@nowline/embed 0.4.1 → 0.5.0

package/dist/share.d.ts

@@ -0,0 +1,45 @@
+export declare const DEFAULT_SHARE_BASE = "https://free.nowline.io/open";
+/**
+ * The `share` initialize option selects where share links point.
+ *
+ * - `true` — use DEFAULT_SHARE_BASE (the default).
+ * - `string` — a base URL with optional path; built via the URL API so
+ *   `https://foo.com/open` → `https://foo.com/open#text=…`.
+ * - `false` / `'none'` — disable the share anchor entirely.
+ * - `{ textUrl, remoteUrl }` — escape hatch for non-hash URL shapes;
+ *   `{text}` substituted with the base64url payload, `{url}` with the
+ *   percent-encoded source URL.
+ */
+export type ShareOption = boolean | 'none' | string | {
+    textUrl: string;
+    remoteUrl: string;
+};
+/**
+ * Encode source text → `#text=<base64url(zlib(utf8(source)))>`.
+ *
+ * The return value includes the `#text=` key so callers can use it
+ * directly as a URL fragment.
+ *
+ * Sync, single code path, no feature-detect.
+ */
+export declare function encodeText(source: string): string;
+export interface BuildShareLinkOptions {
+    /** The roadmap source text (used to build the #text= fragment). */
+    source: string;
+    /**
+     * Resolved source URL for the block (per-block → global → undefined).
+     * Only `https:` URLs are emitted as `#url=`; anything else falls
+     * back to the inline `#text=` encoding.
+     */
+    sourceUrl?: string | undefined;
+    /** The `share` option from InitializeOptions. */
+    share: ShareOption;
+}
+/**
+ * Build the full "Share on Nowline" URL for a rendered block.
+ *
+ * Returns `null` when `share` is `false` or `'none'`, signalling that
+ * no anchor should be rendered.
+ */
+export declare function buildShareLink({ source, sourceUrl, share }: BuildShareLinkOptions): string | null;
+//# sourceMappingURL=share.d.ts.map

package/dist/share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../src/share.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAgBD,MAAM,WAAW,qBAAqB;IAClC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iDAAiD;IACjD,KAAK,EAAE,WAAW,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAwBjG"}

package/dist/share.js

@@ -0,0 +1,75 @@
+// Share-link generation for the "Share on Nowline" anchor that the
+// auto-scan loop appends after each rendered SVG.
+//
+// Encoding grammar (normative — defined in specs/embed.md):
+//   #text=base64url(zlib(utf8(source)))
+//   #url=<https-url>
+//
+// zlib = RFC 1950 via fflate zlibSync (byte-compatible with native
+// CompressionStream('deflate')); base64url strips padding and maps
+// +→- /→_.
+//
+// Sync, works on every browser, no feature-detect.
+import { zlibSync } from 'fflate';
+export const DEFAULT_SHARE_BASE = 'https://free.nowline.io/open';
+/**
+ * Encode source text → `#text=<base64url(zlib(utf8(source)))>`.
+ *
+ * The return value includes the `#text=` key so callers can use it
+ * directly as a URL fragment.
+ *
+ * Sync, single code path, no feature-detect.
+ */
+export function encodeText(source) {
+    return `#text=${_encodePayload(source)}`;
+}
+/** base64url(zlib(utf8(source))) without the `#text=` prefix. */
+function _encodePayload(source) {
+    const bytes = new TextEncoder().encode(source);
+    const compressed = zlibSync(bytes);
+    // Convert Uint8Array to binary string for btoa. Chunked to avoid
+    // call-stack limits on large payloads.
+    const chunk = 0x8000; // 32 KB — safe below JS engine stack limits
+    let bin = '';
+    for (let i = 0; i < compressed.length; i += chunk) {
+        bin += String.fromCharCode(...compressed.subarray(i, i + chunk));
+    }
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Build the full "Share on Nowline" URL for a rendered block.
+ *
+ * Returns `null` when `share` is `false` or `'none'`, signalling that
+ * no anchor should be rendered.
+ */
+export function buildShareLink({ source, sourceUrl, share }) {
+    if (share === false || share === 'none') {
+        return null;
+    }
+    if (typeof share === 'object') {
+        // Template mode: { textUrl, remoteUrl }
+        if (sourceUrl !== undefined && _isHttps(sourceUrl)) {
+            return share.remoteUrl.replace('{url}', encodeURIComponent(sourceUrl));
+        }
+        return share.textUrl.replace('{text}', _encodePayload(source));
+    }
+    // share === true → DEFAULT_SHARE_BASE; share is a string → custom base URL
+    const base = share === true ? DEFAULT_SHARE_BASE : share;
+    const url = new URL(base);
+    if (sourceUrl !== undefined && _isHttps(sourceUrl)) {
+        url.hash = `url=${encodeURIComponent(sourceUrl)}`;
+    }
+    else {
+        url.hash = `text=${_encodePayload(source)}`;
+    }
+    return url.toString();
+}
+function _isHttps(url) {
+    try {
+        return new URL(url).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=share.js.map

package/dist/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../src/share.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kDAAkD;AAClD,EAAE;AACF,4DAA4D;AAC5D,wCAAwC;AACxC,qBAAqB;AACrB,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,WAAW;AACX,EAAE;AACF,mDAAmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAejE;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,OAAO,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,4CAA4C;IAClE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAChD,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAyB;IAC9E,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,wCAAwC;QACxC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,GAAG,OAAO,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;SAAM,CAAC;QACJ,GAAG,CAAC,IAAI,GAAG,QAAQ,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IACzB,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/theme.d.ts

@@ -1,5 +1,5 @@
-import type { ThemeName } from '@nowline/layout';
-export type EmbedTheme = ThemeName | 'auto';
-export declare function resolveSystemTheme(): ThemeName;
+import { type ThemeName } from '@nowline/layout';
+export type EmbedTheme = ThemeName | 'greyscale' | 'auto';
+export declare function resolveSystemTheme(): 'light' | 'dark';
 export declare function effectiveTheme(theme: EmbedTheme | undefined, systemTheme: ThemeName): ThemeName;
 //# sourceMappingURL=theme.d.ts.map

package/dist/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5C,wBAAgB,kBAAkB,IAAI,SAAS,CAS9C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,WAAW,EAAE,SAAS,GAAG,SAAS,CAG/F"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAeA,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGrE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAE1D,wBAAgB,kBAAkB,IAAI,OAAO,GAAG,MAAM,CASrD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,WAAW,EAAE,SAAS,GAAG,SAAS,CAG/F"}

package/dist/theme.js

@@ -1,7 +1,8 @@
 // Theme resolution for the embed.
 //
 // Precedence (highest to lowest):
-//   1. `initialize({ theme })` flag (light / dark / auto).
+//   1. `initialize({ theme })` flag (light / dark / grayscale / auto;
+//      `greyscale` is accepted and canonicalized to `grayscale`).
 //   2. The file's own `nowline v1 theme:` directive — handled inside
 //      layout, so we just don't override it when the embed config says
 //      `'auto'` and we have no system preference reading.
@@ -11,6 +12,7 @@
 // flipping the OS theme mid-session does not cause every embedded
 // roadmap on the page to repaint. This matches Mermaid's posture and
 // keeps the embed deterministic for screenshot tools.
+import { normalizeThemeName } from '@nowline/layout';
 export function resolveSystemTheme() {
     if (typeof globalThis === 'undefined')
         return 'light';
@@ -25,8 +27,8 @@ export function resolveSystemTheme() {
     }
 }
 export function effectiveTheme(theme, systemTheme) {
-    if (theme === 'light' || theme === 'dark')
-        return theme;
+    if (theme && theme !== 'auto')
+        return normalizeThemeName(theme) ?? systemTheme;
     return systemTheme;
 }
 //# sourceMappingURL=theme.js.map

package/dist/theme.js.map

@@ -1 +1 @@
-{"version":3,"file":"theme.js","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,kCAAkC;AAClC,2DAA2D;AAC3D,qEAAqE;AACrE,uEAAuE;AACvE,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,sDAAsD;AAMtD,MAAM,UAAU,kBAAkB;IAC9B,IAAI,OAAO,UAAU,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACtD,MAAM,GAAG,GAAI,UAAmE,CAAC,UAAU,CAAC;IAC5F,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,CAAC;QACD,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA6B,EAAE,WAAsB;IAChF,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,WAAW,CAAC;AACvB,CAAC"}
+{"version":3,"file":"theme.js","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,kCAAkC;AAClC,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,sDAAsD;AAEtD,OAAO,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAKrE,MAAM,UAAU,kBAAkB;IAC9B,IAAI,OAAO,UAAU,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACtD,MAAM,GAAG,GAAI,UAAmE,CAAC,UAAU,CAAC;IAC5F,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,CAAC;QACD,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA6B,EAAE,WAAsB;IAChF,IAAI,KAAK,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;IAC/E,OAAO,WAAW,CAAC;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowline/embed",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Browser embed bundle for Nowline. Drop a <script> tag and ```nowline``` blocks render in place.",
   "license": "Apache-2.0",
   "engines": {
@@ -39,16 +39,16 @@
     "cdn"
   ],
   "dependencies": {
+    "fflate": "^0.8.3",
     "langium": "~4.2.4",
-    "@nowline/browser": "0.4.1",
-    "@nowline/core": "0.4.1",
-    "@nowline/renderer": "0.4.1",
-    "@nowline/layout": "0.4.1"
+    "@nowline/browser": "0.5.0",
+    "@nowline/core": "0.5.0",
+    "@nowline/layout": "0.5.0",
+    "@nowline/renderer": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
     "esbuild": "^0.28.0",
-    "firebase": "^12.13.0",
     "happy-dom": "^20.9.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.7"
@@ -58,7 +58,6 @@
     "watch": "tsc -b tsconfig.json --watch",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "bundle": "node scripts/bundle.mjs",
-    "bundle:dev": "node scripts/bundle.mjs --dev",
     "check-size": "node scripts/check-size.mjs",
     "test": "vitest run",
     "test:watch": "vitest"

package/src/auto-scan.ts

@@ -5,6 +5,7 @@
 
 import type { ThemeName } from '@nowline/layout';
 import { type EmbedRenderOptions, renderSource } from './pipeline.js';
+import { buildShareLink, type ShareOption } from './share.js';
 
 export interface AutoScanInputs {
     selector: string;
@@ -12,6 +13,16 @@ export interface AutoScanInputs {
     locale?: string;
     width?: number;
     today?: Date;
+    /**
+     * Controls the "Share on Nowline" anchor appended after each rendered
+     * SVG. Defaults to `true` when omitted (mirrors the config default).
+     */
+    share?: ShareOption;
+    /**
+     * Global source URL for all blocks. Per-block `data-nowline-source-url`
+     * overrides this for individual blocks.
+     */
+    sourceUrl?: string;
     /**
      * Document to scan. Defaults to `globalThis.document`. Tests inject
      * a happy-dom document; the IIFE running on a real page picks up
@@ -40,6 +51,9 @@ export async function runAutoScan(inputs: AutoScanInputs): Promise<AutoScanResul
     let failed = 0;
     const baseRunId = ++runCounter;
 
+    // share defaults to true when omitted (mirrors config.share default)
+    const share: ShareOption = inputs.share ?? true;
+
     const tasks: Array<Promise<void>> = [];
     let blockIndex = 0;
     for (const code of Array.from(blocks)) {
@@ -56,11 +70,39 @@ export async function runAutoScan(inputs: AutoScanInputs): Promise<AutoScanResul
             today: inputs.today,
             idPrefix,
         };
+
+        // Capture DOM position before the async render. outerHTML replacement
+        // detaches `target` from the tree, so parent and nextSibling must be
+        // read now. The share anchor is inserted at the saved nextSibling
+        // position, which lands it as the immediate next sibling of the SVG.
+        const parent = target.parentElement;
+        const nextSibling = target.nextSibling;
+
+        // Per-block resolution order: data-nowline-source-url → global sourceUrl
+        const perBlockUrl = code.getAttribute('data-nowline-source-url') ?? undefined;
+        const resolvedSourceUrl = perBlockUrl ?? inputs.sourceUrl;
+
         tasks.push(
             renderSource(source, opts).then(
                 (svg) => {
                     replaceWithSvg(target, svg);
                     rendered++;
+                    if (parent !== null) {
+                        const href = buildShareLink({
+                            source,
+                            sourceUrl: resolvedSourceUrl,
+                            share,
+                        });
+                        if (href !== null) {
+                            const a = doc.createElement('a');
+                            a.className = 'nowline-share';
+                            a.href = href;
+                            a.target = '_blank';
+                            a.rel = 'noopener noreferrer';
+                            a.textContent = 'Share on Nowline';
+                            parent.insertBefore(a, nextSibling);
+                        }
+                    }
                 },
                 (err: unknown) => {
                     failed++;

package/src/index.ts

@@ -5,17 +5,12 @@
 // The IIFE bundle exposes everything below as `window.nowline.*`. ESM
 // consumers import named exports from the package root.
 
-import { EMBED_SHA, EMBED_VERSION } from './auth/env.js';
-
-// Build-time constant substituted by esbuild's `define` (see
-// `scripts/bundle.mjs`). Reading it directly at the call site (rather
-// than via an `IS_DEV` re-export from env.ts) means esbuild can fold
-// the `if` below to a literal `true`/`false` at minify time and
-// dead-code-eliminate the dynamic-import branch in the prod bundle,
-// stripping `firebase/app` + `firebase/auth` from `dist/nowline.min.js`.
-// The `typeof` guard keeps the file safe to import under vitest, where
-// esbuild's define never runs and the identifier is undeclared.
-declare const __NOWLINE_EMBED_ENV__: string;
+// Build-time constants substituted by esbuild's `define` (see
+// `scripts/bundle.mjs`). The `typeof` guards keep this file safe to
+// import under vitest, where esbuild's define never runs and the
+// identifiers are undeclared.
+declare const __NOWLINE_EMBED_VERSION__: string;
+declare const __NOWLINE_EMBED_SHA__: string;
 
 import {
     __resetAutoScanForTests,
@@ -31,9 +26,16 @@ import {
     parseSource,
     renderSource,
 } from './pipeline.js';
+import type { ShareOption } from './share.js';
 import { type EmbedTheme, effectiveTheme, resolveSystemTheme } from './theme.js';
 
-export { type AutoScanResult, type EmbedParseResult, EmbedRenderError, type EmbedTheme };
+export {
+    type AutoScanResult,
+    type EmbedParseResult,
+    EmbedRenderError,
+    type EmbedTheme,
+    type ShareOption,
+};
 
 /**
  * Bundle provenance, mirroring the legal-comment banner that
@@ -44,8 +46,10 @@ export { type AutoScanResult, type EmbedParseResult, EmbedRenderError, type Embe
  * pages and bug reports can identify the exact build without scraping
  * the comment banner.
  */
-export const version: string = EMBED_VERSION;
-export const sha: string = EMBED_SHA;
+export const version: string =
+    typeof __NOWLINE_EMBED_VERSION__ !== 'undefined' ? __NOWLINE_EMBED_VERSION__ : '0.0.0';
+export const sha: string =
+    typeof __NOWLINE_EMBED_SHA__ !== 'undefined' ? __NOWLINE_EMBED_SHA__ : 'unknown';
 
 const DEFAULT_SELECTOR = 'pre code.language-nowline, code.language-nowline';
 
@@ -71,6 +75,22 @@ export interface InitializeOptions {
     width?: number;
     /** Pin a `today` for deterministic snapshots; defaults to live `new Date()` per render. */
     today?: Date;
+    /**
+     * Controls the "Share on Nowline" anchor appended after each rendered SVG.
+     * - `true` (default) — link to the Free app open route
+     *   (`https://free.nowline.io/open`).
+     * - string — a custom base URL (may include a path); the fragment is appended.
+     * - `false` / `'none'` — no anchor rendered.
+     * - `{ textUrl, remoteUrl }` — template with `{text}` / `{url}` substitution.
+     */
+    share?: ShareOption;
+    /**
+     * Global source URL for all blocks on the page. When set, share links
+     * use `#url=<sourceUrl>` instead of `#text=` (inline encoding).
+     * Per-block `data-nowline-source-url` overrides this for individual blocks.
+     * Only `https:` URLs are emitted as `#url=`.
+     */
+    sourceUrl?: string;
 }
 
 interface ResolvedConfig {
@@ -82,6 +102,10 @@ interface ResolvedConfig {
     today?: Date;
     /** System theme captured at init; not reactive to OS theme flips mid-session. */
     systemTheme: 'light' | 'dark';
+    /** Controls the "Share on Nowline" anchor. Defaults to `true`. */
+    share: ShareOption;
+    /** Global canonical source URL; per-block `data-nowline-source-url` takes priority. */
+    sourceUrl?: string;
 }
 
 const initialConfig: ResolvedConfig = {
@@ -89,6 +113,7 @@ const initialConfig: ResolvedConfig = {
     startOnLoad: true,
     selector: DEFAULT_SELECTOR,
     systemTheme: resolveSystemTheme(),
+    share: true,
 };
 
 let config: ResolvedConfig = { ...initialConfig };
@@ -102,6 +127,8 @@ export function initialize(options: InitializeOptions = {}): void {
         locale: options.locale ?? config.locale,
         width: options.width ?? config.width,
         today: options.today ?? config.today,
+        share: options.share ?? config.share,
+        sourceUrl: options.sourceUrl ?? config.sourceUrl,
         // Re-read `prefers-color-scheme` on every initialize() so callers
         // who explicitly want the latest system theme can ask for it by
         // calling initialize() again. Auto-scan paths still use the value
@@ -154,6 +181,8 @@ export async function init(overrides?: Partial<AutoScanInputs>): Promise<AutoSca
         locale: overrides?.locale ?? config.locale,
         width: overrides?.width ?? config.width,
         today: overrides?.today ?? config.today,
+        share: overrides?.share ?? config.share,
+        sourceUrl: overrides?.sourceUrl ?? config.sourceUrl,
         document: overrides?.document,
     };
     return runAutoScan(inputs);
@@ -174,23 +203,6 @@ export const run = init;
 if (typeof document !== 'undefined' && !autoStartScheduled) {
     autoStartScheduled = true;
 
-    // Dev-only Firebase Auth gate (embed.nowline.dev). The condition
-    // reads `__NOWLINE_EMBED_ENV__` directly so esbuild's `define`
-    // substitutes a literal string at minify time — the prod bundle
-    // sees `if ("prod" === "dev")` → `if (false)` and DCEs the dynamic
-    // import that pulls in `firebase/app` + `firebase/auth`.
-    // `check-size.mjs` asserts no `firebase` literal survives in the
-    // prod IIFE as a belt-and-suspenders check.
-    if (typeof __NOWLINE_EMBED_ENV__ !== 'undefined' && __NOWLINE_EMBED_ENV__ === 'dev') {
-        void import('./auth/firebase-auth.client.js')
-            .then(({ startDevAuthGate }) => {
-                startDevAuthGate();
-            })
-            .catch((err) => {
-                console.error('[nowline] dev auth gate failed to load:', err);
-            });
-    }
-
     const start = (): void => {
         if (!config.startOnLoad) return;
         // Fire-and-forget; render errors are surfaced via `console.error`

package/src/share.ts

@@ -0,0 +1,108 @@
+// Share-link generation for the "Share on Nowline" anchor that the
+// auto-scan loop appends after each rendered SVG.
+//
+// Encoding grammar (normative — defined in specs/embed.md):
+//   #text=base64url(zlib(utf8(source)))
+//   #url=<https-url>
+//
+// zlib = RFC 1950 via fflate zlibSync (byte-compatible with native
+// CompressionStream('deflate')); base64url strips padding and maps
+// +→- /→_.
+//
+// Sync, works on every browser, no feature-detect.
+
+import { zlibSync } from 'fflate';
+
+export const DEFAULT_SHARE_BASE = 'https://free.nowline.io/open';
+
+/**
+ * The `share` initialize option selects where share links point.
+ *
+ * - `true` — use DEFAULT_SHARE_BASE (the default).
+ * - `string` — a base URL with optional path; built via the URL API so
+ *   `https://foo.com/open` → `https://foo.com/open#text=…`.
+ * - `false` / `'none'` — disable the share anchor entirely.
+ * - `{ textUrl, remoteUrl }` — escape hatch for non-hash URL shapes;
+ *   `{text}` substituted with the base64url payload, `{url}` with the
+ *   percent-encoded source URL.
+ */
+export type ShareOption = boolean | 'none' | string | { textUrl: string; remoteUrl: string };
+
+/**
+ * Encode source text → `#text=<base64url(zlib(utf8(source)))>`.
+ *
+ * The return value includes the `#text=` key so callers can use it
+ * directly as a URL fragment.
+ *
+ * Sync, single code path, no feature-detect.
+ */
+export function encodeText(source: string): string {
+    return `#text=${_encodePayload(source)}`;
+}
+
+/** base64url(zlib(utf8(source))) without the `#text=` prefix. */
+function _encodePayload(source: string): string {
+    const bytes = new TextEncoder().encode(source);
+    const compressed = zlibSync(bytes);
+    // Convert Uint8Array to binary string for btoa. Chunked to avoid
+    // call-stack limits on large payloads.
+    const chunk = 0x8000; // 32 KB — safe below JS engine stack limits
+    let bin = '';
+    for (let i = 0; i < compressed.length; i += chunk) {
+        bin += String.fromCharCode(...compressed.subarray(i, i + chunk));
+    }
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+export interface BuildShareLinkOptions {
+    /** The roadmap source text (used to build the #text= fragment). */
+    source: string;
+    /**
+     * Resolved source URL for the block (per-block → global → undefined).
+     * Only `https:` URLs are emitted as `#url=`; anything else falls
+     * back to the inline `#text=` encoding.
+     */
+    sourceUrl?: string | undefined;
+    /** The `share` option from InitializeOptions. */
+    share: ShareOption;
+}
+
+/**
+ * Build the full "Share on Nowline" URL for a rendered block.
+ *
+ * Returns `null` when `share` is `false` or `'none'`, signalling that
+ * no anchor should be rendered.
+ */
+export function buildShareLink({ source, sourceUrl, share }: BuildShareLinkOptions): string | null {
+    if (share === false || share === 'none') {
+        return null;
+    }
+
+    if (typeof share === 'object') {
+        // Template mode: { textUrl, remoteUrl }
+        if (sourceUrl !== undefined && _isHttps(sourceUrl)) {
+            return share.remoteUrl.replace('{url}', encodeURIComponent(sourceUrl));
+        }
+        return share.textUrl.replace('{text}', _encodePayload(source));
+    }
+
+    // share === true → DEFAULT_SHARE_BASE; share is a string → custom base URL
+    const base = share === true ? DEFAULT_SHARE_BASE : share;
+    const url = new URL(base);
+
+    if (sourceUrl !== undefined && _isHttps(sourceUrl)) {
+        url.hash = `url=${encodeURIComponent(sourceUrl)}`;
+    } else {
+        url.hash = `text=${_encodePayload(source)}`;
+    }
+
+    return url.toString();
+}
+
+function _isHttps(url: string): boolean {
+    try {
+        return new URL(url).protocol === 'https:';
+    } catch {
+        return false;
+    }
+}

package/src/theme.ts

@@ -1,7 +1,8 @@
 // Theme resolution for the embed.
 //
 // Precedence (highest to lowest):
-//   1. `initialize({ theme })` flag (light / dark / auto).
+//   1. `initialize({ theme })` flag (light / dark / grayscale / auto;
+//      `greyscale` is accepted and canonicalized to `grayscale`).
 //   2. The file's own `nowline v1 theme:` directive — handled inside
 //      layout, so we just don't override it when the embed config says
 //      `'auto'` and we have no system preference reading.
@@ -12,11 +13,12 @@
 // roadmap on the page to repaint. This matches Mermaid's posture and
 // keeps the embed deterministic for screenshot tools.
 
-import type { ThemeName } from '@nowline/layout';
+import { normalizeThemeName, type ThemeName } from '@nowline/layout';
 
-export type EmbedTheme = ThemeName | 'auto';
+// `'greyscale'` (UK) is an accepted alias for the canonical `'grayscale'`.
+export type EmbedTheme = ThemeName | 'greyscale' | 'auto';
 
-export function resolveSystemTheme(): ThemeName {
+export function resolveSystemTheme(): 'light' | 'dark' {
     if (typeof globalThis === 'undefined') return 'light';
     const win = (globalThis as { matchMedia?: (q: string) => { matches: boolean } }).matchMedia;
     if (typeof win !== 'function') return 'light';
@@ -28,6 +30,6 @@ export function resolveSystemTheme(): ThemeName {
 }
 
 export function effectiveTheme(theme: EmbedTheme | undefined, systemTheme: ThemeName): ThemeName {
-    if (theme === 'light' || theme === 'dark') return theme;
+    if (theme && theme !== 'auto') return normalizeThemeName(theme) ?? systemTheme;
     return systemTheme;
 }

package/dist/auth/allowlist.d.ts

@@ -1,20 +0,0 @@
-/**
- * Allowlist for the dev embed bundle's Firebase Auth gate.
- *
- * An email is allowlisted if either:
- *   1. Its domain is in ALLOWED_DOMAINS (e.g. anything @nowline.io), OR
- *   2. The exact lowercase email is in ALLOWED_EMAILS.
- *
- * Mirrors the commercial site's `auth-allowlist.ts` so both Lolay
- * dev surfaces (the marketing site and the embed CDN dev tier) share
- * one allowlist policy. Keep this short; when it grows past ~5 entries,
- * migrate to Firebase custom claims (Admin SDK) or a Firestore
- * `allowlist` collection.
- *
- * See specs/embed.md § Bootstrap status (dev auth gate) and
- * the infrastructure deploy runbook § 4 for the deploy-side wiring.
- */
-export declare const ALLOWED_DOMAINS: readonly string[];
-export declare const ALLOWED_EMAILS: readonly string[];
-export declare function isAllowlisted(email: string | null | undefined): boolean;
-//# sourceMappingURL=allowlist.d.ts.map

package/dist/auth/allowlist.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/auth/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAmB,CAAC;AAEjE,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAE3C,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAQvE"}

package/dist/auth/allowlist.js

@@ -1,33 +0,0 @@
-/**
- * Allowlist for the dev embed bundle's Firebase Auth gate.
- *
- * An email is allowlisted if either:
- *   1. Its domain is in ALLOWED_DOMAINS (e.g. anything @nowline.io), OR
- *   2. The exact lowercase email is in ALLOWED_EMAILS.
- *
- * Mirrors the commercial site's `auth-allowlist.ts` so both Lolay
- * dev surfaces (the marketing site and the embed CDN dev tier) share
- * one allowlist policy. Keep this short; when it grows past ~5 entries,
- * migrate to Firebase custom claims (Admin SDK) or a Firestore
- * `allowlist` collection.
- *
- * See specs/embed.md § Bootstrap status (dev auth gate) and
- * the infrastructure deploy runbook § 4 for the deploy-side wiring.
- */
-export const ALLOWED_DOMAINS = ['nowline.io'];
-export const ALLOWED_EMAILS = [
-// Add additional allowlisted Google account emails here, one per line.
-];
-export function isAllowlisted(email) {
-    if (!email)
-        return false;
-    const normalized = email.trim().toLowerCase();
-    if (ALLOWED_EMAILS.includes(normalized))
-        return true;
-    const at = normalized.lastIndexOf('@');
-    if (at === -1)
-        return false;
-    const domain = normalized.slice(at + 1);
-    return ALLOWED_DOMAINS.includes(domain);
-}
-//# sourceMappingURL=allowlist.js.map

package/dist/auth/allowlist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../src/auth/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,YAAY,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAsB;AAC7C,uEAAuE;CAC1E,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC"}