shiny-plotly 0.3.3__tar.gz → 0.4.1__tar.gz

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/.gitignore

@@ -6,5 +6,6 @@ __pycache__/
 *.pyc
 .pytest_cache/
 .ruff_cache/
+.coverage
 tmp/
 site/

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.1](https://github.com/rvben/shiny-plotly/compare/v0.4.0...v0.4.1) - 2026-09-25
+
+### Fixed
+
+- A click, hover or selection on a heatmap (or any trace that addresses a point by row and column) now carries the point's `pointNumber` as `[row, column]` and its `customdata`. Both were dropped: the pair is not a scalar, so it was left out, and looking customdata up by it came back empty. Customdata is now the value plotly itself puts on the point, for every trace type.
+- A `post_script` that throws no longer stops the chart it belongs to. The error is logged to the browser console with the output's id; until now it also left the output never marked as drawn, so updates sent to it were held forever, a themed chart stopped following the color mode, and Shiny reported a client error.
+- Updates held for an output that has no figure drawn, such as one in a closed tab, no longer pile up one per call. Consecutive `extend_traces` calls to the same traces with the same attributes and `max_points` are merged as they arrive, cut to `max_points`, and so are consecutive `prepend_traces` calls. A chart streaming at 50 Hz in a tab closed for ten seconds held 500 updates and drew each one when the tab opened; it now holds one and draws once, to the same result.
+- The in-place updates take a numpy integer for `indices`, where it failed with `TypeError: 'numpy.int64' object is not iterable`, and `extend_traces` and `prepend_traces` take one for `max_points`, as `render_plotly` does for `max_event_points`, where both were refused as not a positive integer. Indices that are not integers (a float, a string, a `bool`) are refused with a `ValueError` naming the argument instead of being sent to the browser.
+- A client that refuses an encoding by name in `Accept-Encoding` is no longer sent it because the header also has a `*`: `gzip;q=0, *` asked for anything but gzip and got gzip. A refusal is also read wherever `q` stands among the entry's parameters.
+- `If-None-Match` for plotly.min.js now matches a weak validator (`W/"..."`, as a proxy may send it) and `*`, returning 304 instead of the whole bundle again.
+- plotly.min.js served raw while its compression is still running, which happens only on the first requests of a process, is marked `Cache-Control: no-cache` instead of immutable for a year. A browser that asked for brotli or gzip revalidates it on the next visit and gets the compressed file, instead of keeping the 4.8 MB raw file in its cache.
+
+## [0.4.0](https://github.com/rvben/shiny-plotly/compare/v0.3.3...v0.4.0) - 2026-08-21
+
+### Changed
+
+- `brotli` is a dependency, so a plain `uv add shiny-plotly` serves plotly.min.js in the smaller encoding (1.2 MB on the wire against 1.5 MB gzipped) instead of only where someone thought to ask for it. It carries the marker `sys_platform != 'emscripten'`: under pyodide the compressing route is never installed, so a shinylive export would have downloaded a 307 kB wasm wheel to compress nothing. An install that still ends up without brotli (a lock file older than this release, a platform with no wheel) falls back to gzip and logs the same one-off warning as before, now naming the fix.
+- README: the note on hidden outputs now names every container Shiny defers a chart in (an inactive `ui.navset_tab`, `ui.navset_card_tab`, `ui.navset_pill` or `ui.navset_hidden` panel, a closed `ui.accordion` section, and a false `ui.panel_conditional` from Shiny 1.6.1 on, which is where that last one changed), and says what it does not cover: a chart scrolled below the fold is drawn with the rest at load. A browser test holds every case, so a Shiny release that changes the behavior breaks the suite rather than the advice.
+
+### Fixed
+
+- A client that refuses an encoding with `Accept-Encoding: br;q=0.0` is no longer served it. RFC 9110 lets a qvalue of zero be written `q=0`, `q=0.0` or `q=0.000`, and only the first spelling was read as a refusal, so plotly.min.js could arrive in an encoding the client had said it would not take.
+
+### Removed
+
+- The `brotli` extra, now that brotli is a plain dependency. An install that still names it (`shiny-plotly[brotli]`) gets the same package, plus a warning from pip or uv that the extra does not exist; drop the `[brotli]`.
+
 ## [0.3.3](https://github.com/rvben/shiny-plotly/compare/v0.3.2...v0.3.3) - 2026-08-21
 
 ### Added

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: shiny-plotly
-Version: 0.3.3
+Version: 0.4.1
 Summary: Render plotly figures in Shiny for Python with plain plotly.js, without the shinywidgets layer.
 Project-URL: Homepage, https://github.com/rvben/shiny-plotly
 Project-URL: Repository, https://github.com/rvben/shiny-plotly
@@ -22,11 +22,10 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Visualization
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
+Requires-Dist: brotli>=1.1; sys_platform != 'emscripten'
 Requires-Dist: htmltools>=0.5.2
 Requires-Dist: plotly>=5.5
 Requires-Dist: shiny>=1.0
-Provides-Extra: brotli
-Requires-Dist: brotli>=1.1; extra == 'brotli'
 Description-Content-Type: text/markdown
 
 # shiny-plotly
@@ -210,7 +209,7 @@ Plotly alone re-measures a graph only on window resize. `shiny-plotly` ships a s
 
 Drawing a plotly figure costs the browser a fixed amount of main-thread work per graph, tens of milliseconds for a small one on a current desktop, and the browser draws them one after another. On a dashboard of a dozen charts that per-chart work, not the bytes on the wire, is what the first second is spent on, and it is plotly's own cost: the same figure drawn from shinywidgets or from a static `to_html` export costs the same.
 
-The lever is drawing fewer charts at once. Shiny suspends an output that is hidden, so charts inside `ui.navset_tab` panels or `ui.accordion` sections are not rendered at all until their panel is shown, and each panel then pays only for its own charts. Charts that must all be visible are better served by fewer, denser figures (subplots in one graph div) than by many small ones.
+The lever is drawing fewer charts at once, and Shiny pulls it for you: an output the browser reports as hidden is suspended, so its figure is not rendered at all until it is shown. That covers every container that hides one, whether an inactive panel of `ui.navset_tab`, `ui.navset_card_tab`, `ui.navset_pill` or `ui.navset_hidden`, a closed `ui.accordion` section, or a `ui.panel_conditional` whose condition is false (that last one from Shiny 1.6.1 on; older Shiny drew it at load); each panel then pays only for its own charts, and pays when it is opened. Scrolling is not hiding, though: a chart 3000px down the page is visible as far as the browser is concerned, and is drawn with the rest at load. Charts that must all be visible at once are better served by fewer, denser figures (subplots in one graph div) than by many small ones.
 
 ### Dark mode
 
@@ -315,7 +314,7 @@ What arrives is plotly's own event data, cut to what serializes, the same way Da
 | `legendclick` | `{"curve_number": 1, "expanded_index": 1, "name": "beta", "visible": True}` for the trace whose legend item was clicked, `visible` as it stood before the click's toggle (`True` or `"legendonly"`); trace types whose legend items are labels (pie, funnelarea) add `label`; fires on every click, and the default toggle still happens |
 | `legenddoubleclick` | same value as `legendclick`; the default isolate-this-trace behavior still happens |
 
-Each point carries plotly's scalar fields for that trace type (`curveNumber`, `pointNumber`, `pointIndex`, `x`, `y`, `z`, `text`, `label`, `value`, `lat`, `lon`, ...) plus `customdata` (as a plain list, also when it was a numpy array), `bbox` and `pointNumbers` when present. `input.<id>_<event>()` raises a silent exception until the event has fired once, so check `is_set()` when the output should show something before that.
+Each point carries plotly's scalar fields for that trace type (`curveNumber`, `pointNumber`, `pointIndex`, `x`, `y`, `z`, `text`, `label`, `value`, `lat`, `lon`, ...) plus `customdata` (as a plain list, also when it was a numpy array), `bbox` and `pointNumbers` when present. On a 2-D trace such as a heatmap `pointNumber` is the cell's `[row, column]`. `input.<id>_<event>()` raises a silent exception until the event has fired once, so check `is_set()` when the output should show something before that.
 
 #### Dense traces
 
@@ -353,7 +352,7 @@ The value is never silently cut: `points` is a full list or `None`, and `point_c
 
 `click` and `hover` carry one point per trace under the pointer, so the cap matters for `selected`; hover is also debounced (100 ms), so a pointer sweeping across a dense trace sends one event when it rests, not one per point.
 
-For anything else, `post_script` runs once, after the first figure is drawn, with `{plot_id}` replaced by the graph div's id. Re-renders go through `Plotly.react` into the same graph div, so handlers attached either way stay attached and are never stacked.
+For anything else, `post_script` runs once, after the first figure is drawn, with `{plot_id}` replaced by the graph div's id. A script that throws is logged to the browser console and the chart carries on: events, theming and held updates do not depend on it. Re-renders go through `Plotly.react` into the same graph div, so handlers attached either way stay attached and are never stacked.
 
 ```python
 ANNOTATION_TO_INPUT = """
@@ -402,7 +401,7 @@ async def _highlight():
 - `add_traces(id, traces, indices=None)`: whole new traces, each a graph object (`go.Scatter(y=[1, 2])`) or a dict (`{"y": [1], "type": "bar"}`); `indices` says where they land in the trace order, appended without it.
 - `delete_traces(id, indices)`: removes the traces at `indices`; the rest renumber, as a Python list does on `del`.
 
-The values go through plotly's encoder, so numpy arrays, pandas columns and datetimes work. The id is namespaced inside a module, like the output. An update reaches the figure that is drawn at that moment; one sent while the output has no figure (its first render is still running, it sits in a hidden tab, it shows an error or was emptied by `None`) is held and applied, in order, right after the output's next draw. A re-render replaces the figure, updates included, with what the render function returns: the server stays the source of truth, and a figure that should keep its streamed points across a re-render builds them in from server-side state.
+The values go through plotly's encoder, so numpy arrays, pandas columns and datetimes work. The id is namespaced inside a module, like the output. An update reaches the figure that is drawn at that moment; one sent while the output has no figure (its first render is still running, it sits in a hidden tab, it shows an error or was emptied by `None`) is held and applied, in order, right after the output's next draw. Consecutive held `extend_traces` calls with the same traces, attributes and `max_points` are merged into one as they arrive, and so are consecutive `prepend_traces` calls, cut to `max_points` as they go: a stream into a chart in a closed tab costs one redraw when the tab opens and, with a cap, holds no more points than the chart will keep. A re-render replaces the figure, updates included, with what the render function returns: the server stays the source of truth, and a figure that should keep its streamed points across a re-render builds them in from server-side state.
 
 A runnable version of the streaming pattern, with a pause switch and a window slider, is `examples/streaming_app.py`.
 
@@ -419,13 +418,9 @@ A runnable version of the streaming pattern, with a pause switch and a window sl
 
 ### plotly.js on the wire
 
-Shiny serves HTML dependencies from a plain static mount: no compression, no `Cache-Control`. `plotly.min.js` is 4.9 MB, so `shiny-plotly` adds a route in front of that mount for the bundle's exact path (`/lib/plotly-<version>/plotly.min.js`) that serves it pre-compressed (brotli when the `brotli` package is installed, gzip otherwise; 1.2 MB or 1.5 MB on the wire) with `Cache-Control: public, max-age=31536000, immutable`, `Vary: Accept-Encoding` and an `ETag` per encoding. The URL is keyed by the plotly version, so a browser fetches each version once. Compression runs once per process, in a background thread; until it has finished the route serves the raw file with the same headers.
+Shiny serves HTML dependencies from a plain static mount: no compression, no `Cache-Control`. `plotly.min.js` is 4.9 MB, so `shiny-plotly` adds a route in front of that mount for the bundle's exact path (`/lib/plotly-<version>/plotly.min.js`) that serves it pre-compressed (brotli, 1.2 MB on the wire, or gzip at 1.5 MB where brotli is not installed) with `Cache-Control: public, max-age=31536000, immutable`, `Vary: Accept-Encoding` and an `ETag` per encoding. The URL is keyed by the plotly version, so a browser fetches each version once. Compression runs once per process, in a background thread; until it has finished the route serves the raw file, with `Cache-Control: no-cache` to a browser that asked for an encoding still being compressed, so its next visit revalidates and swaps in the compressed body rather than keeping the raw one for a year.
 
-```sh
-uv add "shiny-plotly[brotli]"  # optional: brotli instead of gzip
-```
-
-Without it the process logs one warning saying which encoding it is serving and what brotli would save, so a deployment can see it is shipping the larger bundle; `logging.getLogger("shiny_plotly").setLevel(logging.ERROR)` silences it.
+`brotli` is a dependency, so a plain `uv add shiny-plotly` serves the smaller encoding. It is skipped under pyodide, where there is nothing to compress: a shinylive export carries its own assets and the route is not installed at all. An install that ends up without it (a lock file that predates the dependency, a platform with no wheel) falls back to gzip and logs one warning saying which encoding it is serving and what brotli would save, so a deployment can see it is shipping the larger bundle; `logging.getLogger("shiny_plotly").setLevel(logging.ERROR)` silences it.
 
 The route asks nothing of the app. Importing `shiny_plotly` wraps `shiny.App.__init__`, so every app built afterwards has it, Core and Express alike, and the compression starts while the app is still being built rather than when someone first visits it. The timing is the whole point: the browser asks for plotly.js while the page is loading, well before the session that page opens exists, so a route that waited for a session would arrive one visitor too late, and that visitor would take 4.9 MB with no `Cache-Control` at all.
 
@@ -458,7 +453,7 @@ make bench       # the shinywidgets comparison above, on this machine
 make bench-events  # what a selection over a dense trace costs, capped and uncapped
 ```
 
-`make test` runs the unit tests and the in-process Shiny end-to-end tests over a real websocket, including the compressed bundle route. `make test-browser` drives the package in headless Chromium: fill sizing, resize without a window event, the graph div surviving a re-render, `uirevision` keeping a dragged zoom, purge once an output leaves the page, full screen, `events=` click, hover, selection and relayout inputs (attached once, also inside a module, a selection above `max_event_points` arriving as count and range), `extend_traces`, `restyle` and `relayout` applied in place (rolling window, one trace or all, held until the first draw, reset by a re-render, inside a module, dropped with a warning for an unknown output), `post_script` click wiring (once, not stacked), the dark mode recipe, error and `None` rendering, on-demand loading of plotly.js and the compressed, cached bundle as a fresh visitor sees it. `make check-wheel` installs the built wheel into a throwaway venv and runs the suite against it, so the published artifact is what was tested. `make check-floor` installs the package with plotly, shiny and htmltools at the oldest versions `pyproject.toml` allows and runs the whole suite again, browser tests included, so the declared lower bounds are tested on every push rather than assumed.
+`make test` runs the unit tests and the in-process Shiny end-to-end tests over a real websocket, including the compressed bundle route. It fails below 100% line and branch coverage of the package: every line is reachable without a browser, and the gate is what keeps behavior that only the Chromium suite can reach from growing. `make test-browser` drives the package in headless Chromium: fill sizing, resize without a window event, the graph div surviving a re-render, `uirevision` keeping a dragged zoom, purge once an output leaves the page, full screen, `events=` click, hover, selection and relayout inputs (attached once, also inside a module, a selection above `max_event_points` arriving as count and range), `extend_traces`, `restyle` and `relayout` applied in place (rolling window, one trace or all, held until the first draw, reset by a re-render, inside a module, dropped with a warning for an unknown output), `post_script` click wiring (once, not stacked), the dark mode recipe, error and `None` rendering, on-demand loading of plotly.js and the compressed, cached bundle as a fresh visitor sees it. `make check-wheel` installs the built wheel into a throwaway venv and runs the suite against it, so the published artifact is what was tested. `make check-floor` installs the package with plotly, shiny and htmltools at the oldest versions `pyproject.toml` allows and runs the whole suite again, browser tests included, so the declared lower bounds are tested on every push rather than assumed.
 
 ## License
 

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/README.md

@@ -179,7 +179,7 @@ Plotly alone re-measures a graph only on window resize. `shiny-plotly` ships a s
 
 Drawing a plotly figure costs the browser a fixed amount of main-thread work per graph, tens of milliseconds for a small one on a current desktop, and the browser draws them one after another. On a dashboard of a dozen charts that per-chart work, not the bytes on the wire, is what the first second is spent on, and it is plotly's own cost: the same figure drawn from shinywidgets or from a static `to_html` export costs the same.
 
-The lever is drawing fewer charts at once. Shiny suspends an output that is hidden, so charts inside `ui.navset_tab` panels or `ui.accordion` sections are not rendered at all until their panel is shown, and each panel then pays only for its own charts. Charts that must all be visible are better served by fewer, denser figures (subplots in one graph div) than by many small ones.
+The lever is drawing fewer charts at once, and Shiny pulls it for you: an output the browser reports as hidden is suspended, so its figure is not rendered at all until it is shown. That covers every container that hides one, whether an inactive panel of `ui.navset_tab`, `ui.navset_card_tab`, `ui.navset_pill` or `ui.navset_hidden`, a closed `ui.accordion` section, or a `ui.panel_conditional` whose condition is false (that last one from Shiny 1.6.1 on; older Shiny drew it at load); each panel then pays only for its own charts, and pays when it is opened. Scrolling is not hiding, though: a chart 3000px down the page is visible as far as the browser is concerned, and is drawn with the rest at load. Charts that must all be visible at once are better served by fewer, denser figures (subplots in one graph div) than by many small ones.
 
 ### Dark mode
 
@@ -284,7 +284,7 @@ What arrives is plotly's own event data, cut to what serializes, the same way Da
 | `legendclick` | `{"curve_number": 1, "expanded_index": 1, "name": "beta", "visible": True}` for the trace whose legend item was clicked, `visible` as it stood before the click's toggle (`True` or `"legendonly"`); trace types whose legend items are labels (pie, funnelarea) add `label`; fires on every click, and the default toggle still happens |
 | `legenddoubleclick` | same value as `legendclick`; the default isolate-this-trace behavior still happens |
 
-Each point carries plotly's scalar fields for that trace type (`curveNumber`, `pointNumber`, `pointIndex`, `x`, `y`, `z`, `text`, `label`, `value`, `lat`, `lon`, ...) plus `customdata` (as a plain list, also when it was a numpy array), `bbox` and `pointNumbers` when present. `input.<id>_<event>()` raises a silent exception until the event has fired once, so check `is_set()` when the output should show something before that.
+Each point carries plotly's scalar fields for that trace type (`curveNumber`, `pointNumber`, `pointIndex`, `x`, `y`, `z`, `text`, `label`, `value`, `lat`, `lon`, ...) plus `customdata` (as a plain list, also when it was a numpy array), `bbox` and `pointNumbers` when present. On a 2-D trace such as a heatmap `pointNumber` is the cell's `[row, column]`. `input.<id>_<event>()` raises a silent exception until the event has fired once, so check `is_set()` when the output should show something before that.
 
 #### Dense traces
 
@@ -322,7 +322,7 @@ The value is never silently cut: `points` is a full list or `None`, and `point_c
 
 `click` and `hover` carry one point per trace under the pointer, so the cap matters for `selected`; hover is also debounced (100 ms), so a pointer sweeping across a dense trace sends one event when it rests, not one per point.
 
-For anything else, `post_script` runs once, after the first figure is drawn, with `{plot_id}` replaced by the graph div's id. Re-renders go through `Plotly.react` into the same graph div, so handlers attached either way stay attached and are never stacked.
+For anything else, `post_script` runs once, after the first figure is drawn, with `{plot_id}` replaced by the graph div's id. A script that throws is logged to the browser console and the chart carries on: events, theming and held updates do not depend on it. Re-renders go through `Plotly.react` into the same graph div, so handlers attached either way stay attached and are never stacked.
 
 ```python
 ANNOTATION_TO_INPUT = """
@@ -371,7 +371,7 @@ async def _highlight():
 - `add_traces(id, traces, indices=None)`: whole new traces, each a graph object (`go.Scatter(y=[1, 2])`) or a dict (`{"y": [1], "type": "bar"}`); `indices` says where they land in the trace order, appended without it.
 - `delete_traces(id, indices)`: removes the traces at `indices`; the rest renumber, as a Python list does on `del`.
 
-The values go through plotly's encoder, so numpy arrays, pandas columns and datetimes work. The id is namespaced inside a module, like the output. An update reaches the figure that is drawn at that moment; one sent while the output has no figure (its first render is still running, it sits in a hidden tab, it shows an error or was emptied by `None`) is held and applied, in order, right after the output's next draw. A re-render replaces the figure, updates included, with what the render function returns: the server stays the source of truth, and a figure that should keep its streamed points across a re-render builds them in from server-side state.
+The values go through plotly's encoder, so numpy arrays, pandas columns and datetimes work. The id is namespaced inside a module, like the output. An update reaches the figure that is drawn at that moment; one sent while the output has no figure (its first render is still running, it sits in a hidden tab, it shows an error or was emptied by `None`) is held and applied, in order, right after the output's next draw. Consecutive held `extend_traces` calls with the same traces, attributes and `max_points` are merged into one as they arrive, and so are consecutive `prepend_traces` calls, cut to `max_points` as they go: a stream into a chart in a closed tab costs one redraw when the tab opens and, with a cap, holds no more points than the chart will keep. A re-render replaces the figure, updates included, with what the render function returns: the server stays the source of truth, and a figure that should keep its streamed points across a re-render builds them in from server-side state.
 
 A runnable version of the streaming pattern, with a pause switch and a window slider, is `examples/streaming_app.py`.
 
@@ -388,13 +388,9 @@ A runnable version of the streaming pattern, with a pause switch and a window sl
 
 ### plotly.js on the wire
 
-Shiny serves HTML dependencies from a plain static mount: no compression, no `Cache-Control`. `plotly.min.js` is 4.9 MB, so `shiny-plotly` adds a route in front of that mount for the bundle's exact path (`/lib/plotly-<version>/plotly.min.js`) that serves it pre-compressed (brotli when the `brotli` package is installed, gzip otherwise; 1.2 MB or 1.5 MB on the wire) with `Cache-Control: public, max-age=31536000, immutable`, `Vary: Accept-Encoding` and an `ETag` per encoding. The URL is keyed by the plotly version, so a browser fetches each version once. Compression runs once per process, in a background thread; until it has finished the route serves the raw file with the same headers.
+Shiny serves HTML dependencies from a plain static mount: no compression, no `Cache-Control`. `plotly.min.js` is 4.9 MB, so `shiny-plotly` adds a route in front of that mount for the bundle's exact path (`/lib/plotly-<version>/plotly.min.js`) that serves it pre-compressed (brotli, 1.2 MB on the wire, or gzip at 1.5 MB where brotli is not installed) with `Cache-Control: public, max-age=31536000, immutable`, `Vary: Accept-Encoding` and an `ETag` per encoding. The URL is keyed by the plotly version, so a browser fetches each version once. Compression runs once per process, in a background thread; until it has finished the route serves the raw file, with `Cache-Control: no-cache` to a browser that asked for an encoding still being compressed, so its next visit revalidates and swaps in the compressed body rather than keeping the raw one for a year.
 
-```sh
-uv add "shiny-plotly[brotli]"  # optional: brotli instead of gzip
-```
-
-Without it the process logs one warning saying which encoding it is serving and what brotli would save, so a deployment can see it is shipping the larger bundle; `logging.getLogger("shiny_plotly").setLevel(logging.ERROR)` silences it.
+`brotli` is a dependency, so a plain `uv add shiny-plotly` serves the smaller encoding. It is skipped under pyodide, where there is nothing to compress: a shinylive export carries its own assets and the route is not installed at all. An install that ends up without it (a lock file that predates the dependency, a platform with no wheel) falls back to gzip and logs one warning saying which encoding it is serving and what brotli would save, so a deployment can see it is shipping the larger bundle; `logging.getLogger("shiny_plotly").setLevel(logging.ERROR)` silences it.
 
 The route asks nothing of the app. Importing `shiny_plotly` wraps `shiny.App.__init__`, so every app built afterwards has it, Core and Express alike, and the compression starts while the app is still being built rather than when someone first visits it. The timing is the whole point: the browser asks for plotly.js while the page is loading, well before the session that page opens exists, so a route that waited for a session would arrive one visitor too late, and that visitor would take 4.9 MB with no `Cache-Control` at all.
 
@@ -427,7 +423,7 @@ make bench       # the shinywidgets comparison above, on this machine
 make bench-events  # what a selection over a dense trace costs, capped and uncapped
 ```
 
-`make test` runs the unit tests and the in-process Shiny end-to-end tests over a real websocket, including the compressed bundle route. `make test-browser` drives the package in headless Chromium: fill sizing, resize without a window event, the graph div surviving a re-render, `uirevision` keeping a dragged zoom, purge once an output leaves the page, full screen, `events=` click, hover, selection and relayout inputs (attached once, also inside a module, a selection above `max_event_points` arriving as count and range), `extend_traces`, `restyle` and `relayout` applied in place (rolling window, one trace or all, held until the first draw, reset by a re-render, inside a module, dropped with a warning for an unknown output), `post_script` click wiring (once, not stacked), the dark mode recipe, error and `None` rendering, on-demand loading of plotly.js and the compressed, cached bundle as a fresh visitor sees it. `make check-wheel` installs the built wheel into a throwaway venv and runs the suite against it, so the published artifact is what was tested. `make check-floor` installs the package with plotly, shiny and htmltools at the oldest versions `pyproject.toml` allows and runs the whole suite again, browser tests included, so the declared lower bounds are tested on every push rather than assumed.
+`make test` runs the unit tests and the in-process Shiny end-to-end tests over a real websocket, including the compressed bundle route. It fails below 100% line and branch coverage of the package: every line is reachable without a browser, and the gate is what keeps behavior that only the Chromium suite can reach from growing. `make test-browser` drives the package in headless Chromium: fill sizing, resize without a window event, the graph div surviving a re-render, `uirevision` keeping a dragged zoom, purge once an output leaves the page, full screen, `events=` click, hover, selection and relayout inputs (attached once, also inside a module, a selection above `max_event_points` arriving as count and range), `extend_traces`, `restyle` and `relayout` applied in place (rolling window, one trace or all, held until the first draw, reset by a re-render, inside a module, dropped with a warning for an unknown output), `post_script` click wiring (once, not stacked), the dark mode recipe, error and `None` rendering, on-demand loading of plotly.js and the compressed, cached bundle as a fresh visitor sees it. `make check-wheel` installs the built wheel into a throwaway venv and runs the suite against it, so the published artifact is what was tested. `make check-floor` installs the package with plotly, shiny and htmltools at the oldest versions `pyproject.toml` allows and runs the whole suite again, browser tests included, so the declared lower bounds are tested on every push rather than assumed.
 
 ## License
 

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "shiny-plotly"
-version = "0.3.3"
+version = "0.4.1"
 description = "Render plotly figures in Shiny for Python with plain plotly.js, without the shinywidgets layer."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -33,12 +33,12 @@ dependencies = [
   "shiny>=1.0",
   "plotly>=5.5",
   "htmltools>=0.5.2",
+  # plotly.min.js is served brotli-compressed, about 17% smaller than gzip. Under pyodide
+  # there is nothing to compress (the bundle comes from the shinylive export) and the route
+  # is skipped, so the marker keeps a 307 kB wasm wheel out of every exported app.
+  "brotli>=1.1; sys_platform != 'emscripten'",
 ]
 
-[project.optional-dependencies]
-# plotly.min.js is served brotli-compressed (about 15% smaller than gzip) when present.
-brotli = ["brotli>=1.1"]
-
 [project.urls]
 Homepage   = "https://github.com/rvben/shiny-plotly"
 Repository = "https://github.com/rvben/shiny-plotly"
@@ -52,12 +52,12 @@ bench = [
 ]
 dev = [
   "pytest>=8",
+  "pytest-cov>=5",
   "ruff>=0.6",
   "pyright>=1.1.380",
   "httpx2>=2.12.0",
   "pytest-playwright>=0.9.0",
   "numpy>=1.26",
-  "brotli>=1.1",
   "shinylive-check>=0.1.0",
 ]
 
@@ -91,4 +91,4 @@ pythonVersion = "3.10"
 typeCheckingMode = "standard"
 
 [tool.ruff.lint.isort]
-known-local-folder = ["newplot"]
+known-local-folder = ["helpers", "newplot"]

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/src/shiny_plotly/_html.py

@@ -103,9 +103,15 @@ def fig_to_ui(
 
 
 def as_fig_dict(fig: Figure) -> dict[str, Any]:
-    # Figure.to_dict() does no validation (the figure was validated when built), and a
-    # dict is passed through as the caller's JSON; pio.to_html gets validate=False so it
-    # never reconstructs a Figure from it.
+    """
+    The figure as a plain dict carrying a ``layout`` dict, whichever way it was given.
+
+    Everything downstream reaches into ``layout`` (to fill in margins, to drop a baked-in
+    template), so it is made a dict here rather than guarded against at each of them.
+    """
+    # Figure.to_dict() does no validation (the figure was validated when built), and always
+    # carries a layout; a dict is passed through as the caller's JSON, so pio.to_html gets
+    # validate=False and never reconstructs a Figure from it.
     if isinstance(fig, BaseFigure):
         return fig.to_dict()
     if isinstance(fig, dict):
@@ -116,5 +122,5 @@ def as_fig_dict(fig: Figure) -> dict[str, Any]:
 
 
 def fill_in_margins(fig_dict: dict[str, Any]) -> None:
-    layout = fig_dict.setdefault("layout", {})
+    layout = fig_dict["layout"]
     layout["margin"] = {**FIGUREWIDGET_MARGINS, **(layout.get("margin") or {})}

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/src/shiny_plotly/_render.py

@@ -16,6 +16,7 @@ from shiny.ui.fill import as_fill_item, as_fillable_container
 from ._deps import plotly_js, shiny_plotly_js
 from ._html import DEFAULT_CONFIG, Figure, as_fig_dict, fill_in_margins
 from ._serve import enable_compressed_plotly_js
+from ._validate import as_positive_int
 
 __all__ = ("DEFAULT_MAX_EVENT_POINTS", "EVENTS", "output_plotly", "render_plotly")
 
@@ -127,11 +128,7 @@ def template_key(template_json: str) -> str:
 
 
 def normalize_max_event_points(value: int | None) -> int | None:
-    if value is None:
-        return None
-    if isinstance(value, bool) or not isinstance(value, int) or value < 1:
-        raise ValueError(f"max_event_points must be a positive int or None, got {value!r}")
-    return value
+    return None if value is None else as_positive_int(value, "max_event_points")
 
 
 def output_plotly(id: str, *, width: str | None = None, height: str | None = None) -> Tag:
@@ -331,9 +328,7 @@ class render_plotly(Renderer[Figure]):
         if self._theme_templates:
             # The browser picks the mode's template; the one the figure baked in at
             # construction would only add dead weight and a flash of the wrong theme.
-            layout = fig_dict.get("layout")
-            if isinstance(layout, dict):
-                layout.pop("template", None)
+            fig_dict["layout"].pop("template", None)
             theme_keys = await self._cache_templates()
             if theme_keys is not None:
                 themes_json = None

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/src/shiny_plotly/_serve.py

@@ -10,7 +10,8 @@ Importing ``shiny_plotly`` wraps ``shiny.App.__init__``, so every app built afte
 route for the bundle's exact path in front of Shiny's mount, and a background thread starts
 compressing the bundle once per process. Both happen while the app is being built, before it
 can serve anything, so the first request of the process is already served here; until the
-compression has finished the route serves the raw file with the same cache headers. An app
+compression has finished the route serves the raw file, marked for revalidation rather than
+immutable when the client asked for an encoding that is still on its way. An app
 built before the import can still ask for the route with :func:`enable_compressed_plotly_js`,
 and each session enables it for its own app, so it is there either way.
 """
@@ -44,6 +45,10 @@ __all__ = (
 
 ROUTE_NAME = "shiny-plotly-bundle"
 CACHE_CONTROL = "public, max-age=31536000, immutable"
+# For a body that is not yet the one this client will get: the raw file, served while the
+# encoding it asked for is still being compressed. Stored, but revalidated on every use,
+# so the next visit swaps it for the compressed body instead of keeping it for a year.
+PROVISIONAL_CACHE_CONTROL = "no-cache"
 MEDIA_TYPE = "text/javascript; charset=utf-8"
 
 logger = logging.getLogger(__name__)
@@ -55,7 +60,7 @@ BROTLI_SAVING_PERCENT = 17
 
 try:
     import brotli
-except ImportError:  # pragma: no cover - optional extra
+except ImportError:  # pragma: no cover - a dependency, absent only where it was left out
     brotli = None
 
 
@@ -72,6 +77,8 @@ class CompressedBundle:
             f"{stat.st_size}-{stat.st_mtime_ns}".encode(), usedforsecurity=False
         ).hexdigest()[:16]
         self.encodings: dict[str, bytes] = {}
+        # Every encoding the compression will produce, in the order it produces them.
+        self.produces: tuple[str, ...] = ("br", "gzip") if brotli is not None else ("gzip",)
         self._ready = threading.Event()
         self._started = False
         self._lock = threading.Lock()
@@ -86,6 +93,11 @@ class CompressedBundle:
     def wait(self, timeout: float | None = None) -> bool:
         return self._ready.wait(timeout)
 
+    @property
+    def ready(self) -> bool:
+        """Whether compression has finished, every encoding it will produce in place."""
+        return self._ready.is_set()
+
     def etag(self, encoding: str | None) -> str:
         return f'"{self.etag_base}"' if encoding is None else f'"{self.etag_base}-{encoding}"'
 
@@ -103,8 +115,8 @@ class CompressedBundle:
                 # bundle is compressed, cached and immutable either way, just bigger.
                 logger.warning(
                     "shiny-plotly is serving plotly.min.js gzipped (%.2f MB); brotli would "
-                    "be about %d%% smaller. Install shiny-plotly[brotli] for it, or silence "
-                    "this with logging.getLogger('shiny_plotly').setLevel(logging.ERROR).",
+                    "be about %d%% smaller. Install brotli for it, or silence this with "
+                    "logging.getLogger('shiny_plotly').setLevel(logging.ERROR).",
                     len(self.encodings["gzip"]) / 1e6,
                     BROTLI_SAVING_PERCENT,
                 )
@@ -127,21 +139,59 @@ def bundle() -> CompressedBundle:
         return _bundle
 
 
+def refuses(params: str) -> bool:
+    """
+    Whether the parameters of one ``Accept-Encoding`` entry rule its encoding out.
+
+    RFC 9110 writes a refusal as a qvalue of zero, which is ``q=0`` but equally ``q=0.0``
+    and ``q=0.000``, wherever it stands among the entry's ``;``-separated parameters.
+    Anything else leaves the encoding on offer, an unparsable qvalue included: serving a
+    client the encoding it asked for beats guessing at a malformed header.
+    """
+    for param in params.split(";"):
+        key, _, value = param.partition("=")
+        if key.strip().lower() != "q":
+            continue
+        try:
+            return float(value) == 0
+        except ValueError:
+            return False
+    return False
+
+
 def accepted_encodings(accept_encoding: str | None) -> Iterator[str]:
     """Encodings the client accepts, in our order of preference."""
     if not accept_encoding:
         return
     offered: set[str] = set()
+    refused: set[str] = set()
     for part in accept_encoding.split(","):
         token, _, params = part.partition(";")
-        if params.replace(" ", "").lower() == "q=0":
-            continue
-        offered.add(token.strip().lower())
+        (refused if refuses(params) else offered).add(token.strip().lower())
+    # "*" stands for every encoding the header does not name (RFC 9110, 12.5.3), so a
+    # named refusal holds against it, and a named acceptance holds against "*;q=0".
+    wildcard = "*" in offered
     for encoding in ("br", "gzip"):
-        if encoding in offered or "*" in offered:
+        if encoding in offered or (wildcard and encoding not in refused):
             yield encoding
 
 
+def etag_matches(if_none_match: str, etag: str) -> bool:
+    """
+    Whether an ``If-None-Match`` header names ``etag``, compared as RFC 9110 requires.
+
+    The comparison is weak (13.1.2): ``W/"x"`` matches ``"x"``, since a proxy may weaken a
+    tag it passes on. ``*`` matches any current representation, which this route always has.
+    """
+    for candidate in if_none_match.split(","):
+        tag = candidate.strip()
+        if tag == "*":
+            return True
+        if tag.removeprefix("W/") == etag:
+            return True
+    return False
+
+
 def response_for(
     bundle: CompressedBundle,
     *,
@@ -149,10 +199,19 @@ def response_for(
     if_none_match: str | None,
     method: str = "GET",
 ) -> Response:
-    encoding = next((e for e in accepted_encodings(accept_encoding) if e in bundle.encodings), None)
+    accepted = list(accepted_encodings(accept_encoding))
+    encoding = next((e for e in accepted if e in bundle.encodings), None)
+    # The encoding this client gets once compression is done. Until then it may be served
+    # the raw file instead, which must not be the body it caches for a year.
+    eventual = next((e for e in accepted if e in bundle.produces), None)
+    final = bundle.ready or encoding == eventual
     etag = bundle.etag(encoding)
-    headers = {"Cache-Control": CACHE_CONTROL, "Vary": "Accept-Encoding", "ETag": etag}
-    if if_none_match is not None and etag in [t.strip() for t in if_none_match.split(",")]:
+    headers = {
+        "Cache-Control": CACHE_CONTROL if final else PROVISIONAL_CACHE_CONTROL,
+        "Vary": "Accept-Encoding",
+        "ETag": etag,
+    }
+    if if_none_match is not None and etag_matches(if_none_match, etag):
         return Response(status_code=304, headers=headers)
     if encoding is None:
         # Streams the file from disk; HEAD is detected from the request scope.

{shiny_plotly-0.3.3 → shiny_plotly-0.4.1}/src/shiny_plotly/_update.py

@@ -8,9 +8,10 @@ dashboard wants for a new point every second. They ride on Shiny's custom messag
 are applied by the browser helper to the graph div of the named output. One sent while
 the output has no figure drawn (its first render is still running, it sits in a hidden
 tab, it shows an error or was emptied by ``None``) is held and applied, in order, right
-after the output's next draw. A re-render replaces the figure, updates included, with
-what the render function returns. All of these are coroutines: await them from an
-``async def`` effect.
+after the output's next draw; consecutive held extends (or prepends) to the same traces,
+attributes and ``max_points`` are merged into one as they arrive. A re-render replaces
+the figure, updates included, with what the render function returns. All of these are
+coroutines: await them from an ``async def`` effect.
 """
 
 from __future__ import annotations
@@ -21,6 +22,8 @@ from typing import Any
 from plotly.io.json import to_json_plotly
 from shiny.session import Session, require_active_session
 
+from ._validate import as_int, as_positive_int
+
 __all__ = (
     "add_traces",
     "delete_traces",
@@ -40,20 +43,23 @@ Trace = Mapping[str, Any] | Any
 
 
 def _indices(indices: Indices) -> list[int] | None:
+    """Trace indices as a list of Python ints; numpy integers and arrays are taken too."""
     if indices is None:
         return None
-    if isinstance(indices, int):
-        return [indices]
-    return list(indices)
+    try:
+        return [as_int(indices)]
+    except TypeError:
+        pass
+    try:
+        return [as_int(index) for index in indices]  # type: ignore[union-attr]
+    except TypeError:
+        raise ValueError(f"indices must be an integer or integers, got {indices!r}") from None
 
 
-def _check_max_points(max_points: int | None) -> None:
-    # bool is excluded by name: it is an int in Python but serializes to a JSON true,
-    # which plotly.js reads as non-numeric and quietly treats as no cap at all.
-    if max_points is not None and (
-        isinstance(max_points, bool) or not isinstance(max_points, int) or max_points < 1
-    ):
-        raise ValueError(f"max_points must be a positive integer, got {max_points!r}")
+def _max_points(max_points: int | None) -> int | None:
+    # A JSON true, which a Python bool would become, reads to plotly.js as non-numeric and
+    # quietly means no cap at all; as_positive_int refuses it here instead.
+    return None if max_points is None else as_positive_int(max_points, "max_points")
 
 
 def _trace_json(trace: Trace) -> Any:
@@ -97,8 +103,7 @@ async def extend_traces(
     The update is sent to the session's client; outside a session it fails. Use it
     from a reactive effect, for instance one driven by ``reactive.invalidate_later``.
     """
-    _check_max_points(max_points)
-    await _send(id, "extendTraces", [data, _indices(indices), max_points], session)
+    await _send(id, "extendTraces", [data, _indices(indices), _max_points(max_points)], session)
 
 
 async def prepend_traces(
@@ -116,8 +121,7 @@ async def prepend_traces(
     ones, and ``max_points`` drops the newest points past that many instead of the
     oldest. Same ``data`` and ``indices`` shapes.
     """
-    _check_max_points(max_points)
-    await _send(id, "prependTraces", [data, _indices(indices), max_points], session)
+    await _send(id, "prependTraces", [data, _indices(indices), _max_points(max_points)], session)
 
 
 async def add_traces(

shiny_plotly-0.4.1/src/shiny_plotly/_validate.py

@@ -0,0 +1,31 @@
+"""Argument checks shared by the renderer and the in-place updates."""
+
+from __future__ import annotations
+
+import operator
+from typing import Any
+
+
+def as_int(value: Any) -> int:
+    """
+    ``value`` as a Python int, for anything integer-like: ``int`` and numpy's integers.
+
+    Raises TypeError for anything else. ``bool`` is refused by name: it is an int in Python
+    but serializes to a JSON ``true``, which plotly.js does not read as a number (numpy's
+    bool is no integer to begin with). A float, even a whole one, is refused as well, the
+    way ``range()`` and list indexing refuse it.
+    """
+    if isinstance(value, bool):
+        raise TypeError(f"expected an integer, got {value!r}")
+    return operator.index(value)
+
+
+def as_positive_int(value: Any, name: str) -> int:
+    """``value`` as a Python int of at least 1; ValueError naming ``name`` otherwise."""
+    try:
+        number = as_int(value)
+    except TypeError:
+        number = 0
+    if number < 1:
+        raise ValueError(f"{name} must be a positive integer, got {value!r}")
+    return number