wiki-formant 0.98.0 → 0.99.0

package/README.md

@@ -601,6 +601,7 @@ const safe = mapBlockTree(blocks, b => sanitizeCoreLeaf(b, clean), BLOCK_SHAPE);
 - The default list is what `wiki-formant/tiptap`'s nodes store plus a presentational SVG subset. Extend `tags`, `attributes`, `classes` and `schemesByTag` from your stored HTML, never from memory.
 - A YouTube iframe comes out as the `YouTube` node's markup, whoever wrote it, and `base.css` draws it as a 16:9 player.
 - Classes pass by name only, since a site's own utilities can draw over the chrome.
+- `sanitizeLine(html, { links })` cleans what a `WikiLine` stores: its marks and `wikiTextStyle`'s spans. `sanitizeCoreLeaf` runs it over the core leaves' one-line fields (a figure, a quote and who said it, the events' and places' headings, a place's name), which `block-views` draws as HTML.
 
 ## Image uploads
 
@@ -665,7 +666,7 @@ const url = useUrlPrompt(editor, { resolveMapUrl });
 
 - `WikiToolbar` shows each command the editor's extensions support (`supports`) and nothing else, in fixed groups, with the table controls while the cursor is in a table.
 - `useUrlPrompt` is the link and embed field: it opens on the current link, unlinks on an emptied one, and closes when its editor changes.
-- `WikiLine` is a one-line field with its own `marks`, undo and `onFocus`, so one toolbar can drive the field last touched.
+- `WikiLine` is a one-line field with its own `marks`, undo and `onFocus`, so one toolbar can drive the field last touched. Its `style` mark is `wikiTextStyle`: a font, colour and size on a run of words, which an article editor takes through `nodes` and an app's own controls set with `setTextStyle`.
 - A link is stored as its `href` and the `link` class only; whether it is external is decided at render by `articleHtml`'s `links` pass. `uploadImageTo('/api/upload')` is the `uploadImage` an editor passes.
 
 ## Block editor

package/dist/block-views.js

@@ -23,7 +23,9 @@ import { clock, DEFAULT_ZONE, hoursRows, mapEmbed, mapHref, openState } from './
 import { Anchor } from './react-server.js';
 import { safeLinkHref } from './validation.js';
 import { cx } from './html.js';
-import { BANNER_LABELS, BANNER_MESSAGES, bannerVariant } from './text.js';
+import { BANNER_LABELS, BANNER_MESSAGES, bannerVariant, plainText } from './text.js';
+/** A one-line field as the HTML it holds, cleaned by `sanitizeCoreLeaf` (`sanitizeLine`) on its way here. */
+const line = (html) => ({ dangerouslySetInnerHTML: { __html: html } });
 /**
  * Tabbed code samples. Every tab's body stays mounted and the inactive ones are
  * hidden rather than unmounted: remounting a highlighted panel would re-run
@@ -115,14 +117,14 @@ export function StatsView({ items, columns = 4, }) {
     const rows = items ?? [];
     if (!rows.length)
         return null;
-    return (_jsx("div", { className: cx('stat-grid', `stat-grid-${columns}`), children: rows.map((item, i) => (_jsxs("div", { className: "stat-card", children: [_jsxs("span", { className: "stat-value", children: [item.value, item.suffix && _jsx("span", { className: "stat-suffix", children: item.suffix })] }), _jsx("span", { className: "stat-label", children: item.label })] }, item.id ?? i))) }));
+    return (_jsx("div", { className: cx('stat-grid', `stat-grid-${columns}`), children: rows.map((item, i) => (_jsxs("div", { className: "stat-card", children: [_jsxs("span", { className: "stat-value", children: [_jsx("span", { ...line(String(item.value)) }), item.suffix && _jsx("span", { className: "stat-suffix", children: item.suffix })] }), _jsx("span", { className: "stat-label", ...line(item.label) })] }, item.id ?? i))) }));
 }
 /** Someone's words over who said them, with their photo when there is one. */
 export function TestimonialView({ quote, author, role, avatarUrl, photo }) {
     if (!quote.trim())
         return null;
     const src = avatarUrl && safeLinkHref(avatarUrl);
-    return (_jsxs("figure", { className: "testimonial", children: [_jsx("blockquote", { children: quote }), _jsxs("figcaption", { children: [src && _jsx("img", { src: src, ...photo, alt: "", loading: "lazy" }), _jsxs("span", { children: [_jsx("strong", { children: author }), role && _jsx("small", { children: role })] })] })] }));
+    return (_jsxs("figure", { className: "testimonial", children: [_jsx("blockquote", { ...line(quote) }), _jsxs("figcaption", { children: [src && _jsx("img", { src: src, ...photo, alt: "", loading: "lazy" }), _jsxs("span", { children: [_jsx("strong", { ...line(author) }), role && _jsx("small", { ...line(role) })] })] })] }));
 }
 // ---- events -----------------------------------------------------------------
 const still = () => () => { };
@@ -140,7 +142,7 @@ export function EventsView({ items, upcoming, past, day }) {
     return (_jsx("section", { className: "events", children: [
             [upcoming || 'Upcoming', split.upcoming],
             [past || 'Past', split.past],
-        ].map(([heading, rows], ended) => rows.length ? (_jsxs(Fragment, { children: [_jsx("h2", { children: heading }), _jsx("ol", { className: "event-list", children: rows.map((e, i) => (_jsxs("li", { children: [_jsx("time", { dateTime: e.date, children: eventWhen(e) }), _jsxs("span", { children: [_jsx("span", { dangerouslySetInnerHTML: { __html: e.text } }), !ended && eventBegun(e, now) && _jsx("small", { className: "event-now", children: "Now on" })] })] }, e.id ?? i))) })] }, ended)) : null) }));
+        ].map(([heading, rows], ended) => rows.length ? (_jsxs(Fragment, { children: [_jsx("h2", { ...line(heading) }), _jsx("ol", { className: "event-list", children: rows.map((e, i) => (_jsxs("li", { children: [_jsx("time", { dateTime: e.date, children: eventWhen(e) }), _jsxs("span", { children: [_jsx("span", { dangerouslySetInnerHTML: { __html: e.text } }), !ended && eventBegun(e, now) && _jsx("small", { className: "event-now", children: "Now on" })] })] }, e.id ?? i))) })] }, ended)) : null) }));
 }
 // ---- locations --------------------------------------------------------------
 const everyMinute = (tick) => {
@@ -169,10 +171,10 @@ export function PlaceHours({ hours, timeZone = DEFAULT_ZONE }) {
  */
 export function LocationsView({ heading, map, items }) {
     const Name = heading ? 'h3' : 'h2';
-    return (_jsxs("section", { className: "locations", children: [heading && _jsx("h2", { children: heading }), _jsx("ul", { className: "places", children: items.map((p, i) => {
+    return (_jsxs("section", { className: "locations", children: [heading && _jsx("h2", { ...line(heading) }), _jsx("ul", { className: "places", children: items.map((p, i) => {
                     const link = safeLinkHref(mapHref(p));
                     const image = p.image && safeLinkHref(p.image);
-                    return (_jsxs("li", { className: "place", children: [image && _jsx("img", { src: image, ...p.photo, alt: "", className: "place-picture", loading: "lazy" }), p.name && _jsx(Name, { children: p.name }), p.address && _jsx("address", { children: link ? _jsx("a", { href: link, children: p.address.trim() }) : p.address.trim() }), !!p.hours?.length && _jsx(PlaceHours, { hours: p.hours, timeZone: p.timeZone }), p.note && _jsx("p", { dangerouslySetInnerHTML: { __html: p.note } }), (p.phone || p.email) && (_jsxs("p", { className: "place-contact", children: [p.phone && _jsx("a", { href: `tel:${p.phone.replace(/[^\d+]/g, '')}`, children: p.phone }), p.email && _jsx("a", { href: `mailto:${p.email}`, children: p.email })] })), map && p.address && (_jsx("iframe", { className: "place-map", src: mapEmbed({ address: p.address, map: p.map }), title: `Map of ${p.name || p.address.split('\n')[0]}`, loading: "lazy", referrerPolicy: "no-referrer-when-downgrade" }))] }, p.id ?? i));
+                    return (_jsxs("li", { className: "place", children: [image && _jsx("img", { src: image, ...p.photo, alt: "", className: "place-picture", loading: "lazy" }), p.name && _jsx(Name, { ...line(p.name) }), p.address && _jsx("address", { children: link ? _jsx("a", { href: link, children: p.address.trim() }) : p.address.trim() }), !!p.hours?.length && _jsx(PlaceHours, { hours: p.hours, timeZone: p.timeZone }), p.note && _jsx("p", { dangerouslySetInnerHTML: { __html: p.note } }), (p.phone || p.email) && (_jsxs("p", { className: "place-contact", children: [p.phone && _jsx("a", { href: `tel:${p.phone.replace(/[^\d+]/g, '')}`, children: p.phone }), p.email && _jsx("a", { href: `mailto:${p.email}`, children: p.email })] })), map && p.address && (_jsx("iframe", { className: "place-map", src: mapEmbed({ address: p.address, map: p.map }), title: `Map of ${(p.name && plainText(p.name)) || p.address.split('\n')[0]}`, loading: "lazy", referrerPolicy: "no-referrer-when-downgrade" }))] }, p.id ?? i));
                 }) })] }));
 }
 // ---- banner -----------------------------------------------------------------

package/dist/blocks.js

@@ -13,7 +13,7 @@
 import { htmlToMarkdown, inlineToMarkdown } from './markdown.js';
 import { relativeTime } from './freshness.js';
 import { hoursRows, mapHref } from './hours.js';
-import { BANNER_LABELS, bannerToText, codeTabsToText, linkGridToText, pageListToText, referencesToText, statsToText, stripHtml, testimonialToText, } from './text.js';
+import { BANNER_LABELS, bannerToText, codeTabsToText, linkGridToText, pageListToText, plainText, referencesToText, statsToText, stripHtml, testimonialToText, } from './text.js';
 // ---- the shapes the standard block types carry ------------------------------
 /**
  * The languages a code block or code tab offers, and the one a new one opens
@@ -187,11 +187,11 @@ export function referencesToMarkdown(items, title = 'References') {
 export function statsToMarkdown(items) {
     if (!items.length)
         return '';
-    return items.map(s => `- **${s.value}${s.suffix ?? ''}** — ${s.label}`).join('\n');
+    return items.map(s => `- **${plainText(String(s.value))}${s.suffix ?? ''}** — ${inlineToMarkdown(s.label)}`).join('\n');
 }
 /** A quotation over its attribution. @internal */
 export function testimonialToMarkdown(quote, author, role) {
-    return `> ${quote.trim().replace(/\n+/g, '\n> ')}\n>\n> — ${[author, role].filter(Boolean).join(', ')}`;
+    return `> ${quote.trim().split(/\n+/).map(inlineToMarkdown).join('\n> ')}\n>\n> — ${[author, role].filter(Boolean).map(w => inlineToMarkdown(w)).join(', ')}`;
 }
 /** Grouped links under their headings, with an optional lead paragraph. @internal */
 export function linkGridToMarkdown(groups, intro) {
@@ -258,13 +258,13 @@ function eventSections({ upcoming, past, items, day }) {
 /** Events under their headings, split by the day the twin is read, as the page is. */
 export function eventsToMarkdown(block) {
     return eventSections(block)
-        .map(s => `## ${s.heading}\n\n${s.items.map(e => `- ${eventWhen(e)}: ${inlineToMarkdown(e.text)}${s.now(e) ? ' (now on)' : ''}`).join('\n')}`)
+        .map(s => `## ${inlineToMarkdown(s.heading)}\n\n${s.items.map(e => `- ${eventWhen(e)}: ${inlineToMarkdown(e.text)}${s.now(e) ? ' (now on)' : ''}`).join('\n')}`)
         .join('\n\n');
 }
 /** Events as prose, `12 Nov 2026: Group show, London` a line, under their headings. */
 export function eventsToText(block) {
     return eventSections(block)
-        .map(s => `${s.heading}\n${s.items.map(e => `${eventWhen(e)}: ${stripHtml(e.text).replace(/\s+/g, ' ')}${s.now(e) ? ' (now on)' : ''}`).join('\n')}`)
+        .map(s => `${plainText(s.heading)}\n${s.items.map(e => `${eventWhen(e)}: ${stripHtml(e.text).replace(/\s+/g, ' ')}${s.now(e) ? ' (now on)' : ''}`).join('\n')}`)
         .join('\n\n');
 }
 const tel = (phone) => `tel:${phone.replace(/[^\d+]/g, '')}`;
@@ -276,7 +276,7 @@ export function locationsToMarkdown({ heading, items }) {
         const map = mapHref(p);
         const address = addressLine(p.address);
         return [
-            p.name && `${level} ${p.name}`,
+            p.name && `${level} ${inlineToMarkdown(p.name)}`,
             p.image && `![](${p.image})`,
             address && (map ? `[${address}](${map})` : address),
             p.hours?.length && hoursRows(p.hours).map(r => `- ${r.label}: ${r.times}`).join('\n'),
@@ -286,12 +286,12 @@ export function locationsToMarkdown({ heading, items }) {
             .filter(Boolean)
             .join('\n\n');
     };
-    return [heading && `## ${heading}`, ...items.map(place)].filter(Boolean).join('\n\n');
+    return [heading && `## ${inlineToMarkdown(heading)}`, ...items.map(place)].filter(Boolean).join('\n\n');
 }
 /** Each place as prose: its name, address, hours a row to a line, note, phone and email. */
 export function locationsToText({ heading, items }) {
     const place = (p) => [
-        p.name,
+        p.name && plainText(p.name),
         addressLine(p.address),
         ...(p.hours?.length ? hoursRows(p.hours).map(r => `${r.label} ${r.times}`) : []),
         p.note && stripHtml(p.note).replace(/\s+/g, ' '),
@@ -300,7 +300,7 @@ export function locationsToText({ heading, items }) {
     ]
         .filter(Boolean)
         .join('\n');
-    return [heading, ...items.map(place)].filter(Boolean).join('\n\n');
+    return [heading && plainText(heading), ...items.map(place)].filter(Boolean).join('\n\n');
 }
 /** A flat bullet list of links — resolved page lists, feed items, link rails. */
 export function linkList(items) {

package/dist/corpus.d.ts

@@ -7,9 +7,13 @@ export interface CorpusSection {
     /** Heading, URL, date and body, exactly as the document will carry them. */
     section: string;
 }
-/** `maxChars` bounds: the default, the floor and the ceiling. Quote them in the tool's schema. */
+/**
+ * `maxChars` bounds: the default, the floor and the ceiling. Quote them in the
+ * tool's schema. The default slice, with its JSON around it, stays inside
+ * `payloadBudget`'s 120,000, since a call with no arguments is weighed there.
+ */
 export declare const CORPUS_BUDGET: {
-    readonly default: 200000;
+    readonly default: 100000;
     readonly min: 1000;
     readonly max: 1000000;
 };

package/dist/corpus.js

@@ -11,8 +11,12 @@
 //
 // The corpus itself — which rows, in what order, how a page becomes a section —
 // stays with each wiki. This is the arithmetic over the sections it hands in.
-/** `maxChars` bounds: the default, the floor and the ceiling. Quote them in the tool's schema. */
-export const CORPUS_BUDGET = { default: 200_000, min: 1_000, max: 1_000_000 };
+/**
+ * `maxChars` bounds: the default, the floor and the ceiling. Quote them in the
+ * tool's schema. The default slice, with its JSON around it, stays inside
+ * `payloadBudget`'s 120,000, since a call with no arguments is weighed there.
+ */
+export const CORPUS_BUDGET = { default: 100_000, min: 1_000, max: 1_000_000 };
 const CLIP_MARKER = '\n\n[…page clipped at maxChars…]';
 /**
  * A preflight (`sizeOnly`) or one page-aligned slice of `sections`.

package/dist/editor.d.ts

@@ -5,19 +5,35 @@ import { type ChangeEvent, type KeyboardEvent, type ReactNode, type RefObject }
  *
  * Each of these packages ships a `declare module '@tiptap/core'` block that adds
  * its commands to `ChainedCommands` — `toggleBold`, `insertTable`, `setLink`,
- * `setImage`. Because this module owns the extensions, it has to carry
+ * `setImage`, `removeEmptyTextStyle`. Because this module owns the extensions, it has to carry
  * the augmentation across the package boundary, and a re-exported type is what
  * makes the emitted `.d.ts` load the module that declares it. Without these
- * four lines every `editor.chain().focus().toggleBold()` in every consumer
+ * lines every `editor.chain().focus().toggleBold()` in every consumer
  * stops type-checking.
  */
 export type { StarterKitOptions } from '@tiptap/starter-kit';
 export type { LinkOptions } from '@tiptap/extension-link';
 export type { ImageOptions } from '@tiptap/extension-image';
 export type { TableOptions } from '@tiptap/extension-table';
+export type { TextStyleOptions } from '@tiptap/extension-text-style';
 /** The view and the editor's type, so a consumer imports nothing from `@tiptap/*` itself. */
 export { EditorContent } from '@tiptap/react';
 export type { Editor } from '@tiptap/core';
+/** What `wikiTextStyle` may set on a run of words, each one property of its span's `style`. */
+export interface TextStyleAttrs {
+    fontFamily?: string | null;
+    color?: string | null;
+    fontSize?: string | null;
+}
+/**
+ * Tiptap's TextStyle, carrying a font, a colour and a size: a run of words
+ * styled apart from the block around it, the same in a line as in an article.
+ * Each is read back from stored HTML, so a span the sanitiser kept is edited
+ * as it was written. Set with `setTextStyle`, which drops an empty span.
+ */
+export declare const wikiTextStyle: import("@tiptap/core").Mark<import("@tiptap/extension-text-style").TextStyleOptions, any>;
+/** Style the selected words, or with null take a property off them; a span left with none goes. */
+export declare const setTextStyle: (editor: Editor, attrs: TextStyleAttrs) => boolean;
 export interface WikiEditorExtensionOptions {
     /** Empty-document prompt. */
     placeholder?: string;
@@ -169,8 +185,8 @@ export interface WikiEditorState {
  * the buttons its extensions allow; the icons and classes are the app's.
  */
 export declare function useWikiEditor({ value, onChange, placeholder, nodes, proseClass, uploadImage, debounceMs, }: WikiEditorOptions): WikiEditorState;
-/** What a one-line field may keep. With none, its value is plain text. */
-export type LineMark = 'bold' | 'italic' | 'link';
+/** What a one-line field may keep: an article's inline marks, and `wikiTextStyle`'s font, colour and size. With none, its value is plain text. */
+export type LineMark = 'bold' | 'italic' | 'code' | 'link' | 'style';
 export interface WikiLineProps {
     as: 'h1' | 'h2' | 'h3' | 'p' | 'span' | 'div' | 'small' | 'figcaption';
     value: string;

package/dist/editor.js

@@ -23,6 +23,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // the taxonomy or the MCP transport installs none of them.
 import StarterKit from '@tiptap/starter-kit';
 import TiptapLink from '@tiptap/extension-link';
+import TextStyle from '@tiptap/extension-text-style';
 import TiptapImage from '@tiptap/extension-image';
 import TiptapTable from '@tiptap/extension-table';
 import TiptapTableRow from '@tiptap/extension-table-row';
@@ -83,6 +84,27 @@ export const wikiLink = TiptapLink.extend({
         return Object.fromEntries(Object.entries(this.parent?.() ?? {}).filter(([name]) => name !== 'target' && name !== 'rel'));
     },
 }).configure({ openOnClick: false, HTMLAttributes: { class: 'link', target: null, rel: null } });
+const STYLE_CSS = { fontFamily: 'font-family', color: 'color', fontSize: 'font-size' };
+/**
+ * Tiptap's TextStyle, carrying a font, a colour and a size: a run of words
+ * styled apart from the block around it, the same in a line as in an article.
+ * Each is read back from stored HTML, so a span the sanitiser kept is edited
+ * as it was written. Set with `setTextStyle`, which drops an empty span.
+ */
+export const wikiTextStyle = TextStyle.extend({
+    addAttributes() {
+        return Object.fromEntries(Object.entries(STYLE_CSS).map(([name, css]) => [
+            name,
+            {
+                default: null,
+                parseHTML: (el) => el.style.getPropertyValue(css) || null,
+                renderHTML: (attrs) => (attrs[name] ? { style: `${css}: ${attrs[name]}` } : {}),
+            },
+        ]));
+    },
+});
+/** Style the selected words, or with null take a property off them; a span left with none goes. */
+export const setTextStyle = (editor, attrs) => editor.chain().focus().setMark('textStyle', attrs).removeEmptyTextStyle().run();
 /**
  * The editor's extension set.
  *
@@ -514,7 +536,6 @@ export function WikiLine({ as: Tag, value, onChange, placeholder, marks = [], cl
                     orderedList: false,
                     listItem: false,
                     codeBlock: false,
-                    code: false,
                     horizontalRule: false,
                     hardBreak: false,
                     strike: false,
@@ -522,8 +543,10 @@ export function WikiLine({ as: Tag, value, onChange, placeholder, marks = [], cl
                     gapcursor: false,
                     ...(has('bold') ? {} : { bold: false }),
                     ...(has('italic') ? {} : { italic: false }),
+                    ...(has('code') ? {} : { code: false }),
                 }),
                 ...(has('link') ? [wikiLink] : []),
+                ...(has('style') ? [wikiTextStyle] : []),
             ],
             content: content(value),
             editorProps: { transformPastedHTML: pastedLine, transformPastedText: t => t.replace(/\s+/g, ' ') },

package/dist/sanitize.d.ts

@@ -20,10 +20,22 @@ export interface HtmlSanitizerOptions {
  * got here, and a list written from memory erases content on the first render.
  */
 export declare function createHtmlSanitizer(options?: HtmlSanitizerOptions): (html: string) => string;
+/**
+ * A one-line field's HTML, cleaned: bold, italic, code, a link and a styled
+ * span, and nothing else, so a heading or a caption drawn from it as HTML holds
+ * no block, picture or script. `links: false` drops a link's tag and keeps its
+ * words, for a field drawn inside a link already, a button's label.
+ */
+export declare function sanitizeLine(html: string, { links }?: {
+    links?: boolean;
+}): string;
 /**
  * The core leaf types' HTML fields, cleaned: `content.text`, `linkGrid` group
- * descriptions, `references` and `events` item text, and a place's note. Every other field those blocks
- * carry renders as a React text node and is escaped already.
+ * descriptions, `references` and `events` item text, and a place's note, by
+ * `clean`; and their one-line fields, a figure's value and label, a quote and
+ * who said it, the events' headings and a place's heading and name, by
+ * `sanitizeLine`. Every other field those blocks carry renders as a React text
+ * node and is escaped already.
  *
  * Returns any other block untouched, so it drops straight into a
  * `mapBlockTree` pass — a repo whose own types render HTML cleans those itself.

package/dist/sanitize.js

@@ -43,13 +43,14 @@ const STYLE_PROPS = [
     'border', 'border-top', 'border-bottom', 'border-left', 'border-right',
     'border-radius', 'border-color', 'border-width', 'border-style',
     'background', 'background-color', 'color', 'opacity',
-    'font-size', 'font-weight', 'font-style', 'line-height',
+    'font-family', 'font-size', 'font-weight', 'font-style', 'line-height',
     'text-align', 'vertical-align', 'display', 'overflow',
 ];
-// Ordinary CSS tokens plus rgb()/rgba(). Excluding quotes, backslashes, angle
-// brackets and any other `(` keeps `url(...)` and `expression(...)` out of
-// every property without a per-property regex.
-const SAFE_CSS_VALUE = /^(?:[a-z0-9#%.,\-+/ ]|rgba?\([\d\s,.%]+\))*$/i;
+// Ordinary CSS tokens plus rgb()/rgba(), and var() naming a custom property, so
+// a run of words can take the site's own colour or web font. Excluding quotes,
+// backslashes, angle brackets and any other `(` keeps `url(...)` and
+// `expression(...)` out of every property without a per-property regex.
+const SAFE_CSS_VALUE = /^(?:[a-z0-9#%.,\-+/ ]|rgba?\([\d\s,.%]+\)|var\(--[a-z0-9-]+\))*$/i;
 const PROSE_TAGS = [
     'p', 'br', 'hr', 'div', 'span', 'blockquote', 'pre', 'code',
     'strong', 'em', 'b', 'i', 's', 'u', 'sub', 'sup', 'mark', 'small',
@@ -145,6 +146,29 @@ export function createHtmlSanitizer(options = {}) {
     };
     return (html) => (!html || !html.includes('<') ? html : asYouTubeNodes(sanitizeHtml(html, config)));
 }
+// What a `WikiLine` keeps: its marks, the link's class, and `wikiTextStyle`'s
+// three properties, each held to the same safe value as an article's.
+const LINE_TAGS = ['strong', 'em', 'b', 'i', 'code', 'span', 'a'];
+const LINE_STYLES = Object.fromEntries(['font-family', 'color', 'font-size'].map(p => [p, [SAFE_CSS_VALUE]]));
+/**
+ * A one-line field's HTML, cleaned: bold, italic, code, a link and a styled
+ * span, and nothing else, so a heading or a caption drawn from it as HTML holds
+ * no block, picture or script. `links: false` drops a link's tag and keeps its
+ * words, for a field drawn inside a link already, a button's label.
+ */
+export function sanitizeLine(html, { links = true } = {}) {
+    if (!html || !html.includes('<'))
+        return html;
+    return sanitizeHtml(html, {
+        allowedTags: links ? LINE_TAGS : LINE_TAGS.filter(t => t !== 'a'),
+        allowedAttributes: { a: ['href'], span: ['style'] },
+        allowedClasses: { a: ['link'] },
+        allowedStyles: { span: LINE_STYLES },
+        allowedSchemesByTag: { a: ['http', 'https', 'mailto', 'tel'] },
+        allowProtocolRelative: false,
+        nonTextTags: ['script', 'style', 'textarea', 'option', 'noscript'],
+    });
+}
 // A YouTube player the editor did not write: an agent's, an import's, a pasted
 // embed code. Run over the sanitiser's own output, whose markup is regular.
 const BARE_YOUTUBE = /(<div data-youtube-video>)?(<iframe\b[^>]*\bsrc="https:\/\/www\.youtube(?:-nocookie)?\.com\/embed\/[^"]*"[^>]*><\/iframe>)/g;
@@ -155,10 +179,15 @@ const BARE_YOUTUBE = /(<div data-youtube-video>)?(<iframe\b[^>]*\bsrc="https:\/\
 const asYouTubeNodes = (html) => html.includes('youtube') ? html.replace(BARE_YOUTUBE, (all, wrapped, frame) => (wrapped ? all : `<div data-youtube-video>${frame}</div>`)) : html;
 const each = (v, map) => Array.isArray(v) ? v.map(item => (item && typeof item === 'object' ? map(item) : item)) : v;
 const str = (v) => typeof v === 'string';
+/** The named one-line fields of `o` that hold words, each through `sanitizeLine`. */
+const lines = (o, ...keys) => Object.fromEntries(keys.filter(k => str(o[k])).map(k => [k, sanitizeLine(o[k])]));
 /**
  * The core leaf types' HTML fields, cleaned: `content.text`, `linkGrid` group
- * descriptions, `references` and `events` item text, and a place's note. Every other field those blocks
- * carry renders as a React text node and is escaped already.
+ * descriptions, `references` and `events` item text, and a place's note, by
+ * `clean`; and their one-line fields, a figure's value and label, a quote and
+ * who said it, the events' headings and a place's heading and name, by
+ * `sanitizeLine`. Every other field those blocks carry renders as a React text
+ * node and is escaped already.
  *
  * Returns any other block untouched, so it drops straight into a
  * `mapBlockTree` pass — a repo whose own types render HTML cleans those itself.
@@ -177,10 +206,15 @@ export function sanitizeCoreLeaf(block, clean) {
                 groups: each(b.groups, g => (str(g.description) ? { ...g, description: clean(g.description) } : g)),
             };
         case 'references':
-        case 'events':
             return { ...b, items: each(b.items, i => (str(i.text) ? { ...i, text: clean(i.text) } : i)) };
+        case 'events':
+            return { ...b, ...lines(b, 'upcoming', 'past'), items: each(b.items, i => (str(i.text) ? { ...i, text: clean(i.text) } : i)) };
         case 'locations':
-            return { ...b, items: each(b.items, p => (str(p.note) ? { ...p, note: clean(p.note) } : p)) };
+            return { ...b, ...lines(b, 'heading'), items: each(b.items, p => ({ ...p, ...lines(p, 'name'), ...(str(p.note) && { note: clean(p.note) }) })) };
+        case 'stats':
+            return { ...b, items: each(b.items, s => ({ ...s, ...lines(s, 'value', 'label') })) };
+        case 'testimonial':
+            return { ...b, ...lines(b, 'quote', 'author', 'role') };
         default:
             return block;
     }

package/dist/text.js

@@ -109,11 +109,11 @@ export function codeTabsToText(tabs) {
 }
 /** `“Their words” — Name, role`. @internal */
 export function testimonialToText(quote, author, role) {
-    return `“${quote.trim()}” — ${[author, role].filter(Boolean).join(', ')}`;
+    return `“${stripHtml(quote).trim()}” — ${[author, role].filter(Boolean).map(w => plainText(w)).join(', ')}`;
 }
 /** Metric cards, one per line: `99% Uptime`. @internal */
 export function statsToText(items) {
-    return items.map(s => `${s.value}${s.suffix ?? ''} ${s.label}`).join('\n');
+    return items.map(s => `${plainText(String(s.value))}${s.suffix ?? ''} ${plainText(s.label)}`).join('\n');
 }
 /**
  * Each group's heading over its links, hrefs in parentheses the way

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-formant",
-  "version": "0.98.0",
+  "version": "0.99.0",
   "description": "The portable half of a wiki: derived taxonomy and facet controls, a version-negotiating MCP transport, markdown twins, block rendering, a rich-text editor engine, conditional-GET plumbing, and the headers and CSP every origin sends.",
   "type": "module",
   "license": "MIT",
@@ -327,6 +327,7 @@
     "@tiptap/extension-table-cell": "^2.27.3",
     "@tiptap/extension-table-header": "^2.27.3",
     "@tiptap/extension-table-row": "^2.27.3",
+    "@tiptap/extension-text-style": "^2.27.3",
     "@tiptap/extension-youtube": "^2.27.3",
     "@tiptap/pm": "^2.27.3",
     "@tiptap/react": "^2.27.3",