK,CAAC;QACX,KAAK,KAAK;YACP,QAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO;QAET;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EACL,0FAA0F;gBAC5F,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}

package/dist/internal/utils/data/get-initialisation-vector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-initialisation-vector.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/get-initialisation-vector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,eAAO,MAAM,uBAAuB,GAAI,YAAY,iBAAiB,KAAG,MAiBvE,CAAC"}
+{"version":3,"file":"get-initialisation-vector.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/get-initialisation-vector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAS1D,eAAO,MAAM,uBAAuB,GAAI,YAAY,iBAAiB,KAAG,MACrB,CAAC"}

package/dist/internal/utils/data/get-initialisation-vector.js

@@ -1,19 +1,4 @@
 import { randomBytes } from "crypto";
-import { AesError } from "../../../errors/index.js";
-export const getInitialisationVector = (encryption) => {
-    switch (encryption) {
-        case "A128CBC-HS256":
-        case "A192CBC-HS384":
-        case "A256CBC-HS512":
-            return randomBytes(16);
-        case "A128GCM":
-        case "A192GCM":
-        case "A256GCM":
-            return randomBytes(12);
-        default:
-            throw new AesError("Unexpected algorithm", {
-                debug: { encryption },
-            });
-    }
-};
+import { getAesDescriptor } from "../aes-descriptor.js";
+export const getInitialisationVector = (encryption) => randomBytes(getAesDescriptor(encryption).ivBytes);
 //# sourceMappingURL=get-initialisation-vector.js.map

package/dist/internal/utils/data/get-initialisation-vector.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-initialisation-vector.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/get-initialisation-vector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,UAA6B,EAAU,EAAE;IAC/E,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;QAEzB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;QAEzB;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;gBACzC,KAAK,EAAE,EAAE,UAAU,EAAE;aACtB,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"get-initialisation-vector.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/get-initialisation-vector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAOxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,UAA6B,EAAU,EAAE,CAC/E,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC"}

package/dist/internal/utils/data/split-content-encryption-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"split-content-encryption-key.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/split-content-encryption-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,KAAK,MAAM,GAAG;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAqBF,eAAO,MAAM,yBAAyB,GACpC,YAAY,iBAAiB,EAC7B,sBAAsB,MAAM,KAC3B,MAmBF,CAAC"}
+{"version":3,"file":"split-content-encryption-key.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/data/split-content-encryption-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,KAAK,MAAM,GAAG;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,YAAY,iBAAiB,EAC7B,sBAAsB,MAAM,KAC3B,MAwBF,CAAC"}

package/dist/internal/utils/data/split-content-encryption-key.js

@@ -1,30 +1,20 @@
 import { AesError } from "../../../errors/index.js";
-const encryptionKeyLength = (encryption) => {
-    switch (encryption) {
-        case "A128CBC-HS256":
-        case "A128GCM":
-            return 16;
-        case "A192CBC-HS384":
-        case "A192GCM":
-            return 24;
-        case "A256CBC-HS512":
-        case "A256GCM":
-            return 32;
-        default:
-            throw new AesError("Unexpected algorithm");
-    }
-};
+import { getAesDescriptor } from "../aes-descriptor.js";
 export const splitContentEncryptionKey = (encryption, contentEncryptionKey) => {
-    const keyLength = encryptionKeyLength(encryption);
-    if (encryption.includes("CBC")) {
-        const hashKey = contentEncryptionKey.subarray(0, keyLength);
-        const encryptionKey = contentEncryptionKey.subarray(keyLength);
+    const { cipherKeyBytes, mode } = getAesDescriptor(encryption);
+    if (mode === "cbc-hmac") {
+        const hashKey = contentEncryptionKey.subarray(0, cipherKeyBytes);
+        const encryptionKey = contentEncryptionKey.subarray(cipherKeyBytes);
         return { encryptionKey, hashKey };
     }
-    const encryptionKey = contentEncryptionKey.subarray(0, keyLength);
-    const hashKey = contentEncryptionKey.subarray(keyLength);
+    const encryptionKey = contentEncryptionKey.subarray(0, cipherKeyBytes);
+    const hashKey = contentEncryptionKey.subarray(cipherKeyBytes);
     if (hashKey.length) {
-        throw new AesError("Unexpected hash key");
+        throw new AesError("Unexpected hash key", {
+            code: "unexpected_hash_key",
+            title: "Unexpected Hash Key",
+            details: "AEAD encryption (GCM/CCM) uses the full content encryption key for encryption and must not leave any leftover hash key octets.",
+        });
     }
     return { encryptionKey, hashKey };
 };

package/dist/internal/utils/data/split-content-encryption-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"split-content-encryption-key.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/split-content-encryption-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOpD,MAAM,mBAAmB,GAAG,CAAC,UAA6B,EAAgB,EAAE;IAC1E,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC;QAEZ,KAAK,eAAe,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC;QAEZ,KAAK,eAAe,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC;QAEZ;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAA6B,EAC7B,oBAA4B,EACpB,EAAE;IACV,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAGD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC"}
+{"version":3,"file":"split-content-encryption-key.js","sourceRoot":"","sources":["../../../../src/internal/utils/data/split-content-encryption-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAOxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAA6B,EAC7B,oBAA4B,EACpB,EAAE;IACV,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE9D,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAExB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAGD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAE9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE;YACxC,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EACL,gIAAgI;SACnI,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC"}

package/dist/internal/utils/diffie-hellman/diffie-hellman-key-wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diffie-hellman-key-wrap.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman-key-wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAO/C,eAAO,MAAM,oCAAoC,GAAI,0BAGlD,gBAAgB,KAAG,eAyBrB,CAAC;AAEF,eAAO,MAAM,oCAAoC,GAAI,iGAMlD,iBAAiB,KAAG,gBAoBtB,CAAC"}
+{"version":3,"file":"diffie-hellman-key-wrap.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman-key-wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAO/C,eAAO,MAAM,oCAAoC,GAAI,0BAGlD,gBAAgB,KAAG,eAyBrB,CAAC;AAEF,eAAO,MAAM,oCAAoC,GAAI,iGAMlD,iBAAiB,KAAG,gBAyBtB,CAAC"}

package/dist/internal/utils/diffie-hellman/diffie-hellman-key-wrap.js

@@ -29,7 +29,11 @@ export const getDiffieHellmanKeyWrapEncryptionKey = ({ encryption, kryptos, }) =
 };
 export const getDiffieHellmanKeyWrapDecryptionKey = ({ kryptos, publicEncryptionJwk, publicEncryptionIv, publicEncryptionKey, publicEncryptionTag, }) => {
     if (!publicEncryptionKey) {
-        throw new AesError("Missing publicEncryptionKey");
+        throw new AesError("Missing publicEncryptionKey", {
+            code: "missing_public_encryption_key",
+            title: "Missing Public Encryption Key",
+            details: "ECDH key-wrap decryption requires the wrapped content encryption key, but it was not provided.",
+        });
     }
     const sharedSecret = calculateSharedSecret({ kryptos, publicEncryptionJwk });
     const { derivedKey } = concatKdf({

package/dist/internal/utils/diffie-hellman/diffie-hellman-key-wrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"diffie-hellman-key-wrap.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman-key-wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,EACnD,UAAU,EACV,OAAO,GACU,EAAmB,EAAE;IACtC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC;QAClD,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;QAC/E,oBAAoB;QACpB,OAAO;QACP,gBAAgB,EAAE,UAAU;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,EACnD,OAAO,EACP,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACD,EAAoB,EAAE;IACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE7E,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC;QAClD,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;QACf,gBAAgB,EAAE,UAAU;QAC5B,OAAO;QACP,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"diffie-hellman-key-wrap.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman-key-wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,EACnD,UAAU,EACV,OAAO,GACU,EAAmB,EAAE;IACtC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC;QAClD,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;QAC/E,oBAAoB;QACpB,OAAO;QACP,gBAAgB,EAAE,UAAU;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,EACnD,OAAO,EACP,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACD,EAAoB,EAAE;IACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE;YAChD,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,+BAA+B;YACtC,OAAO,EACL,gGAAgG;SACnG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE7E,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC;QAClD,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;QACf,gBAAgB,EAAE,UAAU;QAC5B,OAAO;QACP,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/internal/utils/diffie-hellman/diffie-hellman.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diffie-hellman.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAK/C,eAAO,MAAM,6BAA6B,GAAI,0BAG3C,gBAAgB,KAAG,eAcrB,CAAC;AAEF,eAAO,MAAM,6BAA6B,GAAI,+CAI3C,iBAAiB,KAAG,gBAkBtB,CAAC"}
+{"version":3,"file":"diffie-hellman.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAK/C,eAAO,MAAM,6BAA6B,GAAI,0BAG3C,gBAAgB,KAAG,eAcrB,CAAC;AAEF,eAAO,MAAM,6BAA6B,GAAI,+CAI3C,iBAAiB,KAAG,gBA2BtB,CAAC"}

package/dist/internal/utils/diffie-hellman/diffie-hellman.js

@@ -18,10 +18,18 @@ export const getDiffieHellmanEncryptionKey = ({ encryption, kryptos, }) => {
 };
 export const getDiffieHellmanDecryptionKey = ({ encryption, kryptos, publicEncryptionJwk, }) => {
     if (!KryptosKit.isEc(kryptos) && !KryptosKit.isOkp(kryptos)) {
-        throw new AesError("Invalid kryptos type");
+        throw new AesError("Invalid kryptos type", {
+            code: "invalid_kryptos_type",
+            title: "Invalid Kryptos Type",
+            details: "ECDH-ES decryption requires an EC or OKP Kryptos key type.",
+        });
     }
     if (!publicEncryptionJwk) {
-        throw new AesError("Missing publicEncryptionJwk");
+        throw new AesError("Missing publicEncryptionJwk", {
+            code: "missing_public_encryption_jwk",
+            title: "Missing Public Encryption JWK",
+            details: "ECDH-ES decryption requires the sender's ephemeral public JWK, but it was not provided.",
+        });
     }
     const sharedSecret = calculateSharedSecret({ kryptos, publicEncryptionJwk });
     const keyLength = calculateContentEncryptionKeySize(encryption);

package/dist/internal/utils/diffie-hellman/diffie-hellman.js.map

@@ -1 +1 @@
-{"version":3,"file":"diffie-hellman.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,EAC5C,UAAU,EACV,OAAO,GACU,EAAmB,EAAE;IACtC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,UAAU;QACrB,SAAS;QACT,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,UAAU;QAChC,mBAAmB;KACpB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,EAC5C,UAAU,EACV,OAAO,EACP,mBAAmB,GACD,EAAoB,EAAE;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,UAAU;QACrB,SAAS;QACT,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC,CAAC"}
+{"version":3,"file":"diffie-hellman.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/diffie-hellman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,EAC5C,UAAU,EACV,OAAO,GACU,EAAmB,EAAE;IACtC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,UAAU;QACrB,SAAS;QACT,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB,EAAE,UAAU;QAChC,mBAAmB;KACpB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,EAC5C,UAAU,EACV,OAAO,EACP,mBAAmB,GACD,EAAoB,EAAE;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;YACzC,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE;YAChD,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,+BAA+B;YACtC,OAAO,EACL,yFAAyF;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,UAAU;QACrB,SAAS;QACT,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC,CAAC"}

package/dist/internal/utils/diffie-hellman/shared-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-secret.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/shared-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EAId,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,KAAK,cAAc,GAAG;IACpB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,4BAA4B,GAAG,IAAI,CACtC,iBAAiB,EACjB,SAAS,GAAG,qBAAqB,CAClC,CAAC;AAoBF,eAAO,MAAM,oBAAoB,GAAI,SAAS,QAAQ,KAAG,cA+BxD,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,mCAGnC,4BAA4B,KAAG,MAgCjC,CAAC"}
+{"version":3,"file":"shared-secret.d.ts","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/shared-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EAId,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,KAAK,cAAc,GAAG;IACpB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,4BAA4B,GAAG,IAAI,CACtC,iBAAiB,EACjB,SAAS,GAAG,qBAAqB,CAClC,CAAC;AAyBF,eAAO,MAAM,oBAAoB,GAAI,SAAS,QAAQ,KAAG,cAyCxD,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,mCAGnC,4BAA4B,KAAG,MA+CjC,CAAC"}

package/dist/internal/utils/diffie-hellman/shared-secret.js

@@ -14,17 +14,29 @@ const generateKryptos = (kryptos) => {
             curve: kryptos.curve,
         });
     }
-    throw new AesError("Invalid kryptos type");
+    throw new AesError("Invalid kryptos type", {
+        code: "invalid_kryptos_type",
+        title: "Invalid Kryptos Type",
+        details: "Generating an ephemeral key for ECDH requires an EC or OKP Kryptos key type.",
+    });
 };
 export const generateSharedSecret = (kryptos) => {
     const pek = generateKryptos(kryptos);
     const der = kryptos.export("der");
     const sender = pek.export("der");
     if (!sender.privateKey) {
-        throw new AesError("Sender private key is missing");
+        throw new AesError("Sender private key is missing", {
+            code: "missing_private_key",
+            title: "Missing Private Key",
+            details: "The generated ephemeral sender key has no private key to compute the ECDH shared secret.",
+        });
     }
     if (!der.publicKey) {
-        throw new AesError("Kryptos public key is missing");
+        throw new AesError("Kryptos public key is missing", {
+            code: "missing_public_key",
+            title: "Missing Public Key",
+            details: "The recipient Kryptos key has no public key to compute the ECDH shared secret.",
+        });
     }
     const sharedSecret = diffieHellman({
         privateKey: createPrivateKey({
@@ -46,7 +58,11 @@ export const generateSharedSecret = (kryptos) => {
 };
 export const calculateSharedSecret = ({ kryptos, publicEncryptionJwk, }) => {
     if (!publicEncryptionJwk) {
-        throw new AesError("Missing publicEncryptionJwk");
+        throw new AesError("Missing publicEncryptionJwk", {
+            code: "missing_public_encryption_jwk",
+            title: "Missing Public Encryption JWK",
+            details: "Calculating the ECDH shared secret requires the sender's ephemeral public JWK, but it was not provided.",
+        });
     }
     const pek = KryptosKit.from.jwk({
         alg: kryptos.algorithm,
@@ -56,10 +72,18 @@ export const calculateSharedSecret = ({ kryptos, publicEncryptionJwk, }) => {
     const der = kryptos.export("der");
     const receiver = pek.export("der");
     if (!der.privateKey) {
-        throw new AesError("Kryptos private key is missing");
+        throw new AesError("Kryptos private key is missing", {
+            code: "missing_private_key",
+            title: "Missing Private Key",
+            details: "The recipient Kryptos key has no private key to compute the ECDH shared secret during decryption.",
+        });
     }
     if (!receiver.publicKey) {
-        throw new AesError("Receiver public key is missing");
+        throw new AesError("Receiver public key is missing", {
+            code: "missing_public_key",
+            title: "Missing Public Key",
+            details: "The sender's ephemeral JWK produced no public key to compute the ECDH shared secret during decryption.",
+        });
     }
     return diffieHellman({
         privateKey: createPrivateKey({

package/dist/internal/utils/diffie-hellman/shared-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-secret.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/shared-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAcvD,MAAM,eAAe,GAAG,CAAC,OAAiB,EAAY,EAAE;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,EAAE,OAAO,CAAC,SAA2B;YAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAA4B;YAC/C,KAAK,EAAE,OAAO,CAAC,KAAoB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiB,EAAkB,EAAE;IACxE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC;QACjC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,GAAG,EAAE,MAAM,CAAC,UAAU;YACtB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC;QACF,SAAS,EAAE,eAAe,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO;QACL,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,OAAO,EACP,mBAAmB,GACU,EAAU,EAAE;IACzC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,OAAO,CAAC,SAAS;QACtB,GAAG,EAAE,KAAK;QACV,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,gBAAgB,CAAC;YAC3B,GAAG,EAAE,GAAG,CAAC,UAAU;YACnB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC;QACF,SAAS,EAAE,eAAe,CAAC;YACzB,GAAG,EAAE,QAAQ,CAAC,SAAS;YACvB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"shared-secret.js","sourceRoot":"","sources":["../../../../src/internal/utils/diffie-hellman/shared-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAcvD,MAAM,eAAe,GAAG,CAAC,OAAiB,EAAY,EAAE;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,EAAE,OAAO,CAAC,SAA2B;YAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAA4B;YAC/C,KAAK,EAAE,OAAO,CAAC,KAAoB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;QACzC,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EACL,8EAA8E;KACjF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiB,EAAkB,EAAE;IACxE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE;YAClD,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE;YAClD,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EACL,gFAAgF;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC;QACjC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,GAAG,EAAE,MAAM,CAAC,UAAU;YACtB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC;QACF,SAAS,EAAE,eAAe,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO;QACL,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,OAAO,EACP,mBAAmB,GACU,EAAU,EAAE;IACzC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE;YAChD,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,+BAA+B;YACtC,OAAO,EACL,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,OAAO,CAAC,SAAS;QACtB,GAAG,EAAE,KAAK;QACV,GAAG,mBAAmB;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE;YACnD,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EACL,mGAAmG;SACtG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE;YACnD,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EACL,wGAAwG;SAC3G,CAAC,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,gBAAgB,CAAC;YAC3B,GAAG,EAAE,GAAG,CAAC,UAAU;YACnB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC;QACF,SAAS,EAAE,eAAe,CAAC;YACzB,GAAG,EAAE,QAAQ,CAAC,SAAS;YACvB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/internal/utils/encoded-aes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encoded-aes.d.ts","sourceRoot":"","sources":["../../../src/internal/utils/encoded-aes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AA2C9E,eAAO,MAAM,sBAAsB,GAAI,MAAM,mBAAmB,KAAG,MAwClE,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,SAAS,MAAM,KAAG,yBA+EvD,CAAC"}
+{"version":3,"file":"encoded-aes.d.ts","sourceRoot":"","sources":["../../../src/internal/utils/encoded-aes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAgC9E,eAAO,MAAM,sBAAsB,GAAI,MAAM,mBAAmB,KAAG,MAwClE,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,SAAS,MAAM,KAAG,yBA6GvD,CAAC"}

package/dist/internal/utils/encoded-aes.js

@@ -1,18 +1,9 @@
 import { B64 } from "@lindorm/b64";
 import { AesError } from "../../errors/AesError.js";
+import { getAesDescriptor } from "./aes-descriptor.js";
 import { buildAesHeader, computeAad, decodeAesHeader, headerToDecryptionParams, } from "./aes-header.js";
-const getIvSize = (enc) => (enc.includes("GCM") ? 12 : 16);
-const getTagSize = (enc) => {
-    if (enc.includes("GCM"))
-        return 16;
-    if (enc === "A128CBC-HS256")
-        return 16;
-    if (enc === "A192CBC-HS384")
-        return 24;
-    if (enc === "A256CBC-HS512")
-        return 32;
-    return 16;
-};
+const getIvSize = (enc) => getAesDescriptor(enc).ivBytes;
+const getTagSize = (enc) => getAesDescriptor(enc).tagBytes;
 export const createEncodedAesString = (data) => {
     const header = buildAesHeader({
         algorithm: data.algorithm,
@@ -46,12 +37,20 @@ export const parseEncodedAesString = (encoded) => {
     const buffer = B64.toBuffer(encoded, "b64u");
     let offset = 0;
     if (offset + 2 > buffer.length) {
-        throw new AesError("Unexpected end of encoded AES data: missing header length");
+        throw new AesError("Unexpected end of encoded AES data: missing header length", {
+            code: "malformed_encoded_data",
+            title: "Malformed Encoded Data",
+            details: "The encoded AES buffer ended before the 2-byte header length prefix could be read.",
+        });
     }
     const headerJsonLength = buffer.readUInt16BE(offset);
     offset += 2;
     if (offset + headerJsonLength > buffer.length) {
-        throw new AesError("Unexpected end of encoded AES data: header exceeds buffer");
+        throw new AesError("Unexpected end of encoded AES data: header exceeds buffer", {
+            code: "malformed_encoded_data",
+            title: "Malformed Encoded Data",
+            details: "The declared header length extends beyond the end of the encoded AES buffer.",
+        });
     }
     const headerJsonBytes = buffer.subarray(offset, offset + headerJsonLength);
     offset += headerJsonLength;
@@ -60,27 +59,43 @@ export const parseEncodedAesString = (encoded) => {
     const params = headerToDecryptionParams(decodedHeader);
     const aad = computeAad(headerB64);
     if (offset + 2 > buffer.length) {
-        throw new AesError("Unexpected end of encoded AES data: missing CEK length");
+        throw new AesError("Unexpected end of encoded AES data: missing CEK length", {
+            code: "malformed_encoded_data",
+            title: "Malformed Encoded Data",
+            details: "The encoded AES buffer ended before the 2-byte content encryption key length prefix could be read.",
+        });
     }
     const cekLength = buffer.readUInt16BE(offset);
     offset += 2;
     let publicEncryptionKey;
     if (cekLength > 0) {
         if (offset + cekLength > buffer.length) {
-            throw new AesError("Unexpected end of encoded AES data: CEK exceeds buffer");
+            throw new AesError("Unexpected end of encoded AES data: CEK exceeds buffer", {
+                code: "malformed_encoded_data",
+                title: "Malformed Encoded Data",
+                details: "The declared content encryption key length extends beyond the end of the encoded AES buffer.",
+            });
         }
         publicEncryptionKey = buffer.subarray(offset, offset + cekLength);
         offset += cekLength;
     }
     const ivSize = getIvSize(params.encryption);
     if (offset + ivSize > buffer.length) {
-        throw new AesError("Unexpected end of encoded AES data: IV exceeds buffer");
+        throw new AesError("Unexpected end of encoded AES data: IV exceeds buffer", {
+            code: "malformed_encoded_data",
+            title: "Malformed Encoded Data",
+            details: "The encoded AES buffer is too short to contain the initialisation vector required by the encryption algorithm.",
+        });
     }
     const initialisationVector = buffer.subarray(offset, offset + ivSize);
     offset += ivSize;
     const tagSize = getTagSize(params.encryption);
     if (offset + tagSize > buffer.length) {
-        throw new AesError("Unexpected end of encoded AES data: tag exceeds buffer");
+        throw new AesError("Unexpected end of encoded AES data: tag exceeds buffer", {
+            code: "malformed_encoded_data",
+            title: "Malformed Encoded Data",
+            details: "The encoded AES buffer is too short to contain the authentication tag required by the encryption algorithm.",
+        });
     }
     const authTag = buffer.subarray(offset, offset + tagSize);
     offset += tagSize;