alphaidea-shield 0.1.0__tar.gz

alphaidea_shield-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

alphaidea_shield-0.1.0/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: alphaidea-shield
+Version: 0.1.0
+Summary: A lightweight encryption and decryption library for Python.
+Author: Vincent
+License-Expression: MIT
+License-File: LICENSE
+Requires-Dist: cryptography>=44
+Requires-Python: >=3.11
+Project-URL: Homepage, https://github.com/alphaidea/shield-python
+Project-URL: Repository, https://github.com/alphaidea/shield-python
+Project-URL: Issues, https://github.com/alphaidea/shield-python/issues
+Description-Content-Type: text/markdown
+
+# Shield
+
+A cryptography library for Python 3.11 and later that interoperates with [Go Shield](https://github.com/alphaidea/shield).
+
+Install with `uv add alphaidea-shield`.
+
+- AES-GCM and RSA-OAEP encryption, with hybrid encryption for larger messages.
+- RSA-PSS signing and verification.
+- Argon2id password hashing and TOTP authentication.
+- SHA-256 checksums.
+- HMAC-SHA256 computation and verification for bytes, plus stream computation.
+- Cryptographically secure random bytes and URL-safe tokens.
+- HKDF-SHA256 key derivation.
+
+```python
+import shield
+
+key = shield.random_bytes(32)
+ciphertext = shield.aes_encrypt(key, b"hello")
+plaintext = shield.aes_decrypt(key, ciphertext)
+```

alphaidea_shield-0.1.0/README.md

@@ -0,0 +1,21 @@
+# Shield
+
+A cryptography library for Python 3.11 and later that interoperates with [Go Shield](https://github.com/alphaidea/shield).
+
+Install with `uv add alphaidea-shield`.
+
+- AES-GCM and RSA-OAEP encryption, with hybrid encryption for larger messages.
+- RSA-PSS signing and verification.
+- Argon2id password hashing and TOTP authentication.
+- SHA-256 checksums.
+- HMAC-SHA256 computation and verification for bytes, plus stream computation.
+- Cryptographically secure random bytes and URL-safe tokens.
+- HKDF-SHA256 key derivation.
+
+```python
+import shield
+
+key = shield.random_bytes(32)
+ciphertext = shield.aes_encrypt(key, b"hello")
+plaintext = shield.aes_decrypt(key, ciphertext)
+```

alphaidea_shield-0.1.0/pyproject.toml

@@ -0,0 +1,24 @@
+[project]
+name = "alphaidea-shield"
+version = "0.1.0"
+description = "A lightweight encryption and decryption library for Python."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+dependencies = ["cryptography>=44"]
+
+[[project.authors]]
+name = "Vincent"
+
+[project.urls]
+Homepage = "https://github.com/alphaidea/shield-python"
+Repository = "https://github.com/alphaidea/shield-python"
+Issues = "https://github.com/alphaidea/shield-python/issues"
+
+[build-system]
+requires = ["uv_build>=0.13.7,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.build-backend]
+module-name = "shield"

alphaidea_shield-0.1.0/pyproject.toml.orig

@@ -0,0 +1,26 @@
+[project]
+name = "alphaidea-shield"
+version = "0.1.0"
+description = "A lightweight encryption and decryption library for Python."
+readme = "README.md"
+authors = [
+    { name = "Vincent" }
+]
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+dependencies = [
+    "cryptography>=44",
+]
+
+[project.urls]
+Homepage = "https://github.com/alphaidea/shield-python"
+Repository = "https://github.com/alphaidea/shield-python"
+Issues = "https://github.com/alphaidea/shield-python/issues"
+
+[build-system]
+requires = ["uv_build>=0.13.7,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.build-backend]
+module-name = "shield"

alphaidea_shield-0.1.0/src/shield/__init__.py

@@ -0,0 +1,51 @@
+"""Python APIs compatible with the Go Shield library."""
+
+from . import aes as aes, argon2id as argon2id, rsa as rsa, totp as totp
+from ._utilities import (
+    hkdf_sha256 as hkdf_sha256,
+    hmac_sha256 as hmac_sha256,
+    hmac_sha256_stream as hmac_sha256_stream,
+    hmac_sha256_verify as hmac_sha256_verify,
+    random_bytes as random_bytes,
+    random_token as random_token,
+    sha256 as sha256,
+    sha256_stream as sha256_stream,
+)
+from .aes import (
+    decrypt as aes_decrypt,
+    decrypt_string as aes_decrypt_string,
+    encrypt as aes_encrypt,
+    encrypt_string as aes_encrypt_string,
+    gcm_decrypt as gcm_decrypt,
+    gcm_decrypt_string as gcm_decrypt_string,
+    gcm_encrypt as gcm_encrypt,
+    gcm_encrypt_string as gcm_encrypt_string,
+)
+from .argon2id import (
+    Options as Argon2idOptions,
+    hash as argon2id_hash,
+    verify as argon2id_verify,
+)
+from .rsa import (
+    decrypt_hybrid as rsa_decrypt_hybrid,
+    decrypt_hybrid_string as rsa_decrypt_hybrid_string,
+    decrypt_string as rsa_decrypt_string,
+    encrypt_hybrid as rsa_encrypt_hybrid,
+    encrypt_hybrid_string as rsa_encrypt_hybrid_string,
+    encrypt_string as rsa_encrypt_string,
+    generate_key as rsa_generate_key,
+    parse_private_key as rsa_parse_private_key,
+    parse_public_key as rsa_parse_public_key,
+    sign as rsa_sign,
+    sign_string as rsa_sign_string,
+    verify as rsa_verify,
+    verify_string as rsa_verify_string,
+)
+from .totp import (
+    Algorithm as TOTPAlgorithm,
+    Options as TOTPOptions,
+    generate as totp_generate,
+    generate_secret as totp_generate_secret,
+    uri as totp_uri,
+    verify as totp_verify,
+)

alphaidea_shield-0.1.0/src/shield/_encoding.py

@@ -0,0 +1,17 @@
+import base64
+import binascii
+
+
+def encode_base64(data: bytes) -> str:
+    return base64.b64encode(data).decode("ascii")
+
+
+def decode_base64(data: str, prefix: str = "") -> bytes:
+    if not data.startswith(prefix):
+        raise ValueError("unsupported ciphertext version")
+    encoded = data[len(prefix):].replace("\r", "").replace("\n", "")
+    return base64.b64decode(encoded, validate=True)
+
+
+def decode_hex(data: str) -> bytes:
+    return binascii.unhexlify(data)

alphaidea_shield-0.1.0/src/shield/_utilities.py

@@ -0,0 +1,62 @@
+import hashlib
+import hmac
+import secrets
+from typing import BinaryIO, Protocol
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from ._encoding import decode_hex
+
+
+class _Digest(Protocol):
+    def update(self, data: bytes, /) -> None: ...
+    def hexdigest(self) -> str: ...
+
+
+def _digest_stream(reader: BinaryIO, digest: _Digest) -> str:
+    while chunk := reader.read(65536):
+        digest.update(chunk)
+    return digest.hexdigest()
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def sha256_stream(reader: BinaryIO) -> str:
+    return _digest_stream(reader, hashlib.sha256())
+
+
+def hmac_sha256(key: bytes, data: bytes) -> str:
+    return hmac.digest(key, data, "sha256").hex()
+
+
+def hmac_sha256_verify(key: bytes, data: bytes, encoded: str) -> bool:
+    if len(encoded) != 64:
+        raise ValueError("HMAC-SHA256 must contain 64 hexadecimal characters")
+    return hmac.compare_digest(hmac.digest(key, data, "sha256"), decode_hex(encoded))
+
+
+def hmac_sha256_stream(key: bytes, reader: BinaryIO) -> str:
+    return _digest_stream(reader, hmac.new(key, digestmod="sha256"))
+
+
+def random_bytes(length: int) -> bytes:
+    if length <= 0:
+        raise ValueError("random byte length must be positive")
+    return secrets.token_bytes(length)
+
+
+def random_token(length: int) -> str:
+    if length <= 0:
+        raise ValueError("random byte length must be positive")
+    return secrets.token_urlsafe(length)
+
+
+def hkdf_sha256(
+    secret: bytes, salt: bytes | None = None, info: str = "", length: int = 32
+) -> bytes:
+    if not 1 <= length <= 8160:
+        raise ValueError("HKDF-SHA256 length must be between 1 and 8160 bytes")
+    return HKDF(hashes.SHA256(), length, salt, info.encode()).derive(secret)

alphaidea_shield-0.1.0/src/shield/aes.py

@@ -0,0 +1,47 @@
+"""Authenticated AES-GCM."""
+
+from secrets import token_bytes
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from ._encoding import decode_base64, encode_base64
+
+KEY_SIZE_128 = 16
+KEY_SIZE_192 = 24
+KEY_SIZE_256 = 32
+_NONCE_SIZE = 12
+_TAG_SIZE = 16
+_PREFIX = "v1:"
+
+
+def _seal(key: bytes, data: bytes, aad: bytes | None = None) -> bytes:
+    nonce = token_bytes(_NONCE_SIZE)
+    return nonce + AESGCM(key).encrypt(nonce, data, aad)
+
+
+def _open(key: bytes, data: bytes, aad: bytes | None = None) -> bytes:
+    if len(data) < _NONCE_SIZE + _TAG_SIZE:
+        raise ValueError("invalid GCM ciphertext length")
+    return AESGCM(key).decrypt(data[:_NONCE_SIZE], data[_NONCE_SIZE:], aad)
+
+
+def gcm_encrypt(key: bytes, data: bytes) -> bytes:
+    return _seal(key, data)
+
+
+def gcm_decrypt(key: bytes, data: bytes) -> bytes:
+    return _open(key, data)
+
+
+def gcm_encrypt_string(key: str, data: str) -> str:
+    return _PREFIX + encode_base64(gcm_encrypt(key.encode(), data.encode()))
+
+
+def gcm_decrypt_string(key: str, data: str) -> str:
+    return gcm_decrypt(key.encode(), decode_base64(data, _PREFIX)).decode()
+
+
+encrypt = gcm_encrypt
+decrypt = gcm_decrypt
+encrypt_string = gcm_encrypt_string
+decrypt_string = gcm_decrypt_string

alphaidea_shield-0.1.0/src/shield/argon2id.py

@@ -0,0 +1,84 @@
+"""Peppered Argon2id password hashes in Shield's PHC format."""
+
+import hmac
+import re
+from dataclasses import dataclass
+from secrets import token_bytes
+
+from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
+
+from ._encoding import decode_base64, encode_base64
+
+DEFAULT_MEMORY = 19456
+DEFAULT_ITERATIONS = 2
+DEFAULT_PARALLELISM = 1
+DEFAULT_SALT_LENGTH = 16
+DEFAULT_HASH_LENGTH = 32
+_PHC = re.compile(
+    r"\$argon2id\$v=19\$m=(0|[1-9][0-9]*),t=(0|[1-9][0-9]*),p=(0|[1-9][0-9]*)"
+    r"\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)"
+)
+
+
+@dataclass(frozen=True)
+class Options:
+    memory: int = DEFAULT_MEMORY
+    iterations: int = DEFAULT_ITERATIONS
+    parallelism: int = DEFAULT_PARALLELISM
+    salt_length: int = DEFAULT_SALT_LENGTH
+    hash_length: int = DEFAULT_HASH_LENGTH
+
+    def __post_init__(self) -> None:
+        if not (
+            1 <= self.parallelism <= 16
+            and 8 * self.parallelism <= self.memory <= 262144
+            and 1 <= self.iterations <= 10
+            and 16 <= self.salt_length <= 64
+            and 16 <= self.hash_length <= 64
+        ):
+            raise ValueError("password hash parameters out of range")
+
+
+def _prehash(pepper: str, password: str) -> bytes:
+    if not pepper:
+        raise ValueError("password pepper is empty")
+    return hmac.digest(pepper.encode(), password.encode(), "sha256")
+
+
+def _derive(prehash: bytes, salt: bytes, options: Options) -> bytes:
+    return Argon2id(
+        salt=salt, length=options.hash_length, iterations=options.iterations,
+        lanes=options.parallelism, memory_cost=options.memory,
+    ).derive(prehash)
+
+
+def _encode(data: bytes) -> str:
+    return encode_base64(data).rstrip("=")
+
+
+def _decode(encoded: str) -> bytes:
+    data = decode_base64(encoded + "=" * (-len(encoded) % 4))
+    if _encode(data) != encoded:
+        raise ValueError("non-canonical password hash Base64")
+    return data
+
+
+def hash(pepper: str, password: str, options: Options = Options()) -> str:
+    prehash = _prehash(pepper, password)
+    salt = token_bytes(options.salt_length)
+    digest = _derive(prehash, salt, options)
+    return (
+        f"$argon2id$v=19$m={options.memory},t={options.iterations},p={options.parallelism}"
+        f"${_encode(salt)}${_encode(digest)}"
+    )
+
+
+def verify(pepper: str, password: str, encoded: str) -> bool:
+    prehash = _prehash(pepper, password)
+    match = _PHC.fullmatch(encoded) if len(encoded) <= 256 else None
+    if match is None:
+        raise ValueError("invalid password hash format")
+    memory, iterations, parallelism = map(int, match.groups()[:3])
+    salt, digest = map(_decode, match.groups()[3:])
+    options = Options(memory, iterations, parallelism, len(salt), len(digest))
+    return hmac.compare_digest(_derive(prehash, salt, options), digest)

alphaidea_shield-0.1.0/src/shield/rsa.py

@@ -0,0 +1,132 @@
+"""RSA-OAEP, RSA-PSS and the Shield hybrid ciphertext format."""
+
+import re
+from secrets import token_bytes
+
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.asymmetric import rsa as backend
+
+from ._encoding import decode_base64, encode_base64
+from .aes import _open, _seal
+
+_HEADER = b"SHRSA\x01"
+_PREFIX = "hybrid:v1:"
+_MINIMUM_BITS = 2048
+_PEM = re.compile(
+    rb"-----BEGIN ([A-Z ]+)-----\r?\n([A-Za-z0-9+/=\r\n]+)"
+    rb"-----END \1-----"
+)
+
+
+def _parse_pem(data: bytes, label: bytes) -> bytes:
+    data = data.strip()
+    match = _PEM.fullmatch(data)
+    if match is None or match[1] != label:
+        raise ValueError("invalid RSA key PEM")
+    return data
+
+
+def parse_private_key(data: bytes) -> backend.RSAPrivateKey:
+    key = serialization.load_pem_private_key(_parse_pem(data, b"PRIVATE KEY"), password=None)
+    if not isinstance(key, backend.RSAPrivateKey):
+        raise ValueError("private key is not RSA")
+    return key
+
+
+def parse_public_key(data: bytes) -> backend.RSAPublicKey:
+    key = serialization.load_pem_public_key(_parse_pem(data, b"PUBLIC KEY"))
+    if not isinstance(key, backend.RSAPublicKey):
+        raise ValueError("public key is not RSA")
+    return key
+
+
+def _require_size(bits: int) -> None:
+    if bits < _MINIMUM_BITS:
+        raise ValueError("RSA key must be at least 2048 bits")
+
+
+def generate_key(bits: int = _MINIMUM_BITS) -> tuple[str, str]:
+    _require_size(bits)
+    private = backend.generate_private_key(public_exponent=65537, key_size=bits)
+    private_pem = private.private_bytes(
+        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+    )
+    public_pem = private.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    return private_pem.decode("ascii"), public_pem.decode("ascii")
+
+
+def _oaep(label: bytes | None = None) -> padding.OAEP:
+    return padding.OAEP(padding.MGF1(hashes.SHA256()), hashes.SHA256(), label)
+
+
+def encrypt(key: bytes, data: bytes) -> bytes:
+    public = parse_public_key(key)
+    _require_size(public.key_size)
+    return public.encrypt(data, _oaep())
+
+
+def decrypt(key: bytes, data: bytes) -> bytes:
+    private = parse_private_key(key)
+    _require_size(private.key_size)
+    return private.decrypt(data, _oaep())
+
+
+def encrypt_string(key: str, data: str) -> str:
+    return encode_base64(encrypt(key.encode(), data.encode()))
+
+
+def decrypt_string(key: str, data: str) -> str:
+    return decrypt(key.encode(), decode_base64(data)).decode()
+
+
+def encrypt_hybrid(key: bytes, data: bytes) -> bytes:
+    public = parse_public_key(key)
+    _require_size(public.key_size)
+    secret = token_bytes(32)
+    header = _HEADER + public.encrypt(secret, _oaep(_HEADER))
+    return header + _seal(secret, data, header)
+
+
+def decrypt_hybrid(key: bytes, data: bytes) -> bytes:
+    private = parse_private_key(key)
+    _require_size(private.key_size)
+    boundary = len(_HEADER) + (private.key_size + 7) // 8
+    if len(data) < boundary + 28 or not data.startswith(_HEADER):
+        raise ValueError("invalid hybrid ciphertext")
+    secret = private.decrypt(data[len(_HEADER):boundary], _oaep(_HEADER))
+    if len(secret) != 32:
+        raise ValueError("invalid hybrid key length")
+    return _open(secret, data[boundary:], data[:boundary])
+
+
+def encrypt_hybrid_string(key: str, data: str) -> str:
+    return _PREFIX + encode_base64(encrypt_hybrid(key.encode(), data.encode()))
+
+
+def decrypt_hybrid_string(key: str, data: str) -> str:
+    return decrypt_hybrid(key.encode(), decode_base64(data, _PREFIX)).decode()
+
+
+def sign(key: bytes, data: bytes) -> bytes:
+    private = parse_private_key(key)
+    _require_size(private.key_size)
+    algorithm = hashes.SHA256()
+    return private.sign(data, padding.PSS(padding.MGF1(algorithm), algorithm.digest_size), algorithm)
+
+
+def verify(key: bytes, data: bytes, signature: bytes) -> None:
+    public = parse_public_key(key)
+    _require_size(public.key_size)
+    algorithm = hashes.SHA256()
+    public.verify(signature, data, padding.PSS(padding.MGF1(algorithm), algorithm.digest_size), algorithm)
+
+
+def sign_string(key: str, data: str) -> str:
+    return encode_base64(sign(key.encode(), data.encode()))
+
+
+def verify_string(key: str, data: str, signature: str) -> None:
+    verify(key.encode(), data.encode(), decode_base64(signature))

alphaidea_shield-0.1.0/src/shield/totp.py

@@ -0,0 +1,106 @@
+"""RFC 6238 TOTP codes and authenticator provisioning URIs."""
+
+import base64
+import hmac
+import time
+from dataclasses import dataclass
+from datetime import datetime
+from secrets import token_bytes
+from typing import Literal
+from urllib.parse import quote, urlencode
+
+Algorithm = Literal["SHA1", "SHA256", "SHA512"]
+DEFAULT_ALGORITHM: Algorithm = "SHA1"
+DEFAULT_DIGITS = 6
+DEFAULT_PERIOD = 30
+DEFAULT_SKEW = 1
+DEFAULT_SECRET_LENGTH = 20
+
+
+@dataclass(frozen=True)
+class Options:
+    algorithm: Algorithm = DEFAULT_ALGORITHM
+    digits: int = DEFAULT_DIGITS
+    period: int = DEFAULT_PERIOD
+    skew: int = DEFAULT_SKEW
+
+    def __post_init__(self) -> None:
+        if not (
+            self.algorithm in ("SHA1", "SHA256", "SHA512")
+            and self.digits in (6, 8)
+            and 1 <= self.period <= 86400
+            and 0 <= self.skew <= 10
+        ):
+            raise ValueError("invalid TOTP options")
+
+
+def _encode(key: bytes) -> str:
+    return base64.b32encode(key).decode("ascii").rstrip("=")
+
+
+def _decode(secret: str) -> bytes:
+    if not secret.isascii() or len(secret) > 205:
+        raise ValueError("invalid TOTP secret")
+    encoded = secret.upper()
+    key = base64.b32decode(encoded + "=" * (-len(encoded) % 8))
+    if not 16 <= len(key) <= 128 or _encode(key) != encoded:
+        raise ValueError("TOTP secret must be canonical unpadded Base32 of 16..128 bytes")
+    return key
+
+
+def _counter(at: datetime | int | float | None, period: int) -> int:
+    if isinstance(at, datetime):
+        if at.utcoffset() is None:
+            raise ValueError("TOTP datetime must be timezone-aware")
+        at = at.timestamp()
+    if at is None:
+        at = time.time()
+    if not 0 <= at < 2**63:
+        raise ValueError("invalid TOTP Unix timestamp")
+    return int(at) // period
+
+
+def _code(key: bytes, counter: int, options: Options) -> str:
+    digest = hmac.digest(key, counter.to_bytes(8, "big"), options.algorithm.lower())
+    offset = digest[-1] & 15
+    value = int.from_bytes(digest[offset:offset + 4], "big") & 0x7FFFFFFF
+    return f"{value % 10**options.digits:0{options.digits}d}"
+
+
+def generate_secret() -> str:
+    return _encode(token_bytes(DEFAULT_SECRET_LENGTH))
+
+
+def generate(
+    secret: str, at: datetime | int | float | None = None, *, options: Options = Options()
+) -> str:
+    return _code(_decode(secret), _counter(at, options.period), options)
+
+
+def verify(
+    secret: str, code: str, at: datetime | int | float | None = None, *,
+    options: Options = Options(),
+) -> bool:
+    key = _decode(secret)
+    counter = _counter(at, options.period)
+    if len(code) != options.digits or not code.isascii() or not code.isdigit():
+        return False
+    matches = False
+    for candidate in range(max(0, counter - options.skew), counter + options.skew + 1):
+        matches |= hmac.compare_digest(code, _code(key, candidate, options))
+    return matches
+
+
+def uri(secret: str, issuer: str, account: str, *, options: Options = Options()) -> str:
+    key = _decode(secret)
+    if not issuer.strip() or not account.strip() or ":" in issuer + account:
+        raise ValueError("TOTP issuer and account must be non-empty and contain no colon")
+    label = quote(issuer, safe="$&+@=") + ":" + quote(account, safe="$&+@=")
+    query = urlencode({
+        "algorithm": options.algorithm,
+        "digits": options.digits,
+        "issuer": issuer,
+        "period": options.period,
+        "secret": _encode(key),
+    })
+    return f"otpauth://totp/{label}?{query}"