pyweb-stack 0.4.4__tar.gz → 0.5.0__tar.gz

{pyweb_stack-0.4.4 → pyweb_stack-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweb-stack
-Version: 0.4.4
+Version: 0.5.0
 Summary: Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC.
 Author-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 Maintainer-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
@@ -40,16 +40,27 @@ Provides-Extra: crypto
 Requires-Dist: cryptography>=42; extra == "crypto"
 Provides-Extra: asgi
 Requires-Dist: uvicorn>=0.30; extra == "asgi"
+Provides-Extra: auth
+Requires-Dist: argon2-cffi>=23.1; extra == "auth"
+Provides-Extra: otel
+Requires-Dist: opentelemetry-sdk>=1.24; extra == "otel"
+Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.24; extra == "otel"
 Provides-Extra: all
 Requires-Dist: psycopg[binary]>=3.1; extra == "all"
 Requires-Dist: PyMySQL>=1.1; extra == "all"
 Requires-Dist: redis>=5; extra == "all"
 Requires-Dist: cryptography>=42; extra == "all"
 Requires-Dist: uvicorn>=0.30; extra == "all"
+Requires-Dist: argon2-cffi>=23.1; extra == "all"
+Requires-Dist: opentelemetry-sdk>=1.24; extra == "all"
+Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.24; extra == "all"
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: playwright>=1.45; extra == "test"
 Requires-Dist: mcp>=1.2; extra == "test"
+Requires-Dist: hypothesis>=6.100; extra == "test"
+Requires-Dist: pyyaml>=6; extra == "test"
+Requires-Dist: opentelemetry-sdk>=1.24; extra == "test"
 Dynamic: license-file
 
 <div align="center">
@@ -59,7 +70,8 @@ Dynamic: license-file
 **Full-stack web apps in one Python file.**
 
 Server-rendered pages, a reactive UI compiled from Python, typed calls to
-your server, live data and streaming AI, with no JavaScript toolchain.
+your server, Models with migrations, forms, accounts, live updates,
+background jobs and one-command deploys, with no JavaScript toolchain.
 
 [![CI](https://github.com/MaanavKrishna/PyWeb/actions/workflows/ci.yml/badge.svg)](https://github.com/MaanavKrishna/PyWeb/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/pyweb-stack)](https://pypi.org/project/pyweb-stack/)
@@ -124,6 +136,63 @@ a validated JSON endpoint the browser calls for you.
 
 ## What you get
 
+### A whole product in one file
+
+```pyweb
+from pyweb import App, Field, Form, Input, Model, Submit, server
+from pyweb.authkit import User
+
+app = App(title="Feedback", database="sqlite:///app.db")
+auth = app.use_auth()            # sign-up, passkeys, OAuth, /admin
+
+
+class Idea(Model):
+    text: str = Field(min=3, max=280)
+    votes: int = 0
+    author: User = Field(readonly=True)
+
+
+def own(user, idea):
+    return user is not None and idea.author_id == user.id
+
+
+Idea.policy(write=own)           # only its author can change an idea
+
+
+@server(login=True)
+def share(idea: Idea):           # the form's fields come from Idea
+    idea.author = auth.user()
+    idea.save()
+    thank.enqueue(idea.id)       # runs after the request commits
+
+
+@app.job(retries=3)
+def thank(idea_id: int):
+    print(f"thanks for idea {idea_id}")
+
+
+@app.page("/", login=True)
+def Ideas():
+    ideas = Idea.query().order("-id").live()    # every open tab
+
+    <Form action={share}>
+        <Input name="text" placeholder="Your idea" />
+        <Submit>Share</Submit>
+    </Form>
+    <ul>
+        for idea in ideas:
+            <li>{idea["text"]} ({idea["votes"]})</li>
+    </ul>
+```
+
+That's accounts (sign-up with email confirmation, passkeys, OAuth, an
+admin), a table with rules and a row policy, a form that checks what
+people type in the browser and again on the server (and works without
+JavaScript), a background job queued in the same transaction, and a list
+that updates in every open tab when anyone shares an idea. Start a bigger
+one with `pyweb new myapp --template saas`, or follow
+[a SaaS in an hour](docs/28-saas-tutorial.md).
+
 ### Python on both sides, split by the compiler
 
 You write one file. The compiler decides, line by line, what runs in the
@@ -133,19 +202,22 @@ everything else is computed on the server. Database handles, imports and
 secrets can't leak into browser code: that's a compile error with a line
 number, not a production incident.
 
-### Pages that follow the database
+### Data, with migrations that write themselves
 
 ```pyweb
-from pyweb import App, live
-from pyweb.db import connect
+from pyweb import App, Field, Model
 
-app = App()
-db = connect("sqlite:///shop.db")
+app = App(database="sqlite:///shop.db")      # DATABASE_URL takes over in production
+
+
+class Order(Model):
+    item: str = Field(max=80)
+    status: str = Field(default="new", choices=["new", "paid", "shipped"])
 
 
 @app.page("/orders")
 def Orders():
-    orders = live(db, "select item, status from orders order by id desc limit 20")
+    orders = Order.query().order("-id").limit(20).live()
 
     <ul>
         for o in orders:
@@ -153,8 +225,14 @@ def Orders():
     </ul>
 ```
 
-Any write through `pyweb.db` updates every open window. Identical queries
-run once for all viewers, and it works across processes with Redis.
+Models work on SQLite, Postgres and MySQL, with relations loaded by
+`include()` (an N+1 loop is an error while you develop), cursor
+pagination, transactions per request and read replicas.
+`pyweb db diff` writes the migration when a Model changes and
+`pyweb db upgrade` applies it, under a lock so many servers can start at
+once. `.live()` keeps the list in step with the database in every open
+tab: when one row changes, one row is sent. Raw SQL works too
+(`live(db, "select ...")`). [Data →](docs/09-data.md) ·
 [Live data →](docs/21-live-data.md)
 
 ### AI features that stream
@@ -244,17 +322,36 @@ keeps only the files the browser loads and pins them in `pyweb.lock`.
 There's no `node_modules` and no bundler, and pages that don't use a
 package don't load it. [npm packages →](docs/18-npm-packages.md)
 
+### Ship it, then see what it does
+
+```bash
+pyweb deploy fly          # or docker, compose, k8s, render, railway
+```
+
+`pyweb deploy` reads your app and explains its plan: Postgres instead of
+SQLite, a worker for jobs, Redis when there's more than one server,
+migrations before the new version takes traffic. Then it writes the
+files. In production every log line is JSON with the request id and
+trace id, `/metrics` answers Prometheus, OpenTelemetry traces follow a
+click into its server function, SQL and background job, and while you
+develop a toolbar on every page shows each request's queries and flags
+N+1 loops. [Scaling & deploying →](docs/25-scaling.md) ·
+[Logs, metrics & tracing →](docs/26-observability.md)
+
 ### Small, fast and boring to run
 
 - **Every page is server-rendered**: complete HTML on first paint, then
   hydrated in place. Pages without interactivity ship no JavaScript.
 - **Small**: a typical interactive page is under 1 KB of code plus a
-  ~15 KB (gzip) runtime that's cached across pages.
-- **Stateless servers**: signed-cookie sessions and plain JSON over HTTP
-  scale behind any load balancer. Run `pyweb serve`, uvicorn/gunicorn
-  (ASGI) or the generated Dockerfile.
-- **Secure defaults**: escaped output, a strict Content Security Policy,
-  CSRF and origin checks on RPC, rate limits and request size limits.
+  ~14 KB (gzip) runtime that's cached across pages. Forms and live
+  updates add a few KB, only on pages that use them.
+- **Its own server**: `pyweb serve` handles HTTP/1.1 keep-alive and
+  WebSockets on one asyncio loop per process, with `--workers N`
+  processes. Sessions are signed cookies, so servers stay stateless
+  behind any load balancer. uvicorn and other ASGI servers work too.
+- **Secure defaults**: escaped output, a hashed Content Security Policy,
+  CSRF and origin checks, row policies, rate limits, request size limits
+  and `pyweb check --production` before you deploy.
 
 ## See it
 
@@ -270,7 +367,7 @@ it runs the real PyWeb, server functions included, in your browser.
 
 ```bash
 pip install pyweb-stack
-pyweb new myapp --template todo      # blank | counter | todo | blog | auth | chat | ai-chat
+pyweb new myapp --template saas      # saas | blank | counter | todo | blog | auth | chat | ai-chat
 cd myapp
 pyweb dev app.pyweb                  # edit app.pyweb; the page reloads on save
 ```
@@ -280,8 +377,8 @@ Then:
 ```bash
 pyweb check app.pyweb                # compile + security checks (CI-friendly exit codes)
 pytest                               # new apps come with test_app.py
-pyweb build app.pyweb --production   # hashed, minified, self-contained dist/
-pyweb serve dist                     # production server
+pyweb db diff                        # a migration for what changed in your Models
+pyweb deploy compose                 # or fly, render, railway, k8s, docker
 ```
 
 The [quickstart](docs/02-quickstart.md) and [tutorial](docs/03-tutorial.md)
@@ -301,7 +398,7 @@ take it from there.
        │  handlers in JS │  │  sessions, secrets      │
        └────────┬────────┘  └────────────┬────────────┘
                 └──── typed JSON RPC ────┘
-                     (streams and live updates over the same HTTP)
+          (streams over HTTP; live data over one WebSocket per tab)
 ```
 
 The [architecture overview](ARCHITECTURE.md) goes through each stage.
@@ -309,8 +406,10 @@ The [architecture overview](ARCHITECTURE.md) goes through each stage.
 ## Build it with AI
 
 PyWeb ships an MCP server so AI assistants can scaffold, check, inspect,
-render, screenshot and test your app, add npm packages, and map its
-routes. Errors come back as line numbers with fix hints:
+render, screenshot and test your app, add npm packages, map its routes,
+and look at its data: the schema, read-only queries (row-limited, secrets
+redacted), pending migrations, jobs and recent requests. Errors come back
+as line numbers with fix hints:
 
 ```bash
 claude mcp add pyweb -- pyweb mcp                                    # Claude Code
@@ -329,8 +428,11 @@ site publishes [`llms-full.txt`](https://maanavkrishna.github.io/PyWeb/llms-full
 
 The **[VS Code extension](editors/vscode)** adds highlighting, errors as
 you type, hover that shows where code runs (and the signatures of npm
-packages), completion and go to definition. Any other LSP editor can run
-`pyweb lsp` ([setup](docs/14-cli.md#editor-support)).
+packages), completion that knows your Models' fields and query methods,
+warnings for N+1 loops and form fields the action doesn't take, a code
+lens that writes the migration when a Model changes, and go to
+definition. Any other LSP editor can run `pyweb lsp`
+([setup](docs/14-cli.md#editor-support)).
 
 ## Examples
 
@@ -339,10 +441,11 @@ real browser by the test suite.
 
 | Example | Shows |
 |---|---|
+| [`saas`](examples/saas/app.pyweb) | accounts, Models with migrations, row policies, forms, live lists, a job, a daily email, an admin |
 | [`counter`](examples/counter/app.pyweb) | signals, computed values, binding a number input |
 | [`todo`](examples/todo/app.pyweb) | components, list mutation, filters, keyed lists |
-| [`blog`](examples/blog/app.pyweb) | SQL database, server functions, route parameters, 404s, validation errors |
-| [`auth`](examples/auth/app.pyweb) | registration, password hashing, sessions, protected pages |
+| [`blog`](examples/blog/app.pyweb) | a Model, server functions, route parameters, 404s, validation errors |
+| [`auth`](examples/auth/app.pyweb) | your own registration, password hashing and sessions (or use `app.use_auth()`) |
 | [`chat`](examples/chat/app.pyweb) | route parameters, shared server state, live updates with `publish`/`subscribe` |
 | [`showcase`](examples/showcase/app.pyweb) | everything on one page, with a stylesheet |
 | [`site`](examples/site/app.pyweb) | a layout, client-side navigation, query parameters, page titles, a 404 page |
@@ -353,10 +456,10 @@ real browser by the test suite.
 
 | | |
 |---|---|
-| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
+| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [A SaaS in an hour](docs/28-saas-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
 | Language | [`.pyweb` files](docs/04-pyweb-files.md) · [State & reactivity](docs/05-reactivity.md) · [Python in the browser](docs/07-browser-python.md) · [npm packages](docs/18-npm-packages.md) |
-| Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Layouts & navigation](docs/19-layouts-navigation.md) · [Data](docs/09-data.md) · [Live data](docs/21-live-data.md) · [Building AI apps](docs/20-ai-apps.md) · [Auth](docs/10-auth.md) |
-| Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) |
+| Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Layouts & navigation](docs/19-layouts-navigation.md) · [Data](docs/09-data.md) · [Forms](docs/23-forms.md) · [Auth](docs/10-auth.md) · [Live data](docs/21-live-data.md) · [Background jobs](docs/24-jobs.md) · [Building AI apps](docs/20-ai-apps.md) |
+| Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Scaling](docs/25-scaling.md) · [Logs, metrics & tracing](docs/26-observability.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) · [Upgrading to 0.5](docs/27-upgrading.md) |
 | Reference | [Recipe: wallets & web3](docs/22-recipe-web3.md) · [Toolkit & stability](docs/15-toolkit.md) · [Limitations & roadmap](docs/16-limitations-roadmap.md) · [Architecture](ARCHITECTURE.md) · [Changelog](CHANGELOG.md) |
 
 The same docs are published at
@@ -384,17 +487,21 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
+| 0.5 | Models with migrations, forms, auth kit with passkeys, OAuth and an admin, row-level live updates over WebSockets on PyWeb's own server, durable jobs and schedules, `pyweb deploy` for docker, compose, k8s, fly, render and railway, logs, metrics, tracing and a dev toolbar, data-aware editor and MCP tools, the `saas` template, `pyweb upgrade` |
 | 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |
 
-The test suite covers the parser, the Python→JavaScript translation
-(differentially, against CPython), the reactive runtime, server
-rendering, RPC, streaming, live queries, client-side navigation, every
-example app in Chromium, the playground on Pyodide, and the
-database/Redis layers against real Postgres, MySQL and Redis servers, on
-Python 3.10–3.13.
+The test suite (about 1,200 tests) covers the parser, the
+Python→JavaScript translation (differentially, against CPython), the
+reactive runtime, server rendering, RPC, forms, Models and migrations
+(with property tests), the HTTP and WebSocket parsers (fuzzed), live
+patches, jobs on every backend, every example app in Chromium, the
+playground on Pyodide, and the whole suite against real Postgres, MySQL
+and Redis servers, on Python 3.10–3.13. CI also boots a
+`pyweb deploy compose` stack and runs the VS Code extension in a real
+VS Code.
 
 ## Contributing
 

{pyweb_stack-0.4.4 → pyweb_stack-0.5.0}/README.md

@@ -5,7 +5,8 @@
 **Full-stack web apps in one Python file.**
 
 Server-rendered pages, a reactive UI compiled from Python, typed calls to
-your server, live data and streaming AI, with no JavaScript toolchain.
+your server, Models with migrations, forms, accounts, live updates,
+background jobs and one-command deploys, with no JavaScript toolchain.
 
 [![CI](https://github.com/MaanavKrishna/PyWeb/actions/workflows/ci.yml/badge.svg)](https://github.com/MaanavKrishna/PyWeb/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/pyweb-stack)](https://pypi.org/project/pyweb-stack/)
@@ -70,6 +71,63 @@ a validated JSON endpoint the browser calls for you.
 
 ## What you get
 
+### A whole product in one file
+
+```pyweb
+from pyweb import App, Field, Form, Input, Model, Submit, server
+from pyweb.authkit import User
+
+app = App(title="Feedback", database="sqlite:///app.db")
+auth = app.use_auth()            # sign-up, passkeys, OAuth, /admin
+
+
+class Idea(Model):
+    text: str = Field(min=3, max=280)
+    votes: int = 0
+    author: User = Field(readonly=True)
+
+
+def own(user, idea):
+    return user is not None and idea.author_id == user.id
+
+
+Idea.policy(write=own)           # only its author can change an idea
+
+
+@server(login=True)
+def share(idea: Idea):           # the form's fields come from Idea
+    idea.author = auth.user()
+    idea.save()
+    thank.enqueue(idea.id)       # runs after the request commits
+
+
+@app.job(retries=3)
+def thank(idea_id: int):
+    print(f"thanks for idea {idea_id}")
+
+
+@app.page("/", login=True)
+def Ideas():
+    ideas = Idea.query().order("-id").live()    # every open tab
+
+    <Form action={share}>
+        <Input name="text" placeholder="Your idea" />
+        <Submit>Share</Submit>
+    </Form>
+    <ul>
+        for idea in ideas:
+            <li>{idea["text"]} ({idea["votes"]})</li>
+    </ul>
+```
+
+That's accounts (sign-up with email confirmation, passkeys, OAuth, an
+admin), a table with rules and a row policy, a form that checks what
+people type in the browser and again on the server (and works without
+JavaScript), a background job queued in the same transaction, and a list
+that updates in every open tab when anyone shares an idea. Start a bigger
+one with `pyweb new myapp --template saas`, or follow
+[a SaaS in an hour](docs/28-saas-tutorial.md).
+
 ### Python on both sides, split by the compiler
 
 You write one file. The compiler decides, line by line, what runs in the
@@ -79,19 +137,22 @@ everything else is computed on the server. Database handles, imports and
 secrets can't leak into browser code: that's a compile error with a line
 number, not a production incident.
 
-### Pages that follow the database
+### Data, with migrations that write themselves
 
 ```pyweb
-from pyweb import App, live
-from pyweb.db import connect
+from pyweb import App, Field, Model
 
-app = App()
-db = connect("sqlite:///shop.db")
+app = App(database="sqlite:///shop.db")      # DATABASE_URL takes over in production
+
+
+class Order(Model):
+    item: str = Field(max=80)
+    status: str = Field(default="new", choices=["new", "paid", "shipped"])
 
 
 @app.page("/orders")
 def Orders():
-    orders = live(db, "select item, status from orders order by id desc limit 20")
+    orders = Order.query().order("-id").limit(20).live()
 
     <ul>
         for o in orders:
@@ -99,8 +160,14 @@ def Orders():
     </ul>
 ```
 
-Any write through `pyweb.db` updates every open window. Identical queries
-run once for all viewers, and it works across processes with Redis.
+Models work on SQLite, Postgres and MySQL, with relations loaded by
+`include()` (an N+1 loop is an error while you develop), cursor
+pagination, transactions per request and read replicas.
+`pyweb db diff` writes the migration when a Model changes and
+`pyweb db upgrade` applies it, under a lock so many servers can start at
+once. `.live()` keeps the list in step with the database in every open
+tab: when one row changes, one row is sent. Raw SQL works too
+(`live(db, "select ...")`). [Data →](docs/09-data.md) ·
 [Live data →](docs/21-live-data.md)
 
 ### AI features that stream
@@ -190,17 +257,36 @@ keeps only the files the browser loads and pins them in `pyweb.lock`.
 There's no `node_modules` and no bundler, and pages that don't use a
 package don't load it. [npm packages →](docs/18-npm-packages.md)
 
+### Ship it, then see what it does
+
+```bash
+pyweb deploy fly          # or docker, compose, k8s, render, railway
+```
+
+`pyweb deploy` reads your app and explains its plan: Postgres instead of
+SQLite, a worker for jobs, Redis when there's more than one server,
+migrations before the new version takes traffic. Then it writes the
+files. In production every log line is JSON with the request id and
+trace id, `/metrics` answers Prometheus, OpenTelemetry traces follow a
+click into its server function, SQL and background job, and while you
+develop a toolbar on every page shows each request's queries and flags
+N+1 loops. [Scaling & deploying →](docs/25-scaling.md) ·
+[Logs, metrics & tracing →](docs/26-observability.md)
+
 ### Small, fast and boring to run
 
 - **Every page is server-rendered**: complete HTML on first paint, then
   hydrated in place. Pages without interactivity ship no JavaScript.
 - **Small**: a typical interactive page is under 1 KB of code plus a
-  ~15 KB (gzip) runtime that's cached across pages.
-- **Stateless servers**: signed-cookie sessions and plain JSON over HTTP
-  scale behind any load balancer. Run `pyweb serve`, uvicorn/gunicorn
-  (ASGI) or the generated Dockerfile.
-- **Secure defaults**: escaped output, a strict Content Security Policy,
-  CSRF and origin checks on RPC, rate limits and request size limits.
+  ~14 KB (gzip) runtime that's cached across pages. Forms and live
+  updates add a few KB, only on pages that use them.
+- **Its own server**: `pyweb serve` handles HTTP/1.1 keep-alive and
+  WebSockets on one asyncio loop per process, with `--workers N`
+  processes. Sessions are signed cookies, so servers stay stateless
+  behind any load balancer. uvicorn and other ASGI servers work too.
+- **Secure defaults**: escaped output, a hashed Content Security Policy,
+  CSRF and origin checks, row policies, rate limits, request size limits
+  and `pyweb check --production` before you deploy.
 
 ## See it
 
@@ -216,7 +302,7 @@ it runs the real PyWeb, server functions included, in your browser.
 
 ```bash
 pip install pyweb-stack
-pyweb new myapp --template todo      # blank | counter | todo | blog | auth | chat | ai-chat
+pyweb new myapp --template saas      # saas | blank | counter | todo | blog | auth | chat | ai-chat
 cd myapp
 pyweb dev app.pyweb                  # edit app.pyweb; the page reloads on save
 ```
@@ -226,8 +312,8 @@ Then:
 ```bash
 pyweb check app.pyweb                # compile + security checks (CI-friendly exit codes)
 pytest                               # new apps come with test_app.py
-pyweb build app.pyweb --production   # hashed, minified, self-contained dist/
-pyweb serve dist                     # production server
+pyweb db diff                        # a migration for what changed in your Models
+pyweb deploy compose                 # or fly, render, railway, k8s, docker
 ```
 
 The [quickstart](docs/02-quickstart.md) and [tutorial](docs/03-tutorial.md)
@@ -247,7 +333,7 @@ take it from there.
        │  handlers in JS │  │  sessions, secrets      │
        └────────┬────────┘  └────────────┬────────────┘
                 └──── typed JSON RPC ────┘
-                     (streams and live updates over the same HTTP)
+          (streams over HTTP; live data over one WebSocket per tab)
 ```
 
 The [architecture overview](ARCHITECTURE.md) goes through each stage.
@@ -255,8 +341,10 @@ The [architecture overview](ARCHITECTURE.md) goes through each stage.
 ## Build it with AI
 
 PyWeb ships an MCP server so AI assistants can scaffold, check, inspect,
-render, screenshot and test your app, add npm packages, and map its
-routes. Errors come back as line numbers with fix hints:
+render, screenshot and test your app, add npm packages, map its routes,
+and look at its data: the schema, read-only queries (row-limited, secrets
+redacted), pending migrations, jobs and recent requests. Errors come back
+as line numbers with fix hints:
 
 ```bash
 claude mcp add pyweb -- pyweb mcp                                    # Claude Code
@@ -275,8 +363,11 @@ site publishes [`llms-full.txt`](https://maanavkrishna.github.io/PyWeb/llms-full
 
 The **[VS Code extension](editors/vscode)** adds highlighting, errors as
 you type, hover that shows where code runs (and the signatures of npm
-packages), completion and go to definition. Any other LSP editor can run
-`pyweb lsp` ([setup](docs/14-cli.md#editor-support)).
+packages), completion that knows your Models' fields and query methods,
+warnings for N+1 loops and form fields the action doesn't take, a code
+lens that writes the migration when a Model changes, and go to
+definition. Any other LSP editor can run `pyweb lsp`
+([setup](docs/14-cli.md#editor-support)).
 
 ## Examples
 
@@ -285,10 +376,11 @@ real browser by the test suite.
 
 | Example | Shows |
 |---|---|
+| [`saas`](examples/saas/app.pyweb) | accounts, Models with migrations, row policies, forms, live lists, a job, a daily email, an admin |
 | [`counter`](examples/counter/app.pyweb) | signals, computed values, binding a number input |
 | [`todo`](examples/todo/app.pyweb) | components, list mutation, filters, keyed lists |
-| [`blog`](examples/blog/app.pyweb) | SQL database, server functions, route parameters, 404s, validation errors |
-| [`auth`](examples/auth/app.pyweb) | registration, password hashing, sessions, protected pages |
+| [`blog`](examples/blog/app.pyweb) | a Model, server functions, route parameters, 404s, validation errors |
+| [`auth`](examples/auth/app.pyweb) | your own registration, password hashing and sessions (or use `app.use_auth()`) |
 | [`chat`](examples/chat/app.pyweb) | route parameters, shared server state, live updates with `publish`/`subscribe` |
 | [`showcase`](examples/showcase/app.pyweb) | everything on one page, with a stylesheet |
 | [`site`](examples/site/app.pyweb) | a layout, client-side navigation, query parameters, page titles, a 404 page |
@@ -299,10 +391,10 @@ real browser by the test suite.
 
 | | |
 |---|---|
-| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
+| Start | [Introduction](docs/01-introduction.md) · [Quickstart](docs/02-quickstart.md) · [Tutorial](docs/03-tutorial.md) · [A SaaS in an hour](docs/28-saas-tutorial.md) · [AI assistants & MCP](docs/17-ai-assistants.md) |
 | Language | [`.pyweb` files](docs/04-pyweb-files.md) · [State & reactivity](docs/05-reactivity.md) · [Python in the browser](docs/07-browser-python.md) · [npm packages](docs/18-npm-packages.md) |
-| Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Layouts & navigation](docs/19-layouts-navigation.md) · [Data](docs/09-data.md) · [Live data](docs/21-live-data.md) · [Building AI apps](docs/20-ai-apps.md) · [Auth](docs/10-auth.md) |
-| Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) |
+| Server | [Server functions & RPC](docs/06-server-functions.md) · [Pages & routing](docs/08-pages-routing-assets.md) · [Layouts & navigation](docs/19-layouts-navigation.md) · [Data](docs/09-data.md) · [Forms](docs/23-forms.md) · [Auth](docs/10-auth.md) · [Live data](docs/21-live-data.md) · [Background jobs](docs/24-jobs.md) · [Building AI apps](docs/20-ai-apps.md) |
+| Ship | [Testing](docs/11-testing.md) · [Deployment](docs/12-deployment.md) · [Scaling](docs/25-scaling.md) · [Logs, metrics & tracing](docs/26-observability.md) · [Security](docs/13-security.md) · [CLI](docs/14-cli.md) · [Upgrading to 0.5](docs/27-upgrading.md) |
 | Reference | [Recipe: wallets & web3](docs/22-recipe-web3.md) · [Toolkit & stability](docs/15-toolkit.md) · [Limitations & roadmap](docs/16-limitations-roadmap.md) · [Architecture](ARCHITECTURE.md) · [Changelog](CHANGELOG.md) |
 
 The same docs are published at
@@ -330,17 +422,21 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
+| 0.5 | Models with migrations, forms, auth kit with passkeys, OAuth and an admin, row-level live updates over WebSockets on PyWeb's own server, durable jobs and schedules, `pyweb deploy` for docker, compose, k8s, fly, render and railway, logs, metrics, tracing and a dev toolbar, data-aware editor and MCP tools, the `saas` template, `pyweb upgrade` |
 | 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |
 
-The test suite covers the parser, the Python→JavaScript translation
-(differentially, against CPython), the reactive runtime, server
-rendering, RPC, streaming, live queries, client-side navigation, every
-example app in Chromium, the playground on Pyodide, and the
-database/Redis layers against real Postgres, MySQL and Redis servers, on
-Python 3.10–3.13.
+The test suite (about 1,200 tests) covers the parser, the
+Python→JavaScript translation (differentially, against CPython), the
+reactive runtime, server rendering, RPC, forms, Models and migrations
+(with property tests), the HTTP and WebSocket parsers (fuzzed), live
+patches, jobs on every backend, every example app in Chromium, the
+playground on Pyodide, and the whole suite against real Postgres, MySQL
+and Redis servers, on Python 3.10–3.13. CI also boots a
+`pyweb deploy compose` stack and runs the VS Code extension in a real
+VS Code.
 
 ## Contributing
 

{pyweb_stack-0.4.4 → pyweb_stack-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweb-stack"
-version = "0.4.4"
+version = "0.5.0"
 description = "Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC."
 readme = "README.md"
 license = { text = "MIT" }
@@ -40,8 +40,11 @@ mysql = ["PyMySQL>=1.1"]
 redis = ["redis>=5"]
 crypto = ["cryptography>=42"]
 asgi = ["uvicorn>=0.30"]
-all = ["psycopg[binary]>=3.1", "PyMySQL>=1.1", "redis>=5", "cryptography>=42", "uvicorn>=0.30"]
-test = ["pytest>=8", "playwright>=1.45", "mcp>=1.2"]
+auth = ["argon2-cffi>=23.1"]
+otel = ["opentelemetry-sdk>=1.24", "opentelemetry-exporter-otlp-proto-http>=1.24"]
+all = ["psycopg[binary]>=3.1", "PyMySQL>=1.1", "redis>=5", "cryptography>=42", "uvicorn>=0.30", "argon2-cffi>=23.1",
+       "opentelemetry-sdk>=1.24", "opentelemetry-exporter-otlp-proto-http>=1.24"]
+test = ["pytest>=8", "playwright>=1.45", "mcp>=1.2", "hypothesis>=6.100", "pyyaml>=6", "opentelemetry-sdk>=1.24"]
 
 [project.urls]
 Homepage = "https://maanavkrishna.github.io/PyWeb/"
@@ -57,7 +60,7 @@ pyweb = "pyweb.cli:main"
 include = ["pyweb*"]
 
 [tool.setuptools.package-data]
-pyweb = ["runtime/browser/*.js", "py.typed", "ai/*.md", "templates/*.pyweb", "templates/*.css"]
+pyweb = ["runtime/browser/*.js", "py.typed", "ai/*.md", "templates/*.pyweb", "templates/*.css", "templates/*/*.pyweb", "templates/*/*.py", "templates/*/*.md"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]