Package co.ankatech.ankasecure.sdk.model

Class EncryptResult

java.lang.Object

co.ankatech.ankasecure.sdk.model.EncryptResult

public final class EncryptResult
extends Object

Immutable result returned by encryption operations.

Value object returned by one of the following SDK operations:

• AuthenticatedSdk.encrypt(String, byte[])
• AuthenticatedSdk.encryptFile(String, java.nio.file.Path, java.nio.file.Path)
• AuthenticatedSdk.encryptFileStream(String, java.nio.file.Path, java.nio.file.Path)

This class encapsulates the full JWE produced by the ANKASecure platform when encrypting, in the serialization that carries every recipient. For a single-recipient key it is the RFC 7516 §7.1 Compact JWE; for a composite KEM key, whose result has one recipient per component, it is the §7.2 General JSON JWE (a JSON object with a recipients array), because Compact Serialization holds exactly one recipient. A Compact JWE is represented as five Base64URL-encoded segments separated by dots:

1. Protected Header: JSON object containing JWE metadata
2. Encrypted Key: the Data Encryption Key (DEK) encrypted
3. Initialization Vector (IV): random nonce for AEAD
4. Ciphertext: the encrypted file payload
5. Authentication Tag: ensures integrity and authenticity

Thread Safety

Instances are immutable and thread-safe. All fields are final and collections are unmodifiable. Instances can be safely shared across threads without synchronization.

Usage Example

 EncryptResult result = sdk.encrypt("my-key", data);

 // Access immutable data
 String jwe = result.getJweToken();
 Integer materialVersion = result.getMaterialVersion();

 // Inspect the key-material version that performed the operation
 if (materialVersion != null) {
     System.out.println("Encrypted with material version " + materialVersion);
 }

 // Check warnings
 if (result.getWarnings() != null) {
     result.getWarnings().forEach(System.out::println);
 }
 

Builder Pattern

Instances are created using the Builder pattern:

 EncryptResult result = EncryptResult.builder()
     .jweToken("eyJhbGc...")
     .keyRequested("my-key")
     .materialVersion(2)
     .algorithmUsed("ML-KEM-768")
     .addWarning("KEY_ROTATED")
     .build();
 

See Also:

• AuthenticatedSdk.encrypt(String, byte[])
• AuthenticatedSdk.encryptFile(String, java.nio.file.Path, java.nio.file.Path)
• AuthenticatedSdk.encryptFileStream(String, java.nio.file.Path, java.nio.file.Path)
• DecryptResult

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	EncryptResult.Builder	Builder for constructing immutable EncryptResult instances.

Method Summary

Modifier and Type	Method	Description
static EncryptResult.Builder	builder()	Creates a new builder for constructing EncryptResult instances.
String	getAlgorithmUsed()	Returns the catalogue algorithm of the key that performed this encryption (e.g.
String	getJweToken()	Returns the JWE emitted by the server: Compact for a single-recipient key, General JSON for a composite KEM key.
String	getKeyRequested()	Returns the key identifier originally supplied by the client.
Integer	getMaterialVersion()	Returns the key-material version (ank_kv) that performed the operation under the requested Stable KID; null when not resolvable (e.g. utility mode) — never 0.
List<CryptoWarning>	getWarnings()	Returns structured warnings encountered during the encryption operation.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getJweToken

public String getJweToken()

Returns the JWE emitted by the server: Compact for a single-recipient key, General JSON for a composite KEM key.

Returns:

non-null JWE string, Compact or General JSON

getKeyRequested

public String getKeyRequested()

Returns the key identifier originally supplied by the client.

Returns:

requested kid (may be null)

getMaterialVersion

public Integer getMaterialVersion()

Returns the key-material version (ank_kv) that performed the operation under the requested Stable KID; null when not resolvable (e.g. utility mode) — never 0.

Returns:

material version (may be null)

getAlgorithmUsed

public String getAlgorithmUsed()

Returns the catalogue algorithm of the key that performed this encryption (e.g. ML-KEM-768, RSA-3072, or a composite pairing such as X25519+ML-KEM-768).

Returns:

algorithm identifier (may be null)

getWarnings

public List<CryptoWarning> getWarnings()

Returns structured warnings encountered during the encryption operation.

Warnings are type-safe instances allowing pattern matching and programmatic handling:

 for (CryptoWarning warning : result.getWarnings()) {
     switch (warning) {
         case KeyExpirationWarning kew when kew.daysRemaining() <= 7 ->
             System.err.println("CRITICAL: " + kew.message());
         case UsageLimitWarning ulw ->
             logWarning(ulw.message(), ulw.recommendedAction());
         case GenericWarning gw ->
             System.out.println(gw.rawMessage());
     }
 }
 

The returned list is unmodifiable. Attempts to modify it will throw UnsupportedOperationException.

Returns:

unmodifiable list of warnings (null if no warnings, never empty if non-null)

builder

public static EncryptResult.Builder builder()

Creates a new builder for constructing EncryptResult instances.

Returns:

a new Builder instance