@reportwright/viewer 0.12.1 → 0.13.1

package/CHANGELOG.md

@@ -2,6 +2,99 @@
 
 All `@reportwright/*` packages (formerly `@pagewrightjs/*`) share one version. The versioning policy is in [CONTRIBUTING.md](CONTRIBUTING.md#versioning-semver).
 
+## 0.13.1 — 2026-10-09
+
+### Fixed
+- **N10: the CJK fonts are named Regular in the PDF.** `@reportwright/fonts-cjk` downloads variable TrueType fonts whose default instance is Thin; 0.13.0 cut and renamed the subset at Regular, but `exportPdf` and `exportPdfStream` built the BaseFont from the full font's PostScript name, so pdffonts showed `NotoSansJP-Thin` / `NotoSansKR-Thin`. Both now take the name from the subset they embed (`NotoSansJP-Regular`). Test: tests/engine/b11-cjk-names.test.js (the downloaded fonts are tested when present).
+- **N44: a streamed tagged PDF's memory stays flat.** The writer kept where each object is in arrays of 7 bytes an object that doubled; a tagged million-row ledger has 8–11 million objects (an element per cell), most of tagging's ~125 MB at 1M rows. They are now blocks of 16,384 entries, each deflated (~2 KB) once the numbers are two blocks past; the tagger lets go of a page's elements when it ends. Same file byte for byte (but its ID): veraPDF UA-1 and A-2a pass, same `pdfinfo -struct` tree. Off-heap peak at 50k/100k/200k rows: 16.8/29.1/36.6 MB before, 6.7/7.3/9.3 MB after (RSS ~205 MB either way). Test: tests/engine/b11-n44-tagged-memory.test.js.
+- **N45: `pw render` stopped by a signal leaves no temporary file.** SIGTERM (Docker, Kubernetes, CI), SIGINT (Ctrl+C) and SIGHUP remove `<file>.<pid>.part`, keep an older PDF at the path as it was, and exit 143, 130 or 129. Before, every one of them left the `.part` file. Test: tests/engine/b10-perf-cli.test.js.
+- **N41: a copied worker starts.** The npm package's `engine.worker.js` bundles its libraries (bidi-js, fontkit) instead of importing them by name, so an esbuild app that copies it next to its bundle renders in the worker (it crashed with "Failed to resolve module specifier bidi-js" and fell back to the main thread). Barcodes and the standard-font metrics are files next to it (`engine.worker.bwip.js`, `engine.worker.stdfonts.js`), as in the browser build; the README says to copy `engine.worker*.js`. Test: tests/e2e/b11-esbuild-worker.mjs.
+- **N40: `fonts` is optional.** `render()`, `exportPdf()`, `exportPdfStream()` and the Word, Excel and PowerPoint exports use one default store over `@reportwright/fonts` when given none, and an export loads the fonts the model uses into whatever store it gets, so render and export need not share a store (it failed with "this.loader is not a function" or 'Font "Helvetica" is not loaded'). A report in the standard PDF fonts needs no store and no fonts package (a bold title in a Helvetica report no longer loads Inter-Bold); a font that cannot load says "Install @reportwright/fonts, or pass { fontStore }". Test: tests/engine/b11-fonts-n40.test.js, and the packed packages in all four combinations (packages.test.js).
+- **N19: one warning prefix.** The engine package's console warnings and deprecations start with `[reportwright]`, as the rest do (they said `[@reportwright/engine]`).
+- **N43: the standard-font metrics are a table.** Helvetica, Times, Courier, Symbol and ZapfDingbats widths and font-wide metrics are generated once from the Adobe AFM data (`scripts/gen-standard-metrics.mjs` → `src/engine/text/standard-metrics.js`, 22 KB, 5 KB gzipped) instead of decompressed with pako from `@pdf-lib/standard-fonts` at every cold start; that package is no longer a dependency of `@reportwright/engine` or `@reportwright/viewer` (pdf-lib still installs it for itself), and the viewer's `engine.worker.stdfonts.js` is gone (the table is in the worker: 588 → 594 KB gzipped, about 100 KB gzipped less in all). PDFs are byte-identical. A new process making a 1-page Helvetica invoice: median of 10, 115 → 94 ms on an M2 (Node 20). Test: tests/engine/b11-fonts-n43.test.js.
+- **N42: the designer Outline passes axe.** It was a `listbox` whose rows also hold their move buttons (a listbox may hold only options: aria-required-children, critical). The rows are now toggle buttons (`aria-pressed`) in a labelled group, with the same keyboard: one Tab stop, Up/Down/Home/End, Enter or Space selects.
+- **N44: a large sort's memory stays flat.** The disk spill behind grouped and sorted streamed reports held a 1,000-row batch from every sorted run while merging (50 runs at 1,000,000 rows), so its memory grew with the rows. Runs are now about 8 MB (at most 10,000 rows), batches 200 rows, and the merge holds about 4 MB: past that many runs, groups of runs are merged on disk first. A 200,000-row grouped ledger: 280 → 232 MB peak; the same with 50 runs (the run count of 1,000,000 rows): 296 → 240 MB. `spillSorter({ runMB, mergeMB })` sets them. The engine README recommends `presorted: true` with ORDER BY at the source for big grouped reports. Test: tests/engine/b11-mem-spill.test.js.
+- **SILENT-6: an item taller than the page warns in `validate()`.** A body item taller than the room the page has for the body (the page less its margins, page header and footer, a body section's own page and bands counted) warns with both heights and what the render does: its lower part is cut at the page bottom (a text box's text of more than one line continues on the next page). Tables, matrices, lists and subreports, which split by their rows, and pageless pages are quiet. `render()` keeps its own warning where it cuts (with the page number) and does not repeat validate's. Test: tests/engine/b11-mem-silent6-tall.test.js.
+- **N37: repeated copies cascade.** Ctrl+D (Duplicate) and Paste put a copy 12 pt right and down, and 12 more while an item already sits there, so copying the same item again and again fans the copies out instead of stacking them on the first copy. A pasted coordinate that is not a finite number starts at 0, and the steps are bounded, so a paste of hostile JSON (`1e309`, 2^60) cannot hang the tab. Test: tests/engine/b11-mem-designer-cascade.test.js.
+
+## 0.13.0 — 2026-10-09
+
+A minor release: new options (`largeReportRows`, `signal`, `warnOnLeave`, `onDirtyChange`), the 14 standard PDF fonts, streamed Excel and Word exports, and warnings where mistakes used to be silent. The tester's 0.12.1 tickets are fixed except where noted; fonts are still TTF (WOFF2 is not done).
+
+### Fixed
+- **Cold Helvetica invoice (A1.1):** a report that names only the standard PDF fonts loads no font file and no fontkit (Inter loads in a second layout pass only when some text needs it, such as a character WinAnsi lacks), and `exportPdf` writes such a model (standard-font text, boxes, lines, links) with the engine's own PDF writer instead of pdf-lib. A new process making a 1-page Helvetica invoice PDF: about 115 ms instead of 224 ms on an M2, with the same text, fonts and page content. Embedded fonts, images, form fields, PDF/A, tagged, encrypted and signed files still go through pdf-lib.
+- **Cold start (A1.1):** pdf-lib and fontkit load on first use (in Node through `require`, elsewhere `import()`), not
+  when the engine is imported: `import('@reportwright/engine')` takes about 42 ms instead of 175 ms on an M2, a render
+  loads only fontkit, and the streaming PDF writer never loads pdf-lib. A new process making a 1-page invoice PDF:
+  about 318 ms instead of 364 ms (most of what is left is compiling harfbuzz-subset.wasm, about 150 ms).
+- **Large classic renders (A1.4, A1.5):** `render()` past 100,000 rows warns once (`Large report (N rows):
+  exportPdfStream writes it in about 320 MB; render + exportPdf holds it all in memory`), in the model's warnings and
+  once per process on the console. The threshold is the render option `largeReportRows` (100000; `0` or `false`: off). `exportPdf` takes a rendered model, so it cannot switch to streaming itself; the
+  engine README shows `exportPdfStream` with a sink that keeps the bytes.
+- **Excel streams; Word is written page by page (A1.9):** `exportXlsxStream` keeps memory flat; `exportDocxStream` lowers it, but a Word export's memory still grows slowly with the rows, so it is not yet a flat stream. `exportDocxStream` and `exportXlsxStream` (engine package and `src/exporters/officestream.js`) write a report's Word or Excel file to a sink as its pages or rows are made, with `exportPdfStream`'s sink, `timeoutMs` and `signal`; a report that cannot stream is written whole (`why`). `exportDocx` writes the document XML into the zip page by page instead of holding it. Peak RSS of a Word export, 20k / 50k rows: 329 / 499 MB before (render + exportDocx), 259 / 286 MB streamed with a flat live heap (17.5 / 17.3 MB after GC); Excel 251 / 432 MB before, 125 / 126 MB streamed (`scripts/mem-office.mjs`).
+- **Viewer first load (A1.6):** the embedded viewer no longer loads the engine (layout, expressions, charts, maps, barcodes) on the main thread up front: the worker renders, and the engine loads on the main thread on the first export, parameter list or main-thread render. First load 827 → 652 KB gzipped (about 262 KB once fontkit loads lazily); the render worker 908 → 579 KB, with bwip-js in `engine.worker.bwip.js` beside it, imported for a report with a barcode (a worker copied alone renders such a report on the main thread). `tests/engine/b10-bundle-size.test.js` holds both to a budget.
+- **`pw render -f pdf` streams (A1.4):** into a file, a flowing report is written by `exportPdfStream` (the message says
+  `streamed`; the text is the whole-model PDF's), through a temporary file renamed on success, so a failed run leaves
+  no damaged PDF. Encrypted files, reports that cannot stream and `-o -` render the whole model as before. A streamed
+  grouped report no longer warns that the group totals' internal fields (`__g0_0`) are missing.
+- **First PDF of a cold process (Node):** harfbuzz-subset.wasm is compiled synchronously, which V8 does lazily; the async compile also optimized the whole module in the background, and the first export waited for it. A cold 1-page invoice in Inter: export 215 ms → 40 ms, whole process 498 ms → 305 ms (median of 10, M2). Browsers keep the async compile. A PDF in the standard fonts never loads the subsetter.
+- **CJK fonts survive upgrades (N10):** `@reportwright/fonts-cjk` downloads into a cache folder outside the package (`REPORTWRIGHT_FONTS_DIR`, else `$XDG_CACHE_HOME/reportwright/fonts-cjk`, else `%LOCALAPPDATA%\reportwright\fonts-cjk` on Windows or `~/.cache/reportwright/fonts-cjk`), so upgrading the package no longer deletes them; `defaultFontStore()` reads that folder, then the package's old `fonts/` folder, so existing installs keep working. New exports: `cacheDir()`, `fontPath(name)`.
+- **The 14 standard PDF fonts (A1.2):** `fontFamily` `Helvetica`, `Times-Roman` and `Courier` (four faces each, PostScript names such as `Helvetica-BoldOblique`), `Symbol` and `ZapfDingbats` are named in the PDF and not embedded (Type1, WinAnsiEncoding, the Adobe AFM widths from `@pdf-lib/standard-fonts`); layout measures with the same widths. Aliases: Arial → Helvetica, Times New Roman → Times-Roman, Courier New → Courier. An invoice in Helvetica is about 1.6 KB. Characters WinAnsi lacks are drawn in Inter with a warning; PDF/A and PDF/UA embed Inter (JetBrains Mono for Courier) at the standard font's glyph positions, with a warning; `exportPdfStream` does the same. SVG/HTML name the font with a CSS fallback list, Word and PowerPoint name Arial, Times New Roman or Courier New. `@pdf-lib/standard-fonts` (already installed with pdf-lib) is now a declared dependency, kept external in the packages.
+- **Unknown fonts (N39):** a `fontFamily` the engine does not have is no longer swapped silently: the render warns once per name (`Font "NoSuchFont" is not available; using Inter.`), and monospace names (Consolas, Menlo, Monaco…) use the shipped JetBrains Mono instead of Inter, so aligned columns stay aligned. Family names match in any case, a CSS list (`"Brand, Inter"`) uses its first available font, and the generic names `sans-serif` and `monospace` map to Inter and JetBrains Mono without a warning.
+- **Streaming tickets, from the 0.12.1 retest (N23-N29):** `exportPdfStream` with `encrypt` or `prepare` and `sqlRows` no
+  longer fails with "Save the report first" (the rows are gathered for the whole-model render); a misspelled option
+  key (`encrpyt`, `windw`) warns with "Did you mean" in `render()`'s model warnings, `exportPdfStream`'s result and
+  `exportPdf`'s `onWarning`, and a misspelling of `encrypt` or `prepare` throws so no file is written without its
+  password or signature; `sqlRows` yielding single rows says "sqlRows must yield arrays of rows (got an object with
+  keys …)" and sync iterables are accepted; `spill.dir` that does not exist says so; `pw render --base` on a private
+  address names `--allow-internal`; README: the temp-file + rename pattern for a failed stream and a `pg` +
+  `pg-cursor` `sqlRows` example; the `exportPdf` option docs (pdfa, prepare, save) say what the code does.
+- **Data and form-field retest tickets (B9):**
+  - A `number` (or `date`) field with text in it (N26) warns once per field with the first bad row and how many values
+    are empty, in a render and in a streamed export. Numeric strings such as "12.34" stay silent.
+  - A data set whose path matches an object that holds the rows (`data: { orders: { rows: [...] } }`) warns and names
+    the array key (N8). An object of fields, such as `$.meta`, does not.
+  - `validate()` warns on an aggregate with no scope outside a table, list or data-set item (it uses the first data
+    set), and on `nullable: false` or `allowBlank: false` with no default on a parameter that is not required.
+  - A form field has a `label` (falls back to `tooltip`); a tagged PDF uses it as the field's accessible name (`/TU`)
+    and warns for each field without one (N30).
+- **Tagged PDF table of contents (N32):** a TOC is tagged `TOC > TOCI > Reference > Link`, with the entry text, its page number and the link annotation inside one Link (it was plain `P` elements with a Link around the number only), and its title is an `H1`. veraPDF PDF/UA-1: compliant. The streaming PDF's tagging is unchanged.
+- **Cascading parameters in the viewer:** when a parent parameter changes, a dependent value its list no longer offers is replaced (by the default if still offered, else the first choice) in the state the run uses, and the report re-runs with it. Before, the panel dropped the value but the run kept the old one ("Delhi, South region" with no rows).
+- **Viewer page thumbnails (A11Y-3):** `.vthumb` no longer has an `aria-label` that differs from its visible number (axe `label-content-name-mismatch`); its name "Page 1" comes from hidden text beside the visible 1.
+- **Viewer worker fallback (N1):** when the render worker cannot load (Vite 7 without `worker: { format: 'es' }`, or esbuild not following `new Worker(new URL(...))`), the viewer logs once `[reportwright] worker did not load (<reason>); rendering on the main thread`, and `handle.usesWorker` says which one you got. The viewer README now starts with the bundler setup. No Vite plugin: the setting is one line.
+- **Worker file (N18):** `engine.worker.js` is one self-contained file (no `chunk-*.js` imports), so copying it alone next to a page works.
+- **Viewer fonts (N31):** the viewer fetches a font face only when the layout first needs it, not all seven up front. A report in Inter Regular and Bold now downloads 670 KB (two files) instead of 4.9 MB. Serve `fontsUrl` with `Cache-Control: public, max-age=31536000, immutable` (in the viewer README). WOFF2 for the browser is not done yet.
+- **Streaming PDF (`exportPdfStream`) failures, from the 0.12.1 retest:**
+  - A sink that stops reading no longer hangs the export: `timeoutMs` covers the waits for drain (504, `code:
+    'ETIMEDOUT'`), a sink's `error` or `close` ends the wait, and the new `signal` option (an `AbortSignal`) stops the
+    export at its next wait (rows, sink, sort, page) with an `AbortError`. `sqlRows` gets `{ signal }` as its third
+    argument. On timeout or abort the rows' cursors are closed and spill files removed.
+- **Polar chart without `xValue`** (the angle) says so in validate() and the render ("a polar chart needs xValue"), instead of
+  "N of N rows have no x or y value". A valid polar chart gets no warnings.
+- **Variable font subsets say their weight:** a variable font cut at Regular is named Regular (family, subfamily, full and PostScript names) with usWeightClass 400, and its variation tables are dropped, in the PDF and HTML subsets.
+- **Deprecation messages** all say "will be removed in 1.0" (exportHtml's said 0.9). A test greps the source for a deprecation string that names 0.9.
+- **Rich text warnings** say "Rich text:" once (an unnamed item was named "Rich text" and the parser repeated it). The legend warning says what is accepted: a chart's legend is "bottom" or "none", and it is drawn at the bottom.
+
+- **Designer (b9):**
+  - Embedded designer: `mountDesigner` asks before the page is left with unsaved changes (`warnOnLeave`, default
+    true; false leaves it to the host), and the handle has `isDirty()` and an `onDirtyChange(dirty)` option. The guard is
+    removed on save and on `unmount()` (N34). A blank report is named "Untitled report" (it was "New report").
+  - Keyboard: the outline rows are a listbox with one Tab stop (Up/Down/Home/End move, Enter or Space selects, Shift
+    adds; then Delete and the arrows act on the selection); the left rail's tabs take the focus to their section;
+    canvas items are Tab stops named "Text box T1, x 10, y 10" that Enter selects (N35).
+  - Paste uses the paste event's clipboard (no clipboard-read permission), else the copy made in this tab, and says
+    when there is nothing to paste (N36).
+  - Width and height are at least 1 pt (a line may be 0 one way) (N33). Ctrl+D offsets the copy by 12 pt, as a paste
+    does (N37).
+  - Opening a report gives an item without an `id` a stable one (a hash of its band, place and name), so the same
+    file always reads back the same; the other normalisation (names, band heights, a table's size) is unchanged (N38).
+  - Embedded designer (shadow root): the table cell menu acts again, and Esc and Ctrl+S work after a click on a band
+    label, a matrix or a drill-through in Preview.
+  - A table that gets taller (Add group) grows its band; a drop into a 0 pt band grows it. A number field dropped on a
+    group header cell gives `=Sum(...)`, as on a footer. A matrix value shown as a percentage gets the format P1 while
+    its format is still the default N0. The matrix's drill-down toggle starts closed, as the table's.
+  - Accessibility: the fx button is named "fx: Open the expression editor"; table row tags have 4.85:1 contrast.
+
 ## 0.12.1 — 2026-10-08
 
 ### Fixed

package/README.md

@@ -4,6 +4,21 @@
 
 The ReportWright report viewer in any web app (React is bundled inside, in a shadow root, so your styles do not leak in). A React app imports `@reportwright/viewer/react-peer` (and `/react-peer/designer`) instead, the same viewer using the app's own React, so the page loads React once; `@reportwright/react` does this for you:
 
+## Bundler setup (read this first)
+
+The viewer renders in a Web Worker (`engine.worker.js`, one self-contained file next to the viewer). Bundlers that understand
+`new Worker(new URL(...))` pick it up; two settings matter:
+
+- **Vite 7**: set `worker: { format: 'es' }` in `vite.config.js`. Without it the build fails with
+  `Invalid value "iife" for option "worker.format"`.
+- **esbuild** (plain bundling) does not follow `new Worker(new URL(...))`: copy the worker files next to your bundle:
+  `cp node_modules/@reportwright/viewer/dist/engine.worker*.js dist/`. `engine.worker.js` has no imports (its libraries are
+  inside it); `engine.worker.bwip.js` (barcodes) loads only when a report
+  needs it. Without it those reports render on the main thread, with the warning below.
+
+If the worker cannot load, the viewer still renders, on the main thread (slow and janky at 100k rows), and logs once
+`[reportwright] worker did not load (<reason>); rendering on the main thread`. `handle.usesWorker` tells you which one you got.
+
 Import it through your bundler (Vite, webpack, esbuild, Rollup, Next…). Its third-party libraries (pdf-lib,
 @pdf-lib/fontkit, bwip-js, fflate, bidi-js) are ordinary dependencies, pinned to the versions the tests ran
 against, so the package itself holds only ReportWright's own readable code.
@@ -28,7 +43,7 @@ mountViewer('#report', {
 });
 ```
 
-Nothing calls `/api`; each font is downloaded once; the toolbar uses the system font.
+Nothing calls `/api`; each font is downloaded once, and only when the layout first needs it (a report in Inter Regular and Bold fetches those two files, not all seven); the toolbar uses the system font.
 
 If a font cannot be loaded (wrong `fontsUrl`, the folder not served), the report does not draw: the viewer shows
 "The report did not run. Font "Inter-Regular" did not load (HTTP 404)" with a Retry button, and `onReady(error)` is called
@@ -37,6 +52,8 @@ with that error. Fix the path and retry; there is no fallback font. `onReady(err
 you pass as `fontsUrl`; `fontsUrl` is not inferred from the package. Copying only `fonts/` works too
 (PDFs then embed whole fonts, and PDF/A export needs `icc/`).
 
+Serve `fontsUrl` with `Cache-Control: public, max-age=31536000, immutable`: the files do not change within a package version, so a returning visitor downloads none of them.
+
 ## What works standalone, what needs the server
 
 The npm packages are a library: nothing here needs a ReportWright server. The server is a separate, self-hosted app

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,52 @@
+# Third-party notices
+
+ReportWright is MIT licensed (see LICENSE). It ships or bundles the following third-party work, under their own licenses.
+
+## Bundled code
+
+| Component | Version | License | Used for |
+|---|---|---|---|
+| [HarfBuzz](https://github.com/harfbuzz/harfbuzz), compiled to WebAssembly by [harfbuzzjs](https://github.com/harfbuzz/harfbuzzjs) | harfbuzzjs 1.6.2 | HarfBuzz: "Old MIT" (below); harfbuzzjs: MIT, Copyright (c) 2019-2026 The harfbuzzjs project authors | text shaping (`harfbuzz.wasm`) and font subsetting (`harfbuzz-subset.wasm`) |
+| [pdf-lib](https://github.com/Hopding/pdf-lib) | 1.17.1 | MIT, Copyright (c) 2019 Andrew Dillon | the classic PDF writer (encryption, `prepare`, `save`) |
+| [@pdf-lib/fontkit](https://github.com/Hopding/fontkit) | 1.1.1 | MIT | reading font files |
+| [@pdf-lib/standard-fonts](https://github.com/Hopding/standard-fonts) | 1.0.0 | MIT; the metrics are Adobe's AFM files for the 14 standard PDF fonts | Helvetica, Times and Courier widths: generated from its AFM data into src/engine/text/standard-metrics.js (scripts/gen-standard-metrics.mjs); the package itself is not a runtime dependency |
+| [bwip-js](https://github.com/metafloor/bwip-js) | 4.11.4 | MIT | barcodes |
+| [fflate](https://github.com/101arrowz/fflate) | 0.8.3 | MIT | zip and deflate (Excel, Word, PowerPoint, PDF streams) |
+| [bidi-js](https://github.com/lojjic/bidi-js) | 1.0.3 | MIT | right-to-left text |
+
+The full license text of each npm dependency is in its package under `node_modules`.
+
+### HarfBuzz ("Old MIT" license)
+
+HarfBuzz is licensed under the so-called "Old MIT" license. Its copyright holders are listed in
+[COPYING](https://github.com/harfbuzz/harfbuzz/blob/main/COPYING) in the HarfBuzz repository.
+
+> Permission is hereby granted, without written agreement and without license or royalty fees, to use, copy, modify,
+> and distribute this software and its documentation for any purpose, provided that the above copyright notice and
+> the following two paragraphs appear in all copies of this software.
+>
+> IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR
+> CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF THE COPYRIGHT HOLDER HAS
+> BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+>
+> THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+> MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS ON AN "AS IS" BASIS, AND THE
+> COPYRIGHT HOLDER HAS NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+
+## Fonts (in @reportwright/fonts and @reportwright/fonts-cjk)
+
+All fonts are under the [SIL Open Font License 1.1](https://openfontlicense.org); each family's license file ships next
+to it in `public/fonts` (OFL-Inter.txt, OFL-JetBrainsMono.txt, OFL-NotoSans*.txt).
+
+| Family | Source |
+|---|---|
+| Inter | [rsms/inter](https://github.com/rsms/inter) |
+| JetBrains Mono | [JetBrains/JetBrainsMono](https://github.com/JetBrains/JetBrainsMono) |
+| Noto Sans Arabic, Bengali, Devanagari, Gujarati, Hebrew, Kannada, Khmer, Lao, Myanmar, Tamil, Telugu, Thai | [notofonts](https://github.com/notofonts) |
+| Noto Sans CJK and Noto Emoji (fonts-cjk, downloaded on demand) | [notofonts](https://github.com/notofonts) |
+
+## Colour profile
+
+`sRGB-v2-magic.icc` (the PDF/A output intent) is from
+[Compact-ICC-Profiles](https://github.com/saucecontrol/Compact-ICC-Profiles) by Clinton Ingram, released under
+CC0 1.0 (public domain).

package/dist/{chunk-DXHLIJEY.js → chunk-47ZAKRVN.js}

@@ -1,13 +1,13 @@
-import {
-  formatValue,
-  isoDate,
-  roundHalfAway
-} from "./chunk-GJS242RR.js";
 import {
   mergedRegions,
   needsTableData,
   textRows
 } from "./chunk-F6RMRXIN.js";
+import {
+  formatValue,
+  isoDate,
+  roundHalfAway
+} from "./chunk-GJS242RR.js";
 import "./chunk-OLLMACWA.js";
 
 // src/exporters/csv.js
@@ -95,4 +95,4 @@ export {
   exportCsv,
   writeCsvStream
 };
-//# sourceMappingURL=chunk-DXHLIJEY.js.map
+//# sourceMappingURL=chunk-47ZAKRVN.js.map

package/dist/{chunk-NR2G4TMG.js → chunk-B5ZCT3UK.js}

@@ -1,33 +1,31 @@
 import {
   EXPORT_DEFAULTS,
   arrangeToolbar,
+  clearStaleParams,
   exportOptionsFrom,
   fetchReport,
   findText,
-  fontStore,
   frozenAt,
   galleyDefinition,
+  loadFontStore,
   loadModelFonts,
   loadReportFonts,
   origin,
   pageLinks,
   paramChoices,
+  parameterOptions,
   pdfBlob,
   rangeValue,
   readingText,
   renderReport,
+  reportFetch,
   serverPdfUrl,
   subsetter,
   usingWorker
-} from "./chunk-6TPZ7G74.js";
-import {
-  NO_CJK_FONTS,
-  parameterOptions,
-  reportFetch
-} from "./chunk-VNOWPSE6.js";
+} from "./chunk-ES2LYZ6S.js";
 import {
-  safeUrl
-} from "./chunk-72S6DETS.js";
+  NO_CJK_FONTS
+} from "./chunk-BR5K6SBL.js";
 import {
   needsExportData
 } from "./chunk-F6RMRXIN.js";
@@ -35,10 +33,13 @@ import {
   fontKeysOf,
   linkTitle,
   pageToSvg
-} from "./chunk-M6AYND5G.js";
+} from "./chunk-U2ZY2NPQ.js";
 import {
-  ALL_FONT_KEYS
-} from "./chunk-Z7MKH66Z.js";
+  safeUrl
+} from "./chunk-72S6DETS.js";
+import {
+  CORE_FONT_KEY
+} from "./chunk-MS2LQC2O.js";
 import {
   __commonJS,
   __toESM
@@ -19399,7 +19400,17 @@ usgewählte Liste oder den Container, sonst unter den Hauptteil", "選択した
   b2_selItems: ["{n} items selected", "{n} आइटम चुने गए", "{n} elementos seleccionados", "{n} éléments sélectionnés", "{n} Elemente ausgewählt", "{n} 個の項目を選択", "已选择 {n} 个项目", "{n} itens selecionados", "تم تحديد {n} عناصر"],
   b2_selBand: ["Band: {band}", "बैंड: {band}", "Banda: {band}", "Bande : {band}", "Bereich: {band}", "バンド: {band}", "区域：{band}", "Faixa: {band}", "النطاق: {band}"],
   b2_selCell: ["Cell in {name}", "{name} में सेल", "Celda de {name}", "Cellule de {name}", "Zelle in {name}", "{name} のセル", "{name} 中的单元格", "Célula em {name}", "خلية في {name}"],
-  b2_pageInfo: ["Page {size} · {w} × {h} {unit}", "पृष्ठ {size} · {w} × {h} {unit}", "Página {size} · {w} × {h} {unit}", "Page {size} · {w} × {h} {unit}", "Seite {size} · {w} × {h} {unit}", "ページ {size} · {w} × {h} {unit}", "页面 {size} · {w} × {h} {unit}", "Página {size} · {w} × {h} {unit}", "الصفحة {size} · {w} × {h} {unit}"]
+  b2_pageInfo: ["Page {size} · {w} × {h} {unit}", "पृष्ठ {size} · {w} × {h} {unit}", "Página {size} · {w} × {h} {unit}", "Page {size} · {w} × {h} {unit}", "Seite {size} · {w} × {h} {unit}", "ページ {size} · {w} × {h} {unit}", "页面 {size} · {w} × {h} {unit}", "Página {size} · {w} × {h} {unit}", "الصفحة {size} · {w} × {h} {unit}"],
+  // batch 9 (designer bugs)
+  b9_nothingToPaste: ["Nothing to paste: copy items in a designer first (Ctrl+C)", "चिपकाने को कुछ नहीं: पहले डिज़ाइनर में आइटम कॉपी करें (Ctrl+C)", "Nada que pegar: copie primero elementos en un diseñador (Ctrl+C)", "Rien à coller : copiez d’abord des éléments dans un concepteur (Ctrl+C)", "Nichts zum Einf\
+ügen: zuerst Elemente in einem Designer kopieren (Strg+C)", "貼り付けるものがありません。先にデザイナーで項目をコピーしてください (Ctrl+C)", "没有可粘贴的内容：请先在设计器中复制项目 (Ctrl+C)", "Nada para colar: copie primeiro itens em um designer (Ctrl+C)", "لا شيء للصق: انسخ عناصر في مصمم أولاً (Ctrl+C)"],
+  b9_itemLabel: ["{type} {name}, x {x}, y {y}", "{type} {name}, x {x}, y {y}", "{type} {name}, x {x}, y {y}", "{type} {name}, x {x}, y {y}", "{type} {name}, x {x}, y {y}", "{type} {name}、x {x}、y {y}", "{type} {name}，x {x}，y {y}", "{type} {name}, x {x}, y {y}", "{type} {name}، x {x}، y {y}"],
+  b9_outlineKeys: ["Up and Down move between rows; Enter or Space selects (Shift adds); then Delete removes and the arrows move the selection on the page", "ऊपर और नीचे पंक्तियों के बीच जाते हैं; Enter या Space चुनता है (Shift जोड़ता है); फिर Delete हटाता है और तीर पेज पर चयन को खिसकाते हैं",
+  "Arriba y Abajo cambian de fila; Intro o Espacio selecciona (Mayús añade); luego Supr elimina y las flechas mueven la selección en la página", "Haut et Bas passent d’une ligne à l’autre ; Entrée ou Espace sélectionne (Maj ajoute) ; ensuite Suppr supprime et les flèches déplacent la sélection sur la page", "Auf und Ab wechseln die Zeile; Eingabe oder Leertaste wählt aus (Umschalt fü\
+gt hinzu); dann löscht Entf und die Pfeile verschieben die Auswahl auf der Seite", "上下で行を移動、Enter または Space で選択 (Shift で追加)。その後 Delete で削除、矢印でページ上の選択を移動", "上下键在行间移动；Enter 或空格选择（Shift 添加）；然后 Delete 删除，方向键在页面上移动所选项", "Cima e Baixo mudam de linha; Enter \
+ou Espaço seleciona (Shift adiciona); depois Delete remove e as setas movem a seleção na página", "السهمان لأعلى ولأسفل للتنقل بين الصفوف؛ Enter أو المسافة للتحديد (Shift للإضافة)؛ ثم Delete للحذف والأسهم لتحريك التحديد في الصفحة"],
+  p_field_label: ["Label (the name a screen reader says)", "लेबल (स्क्रीन रीडर जो नाम बोलता है)", "Etiqueta (el nombre que dice un lector de pantalla)", "Libellé (le nom que lit un lecteur d’écran)", "Beschriftung (der Name, den ein Screenreader vorliest)", "ラベル (スクリーンリーダーが読み上げる名前)", "标签（屏幕阅读器读出的名称）",
+  "Rótulo (o nome que um leitor de tela diz)", "التسمية (الاسم الذي يقرؤه قارئ الشاشة)"]
 };
 var b2_default = Object.fromEntries(LANGS.map((l, i) => [l, Object.fromEntries(Object.entries(ROWS).map(([k, v]) => [k, v[i]]))]));
 
@@ -19448,7 +19459,7 @@ var import_react = __toESM(require_react(), 1);
 
 // src/viewer/exports.js
 async function loadedFonts(model) {
-  const store = fontStore();
+  const store = await loadFontStore();
   await store.load(fontKeysOf(model));
   return store;
 }
@@ -19464,10 +19475,10 @@ async function exportBlob(fmt, model, def, opt = {}) {
   const o = { ...EXPORT_DEFAULTS, ...opt.options || {} };
   const lang = def.locale || opt.lang || "en";
   if (fmt === "json") return new Blob([JSON.stringify(model)], { type: "application/json" });
-  if (fmt === "csv") return new Blob([(await import("./chunk-DXHLIJEY.js")).exportCsv(model, { locale: def.locale, currency: def.currency })], { type: "text/csv;charset=utf-8" });
+  if (fmt === "csv") return new Blob([(await import("./chunk-47ZAKRVN.js")).exportCsv(model, { locale: def.locale, currency: def.currency })], { type: "text/csv;charset=utf-8" });
   if (fmt === "html" && opt.interactive !== false && o.html === "interactive") {
     try {
-      const { exportInteractiveHtml } = await import("./chunk-Q6MMPKQA.js");
+      const { exportInteractiveHtml } = await import("./chunk-PF4RFKX2.js");
       const { html } = await exportInteractiveHtml(def, { params: opt.params, reportId: opt.reportId, lang: opt.lang, model });
       return new Blob([html], { type: "text/html;charset=utf-8" });
     } catch (e) {
@@ -19477,19 +19488,19 @@ async function exportBlob(fmt, model, def, opt = {}) {
   }
   if (fmt === "html") {
     const store = await loadedFonts(model);
-    const { exportHtml } = await import("./chunk-DPVJEFKP.js");
+    const { exportHtml } = await import("./chunk-WOBRKNIA.js");
     return new Blob([await exportHtml(model, { fonts: store, title: def.name, subset: subsetter, drillBase: origin(), static: o.html === "static", locale: def.locale, currency: def.currency, lang: opt.lang, strings: opt.strings })], { type: "text/html;charset=utf-8" });
   }
   if (fmt === "docx") {
-    const { exportDocx } = await import("./chunk-BRB34AJ2.js");
+    const { exportDocx } = await import("./chunk-JD6EJ3LI.js");
     return new Blob([await exportDocx(model, { title: def.name, lang, fontStore: await loadedFonts(model), fetchImage })], { type: "application/vnd.openxmlformats-officedocument.wordprocessingml.document" });
   }
   if (fmt === "pptx") {
-    const { exportPptx } = await import("./chunk-3D2KFKG2.js");
+    const { exportPptx } = await import("./chunk-GRYITZPG.js");
     return new Blob([await exportPptx(model, { title: def.name, lang, fontStore: await loadedFonts(model), fetchImage })], { type: "application/vnd.openxmlformats-officedocument.presentationml.presentation" });
   }
   if (fmt === "xlsx") {
-    const { exportXlsx } = await import("./chunk-2BPBQMH2.js");
+    const { exportXlsx } = await import("./chunk-H422SRD3.js");
     const bytes = await exportXlsx(model, { currency: def.currency, title: def.name, formulas: o.formulas, fontStore: await loadedFonts(model), fetchImage });
     return new Blob([bytes], { type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" });
   }
@@ -19735,9 +19746,10 @@ var Thumb = ({ page, w, h, n, current, near, onGo, T }) => {
   (0, import_react.useEffect)(() => {
     if (current) ref.current?.scrollIntoView?.({ block: "nearest" });
   }, [current]);
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("button", { ref, type: "button", className: "vthumb", "aria-current": current ? "page" : void 0, "aria-label": T("b2_pageN", { n }), onClick: () => onGo(n), children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("button", { ref, type: "button", className: "vthumb", "aria-current": current ? "page" : void 0, onClick: () => onGo(n), children: [
     /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "vthumb-sheet", style: { aspectRatio: `${w} / ${h}` }, children: near && /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(SvgHtml, { as: "span", html, "aria-hidden": "true" }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "vthumb-n", children: n })
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "sr-only", children: T("b2_pageN", { n }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "vthumb-n", "aria-hidden": "true", children: n })
   ] });
 };
 var Skeleton = ({ def, scale, T }) => {
@@ -19861,7 +19873,7 @@ function ReportViewer({ definition: rootDef, reportId: rootReportId, params: roo
       const onRetry = (r) => {
         if (id === runId.current) setStatus({ state: "running", retry: r });
       };
-      const [m, defaultFailed] = await Promise.all([renderReport(renderDef, p, { ...st, target: "screen" }, reportId, { onPartial, onRetry }), loadReportFonts(ALL_FONT_KEYS)]);
+      const [m, defaultFailed] = await Promise.all([renderReport(renderDef, p, { ...st, target: "screen" }, reportId, { onPartial, onRetry }), loadReportFonts([CORE_FONT_KEY])]);
       const failed = [...defaultFailed, ...await loadModelFonts(m)];
       if (id !== runId.current) return;
       setModel(m);
@@ -19977,11 +19989,20 @@ function ReportViewer({ definition: rootDef, reportId: rootReportId, params: roo
   const optKey = JSON.stringify(params);
   (0, import_react.useEffect)(() => {
     if (!(definition.parameters || []).some((p) => p.options || p.optionsFrom)) return;
+    let stale = false;
     const t2 = setTimeout(() => {
-      parameterOptions(definition, params, { baseUrl: origin(), reportId, fetch: reportFetch(origin()) }).then((o) => setOptions(paramChoices(definition, o))).catch(() => {
+      parameterOptions(definition, params, { baseUrl: origin(), reportId, fetch: reportFetch(origin()) }).then((o) => {
+        if (stale) return;
+        const choices = paramChoices(definition, o);
+        setOptions(choices);
+        setParams((s) => clearStaleParams(definition, s, choices));
+      }).catch(() => {
       });
     }, 250);
-    return () => clearTimeout(t2);
+    return () => {
+      stale = true;
+      clearTimeout(t2);
+    };
   }, [definition, optKey]);
   (0, import_react.useEffect)(() => {
     const el = scroller.current, rt = root.current;
@@ -20687,4 +20708,4 @@ export {
   ReportViewer,
   uiFontCss
 };
-//# sourceMappingURL=chunk-NR2G4TMG.js.map
+//# sourceMappingURL=chunk-B5ZCT3UK.js.map