`gj4dZddlmZddlZddlZddZddZy)zHAES-256-GCM utilities for QQBot scan-to-configure credential decryption.) annotationsNcntjtjdj S)a Generate a 256-bit random AES key and return it as base64. The key is passed to ``create_bind_task`` so the server can encrypt the bot's *client_secret* before returning it. Only this CLI holds the key, ensuring the secret never travels in plaintext. )base64 b64encodeosurandomdecodeQ/root/.hermes/venv/lib/python3.12/site-packages/gateway/platforms/qqbot/crypto.pygenerate_bind_keyr s&   BJJrN + 2 2 44r cddlm}tj|}tj|}|dd}|dd}||}|j ||d}|j dS)uDecrypt a base64-encoded AES-256-GCM ciphertext. Ciphertext layout (after base64-decoding):: IV (12 bytes) ‖ ciphertext (N bytes) ‖ AuthTag (16 bytes) Args: encrypted_base64: The ``bot_encrypt_secret`` value from ``poll_bind_result``. key_base64: The base64 AES key generated by :func:`generate_bind_key`. Returns: The decrypted *client_secret* as a UTF-8 string. r)AESGCMN zutf-8)+cryptography.hazmat.primitives.ciphers.aeadrr b64decodedecryptr ) encrypted_base64 key_base64rkeyrawivciphertext_with_tagaesgcm plaintexts r decrypt_secretrsm C   : &C   + ,C SbBbc( C[Fr#6=I   G $$r )returnstr)rrrrrr)__doc__ __future__rrrrrr r r r"sN" 5%r