@brianmsm/quarto-bento 0.0.0-stage → 0.1.1

package/distribution/runtime/src/render/native-layout.ts

@@ -0,0 +1,174 @@
+/** Frame adapters for existing simple native content; never rewrite semantic fields. */
+import type { BentoElement, JsonObject } from "../state/types.ts";
+import { canonical } from "../state/json.ts";
+import { StateError } from "../state/types.ts";
+import { type ChartKind, chartOption } from "./chart.ts";
+import { type PlainTable, tableHeight } from "./table.ts";
+import { escapeHtml } from "./html.ts";
+import type { Frame } from "./design.ts";
+function unsupported(message: string): never {
+  throw new StateError("UNSUPPORTED_LAYOUT_CONTENT", message);
+}
+function plainText(html: unknown): string {
+  if (typeof html !== "string") {
+    return unsupported("A table cell needs plain text.");
+  }
+  const text = html.replace(
+    /&(?:amp|lt|gt|quot|#39);/g,
+    (entity) =>
+      ({ "&amp;": "&", "&lt;": "<", "&gt;": ">", "&quot;": '"', "&#39;": "'" })[
+        entity
+      ]!,
+  );
+  if (escapeHtml(text) !== html) {
+    unsupported("Rich table cells need their own measured adapter.");
+  }
+  return text;
+}
+/** Validate the actual saved metrics, not an assumed projection before overrides. */
+export function nativeLayoutFrame(element: BentoElement, slot: Frame): Frame {
+  const refs = element.themeRefs;
+  if (
+    refs && typeof refs === "object" && !Array.isArray(refs) &&
+    Object.keys(refs).some((path) =>
+      ["x", "y", "w", "h", "rotation"].includes(path) ||
+      ["table", "chart"].includes(element.type) &&
+        /^(?:style(?:\.|$)|font|lineHeight)/.test(path)
+    )
+  ) {
+    return unsupported(
+      "This object's frame or measured metrics derive from a theme reference. Resolve that reference explicitly before applying a layout.",
+    );
+  }
+  if (element.rotation !== undefined && element.rotation !== 0) {
+    return unsupported(
+      "Reset rotation before placing this object in a column.",
+    );
+  }
+  if (["text", "code", "image"].includes(element.type)) return { ...slot };
+  if (element.type === "table") {
+    const style = element.style as JsonObject;
+    if (
+      !style || style.fontSize !== 18 || style.cellPadX !== 16 ||
+      style.cellPadY !== 11 || style.borderWidth !== 1
+    ) {
+      return unsupported(
+        "This table has custom cell metrics; retain its design or restore the simple table metrics before applying a layout.",
+      );
+    }
+    const columns = element.columns as JsonObject[],
+      rows = element.rows as JsonObject[];
+    if (
+      !Array.isArray(columns) || !columns.length || !Array.isArray(rows) ||
+      !rows.length
+    ) return unsupported("Malformed simple table.");
+    const table: PlainTable = {
+      header: element.header === true,
+      columns: columns.map((column) => {
+        if (
+          typeof column.w !== "number" || !Number.isFinite(column.w) ||
+          column.w <= 0
+        ) return unsupported("Invalid table column weight.");
+        return { width: column.w, align: "left" };
+      }),
+      rows: rows.map((row) => {
+        const cells = row.cells as JsonObject[];
+        if (!Array.isArray(cells) || cells.length !== columns.length) {
+          return unsupported("Use a rectangular simple table.");
+        }
+        return cells.map((cell) => ({
+          text: plainText(cell.html),
+          align: "left",
+        }));
+      }),
+    };
+    return { ...slot, h: tableHeight(table, slot) };
+  }
+  if (element.type === "chart") {
+    const option = element.option as JsonObject,
+      axis = option?.xAxis as JsonObject;
+    const labels = axis?.data, series = option?.series as JsonObject[];
+    const kind = element.preset as ChartKind;
+    if (
+      !Array.isArray(labels) || !Array.isArray(series) || !series.length ||
+      !["bar", "line"].includes(kind)
+    ) return unsupported("Use a simple bar or line chart.");
+    const cell = (text: unknown) => {
+      if (typeof text !== "string") {
+        return unsupported("Chart labels must be plain text.");
+      }
+      return { text, align: "left" as const };
+    };
+    const table: PlainTable = {
+      header: true,
+      columns: Array.from(
+        { length: series.length + 1 },
+        () => ({ width: 1, align: "left" }),
+      ),
+      rows: [
+        [cell(""), ...series.map((s) => cell(s.name))],
+        ...labels.map((label, index) => [
+          cell(label),
+          ...series.map((s) => {
+            const values = s.data;
+            if (
+              !Array.isArray(values) || values.length !== labels.length ||
+              typeof values[index] !== "number"
+            ) {
+              return unsupported(
+                "Chart data needs the simple numeric adapter.",
+              );
+            }
+            return cell(String(values[index]));
+          }),
+        ]),
+      ],
+    };
+    // This both validates final axes/legend space and prevents silently dropping
+    // custom native option fields while interpreting a different chart grammar.
+    if (canonical(chartOption(table, kind, slot)) !== canonical(option)) {
+      return unsupported(
+        "This chart has custom options; its layout needs a matching measured adapter.",
+      );
+    }
+    return { ...slot };
+  }
+  return unsupported(`No reusable-layout frame adapter for ${element.type}.`);
+}
+
+/** Conservative native table/chart metrics on the final saved frame, after overlays. */
+export function nativeLayoutDiagnostics(
+  document: Pick<import("./types.ts").BentoDoc, "slides">,
+): import("./types.ts").Diagnostic[] {
+  const diagnostics: import("./types.ts").Diagnostic[] = [];
+  for (const slide of document.slides) {
+    for (const element of slide.elements) {
+      if (!["table", "chart"].includes(element.type)) continue;
+      try {
+        nativeLayoutFrame(element, {
+          x: Number(element.x),
+          y: Number(element.y),
+          w: Number(element.w),
+          h: Number(element.h),
+        });
+      } catch (error) {
+        const detail = String(error);
+        const overflow = detail.includes("UNSUPPORTED_TABLE_LAYOUT") ||
+          /final chart frame|Category labels exceed|Series names exceed/.test(
+            detail,
+          );
+        diagnostics.push({
+          code: overflow
+            ? "NATIVE_CONTENT_OVERFLOW"
+            : "NATIVE_CONTENT_UNMEASURED",
+          slideId: slide.id,
+          elementId: element.id,
+          message: overflow
+            ? `The current ${element.type} content no longer fits the saved frame under its conservative native metrics. Enlarge it or reapply a roomier layout; saved geometry was preserved. ${detail}`
+            : `The saved ${element.type} uses metrics outside the simple native layout adapter; inspect it in Bento. Saved geometry was preserved. ${detail}`,
+        });
+      }
+    }
+  }
+  return diagnostics;
+}

package/distribution/runtime/src/render/producer-capture.ts

@@ -0,0 +1,319 @@
+import { producerEnvironment } from "./producer-environment.ts";
+import { basename, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { hashSource, scanSource } from "../source/mod.ts";
+import type { Ast, Node } from "./types.ts";
+export interface ProducerManifest {
+  version: 1;
+  nonce: string;
+  sourceHash: string;
+  input: string;
+  outputReceiptPath?: string;
+  chunks: {
+    index: number;
+    id: string;
+    slideId?: string;
+    label: string;
+    code: string;
+  }[];
+}
+function assertProducerStartup() {
+  const args = (Deno.env.get("QUARTO_KNITR_RSCRIPT_ARGS") ?? "").split(",").map(
+    (arg) => arg.trim(),
+  );
+  if (args.includes("--vanilla") || args.includes("--no-init-file")) {
+    throw new Error(
+      "UNSUPPORTED_PRODUCER_STARTUP: QUARTO_KNITR_RSCRIPT_ARGS disables the original-producer adapter with --vanilla/--no-init-file; use an R startup that loads the adapter or a separately verified execution transport (flags remain unchanged)",
+    );
+  }
+}
+export async function prepareProducerCapture(
+  source: string,
+  options: { environment?: boolean } = {},
+) {
+  const text = await Deno.readTextFile(source), document = scanSource(text);
+  if (document.blocks.some((block) => block.kind === "chunk")) {
+    assertProducerStartup();
+  }
+  if (
+    /(?:\bqbento-producer-proof\s*[=:]|\.qbento-execution\b)/m.test(text)
+  ) {
+    throw new Error(
+      "RESERVED_PRODUCER_MARKER: source cannot declare internal execution receipts",
+    );
+  }
+  let unnamed = 0;
+  const manifest: ProducerManifest = {
+    version: 1,
+    nonce: crypto.randomUUID(),
+    sourceHash: document.hash,
+    input: resolve(
+      dirname(source),
+      basename(source).replace(/\.[^.]*$/, ".rmarkdown"),
+    ),
+    chunks: document.blocks.filter((b) => b.kind === "chunk").map(
+      (block, index) => {
+        const label = block.content.match(
+          /^\s*#\|\s*label:\s*["']?([A-Za-z][\w:.-]*)["']?\s*$/m,
+        )?.[1] ??
+          block.raw.split(/\r?\n/)[0].match(
+            /\{\w+[ ,]+([A-Za-z][\w:.-]*)(?:[, }]|$)/,
+          )?.[1] ?? `unnamed-chunk-${++unnamed}`;
+        const indent = block.raw.match(/^( {0,3})(?:`{3,}|~{3,})/)?.[1] ?? "";
+        const code = block.content.replace(/\r\n|\r/g, "\n").split("\n").map(
+          (line) =>
+            indent && line.startsWith(indent)
+              ? line.slice(indent.length)
+              : line,
+        ).filter((line) => !/^\s*#\|/.test(line)).join("\n").replace(/\n$/, "");
+        return {
+          index,
+          id: block.id,
+          ...(block.slideId ? { slideId: block.slideId } : {}),
+          label,
+          code,
+        };
+      },
+    ),
+  };
+  const startup = options.environment === false || manifest.chunks.length === 0
+    ? {
+      effective: {} as Record<string, string>,
+      originalProfile: undefined,
+      args: [] as string[],
+    }
+    : await producerEnvironment({ cwd: dirname(source) });
+  const receiptDir = await Deno.makeTempDir({ prefix: "qbento-producer-" });
+  const path = resolve(receiptDir, "manifest.json");
+  manifest.outputReceiptPath = resolve(receiptDir, "emitted.jsonl");
+  await Deno.writeTextFile(manifest.outputReceiptPath, "");
+  await Deno.writeTextFile(path, JSON.stringify(manifest));
+  const original = startup.originalProfile;
+  return {
+    manifest,
+    emitted: async () =>
+      (await Deno.readTextFile(manifest.outputReceiptPath!)).split("\n").filter(
+        Boolean,
+      ).map((line) => JSON.parse(line) as string),
+    cleanup: () => Deno.remove(receiptDir, { recursive: true }),
+    env: manifest.chunks.length === 0 ? {} : {
+      ...startup.effective,
+      QUARTO_KNITR_RSCRIPT_ARGS: [
+        ...startup.args,
+        "--no-environ",
+      ].filter(Boolean).join(","),
+      R_PROFILE_USER: fileURLToPath(
+        new URL("./producer-profile.R", import.meta.url),
+      ),
+      ...(startup.args.includes("--no-site-file") ? {} : {
+        R_PROFILE: fileURLToPath(
+          new URL("./producer-site-profile.R", import.meta.url),
+        ),
+      }),
+      QBENTO_ORIGINAL_R_SITE_SET: startup.effective.R_PROFILE === undefined
+        ? "0"
+        : "1",
+      QBENTO_ORIGINAL_R_SITE: startup.effective.R_PROFILE ?? "",
+      QBENTO_PRODUCER_PROFILE: fileURLToPath(
+        new URL("./producer-profile.R", import.meta.url),
+      ),
+      QBENTO_ORIGINAL_R_PROFILE_SET: original === undefined ? "0" : "1",
+      QBENTO_ORIGINAL_R_PROFILE_USER: original ?? "",
+      QBENTO_PRODUCER_MANIFEST: path,
+    },
+  };
+}
+// Receipts are trusted only after the execution boundary attaches a manifest.
+// A serialized AST or a filter-authored attribute cannot self-declare that trust.
+const captures = new WeakMap<Ast, ProducerManifest>();
+export function producerReceipt(ast: Ast, sourceHash: string, token: string) {
+  const manifest = captures.get(ast);
+  if (
+    !manifest || manifest.version !== 1 || manifest.sourceHash !== sourceHash ||
+    !token.startsWith(manifest.nonce + ":")
+  ) {
+    throw new Error(
+      "INVALID_PRODUCER_RECEIPT: execution receipt does not match the original source and invocation",
+    );
+  }
+  const chunk = manifest.chunks.find((c) =>
+    token === `${manifest.nonce}:${c.index}`
+  );
+  if (!chunk) {
+    throw new Error(
+      "INVALID_PRODUCER_RECEIPT: execution receipt has no original chunk",
+    );
+  }
+  return chunk;
+}
+export function attachProducerCapture(
+  ast: Ast,
+  manifest: ProducerManifest,
+  expectedTokens?: string[],
+): Ast {
+  const seen = new Set<string>();
+  const sequence: string[] = [];
+  const attached = { ...ast };
+  captures.set(attached, structuredClone(manifest));
+  function visit(value: unknown, scoped = false) {
+    if (Array.isArray(value)) {
+      value.forEach((child) => visit(child, scoped));
+      return;
+    }
+    if (!value || typeof value !== "object") return;
+    const node = value as Node;
+    if (node.t === "Div") {
+      const [attr, children] = node.c as [
+        [string, string[], [string, string][]],
+        Node[],
+      ];
+      if (
+        !scoped &&
+        attr[1].some((cls) => cls === "cell" || cls.startsWith("cell-output"))
+      ) {
+        throw new Error(
+          "MISSING_PRODUCER_RECEIPT: executed cell lost its verified original boundary",
+        );
+      }
+      const tokens = attr[2].filter(([key]) => key === "qbento-producer-proof");
+      if (attr[1].includes("qbento-execution") || tokens.length) {
+        if (
+          attr[0] || attr[1].length !== 1 ||
+          attr[1][0] !== "qbento-execution" || tokens.length !== 1 ||
+          attr[2].length !== 1 || seen.has(tokens[0][1])
+        ) {
+          throw new Error(
+            "INVALID_PRODUCER_RECEIPT: malformed or repeated original execution boundary",
+          );
+        }
+        producerReceipt(
+          attached,
+          manifest.sourceHash,
+          tokens[0][1],
+        );
+        seen.add(tokens[0][1]);
+        sequence.push(tokens[0][1]);
+        scoped = true;
+      }
+      children.forEach((child) => visit(child, scoped));
+    } else if ("c" in node) visit(node.c, scoped);
+  }
+  ast.blocks.forEach((node) => visit(node));
+  if (
+    expectedTokens &&
+    (new Set(expectedTokens).size !== expectedTokens.length ||
+      expectedTokens.length !== seen.size ||
+      expectedTokens.some((token, index) => token !== sequence[index]))
+  ) {
+    throw new Error(
+      "MISSING_PRODUCER_RECEIPT: executed output receipts were removed, repeated or replaced before capture",
+    );
+  }
+  return attached;
+}
+
+/** User transformations can detach or swap producer boundaries. Refuse them
+ * before execution until a transform-specific original-boundary proof exists.
+ * Inspect resolves QMD/project/profile/metadata inheritance; source-only YAML
+ * searches cannot establish this gate.
+ */
+export async function assertCompatibleProducerFilters(
+  source: string,
+  targetFormat = "html",
+) {
+  const document = scanSource(await Deno.readTextFile(source));
+  if (
+    !document.blocks.some((b) => b.kind === "chunk" || b.origin === "computed")
+  ) return;
+  if (document.blocks.some((b) => b.kind === "chunk")) assertProducerStartup();
+  const inspected = await new Deno.Command("quarto", {
+    cwd: dirname(source),
+    args: ["inspect", source],
+    stdout: "piped",
+    stderr: "piped",
+  }).output();
+  if (!inspected.success) {
+    throw new Error(
+      `QUARTO_INSPECT_FAILED: ${new TextDecoder().decode(inspected.stderr)}`,
+    );
+  }
+  const inspection = JSON.parse(new TextDecoder().decode(inspected.stdout));
+  const filters: unknown[] = [];
+  const append = (value: unknown) => {
+    if (value === undefined || value === null) return;
+    if (Array.isArray(value)) filters.push(...value);
+    else filters.push(value);
+  };
+  const selected = inspection.formats?.[targetFormat];
+  // Quarto inspect has no --to override. If it omits the forced format, use
+  // the inspected configurations conservatively rather than assume an absent filter.
+  const effective = selected
+    ? [selected]
+    : Object.values(inspection.formats ?? {});
+  for (
+    const format of effective as Record<
+      string,
+      Record<string, unknown>
+    >[]
+  ) {
+    append(format.pandoc?.filters);
+    append(format.metadata?.filters);
+    append(format.metadata?.["lua-filter"]);
+    append(format.metadata?.["lua-filters"]);
+  }
+  // Bind the reviewed internal filter bytes, including in installed runtimes
+  // where project filters must not become their own trust authority.
+  const canonical = new Set([
+    "484dc9143665b4b61fab5e1ce24241f8133d1c5e2c59bfbb4576606e036f7f2f",
+    "bf2ef385783f7b750d7dc97e1f158d30d4fcd4556a44bf5f82486749d25bed97",
+  ]);
+  for (const filter of filters) {
+    const path = typeof filter === "string"
+      ? filter
+      : filter && typeof filter === "object"
+      ? (filter as { path?: unknown }).path
+      : undefined;
+    let internal = false;
+    if (
+      typeof path === "string" &&
+      /(?:^|[/\\])_extensions[/\\]qbento[/\\](?:guard|capture)\.lua$/.test(path)
+    ) {
+      try {
+        internal = canonical.has(hashSource(
+          await Deno.readTextFile(resolve(dirname(source), path)),
+        ));
+      } catch { /* Missing or changed filters are never trusted. */ }
+    }
+    if (!internal) {
+      throw new Error(
+        "UNSUPPORTED_COMPUTED_FILTER: effective user filters can change execution producer boundaries; remove them from computed QMD/project/profile/metadata configuration or use a separately verified transformation adapter",
+      );
+    }
+  }
+}
+
+/** Existing bounded rich/widget adapters may look through exactly one verified
+ * execution boundary, while retaining their original source producer proof.
+ */
+export function producerOutputChildren(
+  ast: Ast,
+  nodes: Node[],
+  sourceHash: string,
+  expectedProducer: string,
+): Node[] {
+  if (nodes.length !== 1 || nodes[0].t !== "Div") return nodes;
+  const [attr, children] = nodes[0].c as [
+    [string, string[], [string, string][]],
+    Node[],
+  ];
+  if (!attr[1].includes("qbento-execution")) return nodes;
+  const token = attr[2].find(([key]) => key === "qbento-producer-proof")?.[1];
+  if (
+    !token || producerReceipt(ast, sourceHash, token).id !== expectedProducer
+  ) {
+    throw new Error(
+      "INVALID_PRODUCER_RECEIPT: output boundary disagrees with the original adapter producer",
+    );
+  }
+  return children;
+}

package/distribution/runtime/src/render/producer-environment.R

@@ -0,0 +1,49 @@
+# Base-only data parsing: --vanilla/NULL prevents all profiles, user packages,
+# cached workspaces and QMD execution. Renviron values are never logged.
+local({
+  args <- commandArgs(TRUE)
+  stopifnot(length(args) == 2L)
+  Sys.setenv(R_DEFAULT_PACKAGES=Sys.getenv('QBENTO_STARTUP_PACKAGES'))
+  Sys.unsetenv('QBENTO_STARTUP_PACKAGES')
+  # R's --vanilla sets these selectors to empty: restore the caller's exact
+  # unset/empty/value distinction before applying the native environment parser.
+  for (name in c('R_ENVIRON','R_ENVIRON_USER','R_PROFILE','R_PROFILE_USER')) {
+    marker <- paste0('QBENTO_STARTUP_', name, '_SET')
+    value <- paste0('QBENTO_STARTUP_', name, '_VALUE')
+    if (Sys.getenv(marker) == '1') {
+      selected <- list(Sys.getenv(value))
+      names(selected) <- name
+      do.call(Sys.setenv, selected)
+    } else Sys.unsetenv(name)
+    Sys.unsetenv(c(marker,value))
+  }
+  baseline <- Sys.getenv()
+  if (identical(args[[2L]], 'read')) {
+    read_file <- function(path) {
+      if (nzchar(path) && file.exists(path) && !dir.exists(path)) {
+        if (!readRenviron(path)) stop('Cannot read startup environment')
+      }
+    }
+    site <- Sys.getenv('R_ENVIRON', unset=NA_character_)
+    if (is.na(site)) site <- file.path(R.home('etc'), 'Renviron.site')
+    read_file(site)
+    user <- Sys.getenv('R_ENVIRON_USER', unset=NA_character_)
+    if (is.na(user)) {
+      local <- file.path(getwd(), '.Renviron')
+      user <- if (file.exists(local)) local else file.path(path.expand('~'), '.Renviron')
+    }
+    read_file(user)
+  }
+  current <- Sys.getenv()
+  keys <- names(current)[!(names(current) %in% names(baseline)) |
+    current != baseline[names(current)]]
+  keys <- unique(c(keys[!is.na(keys)], "R_DEFAULT_PACKAGES"))
+  connection <- file(args[[1L]], 'wb')
+  for (key in keys) {
+    writeBin(charToRaw(enc2utf8(key)), connection)
+    writeBin(as.raw(0L), connection)
+    writeBin(charToRaw(enc2utf8(current[[key]])), connection)
+    writeBin(as.raw(0L), connection)
+  }
+  close(connection)
+})

package/distribution/runtime/src/render/producer-environment.ts

@@ -0,0 +1,96 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** Evaluate startup environment files with R's parser, without profiles,
+ * default packages or QMD. Only file-induced changes reach the real child.
+ */
+export async function producerEnvironment(options: {
+  cwd: string;
+  env?: Record<string, string>;
+  command?: string;
+  args?: string[];
+}) {
+  const inherited = { ...Deno.env.toObject(), ...options.env };
+  let command = options.command ?? "Rscript";
+  if (!options.command) {
+    const selected = inherited.QUARTO_R;
+    if (selected) {
+      try {
+        const info = await Deno.stat(selected);
+        command = resolve(
+          info.isDirectory ? selected : dirname(selected),
+          "Rscript",
+        );
+      } catch { /* Quarto also falls back for a missing QUARTO_R. */ }
+    } else if (inherited.R_HOME) {
+      const candidate = resolve(inherited.R_HOME, "bin", "Rscript");
+      try {
+        await Deno.stat(candidate);
+        command = candidate;
+      } catch { /* PATH. */ }
+    }
+  }
+  const args = options.args ?? (inherited.QUARTO_KNITR_RSCRIPT_ARGS ?? "")
+    .split(",").filter((arg) => arg.trim());
+  const directory = await Deno.makeTempDir({ prefix: "qbento-r-environment-" });
+  const output = resolve(directory, "changes.bin");
+  const originalPackages = inherited.R_DEFAULT_PACKAGES;
+  const explicitPackages = args.filter((arg) =>
+    arg.startsWith("--default-packages=")
+  ).at(-1)?.slice("--default-packages=".length);
+  const startupSelection: Record<string, string> = {};
+  for (
+    const name of ["R_ENVIRON", "R_ENVIRON_USER", "R_PROFILE", "R_PROFILE_USER"]
+  ) {
+    startupSelection[`QBENTO_STARTUP_${name}_SET`] =
+      inherited[name] === undefined ? "0" : "1";
+    startupSelection[`QBENTO_STARTUP_${name}_VALUE`] = inherited[name] ?? "";
+  }
+  try {
+    const result = await new Deno.Command(command, {
+      cwd: options.cwd,
+      args: [
+        "--vanilla",
+        "--default-packages=NULL",
+        fileURLToPath(new URL("./producer-environment.R", import.meta.url)),
+        output,
+        args.includes("--no-environ") ? "skip" : "read",
+      ],
+      clearEnv: true,
+      env: {
+        ...inherited,
+        ...startupSelection,
+        QBENTO_STARTUP_PACKAGES: explicitPackages ?? originalPackages ??
+          "datasets,utils,grDevices,graphics,stats,methods",
+      },
+      stdout: "piped",
+      stderr: "piped",
+    }).output();
+    if (!result.success) {
+      // Do not expose environment values, including in errors from malformed files.
+      throw new Error(
+        "R_ENVIRONMENT_PROBE_FAILED: cannot resolve startup environment without executing source",
+      );
+    }
+    const values = new TextDecoder().decode(await Deno.readFile(output)).split(
+      "\0",
+    );
+    values.pop();
+    if (values.length % 2) {
+      throw new Error(
+        "INVALID_R_ENVIRONMENT_PROBE: malformed environment changes",
+      );
+    }
+    const effective = { ...inherited };
+    for (let i = 0; i < values.length; i += 2) {
+      effective[values[i]] = values[i + 1];
+    }
+    return {
+      effective,
+      originalProfile: effective.R_PROFILE_USER,
+      args: args.filter((arg) => !arg.startsWith("--default-packages=")),
+    };
+  } finally {
+    await Deno.remove(directory, { recursive: true });
+  }
+}