docs: def spec_compliant_encrypt(claims, jwk, add_header=None, alg='RSA-OAEP',
                             enc='A128CBC-HS256', rng=get_random_bytes):
      """ Encrypts the given claims and produces a :class:`~jose.JWE`
  
      :param claims: A `dict` representing the claims for this
                     :class:`~jose.JWE`.
      :param jwk: A `dict` representing the JWK to be used for encryption of
                  the CEK. This parameter is algorithm-specific.
      :param add_header: Additional items to be added to the header. Additional
                         headers *will* be authenticated.
      :param alg: The algorithm to use for CEK encryption
      :param enc: The algorithm to use for claims encryption
      :param rng: Random number generator. A string of random bytes is expected
                  as output.
      : param compression: The compression algorithm to use. Currently supports
                  `'DEF'`.
      :rtype: :class:`~jose.JWE`
      :raises: :class:`~jose.Error` if there is an error producing the JWE
      """
      # We need 5 components for JWE token
      # 1. Generate header
      header = dict((add_header or {}).items() + [(HEADER_ENC, enc),
                                                  (HEADER_ALG, alg)])
      protected_header = json_encode(header)
  
      # 2. Generate CEK
      mac_key, enc_key = _generate_encryption_keys(enc, rng)
      encrypted_key = _encrypt_key(mac_key + enc_key, jwk, alg)
  
      # 3. Generate Initialization Vector
      iv = _generate_iv(enc, rng)
  
      # 4. Generate payload
      plaintext = json_encode(claims)
      # Compress if needed
      if HEADER_ZIP in header:
          try:
              (compression_func, _) = COMPRESSION[header[HEADER_ZIP]]
          except KeyError:
              raise Error(
                  'Unsupported compression algorithm: {}'.format(header[HEADER_ZIP]))
          M = compression_func(plaintext)
      else:
          M = plaintext
  
      # Encrypt payload
      ((cipher, _), key_len), _ = JWA[enc]
      ciphertext = cipher(M, enc_key, iv)
  
      # 5. Generate authentication tag
      authentication_tag = _generate_authentication_tag(
          mac_key, protected_header, ciphertext, iv, enc
      )
  
      return JWE(
          *map(
              b64encode_url,
              (protected_header, encrypted_key, iv, ciphertext,
               authentication_tag)
          )
      )