@tightknitai/block-kitchen 0.6.1-alpha.0 → 0.8.2

package/README.md

@@ -6,6 +6,7 @@
 
 [![CI](https://github.com/TightknitAI/block-kitchen/actions/workflows/ci.yml/badge.svg)](https://github.com/TightknitAI/block-kitchen/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/@tightknitai/block-kitchen.svg)](https://www.npmjs.com/package/@tightknitai/block-kitchen)
+[![minzipped size](https://img.shields.io/bundlephobia/minzip/@tightknitai/block-kitchen)](https://bundlephobia.com/package/@tightknitai/block-kitchen)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![Live demo](https://img.shields.io/badge/demo-live-6366f1)](https://block-kitchen.tightknit.dev)
 
@@ -19,7 +20,7 @@ Inspired by [Slack's Block Kit Builder](https://app.slack.com/block-kit-builder)
   <img src="./assets/screenshot.png" alt="block-kitchen demo screenshot" width="900" />
 </p>
 
-The package owns the entire builder UX — palette, sortable preview surface, per-block popover editors, send dialog. It knows nothing about how channels are listed, who the user is, or how messages are sent. The consumer wires those concerns through callback props. A working end-to-end app is shown in [block-kit-builder-template](https://github.com/TightknitAI/block-kit-builder-template).
+The package owns the entire builder UX — palette, sortable preview surface, per-block popover editors, send dialog. It knows nothing about how channels are listed, who the user is, or how messages are sent. The consumer wires those concerns through callback props. A working end-to-end app is shown in [block-kitchen-template](https://github.com/TightknitAI/block-kitchen-template).
 
 ## Install
 
@@ -27,10 +28,48 @@ The package owns the entire builder UX — palette, sortable preview surface, pe
 pnpm add @tightknitai/block-kitchen
 ```
 
-Peer deps: `react`, `react-dom`.
+Modern package managers (pnpm 8+, npm 7+, yarn berry) auto-install peer
+dependencies — no extra command needed. The peer set is deliberately
+narrow: only the dependencies a typical consumer is likely to *already*
+have, where deduplication gives them a real win:
+
+- `react` `^18 || ^19`, `react-dom` `^18 || ^19`
+- `@radix-ui/react-{dialog,label,popover,radio-group,slot,tooltip}` —
+  the dialog/popover/tooltip/sheet primitives the builder uses. If
+  you already use shadcn/ui you already have these, and peer
+  deduplication avoids two Radix copies (which would split React
+  context — a `<TooltipProvider>` from your copy can't reach a
+  `<Tooltip>` from ours).
+- `lucide-react` — every icon in the toolbar, palette, and editors.
+  Universal in modern React UI stacks; peer keeps a single copy.
+
+Everything else (`@dnd-kit/*`, `@tiptap/*`, `slack-blocks-to-jsx`,
+`@tightknitai/slack-block-kit-validator`) is a regular dependency.
+Most consumers don't already have these, so there's no dedupe benefit
+to forcing them into a peer position — and you don't have to think
+about their versions.
+
+If your package manager doesn't auto-install peers:
+
+```bash
+pnpm add @tightknitai/block-kitchen \
+  react react-dom \
+  @radix-ui/react-dialog @radix-ui/react-label \
+  @radix-ui/react-popover @radix-ui/react-radio-group \
+  @radix-ui/react-slot @radix-ui/react-tooltip \
+  lucide-react
+```
 
 ## Usage
 
+> **Import the stylesheet once, at app root.** The builder mounts
+> dialogs, popovers, tooltips, and the mobile palette sheet via React
+> portals, which render to `document.body` — outside the route tree.
+> If you import `styles.css` inside a single route module, those
+> portal contents will be unstyled on every other route that doesn't
+> import it. Put the import in your root layout (Next.js `app/layout.tsx`,
+> Remix `app/root.tsx`, Vite `src/main.tsx`, etc.).
+
 ```tsx
 import { BlockKitchen } from "@tightknitai/block-kitchen";
 import "@tightknitai/block-kitchen/styles.css";
@@ -71,6 +110,7 @@ export function MyBuilderPage() {
 | `onSend` | `(payload) => Promise<{ ok: boolean; error?: string }>` | yes | Called when the user submits the send dialog. Payload is `{ channelId, blocks, sendAsUser }`. |
 | `previewHooks` | `PreviewHooks` | no | Hooks forwarded to `slack-blocks-to-jsx`'s `<Message>` for resolving user / channel / emoji directives. |
 | `palette` | `PaletteSection[]` | no | The left-hand palette of draggable variants. Defaults to `defaultPalette`. Spread it to filter, reorder, or add your own pre-configured variants — see [Customizing the palette](#customizing-the-palette). |
+| `disabledBlockTypes` | `SupportedBlockType[]` | no | Block types to hide from the palette without rebuilding it. Filters at the variant level — a section keeps any variants whose block types aren't disabled; sections that end up empty are dropped. Convenient when you want the default palette minus a few types (e.g. `['image', 'table']` for a text-only builder). |
 | `defaultOpenSections` | `boolean \| string[]` | no | Which palette section headers are expanded on first paint. `true` (default) opens all sections; `false` collapses all (Slack-style); an array opens only sections whose `name` is in the list (e.g. `['Section', 'Actions']`). The palette also has a built-in search input that expands matching sections on demand. |
 | `showPaletteSearch` | `boolean` | no | Whether the palette renders the quick-search input above the section list. Defaults to `true`. Set `false` for compact palettes (e.g. when you've passed a small custom `palette`) where scanning by eye is faster than typing. |
 | `paletteSearchPlaceholder` | `string` | no | Placeholder text for the palette search input. Defaults to `'Search blocks…'`. Useful for localization. |
@@ -143,7 +183,7 @@ import type {
 
 ## Backend
 
-The builder is frontend-only. For a full app that handles OAuth, channel listing, and `chat.postMessage`, see [block-kit-builder-template](https://github.com/TightknitAI/block-kit-builder-template) — a Vite + React SPA on Cloudflare Workers that wires this package to [slack-hono](https://github.com/TightknitAI/slack-hono) on the backend.
+The builder is frontend-only. For a full app that handles OAuth, channel listing, and `chat.postMessage`, see [block-kitchen-template](https://github.com/TightknitAI/block-kitchen-template) — a Vite + React SPA on Cloudflare Workers that wires this package to [slack-hono](https://github.com/TightknitAI/slack-hono) on the backend.
 
 ## Validation
 
@@ -183,6 +223,85 @@ The lower-level CSS-variable contract above keeps working; the `theme` prop simp
 
 Fonts are deliberately not part of `BrandTheme`. The builder sets no `font-family` of its own (aside from `font-mono` on the JSON viewer, which is intentional), so it inherits whatever the host page declares on `<html>` or `<body>`. Set your brand typography globally and the builder will pick it up automatically — no additional configuration needed. The Slack preview surface continues to render with Slack's own typography via `slack-blocks-to-jsx`.
 
+## Frameworks & SSR
+
+The builder is client-only by design — it uses drag sensors, contentEditable
+(TipTap), portals, and `useEffect`-driven state. It cannot be statically
+rendered on the server. The component still ships fine inside SSR/SSG
+frameworks; just mark its tree as client-side.
+
+- **Next.js (App Router)** — put `'use client'` at the top of the file
+  that renders `<BlockKitchen>`. Import `styles.css` from
+  `app/layout.tsx` (the root layout) so portal content stays styled
+  on every route.
+- **Next.js (Pages Router)** — render the component inside a page
+  module; the bundled-client default works. Import `styles.css` from
+  `pages/_app.tsx`.
+- **Remix / React Router** — render inside any route component;
+  put the `styles.css` import in `app/root.tsx`. If you ship the
+  builder on a single route, import the stylesheet there *and*
+  in `root.tsx` so portals on other routes don't render unstyled.
+- **Vite SPA** — import `styles.css` once from `src/main.tsx`.
+- **Astro** — load the React component with `client:only="react"`.
+
+The package exports React JSX with the automatic runtime, so any
+JSX-transform-aware bundler from the last few years works without
+extra configuration.
+
+## Subpath exports
+
+Three import paths are published:
+
+```ts
+// 1. Full builder (default)
+import { BlockKitchen } from "@tightknitai/block-kitchen";
+
+// 2. Headless helpers — no React component tree, safe for backends.
+//    Use this when you only need to round-trip / validate / encode
+//    blocks (e.g. inside a Worker that calls Slack's chat.postMessage).
+import {
+  toSlackBlocks,
+  encodeBlocksToString,
+  decodeBlocksFromString,
+} from "@tightknitai/block-kitchen/helpers";
+
+// 3. Palette catalog — for tooling that needs the default variants
+//    (e.g. a Storybook story or a config generator) without pulling
+//    in the builder.
+import {
+  defaultPalette,
+  legacyInputVariants,
+  extraAlertVariant,
+} from "@tightknitai/block-kitchen/palette";
+```
+
+The root entry (`.`) still re-exports everything from `./helpers` and
+`./palette`, so existing imports keep working — the subpaths are a tree-
+shaking-friendly shortcut, not a breaking split.
+
+## Cascade layer ordering (Tailwind users)
+
+The stylesheet emits all utility classes into a named cascade layer:
+
+```css
+@layer bk-theme, bk-utilities;
+```
+
+Per CSS Cascade Level 5, unlayered rules and rules in later-declared
+layers win over `bk-utilities`. In practice this means a consumer who
+imports both this package's `styles.css` and their own Tailwind output
+will see *their* utilities win on any class-name collision (e.g. they
+define `bg-background` differently). No action needed for that
+common case.
+
+If you want explicit control — for example, to make this package's
+utilities win, or to layer them alongside a `shadcn/ui` token stack —
+declare the order at the top of your own root stylesheet:
+
+```css
+@layer bk-theme, bk-utilities, theme, base, components, utilities;
+```
+
 ## License
 
 MIT. See [LICENSE](./LICENSE).

package/dist/helpers.cjs

@@ -0,0 +1,171 @@
+'use strict';
+
+// src/lib/url-safety.ts
+var SAFE_LINK_PROTOCOLS = /^(https?|ircs?|mailto|tel|sms|xmpp)$/i;
+var SAFE_IMAGE_PROTOCOLS = /^(https?)$/i;
+var SAFE_IMAGE_DATA_PREFIX = /^data:image\/(?:png|jpeg|jpg|gif|webp|avif|x-icon|vnd\.microsoft\.icon)(?:;[a-z0-9-]+(?:=[^,;]*)?)*,/i;
+function getScheme(value) {
+  const trimmed = value.replace(/^\s+/, "");
+  const colon = trimmed.indexOf(":");
+  if (colon === -1) {
+    return null;
+  }
+  const slash = trimmed.indexOf("/");
+  const question = trimmed.indexOf("?");
+  const hash = trimmed.indexOf("#");
+  if (slash !== -1 && slash < colon || question !== -1 && question < colon || hash !== -1 && hash < colon) {
+    return null;
+  }
+  return trimmed.slice(0, colon).toLowerCase();
+}
+function isSafeHref(value) {
+  if (value === null || value === void 0) {
+    return false;
+  }
+  if (typeof value !== "string") {
+    return false;
+  }
+  if (value.length === 0) {
+    return true;
+  }
+  const scheme = getScheme(value);
+  if (scheme === null) {
+    return true;
+  }
+  return SAFE_LINK_PROTOCOLS.test(scheme);
+}
+function isSafeImageSrc(value) {
+  if (value === null || value === void 0) {
+    return false;
+  }
+  if (typeof value !== "string") {
+    return false;
+  }
+  if (value.length === 0) {
+    return true;
+  }
+  const scheme = getScheme(value);
+  if (scheme === null) {
+    return true;
+  }
+  if (scheme === "data") {
+    return SAFE_IMAGE_DATA_PREFIX.test(value);
+  }
+  return SAFE_IMAGE_PROTOCOLS.test(scheme);
+}
+function sanitizeHref(value) {
+  return isSafeHref(value) ? value ?? "" : "";
+}
+function sanitizeImageSrc(value) {
+  return isSafeImageSrc(value) ? value ?? "" : "";
+}
+
+// src/lib/sanitize-blocks.ts
+var HREF_KEYS = /* @__PURE__ */ new Set(["url"]);
+var IMAGE_KEYS = /* @__PURE__ */ new Set(["image_url"]);
+function sanitizeValue(value) {
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const out = new Array(value.length);
+    for (let i = 0; i < value.length; i++) {
+      const next = sanitizeValue(value[i]);
+      if (next !== value[i]) {
+        changed = true;
+      }
+      out[i] = next;
+    }
+    return changed ? out : value;
+  }
+  const src = value;
+  let copy = null;
+  for (const key of Object.keys(src)) {
+    const original = src[key];
+    let next = original;
+    if (typeof original === "string") {
+      if (HREF_KEYS.has(key)) {
+        next = sanitizeHref(original);
+      } else if (IMAGE_KEYS.has(key)) {
+        next = sanitizeImageSrc(original);
+      }
+    } else if (typeof original === "object" && original !== null) {
+      next = sanitizeValue(original);
+    }
+    if (next !== original) {
+      if (!copy) {
+        copy = { ...src };
+      }
+      copy[key] = next;
+    }
+  }
+  return copy ?? src;
+}
+function sanitizeBlock(block) {
+  return sanitizeValue(block);
+}
+
+// src/lib/to-slack-blocks.ts
+function toSlackBlocks(blocks) {
+  return blocks.map((block) => {
+    const safe = sanitizeBlock(block);
+    if (safe.type === "header" && "level" in safe) {
+      const { level: _omit, ...rest } = safe;
+      return rest;
+    }
+    return safe;
+  });
+}
+
+// src/lib/url-state.ts
+var MAX_ENCODED_BYTES = 1024 * 1024;
+function encodeBlocksToString(blocks) {
+  if (blocks.length === 0) {
+    return "";
+  }
+  const json = JSON.stringify(blocks);
+  const utf8Bytes = new TextEncoder().encode(json);
+  const chars = new Array(utf8Bytes.length);
+  for (let i = 0; i < utf8Bytes.length; i++) {
+    chars[i] = String.fromCharCode(utf8Bytes[i]);
+  }
+  return toBase64Url(btoa(chars.join("")));
+}
+function decodeBlocksFromString(encoded) {
+  if (!encoded) {
+    return null;
+  }
+  if (encoded.length > MAX_ENCODED_BYTES) {
+    return null;
+  }
+  try {
+    const binary = atob(fromBase64Url(encoded));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    const json = new TextDecoder().decode(bytes);
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function toBase64Url(b64) {
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(b64url) {
+  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padLen = (4 - b64.length % 4) % 4;
+  return b64 + "=".repeat(padLen);
+}
+
+exports.decodeBlocksFromString = decodeBlocksFromString;
+exports.encodeBlocksToString = encodeBlocksToString;
+exports.toSlackBlocks = toSlackBlocks;
+//# sourceMappingURL=helpers.cjs.map
+//# sourceMappingURL=helpers.cjs.map

package/dist/helpers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/url-safety.ts","../src/lib/sanitize-blocks.ts","../src/lib/to-slack-blocks.ts","../src/lib/url-state.ts"],"names":[],"mappings":";;;AAqBA,IAAM,mBAAA,GAAsB,uCAAA;AAQ5B,IAAM,oBAAA,GAAuB,aAAA;AAK7B,IAAM,sBAAA,GACJ,uGAAA;AAWF,SAAS,UAAU,KAAA,EAA8B;AAI/C,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACjC,EAAA,IAAI,UAAU,EAAA,EAAI;AAChB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACjC,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAIhC,EAAA,IAAK,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,KAAA,IAAW,QAAA,KAAa,EAAA,IAAM,QAAA,GAAW,KAAA,IAAW,IAAA,KAAS,EAAA,IAAM,IAAA,GAAO,KAAA,EAAQ;AAC7G,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,KAAK,EAAE,WAAA,EAAY;AAC7C;AAeO,SAAS,WAAW,KAAA,EAA2C;AACpE,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzC,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,UAAU,KAAK,CAAA;AAC9B,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,mBAAA,CAAoB,KAAK,MAAM,CAAA;AACxC;AAUO,SAAS,eAAe,KAAA,EAA2C;AACxE,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzC,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,UAAU,KAAK,CAAA;AAC9B,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,sBAAA,CAAuB,KAAK,KAAK,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,oBAAA,CAAqB,KAAK,MAAM,CAAA;AACzC;AASO,SAAS,aAAa,KAAA,EAA0C;AACrE,EAAA,OAAO,UAAA,CAAW,KAAK,CAAA,GAAK,KAAA,IAAS,EAAA,GAAM,EAAA;AAC7C;AAQO,SAAS,iBAAiB,KAAA,EAA0C;AACzE,EAAA,OAAO,cAAA,CAAe,KAAK,CAAA,GAAK,KAAA,IAAS,EAAA,GAAM,EAAA;AACjD;;;AC/HA,IAAM,SAAA,mBAAY,IAAI,GAAA,CAAI,CAAC,KAAK,CAAC,CAAA;AACjC,IAAM,UAAA,mBAAa,IAAI,GAAA,CAAI,CAAC,WAAW,CAAC,CAAA;AAWxC,SAAS,cAAc,KAAA,EAAyB;AAC9C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA;AAClC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,MAAA,MAAM,IAAA,GAAO,aAAA,CAAc,KAAA,CAAM,CAAC,CAAC,CAAA;AACnC,MAAA,IAAI,IAAA,KAAS,KAAA,CAAM,CAAC,CAAA,EAAG;AACrB,QAAA,OAAA,GAAU,IAAA;AAAA,MACZ;AACA,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA;AAAA,IACX;AACA,IAAA,OAAO,UAAU,GAAA,GAAM,KAAA;AAAA,EACzB;AACA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,IAAI,IAAA,GAAuC,IAAA;AAC3C,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,IAAI,GAAG,CAAA;AACxB,IAAA,IAAI,IAAA,GAAgB,QAAA;AACpB,IAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,MAAA,IAAI,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,QAAA,IAAA,GAAO,aAAa,QAAQ,CAAA;AAAA,MAC9B,CAAA,MAAA,IAAW,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AAC9B,QAAA,IAAA,GAAO,iBAAiB,QAAQ,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,QAAA,KAAa,QAAA,IAAY,aAAa,IAAA,EAAM;AAC5D,MAAA,IAAA,GAAO,cAAc,QAAQ,CAAA;AAAA,IAC/B;AACA,IAAA,IAAI,SAAS,QAAA,EAAU;AACrB,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,IAAA,GAAO,EAAE,GAAG,GAAA,EAAI;AAAA,MAClB;AACA,MAAA,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO,IAAA,IAAQ,GAAA;AACjB;AAQO,SAAS,cAAwC,KAAA,EAAa;AACnE,EAAA,OAAO,cAAc,KAAK,CAAA;AAC5B;;;AC9DO,SAAS,cAAc,MAAA,EAA4C;AACxE,EAAA,OAAO,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,KAAU;AAC3B,IAAA,MAAM,IAAA,GAAO,cAAc,KAAK,CAAA;AAChC,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,OAAA,IAAW,IAAA,EAAM;AAC7C,MAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,GAAG,MAAK,GAAI,IAAA;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACH;;;ACdA,IAAM,oBAAoB,IAAA,GAAO,IAAA;AAW1B,SAAS,qBAAqB,MAAA,EAAkC;AACrE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,OAAO,EAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAc,SAAA,CAAU,MAAM,CAAA;AAChD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,YAAA,CAAa,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,YAAY,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,EAAE,CAAC,CAAC,CAAA;AACzC;AAQO,SAAS,uBAAuB,OAAA,EAA6D;AAClG,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,iBAAA,EAAmB;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,aAAA,CAAc,OAAO,CAAC,CAAA;AAC1C,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,IAChC;AACA,IAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOA,SAAS,YAAY,GAAA,EAAqB;AACxC,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtE;AAOA,SAAS,cAAc,MAAA,EAAwB;AAC7C,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACvD,EAAA,MAAM,MAAA,GAAA,CAAU,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAA;AACxC,EAAA,OAAO,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAChC","file":"helpers.cjs","sourcesContent":["/**\n * URL-scheme allowlists used as a defense-in-depth layer against\n * DOM-XSS via user-supplied URLs that flow into `<a href>` and `<img src>`\n * in the preview (rendered by `slack-blocks-to-jsx`, which does not\n * filter URI schemes itself) or in the builder's own chrome (e.g. the\n * \"Sign in with Slack\" link in `SendDialog`).\n *\n * `format: \"uri\"` on the validator schema (AJV / ajv-formats) accepts\n * any RFC-3986 URI including `javascript:` and `data:`, so the validator\n * cannot be relied on for this purpose.\n *\n * Mirrors react-markdown 9's `defaultUrlTransform` approach: parse the\n * scheme, allow the safe set, and treat anything without a recognized\n * scheme as a relative URL (preserved as-is).\n */\n\n/**\n * Schemes safe to use as an `<a href>` target.\n * Mirrors react-markdown's `safeProtocol` set (`https?|ircs?|mailto|xmpp`)\n * plus `tel` and `sms` (Slack's documented link types).\n */\nconst SAFE_LINK_PROTOCOLS = /^(https?|ircs?|mailto|tel|sms|xmpp)$/i;\n\n/**\n * Schemes safe to use as an `<img src>` source. We allow `data:image/*`\n * because Slack itself emits inline images that way for some emoji and\n * file thumbnails; everything else (e.g. `data:text/html`, `data:image/svg+xml`\n * — which can carry script in some contexts) is rejected.\n */\nconst SAFE_IMAGE_PROTOCOLS = /^(https?)$/i;\n// Allow `data:image/<safe-mime>` followed by any sequence of media-type\n// parameters. Each parameter is `;<name>` or `;<name>=<value>` (RFC 2397\n// allows the bare `;base64` token, which has no `=`). The comma\n// terminates the parameter list and starts the payload.\nconst SAFE_IMAGE_DATA_PREFIX =\n  /^data:image\\/(?:png|jpeg|jpg|gif|webp|avif|x-icon|vnd\\.microsoft\\.icon)(?:;[a-z0-9-]+(?:=[^,;]*)?)*,/i;\n\n/**\n * Splits a URL into its scheme prefix and tail without invoking the\n * `URL` constructor (which throws on relative URLs and varies in how\n * it normalizes whitespace and unicode). Matches react-markdown's\n * approach: look for the first `:`, `?`, `#`, or `/`; if `:` comes\n * first, that prefix is the scheme.\n * @param value - the candidate URL\n * @returns the lowercase scheme if the URL is absolute, or `null` if relative\n */\nfunction getScheme(value: string): string | null {\n  // Strip leading whitespace so `\\tjavascript:` and ` javascript:`\n  // still resolve to the `javascript` scheme; browsers ignore leading\n  // whitespace when following an href, so the sanitizer must too.\n  const trimmed = value.replace(/^\\s+/, '');\n  const colon = trimmed.indexOf(':');\n  if (colon === -1) {\n    return null;\n  }\n  const slash = trimmed.indexOf('/');\n  const question = trimmed.indexOf('?');\n  const hash = trimmed.indexOf('#');\n  // If any of `/`, `?`, `#` appears before the `:`, then the `:` is\n  // inside the path/query/fragment, not a scheme delimiter — treat the\n  // URL as relative.\n  if ((slash !== -1 && slash < colon) || (question !== -1 && question < colon) || (hash !== -1 && hash < colon)) {\n    return null;\n  }\n  return trimmed.slice(0, colon).toLowerCase();\n}\n\n/**\n * Returns true when `value` is safe to use as an `<a href>` target.\n * Accepts:\n *  - absolute URLs whose scheme is in the safe-link allowlist\n *    (`http`, `https`, `ircs?`, `mailto`, `tel`, `sms`, `xmpp`).\n *  - relative URLs (no scheme).\n *  - empty string (caller decides whether to render).\n *\n * Rejects `javascript:`, `data:`, `vbscript:`, `file:`, `about:`,\n * and any other unrecognized scheme.\n * @param value - the candidate URL\n * @returns true when the URL is safe to render as a link\n */\nexport function isSafeHref(value: string | null | undefined): boolean {\n  if (value === null || value === undefined) {\n    return false;\n  }\n  if (typeof value !== 'string') {\n    return false;\n  }\n  if (value.length === 0) {\n    return true;\n  }\n  const scheme = getScheme(value);\n  if (scheme === null) {\n    return true;\n  }\n  return SAFE_LINK_PROTOCOLS.test(scheme);\n}\n\n/**\n * Returns true when `value` is safe to use as an `<img src>`.\n * Accepts http(s), relative URLs, empty string, and `data:image/*`\n * URLs whose MIME subtype is in a tight allowlist. Rejects\n * `data:image/svg+xml` (can carry script) and everything else.\n * @param value - the candidate URL\n * @returns true when the URL is safe to render as an image\n */\nexport function isSafeImageSrc(value: string | null | undefined): boolean {\n  if (value === null || value === undefined) {\n    return false;\n  }\n  if (typeof value !== 'string') {\n    return false;\n  }\n  if (value.length === 0) {\n    return true;\n  }\n  const scheme = getScheme(value);\n  if (scheme === null) {\n    return true;\n  }\n  if (scheme === 'data') {\n    return SAFE_IMAGE_DATA_PREFIX.test(value);\n  }\n  return SAFE_IMAGE_PROTOCOLS.test(scheme);\n}\n\n/**\n * Returns `value` if it passes {@link isSafeHref}, otherwise an empty\n * string. Use at render time / payload boundaries so an unsafe URL\n * never reaches the DOM as an `href` attribute.\n * @param value - the candidate URL\n * @returns the URL if safe, or `''`\n */\nexport function sanitizeHref(value: string | null | undefined): string {\n  return isSafeHref(value) ? (value ?? '') : '';\n}\n\n/**\n * Returns `value` if it passes {@link isSafeImageSrc}, otherwise an\n * empty string. Use at render time / payload boundaries.\n * @param value - the candidate URL\n * @returns the URL if safe, or `''`\n */\nexport function sanitizeImageSrc(value: string | null | undefined): string {\n  return isSafeImageSrc(value) ? (value ?? '') : '';\n}\n","import type { SupportedBlock } from '../types';\nimport { sanitizeHref, sanitizeImageSrc } from './url-safety';\n\n/**\n * Recursively walks an unknown value and rewrites string values at the\n * specified keys via the matching sanitizer. Used to strip dangerous\n * URI schemes (e.g. `javascript:`) from `url`, `image_url`, and\n * rich-text link `url` fields before a Block Kit payload reaches a\n * renderer or is handed back to the consumer.\n *\n * Allocates a new object whenever a child is rewritten; otherwise\n * returns the input unchanged so unaffected payloads are reference-stable.\n *\n * Defensive against prototype-polluted shapes: copies are made via\n * `Object.assign({}, ...)` over own enumerable keys returned by\n * `Object.keys`, which skips inherited properties.\n */\nconst HREF_KEYS = new Set(['url']);\nconst IMAGE_KEYS = new Set(['image_url']);\n\n/**\n * Recursively sanitize all known URL-bearing string fields inside a\n * Slack Block Kit payload fragment. Returns a value with the same\n * structural shape, where any field whose name matches an href or\n * image-src key has been replaced by the safe variant (`''` if the\n * original scheme was unsafe).\n * @param value - any payload fragment (object, array, primitive)\n * @returns the sanitized payload fragment\n */\nfunction sanitizeValue(value: unknown): unknown {\n  if (value === null || typeof value !== 'object') {\n    return value;\n  }\n  if (Array.isArray(value)) {\n    let changed = false;\n    const out = new Array(value.length);\n    for (let i = 0; i < value.length; i++) {\n      const next = sanitizeValue(value[i]);\n      if (next !== value[i]) {\n        changed = true;\n      }\n      out[i] = next;\n    }\n    return changed ? out : value;\n  }\n  const src = value as Record<string, unknown>;\n  let copy: Record<string, unknown> | null = null;\n  for (const key of Object.keys(src)) {\n    const original = src[key];\n    let next: unknown = original;\n    if (typeof original === 'string') {\n      if (HREF_KEYS.has(key)) {\n        next = sanitizeHref(original);\n      } else if (IMAGE_KEYS.has(key)) {\n        next = sanitizeImageSrc(original);\n      }\n    } else if (typeof original === 'object' && original !== null) {\n      next = sanitizeValue(original);\n    }\n    if (next !== original) {\n      if (!copy) {\n        copy = { ...src };\n      }\n      copy[key] = next;\n    }\n  }\n  return copy ?? src;\n}\n\n/**\n * Sanitize a single Block Kit block, scrubbing dangerous URI schemes\n * from `url` and `image_url` fields anywhere in the payload tree.\n * @param block - the block payload to sanitize\n * @returns the sanitized block (same reference if nothing changed)\n */\nexport function sanitizeBlock<T extends SupportedBlock>(block: T): T {\n  return sanitizeValue(block) as T;\n}\n\n/**\n * Sanitize an array of Block Kit blocks. See {@link sanitizeBlock}.\n * @param blocks - the block payloads to sanitize\n * @returns the sanitized blocks\n */\nexport function sanitizeBlocks(blocks: SupportedBlock[]): SupportedBlock[] {\n  let changed = false;\n  const out = new Array<SupportedBlock>(blocks.length);\n  for (let i = 0; i < blocks.length; i++) {\n    const next = sanitizeBlock(blocks[i]);\n    if (next !== blocks[i]) {\n      changed = true;\n    }\n    out[i] = next;\n  }\n  return changed ? out : blocks;\n}\n","import type { SupportedBlock } from '../types';\nimport { sanitizeBlock } from './sanitize-blocks';\n\n/**\n * Strip builder-only fields from blocks so they conform to Slack's\n * Block Kit schema, and scrub dangerous URI schemes from any\n * `url`/`image_url` fields. Currently removes the cosmetic `level`\n * field from header blocks (a builder-only extension Slack would\n * reject) and routes every URL/image-url through the allowlist in\n * `lib/url-safety.ts` so a payload that round-trips through the\n * builder cannot carry `javascript:`/`data:text/html` URIs to a\n * downstream consumer or to the Slack API.\n * @param blocks - the working draft blocks\n * @returns blocks with builder-only fields removed and URLs scrubbed\n */\nexport function toSlackBlocks(blocks: SupportedBlock[]): SupportedBlock[] {\n  return blocks.map((block) => {\n    const safe = sanitizeBlock(block);\n    if (safe.type === 'header' && 'level' in safe) {\n      const { level: _omit, ...rest } = safe;\n      return rest as SupportedBlock;\n    }\n    return safe;\n  });\n}\n","import type { SupportedBlock } from '../types';\n\n/**\n * Upper bound on the encoded string length we accept on decode. Block\n * Kit JSON in practice is well under 100 KB; we cap at 1 MiB of encoded\n * input so a pathologically large URL hash cannot freeze the tab in\n * `atob` + `JSON.parse` before the validator gets a look. Encoded\n * (base64url) is ~33% larger than the binary, so this bounds the decoded\n * JSON at roughly 768 KiB.\n */\nconst MAX_ENCODED_BYTES = 1024 * 1024;\n\n/**\n * Encodes a block list to a base64url string suitable for use as a URL\n * search param. The consumer chooses where to put it (search param, hash,\n * localStorage, etc).\n * Returns an empty string for an empty list so the consumer can omit the\n * param entirely.\n * @param blocks - the blocks to encode\n * @returns base64url-encoded JSON, or '' if blocks is empty\n */\nexport function encodeBlocksToString(blocks: SupportedBlock[]): string {\n  if (blocks.length === 0) {\n    return '';\n  }\n  const json = JSON.stringify(blocks);\n  const utf8Bytes = new TextEncoder().encode(json);\n  const chars = new Array<string>(utf8Bytes.length);\n  for (let i = 0; i < utf8Bytes.length; i++) {\n    chars[i] = String.fromCharCode(utf8Bytes[i]);\n  }\n  return toBase64Url(btoa(chars.join('')));\n}\n\n/**\n * Decodes a string produced by {@link encodeBlocksToString} back to a\n * block list. Returns null on any decode/parse error.\n * @param encoded - the encoded string\n * @returns decoded blocks, or null if input is empty/invalid\n */\nexport function decodeBlocksFromString(encoded: string | undefined | null): SupportedBlock[] | null {\n  if (!encoded) {\n    return null;\n  }\n  if (encoded.length > MAX_ENCODED_BYTES) {\n    return null;\n  }\n  try {\n    const binary = atob(fromBase64Url(encoded));\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    const json = new TextDecoder().decode(bytes);\n    const parsed = JSON.parse(json);\n    if (!Array.isArray(parsed)) {\n      return null;\n    }\n    return parsed as SupportedBlock[];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Converts a standard base64 string to base64url (URL-safe alphabet, no padding).\n * @param b64 - standard base64-encoded string\n * @returns the base64url-encoded equivalent\n */\nfunction toBase64Url(b64: string): string {\n  return b64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Converts a base64url string back to standard base64 with padding restored.\n * @param b64url - base64url-encoded string\n * @returns the standard base64 equivalent\n */\nfunction fromBase64Url(b64url: string): string {\n  const b64 = b64url.replace(/-/g, '+').replace(/_/g, '/');\n  const padLen = (4 - (b64.length % 4)) % 4;\n  return b64 + '='.repeat(padLen);\n}\n"]}

package/dist/helpers.d.cts

@@ -0,0 +1,38 @@
+import { t as SupportedBlock } from './palette-CTUROcUC.cjs';
+export { u as SupportedBlockType } from './palette-CTUROcUC.cjs';
+import 'react';
+import 'slack-web-api-client';
+
+/**
+ * Strip builder-only fields from blocks so they conform to Slack's
+ * Block Kit schema, and scrub dangerous URI schemes from any
+ * `url`/`image_url` fields. Currently removes the cosmetic `level`
+ * field from header blocks (a builder-only extension Slack would
+ * reject) and routes every URL/image-url through the allowlist in
+ * `lib/url-safety.ts` so a payload that round-trips through the
+ * builder cannot carry `javascript:`/`data:text/html` URIs to a
+ * downstream consumer or to the Slack API.
+ * @param blocks - the working draft blocks
+ * @returns blocks with builder-only fields removed and URLs scrubbed
+ */
+declare function toSlackBlocks(blocks: SupportedBlock[]): SupportedBlock[];
+
+/**
+ * Encodes a block list to a base64url string suitable for use as a URL
+ * search param. The consumer chooses where to put it (search param, hash,
+ * localStorage, etc).
+ * Returns an empty string for an empty list so the consumer can omit the
+ * param entirely.
+ * @param blocks - the blocks to encode
+ * @returns base64url-encoded JSON, or '' if blocks is empty
+ */
+declare function encodeBlocksToString(blocks: SupportedBlock[]): string;
+/**
+ * Decodes a string produced by {@link encodeBlocksToString} back to a
+ * block list. Returns null on any decode/parse error.
+ * @param encoded - the encoded string
+ * @returns decoded blocks, or null if input is empty/invalid
+ */
+declare function decodeBlocksFromString(encoded: string | undefined | null): SupportedBlock[] | null;
+
+export { SupportedBlock, decodeBlocksFromString, encodeBlocksToString, toSlackBlocks };

package/dist/helpers.d.ts

@@ -0,0 +1,38 @@
+import { t as SupportedBlock } from './palette-CTUROcUC.js';
+export { u as SupportedBlockType } from './palette-CTUROcUC.js';
+import 'react';
+import 'slack-web-api-client';
+
+/**
+ * Strip builder-only fields from blocks so they conform to Slack's
+ * Block Kit schema, and scrub dangerous URI schemes from any
+ * `url`/`image_url` fields. Currently removes the cosmetic `level`
+ * field from header blocks (a builder-only extension Slack would
+ * reject) and routes every URL/image-url through the allowlist in
+ * `lib/url-safety.ts` so a payload that round-trips through the
+ * builder cannot carry `javascript:`/`data:text/html` URIs to a
+ * downstream consumer or to the Slack API.
+ * @param blocks - the working draft blocks
+ * @returns blocks with builder-only fields removed and URLs scrubbed
+ */
+declare function toSlackBlocks(blocks: SupportedBlock[]): SupportedBlock[];
+
+/**
+ * Encodes a block list to a base64url string suitable for use as a URL
+ * search param. The consumer chooses where to put it (search param, hash,
+ * localStorage, etc).
+ * Returns an empty string for an empty list so the consumer can omit the
+ * param entirely.
+ * @param blocks - the blocks to encode
+ * @returns base64url-encoded JSON, or '' if blocks is empty
+ */
+declare function encodeBlocksToString(blocks: SupportedBlock[]): string;
+/**
+ * Decodes a string produced by {@link encodeBlocksToString} back to a
+ * block list. Returns null on any decode/parse error.
+ * @param encoded - the encoded string
+ * @returns decoded blocks, or null if input is empty/invalid
+ */
+declare function decodeBlocksFromString(encoded: string | undefined | null): SupportedBlock[] | null;
+
+export { SupportedBlock, decodeBlocksFromString, encodeBlocksToString, toSlackBlocks };

package/dist/helpers.js

@@ -0,0 +1,167 @@
+// src/lib/url-safety.ts
+var SAFE_LINK_PROTOCOLS = /^(https?|ircs?|mailto|tel|sms|xmpp)$/i;
+var SAFE_IMAGE_PROTOCOLS = /^(https?)$/i;
+var SAFE_IMAGE_DATA_PREFIX = /^data:image\/(?:png|jpeg|jpg|gif|webp|avif|x-icon|vnd\.microsoft\.icon)(?:;[a-z0-9-]+(?:=[^,;]*)?)*,/i;
+function getScheme(value) {
+  const trimmed = value.replace(/^\s+/, "");
+  const colon = trimmed.indexOf(":");
+  if (colon === -1) {
+    return null;
+  }
+  const slash = trimmed.indexOf("/");
+  const question = trimmed.indexOf("?");
+  const hash = trimmed.indexOf("#");
+  if (slash !== -1 && slash < colon || question !== -1 && question < colon || hash !== -1 && hash < colon) {
+    return null;
+  }
+  return trimmed.slice(0, colon).toLowerCase();
+}
+function isSafeHref(value) {
+  if (value === null || value === void 0) {
+    return false;
+  }
+  if (typeof value !== "string") {
+    return false;
+  }
+  if (value.length === 0) {
+    return true;
+  }
+  const scheme = getScheme(value);
+  if (scheme === null) {
+    return true;
+  }
+  return SAFE_LINK_PROTOCOLS.test(scheme);
+}
+function isSafeImageSrc(value) {
+  if (value === null || value === void 0) {
+    return false;
+  }
+  if (typeof value !== "string") {
+    return false;
+  }
+  if (value.length === 0) {
+    return true;
+  }
+  const scheme = getScheme(value);
+  if (scheme === null) {
+    return true;
+  }
+  if (scheme === "data") {
+    return SAFE_IMAGE_DATA_PREFIX.test(value);
+  }
+  return SAFE_IMAGE_PROTOCOLS.test(scheme);
+}
+function sanitizeHref(value) {
+  return isSafeHref(value) ? value ?? "" : "";
+}
+function sanitizeImageSrc(value) {
+  return isSafeImageSrc(value) ? value ?? "" : "";
+}
+
+// src/lib/sanitize-blocks.ts
+var HREF_KEYS = /* @__PURE__ */ new Set(["url"]);
+var IMAGE_KEYS = /* @__PURE__ */ new Set(["image_url"]);
+function sanitizeValue(value) {
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const out = new Array(value.length);
+    for (let i = 0; i < value.length; i++) {
+      const next = sanitizeValue(value[i]);
+      if (next !== value[i]) {
+        changed = true;
+      }
+      out[i] = next;
+    }
+    return changed ? out : value;
+  }
+  const src = value;
+  let copy = null;
+  for (const key of Object.keys(src)) {
+    const original = src[key];
+    let next = original;
+    if (typeof original === "string") {
+      if (HREF_KEYS.has(key)) {
+        next = sanitizeHref(original);
+      } else if (IMAGE_KEYS.has(key)) {
+        next = sanitizeImageSrc(original);
+      }
+    } else if (typeof original === "object" && original !== null) {
+      next = sanitizeValue(original);
+    }
+    if (next !== original) {
+      if (!copy) {
+        copy = { ...src };
+      }
+      copy[key] = next;
+    }
+  }
+  return copy ?? src;
+}
+function sanitizeBlock(block) {
+  return sanitizeValue(block);
+}
+
+// src/lib/to-slack-blocks.ts
+function toSlackBlocks(blocks) {
+  return blocks.map((block) => {
+    const safe = sanitizeBlock(block);
+    if (safe.type === "header" && "level" in safe) {
+      const { level: _omit, ...rest } = safe;
+      return rest;
+    }
+    return safe;
+  });
+}
+
+// src/lib/url-state.ts
+var MAX_ENCODED_BYTES = 1024 * 1024;
+function encodeBlocksToString(blocks) {
+  if (blocks.length === 0) {
+    return "";
+  }
+  const json = JSON.stringify(blocks);
+  const utf8Bytes = new TextEncoder().encode(json);
+  const chars = new Array(utf8Bytes.length);
+  for (let i = 0; i < utf8Bytes.length; i++) {
+    chars[i] = String.fromCharCode(utf8Bytes[i]);
+  }
+  return toBase64Url(btoa(chars.join("")));
+}
+function decodeBlocksFromString(encoded) {
+  if (!encoded) {
+    return null;
+  }
+  if (encoded.length > MAX_ENCODED_BYTES) {
+    return null;
+  }
+  try {
+    const binary = atob(fromBase64Url(encoded));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    const json = new TextDecoder().decode(bytes);
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function toBase64Url(b64) {
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(b64url) {
+  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padLen = (4 - b64.length % 4) % 4;
+  return b64 + "=".repeat(padLen);
+}
+
+export { decodeBlocksFromString, encodeBlocksToString, toSlackBlocks };
+//# sourceMappingURL=helpers.js.map
+//# sourceMappingURL=helpers.js.map