code: def auth_encrypt(self, P, A, seq_num=None):
          
          if False in six.itervalues(self.ready):
              raise CipherError(P, A)
  
          if hasattr(self, "pc_cls"):
              self._cipher.mode._initialization_vector = self._get_nonce()
              self._cipher.mode._tag = None
              encryptor = self._cipher.encryptor()
              encryptor.authenticate_additional_data(A)
              res = encryptor.update(P) + encryptor.finalize()
              res += encryptor.tag
          else:
              res = self._cipher.encrypt(self._get_nonce(), P, A)
  
          nonce_explicit = pkcs_i2osp(self.nonce_explicit,
                                      self.nonce_explicit_len)
          self._update_nonce_explicit()
          return nonce_explicit + res
docs: Encrypt the data then prepend the explicit part of the nonce. The
          authentication tag is directly appended with the most recent crypto
          API. Additional data may be authenticated without encryption (as A).
  
          The 'seq_num' should never be used here, it is only a safeguard needed
          because one cipher (ChaCha20Poly1305) using TLS 1.2 logic in record.py
          actually is a _AEADCipher_TLS13 (even though others are not).