feat(builder): text+button package -- typography depth, button target/hover, box-model+anim/vis rollout

- TextStylePanel (Heading/TextBlock): line-height/letter-spacing presets,
  text-transform (none/uppercase/lowercase/capitalize), italic + underline
  toggles (fontStyle/textDecoration), and a custom NumericUnitInput
  font-size alongside the existing preset row. All write to component
  `style`; no toHtml changes needed (style already flows through
  cssPropsToString for both components).
- ButtonStylePanel/ButtonLink: "Open in new tab" checkbox writes the
  existing `target` prop ('_self'/'_blank' -- toHtml already emitted
  rel="noopener noreferrer" for _blank). New Hover State section
  (hoverBg/hoverColor via ColorPickerField) renders a scoped
  `<style>.btn_<hash>:hover{...}</style>` block before the `<a>` in
  toHtml, scoped per-node via scopeId (same pattern as Navbar/Menu) so
  two buttons on one page don't collide; both values sanitized through
  cssValue against <style>-element breakout. Editor canvas gets a live
  hover preview via onMouseEnter/onMouseLeave local state (mirrors Menu's
  approach), since there's no way to preview a CSS :hover rule directly
  on an inline-styled React element.
- Heading/TextBlock/ButtonLink: added margin(per-side)/padding(per-side,
  Text only)/border/box-shadow/opacity style defaults + AnimationControl/
  VisibilityControl-backed animation/animationDelay/hideOnDesktop/
  hideOnTablet/hideOnMobile props, each panel gaining collapsible
  Spacing / Border & Effects / Animation & Visibility sections. Button
  keeps its existing padding-shorthand preset row rather than adding a
  redundant per-side padding control; only margin got the new
  per-side SpacingControl.
- Tests: extended all three *.toHtml.test.ts files -- typography style
  emission (line-height/letter-spacing/text-transform/font-style/
  text-decoration/custom font-size), button target+rel, scoped hover
  style emission + two adversarial style-breakout cases (</style><script>
  and rule-injection via `;}selector{`), and craft.props assertions for
  every new prop on all three components. 674 tests green, tsc + vite
  build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/components/basic/ButtonLink.toHtml.test.ts

@@ -52,3 +52,69 @@ describe('ButtonLink.toHtml text escaping (attacker-controlled `text` prop)', ()
     expect(html).toContain('>Click Me</a>');
   });
 });
+
+describe('ButtonLink.toHtml hover state (scoped <style> block)', () => {
+  test('no hover props -- no <style> block, no class added', () => {
+    const { html } = toHtml({ href: '#', text: 'x' }, '', 'node-1');
+    expect(html).not.toContain('<style>');
+    expect(html).not.toContain('class=');
+  });
+
+  test('hoverBg/hoverColor emit a scoped :hover rule scoped to the node id', () => {
+    const { html } = toHtml({ href: '#', text: 'x', hoverBg: '#111111', hoverColor: '#eeeeee' }, '', 'node-42');
+    expect(html).toMatch(/<style>\.btn_[a-z0-9]+:hover\{background-color:#111111;color:#eeeeee\}<\/style>/);
+    expect(html).toMatch(/class="btn_[a-z0-9]+"/);
+  });
+
+  test('two different node ids produce different scope classes (no collision)', () => {
+    const a = toHtml({ href: '#', text: 'x', hoverBg: '#111111' }, '', 'node-a').html;
+    const b = toHtml({ href: '#', text: 'x', hoverBg: '#111111' }, '', 'node-b').html;
+    const scopeOf = (html: string) => html.match(/btn_[a-z0-9]+/)?.[0];
+    expect(scopeOf(a)).toBeTruthy();
+    expect(scopeOf(a)).not.toBe(scopeOf(b));
+  });
+
+  test('an XSS breakout attempt in hoverBg cannot close the <style> element', () => {
+    const malicious = '</style><script>alert(1)</script>';
+    const { html } = toHtml({ href: '#', text: 'x', hoverBg: malicious }, '', 'node-1');
+    expect(html).not.toContain('</style><script>');
+    expect(html).not.toContain('<script>alert(1)</script>');
+  });
+
+  test('a rule-breakout attempt in hoverColor cannot inject a second selector/rule', () => {
+    const malicious = 'red;}body{background:red';
+    const { html } = toHtml({ href: '#', text: 'x', hoverColor: malicious }, '', 'node-1');
+    expect(html).not.toContain('}body{');
+    expect(html).not.toContain(';}');
+    // The whole export is still exactly one <style> element -- no new rule
+    // or element was opened by the malicious value.
+    expect((html.match(/<style>/g) || []).length).toBe(1);
+    expect((html.match(/<\/style>/g) || []).length).toBe(1);
+  });
+});
+
+describe('ButtonLink.craft.props exposes target + hover + box-model + animation/visibility', () => {
+  test('target defaults to _self, hoverBg/hoverColor blank', () => {
+    const props = (ButtonLink as any).craft.props;
+    expect(props.target).toBe('_self');
+    expect(props.hoverBg).toBe('');
+    expect(props.hoverColor).toBe('');
+  });
+
+  test('animation, animationDelay, hideOnDesktop/Tablet/Mobile are present with blank/false defaults', () => {
+    const props = (ButtonLink as any).craft.props;
+    expect(props.animation).toBe('');
+    expect(props.animationDelay).toBe('0');
+    expect(props.hideOnDesktop).toBe(false);
+    expect(props.hideOnTablet).toBe(false);
+    expect(props.hideOnMobile).toBe(false);
+  });
+
+  test('style carries blank/default box-model keys', () => {
+    const style = (ButtonLink as any).craft.props.style;
+    expect(style).toHaveProperty('marginTop');
+    expect(style.border).toBe('none');
+    expect(style.boxShadow).toBe('none');
+    expect(style.opacity).toBe('1');
+  });
+});

craft/src/components/basic/ButtonLink.tsx

@@ -1,13 +1,24 @@
 import React, { CSSProperties } from 'react';
 import { useNode, UserComponent } from '@craftjs/core';
 import { cssPropsToString } from '../../utils/style-helpers';
-import { escapeHtml, escapeAttr, safeUrl } from '../../utils/escape';
+import { escapeHtml, escapeAttr, safeUrl, cssValue, scopeId } from '../../utils/escape';
 
 interface ButtonLinkProps {
   text?: string;
   href?: string;
   target?: '_self' | '_blank';
   style?: CSSProperties;
+  /** Background color applied on `:hover` via a scoped `<style>` block
+   *  (editor preview does not show hover state -- only the published
+   *  export). Blank means "no hover background override". */
+  hoverBg?: string;
+  /** Text color applied on `:hover`, same scoped `<style>` block. */
+  hoverColor?: string;
+  animation?: string;
+  animationDelay?: string;
+  hideOnDesktop?: boolean;
+  hideOnTablet?: boolean;
+  hideOnMobile?: boolean;
 }
 
 export const ButtonLink: UserComponent<ButtonLinkProps> = ({
@@ -15,6 +26,8 @@ export const ButtonLink: UserComponent<ButtonLinkProps> = ({
   href = '#',
   target = '_self',
   style = {},
+  hoverBg = '',
+  hoverColor = '',
 }) => {
   const {
     connectors: { connect, drag },
@@ -23,6 +36,8 @@ export const ButtonLink: UserComponent<ButtonLinkProps> = ({
     selected: node.events.selected,
   }));
 
+  const [hovered, setHovered] = React.useState(false);
+
   return (
     <a
       ref={(ref: HTMLAnchorElement | null) => { if (ref) connect(drag(ref)); }}
@@ -32,12 +47,16 @@ export const ButtonLink: UserComponent<ButtonLinkProps> = ({
         // Prevent navigation inside editor
         e.preventDefault();
       }}
+      onMouseEnter={() => setHovered(true)}
+      onMouseLeave={() => setHovered(false)}
       style={{
         display: 'inline-block',
         textDecoration: 'none',
         cursor: 'pointer',
         outline: selected ? '2px solid #3b82f6' : 'none',
         ...style,
+        ...(hovered && hoverBg ? { backgroundColor: hoverBg } : {}),
+        ...(hovered && hoverColor ? { color: hoverColor } : {}),
       }}
     >
       {text}
@@ -53,6 +72,8 @@ ButtonLink.craft = {
     text: 'Click Me',
     href: '#',
     target: '_self',
+    hoverBg: '',
+    hoverColor: '',
     style: {
       backgroundColor: '#3b82f6',
       color: '#ffffff',
@@ -61,7 +82,15 @@ ButtonLink.craft = {
       fontWeight: '600',
       fontSize: '16px',
       border: 'none',
+      marginTop: '', marginRight: '', marginBottom: '', marginLeft: '',
+      boxShadow: 'none',
+      opacity: '1',
     },
+    animation: '',
+    animationDelay: '0',
+    hideOnDesktop: false,
+    hideOnTablet: false,
+    hideOnMobile: false,
   },
   rules: {
     canDrag: () => true,
@@ -72,7 +101,7 @@ ButtonLink.craft = {
 
 /* ---------- HTML export ---------- */
 
-(ButtonLink as any).toHtml = (props: ButtonLinkProps, _childrenHtml: string) => {
+(ButtonLink as any).toHtml = (props: ButtonLinkProps, _childrenHtml: string, nodeId?: string) => {
   const styleStr = cssPropsToString({
     display: 'inline-block',
     textDecoration: 'none',
@@ -80,7 +109,28 @@ ButtonLink.craft = {
   });
   const escapedText = escapeHtml(props.text || '');
   const targetAttr = props.target === '_blank' ? ' target="_blank" rel="noopener noreferrer"' : '';
+
+  // Scoped hover style -- same pattern as Navbar/Menu: a deterministic,
+  // per-node class (via scopeId) avoids two ButtonLink instances on the
+  // same page colliding on a shared `.btn-link:hover` rule. hoverBg/
+  // hoverColor are sanitized through cssValue -- they land inside a
+  // `<style>` element, the worst-case XSS sink (an unescaped `<`/`>` or
+  // `{`/`}` could close the rule/element and open a `<script>`).
+  const hoverBg = cssValue(props.hoverBg);
+  const hoverColor = cssValue(props.hoverColor);
+  let hoverCss = '';
+  let cls = '';
+  if (hoverBg || hoverColor) {
+    const scope = scopeId(nodeId, (props.href || '') + (props.text || ''), 'btn');
+    cls = ` class="${scope}"`;
+    const decls = [
+      hoverBg ? `background-color:${hoverBg}` : '',
+      hoverColor ? `color:${hoverColor}` : '',
+    ].filter(Boolean).join(';');
+    hoverCss = `<style>.${scope}:hover{${decls}}</style>`;
+  }
+
   return {
-    html: `<a href="${escapeAttr(safeUrl(props.href || '#'))}"${targetAttr}${styleStr ? ` style="${styleStr}"` : ''}>${escapedText}</a>`,
+    html: `${hoverCss}<a href="${escapeAttr(safeUrl(props.href || '#'))}"${targetAttr}${cls}${styleStr ? ` style="${styleStr}"` : ''}>${escapedText}</a>`,
   };
 };

craft/src/components/basic/Heading.toHtml.test.ts

@@ -56,3 +56,54 @@ describe('Heading.toHtml text escaping (attacker-controlled `text` prop)', () =>
     expect(html).toBe('<h2>Hello world</h2>');
   });
 });
+
+describe('Heading.toHtml typography depth (line-height/letter-spacing/transform/style/decoration)', () => {
+  test('line-height, letter-spacing, text-transform all flow into the style attribute', () => {
+    const { html } = toHtml({
+      text: 'x',
+      level: 'h2',
+      style: { lineHeight: '1.25', letterSpacing: '0.05em', textTransform: 'uppercase' },
+    }, '');
+    expect(html).toContain('line-height:1.25');
+    expect(html).toContain('letter-spacing:0.05em');
+    expect(html).toContain('text-transform:uppercase');
+  });
+
+  test('italic + underline toggles emit font-style and text-decoration', () => {
+    const { html } = toHtml({
+      text: 'x',
+      level: 'h2',
+      style: { fontStyle: 'italic', textDecoration: 'underline' },
+    }, '');
+    expect(html).toContain('font-style:italic');
+    expect(html).toContain('text-decoration:underline');
+  });
+
+  test('a custom font-size (not one of the presets) still flows through', () => {
+    const { html } = toHtml({ text: 'x', level: 'h2', style: { fontSize: '42px' } }, '');
+    expect(html).toContain('font-size:42px');
+  });
+});
+
+describe('Heading.craft.props exposes the box-model + animation/visibility rollout', () => {
+  test('animation, animationDelay, hideOnDesktop/Tablet/Mobile are present with blank/false defaults', () => {
+    const props = (Heading as any).craft.props;
+    expect(props.animation).toBe('');
+    expect(props.animationDelay).toBe('0');
+    expect(props.hideOnDesktop).toBe(false);
+    expect(props.hideOnTablet).toBe(false);
+    expect(props.hideOnMobile).toBe(false);
+  });
+
+  test('style carries blank/default box-model + typography-depth keys', () => {
+    const style = (Heading as any).craft.props.style;
+    expect(style).toHaveProperty('marginTop');
+    expect(style).toHaveProperty('paddingTop');
+    expect(style).toHaveProperty('lineHeight');
+    expect(style).toHaveProperty('letterSpacing');
+    expect(style).toHaveProperty('textTransform');
+    expect(style.border).toBe('none');
+    expect(style.boxShadow).toBe('none');
+    expect(style.opacity).toBe('1');
+  });
+});

craft/src/components/basic/Heading.tsx

@@ -100,7 +100,22 @@ Heading.craft = {
       fontFamily: 'Inter, sans-serif',
       color: '#1f2937',
       marginBottom: '16px',
+      lineHeight: '',
+      letterSpacing: '',
+      textTransform: '' as CSSProperties['textTransform'],
+      fontStyle: '' as CSSProperties['fontStyle'],
+      textDecoration: '',
+      marginTop: '', marginRight: '', marginLeft: '',
+      paddingTop: '', paddingRight: '', paddingBottom: '', paddingLeft: '',
+      border: 'none',
+      boxShadow: 'none',
+      opacity: '1',
     },
+    animation: '',
+    animationDelay: '0',
+    hideOnDesktop: false,
+    hideOnTablet: false,
+    hideOnMobile: false,
   },
   rules: {
     canDrag: () => true,

craft/src/components/basic/TextBlock.toHtml.test.ts

@@ -20,3 +20,48 @@ describe('TextBlock.toHtml text escaping (attacker-controlled `text` prop)', ()
     expect(html).toBe('<p>Hello world</p>');
   });
 });
+
+describe('TextBlock.toHtml typography depth (line-height/letter-spacing/transform/style/decoration)', () => {
+  test('line-height, letter-spacing, text-transform all flow into the style attribute', () => {
+    const { html } = toHtml({
+      text: 'x',
+      style: { lineHeight: '1.75', letterSpacing: '-0.02em', textTransform: 'capitalize' },
+    }, '');
+    expect(html).toContain('line-height:1.75');
+    expect(html).toContain('letter-spacing:-0.02em');
+    expect(html).toContain('text-transform:capitalize');
+  });
+
+  test('italic + underline toggles emit font-style and text-decoration', () => {
+    const { html } = toHtml({ text: 'x', style: { fontStyle: 'italic', textDecoration: 'underline' } }, '');
+    expect(html).toContain('font-style:italic');
+    expect(html).toContain('text-decoration:underline');
+  });
+
+  test('a custom font-size (not one of the presets) still flows through', () => {
+    const { html } = toHtml({ text: 'x', style: { fontSize: '19px' } }, '');
+    expect(html).toContain('font-size:19px');
+  });
+});
+
+describe('TextBlock.craft.props exposes the box-model + animation/visibility rollout', () => {
+  test('animation, animationDelay, hideOnDesktop/Tablet/Mobile are present with blank/false defaults', () => {
+    const props = (TextBlock as any).craft.props;
+    expect(props.animation).toBe('');
+    expect(props.animationDelay).toBe('0');
+    expect(props.hideOnDesktop).toBe(false);
+    expect(props.hideOnTablet).toBe(false);
+    expect(props.hideOnMobile).toBe(false);
+  });
+
+  test('style carries blank/default box-model + typography-depth keys', () => {
+    const style = (TextBlock as any).craft.props.style;
+    expect(style).toHaveProperty('marginTop');
+    expect(style).toHaveProperty('paddingTop');
+    expect(style).toHaveProperty('letterSpacing');
+    expect(style).toHaveProperty('textTransform');
+    expect(style.border).toBe('none');
+    expect(style.boxShadow).toBe('none');
+    expect(style.opacity).toBe('1');
+  });
+});

craft/src/components/basic/TextBlock.tsx

@@ -83,7 +83,21 @@ TextBlock.craft = {
       fontSize: '16px',
       lineHeight: '1.6',
       color: '#3f3f46',
+      letterSpacing: '',
+      textTransform: '' as CSSProperties['textTransform'],
+      fontStyle: '' as CSSProperties['fontStyle'],
+      textDecoration: '',
+      marginTop: '', marginRight: '', marginBottom: '', marginLeft: '',
+      paddingTop: '', paddingRight: '', paddingBottom: '', paddingLeft: '',
+      border: 'none',
+      boxShadow: 'none',
+      opacity: '1',
     },
+    animation: '',
+    animationDelay: '0',
+    hideOnDesktop: false,
+    hideOnTablet: false,
+    hideOnMobile: false,
   },
   rules: {
     canDrag: () => true,