beatrina 0.8.7 → 0.9.43

package/{check → kernel/check}/session.mjs

@@ -10,15 +10,16 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { mirrorEnv, setEnvName } from "../../host/env-names.mjs";
 
 export const repo = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 export const WIN = process.platform === "win32";
 export const pause = (ms) => new Promise((r) => setTimeout(r, ms));
 
-/** The installed carmar package's host/main.mjs, asked of R itself. */
+/** The installed R package's host/main.mjs (the package is still named `beatrina`), asked of R itself. */
 export function installedHost() {
   const r = spawnSync(WIN ? "Rscript.exe" : "Rscript",
-    ["-e", "cat(system.file('app', 'host', 'main.mjs', package = 'carmar'))"], { encoding: "utf8" });
+    ["-e", "cat(system.file('app', 'host', 'main.mjs', package = 'beatrina'))"], { encoding: "utf8" });
   return String(r.stdout || "").trim();
 }
 
@@ -47,8 +48,11 @@ export function supervisorCommand({ supervisor = "beatrix", host = "", installed
     fs.copyFileSync(path.join(repo, "kernel.protocol"), path.join(stage, "kernel-protocol"));
     const version = String(spawnSync(process.execPath, ["-p", "require(process.argv[1]).version", path.join(repo, "notebook.version.cjs")], { encoding: "utf8" }).stdout).trim();
     fs.writeFileSync(path.join(stage, "kernel-version"), `${version}\n`);
-    for (const f of fs.readdirSync(path.join(repo, "dist")).filter((x) => /^carmar_V.*\.html$/.test(x))) {
+    const checked = spawnSync(process.execPath, [path.join(repo, "tools/artifact-inputs.mjs")], {encoding:"utf8"});
+    if (checked.status !== 0) throw new Error(`Cannot stage stale notebook artifacts: ${checked.stderr || checked.error || "build verification failed"}`);
+    for (const f of [`beatrina_V${version}.html`, `beatrina_V${version}.beta.min.html`]) {
       fs.copyFileSync(path.join(repo, "dist", f), path.join(stage, f));
+      fs.copyFileSync(path.join(repo, "dist", f + ".inputs.json"), path.join(stage, f + ".inputs.json"));
     }
     return { label: "R supervisor (serve.R, retired)", cmd: WIN ? "Rscript.exe" : "Rscript", args: [path.join(stage, "serve.R")] };
   }
@@ -120,20 +124,57 @@ export function openSocket(port, origin) {
 }
 
 
+/**
+ * A port nothing is listening on, from the OS (listen on 0, read, close).
+ * `beatrina knit` without --port used to hand startSession an empty port, and
+ * the page socket then refused to connect to it — every knit that ran a chunk
+ * died before the first one (2026-09-19).
+ */
+export function freePort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.unref();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+
 /**
  * Start a supervisor on `port`, open a page socket, and wait for R's ready.
  * @returns {Promise<object>} the session: frames, until, text, run, ask, ready, startupMs, log, shutdown
  */
 export async function startSession({ command, port, cwd, env = {}, readyMs = 90000, logFile = "" }) {
   const t0 = Date.now();
+  // A caller's override may be spelled BEATRINA_* or CARMAR_*; it is applied
+  // under BOTH names so it beats the defaults below whichever spelling it used.
+  const overrides = {};
+  for (const [k, v] of Object.entries(env)) setEnvName(overrides, k, v);
   const child = spawn(command.cmd, command.args, {
     cwd,
-    env: {
-      ...process.env, CARMAR_PORT: String(port), CARMAR_NO_NATIVE_DIALOG: "1", CARMAR_NO_RUNTIME_FILE: "1",
-      CARMAR_HISTORY_DIR: path.join(cwd, ".beatrina-history"), CARMAR_NO_UPDATE_CHECK: "1", CARMAR_LINGER: "0",
+    // Canonical names, mirrored: a host older than the rename reads CARMAR_*.
+    env: mirrorEnv({
+      ...process.env, BEATRINA_PORT: String(port), BEATRINA_NO_NATIVE_DIALOG: "1", BEATRINA_NO_RUNTIME_FILE: "1",
+      BEATRINA_HISTORY_DIR: path.join(cwd, ".beatrina-history"), BEATRINA_NO_UPDATE_CHECK: "1",
+      // A PRIVATE SESSION MUST BE ABLE TO REAP ITSELF.
+      //
+      // This pair — LINGER=0 (never idle-reap) with NO_RUNTIME_FILE=1 (write
+      // no discovery record) — makes a kernel that nothing can find and
+      // nothing will ever stop. If the parent dies between spawn and
+      // shutdown, it serves forever: the orphan measured on port 4748 (pid
+      // 64335, started 2026-09-19) is exactly this, and it is holding a port
+      // in the owner's own session band.
+      //
+      // A POSITIVE linger is the documented opt-in to the idle clock, and a
+      // RUNNING TASK BLOCKS IT (spike/settings.R), so a long knit or check is
+      // not at risk — only an abandoned one, which is the case we want
+      // collected. The caller's `overrides` still win, spelled either way.
+      BEATRINA_LINGER: "600",
       BEATRIX_NO_OPEN: "1",                   // the `beatrix` command opens a browser unless told not to
-      ...env,
-    },
+      ...overrides,
+    }),
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
   });

package/kernel/deployment.R

@@ -1,6 +1,6 @@
 # deployment.R — where this kernel listens, and who is allowed to reach it.
 #
-# CarmaR was written for exactly one deployment: a loopback socket serving one
+# Beatrina was written for exactly one deployment: a loopback socket serving one
 # person on their own machine. Every trust rule in serve.R is an expression of
 # that, and one of them INVERTS the moment the socket leaves loopback:
 #
@@ -24,15 +24,15 @@
 # The refusals are the point. Binding off loopback is a deployment decision
 # with consequences the operator must state out loud:
 #
-#   · no CARMAR_HOSTS            → refuse. An unset Host allow-list off
+#   · no BEATRINA_HOSTS            → refuse. An unset Host allow-list off
 #                                  loopback is a DNS-rebinding hole with the
 #                                  door held open.
-#   · no authentication in front → refuse, unless CARMAR_ALLOW_UNAUTHENTICATED
+#   · no authentication in front → refuse, unless BEATRINA_ALLOW_UNAUTHENTICATED
 #                                  is set. The variable is deliberately long
 #                                  and unpleasant to type; it is a decision,
 #                                  not a default.
 #
-# The intended P0 shape is one CarmaR per person, each as their own OS user on
+# The intended P0 shape is one Beatrina per person, each as their own OS user on
 # its own port, with TLS and login in a reverse proxy (Caddy + OIDC
 # forward-auth). serve.R never sees a password; it trusts an identity header,
 # and only from the proxy address. See docs/server.md.
@@ -65,8 +65,8 @@ is_loopback_bind <- function(bind) tolower(bind %||% "") %in% LOOPBACK_HOSTS
 #'   `user_header`, `proxy_addrs`, and `errors` — a character vector that is
 #'   EMPTY when the posture is safe to serve. A non-empty `errors` must abort
 #'   startup; it is never a warning.
-carmar_deployment <- function(port, env = Sys.getenv) {
-  bind <- trimws(env("CARMAR_BIND", "127.0.0.1"))
+beatrina_deployment <- function(port, env = Sys.getenv) {
+  bind <- trimws(env("BEATRINA_BIND", "127.0.0.1"))
   if (!nzchar(bind)) bind <- "127.0.0.1"
   loopback <- is_loopback_bind(bind)
 
@@ -77,9 +77,9 @@ carmar_deployment <- function(port, env = Sys.getenv) {
   self_origins <- c(sprintf("http://%s:%d", bind, port),
                     sprintf("http://127.0.0.1:%d", port),
                     sprintf("http://localhost:%d", port))
-  origins <- unique(c(self_origins, split_list(env("CARMAR_ORIGINS", ""))))
+  origins <- unique(c(self_origins, split_list(env("BEATRINA_ORIGINS", ""))))
 
-  hosts_env <- split_list(env("CARMAR_HOSTS", ""))
+  hosts_env <- split_list(env("BEATRINA_HOSTS", ""))
   default_hosts <- c(sprintf("127.0.0.1:%d", port), sprintf("localhost:%d", port),
                      sprintf("[::1]:%d", port))
   # A configured host may or may not carry a port. Accept both spellings so an
@@ -97,33 +97,33 @@ carmar_deployment <- function(port, env = Sys.getenv) {
   # loopback. So the posture is declarable in its own right and the bind
   # address merely IMPLIES it; an operator hardening a shared machine does not
   # have to move the socket to say so.
-  require_origin <- identical(env("CARMAR_REQUIRE_ORIGIN", ""), "1") || !loopback
+  require_origin <- identical(env("BEATRINA_REQUIRE_ORIGIN", ""), "1") || !loopback
 
-  trust_proxy <- identical(env("CARMAR_TRUST_PROXY", ""), "1")
-  user_header <- trimws(env("CARMAR_USER_HEADER", "X-Forwarded-User"))
-  proxy_addrs <- split_list(env("CARMAR_TRUSTED_PROXY", "127.0.0.1 ::1"))
-  allow_open <- identical(env("CARMAR_ALLOW_UNAUTHENTICATED", ""), "1")
+  trust_proxy <- identical(env("BEATRINA_TRUST_PROXY", ""), "1")
+  user_header <- trimws(env("BEATRINA_USER_HEADER", "X-Forwarded-User"))
+  proxy_addrs <- split_list(env("BEATRINA_TRUSTED_PROXY", "127.0.0.1 ::1"))
+  allow_open <- identical(env("BEATRINA_ALLOW_UNAUTHENTICATED", ""), "1")
 
   errors <- character(0)
   if (!loopback) {
     if (!length(hosts_env)) {
       errors <- c(errors, paste0(
-        "CARMAR_BIND is ", bind, " but CARMAR_HOSTS is unset. Off loopback the ",
+        "BEATRINA_BIND is ", bind, " but BEATRINA_HOSTS is unset. Off loopback the ",
         "Host allow-list is the only defence against DNS rebinding, so it must ",
-        "name the hostname readers will use (e.g. CARMAR_HOSTS=stats.example.edu)."))
+        "name the hostname readers will use (e.g. BEATRINA_HOSTS=stats.example.edu)."))
     }
     if (!trust_proxy && !allow_open) {
       errors <- c(errors, paste0(
-        "CARMAR_BIND is ", bind, " with no authentication in front of it. Put ",
-        "CarmaR behind a reverse proxy that authenticates and set ",
-        "CARMAR_TRUST_PROXY=1, or set CARMAR_ALLOW_UNAUTHENTICATED=1 to serve R ",
+        "BEATRINA_BIND is ", bind, " with no authentication in front of it. Put ",
+        "Beatrina behind a reverse proxy that authenticates and set ",
+        "BEATRINA_TRUST_PROXY=1, or set BEATRINA_ALLOW_UNAUTHENTICATED=1 to serve R ",
         "execution to everyone who can reach this port. See docs/server.md."))
     }
     if (trust_proxy && !nzchar(user_header)) {
-      errors <- c(errors, "CARMAR_TRUST_PROXY=1 requires a non-empty CARMAR_USER_HEADER.")
+      errors <- c(errors, "BEATRINA_TRUST_PROXY=1 requires a non-empty BEATRINA_USER_HEADER.")
     }
     if (trust_proxy && !length(proxy_addrs)) {
-      errors <- c(errors, "CARMAR_TRUST_PROXY=1 requires CARMAR_TRUSTED_PROXY to name the proxy's address.")
+      errors <- c(errors, "BEATRINA_TRUST_PROXY=1 requires BEATRINA_TRUSTED_PROXY to name the proxy's address.")
     }
   }
 

package/kernel/examples/NOTICE.md

@@ -1,4 +1,4 @@
-# Test files shipped with CarmaR
+# Test files shipped with Beatrina
 
 ## tna-complete-tutorial.Rmd
 

package/kernel/fileio.R

@@ -27,7 +27,7 @@ fs_abs <- function(p, wd = getwd()) {
 }
 
 # ── the confinement root ────────────────────────────────────────────────────
-# CARMAR_ROOT restricts every FILE command — browse, read, write, import, and
+# BEATRINA_ROOT restricts every FILE command — browse, read, write, import, and
 # changing the working directory — to one subtree. It exists for managed
 # deployments where a notebook should see the project share and nothing else.
 #
@@ -41,7 +41,7 @@ fs_abs <- function(p, wd = getwd()) {
 # the operating system's job: run the kernel as a user who cannot read the
 # rest, or in a container.
 confine_root <- local({
-  raw <- Sys.getenv("CARMAR_ROOT", "")
+  raw <- Sys.getenv("BEATRINA_ROOT", "")
   if (!nzchar(raw)) NULL
   else normalizePath(path.expand(raw), mustWork = FALSE)
 })
@@ -414,7 +414,7 @@ fs_readfile <- function(id, path = NULL, wd = getwd()) {
 #' power-loss durability guarantee. The mode of an existing file is kept.
 #' Returns NULL on success or the sentence to report.
 fs_replace_atomic <- function(p, body_bytes) {
-  temp <- tempfile(pattern = ".carmar-save-", tmpdir = dirname(p))
+  temp <- tempfile(pattern = ".beatrina-save-", tmpdir = dirname(p))
   existed <- file.exists(p)
   old_mode <- if (existed) file.info(p)$mode else NULL
   cleanup_save <- function() {
@@ -439,7 +439,7 @@ fs_replace_atomic <- function(p, body_bytes) {
   if (is.character(ok)) return(fail_after_cleanup(ok))
   # Keep the existing test knob as an alias for the pre-replacement boundary.
   # The original is still at its path; a failure needs no restoration rename.
-  if (identical(Sys.getenv("CARMAR_TEST_SAVE_FAILURE", ""), "after-backup")) {
+  if (identical(Sys.getenv("BEATRINA_TEST_SAVE_FAILURE", ""), "after-backup")) {
     return(fail_after_cleanup("simulated failure before replacement"))
   }
   replaced <- tryCatch(suppressWarnings(file.rename(temp, p)), error = function(e) FALSE)
@@ -557,8 +557,8 @@ fs_writefiles_atomic <- function(id, files = NULL, wd = getwd()) {
     if (length(after_bytes) > MAX_TEXT_BYTES) return(fail(paste0(basename(p), " is too large")))
     plans[[length(plans) + 1L]] <- list(path = p, before = before, after = after, bytes = after_bytes,
       mode = file.info(p)$mode,
-      temp = tempfile(pattern = ".carmar-new-", tmpdir = dirname(p)),
-      backup = tempfile(pattern = ".carmar-old-", tmpdir = dirname(p)))
+      temp = tempfile(pattern = ".beatrina-new-", tmpdir = dirname(p)),
+      backup = tempfile(pattern = ".beatrina-old-", tmpdir = dirname(p)))
   }
 
   cleanup <- function() {

package/kernel/index.html

@@ -1,6 +1,6 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CarmaR kernel spike</title>
+<title>Beatrina kernel spike</title>
 <style>
   :root { color-scheme: light dark; }
   body { font: 14px/1.5 ui-sans-serif, system-ui, sans-serif; margin: 0; padding: 1.5rem;
@@ -25,7 +25,7 @@
   img { display: block; margin: .5rem 0; border-radius: 3px; }
 </style>
 
-<h1>CarmaR kernel spike <span id="status">connecting…</span></h1>
+<h1>Beatrina kernel spike <span id="status">connecting…</span></h1>
 
 <textarea id="src">for (i in 1:20) { cat("tick", i, "\n"); flush(stdout()); Sys.sleep(0.5) }</textarea>
 

package/kernel/job-run.R

@@ -38,6 +38,7 @@ here <- dirname(normalizePath(sub("^--file=", "", grep("^--file=", commandArgs(F
 source(file.path(here, "kernel.R"))
 source(file.path(here, "jobs.R"))
 source(file.path(here, "latex.R"))
+source(file.path(here, "typst.R"))
 compile_identity <- NULL
 
 #' Write one control frame: the session's random sentinel, then compact JSON.
@@ -59,12 +60,12 @@ emit <- function(obj) {
   invisible(NULL)
 }
 
-job_id <- Sys.getenv("CARMAR_JOB_ID", "job")
-task   <- Sys.getenv("CARMAR_JOB_TASK", "")
-root   <- Sys.getenv("CARMAR_JOB_ROOT", "")
-target <- Sys.getenv("CARMAR_JOB_TARGET", "")
-filter <- Sys.getenv("CARMAR_JOB_FILTER", "")
-format <- Sys.getenv("CARMAR_JOB_FORMAT", "")
+job_id <- Sys.getenv("BEATRINA_JOB_ID", "job")
+task   <- Sys.getenv("BEATRINA_JOB_TASK", "")
+root   <- Sys.getenv("BEATRINA_JOB_ROOT", "")
+target <- Sys.getenv("BEATRINA_JOB_TARGET", "")
+filter <- Sys.getenv("BEATRINA_JOB_FILTER", "")
+format <- Sys.getenv("BEATRINA_JOB_FORMAT", "")
 
 # The supervisor validated all of this in jobs.R before spawning. Re-checking
 # here is not redundant: this file is also runnable by hand, and a task that
@@ -82,18 +83,18 @@ if (!nzchar(root) || !dir.exists(root)) {
 }
 # A render acts on a FILE. Checking only the folder would let a task start
 # against a document that is not there and fail somewhere less legible.
-if (task %in% c("render", "latex") && (!nzchar(target) || !file.exists(target))) {
+if (task %in% c("render", "latex", "typst") && (!nzchar(target) || !file.exists(target))) {
   emit(list(type = "job", event = "done", ok = FALSE,
             error = sprintf("'%s' is not a file", target)))
   quit(status = 2L, save = "no")
 }
 if (identical(task, "latex")) {
   prepared <- tryCatch({
-    identity_text <- Sys.getenv("CARMAR_LATEX_IDENTITY", "")
+    identity_text <- Sys.getenv("BEATRINA_LATEX_IDENTITY", "")
     identity <- if (nzchar(identity_text)) jsonlite::fromJSON(identity_text, simplifyVector = FALSE) else NULL
-    spec <- job_spec(task, target, list(engine = Sys.getenv("CARMAR_LATEX_ENGINE", "auto"),
-      timeout = suppressWarnings(as.numeric(Sys.getenv("CARMAR_LATEX_TIMEOUT", as.character(LATEX_TIMEOUT)))),
-      fetch = identical(Sys.getenv("CARMAR_LATEX_FETCH", ""), "1"), identity = identity))
+    spec <- job_spec(task, target, list(engine = Sys.getenv("BEATRINA_LATEX_ENGINE", "auto"),
+      timeout = suppressWarnings(as.numeric(Sys.getenv("BEATRINA_LATEX_TIMEOUT", as.character(LATEX_TIMEOUT)))),
+      fetch = identical(Sys.getenv("BEATRINA_LATEX_FETCH", ""), "1"), identity = identity))
     if (!isTRUE(spec$ok)) stop(spec$error, call. = FALSE)
     compile_identity <- identity
     spec
@@ -229,7 +230,7 @@ run_tests <- function() {
 #' Locate a quarto binary.
 #' @return Path to quarto, or "" when there is none.
 find_quarto <- function() {
-  explicit <- Sys.getenv("CARMAR_QUARTO", "")
+  explicit <- Sys.getenv("BEATRINA_QUARTO", "")
   if (nzchar(explicit) && file.exists(explicit)) return(explicit)
   # RStudio and Positron both export this into the sessions they start.
   from_env <- Sys.getenv("QUARTO_PATH", "")
@@ -261,9 +262,11 @@ find_quarto <- function() {
 #'
 #' @param path The document.
 #' @return "quarto" or "rmarkdown".
-pick_renderer <- function(path) {
+pick_renderer <- function(path, format = "") {
   ext <- tolower(sub("^.*\\.", "", basename(path)))
   if (identical(ext, "qmd")) return("quarto")
+  # rmarkdown has no Typst writer; Quarto renders .Rmd and .md too.
+  if (identical(format, "typst")) return("quarto")
   if (requireNamespace("rmarkdown", quietly = TRUE)) "rmarkdown" else "quarto"
 }
 
@@ -287,7 +290,7 @@ run_streaming <- function(bin, args, wd = NULL, timeout = Inf, env = NULL) {
     if (!nzchar(text)) return(invisible(NULL))
     cat(text, sep = ""); flush(stdout())
     kept <<- paste0(kept, text)
-    if (nchar(kept) > 1000000L) { kept <<- substring(kept, nchar(kept) - 999999L); truncated <<- TRUE }
+    if (nchar(kept) > 1000000L) { kept <<- substring(kept, nchar(kept) - 999999L, nchar(kept)); truncated <<- TRUE }
   }
   repeat {
     proc$poll_io(100L)
@@ -316,26 +319,82 @@ run_streaming <- function(bin, args, wd = NULL, timeout = Inf, env = NULL) {
 #' puts the output beside the source and still reports it relatively. Either
 #' way the file is checked to exist before it is reported, for the same
 #' reason a test failure only offers a link to a file that is really there.
+#' The folder a document declares for R: the flat front-matter line
+#' `beatrina-workdir: data/` — the same line lib/wd-menu.js reads for the
+#' interactive session, so a chunk run in the window and the same chunk in
+#' a render start from ONE folder. Relative to the document's own folder;
+#' absolute and `~` paths as written. The document's folder when absent.
+#' Returns list(path, declared): `declared` is "" when nothing was said.
+document_workdir <- function(target) {
+  base <- dirname(target)
+  lines <- tryCatch(readLines(target, n = 200L, warn = FALSE, encoding = "UTF-8"),
+                    error = function(e) character())
+  if (!length(lines) || !identical(trimws(lines[[1L]]), "---")) return(list(path = base, declared = ""))
+  close <- which(trimws(lines[-1L]) %in% c("---", "..."))
+  if (!length(close)) return(list(path = base, declared = ""))
+  front <- lines[seq_len(close[[1L]])]
+  hit <- grep("^beatrina-workdir:", front, value = TRUE)
+  if (!length(hit)) return(list(path = base, declared = ""))
+  value <- trimws(sub("^beatrina-workdir:", "", hit[[1L]]))
+  value <- trimws(sub("[ \t]+#.*$", "", value))
+  value <- gsub("^[\"']|[\"']$", "", value)
+  if (!nzchar(value)) return(list(path = base, declared = ""))
+  path <- if (grepl("^(/|~|[A-Za-z]:[\\\\/]|\\\\\\\\)", value)) path.expand(value)
+          else normalizePath(file.path(base, value), mustWork = FALSE)
+  list(path = path, declared = value)
+}
+
+#' The name rmarkdown knows a format by. The job's vocabulary is the short one
+#' Quarto speaks (`html`, `pdf`, `docx`, `latex`); rmarkdown::render() evaluates
+#' a bare `html` as an R object and fails with "object 'html' not found" — so
+#' until 2026-09-19 choosing a format for an .Rmd could not work at all.
+#' @param format A RENDER_FORMATS entry; "" lets the document's YAML decide.
+#' @return A format name, or NULL for the document's own.
+rmarkdown_format <- function(format) {
+  if (!nzchar(format)) return(NULL)
+  switch(format,
+    html = "html_document", pdf = "pdf_document", docx = "word_document",
+    latex = "latex_document",
+    stop(sprintf("rmarkdown cannot render to '%s'", format), call. = FALSE))
+}
+
 render_document <- function() {
-  renderer <- pick_renderer(target)
+  renderer <- pick_renderer(target, format)
   produced <- NA_character_
+  # Where the code runs: the document's declared folder, else its own. Said
+  # when the declaration names a folder that is not there — a render that
+  # quietly ran somewhere else would make every relative path a mystery.
+  workdir <- document_workdir(target)
+  if (nzchar(workdir$declared) && !dir.exists(workdir$path)) {
+    stop(sprintf("the document declares beatrina-workdir: %s, but '%s' is not a folder",
+                 workdir$declared, workdir$path), call. = FALSE)
+  }
 
   if (identical(renderer, "rmarkdown")) {
     need("rmarkdown")
     out <- rmarkdown::render(
       target,
-      output_format = if (nzchar(format)) format else NULL,
-      knit_root_dir = dirname(target)
+      output_format = rmarkdown_format(format),
+      knit_root_dir = workdir$path
     )
     if (length(out) >= 1L && nzchar(out[[1L]])) produced <- out[[1L]]
   } else {
     bin <- find_quarto()
     if (!nzchar(bin)) {
-      stop("Quarto is not installed, or CarmaR could not find it. Install Quarto, ",
-           "or set CARMAR_QUARTO to the binary.", call. = FALSE)
+      stop("Quarto is not installed, or Beatrina could not find it. Install Quarto, ",
+           "or set BEATRINA_QUARTO to the binary.", call. = FALSE)
     }
     args <- c("render", target)
     if (nzchar(format)) args <- c(args, "--to", format)
+    # Typst figures default to SVG, which knitr draws through cairo — and a
+    # Mac without XQuartz has no cairo, so the render failed at the first plot
+    # (measured, 2026-09-19). PNG needs nothing; keep-typ leaves the .typ
+    # source beside the PDF, which is what someone editing the paper wants.
+    if (identical(format, "typst")) args <- c(args, "-M", "fig-format:png", "-M", "keep-typ:true")
+    # Quarto's own execution directory, only when the document asked: its
+    # default (the document's folder, or the project's when the project says
+    # so) stays Quarto's decision for a document that said nothing.
+    if (nzchar(workdir$declared)) args <- c(args, "--execute-dir", workdir$path)
     result <- run_streaming(bin, args)
     if (!identical(as.integer(result$status), 0L)) {
       stop(sprintf("quarto render exited %s", result$status), call. = FALSE)
@@ -374,9 +433,11 @@ outcome <- tryCatch({
     build    = { need("devtools"); devtools::build(root); NULL },
     install  = { need("devtools"); devtools::install(root, quick = TRUE, upgrade = "never"); NULL },
     render   = render_document(),
-    latex    = latex_compile(target, prepared$env[["CARMAR_LATEX_ENGINE"]],
-      as.numeric(prepared$env[["CARMAR_LATEX_TIMEOUT"]]), job_id, run_streaming, emit,
-      fetch = identical(prepared$env[["CARMAR_LATEX_FETCH"]], "1"))
+    typst    = typst_compile(target, suppressWarnings(as.numeric(Sys.getenv("BEATRINA_TYPST_TIMEOUT", as.character(TYPST_TIMEOUT)))),
+      run_streaming, emit, pages = identical(Sys.getenv("BEATRINA_TYPST_PAGES", ""), "svg")),
+    latex    = latex_compile(target, prepared$env[["BEATRINA_LATEX_ENGINE"]],
+      as.numeric(prepared$env[["BEATRINA_LATEX_TIMEOUT"]]), job_id, run_streaming, emit,
+      fetch = identical(prepared$env[["BEATRINA_LATEX_FETCH"]], "1"))
   )
   list(ok = TRUE, error = "")
 }, error = function(e) {

package/kernel/jobs.R

@@ -125,7 +125,10 @@ JOB_TASKS <- list(
   build    = list(label = "Build",    running = "Building",    target = "package",  pkg = "devtools"),
   install  = list(label = "Install",  running = "Installing",  target = "package",  pkg = "devtools"),
   render   = list(label = "Render",   running = "Rendering",   target = "document", pkg = NA_character_),
-  latex    = list(label = "Compile",  running = "Compiling",   target = "document", pkg = NA_character_)
+  latex    = list(label = "Compile",  running = "Compiling",   target = "document", pkg = NA_character_),
+  # Typst: one document in, one PDF out — the same shape as latex, a different
+  # compiler (Quarto bundles it; nothing to install).
+  typst    = list(label = "Compile",  running = "Compiling",   target = "document", pkg = NA_character_)
 )
 
 #' Documents this kernel will render. Lower-cased extension, no dot.
@@ -140,7 +143,7 @@ RENDER_EXTENSIONS <- c("qmd", "rmd", "md")
 # decides. A document whose header says `format: revealjs` must render as
 # revealjs when the reader presses Render without choosing anything —
 # defaulting to html would silently overrule the file.
-RENDER_FORMATS <- c("", "html", "pdf", "docx")
+RENDER_FORMATS <- c("", "html", "pdf", "docx", "latex", "typst")
 
 #' Is this a single, plain, non-empty string? Mirrors serve.R's scalar_chr —
 #' R's coercion rules are exactly permissive enough to turn a JSON array into
@@ -167,7 +170,7 @@ path_extension <- function(path) {
 #' Decide whether one task may run, and exactly what would run.
 #'
 #' The whole decision in one pure function, returning it whole — the same
-#' shape as `carmar_deployment()`, and for the same reason: three callers
+#' shape as `beatrina_deployment()`, and for the same reason: three callers
 #' (the supervisor, the tests, the UI's error message) must not each
 #' re-derive it and drift.
 #'
@@ -178,7 +181,7 @@ path_extension <- function(path) {
 #' @param task Task name from the wire.
 #' @param target Directory or file from the wire.
 #' @param opts Named list of extras from the wire: `filter` (test), `format`
-#'   (render). Unknown members are ignored rather than refused — a page one
+#'   (render), `pages` (typst). Unknown members are ignored rather than refused — a page one
 #'   version ahead must not be an error.
 #' @return list(ok, error, task, target, root, label, package, env) — `env` is
 #'   the named character vector of environment variables for the child, and is
@@ -214,9 +217,9 @@ job_spec <- function(task, target, opts = list()) {
     }
     target <- tryCatch(normalizePath(target, mustWork = TRUE), error = function(e) target)
     ext <- path_extension(target)
-    extensions <- if (identical(task, "latex")) "tex" else RENDER_EXTENSIONS
+    extensions <- if (identical(task, "latex")) "tex" else if (identical(task, "typst")) "typ" else RENDER_EXTENSIONS
     if (!ext %in% extensions) {
-      return(bad(sprintf("CarmaR renders %s files; '%s' is a .%s",
+      return(bad(sprintf("Beatrina renders %s files; '%s' is a .%s",
                          paste0(".", extensions, collapse = ", "), basename(target),
                          if (nzchar(ext)) ext else "(no extension)")))
     }
@@ -234,6 +237,18 @@ job_spec <- function(task, target, opts = list()) {
   if (nzchar(format) && !identical(task, "render")) {
     return(bad("a format only applies to the render task"))
   }
+  # `pages` asks Typst for one SVG per page instead of a PDF: what the live
+  # preview draws, so it can keep the reader's place across a rebuild
+  # (lib/doc-preview.js). Strict like `fetch` — exactly TRUE, never arrived at
+  # by coercion — and it means nothing to any other task.
+  pages <- isTRUE(opts$pages)
+  if (pages && !identical(task, "typst")) return(bad("pages only apply to the typst task"))
+  # …and only INSIDE the preview's own hidden folder: a pages compile deletes the
+  # last compile's `<stem>-N.svg` first, and that must never be aimed at a folder
+  # of somebody's own files. (The twin of host/planes/jobs.mjs.)
+  if (pages && !identical(basename(dirname(target)), ".beatrina-preview")) {
+    return(bad("pages are compiled only in a document's .beatrina-preview folder"))
+  }
   if (!format %in% RENDER_FORMATS) {
     return(bad(sprintf("'%s' is not a format this kernel renders (%s)",
                        format, paste(setdiff(RENDER_FORMATS, ""), collapse = ", "))))
@@ -245,9 +260,10 @@ job_spec <- function(task, target, opts = list()) {
     label = spec$label, running = spec$running, targets = spec$target,
     package = if (identical(spec$target, "package")) package_name(root) else "",
     needs = spec$pkg,
-    env = c(CARMAR_JOB_TASK = task, CARMAR_JOB_TARGET = target,
-            CARMAR_JOB_ROOT = root, CARMAR_JOB_FILTER = filter,
-            CARMAR_JOB_FORMAT = format, latex_env)
+    env = c(BEATRINA_JOB_TASK = task, BEATRINA_JOB_TARGET = target,
+            BEATRINA_JOB_ROOT = root, BEATRINA_JOB_FILTER = filter,
+            BEATRINA_JOB_FORMAT = format,
+            BEATRINA_TYPST_PAGES = if (pages) "svg" else "", latex_env)
   )
 }
 
@@ -260,14 +276,14 @@ job_spec <- function(task, target, opts = list()) {
 #' @param spec A successful `job_spec()`.
 #' @return One line of text.
 job_title <- function(spec) {
-  if (identical(spec$task, "latex")) return(sprintf("Compiling %s", basename(spec$target)))
+  if (identical(spec$task, "latex") || identical(spec$task, "typst")) return(sprintf("Compiling %s", basename(spec$target)))
   if (identical(spec$targets, "document")) {
-    format <- spec$env[["CARMAR_JOB_FORMAT"]]
+    format <- spec$env[["BEATRINA_JOB_FORMAT"]]
     return(sprintf("Rendering %s%s", basename(spec$target),
                    if (nzchar(format)) paste0(" to ", format) else ""))
   }
   name <- if (nzchar(spec$package)) spec$package else basename(spec$root)
-  filter <- spec$env[["CARMAR_JOB_FILTER"]]
+  filter <- spec$env[["BEATRINA_JOB_FILTER"]]
   if (identical(spec$task, "test") && nzchar(filter)) {
     sprintf("%s %s — tests matching '%s'", spec$running, name, filter)
   } else {

package/kernel/kernel-version

@@ -1 +1 @@
-0.8.7
+0.9.43