@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/voice/wake-word.js

@@ -6,6 +6,7 @@
  */
 import { EventEmitter } from 'events';
 import { DEFAULT_WAKE_WORD_CONFIG } from './types.js';
+import { logger } from '../utils/logger.js';
 /**
  * Built-in Porcupine keyword mapping.
  * Maps friendly wake word names to Porcupine built-in keyword identifiers.
@@ -39,6 +40,7 @@ export class WakeWordDetector extends EventEmitter {
     lastDetection = null;
     cooldownMs = 1000;
     keywordLabels = [];
+    porcupineBuffer = Buffer.alloc(0);
     constructor(config = {}) {
         super();
         this.config = { ...DEFAULT_WAKE_WORD_CONFIG, ...config };
@@ -51,7 +53,7 @@ export class WakeWordDetector extends EventEmitter {
         if (requestedEngine === 'text-match' || !accessKey) {
             this.engine = 'text-match';
             if (!accessKey && requestedEngine !== 'text-match') {
-                console.warn('[WakeWord] No PICOVOICE_ACCESS_KEY found, falling back to text-match mode');
+                logger.warn('[WakeWord] No PICOVOICE_ACCESS_KEY found, falling back to text-match mode');
             }
         }
         else {
@@ -61,7 +63,7 @@ export class WakeWordDetector extends EventEmitter {
             }
             catch (error) {
                 const msg = error instanceof Error ? error.message : String(error);
-                console.warn(`[WakeWord] Porcupine init failed (${msg}), falling back to text-match mode`);
+                logger.warn(`[WakeWord] Porcupine init failed (${msg}), falling back to text-match mode`);
                 this.engine = 'text-match';
             }
         }
@@ -108,6 +110,7 @@ export class WakeWordDetector extends EventEmitter {
             this.porcupine.release();
             this.porcupine = null;
         }
+        this.porcupineBuffer = Buffer.alloc(0);
         this.emit('stopped');
     }
     processFrame(frame) {
@@ -118,23 +121,40 @@ export class WakeWordDetector extends EventEmitter {
             return null;
         }
         if (this.engine === 'porcupine' && this.porcupine) {
-            return this.processPorcupineFrame(frame);
+            return this.processPorcupineInput(frame);
         }
         // text-match mode: no-op for raw audio frames
         // Text matching is handled via detectWakeWordText()
         return null;
     }
-    processPorcupineFrame(frame) {
+    processPorcupineInput(frame) {
         if (!this.porcupine)
             return null;
-        let int16Frame;
         if (frame instanceof Int16Array) {
-            int16Frame = frame;
+            for (let offset = 0; offset + this.porcupine.frameLength <= frame.length; offset += this.porcupine.frameLength) {
+                const detection = this.processPorcupineFrame(frame.subarray(offset, offset + this.porcupine.frameLength));
+                if (detection)
+                    return detection;
+            }
+            return null;
         }
-        else {
-            // Convert Buffer to Int16Array
-            int16Frame = new Int16Array(frame.buffer, frame.byteOffset, frame.length / 2);
+        const frameBytes = this.porcupine.frameLength * 2;
+        this.porcupineBuffer = Buffer.concat([this.porcupineBuffer, frame]);
+        while (this.porcupineBuffer.length >= frameBytes) {
+            const chunk = this.porcupineBuffer.subarray(0, frameBytes);
+            this.porcupineBuffer = this.porcupineBuffer.subarray(frameBytes);
+            const int16Frame = new Int16Array(chunk.buffer, chunk.byteOffset, this.porcupine.frameLength);
+            const detection = this.processPorcupineFrame(int16Frame);
+            if (detection)
+                return detection;
         }
+        return null;
+    }
+    processPorcupineFrame(int16Frame) {
+        if (!this.porcupine)
+            return null;
+        if (int16Frame.length !== this.porcupine.frameLength)
+            return null;
         const keywordIndex = this.porcupine.process(int16Frame);
         if (keywordIndex >= 0) {
             const detection = {
@@ -235,7 +255,7 @@ export class WakeWordDetector extends EventEmitter {
      * Clear audio buffer (no-op, kept for API compatibility)
      */
     clearBuffer() {
-        // Porcupine processes frames individually, no buffer to clear
+        this.porcupineBuffer = Buffer.alloc(0);
     }
 }
 /**

package/dist/webhooks/webhook-manager.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'crypto';
 import { createHmac, timingSafeEqual } from 'crypto';
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
-import { join, dirname } from 'path';
+import { join } from 'path';
+import { readJsonAtomicSync, writeJsonAtomicSync } from '../utils/atomic-write.js';
 export class WebhookManager {
     webhooks = new Map();
     configPath;
@@ -126,27 +126,19 @@ export class WebhookManager {
         });
     }
     load() {
-        try {
-            if (existsSync(this.configPath)) {
-                const data = JSON.parse(readFileSync(this.configPath, 'utf-8'));
-                if (Array.isArray(data)) {
-                    for (const hook of data) {
-                        this.webhooks.set(hook.id, hook);
-                    }
-                }
+        const data = readJsonAtomicSync(this.configPath, [], {
+            mode: 0o600,
+            isValid: (value) => Array.isArray(value),
+        });
+        for (const hook of data) {
+            if (hook && typeof hook.id === 'string') {
+                this.webhooks.set(hook.id, hook);
             }
         }
-        catch {
-            // Start with empty webhooks on load failure
-        }
     }
     save() {
         try {
-            const dir = dirname(this.configPath);
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true });
-            }
-            writeFileSync(this.configPath, JSON.stringify(this.list(), null, 2));
+            writeJsonAtomicSync(this.configPath, this.list(), { mode: 0o600 });
         }
         catch {
             // Silently fail on save errors

package/dist/widgets/auto-widget.d.ts

@@ -0,0 +1,27 @@
+import { type ResolveOrGenerateDeps } from './widget-engine.js';
+import { type WidgetTheme } from './widget-registry.js';
+import { type WidgetCandidate } from './widget-matcher.js';
+import type { AuthoredWidget } from './widget-types.js';
+export interface AutoWidgetResult {
+    /** Always byte-identical to the input answer. */
+    answer: string;
+    /** Full server-rendered CSP document for the inline renderer, or null. */
+    widgetHtml: string | null;
+    /** The single selected candidate, or null when disabled/not widgetable. */
+    candidate: WidgetCandidate | null;
+}
+export interface AutoWidgetDeps {
+    env?: NodeJS.ProcessEnv;
+    theme?: WidgetTheme;
+    registry?: readonly AuthoredWidget[];
+    renderAuthored?: (widget: AuthoredWidget, data: unknown, theme?: WidgetTheme) => string | null;
+    renderCurated?: (data: unknown, env: NodeJS.ProcessEnv, theme?: WidgetTheme) => string | null;
+    generate?: (data: unknown, deps: ResolveOrGenerateDeps) => Promise<string | null>;
+    propose?: ResolveOrGenerateDeps['propose'];
+    now?: () => number;
+}
+/**
+ * Detect and render at most one automatic widget. All failures are fail-open:
+ * callers always receive the exact original answer and no exception.
+ */
+export declare function autoWidget(answer: string, payloads?: readonly unknown[], deps?: AutoWidgetDeps): Promise<AutoWidgetResult>;

package/dist/widgets/auto-widget.js

@@ -0,0 +1,111 @@
+/**
+ * Opt-in answer → widget pipeline. The answer text is never modified; callers
+ * may display the optional server-rendered HTML beside it using their existing
+ * inline widget surface.
+ *
+ * @module widgets/auto-widget
+ */
+import { logger } from '../utils/logger.js';
+import { listAuthoredWidgetRegistry, recordAuthoredWidgetUse, renderAuthoredWidgetForData, renderWidgetDocument, renderWidgetForData, resolveWidgetSource, } from './widget-registry.js';
+import { detectWidgetable, matchAuthoredWidget } from './widget-matcher.js';
+function enabled(env) {
+    return env.CODEBUDDY_WIDGETS === 'true' && env.CODEBUDDY_WIDGETS_AUTO === 'true';
+}
+function safeResult(answer, candidate = null) {
+    return { answer, widgetHtml: null, candidate };
+}
+function scriptFree(html) {
+    return typeof html === 'string' && html.trim().length > 0 && !/<\s*script\b/i.test(html);
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/gu, (character) => ({
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+    })[character] ?? character);
+}
+function renderMarkdownTableWidget(candidate, theme) {
+    const header = candidate.data.headers
+        .map((cell) => `<th scope="col">${escapeHtml(cell.label)}</th>`)
+        .join('');
+    const rows = candidate.data.rows
+        .map((row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell.value)}</td>`).join('')}</tr>`)
+        .join('');
+    const fragment = '<style>table{border-collapse:collapse;width:100%;font:14px system-ui,sans-serif}' +
+        'th,td{border:1px solid #cbd5e1;padding:7px 9px;text-align:left}' +
+        'th{background:#e2e8f0;font-weight:700}td{background:#fff}' +
+        'caption{text-align:left;font-weight:700;margin-bottom:8px}</style>' +
+        `<table><caption>Réponse structurée</caption><thead><tr>${header}</tr></thead><tbody>${rows}</tbody></table>`;
+    return renderWidgetDocument(fragment, theme);
+}
+function renderStructuredPayloadWidget(candidate, theme) {
+    const record = candidate.data && typeof candidate.data === 'object' && !Array.isArray(candidate.data)
+        ? candidate.data
+        : { value: candidate.data };
+    const rows = Object.entries(record)
+        .map(([key, value]) => `<tr><th scope="row">${escapeHtml(key)}</th><td>${escapeHtml(String(value))}</td></tr>`)
+        .join('');
+    const fragment = '<style>table{border-collapse:collapse;width:100%;font:14px system-ui,sans-serif}' +
+        'th,td{border:1px solid #cbd5e1;padding:7px 9px;text-align:left}' +
+        'th{background:#e2e8f0;font-weight:700}td{background:#fff}' +
+        `caption{text-align:left;font-weight:700;margin-bottom:8px}</style>` +
+        `<table><caption>${escapeHtml(candidate.dataType)}</caption><tbody>${rows}</tbody></table>`;
+    return renderWidgetDocument(fragment, theme);
+}
+/**
+ * Detect and render at most one automatic widget. All failures are fail-open:
+ * callers always receive the exact original answer and no exception.
+ */
+export async function autoWidget(answer, payloads = [], deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!enabled(env))
+        return safeResult(answer);
+    let candidate = null;
+    try {
+        candidate = detectWidgetable(answer, payloads);
+        if (!candidate)
+            return safeResult(answer);
+        const registry = deps.registry ?? listAuthoredWidgetRegistry(env);
+        const authored = matchAuthoredWidget(candidate.dataType, registry);
+        if (authored) {
+            const render = deps.renderAuthored ?? renderAuthoredWidgetForData;
+            const html = render(authored, candidate.data, deps.theme);
+            if (!scriptFree(html)) {
+                logger.debug('[auto-widget] authored render returned no safe HTML', {
+                    dataType: candidate.dataType,
+                    widget: authored.kind,
+                });
+                return safeResult(answer, candidate);
+            }
+            recordAuthoredWidgetUse(authored.kind, env, deps.now?.() ?? Date.now());
+            return { answer, widgetHtml: html, candidate };
+        }
+        // Curated rendering remains authoritative for its built-in discriminator.
+        if (resolveWidgetSource(candidate.dataType, env) === 'curated') {
+            const render = deps.renderCurated ?? renderWidgetForData;
+            const html = render(candidate.data, env, deps.theme);
+            return scriptFree(html) ? { answer, widgetHtml: html, candidate } : safeResult(answer, candidate);
+        }
+        // A legacy same-kind file is renderable explicitly, but without dataTypes it
+        // must never enter the automatic path (including through resolveOrGenerate).
+        if (resolveWidgetSource(candidate.dataType, env) === 'authored') {
+            return safeResult(answer, candidate);
+        }
+        // Structured kinds (tables and typed payloads) have deterministic renderers;
+        // the automatic answer path never needs to invoke an LLM.
+        if (candidate.kind === 'table') {
+            return { answer, widgetHtml: renderMarkdownTableWidget(candidate, deps.theme), candidate };
+        }
+        return { answer, widgetHtml: renderStructuredPayloadWidget(candidate, deps.theme), candidate };
+    }
+    catch (error) {
+        logger.debug('[auto-widget] pipeline failed; preserving text response', {
+            dataType: candidate?.dataType,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return safeResult(answer, candidate);
+    }
+}
+//# sourceMappingURL=auto-widget.js.map

package/dist/widgets/canvas-publish.d.ts

@@ -0,0 +1,15 @@
+import { type AutoWidgetDeps, type AutoWidgetResult } from './auto-widget.js';
+export interface PublishedWidget extends AutoWidgetResult {
+    canvasId: string | null;
+    canvasPath: string | null;
+}
+/**
+ * Detect + render at most one widget and, if HTML exists, publish it to canvas.
+ * Callers must not claim a render when canvasId is null.
+ */
+export declare function publishAnswerWidget(answer: string, payloads?: readonly unknown[], deps?: AutoWidgetDeps): Promise<PublishedWidget>;
+/** Convenience for a single tool result (`data:{type}` payload). */
+export declare function publishToolResultWidget(result: {
+    output?: string;
+    data?: unknown;
+}, deps?: AutoWidgetDeps): Promise<PublishedWidget>;

package/dist/widgets/canvas-publish.js

@@ -0,0 +1,39 @@
+/**
+ * Push an auto-rendered widget onto the in-process canvas store.
+ * Opt-in via CODEBUDDY_WIDGETS + CODEBUDDY_WIDGETS_AUTO (autoWidget gate).
+ * Never throws; a missing/unsafe widget leaves the canvas untouched.
+ *
+ * @module widgets/canvas-publish
+ */
+import { canvasStore } from '../server/routes/canvas.js';
+import { autoWidget } from './auto-widget.js';
+function unpublished(widget) {
+    return { ...widget, canvasId: null, canvasPath: null };
+}
+/**
+ * Detect + render at most one widget and, if HTML exists, publish it to canvas.
+ * Callers must not claim a render when canvasId is null.
+ */
+export async function publishAnswerWidget(answer, payloads = [], deps = {}) {
+    try {
+        const widget = await autoWidget(answer, payloads, deps);
+        if (!widget.widgetHtml)
+            return unpublished(widget);
+        const snapshot = canvasStore.push(widget.widgetHtml, undefined, undefined, {
+            dataType: widget.candidate?.dataType,
+        });
+        return {
+            ...widget,
+            canvasId: snapshot.id,
+            canvasPath: `/__codebuddy__/canvas/${snapshot.id}`,
+        };
+    }
+    catch {
+        return unpublished({ answer, widgetHtml: null, candidate: null });
+    }
+}
+/** Convenience for a single tool result (`data:{type}` payload). */
+export async function publishToolResultWidget(result, deps = {}) {
+    return publishAnswerWidget(result.output ?? '', [result], deps);
+}
+//# sourceMappingURL=canvas-publish.js.map

package/dist/widgets/curated/news.d.ts

@@ -0,0 +1,2 @@
+/** Render a news payload to a self-contained HTML fragment (no script). */
+export declare function renderNewsWidget(raw: unknown): string;

package/dist/widgets/curated/news.js

@@ -0,0 +1,46 @@
+import { sanitizeURL } from '../../utils/sanitize.js';
+function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"]/g, (m) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[m]);
+}
+/** An http(s) URL, or null (drops javascript:/data:/relative/garbage). never throws. */
+function safeUrl(u) {
+    if (typeof u !== 'string' || !u.trim())
+        return null;
+    try {
+        return sanitizeURL(u, ['http', 'https']);
+    }
+    catch {
+        return null;
+    }
+}
+const STYLE = `<style>
+.cbw-news{font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;border-radius:16px;padding:16px 18px;color:#0b1220;background:#fff;border:1px solid rgba(0,0,0,.08);max-width:520px}
+.cbw-news .h{font-size:14px;font-weight:700;margin-bottom:10px}
+.cbw-news ul{list-style:none;margin:0;padding:0}
+.cbw-news li{padding:9px 0;border-top:1px solid rgba(0,0,0,.06);font-size:14px;line-height:1.35}
+.cbw-news li:first-child{border-top:none}
+.cbw-news .src{display:block;font-size:11px;opacity:.55;margin-top:2px}
+.cbw-news a{color:inherit;text-decoration:none}
+.cbw-news a:hover{text-decoration:underline}
+:root[data-cbw-theme="dark"] .cbw-news{color:#e8eefc;background:#0f1626;border-color:rgba(255,255,255,.08)}
+:root[data-cbw-theme="dark"] .cbw-news li{border-color:rgba(255,255,255,.08)}
+</style>`;
+/** Render a news payload to a self-contained HTML fragment (no script). */
+export function renderNewsWidget(raw) {
+    const d = (raw ?? {});
+    const items = Array.isArray(d.items) ? d.items.slice(0, 8) : [];
+    const body = items.length
+        ? `<ul>${items
+            .map((it) => {
+            const title = esc(it.title ?? '');
+            const url = safeUrl(it.url);
+            const inner = url
+                ? `<a href="${esc(url)}" target="_blank" rel="noopener noreferrer">${title}</a>`
+                : title;
+            return `<li>${inner}${it.source ? `<span class="src">${esc(it.source)}</span>` : ''}</li>`;
+        })
+            .join('')}</ul>`
+        : `<div style="opacity:.6;font-size:13px">Pas d'actualité disponible.</div>`;
+    return `${STYLE}<div class="cbw-news"><div class="h">📰 ${esc(d.title ?? 'Actualités du jour')}</div>${body}</div>`;
+}
+//# sourceMappingURL=news.js.map

package/dist/widgets/curated/stock.d.ts

@@ -0,0 +1 @@
+export declare function renderStockWidget(raw: unknown): string;

package/dist/widgets/curated/stock.js

@@ -0,0 +1,87 @@
+function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"]/g, (m) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[m]);
+}
+function num(v) {
+    if (typeof v === 'number' && Number.isFinite(v))
+        return v;
+    if (typeof v !== 'string')
+        return null;
+    const normalized = v.trim().replace(/\s/g, '').replace('%', '').replace(',', '.');
+    if (!normalized)
+        return null;
+    const parsed = Number(normalized);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function fmt(v, digits = 2) {
+    return v == null ? '—' : new Intl.NumberFormat('fr-FR', { maximumFractionDigits: digits, minimumFractionDigits: digits }).format(v);
+}
+function fmtCompact(v) {
+    return v == null ? '—' : new Intl.NumberFormat('fr-FR', { notation: 'compact', maximumFractionDigits: 1 }).format(v);
+}
+function trendLabel(pct, change) {
+    const v = pct ?? change;
+    if (v == null || v === 0)
+        return 'Stable';
+    return v > 0 ? 'Hausse' : 'Baisse';
+}
+const STYLE = `<style>
+.cbw-stock{font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;border-radius:18px;padding:16px 18px;color:#0b1220;background:radial-gradient(circle at top right,rgba(16,185,129,.18),transparent 34%),linear-gradient(135deg,#fff7ed 0%,#fff 100%);border:1px solid rgba(0,0,0,.07);box-shadow:0 12px 32px rgba(15,23,42,.08);max-width:460px;min-width:300px}
+.cbw-stock .top{display:flex;align-items:flex-start;justify-content:space-between;gap:16px}
+.cbw-stock .status{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;opacity:.5;margin-bottom:8px}
+.cbw-stock .label{font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;opacity:.52}
+.cbw-stock .name{margin-top:4px;font-size:17px;font-weight:800;line-height:1.15}
+.cbw-stock .symbol{font-size:12px;opacity:.6;margin-top:3px}
+.cbw-stock .price{margin-top:14px;font-size:40px;font-weight:850;line-height:1;letter-spacing:-.04em}
+.cbw-stock .currency{font-size:15px;font-weight:700;opacity:.62;margin-left:5px}
+.cbw-stock .move{display:flex;align-items:center;gap:8px;margin-top:10px;flex-wrap:wrap}
+.cbw-stock .pill{border-radius:999px;padding:7px 10px;font-size:13px;font-weight:800;white-space:nowrap;background:rgba(16,185,129,.14);color:#047857}
+.cbw-stock .pill.neg{background:rgba(239,68,68,.13);color:#b91c1c}
+.cbw-stock .abs{font-size:13px;font-weight:700;opacity:.68}
+.cbw-stock .bar{height:6px;border-radius:999px;background:rgba(15,23,42,.1);overflow:hidden;margin-top:14px}
+.cbw-stock .bar span{display:block;height:100%;width:var(--w);background:linear-gradient(90deg,#10b981,#34d399);border-radius:inherit}
+.cbw-stock .bar.neg span{background:linear-gradient(90deg,#ef4444,#fb7185)}
+.cbw-stock .grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(88px,1fr));gap:8px;margin-top:14px}
+.cbw-stock .cell{border-radius:12px;background:rgba(255,255,255,.58);padding:8px 9px;border:1px solid rgba(15,23,42,.06)}
+.cbw-stock .k{display:block;font-size:10px;font-weight:750;letter-spacing:.06em;text-transform:uppercase;opacity:.5}
+.cbw-stock .v{display:block;margin-top:2px;font-size:13px;font-weight:800}
+.cbw-stock .meta{margin-top:12px;display:flex;gap:10px;flex-wrap:wrap;font-size:12px;opacity:.62}
+:root[data-cbw-theme="dark"] .cbw-stock{color:#e8eefc;background:radial-gradient(circle at top right,rgba(16,185,129,.16),transparent 34%),linear-gradient(135deg,#221609 0%,#0f1626 100%);border-color:rgba(255,255,255,.08);box-shadow:none}
+:root[data-cbw-theme="dark"] .cbw-stock .cell{background:rgba(255,255,255,.055);border-color:rgba(255,255,255,.07)}
+:root[data-cbw-theme="dark"] .cbw-stock .bar{background:rgba(255,255,255,.1)}
+:root[data-cbw-theme="dark"] .cbw-stock .pill{background:rgba(16,185,129,.18);color:#6ee7b7}
+:root[data-cbw-theme="dark"] .cbw-stock .pill.neg{background:rgba(239,68,68,.18);color:#fca5a5}
+</style>`;
+export function renderStockWidget(raw) {
+    const d = (raw ?? {});
+    const price = num(d.price) ?? num(d.value);
+    const change = num(d.change);
+    const pct = num(d.changePercent);
+    const open = num(d.open);
+    const high = num(d.high);
+    const low = num(d.low);
+    const volume = num(d.volume);
+    const previousClose = num(d.previousClose);
+    const neg = (pct ?? change ?? 0) < 0;
+    const sign = neg ? '' : '+';
+    // An index (market/bourse kind, or a recognized index) is quoted in points
+    // unless an explicit currency is given.
+    const isIndex = d.type === 'market' || d.type === 'bourse' || d.symbol === 'PX1' || d.name === 'CAC 40';
+    const currency = d.currency ?? (isIndex ? 'pts' : '');
+    const title = d.name ?? d.symbol ?? 'Cours de bourse';
+    const pill = pct != null ? `${sign}${fmt(pct)}%` : change != null ? `${sign}${fmt(change)}` : '—';
+    const abs = change != null ? `${sign}${fmt(change)}${currency ? ` ${currency}` : ''}` : '';
+    const width = `${Math.min(100, Math.max(8, Math.abs(pct ?? 0) * 14))}%`;
+    const status = trendLabel(pct, change);
+    return (STYLE +
+        `<div class="cbw-stock"><div class="status">${esc(status)}</div><div class="top"><div>` +
+        `<div class="label">Bourse</div><div class="name">${esc(title)}</div>` +
+        (d.symbol ? `<div class="symbol">${esc(d.symbol)}</div>` : '') +
+        `</div><div class="pill ${neg ? 'neg' : ''}">${esc(pill)}</div></div>` +
+        `<div class="price">${esc(fmt(price))}${currency ? `<span class="currency">${esc(currency)}</span>` : ''}</div>` +
+        `<div class="move">${abs ? `<span class="abs">${esc(abs)}</span>` : ''}</div>` +
+        `<div class="bar ${neg ? 'neg' : ''}"><span style="--w:${esc(width)}"></span></div>` +
+        `<div class="grid"><div class="cell"><span class="k">Ouverture</span><span class="v">${esc(fmt(open))}</span></div><div class="cell"><span class="k">+ Haut</span><span class="v">${esc(fmt(high))}</span></div><div class="cell"><span class="k">+ Bas</span><span class="v">${esc(fmt(low))}</span></div>${previousClose != null ? `<div class="cell"><span class="k">Clôture veille</span><span class="v">${esc(fmt(previousClose))}</span></div>` : ''}</div>` +
+        `<div class="meta">${d.market ? `<span>${esc(d.market)}</span>` : ''}${volume != null ? `<span>· Vol. ${esc(fmtCompact(volume))}</span>` : ''}${d.time ? `<span>· ${esc(d.time)}</span>` : ''}</div>` +
+        `</div>`);
+}
+//# sourceMappingURL=stock.js.map

package/dist/widgets/curated/weather.d.ts

@@ -0,0 +1,2 @@
+/** Render a weather payload to a self-contained HTML fragment (no script). */
+export declare function renderWeatherWidget(raw: unknown): string;

package/dist/widgets/curated/weather.js

@@ -0,0 +1,93 @@
+function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"]/g, (m) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[m]);
+}
+const WEEKDAYS = ['dim', 'lun', 'mar', 'mer', 'jeu', 'ven', 'sam'];
+/** Short weekday label from a `day` string or an ISO `date` (YYYY-MM-DD). */
+function dayLabel(raw) {
+    if (typeof raw.day === 'string' && raw.day.trim())
+        return raw.day.trim();
+    const d = raw.date;
+    if (typeof d === 'string' && /^\d{4}-\d{2}-\d{2}/.test(d)) {
+        const parsed = new Date(d + (d.length === 10 ? 'T00:00:00' : ''));
+        const wd = parsed.getDay();
+        if (!Number.isNaN(wd))
+            return WEEKDAYS[wd];
+    }
+    return typeof d === 'string' ? d.slice(5) : '';
+}
+/** First finite number among the given candidates (tolerates min/max vs low/high). */
+function num(...candidates) {
+    for (const c of candidates)
+        if (typeof c === 'number' && Number.isFinite(c))
+            return c;
+    return null;
+}
+function emoji(cond) {
+    const c = String(cond ?? '').toLowerCase();
+    if (/orage|thunder|storm/.test(c))
+        return '⛈️';
+    if (/neige|snow/.test(c))
+        return '🌨️';
+    if (/pluie|rain|averse|drizzle|bruine/.test(c))
+        return '🌧️';
+    if (/brou|fog|mist|brume/.test(c))
+        return '🌫️';
+    if (/nuag|cloud|couvert|overcast/.test(c))
+        return '☁️';
+    if (/eclair|éclair|partiel|partly/.test(c))
+        return '⛅';
+    if (/soleil|clear|ensole|sunny|degage|dégagé/.test(c))
+        return '☀️';
+    return '🌡️';
+}
+const STYLE = `<style>
+.cbw-weather{font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;border-radius:16px;padding:16px 18px;color:#0b1220;background:linear-gradient(135deg,#eaf3ff 0%,#f7fbff 100%);border:1px solid rgba(0,0,0,.06);max-width:460px}
+.cbw-weather .top{display:flex;align-items:center;justify-content:space-between;gap:12px}
+.cbw-weather .loc{font-size:14px;font-weight:600;opacity:.8}
+.cbw-weather .temp{font-size:44px;font-weight:700;line-height:1}
+.cbw-weather .emoji{font-size:44px}
+.cbw-weather .cond{margin-top:2px;font-size:14px;opacity:.85;text-transform:capitalize}
+.cbw-weather .meta{margin-top:8px;font-size:12px;opacity:.7;display:flex;gap:14px;flex-wrap:wrap}
+.cbw-weather .fc{margin-top:14px;display:flex;gap:10px;overflow-x:auto}
+.cbw-weather .day{flex:0 0 auto;text-align:center;padding:8px 10px;border-radius:12px;background:rgba(255,255,255,.55);min-width:62px}
+.cbw-weather .day .d{font-size:11px;opacity:.7;text-transform:capitalize}
+.cbw-weather .day .e{font-size:20px;margin:2px 0}
+.cbw-weather .day .t{font-size:12px;font-weight:600}
+:root[data-cbw-theme="dark"] .cbw-weather{color:#e8eefc;background:linear-gradient(135deg,#101a2e 0%,#0b1220 100%);border-color:rgba(255,255,255,.08)}
+:root[data-cbw-theme="dark"] .cbw-weather .day{background:rgba(255,255,255,.06)}
+</style>`;
+/** Render a weather payload to a self-contained HTML fragment (no script). */
+export function renderWeatherWidget(raw) {
+    const d = (raw ?? {});
+    const cur = d.current ?? {};
+    const unit = d.units === 'imperial' ? '°F' : '°C';
+    const meta = [];
+    if (cur.feelsLike != null)
+        meta.push(`Ressenti ${Math.round(cur.feelsLike)}${unit}`);
+    if (cur.humidity != null)
+        meta.push(`💧 ${cur.humidity}%`);
+    if (cur.windSpeed != null)
+        meta.push(`💨 ${cur.windSpeed} km/h`);
+    const fc = Array.isArray(d.forecast) ? d.forecast.slice(0, 5) : [];
+    const temp = cur.temperature != null ? Math.round(cur.temperature) : '—';
+    return (STYLE +
+        `<div class="cbw-weather"><div class="top"><div>` +
+        `<div class="loc">${esc(d.location ?? 'Météo')}</div>` +
+        `<div class="temp">${temp}${unit}</div>` +
+        `<div class="cond">${esc(cur.condition ?? '')}</div>` +
+        `</div><div class="emoji">${emoji(cur.condition)}</div></div>` +
+        (meta.length ? `<div class="meta">${meta.map((m) => esc(m)).join('<span>·</span>')}</div>` : '') +
+        (fc.length
+            ? `<div class="fc">${fc
+                .map((f) => {
+                const g = f;
+                const hi = num(g.max, g.high);
+                const lo = num(g.min, g.low);
+                return (`<div class="day"><div class="d">${esc(dayLabel(g))}</div><div class="e">${emoji(g.condition)}</div>` +
+                    `<div class="t">${hi != null ? Math.round(hi) : '—'}° / ${lo != null ? Math.round(lo) : '—'}°</div></div>`);
+            })
+                .join('')}</div>`
+            : '') +
+        `</div>`);
+}
+//# sourceMappingURL=weather.js.map

package/dist/widgets/template-engine.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Tiny, SAFE Mustache-style template engine for AUTHORED widgets. Authored
+ * widgets are data-driven yet inert: `{{path}}` interpolation is ALWAYS
+ * HTML-escaped, `{{#each}}`/`{{#if}}` are the only control structures, and there
+ * is NO expression evaluation, NO function calls, NO `eval`. A template is a
+ * pure string transform — CSP-proof (no client script) and injection-safe (every
+ * interpolated value is escaped, so authored data can never inject markup).
+ *
+ * Grammar:
+ *   {{ a.b.c }}            → HTML-escaped value at dot-path (empty if missing)
+ *   {{#each items}} … {{/each}}   → iterate an array; inside, {{this}} / {{field}}
+ *   {{#if flag}} … {{else}} … {{/if}}  → truthy conditional
+ * Paths resolve against the current item, walking up to parent contexts.
+ *
+ * @module widgets/template-engine
+ */
+export declare function escapeHtml(s: unknown): string;
+/** Render a safe Mustache-style template with `data`. Pure, never executes code. */
+export declare function renderTemplate(tpl: string, data: unknown): string;