+ Gb]cs*^RIt^RIHt^RIHtHt^RIHtHt^RIHtH t ^RIH t H t ^RI H t ^RIHtR ]!R R R R4R ]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!RR R R4R]!R R R R4R!]!R"R R R4R#]!R$R R R4/ t.R)Ot!R%R&]4t]P&t]P(t]P*t]P,t!R'R(4tR#)*iN)common) JWException JWKeyNotFound)JWSEHeaderParameterJWSEHeaderRegistry)base64url_decodebase64url_encode) json_decode json_encode)JWA)JWKSetalgZ AlgorithmFTenczEncryption AlgorithmzipzCompression AlgorithmZjkuz JWK Set URLZjwkz JSON Web KeykidzKey IDZx5uz X.509 URLZx5czX.509 Certificate ChainZx5tz"X.509 Certificate SHA-1 Thumbprintzx5t#S256z$X.509 Certificate SHA-256 ThumbprintZtypZTypeZctyz Content TypecritZCriticalcs:aa]tRt^1toRtRV3RlltRtVtV;t#)InvalidJWEDatazjInvalid JWE Object. This exception is raised when the JWE Object is invalid and/or improperly formatted. cs<RpV'dTpMRpV'dVR\V4,, p\\V`V4R#)Nz!Unknown Data Verification Failurez {%s})ZstrZsuperr__init__)selfZmessageZ exceptionZmsg __class__s&&& 1/usr/lib/python3.14/site-packages/jwcrypto/jwe.pyrZInvalidJWEData.__init__8s: C5C  7S^+ +C nd,S1)NN) __name__ __module__ __qualname____firstlineno____doc__r__static_attributes____classdictcell__Z __classcell__)r __classdict__s@@rrr1s 22rrcsa]tRt^JtoRtRRltRtRt]R4t ] PR4t Rt RR lt R t R tRR ltRR ltRtRtRtRtRRlt]R4t]R4t]R4tRtRtRtRtVtR#)JWEz?JSON Web Encryption object This object represent a JWE token. Nc  sRVn/VnRVn\\4VnV'dVP P V4Ve4\V\4'dWnMVPR4VnRVn RVn V'dW@PR&V'd<\V\4'd \V4pM \V4W PR&V'd<\V\4'd \V4pM \V4W0PR&V'dWPnV'dVPWgR7R#V'd \!R4hR#)aCreates a JWE token. :param plaintext(bytes): An arbitrary plaintext to be encrypted. :param protected: A JSON string with the protected header. :param unprotected: A JSON string with the shared unprotected header. :param aad(bytes): Arbitrary additional authenticated data :param algs: An optional list of allowed algorithms :param recipient: An optional, default recipient key :param header: An optional header for the default recipient :param header_registry: Optional additions to the header registry Nutf-8aad protected unprotected)headerz-Header is allowed only with default recipient) _allowed_algsobjects plaintextrJWEHeaderRegistryheader_registryupdate isinstancebytesencodecek decryptlogdictrr add_recipient ValueError) rr'r"r#r!algsZ recipientr$r)s &&&&&&&&&rrZ JWE.__init__Ps" 12CD   ' ' 8  )U++!*!*!1!1'!: "%LL  )T**' 2 I&(1LL % +t,,)+6 K(*5LL ' !%     y  8 LM MrcVP;'g\pW9d \R4h\P!V4#zAlgorithm not allowed)r%default_allowed_algsInvalidJWEOperationr Z keymgmt_algrZnameZallowed&& r _jwa_keymgmtZJWE._jwa_keymgmts7$$<<(<  %&=> >t$$rcr4r5)r%r6r7r Zencryption_algr8r9r_jwa_encZ JWE._jwa_encs9$$<<(<  %&=> >!!$''rc sJVP'd VP#\#)zjAllowed algorithms. The list of allowed algorithms. Can be changed by setting a list of algorithm names. )r%r6r&r allowed_algsJWE.allowed_algss"    %% %' 'rcsT\V\4'g \R4hWnR#)zAllowed Algs must be a listN)r+listZ TypeErrorr%)rr3s&&rr>r?s!$%%9: :!rcs\VP44FpW29gK \RV,4h VPV4V#)zDuplicate header: "%s")r@keysrr*)rZh1Zh2ks&&& r_merge_headersZJWE._merge_headerss>bggiAw$%=%ABB! "  rcsJ/pRVP9d.\VPR,4pVPW#4pRVP9d.\VPR,4pVPW$4pV'd\V4pVPW%4pV#)r"r#)r&rrC)rr$jhphZuhZrh&& r_get_jose_headerZJWE._get_jose_headers  $,, &T\\+67B$$R,B DLL (T\\-89B$$R,B V$B$$R,B rcsVPRR4pVf \R4hVPV4pVPRR4pVf \R4hVPV4pW53#)r NzMissing "alg" from headersr zMissing "enc" from headers)getrr:r;)rrDZalgnamer Zencnamer rFr_get_alg_enc_from_headersZJWE._get_alg_enc_from_headerssi&&% ? !=> >(&&% ? !=> >mmG$xrcs,\VPPRR44pRVP9d+VR\VPR,4,, pVPR4pVPRR4pVR8Xd%\P !VP 4^R pMVfVP pM \R4hVPVPWF4wrxp WpPR &WPR &WPR &R#) r"r!.r r NDEFUnknown compressioniv ciphertexttagi) rr&rHr-zlibcompressr'r2Zencryptr.) rr r rDr!rRdatarNrOrPs &&&& r_encryptZ JWE._encryptst||// R@A DLL 3)$,,u*=>> >Cjj!66%& u ==026D  >>D23 3!kk$((C> T%/ \"! Urc sVPf \R4h\VP\4'g \R4h\V\4'd \ V4pVP V4pVPV4wrE/pV'dW&R&VPWPVPV4pVR,Vn RV9d VR,VR&RV9dB\VPRR44pVPWR,4p \ V 4VR&R VP9dVPWEV4R VP9d%VPR ,P!V4R#RVP9gRVP9d.VPR &/p RVP9dVPP#R4V R&RVP9dVPP#R4V R&VPR ,P!V 4VPR ,P!V4R#VPP%V4R#) aEncrypt the plaintext with the given key. :param key: A JWK key or password of appropriate type for the 'alg' provided in the JOSE Headers. :param header: A JSON string representing the per-recipient header. :raises ValueError: if the plaintext is missing or not of type bytes. :raises ValueError: if the compression type is unknown. :raises InvalidJWAAlgorithm: if the 'alg' provided in the JOSE headers is missing or unknown, or otherwise not implemented. NzMissing plaintextzPlaintext must be 'bytes'r$r.Zek encrypted_keyz{}rO recipients)r'r2r+r,r0rrGrIZwrap wrap_key_sizer.rrHrCr&rTappendZpopr*) rkeyr$rDr r recZwrappedhZnhZns &&& rr1ZJWE.add_recipients >> !01 1$..%0089 9 fd # # (F  " "6 *11"5 "M((3 1 1488R@5> 7?#*4=C w CGGHd34A$$Q(9:B'OCM t|| + MM#B ' 4<< ' LL & - -c 2  ,DLL0H)+DLL &A$,,.%)\\%5%5o%F/"4<<'"ll..x8( LL & - -a 0 LL & - -c 2 LL   $rc  sRVP9d \R4hV'EdRF%pW P9gK\RV,4h RVP9d \R4h\VPR,4pRFpWC9gK \RV,4h R VP9dH\VPR ,4^8wd \R 4hVPR ,^,pM VPpR V9d\VR ,4p\VPR,4pVP Wc4p\ V4VPR&VP 4pVPV4wrVPWV4VR R P\VPR,4\VPR R44\VPR,4\VPR,4\VPR,4.4#VPp R\V R,4R\V R,4R\VPR,4/p RV 9d\V R,4V R&RV 9d\V R,4V R&RV 9d\V R,4V R&R V 9di.V R &V R ,FUp/p R V9d\VR ,4V R &R V9d\VR ,4V R &V R ,PV 4KW M8R V 9d\V R ,4V R &R V 9d\V R ,4V R &\ V 4#)aSerializes the object into a JWE token. :param compact(boolean): if True generates the compact representation, otherwise generates a standard JSON format. :raises InvalidJWEOperation: if the object cannot be serialized with the compact representation and `compact` is True. :raises InvalidJWEOperation: if no recipients have been added to the object. :return: A json formatted string or a compact representation string :rtype: `str` rONo available ciphertextr!r#z9Can't use compact encoding when the '%s' parameter is setr"z4Can't use compact encoding without protected headersz@Can't use compact encoding, '%s' must be in the protected headerrVzInvalid number of recipientsr$rKrUrJrNrP)r!r#)r r ) r&r7rlenrCrrGrIrTZjoinrrHrX) rZcompactZinvalidrEZrequiredrZr[ZnphrDr r objes && r serializeZ JWE.serialize s> t|| +%&?@ @ 7/ll*-!#*+,,0 $,,.)JLL!k!:; ,H)1/19:;;!- t||+t||L12a7-.LMMll<03ll3  H . k!:;))!0,7,< [)**,99"= c+M88-dll;.GH-cggor.JK-dll4.@A-dll<.HI-dll5.AB DE E ,,C!1#l2C!D)#d)4*4<<+>?ACc!#3C 4D#EK #%0]1C%DM"|-c%j9E s"$&L!|,,CA&#-,S-AB/*3&1#h-&@(  %,,Q/-#c)(_)=>(s?$/H $>CMs# #rcsVFZpW P9d\RV,4hVPV,P'dKJ\RV,4h R#)zUnknown critical header: "%s"z!Unsupported critical header: "%s"N)r)rZ supported)rrrBr9r _check_critZJWE._check_critasZA,,,$%Dq%HII++A.888(*023*455 rc sVPW2PWE4p VPWWxV 4p VPP R4WnV #)Success)ZunwraprWdecryptr/rXr.) rr r rYZenckeyr$r!rNrOrPr.rSs &&&&&&&&&& r_unwrap_decryptZJWE._unwrap_decryptjsFjj//@{{3RS9 y) rc sVPVPRR44pVPVPR/44VFApW@P9gKVPP W@4'dK8\ R4h VP VPRR44pVPVPRR44p\VPPRR44pRVP9d+VR \VPR,4,, pVPR 4p\V\4'EdTpR VP9dXVPVPR ,4p V 'g,\R P!VPR ,44hT pVFyp VP#WVV VPR R4W7VPR,VPR,VPR,4 p VP$P'R4M RVP$9d \R4hMZVP#WVVVPR R4W7VPR,VPR,VPR,4 p VPRR4pVR8Xd.\.P0!X \.P2)4VnR#Vf X VnR#\7R4h \(dap T PR T P+44p TP$P'RP!T \-T 444Rp ? EKRp ? ii;i)r$NrzFailed header checkr r r"rJr!rKr rzKey ID {} not in key setrUrrNrOrPrbzKey [{}] failed: [{}]zNo working key found in key setr rLrM)rGrHrar)Z check_headerrr:r;rr&r-r+r jose_headerZget_keysrZformatrdr/rX ExceptionZ thumbprintreprrQZ decompressZ MAX_WBITSr'r2)rrYZpperDZhdrr r r!rAZkid_keysrBrSr_ZkeyidrRs&&& r_decryptZ JWE._decryptss  " "3778T#: ; +,C***++88CC()>?? ud 34mmBFF5$/0t||// R@A DLL 3)$,,u*=>> >Cjj! c6 " "D(((<<(8(8(?@'(B(I(I(,(8(8(?)ABB <//!030M02d9K04 \0J04 U0C ED OO**95/#$EFF0''#(+(E(*d1C(, \(B(, U(; =D 66%& u !__TDNN?CDN  !DN23 3)!<EE%8EOO**+B+I+I+0$q',;<<> "')-doo)>"?@ @!E!!]33%) OO**>DG+CDDE Aa//!%J&&~Q'?@@ As2C %D( D%AD  D%( F3AE;;Fc s&/VnRVnRVn/p\V4p\ VR,4VR&\ VR,4VR&\ VR,4VR&RV9d'\ VR,4pVP R4VR&RV9d\ VR,4VR&RV9d\ VR,4VR&R V9di.VR &VR ,FUp/pR V9d\ VR ,4VR &R V9d\ VR ,4VR &VR ,PV4KW M8R V9d\ VR ,4VR &R V9d\ VR ,4VR &W0nT'dTPT4R#R# \dpTPR 4p\T4^8wd \4Th\ T^,4pTP R4TR&\ T^,4p T R 8wd\ T^,4TR &\ T^,4TR&\ T^,4TR&\ T^,4TR&Rp?LRp?ii;i \dp\R\T44ThRp?ii;i)adDeserialize a JWE token. NOTE: Destroys any current status and tries to import the raw JWE provided. If a key is provided a decryption step will be attempted after the object is successfully deserialized. :param raw_jwe: a 'raw' JWE token (JSON Encoded or Compact notation) string. :param key: A (:class:`jwcrypto.jwk.JWK`) decryption key, or a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed by the 'kid' header or (deprecated) a string containing a password (optional). :raises InvalidJWEData: if the raw object is an invalid JWE token. :raises InvalidJWEOperation: if the decryption fails. NrNrOrPr"r r#r!rVrUr$rKrzInvalid format)r&r'r.rrZdecoderrXr2Zsplitr]rrfrgrc) rZraw_jwerYZoZdjweZprZr_ZcZekeys &&& r deserializeZJWE.deserializesm(  . C( 2"7+*4:6$"24 3E"F,+DK8%$&(k):;A%&XXg%6AkN D('24 3F'GAm$D=/U  r7a<%&AB B rc s6V!4pVPV4V#)zCreates a JWE object from a serialized JWE token. :param token: A string with the json or compat representation of the token. :raises InvalidJWEData: if the raw object is an invalid JWE token. :return: A JWE token :rtype: JWE )ri)ZclsZtokenr^r9rfrom_jose_tokenZJWE.from_jose_token1se  rcsD\V\4'gR#VP4VP48H# \dZRTP/pTP TP 4RTP/pTP TP 4Y#8Hu#i;i)Fr')r+rr`rfr'r*r&)rZotherZaZbs&& r__eq__Z JWE.__eq__Bs%%% >>#u'88 8 dnn-A HHT\\ "eoo.A HHU]] #6M  s ;A!BBcsfVP4# \dTP4u#i;iN)r`rf__repr__r<r=r__str__Z JWE.__str__Ns/ #>># # #==? " #s 00csRVP4 R2# \d\TP4pTPP R4pTPP R4pTPP R4pTP pRT R2RT R2,RT R2,R T R T R 2,u#i;i) zJWE.from_json_token("z")r"r#r!zJWE(plaintext=z, z protected=z unprotected=zaad=z, algs=Z))r`rfrgr'r&rHr%)rr'r"r#r!r3s& rrnZ JWE.__repr__Ts .*4>>+;*ZsetterrCrGrIrTr1r`rardrhrcrirjreZ classmethodrkrlrornrr)rs@rrrJs /Nb% (  ( (""   "&5%nV$p5:4x'@RJX   # . .rr)zRSA-OAEPz RSA-OAEP-256ZA128KWZA192KWZA256KWZdirzECDH-ESzECDH-ES+A128KWzECDH-ES+A192KWzECDH-ES+A256KWZ A128GCMKWZ A192GCMKWZ A256GCMKWzPBES2-HS256+A128KWzPBES2-HS384+A192KWzPBES2-HS512+A256KWz A128CBC-HS256z A192CBC-HS384z A256CBC-HS512ZA128GCMZA192GCMZA256GCM)rQZjwcryptorZjwcrypto.commonrrrrrrrrZ jwcrypto.jwar Z jwcrypto.jwkr r(r6rZInvalidCEKeyLengthZInvalidJWEKeyLengthZInvalidJWEKeyTyper7rrrrrpsm 6C>4  {E4 > 5udD I 6tT J }eUD A ~ueT B xd ; {E5$ ? 8% M CU$d ,#$J$)5$8 vudD 9 ~udD A  D$ ="* %!2[2&..00,,00V.V.r