pyweb-stack 0.4.2__tar.gz → 0.4.3__tar.gz

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: pyweb-stack
-Version: 0.4.2
+Version: 0.4.3
 Summary: Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC.
 Author-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 Maintainer-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 License: MIT
 Project-URL: Homepage, https://maanavkrishna.github.io/PyWeb/
-Project-URL: Documentation, https://maanavkrishna.github.io/PyWeb/guide.html
+Project-URL: Documentation, https://maanavkrishna.github.io/PyWeb/introduction.html
 Project-URL: Source, https://github.com/MaanavKrishna/PyWeb
 Project-URL: Changelog, https://github.com/MaanavKrishna/PyWeb/blob/main/CHANGELOG.md
 Project-URL: Issues, https://github.com/MaanavKrishna/PyWeb/issues
@@ -72,6 +72,10 @@ your server, live data and streaming AI, with no JavaScript toolchain.
 **[Examples](#examples)** ·
 **[Changelog](CHANGELOG.md)**
 
+<br>
+
+<img src="https://raw.githubusercontent.com/MaanavKrishna/PyWeb/main/docs/images/demo.gif" alt="A guestbook app written in one .pyweb file: the submit handler runs in the browser and sign() runs on the server" width="860">
+
 </div>
 
 ```pyweb
@@ -380,7 +384,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/README.md

@@ -18,6 +18,10 @@ your server, live data and streaming AI, with no JavaScript toolchain.
 **[Examples](#examples)** ·
 **[Changelog](CHANGELOG.md)**
 
+<br>
+
+<img src="https://raw.githubusercontent.com/MaanavKrishna/PyWeb/main/docs/images/demo.gif" alt="A guestbook app written in one .pyweb file: the submit handler runs in the browser and sign() runs on the server" width="860">
+
 </div>
 
 ```pyweb
@@ -326,7 +330,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweb-stack"
-version = "0.4.2"
+version = "0.4.3"
 description = "Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC."
 readme = "README.md"
 license = { text = "MIT" }
@@ -45,7 +45,7 @@ test = ["pytest>=8", "playwright>=1.45", "mcp>=1.2"]
 
 [project.urls]
 Homepage = "https://maanavkrishna.github.io/PyWeb/"
-Documentation = "https://maanavkrishna.github.io/PyWeb/guide.html"
+Documentation = "https://maanavkrishna.github.io/PyWeb/introduction.html"
 Source = "https://github.com/MaanavKrishna/PyWeb"
 Changelog = "https://github.com/MaanavKrishna/PyWeb/blob/main/CHANGELOG.md"
 Issues = "https://github.com/MaanavKrishna/PyWeb/issues"

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/ai/guide.md

@@ -55,7 +55,7 @@ Static files go in `static/` next to `app.pyweb`, served at `/static/...`.
 | Code | Runs |
 |---|---|
 | imports, classes, DB connections, module objects | server only |
-| `NAME = <literal>` at module level | both (inlined into browser JS) |
+| `NAME = <literal>` at module level | both (inlined into browser JS); server only if any code changes it (`.append`, `[k] =`, `global`) |
 | `@server` functions | server; browser calls become RPC |
 | undecorated module functions | server; compiled to JS only if browser code calls them |
 | page function body (top to the markup) | server, every request |

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/asgi.py

@@ -71,8 +71,10 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 break
         headers = {}
         for k, v in scope.get("headers", []):
-            name = k.decode("latin-1").title()
-            headers[name] = v.decode("latin-1")
+            name, value = k.decode("latin-1").title(), v.decode("latin-1")
+            if name in headers:  # repeated (HTTP/2 sends cookies as several headers)
+                value = headers[name] + ("; " if name == "Cookie" else ", ") + value
+            headers[name] = value
         path = scope.get("path", "/")
         if scope.get("query_string"):
             path += "?" + scope["query_string"].decode("latin-1")
@@ -81,7 +83,8 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 b'{"error": {"code": "http_413", "message": "request body too large"}}'
         else:
             status, hdrs, body = await asyncio.to_thread(
-                site.respond, scope.get("method", "GET"), path, headers, b"".join(chunks))
+                site.respond, scope.get("method", "GET"), path, headers, b"".join(chunks),
+                (scope.get("client") or [None])[0])
         raw_headers = [(k.lower().encode("latin-1"), v.encode("latin-1")) for k, v in hdrs]
         if hasattr(body, "aiter"):  # Server-Sent Events, streamed RPC results
             await send({"type": "http.response.start", "status": status, "headers": raw_headers})

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/auth.py

@@ -205,7 +205,20 @@ def require_session(req, secret: str, max_age: int = 3600):
     session = session_from_request(req, secret, max_age)
     if session is not None and "sub" in session:
         return session, None
-    return None, Response(302, "", {"Location": f"{LOGIN_URL}?next={req.path}"})
+    nxt = urllib.parse.quote(safe_next(req.path), safe="/")
+    return None, Response(302, "", {"Location": f"{LOGIN_URL}?next={nxt}"})
+
+
+def safe_next(url, default="/"):
+    """``url`` if it's a path on this site, else ``default``.
+
+    Use it on a ``?next=`` value before redirecting there after login, so a
+    link like ``/login?next=//evil.example`` can't send people elsewhere.
+    """
+    url = str(url or "")
+    if not url.startswith("/") or url.startswith(("//", "/\\")) or any(c in url for c in "\r\n\t"):
+        return default
+    return url
 
 
 def login_response(user_id, secret: str, *, extra=None, next_url="/",
@@ -222,7 +235,7 @@ def login_response(user_id, secret: str, *, extra=None, next_url="/",
     flags = (f"HttpOnly; Path=/; Max-Age={int(max_age)}; SameSite=Lax"
              + ("; Secure" if secure else ""))
     return Response(302, "", {
-        "Location": next_url,
+        "Location": safe_next(next_url),
         "Set-Cookie": f"{SESSION_COOKIE}={token}; {flags}",
     })
 
@@ -334,7 +347,8 @@ class OAuthClient:
 def issue_magic_token(secret: str, email: str, ttl: int = 900) -> str:
     payload = {"email": email, "exp": int(time.time()) + ttl}
     payload_b64 = _b64e(json.dumps(payload, separators=(",", ":")).encode())
-    return f"{payload_b64}.{_sign(payload_b64, secret)}"
+    # Signed under its own prefix, so a session cookie can never pass as a login link (or back).
+    return f"{payload_b64}.{_sign('magic:' + payload_b64, secret)}"
 
 
 def verify_magic_token(secret: str, token: str, max_age: int = 900):
@@ -342,13 +356,13 @@ def verify_magic_token(secret: str, token: str, max_age: int = 900):
         payload_b64, sig = token.rsplit(".", 1)
     except ValueError:
         return None
-    if not hmac.compare_digest(_sign(payload_b64, secret), sig):
+    if not hmac.compare_digest(_sign("magic:" + payload_b64, secret), sig):
         return None
     try:
         payload = json.loads(_b64d(payload_b64))
     except (ValueError, base64.binascii.Error, json.JSONDecodeError):
         return None
-    if time.time() > payload.get("exp", 0):
+    if not isinstance(payload, dict) or time.time() > payload.get("exp", 0):
         return None
     return payload.get("email")
 

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/cache.py

@@ -32,6 +32,24 @@ class MemoryCache(Cache):
         self._tags: dict[str, set] = {}
         self._lock = threading.Lock()
         self._now = time_fn or time.monotonic
+        self._sets = 0
+
+    def _drop(self, key):
+        """Remove ``key`` and its tag entries. Hold the lock."""
+        item = self._store.pop(key, None)
+        if item is not None:
+            for t in item[2]:
+                keys = self._tags.get(t)
+                if keys is not None:
+                    keys.discard(key)
+                    if not keys:
+                        del self._tags[t]
+
+    def _sweep(self):
+        """Forget expired entries nobody asked for again. Hold the lock."""
+        now = self._now()
+        for key in [k for k, (_v, exp, _t) in self._store.items() if exp is not None and exp <= now]:
+            self._drop(key)
 
     def get(self, key, default=None):
         """Return ``(value, hit)`` tuple, preserving the prototype API."""
@@ -41,7 +59,7 @@ class MemoryCache(Cache):
                 return None, False
             value, expires, _tags = item
             if expires is not None and expires <= self._now():
-                del self._store[key]
+                self._drop(key)
                 return None, False
             return value, True
 
@@ -55,6 +73,9 @@ class MemoryCache(Cache):
             ttl = kw["minutes"] * 60
         expires = None if ttl is None else self._now() + ttl
         with self._lock:
+            self._sets += 1
+            if self._sets % 256 == 0:
+                self._sweep()
             old = self._store.get(key)
             if isinstance(old, tuple) and len(old) == 3:
                 for t in old[2]:

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/cli/__init__.py

@@ -156,7 +156,8 @@ def cmd_dev(args):
             if state.error is not None or state.site is None:
                 html = _error_overlay(state.error, state.path).encode()
                 return self._send(500, [("Content-Type", "text/html; charset=utf-8")], html)
-            status, headers, raw = state.site.respond(method, self.path, dict(self.headers), body)
+            status, headers, raw = state.site.respond(method, self.path, dict(self.headers), body,
+                                                      client=self.client_address[0])
             ctype = next((v for k, v in headers if k.lower() == "content-type"), "")
             if ctype.startswith("text/html") and isinstance(raw, bytes) and b"</body>" in raw:
                 raw = raw.replace(b"</body>", DEV_RELOAD_JS.encode() + b"</body>", 1)
@@ -193,12 +194,17 @@ def _watch_and_reload(state, Site):
 
     app_dir = os.path.dirname(os.path.abspath(state.path))
 
+    skip = {"__pycache__", "node_modules", "dist", "build", "venv", "env", "site-packages", "vendor"}
+
     def snapshot():
         stamps = {}
         for root, dirs, files in os.walk(app_dir):
-            dirs[:] = [d for d in dirs if not d.startswith((".", "__pycache__", "node_modules", "dist"))]
+            # Virtualenvs (any folder with a pyvenv.cfg) hold thousands of files that never matter here;
+            # npm packages are covered by pyweb.lock, which changes whenever they do.
+            dirs[:] = [d for d in dirs if not d.startswith(".") and d not in skip
+                       and not os.path.exists(os.path.join(root, d, "pyvenv.cfg"))]
             for fn in files:
-                if fn.endswith((".pyweb", ".py", ".css", ".js")):
+                if fn.endswith((".pyweb", ".py", ".css", ".js")) or fn == "pyweb.lock":
                     p = os.path.join(root, fn)
                     try:
                         stamps[p] = os.path.getmtime(p)

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/compiler/lower.py

@@ -321,6 +321,11 @@ def scan_module(tree, ui_all, filename, resolve=None):
                     except (ValueError, SyntaxError, TypeError):
                         ctx.server_only[name] = "a module-level object created on the server"
                         ctx.modconsts.pop(name, None)
+    for name in _mutated_globals(tree) & set(ctx.modconsts):
+        # e.g. `ITEMS = []` that an @server function appends to: a browser copy of the
+        # starting value would be wrong, so pages get its current value from the server.
+        ctx.modconsts.pop(name)
+        ctx.server_only[name] = "a module-level value that server code changes"
     taken = {i.name for i in pages + layouts} | set(ctx.components)
     if not any(p.error_status is None for p in pages):
         # Single-page fallback: the first function with markup is "/".
@@ -339,6 +344,32 @@ def scan_module(tree, ui_all, filename, resolve=None):
     return ctx, pages, components
 
 
+_MUTATORS = {"append", "extend", "insert", "pop", "remove", "clear", "update", "setdefault", "popitem",
+             "add", "discard", "sort", "reverse", "difference_update", "intersection_update",
+             "symmetric_difference_update"}
+
+
+def _mutated_globals(tree):
+    """Module-level names that some code changes after they're defined."""
+    out = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Global):
+            out.update(node.names)
+        elif isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute) \
+                and node.func.attr in _MUTATORS and isinstance(node.func.value, ast.Name):
+            out.add(node.func.value.id)
+        elif isinstance(node, (ast.Assign, ast.AugAssign, ast.AnnAssign, ast.Delete)):
+            targets = node.targets if isinstance(node, (ast.Assign, ast.Delete)) else [node.target]
+            for t in targets:
+                while isinstance(t, (ast.Subscript, ast.Attribute)):
+                    t = t.value
+                    if isinstance(t, ast.Name):
+                        out.add(t.id)
+            if isinstance(node, ast.AugAssign) and isinstance(node.target, ast.Name):
+                out.add(node.target.id)
+    return out
+
+
 def _ui_of(node, ui_all):
     span = (node.lineno, getattr(node, "end_lineno", node.lineno))
     return [n for n in ui_all if span[0] <= getattr(n, "line", 0) <= span[1]]
@@ -846,7 +877,7 @@ class Emitter:
                 lines.append(f"  const {js} = $s[{key}];")
             else:
                 lines.append(f"  const {js} = {fallback};")
-        for hname, hnode in info.handlers.items():
+        for hnode in info.handlers.values():
             lines.append(self.tr.function(hnode, scope, "  "))
         for name in getattr(info, "live", ()):
             if name in info.refs:
@@ -925,7 +956,7 @@ class Emitter:
                 return f"$dyn({_thunk(js)})"
             return f"$t($py.text({js}))"
         if t == "ControlFor":
-            it_node, it_js = self._expr(n.iterable, n.line, scope)
+            _it_node, it_js = self._expr(n.iterable, n.line, scope)
             target = self._parse(n.target, n.line)
             inner = scope.child({name: VALUE for name in pyjs._target_names(target)})
             try:

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/db/__init__.py

@@ -386,6 +386,11 @@ class _PooledDB:
                     return res
                 except Exception as exc:  # noqa: BLE001
                     last = exc
+                    if not owned:
+                        # Inside transaction(): rolling back here would drop the
+                        # transaction's earlier writes while later ones still commit.
+                        # transaction() rolls back if the error escapes it.
+                        raise
                     try:
                         conn.rollback()
                     except Exception:
@@ -400,7 +405,10 @@ class _PooledDB:
 
     def stream(self, sql, params=(), *, chunksize=1000):
         """Yield ``Result`` pages without loading the full result set."""
-        conn = self._acquire()
+        conn = self._current()            # inside transaction(): use (and see) its connection
+        owned = conn is None
+        if owned:
+            conn = self._acquire()
         sql = self._adapt(sql, params)
         try:
             cur = conn.cursor() if hasattr(conn, "cursor") else None
@@ -420,7 +428,8 @@ class _PooledDB:
             except Exception:
                 pass
         finally:
-            self._pool.put(conn)
+            if owned:
+                self._pool.put(conn)
 
     @contextmanager
     def transaction(self):

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/dts.py

@@ -34,33 +34,53 @@ def _ts_to_py(ts_type):
     return _TS_SCALARS.get(t, t)
 
 
+def _members(body):
+    """The members of an object type, split on newlines, `;` and top-level `,`."""
+    import re
+    body = re.sub(r"//[^\n]*", "", body)
+    out, depth, cur = [], 0, ""
+    for ch in body:
+        if ch in "<([{":
+            depth += 1
+        elif ch in ">)]}":
+            depth -= 1
+        if depth == 0 and ch in "\n;,":
+            out.append(cur.strip())
+            cur = ""
+        else:
+            cur += ch
+    out.append(cur.strip())
+    return [m for m in out if m]
+
+
 def from_dts(dts: str):
     """Parse `interface`/`type` declarations into typed Python dataclasses."""
     import re
     out = ["from __future__ import annotations", "from dataclasses import dataclass",
            "from typing import Optional", ""]
-    found = False
+    classes = set()
     for m in re.finditer(r"(?:interface|type)\s+(\w+)(?:\s*=\s*)?\s*\{([^}]*)\}", dts):
-        found = True
         name, body = m.group(1), m.group(2)
+        classes.add(name)
         out.append("@dataclass")
         out.append(f"class {name}:")
-        n_fields = 0
-        for line in body.splitlines():
-            line = line.split("//")[0].strip().rstrip(",;")
+        required, optional = [], []
+        for line in _members(body):
             fm = re.match(r"(?:readonly\s+)?(\w+)(\?)?:\s*(.+)", line)
             if fm:
                 fname, opt, ftype = fm.group(1), fm.group(2), fm.group(3).strip()
                 py_t = _ts_to_py(ftype)
-                out.append(f"    {fname}: {py_t} = None" if opt else f"    {fname}: {py_t}")
-                n_fields += 1
-        if not n_fields:
-            out.append("    pass")
+                # Fields with defaults must follow those without, or the dataclass won't import.
+                (optional if opt else required).append(
+                    f"    {fname}: {py_t if py_t.startswith('Optional[') else f'Optional[{py_t}]'} = None"
+                    if opt else f"    {fname}: {py_t}")
+        out.extend(required + optional or ["    pass"])
         out.append("")
-    for m in re.finditer(r"type\s+(\w+)\s*=\s*([^;]+);", dts):
-        if m.group(1) not in dts:
+    # Plain aliases (`type Id = string | number;`); object types became classes above.
+    for m in re.finditer(r"\btype\s+(\w+)\s*=\s*([^;{]+);", dts):
+        if m.group(1) not in classes:
             out.append(f"{m.group(1)} = {_ts_to_py(m.group(2))}")
-    return "\n".join(out) if found else "\n".join(out)
+    return "\n".join(out)
 
 
 @dataclass

{pyweb_stack-0.4.2 → pyweb_stack-0.4.3}/pyweb/hosting.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import json
 import mimetypes
 import os
+import re
 import time
 
 from .runtime.server import Request, Server
@@ -35,6 +36,81 @@ def _ctype(path):
     return mimetypes.guess_type(path)[0] or "application/octet-stream"
 
 
+# `name.<12 hex>.js|css|js.map` from `pyweb build --production`, and npm files under
+# `vendor/<package>@<version>/`: their URL changes when their content does.
+_VERSIONED = re.compile(r"(^|/)[^/]+\.[0-9a-f]{12}\.(js|css|js\.map)$|(^|/)vendor/(@[^/]+/)?[^/@]+@[^/]+/")
+IMMUTABLE = "public, max-age=31536000, immutable"
+
+
+def static_file(static_dirs, rel, *, query="", if_none_match=None, dev=False):
+    """``(status, headers, body)`` for a file under one of ``static_dirs``.
+
+    Content-hashed and versioned files (and ``?v=`` URLs) are cached for a
+    year. Everything else, such as your own ``static/app.css``, is revalidated
+    with an ETag, so a deploy shows up at once and an unchanged file costs a
+    304 without a body.
+    """
+    rel = rel.split("?")[0]
+    for base in static_dirs:
+        base = os.path.realpath(base)
+        target = os.path.realpath(os.path.join(base, rel))
+        if target != base and not target.startswith(base + os.sep):
+            return 403, [("Content-Type", "text/plain")], b"forbidden"
+        try:
+            st = os.stat(target)
+        except OSError:
+            continue
+        if not os.path.isfile(target):
+            continue
+        etag = f'W/"{st.st_size:x}-{st.st_mtime_ns:x}"'
+        if dev:
+            cache = "no-cache"
+        elif _VERSIONED.search(rel) or re.search(r"(^|&)v=", query or ""):
+            cache = IMMUTABLE
+        else:
+            cache = "public, max-age=0, must-revalidate"
+        headers = [("Content-Type", _ctype(target)), ("Cache-Control", cache), ("ETag", etag)]
+        if if_none_match and etag in [t.strip() for t in if_none_match.split(",")]:
+            return 304, headers, b""
+        with open(target, "rb") as fh:
+            return 200, headers, fh.read()
+    return 404, [("Content-Type", "text/plain")], b"not found"
+
+
+_COMPRESSIBLE = ("text/", "application/json", "application/javascript", "image/svg+xml", "application/xml")
+_gz_cache: dict = {}
+
+
+def gzip_response(headers, body, accept_encoding):
+    """Gzip ``body`` when the client accepts it and it's worth it; returns ``(headers, body)``.
+
+    ``headers`` is a list of ``(name, value)``. Static files (those with an ETag)
+    are compressed once and kept, so repeat requests cost a dictionary lookup.
+    """
+    if not isinstance(body, (bytes, bytearray)) or len(body) < 1024 or "gzip" not in (accept_encoding or ""):
+        return headers, body
+    names = {k.lower(): v for k, v in headers}
+    ctype = names.get("content-type", "")
+    if "content-encoding" in names or not ctype.startswith(_COMPRESSIBLE):
+        return headers, body
+    import gzip
+    etag = names.get("etag")
+    key = (etag, len(body)) if etag else None
+    packed = _gz_cache.get(key) if key else None
+    if packed is None:
+        packed = gzip.compress(bytes(body), 6, mtime=0)
+        if key:
+            if len(_gz_cache) > 512:
+                _gz_cache.clear()
+            _gz_cache[key] = packed
+    if len(packed) >= len(body):
+        return headers, body
+    vary = [v for k, v in headers if k.lower() == "vary"]
+    out = [(k, v) for k, v in headers if k.lower() not in ("content-length", "vary")]
+    out += [("Content-Encoding", "gzip"), ("Vary", ", ".join(vary + ["Accept-Encoding"]))]
+    return out, packed
+
+
 def is_stream(body):
     return not isinstance(body, (bytes, bytearray, str))
 
@@ -119,8 +195,9 @@ class Site:
         self.server = Server(app=app, debug=self.debug, max_body=self.max_body, **self.server_kwargs)
 
     # ------------------------------------------------------------ static
-    def static(self, rel):
-        rel = rel.split("?")[0]
+    def static(self, rel, *, query="", if_none_match=None):
+        rel, _, q = rel.partition("?")
+        query = query or q
         if self.source_mode:
             if rel in ("runtime.js", "markdown.js"):
                 with open(os.path.join(os.path.dirname(RUNTIME_PATH), rel), "rb") as fh:
@@ -128,32 +205,24 @@ class Site:
             if rel in self.memory_js:
                 return 200, [("Content-Type", _ctype(rel)), ("Cache-Control", "no-cache")], \
                     self.memory_js[rel].encode()
-        for base in self.static_dirs:
-            base = os.path.realpath(base)
-            target = os.path.realpath(os.path.join(base, rel))
-            if target != base and not target.startswith(base + os.sep):
-                return 403, [("Content-Type", "text/plain")], b"forbidden"
-            if os.path.isfile(target):
-                with open(target, "rb") as fh:
-                    body = fh.read()
-                cache = "no-cache" if self.source_mode else "public, max-age=31536000, immutable"
-                return 200, [("Content-Type", _ctype(target)), ("Cache-Control", cache)], body
-        return 404, [("Content-Type", "text/plain")], b"not found"
+        return static_file(self.static_dirs, rel, query=query, if_none_match=if_none_match, dev=self.source_mode)
 
     # ----------------------------------------------------------- request
-    def respond(self, method, path, headers, body=b""):
+    def respond(self, method, path, headers, body=b"", client=None):
         bare = path.split("?")[0]
         if bare in ("/healthz", "/health", "/readyz"):
             from . import __version__
             payload = {"ok": True, "version": __version__, "uptime_s": round(time.time() - self.started, 3)}
             out = (200, [("Content-Type", "application/json")], json.dumps(payload).encode())
         elif bare.startswith("/static/") and method in ("GET", "HEAD"):
-            out = self.static(bare[len("/static/"):])
+            query = path.partition("?")[2]
+            inm = next((v for k, v in (headers or {}).items() if k.lower() == "if-none-match"), None)
+            out = self.static(bare[len("/static/"):], query=query, if_none_match=inm)
         elif len(body or b"") > self.max_body:
             out = (413, [("Content-Type", "application/json")],
                    json.dumps({"error": {"code": "http_413", "message": "request body too large"}}).encode())
         else:
-            resp = self.server.handle(Request(method, path, headers, body))
+            resp = self.server.handle(Request(method, path, headers, body, client=client))
             hdrs = []
             for k, v in resp.headers.items():
                 for item in (v if isinstance(v, list) else [v]):
@@ -171,6 +240,9 @@ class Site:
         if ctype.startswith("text/html") and not self.debug and "content-security-policy" not in names:
             from .serve import csp_for
             hdrs.append(("Content-Security-Policy", csp_for(self.csp, raw) if isinstance(raw, bytes) else self.csp))
+        if not is_stream(raw) and status == 200:
+            ae = next((v for k, v in (headers or {}).items() if k.lower() == "accept-encoding"), "")
+            hdrs, raw = gzip_response(hdrs, raw, ae)
         if method == "HEAD":
             hdrs.append(("Content-Length", str(len(raw))))
             raw = b""