pyweb-stack 0.1.0__tar.gz → 0.3.0__tar.gz

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweb-stack
-Version: 0.1.0
+Version: 0.3.0
 Summary: Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC.
 Author-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>, Claude <noreply@anthropic.com>
 Maintainer-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
@@ -49,6 +49,7 @@ Requires-Dist: uvicorn>=0.30; extra == "all"
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: playwright>=1.45; extra == "test"
+Requires-Dist: mcp>=1.2; extra == "test"
 Dynamic: license-file
 
 # PyWeb
@@ -63,6 +64,9 @@ functions, without a JavaScript toolchain.
 ![PyPI](https://img.shields.io/pypi/v/pyweb-stack)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
+**[Try it in your browser](https://maanavkrishna.github.io/PyWeb/playground.html)**: the playground runs
+the real PyWeb, server functions included, on Python compiled to WebAssembly.
+
 ```pyweb
 from pyweb import App, server
 
@@ -139,11 +143,31 @@ browser (use Pyodide/PyScript). See the
 [comparison](https://maanavkrishna.github.io/PyWeb/introduction.html)
 and [current limitations](docs/16-limitations-roadmap.md).
 
+## Build it with AI
+
+PyWeb ships an MCP server so AI assistants can scaffold, check, inspect,
+render, screenshot and test your app, with errors that come back as line
+numbers and fix hints:
+
+```bash
+claude mcp add pyweb -- pyweb mcp          # Claude Code
+```
+
+```json
+{ "mcpServers": { "pyweb": { "command": "pyweb", "args": ["mcp"] } } }
+```
+
+(the JSON is for Cursor, Claude Desktop, VS Code and other MCP clients).
+`pyweb new myapp --template todo` also writes `AGENTS.md` and `CLAUDE.md`
+so coding agents follow PyWeb's rules, and the docs site publishes
+[`llms-full.txt`](https://maanavkrishna.github.io/PyWeb/llms-full.txt).
+See [AI assistants & MCP](docs/17-ai-assistants.md).
+
 ## Documentation
 
 | | |
 |---|---|
-| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) |
+| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
 | Language | [`.pyweb` files](docs/04-pyweb-files.md) · [State & reactivity](docs/05-reactivity.md) · [Python in the browser](docs/07-browser-python.md) |
 | Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Data](docs/09-data.md) · [Auth](docs/10-auth.md) |
 | Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) |
@@ -164,25 +188,39 @@ a real browser by the test suite.
 | [`todo`](examples/todo/app.pyweb) | components, list mutation, filters, keyed lists |
 | [`blog`](examples/blog/app.pyweb) | SQL database, server functions, route params, 404s, validation errors |
 | [`auth`](examples/auth/app.pyweb) | registration, password hashing, sessions, protected pages |
-| [`chat`](examples/chat/app.pyweb) | route params, shared server state, polling with `on_mount` |
+| [`chat`](examples/chat/app.pyweb) | route params, shared server state, live updates with `publish`/`subscribe` |
 | [`showcase`](examples/showcase/app.pyweb) | everything on one page, with a stylesheet |
 
 ## Command line
 
 ```bash
-pyweb new myapp                                  # scaffold
+pyweb new myapp --template todo                  # scaffold (blank|counter|todo|blog|auth|chat)
 pyweb dev app.pyweb                              # dev server: live reload + error overlay
 pyweb inspect app.pyweb                          # where each name runs, and why
 pyweb check app.pyweb                            # compile + security checks for CI
 pyweb build app.pyweb --out dist --production    # self-contained, hashed, minified dist/
 pyweb serve dist                                 # production server (/healthz, CSP, graceful shutdown)
+pyweb mcp                                        # MCP server for AI assistants (stdio)
+pyweb lsp                                        # language server for editors (stdio)
 ```
 
+Editors: the [VS Code extension](editors/vscode) adds highlighting, errors as you
+type, hover that shows where code runs, completion and go to definition. Any
+other LSP editor can run `pyweb lsp` ([setup](docs/14-cli.md#editor-support)).
+
 ## Status
 
-PyWeb 0.1 is the first public release (beta). The language, server API,
-RPC protocol and CLI are documented and tested, and changes to them are
-announced in the changelog (see [stability](docs/15-toolkit.md#stability)). The test suite covers the
+PyWeb is in beta (0.x; see the PyPI badge above for the latest version).
+The language, server API, RPC protocol and CLI are documented and tested,
+and changes to them are announced in the [changelog](CHANGELOG.md) (see
+[stability](docs/15-toolkit.md#stability)). Upgrade with
+`pip install -U pyweb-stack`.
+
+| Version | Highlights |
+|---|---|
+| 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
+| 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
+| 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI | The test suite covers the
 parser, the Python→JavaScript translation (differentially, against
 CPython), the reactive runtime, server rendering, RPC, sessions, every
 example app in Chromium, and the database/Redis layers against real

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/README.md

@@ -10,6 +10,9 @@ functions, without a JavaScript toolchain.
 ![PyPI](https://img.shields.io/pypi/v/pyweb-stack)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
+**[Try it in your browser](https://maanavkrishna.github.io/PyWeb/playground.html)**: the playground runs
+the real PyWeb, server functions included, on Python compiled to WebAssembly.
+
 ```pyweb
 from pyweb import App, server
 
@@ -86,11 +89,31 @@ browser (use Pyodide/PyScript). See the
 [comparison](https://maanavkrishna.github.io/PyWeb/introduction.html)
 and [current limitations](docs/16-limitations-roadmap.md).
 
+## Build it with AI
+
+PyWeb ships an MCP server so AI assistants can scaffold, check, inspect,
+render, screenshot and test your app, with errors that come back as line
+numbers and fix hints:
+
+```bash
+claude mcp add pyweb -- pyweb mcp          # Claude Code
+```
+
+```json
+{ "mcpServers": { "pyweb": { "command": "pyweb", "args": ["mcp"] } } }
+```
+
+(the JSON is for Cursor, Claude Desktop, VS Code and other MCP clients).
+`pyweb new myapp --template todo` also writes `AGENTS.md` and `CLAUDE.md`
+so coding agents follow PyWeb's rules, and the docs site publishes
+[`llms-full.txt`](https://maanavkrishna.github.io/PyWeb/llms-full.txt).
+See [AI assistants & MCP](docs/17-ai-assistants.md).
+
 ## Documentation
 
 | | |
 |---|---|
-| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) |
+| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
 | Language | [`.pyweb` files](docs/04-pyweb-files.md) · [State & reactivity](docs/05-reactivity.md) · [Python in the browser](docs/07-browser-python.md) |
 | Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Data](docs/09-data.md) · [Auth](docs/10-auth.md) |
 | Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) |
@@ -111,25 +134,39 @@ a real browser by the test suite.
 | [`todo`](examples/todo/app.pyweb) | components, list mutation, filters, keyed lists |
 | [`blog`](examples/blog/app.pyweb) | SQL database, server functions, route params, 404s, validation errors |
 | [`auth`](examples/auth/app.pyweb) | registration, password hashing, sessions, protected pages |
-| [`chat`](examples/chat/app.pyweb) | route params, shared server state, polling with `on_mount` |
+| [`chat`](examples/chat/app.pyweb) | route params, shared server state, live updates with `publish`/`subscribe` |
 | [`showcase`](examples/showcase/app.pyweb) | everything on one page, with a stylesheet |
 
 ## Command line
 
 ```bash
-pyweb new myapp                                  # scaffold
+pyweb new myapp --template todo                  # scaffold (blank|counter|todo|blog|auth|chat)
 pyweb dev app.pyweb                              # dev server: live reload + error overlay
 pyweb inspect app.pyweb                          # where each name runs, and why
 pyweb check app.pyweb                            # compile + security checks for CI
 pyweb build app.pyweb --out dist --production    # self-contained, hashed, minified dist/
 pyweb serve dist                                 # production server (/healthz, CSP, graceful shutdown)
+pyweb mcp                                        # MCP server for AI assistants (stdio)
+pyweb lsp                                        # language server for editors (stdio)
 ```
 
+Editors: the [VS Code extension](editors/vscode) adds highlighting, errors as you
+type, hover that shows where code runs, completion and go to definition. Any
+other LSP editor can run `pyweb lsp` ([setup](docs/14-cli.md#editor-support)).
+
 ## Status
 
-PyWeb 0.1 is the first public release (beta). The language, server API,
-RPC protocol and CLI are documented and tested, and changes to them are
-announced in the changelog (see [stability](docs/15-toolkit.md#stability)). The test suite covers the
+PyWeb is in beta (0.x; see the PyPI badge above for the latest version).
+The language, server API, RPC protocol and CLI are documented and tested,
+and changes to them are announced in the [changelog](CHANGELOG.md) (see
+[stability](docs/15-toolkit.md#stability)). Upgrade with
+`pip install -U pyweb-stack`.
+
+| Version | Highlights |
+|---|---|
+| 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
+| 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
+| 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI | The test suite covers the
 parser, the Python→JavaScript translation (differentially, against
 CPython), the reactive runtime, server rendering, RPC, sessions, every
 example app in Chromium, and the database/Redis layers against real

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweb-stack"
-version = "0.1.0"
+version = "0.3.0"
 description = "Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC."
 readme = "README.md"
 license = { text = "MIT" }
@@ -42,7 +42,7 @@ redis = ["redis>=5"]
 crypto = ["cryptography>=42"]
 asgi = ["uvicorn>=0.30"]
 all = ["psycopg[binary]>=3.1", "PyMySQL>=1.1", "redis>=5", "cryptography>=42", "uvicorn>=0.30"]
-test = ["pytest>=8", "playwright>=1.45"]
+test = ["pytest>=8", "playwright>=1.45", "mcp>=1.2"]
 
 [project.urls]
 Homepage = "https://maanavkrishna.github.io/PyWeb/"
@@ -58,7 +58,7 @@ pyweb = "pyweb.cli:main"
 include = ["pyweb*"]
 
 [tool.setuptools.package-data]
-pyweb = ["runtime/browser/*.js", "py.typed"]
+pyweb = ["runtime/browser/*.js", "py.typed", "ai/*.md", "templates/*.pyweb", "templates/*.css"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/pyweb/__init__.py

@@ -10,6 +10,7 @@ from .jobs import task
 from .context import NotFound, redirect, request, session
 from .rpc import RPCError
 from .decorators import component, edge, server, worker
+from .realtime import channel, publish, subscribe
 
 __all__ = [
     "App",
@@ -22,6 +23,9 @@ __all__ = [
     "edge",
     "server",
     "worker",
+    "channel",
+    "publish",
+    "subscribe",
     "Email",
     "Model",
     "task",

pyweb_stack-0.3.0/pyweb/ai/guide.md

@@ -0,0 +1,227 @@
+# PyWeb guide for AI assistants
+
+PyWeb (`pip install pyweb-stack`, `import pyweb`, command `pyweb`) builds a
+full-stack web app from ONE `.pyweb` file: Python plus HTML-like markup.
+Pages render on the server; event handlers compile to JavaScript; functions
+marked `@server` run on the server and are called from the browser over RPC.
+
+Follow these rules exactly. When unsure, run the `pyweb_check` tool (or
+`pyweb check app.pyweb`) and fix what it reports.
+
+## 1. Skeleton
+
+```pyweb
+from pyweb import App, server
+
+app = App(title="My app", stylesheets=["/static/app.css"])
+
+
+@server
+def save_item(text: str) -> list:      # runs on the server; called over RPC
+    ITEMS.append(text)
+    return ITEMS
+
+
+ITEMS = []
+
+
+@app.page("/")
+def Home():
+    items = list(ITEMS)                # computed on the server per request
+    draft = ""                         # browser state (bound below)
+
+    def add():                         # event handler -> compiled to JavaScript
+        items = save_item(draft)       # server call: awaited automatically
+        draft = ""
+
+    <main>
+        <h1>Items ({len(items)})</h1>
+        <form onsubmit={add}>
+            <input bind={draft} placeholder="New item" />
+            <button disabled={not draft.strip()}>Add</button>
+        </form>
+        <ul>
+            for item in items:
+                <li>{item}</li>
+        </ul>
+    </main>
+```
+
+Run: `pyweb dev app.pyweb` (http://localhost:8000, live reload).
+Static files go in `static/` next to `app.pyweb`, served at `/static/...`.
+
+## 2. What runs where (most important rules)
+
+| Code | Runs |
+|---|---|
+| imports, classes, DB connections, module objects | server only |
+| `NAME = <literal>` at module level | both (inlined into browser JS) |
+| `@server` functions | server; browser calls become RPC |
+| undecorated module functions | server; compiled to JS only if browser code calls them |
+| page function body (top to the markup) | server, every request |
+| nested `def` inside a page (handlers) | browser (JavaScript) |
+| `{expressions}` in markup | server (first render) and browser (updates) |
+
+Consequences:
+- Handlers must NOT use imports, DB handles, files, `os`, models, or other
+  server-only names. Put that work in an `@server` function and call it.
+- Markup expressions must not call `@server` functions. Load data into a
+  page variable instead (`rows = load_rows()` at the top of the page).
+- Never put secrets in page variables read by markup or handlers; the
+  compiler rejects names like `token`, `secret`, `password`, `api_key`
+  that would reach the browser (an empty `password = ""` bound to an input
+  is fine).
+- Everything the browser reads (markup, JS, page state) is public.
+  Authorize inside `@server` functions with `session.require(...)`.
+
+## 3. State
+
+Plain local variables in a page are the state. No `useState`, no `nonlocal`.
+
+- A variable assigned/mutated in a handler, or used with `bind={x}`, is a
+  **signal**: reactive, updating only the DOM that reads it.
+- A variable computed from signals and never assigned in a handler is
+  **computed**: `total = price * quantity`.
+- Everything else is a constant.
+- Inside handlers, assigning a page variable updates the page:
+  `count += 1`, `draft = ""`, `items.append(x)`, `items[i]["done"] = True`,
+  `del items[i]`, `items = [x for x in items if ...]` all work.
+- You cannot assign to a computed value or constant from a handler.
+- Initial values that call functions, read the session, or depend on
+  page-level logic are computed on the server; only values browser code
+  reads are sent to the browser.
+
+## 4. Markup
+
+- A line starting with `<tag` is markup; tags may span lines; every
+  non-void tag must be closed. Lowercase = HTML, Capitalized = component.
+- `{expr}` inserts a value (None renders nothing). Text is escaped.
+- Attributes: `class="x"` (literal), `href={url}` (expression),
+  `disabled={flag}` (True/False toggles), `class={{"done": t["done"]}}`
+  (dict of classes), `style={{"color": c}}` (dict of CSS).
+- Events: `onclick={handler}`, `onclick={lambda: remove(item)}`, or
+  `onclick={remove(item)}` (runs when clicked). `onsubmit` prevents the
+  default submit. Any `on<event>` works: `oninput`, `onchange`, `onkeydown`.
+- Binding: `bind={name}` on input/textarea/select; checkbox binds a bool;
+  `type="number"` with a numeric initial value binds a number.
+- Control flow lines inside markup: `for x in xs:`, `if c:`, `elif c:`,
+  `else:` with markup bodies indented below.
+- Whitespace between separate lines is dropped (like JSX); keep text that
+  needs a space on one line.
+- Literal braces: `{"{"}`.
+
+## 5. Components
+
+```pyweb
+from pyweb import App, component
+
+app = App()
+
+
+@component
+def Card(title, subtitle="", children=None):
+    <section class="card">
+        <h2>{title}</h2>
+        if subtitle:
+            <p>{subtitle}</p>
+        {children}
+    </section>
+
+
+@app.page("/")
+def Home():
+    <Card title="Hello"><p>Body</p></Card>
+```
+
+Props are parameters (defaults = optional). Pass callbacks as props
+(`on_delete={lambda: delete(i)}`) and use them as handlers inside
+(`onclick={on_delete}`). A component's initial state must be computable in
+the browser (pass server data as props).
+
+Bigger apps can split into files: put components, `@server` functions and
+constants in e.g. `widgets.pyweb` (or `ui/cards.pyweb`) next to `app.pyweb`
+and `from widgets import Card, save`. Pages stay in `app.pyweb`; import
+server functions without `as`; each file keeps its own constants.
+
+## 6. Server functions, sessions, routing
+
+```python
+from pyweb import App, RPCError, NotFound, redirect, request, server, session
+
+@server
+def update(item_id: int, title: str) -> dict:     # annotations validate/coerce args
+    user = session.require()                       # 401 if not signed in
+    if not title.strip():
+        raise RPCError("validation_error", "Title is required.")   # browser: except RPCError as e: str(e)
+    ...
+
+@app.page("/items/{item_id}")                      # typed route param; bad int -> 404
+def Item(item_id: int):
+    if not session.user():
+        return redirect("/login")
+    row = find(item_id)
+    if row is None:
+        raise NotFound()
+    ...
+```
+
+- `session.login(user_id, **claims)`, `session.user()`, `session.logout()`,
+  `session.require("admin")`.
+- `pyweb.auth.hash_password` / `verify_password` for passwords.
+- Database: `from pyweb.db import connect; db = connect("sqlite:///app.db")`;
+  `db.execute("select ... where id = ?", (x,)).dicts()`; always use `?`
+  parameters; `with db.transaction(): ...`.
+- In handlers, navigate with `window.location.href = "/path"`.
+- Run code after load with a handler named `on_mount`.
+- Live updates: in a server function `publish("room:1", data)`; in the
+  page `feed = channel("room:1")` (runs on the server); in `on_mount`
+  `subscribe(feed, handler)`, where `handler(message)` assigns page
+  variables. Import all three from `pyweb`. Never poll with
+  `setInterval` when `publish` fits.
+
+## 7. Python that compiles to the browser
+
+Supported in handlers/markup: literals, f-strings (with format specs),
+arithmetic with Python semantics, comparisons, `in`, `and/or/not` with
+Python truthiness, comprehensions, lambdas, slicing/negative indexes,
+`if/for/while/try/except/raise/return/del`, builtins (`len str int float
+bool abs min max sum round range sorted reversed enumerate zip list dict
+set tuple any all isinstance print`), common str/list/dict/set methods.
+JS globals are available directly: `window`, `document`, `localStorage`,
+`console`, `setTimeout`, `setInterval`, `fetch`, `Math`, `JSON`, `Date`.
+
+Not supported in browser code: classes, imports, `with`, generators,
+walrus, `*args/**kwargs` parameters, slice assignment, keyword arguments to
+JS functions, server-only names. Move such code into `@server` functions.
+
+## 8. Errors and fixes
+
+| Error text contains | Fix |
+|---|---|
+| `only exists on the server` | Move that logic into an `@server` function and call it from the handler. |
+| `is not defined in browser code` | Define it at module level (literal or helper function), pass it in, or use an `@server` function. |
+| `markup expressions must be synchronous` | Assign the server call's result to a page variable or call it in a handler. |
+| `cannot assign to ... derived/read-only` | Assign to a variable the handler owns (make it state), not a computed/constant. |
+| `server secret ... would be sent to the browser` | Keep the value inside `@server` functions; don't read it in markup/handlers. |
+| `bind={x} must name a local variable` | Declare `x = ""` (or a number/bool) in the page before the markup. |
+| `unknown component <X>` | Define `def X(...)` with markup (capitalized) in this file, or import it: `from widgets import X`. |
+| `mismatched </tag>` / `is never closed` | Close every tag; void tags (`input`, `img`, `br`) need no close (`<input ... />`). |
+| `... is not supported in browser code` | Rewrite with supported constructs or move it to `@server`. |
+
+## 9. Workflow for agents
+
+1. Start from a template: `pyweb new NAME --template todo` (or the
+   `pyweb_new_app` MCP tool). Templates: blank, counter, todo, blog, auth, chat.
+2. Edit `app.pyweb`. After every edit run `pyweb check app.pyweb`
+   (MCP: `pyweb_check`) and fix errors by line number.
+3. Use `pyweb inspect` (MCP: `pyweb_inspect`) to confirm what runs in the
+   browser vs server and what is sent to the browser.
+4. Verify behaviour: render pages (`pyweb_render`) and call server
+   functions (`pyweb_call`). See the page and try interactions in a real
+   browser with `pyweb_screenshot` (steps: click, fill, press, ...).
+5. Test: new apps include `test_app.py` (`pyweb.testing.TestClient`); add
+   tests for what you change and run `pytest` (MCP: `pyweb_test`).
+6. Ship: `pyweb build app.pyweb --out dist --production` then
+   `pyweb serve dist` (set `PYWEB_AUTH_SECRET` in production).
+
+Full docs: https://maanavkrishna.github.io/PyWeb/

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/pyweb/app_loader.py

@@ -18,7 +18,7 @@ from .compiler import compile_source
 from .compiler import parser as P
 from .compiler.lower import is_ui_stmt
 from .context import NotFound, Redirect
-from .ssr import Renderer, page_html
+from .ssr import NS_KEY, Renderer, page_html
 
 STATE_PREFIX = "__pyweb_state_"
 
@@ -53,12 +53,30 @@ class LoadedApp:
         self.extra_stylesheets = list(stylesheets or [])
         self.compiled = compile_source(source, filename=self.filename)
         self.ctx = self.compiled["context"]
-        self.module = self._exec()
+        # Other .pyweb files the app imports run as real modules, registered
+        # under their import name so `from widgets import Card` works.
+        self.libraries = self.compiled["libraries"]
+        self.lib_modules = {}
+        for lib in self.libraries:
+            with open(lib.path, encoding="utf-8") as fh:
+                lib_source = fh.read()
+            infos = list(lib.components.values())
+            self.lib_modules[lib.path] = self._exec(lib_source, lib.path, infos, lib.name)
+        self.files = [os.path.abspath(path)] if path else []
+        self.files += [lib.path for lib in self.libraries]
+        infos = [p["info"] for p in self.compiled["pages"].values()]
+        infos += list(self.compiled["components"].values())
+        self.module = self._exec(source, self.filename, infos)
         self.rpc = {}
         for spec in self.compiled["rpc"]:
             fn = self.module.__dict__.get(spec["name"])
             if callable(fn):
                 self.rpc[spec["name"]] = fn
+        for lib in self.libraries:
+            for spec in lib.rpc:
+                fn = self.lib_modules[lib.path].__dict__.get(spec["name"])
+                if callable(fn):
+                    self.rpc[spec["name"]] = fn
         app_obj = next((v for v in self.module.__dict__.values()
                         if type(v).__name__ == "App" and type(v).__module__.startswith("pyweb")), None)
         self.app = app_obj
@@ -67,29 +85,42 @@ class LoadedApp:
         self.lang = getattr(app_obj, "lang", "en") or "en"
 
     # ----------------------------------------------------------- module
-    def _exec(self):
-        py_source, _ui = P.split_sources(self.source)
-        tree = ast.parse(py_source, filename=self.filename)
-        infos = [p["info"] for p in self.compiled["pages"].values()]
-        infos += list(self.compiled["components"].values())
+    def _exec(self, source, filename, infos, module_name=None):
+        py_source, _ui = P.split_sources(source)
+        tree = ast.parse(py_source, filename=filename)
         for info in infos:
             tree.body.append(_state_function(info.node))
-        stem = os.path.splitext(os.path.basename(self.filename))[0] or "app"
-        mod = types.ModuleType(f"pyweb_app_{stem}")
-        mod.__file__ = os.path.abspath(self.filename) if self.path else self.filename
+        stem = os.path.splitext(os.path.basename(filename))[0] or "app"
+        mod = types.ModuleType(module_name or f"pyweb_app_{stem}")
+        mod.__file__ = os.path.abspath(filename) if self.path else filename
         mod.__dict__["__pyweb_ui__"] = lambda *_a: None
         app_dir = os.path.dirname(os.path.abspath(self.path)) if self.path else None
         if app_dir and app_dir not in sys.path:
             sys.path.insert(0, app_dir)
         sys.modules[mod.__name__] = mod
-        exec(compile(tree, self.filename, "exec"), mod.__dict__)  # noqa: S102 - the app itself
+        exec(compile(tree, filename, "exec"), mod.__dict__)  # noqa: S102 - the app itself
         return mod
 
     # -------------------------------------------------------- rendering
-    def _component_state(self, name, props):
-        info = self.compiled["components"][name]
-        fn = self.module.__dict__[STATE_PREFIX + name]
-        env = fn(**{k: v for k, v in props.items() if k in info.params})
+    def _component_state(self, name, props, ns=None):
+        """Run component ``name`` as used by the file ``ns`` (None: the app)."""
+        ctx = ns or self.ctx
+        source = ctx.imported_components.get(name)
+        if source is not None:
+            lib, name = source
+            ctx, module = lib.ctx, self.lib_modules[lib.path]
+        else:
+            module = self.module if ctx is self.ctx else next(
+                self.lib_modules[lib.path] for lib in self.libraries if lib.ctx is ctx)
+        info = ctx.components[name]
+        fn = module.__dict__[STATE_PREFIX + name]
+        local = fn(**{k: v for k, v in props.items() if k in info.params})
+        if module is self.module:
+            return info.ui, local
+        # Markup in another file sees that file's globals.
+        env = {k: v for k, v in module.__dict__.items() if not k.startswith("__")}
+        env.update(local)
+        env[NS_KEY] = ctx
         return info.ui, env
 
     def renderer(self):

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/pyweb/asgi.py

@@ -20,6 +20,27 @@ import asyncio
 from .hosting import Site
 
 
+async def _stream(stream, receive, send):
+    """Send an event stream until it ends or the client disconnects."""
+    async def watch():
+        while (await receive())["type"] != "http.disconnect":
+            pass
+        stream.close()
+
+    watcher = asyncio.ensure_future(watch())
+    try:
+        async for chunk in stream.aiter():
+            if watcher.done():
+                break
+            await send({"type": "http.response.body", "body": chunk, "more_body": True})
+        await send({"type": "http.response.body", "body": b""})
+    except OSError:
+        pass
+    finally:
+        stream.close()
+        watcher.cancel()
+
+
 def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_kwargs):
     """Return an ASGI 3 application serving ``target`` (a `.pyweb` file or dist dir)."""
     site = Site(target, debug=debug, max_body=max_body, **server_kwargs)
@@ -62,6 +83,10 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
             status, hdrs, body = await asyncio.to_thread(
                 site.respond, scope.get("method", "GET"), path, headers, b"".join(chunks))
         raw_headers = [(k.lower().encode("latin-1"), v.encode("latin-1")) for k, v in hdrs]
+        if hasattr(body, "aiter"):  # Server-Sent Events
+            await send({"type": "http.response.start", "status": status, "headers": raw_headers})
+            await _stream(body, receive, send)
+            return
         if not any(k == b"content-length" for k, _ in raw_headers):
             raw_headers.append((b"content-length", str(len(body)).encode()))
         await send({"type": "http.response.start", "status": status, "headers": raw_headers})

{pyweb_stack-0.1.0 → pyweb_stack-0.3.0}/pyweb/auth.py

@@ -37,14 +37,36 @@ def _b64d(data: str) -> bytes:
     return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
 
 
+def _pbkdf2_sha256(password: bytes, salt: bytes, iterations: int) -> bytes:
+    """PBKDF2-HMAC-SHA256 (32-byte key). Uses hashlib's C version when it
+    exists; Pythons built without OpenSSL (e.g. Pyodide) get this pure
+    Python one, which gives the same result."""
+    fast = getattr(hashlib, "pbkdf2_hmac", None)
+    if fast is not None:
+        return fast("sha256", password, salt, iterations)
+    mac = hmac.new(password, digestmod=hashlib.sha256)
+
+    def prf(data):
+        m = mac.copy()
+        m.update(data)
+        return m.digest()
+
+    u = prf(salt + b"\x00\x00\x00\x01")
+    acc = int.from_bytes(u, "big")
+    for _ in range(iterations - 1):
+        u = prf(u)
+        acc ^= int.from_bytes(u, "big")
+    return acc.to_bytes(32, "big")
+
+
 def hash_password(password, *, salt=None, rounds=None, iterations=_ITERATIONS):
     if salt is None:
         salt_bytes = secrets.token_bytes(16)
-        dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt_bytes, iterations)
+        dk = _pbkdf2_sha256(password.encode(), salt_bytes, iterations)
         return f"{_HASH_ALGO}${iterations}${_b64e(salt_bytes)}${_b64e(dk)}"
     salt_bytes = salt if isinstance(salt, bytes) else bytes.fromhex(salt)
     n = rounds if rounds is not None else iterations
-    dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt_bytes, n)
+    dk = _pbkdf2_sha256(password.encode(), salt_bytes, n)
     return f"pbkdf2${n}${salt_bytes.hex()}${dk.hex()}"
 
 
@@ -63,7 +85,7 @@ def verify_password(password, stored):
             expected = bytes.fromhex(dk_part)
     except (ValueError, base64.binascii.Error):
         return False
-    candidate = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, iters_i)
+    candidate = _pbkdf2_sha256(password.encode(), salt, iters_i)
     if algo == _HASH_ALGO:
         return hmac.compare_digest(candidate, expected)
     return hmac.compare_digest(candidate.hex(), expected.hex() if isinstance(expected, bytes) else dk_part)