code: function contentEncryptGcm(aad, cek, cekEnc, plain, bits) {
    let iv = crypto.randomBytes(12);
    let cipher = crypto.createCipheriv(`id-aes${bits}-GCM`, cek, iv);
    cipher.setAutoPadding(false);
    cipher.setAAD(Buffer.from(aad));
    let enc = buf2b64url(Buffer.concat([cipher.update(plain), cipher.final()]));
    let tag = buf2b64url(cipher.getAuthTag());
    return `${aad}.${cekEnc}.${buf2b64url(iv)}.${enc}.${tag}`;
  }
docs: ===== A128GCM, A192GCM, A256GCM ============================================