@anthusai/papyrus 1.0.0-next.17 → 1.0.0-next.19

package/amplify/auth/resource.js

@@ -1,5 +1,6 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
@@ -25,15 +26,13 @@ export function authConfigFromEnv() {
     return {
         redirectUrls: resolveAuthRedirectUrls(),
         disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-        // See docs/google-oauth-setup.md.
         cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+        applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
 export function defineSiteAuth(config) {
     const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
-    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
     return defineAuth({
         loginWith: {
             email: true,
@@ -49,7 +48,6 @@ export function defineSiteAuth(config) {
                         scopes: ["EMAIL", "PROFILE", "OPENID"],
                         callbackUrls: authRedirectUrls,
                         logoutUrls: authRedirectUrls,
-                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
                     },
                 }),
         },
@@ -59,3 +57,18 @@ export function defineSiteAuth(config) {
         ],
     });
 }
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack, cognitoDomainPrefix) {
+    const domainResources = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolDomain);
+    if (domainResources.length !== 1) {
+        throw new Error(`Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`);
+    }
+    domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/auth/resource.ts

@@ -1,5 +1,7 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
+import { Stack } from "aws-cdk-lib";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
@@ -28,16 +30,14 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   return {
     redirectUrls: resolveAuthRedirectUrls(),
     disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-    // See docs/google-oauth-setup.md.
     cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
   };
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
-  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
   return defineAuth({
     loginWith: {
       email: true,
@@ -53,7 +53,6 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
               scopes: ["EMAIL", "PROFILE", "OPENID"],
               callbackUrls: authRedirectUrls,
               logoutUrls: authRedirectUrls,
-              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
             },
           }),
     },
@@ -63,3 +62,21 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
     ],
   });
 }
+
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack: Stack, cognitoDomainPrefix: string): void {
+  const domainResources = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolDomain => construct instanceof CfnUserPoolDomain);
+  if (domainResources.length !== 1) {
+    throw new Error(
+      `Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`,
+    );
+  }
+  domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/site-backend-config.ts

@@ -7,8 +7,13 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
-  /** Stable Cognito hosted-UI domain prefix. */
+  /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
+  /**
+   * Opt in to the prefix. Off by default because changing a live pool's
+   * domain replaces it and changes the Google redirect URI.
+   */
+  applyCognitoDomainPrefix?: boolean;
 };
 
 export type PapyrusSiteBackendConfig = {

package/amplify/site-backend.js

@@ -13,7 +13,7 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
 import { categoryAction } from "./functions/category-action/resource.js";
@@ -76,9 +76,10 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = site.features?.inboundEmail ?? readEnvFlag("PAPYRUS_ENABLE_INBOUND_EMAIL", isAmplifyProductionPipeline);
     const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
     const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
+    const authConfig = site.auth ?? authConfigFromEnv();
     const backend = defineBackend({
         assignmentAction,
-        auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+        auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
         data,
@@ -94,6 +95,12 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+    if (authConfig.applyCognitoDomainPrefix === true
+        && requestedCognitoDomainPrefix !== ""
+        && authConfig.disableGoogleOAuth !== true) {
+        applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+    }
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");

package/amplify/site-backend.ts

@@ -14,7 +14,7 @@ import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aw
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
@@ -87,9 +87,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
   const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
 
+  const authConfig = site.auth ?? authConfigFromEnv();
   const backend = defineBackend({
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
     data,
@@ -106,6 +107,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -52,10 +52,12 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
+        sections: content.sections.map((section) => ({ key: section.key, label: section.label })),
         subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
         title: SITE_BRAND.footerTitle,
       }}
       item={item}
+      videoScript={content.videoScripts?.[item.slug] ?? null}
       backHref={`${editionBasePath}#${item.slug}`}
     />
   );

package/app/api/revalidate/route.ts

@@ -1,3 +1,4 @@
+import { toPublicReaderPath } from "../../../lib/reader-base-path";
 import { revalidatePath, revalidateTag } from "next/cache";
 import { NextResponse } from "next/server";
 import {
@@ -44,8 +45,8 @@ export async function POST(request: Request) {
     if (!normalized) continue;
     revalidateTag(articleCacheTag(normalized));
     revalidatedTags.add(articleCacheTag(normalized));
-    revalidatePath(`/articles/${encodeURIComponent(normalized)}`);
-    revalidatedPaths.add(`/articles/${encodeURIComponent(normalized)}`);
+    revalidatePath(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
+    revalidatedPaths.add(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
     if (editionDate) {
       revalidateTag(editionItemCacheTag(editionDate, normalized));
       revalidatedTags.add(editionItemCacheTag(editionDate, normalized));
@@ -76,8 +77,8 @@ export async function POST(request: Request) {
   revalidatedTags.add(ARCHIVE_CACHE_TAG);
   revalidateTag(ARTICLES_CACHE_TAG);
   revalidatedTags.add(ARTICLES_CACHE_TAG);
-  revalidatePath("/archive");
-  revalidatedPaths.add("/archive");
+  revalidatePath(toPublicReaderPath("/archive"));
+  revalidatedPaths.add(toPublicReaderPath("/archive"));
 
   for (const path of body.paths ?? []) {
     const normalized = path.trim();

package/app/blog-rhythm.css

@@ -0,0 +1,278 @@
+/*
+  Structural CSS for the rhythm blog layout (blogLayout: "rhythm").
+  Every rule is scoped to .blog-rhythm-shell, which only the rhythm layout
+  renders, so classic layouts are unaffected. The shell sets --blog-rhythm,
+  --blog-row-height, --blog-paint-buffer and --blog-paint-height inline.
+  Typography, colors and the header look belong to the publication's theme.css.
+  Optional tokens a publication may set:
+    --blog-hrule-foreground, --blog-section-rule, --blog-section-band-height,
+    --blog-page-padding-x, --blog-secondary-pair-min-width.
+*/
+
+.blog-rhythm-shell {
+  --blog-hrule-foreground: var(--border);
+  --blog-section-rule: var(--border);
+  --blog-section-band-height: calc(var(--blog-row-height) * 2);
+  --blog-page-padding-x: calc(var(--blog-rhythm) * 3);
+  --paper-rhythm: var(--blog-row-height);
+
+  isolation: isolate;
+  position: relative;
+}
+
+.blog-rhythm-shell.presentation-page--blog {
+  padding: calc(var(--blog-row-height) * 4) var(--blog-page-padding-x) 0;
+}
+
+.blog-rhythm-shell > :not(.blog-page-background) {
+  position: relative;
+  z-index: 1;
+}
+
+.blog-rhythm-shell[data-rhythm-overlay="true"]::before {
+  background-image:
+    repeating-linear-gradient(
+      to bottom,
+      rgb(var(--rhythm-overlay-rule-rgb) / var(--rhythm-overlay-rule-alpha)) 0,
+      rgb(var(--rhythm-overlay-rule-rgb) / var(--rhythm-overlay-rule-alpha)) 1px,
+      transparent 1px,
+      transparent var(--blog-row-height)
+    ),
+    repeating-linear-gradient(
+      to bottom,
+      rgb(var(--rhythm-overlay-blue-rgb) / var(--rhythm-overlay-blue-alpha)) 0,
+      rgb(var(--rhythm-overlay-blue-rgb) / var(--rhythm-overlay-blue-alpha)) var(--blog-row-height),
+      rgb(var(--rhythm-overlay-yellow-rgb) / var(--rhythm-overlay-yellow-alpha)) var(--blog-row-height),
+      rgb(var(--rhythm-overlay-yellow-rgb) / var(--rhythm-overlay-yellow-alpha)) calc(var(--blog-row-height) * 2)
+    );
+  content: "";
+  inset: 0;
+  pointer-events: none;
+  position: absolute;
+  z-index: 900;
+}
+
+.blog-rhythm-shell .presentation-header {
+  max-width: 100%;
+  min-width: 0;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header,
+.blog-rhythm-shell .presentation-item,
+.blog-rhythm-shell .presentation-item__copy {
+  max-width: 100%;
+  min-width: 0;
+}
+
+.blog-rhythm-shell .presentation-section-header {
+  align-items: stretch;
+  border-bottom: 0;
+  border-top: 0;
+  display: flex;
+  flex-direction: column;
+  gap: var(--blog-row-height);
+  margin: 0;
+  min-height: 0;
+  padding: calc(var(--blog-row-height) * 4) 0 calc(var(--blog-row-height) * 2);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header__band {
+  align-items: center;
+  display: grid;
+  gap: 0 var(--blog-rhythm);
+  grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr);
+  grid-template-rows: var(--blog-section-band-height);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header__band::before,
+.blog-rhythm-shell .presentation-section-header__band::after {
+  background: var(--blog-section-rule);
+  content: "";
+  grid-row: 1;
+  height: var(--blog-section-band-height);
+}
+
+.blog-rhythm-shell .presentation-section-header__band::before {
+  grid-column: 1;
+}
+
+.blog-rhythm-shell .presentation-section-header__band::after {
+  grid-column: 3;
+}
+
+.blog-rhythm-shell .presentation-section-header__band p {
+  grid-column: 2;
+  grid-row: 1;
+  height: var(--blog-section-band-height);
+  justify-self: center;
+  line-height: var(--blog-section-band-height);
+  margin: 0;
+  padding: 0 var(--blog-rhythm);
+  width: max-content;
+}
+
+.blog-rhythm-shell .presentation-item {
+  border-bottom: 0;
+  gap: var(--blog-row-height) calc(var(--blog-rhythm) * 4);
+  padding-bottom: 0;
+}
+
+.blog-rhythm-shell .presentation-item--blog {
+  grid-template-columns: minmax(0, 1fr);
+}
+
+.blog-rhythm-shell .presentation-rhythm-hrule {
+  display: grid;
+  grid-column: 1 / -1;
+  grid-template-rows: repeat(5, var(--blog-row-height));
+  height: calc(var(--blog-row-height) * 5);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-rhythm-hrule__line {
+  background: var(--blog-hrule-foreground);
+  grid-row: 3;
+  height: var(--blog-row-height);
+}
+
+@media (min-width: 1100px) {
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) {
+    column-gap: calc(var(--blog-row-height) * 2);
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-section-header,
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-item[data-item-index="0"] {
+    grid-column: 1 / -1;
+  }
+
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-rhythm-hrule[data-hide-in-secondary-pair="true"] {
+    display: none;
+  }
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout][data-has-image="true"] {
+  display: flex;
+  flex-direction: column;
+  gap: 0;
+  grid-template-columns: minmax(0, 1fr);
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .presentation-item__text-frame {
+  height: var(--feature-text-frame-height);
+  max-width: none;
+  overflow: hidden;
+  position: relative;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .presentation-item__media {
+  height: var(--feature-media-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .pictogram-figure__frame {
+  aspect-ratio: auto;
+  height: var(--feature-image-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__copy {
+  display: contents;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__header {
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__body {
+  min-width: 0;
+  position: relative;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__body .presentation-item__text-frame {
+  margin-top: 0;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__media {
+  margin: 0;
+  position: absolute;
+  right: 0;
+  top: 0;
+  z-index: 1;
+}
+
+.blog-rhythm-shell .presentation-item__image img {
+  height: 100%;
+  object-fit: contain;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item__video {
+  grid-column: 1 / -1;
+  margin: var(--blog-row-height) 0 0;
+}
+
+.blog-rhythm-shell .article-page__hero-video {
+  margin: 0 0 calc(var(--blog-rhythm) * 5);
+}
+
+.blog-rhythm-shell .article-page__hero-video .article-video,
+.blog-rhythm-shell .presentation-item__video-figure {
+  container-type: inline-size;
+}
+
+.blog-rhythm-shell .presentation-item__video-figure .article-video__media,
+.blog-rhythm-shell .article-page__hero-video .article-video__media {
+  height: round(up, calc(100cqw * 9 / 16), var(--blog-row-height));
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout][data-has-image="true"] {
+  display: grid;
+  gap: var(--feature-layout-gap);
+  grid-template-columns: minmax(0, 1fr) var(--feature-image-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-page__hero-video,
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__header {
+  grid-column: 1 / -1;
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__body {
+  align-self: start;
+  grid-column: 1;
+  max-width: var(--feature-copy-width);
+  min-width: 0;
+  width: var(--feature-copy-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__media,
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .pictogram-figure__frame {
+  height: var(--feature-image-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .pictogram-figure__frame {
+  aspect-ratio: auto;
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__media {
+  align-self: start;
+  grid-column: 2;
+  margin: 0;
+  position: relative;
+}
+
+.blog-rhythm-shell .article-float-grid .presentation-item__image {
+  margin: 0;
+}
+
+@media (max-width: 900px) {
+  .blog-rhythm-shell .presentation-item--blog {
+    grid-template-columns: 1fr;
+  }
+}

package/app/globals.css

@@ -45,6 +45,7 @@
   --color-surface-foreground: var(--surface-foreground);
   --color-foreground-strong: var(--foreground-strong);
   --color-foreground-muted: var(--foreground-muted);
+  --color-foreground-subtle: var(--foreground-subtle);
 }
 
 :root {
@@ -71,6 +72,7 @@
   --surface-foreground: var(--card-foreground);
   --foreground-strong: var(--slate-12);
   --foreground-muted: var(--slate-10);
+  --foreground-subtle: var(--slate-9);
   --border: var(--slate-6);
   --input: var(--slate-6);
   --ring: var(--slate-8);

package/app/layout.tsx

@@ -4,12 +4,14 @@ import Script from "next/script";
 import { AmplifyClientProvider } from "../components/amplify-client-provider";
 import { PapyrusConsoleShell } from "../components/papyrus-console-shell";
 import { TooltipProvider } from "../components/ui/tooltip";
+import { resolveBrandFontAssets } from "../lib/brand-fonts";
 import { getPresentationChoices, getSiteBrand } from "../lib/site-brand";
 import { getSiteStack } from "../lib/site-stack";
 import { isIndexable, showStagingBanner } from "../lib/site-env";
 import { StagingBanner } from "../components/staging-banner";
 import "./tailwind.css";
 import "./globals.css";
+import "./blog-rhythm.css";
 import "papyrus-site-theme";
 
 const playfairDisplay = Playfair_Display({
@@ -43,6 +45,7 @@ export default async function RootLayout({ children }: Readonly<{ children: Reac
   const siteBrand = getSiteBrand();
   const presentationChoices = getPresentationChoices(siteBrand);
   const siteStack = getSiteStack(siteBrand);
+  const brandFonts = resolveBrandFontAssets(siteBrand.fonts);
 
   return (
     <html
@@ -56,8 +59,21 @@ export default async function RootLayout({ children }: Readonly<{ children: Reac
       data-default-presentation={siteBrand.defaultPresentation}
       data-presentation-choices={presentationChoices.join(",")}
       {...(siteBrand.forcedPresentation ? { "data-forced-presentation": siteBrand.forcedPresentation } : {})}
+      {...(siteBrand.blogLayout === "rhythm" ? { "data-blog-layout": "rhythm" } : {})}
+      {...(brandFonts.isEmpty ? {} : { style: brandFonts.rootStyle as React.CSSProperties })}
       suppressHydrationWarning
     >
+      {brandFonts.isEmpty ? null : (
+        <head>
+          {brandFonts.preconnectOrigins.map((origin) => (
+            <link crossOrigin="anonymous" href={origin} key={origin} rel="preconnect" />
+          ))}
+          {brandFonts.stylesheetHrefs.map((href) => (
+            <link href={href} key={href} rel="stylesheet" />
+          ))}
+          {brandFonts.fontFaceCss ? <style data-brand-fonts="true">{brandFonts.fontFaceCss}</style> : null}
+        </head>
+      )}
       <body className={`${playfairDisplay.variable} ${plusJakartaSans.variable}`}>
         <Script id="papyrus-favicon-color-scheme" strategy="beforeInteractive">
           {`(() => {

package/app/page.tsx

@@ -16,6 +16,7 @@ import {
 import type { PublicationItem } from "../lib/publication-items";
 import { SITE_BRAND, rootRoute } from "../lib/site-brand";
 import { notFound, redirect } from "next/navigation";
+import { getReaderBasePath } from "../lib/reader-base-path";
 import { buildRootRedirectTarget } from "../lib/root-route-redirect";
 import NewsDeskRootPage, { type NewsDeskRootSearchParams } from "./newsroom/page";
 
@@ -38,11 +39,13 @@ export default async function Home({ searchParams }: HomePageProps) {
   // co-hosts reader + CMS uses the default "reader" (render the publication
   // home page here). A CMS-only site points the root at the newsroom or
   // anywhere else. Preserve the scenario and OAuth-callback paths.
-  if (rootRoute.kind === "newsroom" && !scenarioId) {
+  const publicationOwnsRoot = getReaderBasePath() !== "";
+
+  if (!publicationOwnsRoot && rootRoute.kind === "newsroom" && !scenarioId) {
     return <NewsDeskRootPage searchParams={searchParams} />;
   }
 
-  if (rootRoute.kind === "redirect") {
+  if (!publicationOwnsRoot && rootRoute.kind === "redirect") {
     redirect(buildRootRedirectTarget(rootRoute.destination, resolvedSearchParams));
   }
 

package/components/archive-shell.tsx

@@ -1,27 +1,14 @@
 "use client";
 
 import type { ReactNode } from "react";
-import { useEffect, useState } from "react";
+import { useRhythmOverlay } from "./use-rhythm-overlay";
 
 type ArchiveShellProps = {
   children: ReactNode;
 };
 
 export function ArchiveShell({ children }: ArchiveShellProps) {
-  const [showRhythmOverlay, setShowRhythmOverlay] = useState(false);
-
-  useEffect(() => {
-    const handleKeyDown = (event: KeyboardEvent) => {
-      if (isEditableEventTarget(event.target)) return;
-      if ((event.key === "=" || event.code === "Equal") && event.ctrlKey && !event.metaKey && !event.altKey) {
-        event.preventDefault();
-        setShowRhythmOverlay((current) => !current);
-      }
-    };
-
-    window.addEventListener("keydown", handleKeyDown);
-    return () => window.removeEventListener("keydown", handleKeyDown);
-  }, []);
+  const showRhythmOverlay = useRhythmOverlay();
 
   return (
     <main
@@ -32,10 +19,3 @@ export function ArchiveShell({ children }: ArchiveShellProps) {
     </main>
   );
 }
-
-function isEditableEventTarget(target: EventTarget | null): boolean {
-  if (!(target instanceof HTMLElement)) return false;
-  const tagName = target.tagName.toLowerCase();
-  if (tagName === "input" || tagName === "textarea" || tagName === "select") return true;
-  return target.isContentEditable || target.closest("[contenteditable='true']") !== null;
-}