tina4-python 3.13.135__tar.gz → 3.13.137__tar.gz

{tina4_python-3.13.135 → tina4_python-3.13.137}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tina4-python
-Version: 3.13.135
+Version: 3.13.137
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.135 → tina4_python-3.13.137}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.135"
+version = "3.13.137"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}
@@ -41,9 +41,12 @@ s3 = ["boto3>=1.34"]
 kafka = ["confluent-kafka>=2.0"]
 rabbitmq = ["pika>=1.3"]
 
-# Web Push is zero-dependency until selected. The standard library has no
-# P-256 ECDH or ES256 primitives, so the native cryptography capability is
-# installed explicitly when a project enables Web Push.
+# Web Push is zero-dependency on the server: the crypto runs through the OS
+# OpenSSL (libcrypto) by ctypes, so a Linux host needs nothing installed. This
+# extra is the DEV FALLBACK - on a stock Mac or a Windows workstation ctypes
+# cannot reach a safe OpenSSL, so the cryptography package runs instead. Install
+# it there (or pin it with TINA4_PUSH_BACKEND=cryptography); the wire output is
+# identical either way. See tina4_python/push/_libcrypto.py.
 push = ["cryptography>=42.0"]
 
 # All database drivers

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/__init__.py

@@ -51,7 +51,7 @@ def _resolve_version() -> str:
     #
     # test_version_constant.py now asserts this literal equals the pyproject
     # version, so the release bump cannot leave it behind again.
-    return "3.13.135"
+    return "3.13.137"
 
 
 __version__ = _resolve_version()

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/ai/client.py

@@ -98,7 +98,7 @@ class Ai:
     Explicit call options beat environment values, which beat defaults.
     """
 
-    _PROVIDERS = {"local", "openai", "anthropic"}
+    _PROVIDERS = {"local", "openai", "anthropic", "gemini"}
 
     @staticmethod
     def chat(
@@ -369,15 +369,19 @@ class Ai:
     def _config(capability: str, *, model: str | None, timeout: float | None, provider: str | None) -> _Config:
         selected = (provider or os.environ.get("TINA4_AI_PROVIDER") or "local").strip().lower()
         if selected not in Ai._PROVIDERS:
-            raise AiConfigError("TINA4_AI_PROVIDER must be local, openai, or anthropic")
+            raise AiConfigError("TINA4_AI_PROVIDER must be local, openai, anthropic, or gemini")
         key = os.environ.get("TINA4_AI_KEY") or None
-        if selected in {"openai", "anthropic"} and not key:
+        if selected in {"openai", "anthropic", "gemini"} and not key:
             raise AiConfigError(f"TINA4_AI_KEY is required for the {selected} provider")
 
         defaults = {
             "local": ("http://localhost:11437", "llama3.2"),
             "openai": ("https://api.openai.com/v1", "gpt-4o-mini"),
             "anthropic": ("https://api.anthropic.com/v1", "claude-3-5-haiku-latest"),
+            # Gemini speaks the OpenAI wire format at its OpenAI-compatible base, so it
+            # rides the openai body/parse/stream path - only the base URL, the endpoint
+            # suffix append, and the Bearer key differ.
+            "gemini": ("https://generativelanguage.googleapis.com/v1beta/openai", "gemini-2.5-flash"),
         }
         base, default_model = defaults[selected]
         if capability == "embed" and os.environ.get("TINA4_EMBED_URL"):
@@ -408,8 +412,12 @@ class Ai:
             suffix = "/embeddings"
         else:
             suffix = "/chat/completions"
-        if path in {"", "/v1", "/api"}:
-            prefix = path or ("/v1" if provider in {"local", "openai"} else "/v1")
+        # "/v1beta/openai" is Gemini's OpenAI-compatible base; append the suffix onto
+        # it exactly as onto a bare host or "/v1", so the default gemini base resolves
+        # to .../v1beta/openai/chat/completions (or /embeddings). A full endpoint URL
+        # the caller supplies verbatim still passes through untouched.
+        if path in {"", "/v1", "/api", "/v1beta/openai"}:
+            prefix = path or "/v1"
             path = prefix + suffix
             parsed = parsed._replace(path=path)
             return parsed.geturl()
@@ -418,7 +426,7 @@ class Ai:
     @staticmethod
     def _headers(config: _Config) -> dict[str, str]:
         headers = {"content-type": "application/json", "accept": "application/json"}
-        if config.provider == "openai" and config.key:
+        if config.provider in {"openai", "gemini"} and config.key:
             headers["authorization"] = f"Bearer {config.key}"
         elif config.provider == "anthropic" and config.key:
             headers["x-api-key"] = config.key

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/core/server.py

@@ -2588,7 +2588,11 @@ def _stage_dev_toolbar_inject(ctx: DispatchContext) -> None:
     Best-effort: a toolbar that fails to render must never break the response
     it was decorating, so the whole thing is guarded.
     """
-    if not ctx.is_dev or not ctx.response.content_type:
+    if (
+        not ctx.is_dev 
+        or not ctx.response.content_type 
+        or ctx.response.status_code == 204
+    ):
         return None
     if "text/html" not in ctx.response.content_type:
         return None

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/database/connection.py

@@ -10,6 +10,7 @@ Connection pooling:
     db = Database("sqlite:///data/app.db", pool=4)  # 4 connections, round-robin
 """
 import hashlib
+import importlib
 import os
 import threading
 import time
@@ -129,43 +130,56 @@ def register_driver(scheme: str, adapter_class: type):
     _DRIVERS[scheme] = adapter_class
 
 
-# Register built-in SQLite
+# Register built-in SQLite eagerly. It is stdlib, so importing it drags in no
+# third-party package -- the zero-dependency default carries no import cost.
 from tina4_python.database.sqlite import SQLiteAdapter
 register_driver("sqlite", SQLiteAdapter)
 
-# Register ODBC (lazy — only fails if you actually use it without pyodbc)
-try:
-    from tina4_python.database.odbc import ODBCAdapter
-    register_driver("odbc", ODBCAdapter)
-except ImportError:
-    pass  # pyodbc not installed — that's fine
-
-# Register PostgreSQL (psycopg2 — optional)
-from tina4_python.database.postgres import PostgreSQLAdapter
-register_driver("postgresql", PostgreSQLAdapter)
-register_driver("postgres", PostgreSQLAdapter)
-register_driver("pgsql", PostgreSQLAdapter)  # PDO / Laravel / Doctrine scheme name (issue #58)
-
-# Register MySQL (mysql-connector-python — optional)
-from tina4_python.database.mysql import MySQLAdapter
-register_driver("mysql", MySQLAdapter)
-
-# Register MSSQL (pymssql — optional)
-from tina4_python.database.mssql import MSSQLAdapter
-register_driver("mssql", MSSQLAdapter)
-register_driver("sqlserver", MSSQLAdapter)
-
-# Register Firebird (fdb — optional)
-from tina4_python.database.firebird import FirebirdAdapter
-register_driver("firebird", FirebirdAdapter)
-
-# Register MongoDB (pymongo — optional)
-try:
-    from tina4_python.database.mongodb import MongoDBAdapter
-    register_driver("mongodb", MongoDBAdapter)
-    register_driver("pymongo", MongoDBAdapter)
-except ImportError:
-    pass
+# Every OTHER adapter is registered LAZILY: its module -- and the third-party
+# driver that module imports -- is loaded only when a URL for that scheme is
+# actually connected. Importing tina4_python.database (which happens on the first
+# Database(url), regardless of engine) therefore never drags psycopg2,
+# firebird-driver (+ protobuf + dateutil), pymssql or pymongo into an app that
+# does not use them. Connecting to Postgres loads only psycopg2; a SQLite app
+# loads no third-party driver at all. This mirrors PHP/Ruby autoload and Node's
+# optionalDependencies + dynamic import. Aliases share the same target so the
+# canonical engine and every alias resolve to one adapter class.
+_LAZY_DRIVERS: dict[str, tuple[str, str]] = {
+    "postgres": ("tina4_python.database.postgres", "PostgreSQLAdapter"),
+    "postgresql": ("tina4_python.database.postgres", "PostgreSQLAdapter"),
+    "pgsql": ("tina4_python.database.postgres", "PostgreSQLAdapter"),  # PDO / Laravel / Doctrine (issue #58)
+    "mysql": ("tina4_python.database.mysql", "MySQLAdapter"),
+    "mssql": ("tina4_python.database.mssql", "MSSQLAdapter"),
+    "sqlserver": ("tina4_python.database.mssql", "MSSQLAdapter"),
+    "firebird": ("tina4_python.database.firebird", "FirebirdAdapter"),
+    "odbc": ("tina4_python.database.odbc", "ODBCAdapter"),
+    "mongodb": ("tina4_python.database.mongodb", "MongoDBAdapter"),
+    "pymongo": ("tina4_python.database.mongodb", "MongoDBAdapter"),
+}
+
+
+def known_drivers() -> set[str]:
+    """Every URL scheme the framework can resolve: eagerly-registered (sqlite,
+    plus anything an app registered by hand via register_driver) and the
+    lazily-registered built-ins that import their driver on first use."""
+    return set(_DRIVERS) | set(_LAZY_DRIVERS)
+
+
+def _resolve_lazy_driver(scheme: str) -> None:
+    """Import a lazily-declared adapter and register it, on first use.
+
+    Raises a clear ValueError if the adapter's driver package is not installed,
+    rather than an opaque ImportError from deep in the driver.
+    """
+    module_path, class_name = _LAZY_DRIVERS[scheme]
+    try:
+        module = importlib.import_module(module_path)
+    except ImportError as exc:
+        raise ValueError(
+            f"Database driver '{scheme}' is unavailable: {exc}. "
+            f"Install the driver package and it will register automatically."
+        ) from exc
+    register_driver(scheme, getattr(module, class_name))
 
 
 class Database:
@@ -339,12 +353,16 @@ class Database:
             scheme = (urlparse(self.url).scheme or "").lower()
 
         if scheme not in _DRIVERS:
-            available = ", ".join(_DRIVERS.keys())
-            raise ValueError(
-                f"Unknown database driver '{scheme}'. "
-                f"Available: {available}. "
-                f"Install the driver package and it will register automatically."
-            )
+            if scheme in _LAZY_DRIVERS:
+                # First connection to this engine: import + register its adapter.
+                _resolve_lazy_driver(scheme)
+            else:
+                available = ", ".join(sorted(known_drivers()))
+                raise ValueError(
+                    f"Unknown database driver '{scheme}'. "
+                    f"Available: {available}. "
+                    f"Install the driver package and it will register automatically."
+                )
 
         return _DRIVERS[scheme]()
 

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/migration/runner.py

@@ -156,7 +156,13 @@ def _build_stem_map(migration_folder: str | None) -> list[str]:
 def _resolve_migration_name(description: str, stems: list[str]) -> str:
     """Find the file stem that corresponds to a v2 description, or fall back.
 
-    Match strategy, in order:
+    Python v2 recorded `description` straight from os.listdir, so the value
+    normally carries the file extension (".sql"/".py") while a stem never does.
+    Match on the extension-stripped form as well, or a whole v2 history looks
+    unapplied and replays — see tests/test_issue_115_v2_upgrade.py.
+
+    Match strategy, in order (each tried against the description and against
+    its extension-stripped form):
       1. Exact stem match.
       2. A stem ending in "_" + description (e.g. "000001_create_users"
          resolves a v2 description of "create_users").
@@ -165,14 +171,22 @@ def _resolve_migration_name(description: str, stems: list[str]) -> str:
          getAppliedMigrations() but migrate() may re-run if a real file
          exists with a different name.
     """
-    if description in stems:
-        return description
-    for stem in stems:
-        if stem.endswith("_" + description):
-            return stem
-    for stem in stems:
-        if description in stem:
-            return stem
+    candidates = [description]
+    bare = re.sub(r"\.(sql|py)$", "", description, flags=re.IGNORECASE)
+    if bare != description:
+        candidates.append(bare)
+
+    for candidate in candidates:
+        if candidate in stems:
+            return candidate
+    for candidate in candidates:
+        for stem in stems:
+            if stem.endswith("_" + candidate):
+                return stem
+    for candidate in candidates:
+        for stem in stems:
+            if candidate in stem:
+                return stem
     return description
 
 

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/public/swagger/index.html

@@ -71,7 +71,7 @@
 
         // Build a system
         const ui = SwaggerUIBundle({
-            url: "{SWAGGER_ROUTE}/swagger.json",
+            url: "/swagger/openapi.json",
             dom_id: '#swagger-ui',
             deepLinking: true,
             presets: [

{tina4_python-3.13.135 → tina4_python-3.13.137}/tina4_python/push/__init__.py

@@ -1,8 +1,13 @@
 """Provider-neutral Web Push delivery (RFC 8291 / RFC 8292).
 
-The framework remains zero-dependency. Install the optional capability with
-``pip install tina4-python[push]``; ``cryptography`` is imported only when a
-push sender is constructed or used.
+The framework stays zero-dependency on the server. The crypto runs through the OS
+OpenSSL (``libcrypto``) by ctypes - the same "use the platform crypto" model the
+PHP, Ruby and Node frameworks get from their stdlib - so a Linux host sends push
+with nothing installed. Where ctypes cannot reach a safe OpenSSL (a stock Mac, a
+Windows workstation), it falls back to the optional ``cryptography`` package
+(``pip install tina4-python[push]``). Both backends emit identical bytes, so the
+wire output is the same whichever runs. Set ``TINA4_PUSH_BACKEND`` to ``libcrypto``
+or ``cryptography`` to pin one; ``auto`` (default) prefers libcrypto.
 """
 from __future__ import annotations
 
@@ -19,6 +24,8 @@ import urllib.request
 from dataclasses import dataclass
 from typing import Any
 
+from ._base import BackendUnavailable
+
 RECORD_SIZE = 4096
 MAX_PAYLOAD = RECORD_SIZE - 17
 
@@ -50,15 +57,45 @@ def _unb64(value: str, name: str) -> bytes:
     return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
 
 
-def _crypto() -> tuple[Any, ...]:
-    try:
-        from cryptography.hazmat.primitives import hashes, serialization
-        from cryptography.hazmat.primitives.asymmetric import ec
-        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-        from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
-    except ImportError as exc:
-        raise PushError("Web Push requires the optional crypto capability; install tina4-python[push]") from exc
-    return hashes, serialization, ec, Cipher, algorithms, modes, decode_dss_signature
+_BACKEND = None
+
+
+def _select_backend():
+    """Pick the crypto backend: OS libcrypto first, cryptography as fallback.
+
+    ``TINA4_PUSH_BACKEND`` forces ``auto`` (default), ``libcrypto`` or
+    ``cryptography``. The choice is cached for the process; ``_reset_backend``
+    drops the cache so a later call re-selects after the environment changes.
+    """
+    global _BACKEND
+    if _BACKEND is not None:
+        return _BACKEND
+    choice = os.getenv("TINA4_PUSH_BACKEND", "auto").strip().lower() or "auto"
+    order = {"auto": ("libcrypto", "cryptography"),
+             "libcrypto": ("libcrypto",),
+             "cryptography": ("cryptography",)}.get(choice)
+    if order is None:
+        raise PushError("TINA4_PUSH_BACKEND must be auto, libcrypto or cryptography")
+    reasons = []
+    for name in order:
+        if name == "libcrypto":
+            from . import _libcrypto as backend_module
+        else:
+            from . import _cryptography as backend_module
+        try:
+            _BACKEND = backend_module.load()
+            return _BACKEND
+        except BackendUnavailable as exc:
+            reasons.append(f"{name} ({exc})")
+    raise PushError(
+        "Web Push needs the OS OpenSSL (Linux/Unix) or the cryptography package "
+        "(install tina4-python[push]); unavailable here: " + ", ".join(reasons))
+
+
+def _reset_backend() -> None:
+    """Drop the cached backend so the next call re-selects."""
+    global _BACKEND
+    _BACKEND = None
 
 
 def _hmac(key: bytes, value: bytes) -> bytes:
@@ -78,15 +115,8 @@ def _hkdf(prk: bytes, info: bytes, length: int) -> bytes:
     return b"".join(chunks)[:length]
 
 
-def _public_bytes(public_key: Any, serialization: Any) -> bytes:
-    return public_key.public_bytes(serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint)
-
-
 def generate_vapid_keys() -> dict[str, str]:
-    _hashes, serialization, ec, *_ = _crypto()
-    private = ec.generate_private_key(ec.SECP256R1())
-    public = _public_bytes(private.public_key(), serialization)
-    raw_private = private.private_numbers().private_value.to_bytes(32, "big")
+    raw_private, public = _select_backend().generate_keypair()
     return {"publicKey": _b64(public), "privateKey": _b64(raw_private)}
 
 
@@ -104,7 +134,7 @@ def _payload_bytes(payload: Any) -> bytes:
 def _encrypt(payload: bytes, subscription: dict[str, Any]) -> bytes:
     if len(payload) > MAX_PAYLOAD:
         raise PushError(f"Push payload is too large; maximum is {MAX_PAYLOAD} bytes")
-    _hashes, serialization, ec, Cipher, algorithms, modes, _decode = _crypto()
+    backend = _select_backend()
     try:
         client_public_bytes = _unb64(subscription["keys"]["p256dh"], "subscription.keys.p256dh")
         auth_secret = _unb64(subscription["keys"]["auth"], "subscription.keys.auth")
@@ -115,32 +145,27 @@ def _encrypt(payload: bytes, subscription: dict[str, Any]) -> bytes:
     if len(auth_secret) != 16:
         raise PushError("subscription.keys.auth must be a 16-byte authentication secret")
 
-    client_public = ec.EllipticCurvePublicKey.from_encoded_point(ec.SECP256R1(), client_public_bytes)
-    ephemeral = ec.generate_private_key(ec.SECP256R1())
-    server_public_bytes = _public_bytes(ephemeral.public_key(), serialization)
-    shared = ephemeral.exchange(ec.ECDH(), client_public)
+    try:
+        server_public_bytes, shared = backend.encrypt_ecdh(client_public_bytes)
+    except ValueError as exc:
+        raise PushError("subscription.keys.p256dh is not a valid P-256 public key") from exc
     key_info = b"WebPush: info\0" + client_public_bytes + server_public_bytes
     ikm = _hkdf(_hmac(auth_secret, shared), key_info, 32)
     salt = os.urandom(16)
     prk = _hmac(salt, ikm)
     cek = _hkdf(prk, b"Content-Encoding: aes128gcm\0", 16)
     nonce = _hkdf(prk, b"Content-Encoding: nonce\0", 12)
-    encryptor = Cipher(algorithms.AES(cek), modes.GCM(nonce)).encryptor()
-    ciphertext = encryptor.update(payload + b"\x02") + encryptor.finalize() + encryptor.tag
+    ciphertext = backend.aes128gcm_encrypt(cek, nonce, payload + b"\x02")
     return salt + RECORD_SIZE.to_bytes(4, "big") + bytes([len(server_public_bytes)]) + server_public_bytes + ciphertext
 
 
 def _vapid_token(endpoint: str, subject: str, raw_private: bytes, raw_public: bytes) -> str:
-    _hashes, serialization, ec, _Cipher, _algorithms, _modes, decode_dss_signature = _crypto()
     audience = urllib.parse.urlparse(endpoint)
     aud = f"{audience.scheme}://{audience.netloc}"
     header = _b64(json.dumps({"typ": "JWT", "alg": "ES256"}, separators=(",", ":")).encode())
     claims = _b64(json.dumps({"aud": aud, "exp": int(time.time()) + 12 * 60 * 60, "sub": subject}, separators=(",", ":")).encode())
     signing_input = f"{header}.{claims}".encode("ascii")
-    private = ec.derive_private_key(int.from_bytes(raw_private, "big"), ec.SECP256R1())
-    der = private.sign(signing_input, ec.ECDSA(_hashes.SHA256()))
-    r, s = decode_dss_signature(der)
-    signature = r.to_bytes(32, "big") + s.to_bytes(32, "big")
+    signature = _select_backend().sign_es256(raw_private, signing_input)
     return signing_input.decode("ascii") + "." + _b64(signature)
 
 
@@ -196,12 +221,11 @@ class Push:
             raise PushError("TINA4_VAPID_PUBLIC must be a 65-byte P-256 public key")
         if len(raw_private) != 32:
             raise PushError("TINA4_VAPID_PRIVATE must be a 32-byte P-256 private key")
-        _hashes, serialization, ec, *_ = _crypto()
         try:
-            derived = ec.derive_private_key(int.from_bytes(raw_private, "big"), ec.SECP256R1())
+            derived_public = _select_backend().public_from_private(raw_private)
         except ValueError as exc:
             raise PushError("TINA4_VAPID_PRIVATE is not a valid P-256 private key") from exc
-        if _public_bytes(derived.public_key(), serialization) != raw_public:
+        if derived_public != raw_public:
             raise PushError("TINA4_VAPID_PUBLIC does not match TINA4_VAPID_PRIVATE")
         return raw_public, raw_private
 

tina4_python-3.13.137/tina4_python/push/_base.py

@@ -0,0 +1,38 @@
+"""The Web Push crypto backend contract.
+
+A backend supplies the five primitives RFC 8291 / RFC 8292 need that CPython's
+stdlib cannot: P-256 keygen, ECDH, AES-128-GCM, the public point of a stored
+scalar, and an ES256 signature. Everything else (HKDF, HMAC, the record framing,
+the JWT assembly) is pure stdlib and lives in ``__init__``, written once and
+shared by both backends.
+
+Two backends implement this contract: ``_libcrypto`` (ctypes -> the OS OpenSSL,
+zero packages, the server path) and ``_cryptography`` (the pyca package, the
+Mac/Windows dev fallback). Both return the SAME bytes, so the wire output stays
+identical to the PHP, Ruby and Node frameworks whichever one runs.
+
+Each method raises ``ValueError`` on malformed key material. A backend that
+cannot run on this host raises ``BackendUnavailable`` from its ``load()`` so the
+selector can fall through to the next one.
+
+Contract (all keys are raw bytes, points are 65-byte uncompressed ``0x04`` form):
+
+    generate_keypair() -> (raw_private32, public65)
+        A fresh random P-256 keypair.
+    public_from_private(raw_private32) -> public65
+        The public point for a stored scalar (used to validate a VAPID pair).
+    encrypt_ecdh(peer_public65) -> (server_public65, shared32)
+        Generate an ephemeral keypair, ECDH against the subscriber's key, and
+        hand back both the ephemeral public point and the shared secret. The
+        ephemeral private key never leaves the backend.
+    aes128gcm_encrypt(key16, iv12, plaintext) -> ciphertext_with_tag
+        AES-128-GCM; the 16-byte tag is appended to the ciphertext.
+    sign_es256(raw_private32, message) -> signature64
+        ECDSA P-256 / SHA-256 over ``message``, as raw r||s (each left-padded
+        to 32 bytes).
+"""
+from __future__ import annotations
+
+
+class BackendUnavailable(RuntimeError):
+    """Raised by a backend's ``load()`` when it cannot run on this host."""

tina4_python-3.13.137/tina4_python/push/_cryptography.py

@@ -0,0 +1,66 @@
+"""Web Push crypto through the pyca ``cryptography`` package.
+
+The dev fallback. When ctypes cannot reach a safe OS OpenSSL - a stock Mac, a
+Windows workstation, a musl image without OpenSSL - this backend runs instead,
+provided the optional package is installed (``pip install tina4-python[push]``).
+It produces the same bytes as the libcrypto backend, so the wire output does not
+change with the host.
+
+``load()`` raises ``BackendUnavailable`` when the package is absent, so the
+selector can report both misses in one clear error.
+"""
+from __future__ import annotations
+
+from ._base import BackendUnavailable
+
+
+class CryptographyBackend:
+    """RFC 8291 / RFC 8292 primitives over the pyca cryptography package."""
+
+    name = "cryptography"
+
+    def __init__(self, module_bundle):
+        (self._ec, self._AESGCM, self._Encoding, self._PublicFormat,
+         self._hashes, self._decode_dss) = module_bundle
+
+    def _public_bytes(self, public_key) -> bytes:
+        return public_key.public_bytes(self._Encoding.X962, self._PublicFormat.UncompressedPoint)
+
+    def generate_keypair(self):
+        priv = self._ec.generate_private_key(self._ec.SECP256R1())
+        pub = self._public_bytes(priv.public_key())
+        raw = priv.private_numbers().private_value.to_bytes(32, "big")
+        return raw, pub
+
+    def public_from_private(self, raw_private: bytes) -> bytes:
+        priv = self._ec.derive_private_key(int.from_bytes(raw_private, "big"), self._ec.SECP256R1())
+        return self._public_bytes(priv.public_key())
+
+    def encrypt_ecdh(self, peer_public: bytes):
+        peer = self._ec.EllipticCurvePublicKey.from_encoded_point(self._ec.SECP256R1(), peer_public)
+        ephemeral = self._ec.generate_private_key(self._ec.SECP256R1())
+        server_pub = self._public_bytes(ephemeral.public_key())
+        shared = ephemeral.exchange(self._ec.ECDH(), peer)
+        return server_pub, shared
+
+    def aes128gcm_encrypt(self, key: bytes, iv: bytes, plaintext: bytes) -> bytes:
+        return self._AESGCM(key).encrypt(iv, plaintext, None)
+
+    def sign_es256(self, raw_private: bytes, message: bytes) -> bytes:
+        priv = self._ec.derive_private_key(int.from_bytes(raw_private, "big"), self._ec.SECP256R1())
+        der = priv.sign(message, self._ec.ECDSA(self._hashes.SHA256()))
+        r, s = self._decode_dss(der)
+        return r.to_bytes(32, "big") + s.to_bytes(32, "big")
+
+
+def load() -> CryptographyBackend:
+    """Return the cryptography backend, or raise BackendUnavailable if absent."""
+    try:
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.asymmetric import ec
+        from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
+        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+        from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+    except ImportError as exc:
+        raise BackendUnavailable("the cryptography package is not installed") from exc
+    return CryptographyBackend((ec, AESGCM, Encoding, PublicFormat, hashes, decode_dss_signature))