cryptoishard

doc says it defaults to cbc, not sure about the kdf

You've somewhat rolled your own crypto. For instance, you've manually HMACed separately and appended it to the message, and you've chosen which encryption primitives to use. In this case, I don't see anything wrong (you've used encrypt-then-mac, which is the recommended way of doing it).

Another easy to make error would've been to use the same key for the MAC and the encryption. In this case, the library probably uses a unique salt everytime it generate a key from the passphrase, so you're fine there too.

In principle though, using a library like NaCL or Libsodium offers a high level "encrypt and sign" primitive and you should be using something like that to avoid getting anything wrong. There are lots of mistakes to be made.

libsodium is unfortunately a bit broken because the pw_hash functions (argon + scrypt) don't work in the browser.