@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.21

package/lib/site-brand.ts

@@ -1,8 +1,10 @@
+import type { ComponentType } from "react";
 import type { EditionPresentationFormat } from "./content-types";
+import type { Article, ArticleVideoAsset } from "./articles";
+import type { BlogPageBackgroundProps } from "../components/blog-page-background";
+import type { SiteBrandFont } from "./brand-fonts";
+import type { PictogramFigureProps } from "../components/pictogram-figure";
 import papyrusSite from "papyrus-site";
-import { threatIntelligenceBrand } from "../publications/threat_intelligence/brand";
-import { pilobolUsBrand } from "../publications/pilobol_us/brand";
-import { anthUsBrand } from "../publications/anth_us/brand";
 import {
   DEFAULT_THEME_PACK_TOKENS,
   type HostingConfig,
@@ -17,6 +19,51 @@ import {
 /** Open string: a publication registers its own brand through `papyrus.config.ts` (`defineSite`). */
 export type SiteBrandId = string;
 
+/** Brand-specific replacements for generic Pretext components. */
+export type SiteBrandComponents = {
+  PictogramFigure?: ComponentType<PictogramFigureProps>;
+  BlogPageBackground?: ComponentType<BlogPageBackgroundProps>;
+};
+
+/**
+ * One line of a brand's header tagline: an emphasized lead and a plain tail,
+ * e.g. `{ emphasis: "Practical advice", tail: "for staying secure" }`.
+ */
+export type SiteBrandTaglineLine = {
+  emphasis: string;
+  tail: string;
+};
+
+/**
+ * Blog presentation layout. `"classic"` (the default) is the original blog
+ * layout. `"rhythm"` snaps every height and gap to the vertical rhythm grid,
+ * floats featured images on the grid, draws rhythm rules between items, adds
+ * the eyebrow/tagline header and the rhythm overlay hotkey (Ctrl+=).
+ */
+export type SiteBrandBlogLayout = "classic" | "rhythm";
+
+/** Default scenario content a brand supplies for the layout lab. */
+export type SiteBrandDemoEdition = {
+  title: string;
+  editionDate: string;
+  description: string;
+  articles: Article[];
+  suppressNewsDeskAppendix?: boolean;
+  editionVideo?: ArticleVideoAsset;
+};
+
+/**
+ * Video slot: how a publication supplies its own VideoML scene components.
+ * Paths are relative to the publication root.
+ */
+export type SiteBrandVideo = {
+  /** TSX module that registers the brand's `@videoml` scene components via `window.Babulus.registerComponent`. */
+  bundleEntry: string;
+  /** DSL element aliases for the browser preview, e.g. `{ "quote-card": "acme-quote-card" }`. */
+  sceneComponents?: Record<string, string>;
+  rhythm?: Record<string, unknown>;
+};
+
 export type SiteBrand = {
   id: SiteBrandId;
   appTitle: string;
@@ -24,6 +71,10 @@ export type SiteBrand = {
   mastheadTitle: string;
   mastheadSubtitle: string;
   mastheadTagline?: string;
+  /** Rhythm blog layout only: small line above the masthead title, e.g. "Acme Research". The first word is emphasized. */
+  mastheadEyebrow?: string;
+  /** Rhythm blog layout only: structured tagline; `mastheadTagline` stays the plain-text fallback. */
+  mastheadTaglineLines?: SiteBrandTaglineLine[];
   backToHomeLabel: string;
   articleTitleSuffix: string;
   placeholderByline: string;
@@ -51,17 +102,36 @@ export type SiteBrand = {
   rootRoute?: RootRouteConfig;
   /** Public URL prefix for newsroom routes. Default `/newsroom`; use `""` on a CMS-only subdomain. */
   newsroomBasePath?: string;
+  /** Public URL prefix for the Pretext reader (home, editions, articles, archive, settings). Default `""`; e.g. `/information`. */
+  readerBasePath?: string;
   opsChrome: OpsChrome;
   corpusKey: string;
   steeringConfigPath: string;
   newsroomSectionsConfigPath: string;
   analysisProfilesPath: string;
   publicationName: string;
+  components?: SiteBrandComponents;
+  /**
+   * Video player chrome. `"native"` (default) is the browser's controls;
+   * `"framed"` wraps the media in `.article-video__media` and renders a
+   * "Play Video" button with a seek bar (`.article-video__cta*`), styled by the publication CSS.
+   */
+  videoPlayer?: "native" | "framed";
+  /** Blog presentation layout. Default `"classic"`. See `SiteBrandBlogLayout`. */
+  blogLayout?: SiteBrandBlogLayout;
+  /**
+   * Brand font slot: families the root layout loads (Google Fonts stylesheet
+   * or self-hosted files) and exposes as CSS custom properties. See
+   * `lib/brand-fonts.ts` and docs/brand-slots.md.
+   */
+  fonts?: SiteBrandFont[];
+  demoEdition?: SiteBrandDemoEdition;
+  video?: SiteBrandVideo;
 };
 
 const SERIF_TEXT_FONT = 'Georgia, "Times New Roman", serif';
 
-const BUILT_IN_SITE_BRANDS: Record<SiteBrandId, SiteBrand> = {
+const REFERENCE_SITE_BRANDS: Record<SiteBrandId, SiteBrand> = {
   papyrus: {
     id: "papyrus",
     appTitle: "Papyrus",
@@ -88,63 +158,46 @@ const BUILT_IN_SITE_BRANDS: Record<SiteBrandId, SiteBrand> = {
     analysisProfilesPath: "corpora/papyrus-analysis-profiles.yml",
     publicationName: "Anthus Threat Intelligence",
   },
-  "threat-intelligence": threatIntelligenceBrand,
-  "pilobol-us": pilobolUsBrand,
-  "anth-us": anthUsBrand,
 };
 
 /**
- * Built-in reference brands plus whatever the publication registered in its
+ * The Papyrus reference brand plus whatever the publication registered in its
  * own `papyrus.config.ts` (resolved through the `papyrus-site` alias).
  */
 const SITE_BRANDS: Record<SiteBrandId, SiteBrand> = {
-  ...BUILT_IN_SITE_BRANDS,
+  ...REFERENCE_SITE_BRANDS,
   ...Object.fromEntries((papyrusSite.brands ?? []).map((brand) => [brand.id, brand])),
 };
 
 export function normalizeSiteBrandId(value: string | undefined | null): SiteBrandId | null {
   if (!value) return null;
-  const normalized = value.trim().toLowerCase().replace(/[._]/g, "-");
-  if (!normalized) return null;
-  if (normalized === "papyrus") return "papyrus";
-  // NOTE: the bare alias `anthus` has resolved to `threat-intelligence` since
-  // that brand was added and is kept pointing there so existing
-  // PAPYRUS_SITE_BRAND values do not silently change meaning. The Anth.us
-  // publication is therefore addressed as `anth-us` / `anth.us` / `anth_us`
-  // only. Do not "tidy" this by moving `anthus` across.
-  if (normalized === "threat-intelligence" || normalized === "threat-intel" || normalized === "anthus") {
-    return "threat-intelligence";
-  }
-  if (normalized === "anth-us") {
-    // `normalized` has already mapped `.` and `_` to `-`, so this covers
-    // `anth.us` and `anth_us` too.
-    return "anth-us";
-  }
-  // Bare `pilobol` is deliberately NOT an alias (f268e72): the brand name is
-  // Pilobolus; Pilobol.us is the domain and `pilobol-us` the technical id.
-  if (normalized === "pilobol-us" || normalized === "pilobolus") {
-    return "pilobol-us";
-  }
-  // Registered brands (publication-owned `papyrus.config.ts`): exact id only.
-  if (Object.prototype.hasOwnProperty.call(SITE_BRANDS, normalized)) return normalized;
-  return null;
+  const trimmed = value.trim();
+  return Object.prototype.hasOwnProperty.call(SITE_BRANDS, trimmed) ? trimmed : null;
 }
 
-export function resolveSiteBrandId(
-  raw: string | undefined | null = process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND ?? process.env.PAPYRUS_SITE_BRAND,
-): SiteBrandId {
-  return normalizeSiteBrandId(raw) ?? papyrusSite.defaultBrand ?? "papyrus";
+function unknownBrandError(value: string): Error {
+  return new Error(`Unknown brand '${value}'. Registered: ${Object.keys(SITE_BRANDS).join(", ")}`);
 }
 
-/** Cookie set by middleware when `?brand=` is present (demo without rebuild). */
-export function resolveRuntimeSiteBrandId(
-  cookieOverride: string | undefined | null = null,
+export function resolveSiteBrandId(
+  raw: string | undefined | null = process.env.NEXT_PUBLIC_PAPYRUS_SITE_BRAND ?? process.env.PAPYRUS_SITE_BRAND,
 ): SiteBrandId {
-  return normalizeSiteBrandId(cookieOverride) ?? resolveSiteBrandId();
+  const requested = raw?.trim();
+  if (requested) {
+    const normalized = normalizeSiteBrandId(requested);
+    if (normalized === null) throw unknownBrandError(requested);
+    return normalized;
+  }
+  const fallback = papyrusSite.defaultBrand ?? "papyrus";
+  const normalizedFallback = normalizeSiteBrandId(fallback);
+  if (normalizedFallback === null) throw unknownBrandError(fallback);
+  return normalizedFallback;
 }
 
 export function getSiteBrand(id: SiteBrandId = resolveSiteBrandId()): SiteBrand {
-  return SITE_BRANDS[id];
+  const brand = Object.prototype.hasOwnProperty.call(SITE_BRANDS, id) ? SITE_BRANDS[id] : undefined;
+  if (!brand) throw unknownBrandError(id);
+  return brand;
 }
 
 export const SITE_BRAND = getSiteBrand();

package/lib/site-env.ts

@@ -0,0 +1,52 @@
+export type SiteEnv = "production" | "staging" | "development";
+export type ContentSource = "published" | "drafts";
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+const SITE_ENVIRONMENTS: readonly SiteEnv[] = ["production", "staging", "development"];
+const CONTENT_SOURCES: readonly ContentSource[] = ["published", "drafts"];
+const PRODUCTION_BRANCH = "main";
+
+export function getSiteEnv(environment: EnvironmentVariables = process.env): SiteEnv {
+  const configured = (environment.SITE_ENV ?? "").trim();
+  if (!configured) return "development";
+  if (!SITE_ENVIRONMENTS.includes(configured as SiteEnv)) {
+    throw new Error(`SITE_ENV must be one of ${SITE_ENVIRONMENTS.join(", ")}; received "${configured}".`);
+  }
+  if (configured === "production") {
+    const branch = (environment.AWS_BRANCH ?? "").trim();
+    if (branch && branch !== PRODUCTION_BRANCH) return "staging";
+  }
+  return configured as SiteEnv;
+}
+
+export function getContentSource(environment: EnvironmentVariables = process.env): ContentSource {
+  const configured = (environment.PAPYRUS_CONTENT_SOURCE ?? "").trim();
+  if (!configured) return "published";
+  if (!CONTENT_SOURCES.includes(configured as ContentSource)) {
+    throw new Error(`PAPYRUS_CONTENT_SOURCE must be one of ${CONTENT_SOURCES.join(", ")}; received "${configured}".`);
+  }
+  return configured as ContentSource;
+}
+
+export function isIndexable(environment: EnvironmentVariables = process.env): boolean {
+  return getSiteEnv(environment) === "production";
+}
+
+export function showStagingBanner(environment: EnvironmentVariables = process.env): boolean {
+  return getSiteEnv(environment) === "staging";
+}
+
+export function analyticsAllowed(environment: EnvironmentVariables = process.env): boolean {
+  return getSiteEnv(environment) === "production";
+}
+
+export function assertContentSourceMatchesEnv(environment: EnvironmentVariables = process.env): void {
+  if (getContentSource(environment) !== "drafts") return;
+  const siteEnv = getSiteEnv(environment);
+  if (siteEnv !== "staging") {
+    throw new Error(
+      `PAPYRUS_CONTENT_SOURCE=drafts requires SITE_ENV=staging; the resolved site environment is "${siteEnv}". Drafts must never be served from production or development.`,
+    );
+  }
+}

package/lib/staging-gate.ts

@@ -0,0 +1,37 @@
+import type { NextRequest, NextResponse } from "next/server";
+import { fetchAuthSession } from "aws-amplify/auth/server";
+import { getAmplifyServerRuntime } from "./amplify-server-runtime";
+
+export type StagingAccess = "anonymous" | "forbidden" | "ok";
+
+const STAGING_ALLOWED_GROUPS = ["editor", "admin"];
+
+export function groupsFromIdTokenPayload(payload: Record<string, unknown> | undefined): string[] {
+  const raw = payload?.["cognito:groups"];
+  if (Array.isArray(raw)) return raw.filter((group): group is string => typeof group === "string");
+  if (typeof raw === "string" && raw) return [raw];
+  return [];
+}
+
+export function accessForGroups(groups: string[] | null): StagingAccess {
+  if (groups === null) return "anonymous";
+  return groups.some((group) => STAGING_ALLOWED_GROUPS.includes(group)) ? "ok" : "forbidden";
+}
+
+export async function getStagingAccess(request: NextRequest, response: NextResponse): Promise<StagingAccess> {
+  const { runWithAmplifyServerContext } = getAmplifyServerRuntime();
+  const groups = await runWithAmplifyServerContext({
+    nextServerContext: { request, response },
+    operation: async (contextSpec) => {
+      try {
+        const session = await fetchAuthSession(contextSpec);
+        const idTokenPayload = session.tokens?.idToken?.payload as Record<string, unknown> | undefined;
+        if (!session.tokens?.idToken) return null;
+        return groupsFromIdTokenPayload(idTokenPayload);
+      } catch {
+        return null;
+      }
+    },
+  });
+  return accessForGroups(groups);
+}

package/lib/staging-gated-path.ts

@@ -0,0 +1,22 @@
+import { normalizeReaderBasePath } from "./reader-base-path";
+
+function isStaticOrApiPath(pathname: string): boolean {
+  return (
+    pathname.startsWith("/_next")
+    || pathname.startsWith("/api")
+    || pathname === "/favicon.ico"
+    || pathname.startsWith("/icon")
+    || /\.[a-zA-Z0-9]+$/.test(pathname)
+  );
+}
+
+export { isStaticOrApiPath };
+
+export function isStagingGatedPath(pathname: string, readerBasePath: string = ""): boolean {
+  if (isStaticOrApiPath(pathname)) return false;
+  if (pathname === "/robots.txt") return false;
+  if (pathname === "/newsroom" || pathname.startsWith("/newsroom/")) return false;
+  const base = normalizeReaderBasePath(readerBasePath);
+  if (base) return pathname === base || pathname.startsWith(`${base}/`);
+  return true;
+}

package/lib/staging-preview-object.ts

@@ -0,0 +1,98 @@
+import { cookies } from "next/headers";
+import { getUrl } from "aws-amplify/storage/server";
+import { getAmplifyServerRuntime } from "./amplify-server-runtime";
+import { getSiteEnv } from "./site-env";
+
+export const PREVIEW_ROUTE_PREFIX = "/__preview";
+export const PREVIEW_KEY_PREFIX = "preview/";
+
+const PRESIGN_SECONDS = 60;
+const NOT_FOUND_ERROR_NAMES = ["NotFound", "NoSuchKey"];
+const PREVIEW_EXCLUDED_PREFIXES = ["/newsroom", "/api", "/_next", PREVIEW_ROUTE_PREFIX];
+
+export function isStaticPreviewEnabled(environment: Record<string, string | undefined> = process.env): boolean {
+  return getSiteEnv(environment) === "staging" && (environment.PAPYRUS_STAGING_PREVIEW ?? "").trim() === "static";
+}
+
+export function previewCandidateKeys(requestPath: string): string[] | null {
+  if (requestPath.includes("//")) return null;
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(requestPath);
+  } catch {
+    return null;
+  }
+  if (decoded.includes("//") || decoded.includes("\\") || decoded.includes("\0")) return null;
+  const segments = decoded.split("/").filter((segment) => segment !== "");
+  if (segments.some((segment) => segment === ".." || segment === ".")) return null;
+  if (segments.length === 0) return [`${PREVIEW_KEY_PREFIX}index.html`];
+  const joined = segments.join("/");
+  if (decoded.endsWith("/")) return [`${PREVIEW_KEY_PREFIX}${joined}/index.html`];
+  const base = `${PREVIEW_KEY_PREFIX}${joined}`;
+  return [base, `${base}.html`, `${base}/index.html`];
+}
+
+export function shouldRewriteToPreview(pathname: string): boolean {
+  if (pathname === "/favicon.ico" || pathname === "/robots.txt" || pathname.startsWith("/icon")) return false;
+  return !PREVIEW_EXCLUDED_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+
+export function isPreviewGatedPath(pathname: string): boolean {
+  return shouldRewriteToPreview(pathname) || pathname === PREVIEW_ROUTE_PREFIX || pathname.startsWith(`${PREVIEW_ROUTE_PREFIX}/`);
+}
+
+export function previewRewritePathname(pathname: string): string {
+  return `${PREVIEW_ROUTE_PREFIX}${pathname}`;
+}
+
+export function previewRequestPath(pathname: string): string {
+  return pathname.slice(PREVIEW_ROUTE_PREFIX.length) || "/";
+}
+
+function isNotFoundError(error: unknown): boolean {
+  const name = (error as { name?: string } | null)?.name ?? "";
+  return NOT_FOUND_ERROR_NAMES.includes(name);
+}
+
+async function presignFirstExistingKey(candidateKeys: string[]): Promise<URL | null> {
+  const { runWithAmplifyServerContext } = getAmplifyServerRuntime();
+  return runWithAmplifyServerContext({
+    nextServerContext: { cookies },
+    operation: async (contextSpec) => {
+      for (const key of candidateKeys) {
+        try {
+          const { url } = await getUrl(contextSpec, {
+            path: key,
+            options: { validateObjectExistence: true, expiresIn: PRESIGN_SECONDS },
+          });
+          return url;
+        } catch (error) {
+          if (!isNotFoundError(error)) throw error;
+        }
+      }
+      return null;
+    },
+  });
+}
+
+function notFound(): Response {
+  return new Response("Not found", { status: 404, headers: { "Cache-Control": "private, no-store" } });
+}
+
+export async function streamPreviewObject(pathname: string): Promise<Response> {
+  if (!isStaticPreviewEnabled()) return notFound();
+  const candidateKeys = previewCandidateKeys(previewRequestPath(pathname));
+  if (!candidateKeys) return notFound();
+  const presigned = await presignFirstExistingKey(candidateKeys);
+  if (!presigned) return notFound();
+  const upstream = await fetch(presigned);
+  if (!upstream.ok || !upstream.body) return notFound();
+  return new Response(upstream.body, {
+    status: 200,
+    headers: {
+      "Content-Type": upstream.headers.get("content-type") ?? "application/octet-stream",
+      "Cache-Control": "private, no-store",
+      "X-Robots-Tag": "noindex, nofollow",
+    },
+  });
+}

package/lib/video-mode.ts

@@ -0,0 +1,42 @@
+export type VideoMode = "preview" | "mp4";
+
+function parseVideoMode(value: string | null | undefined): VideoMode | null {
+  if (value === "preview" || value === "mp4") return value;
+  return null;
+}
+
+/** Server-safe mode from env only. Production always returns `"mp4"`. */
+export function resolveVideoModeFromEnv(): VideoMode {
+  if (process.env.NODE_ENV === "production") return "mp4";
+  return parseVideoMode(process.env.NEXT_PUBLIC_PAPYRUS_VIDEO_MODE) ?? "preview";
+}
+
+/** Client-only `?video=` override. Returns null when absent or in production. */
+export function resolveVideoModeFromSearch(search: string): VideoMode | null {
+  if (process.env.NODE_ENV === "production") return null;
+  const query = search.startsWith("?") ? search.slice(1) : search;
+  return parseVideoMode(new URLSearchParams(query).get("video"));
+}
+
+/**
+ * Effective video mode for the reader.
+ * Production always uses `"mp4"`. In development, `?video=` overrides
+ * `NEXT_PUBLIC_PAPYRUS_VIDEO_MODE` (default `"preview"`).
+ */
+export function resolveVideoMode(): VideoMode {
+  if (process.env.NODE_ENV === "production") return "mp4";
+  if (typeof window !== "undefined") {
+    const fromSearch = resolveVideoModeFromSearch(window.location.search);
+    if (fromSearch) return fromSearch;
+  }
+  return resolveVideoModeFromEnv();
+}
+
+/**
+ * Server-safe gate for fetching VideoML DSL scripts.
+ * Always true in development so `?video=preview` and `?video=mp4` can both
+ * work without restarting the server. Production never fetches scripts.
+ */
+export function shouldFetchVideoScripts(): boolean {
+  return process.env.NODE_ENV === "development";
+}

package/lib/video-script.ts

@@ -0,0 +1,77 @@
+export type VideoElementAliases = Record<string, string>;
+
+/**
+ * Rewrites generic VideoML element names in a stored script to the publication's
+ * own scene components, e.g. `{ "quote-card": "acme-quote-card" }`.
+ */
+export function normalizeDevPreviewDsl(dsl: string, elementAliases: VideoElementAliases = {}): string {
+  let normalized = dsl;
+  for (const [generic, branded] of Object.entries(elementAliases)) {
+    const escaped = generic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    normalized = normalized.replace(new RegExp(`(</?)${escaped}(?=[\\s/>])`, "g"), `$1${branded}`);
+  }
+  return normalized;
+}
+
+export type VideoScriptTargetKind = "article" | "edition";
+
+export type VideoScriptRef = {
+  slug: string;
+  dsl: string;
+  targetKind: VideoScriptTargetKind;
+};
+
+export const EDITION_OVERVIEW_VIDEO_KEY = "edition-overview";
+
+export function collectVideoScriptTargets(
+  items: ReadonlyArray<{ slug: string; video?: unknown }>,
+  hasEditionVideo: boolean,
+): string[] {
+  const targets = new Set<string>();
+  if (hasEditionVideo) targets.add(EDITION_OVERVIEW_VIDEO_KEY);
+  for (const item of items) {
+    if (item.video) targets.add(item.slug);
+  }
+  return [...targets];
+}
+
+export function videomlItemSlug(targetSlug: string): string {
+  return `${targetSlug}--videoml`;
+}
+
+export function parseVideoScriptRef(item: {
+  slug: string;
+  editorial?: unknown;
+}): VideoScriptRef | null {
+  const editorial = parseEditorial(item.editorial);
+  const videoScript = editorial?.videoScript;
+  if (!videoScript || typeof videoScript !== "object" || Array.isArray(videoScript)) return null;
+
+  const scriptRecord = videoScript as Record<string, unknown>;
+  const dsl = typeof scriptRecord.dsl === "string" ? scriptRecord.dsl.trim() : "";
+  if (!dsl) return null;
+
+  const target = scriptRecord.target;
+  const targetKind: VideoScriptTargetKind =
+    target && typeof target === "object" && !Array.isArray(target) && (target as Record<string, unknown>).kind === "edition"
+      ? "edition"
+      : "article";
+
+  return { slug: item.slug, dsl, targetKind };
+}
+
+function parseEditorial(editorial: unknown): Record<string, unknown> | null {
+  if (!editorial) return null;
+  if (typeof editorial === "string") {
+    try {
+      const parsed = JSON.parse(editorial) as unknown;
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
+    } catch {
+      return null;
+    }
+  }
+  if (typeof editorial === "object" && !Array.isArray(editorial)) {
+    return editorial as Record<string, unknown>;
+  }
+  return null;
+}

package/middleware.ts

@@ -1,49 +1,39 @@
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
-import { getSiteBrand, normalizeSiteBrandId, resolveSiteBrandId } from "./lib/site-brand";
+import { getSiteBrand } from "./lib/site-brand";
+import { getReaderBasePath } from "./lib/reader-base-path";
+import { isStagingGatedPath, isStaticOrApiPath } from "./lib/staging-gated-path";
+import { getSiteEnv, isIndexable } from "./lib/site-env";
+import { getStagingAccess } from "./lib/staging-gate";
+import {
+  isPreviewGatedPath,
+  isStaticPreviewEnabled,
+  previewRewritePathname,
+  shouldRewriteToPreview,
+} from "./lib/staging-preview-object";
 
-const BRAND_OVERRIDE_COOKIE = "papyrus-site-brand-override";
-
-function usesNewsroomRootPaths(request: NextRequest): boolean {
-  const cookieBrand = request.cookies.get(BRAND_OVERRIDE_COOKIE)?.value;
-  const brandId = normalizeSiteBrandId(cookieBrand)
-    ?? normalizeSiteBrandId(request.nextUrl.searchParams.get("brand"))
-    ?? resolveSiteBrandId();
-  // Brand property (not a hard-coded id) so publication-registered brands work.
-  return getSiteBrand(brandId).rootRoute?.kind === "newsroom" && getSiteBrand(brandId).newsroomBasePath === "";
+function usesNewsroomRootPaths(): boolean {
+  const brand = getSiteBrand();
+  return brand.rootRoute?.kind === "newsroom" && brand.newsroomBasePath === "";
 }
 
-function isStaticOrApiPath(pathname: string): boolean {
-  return (
-    pathname.startsWith("/_next")
-    || pathname.startsWith("/api")
-    || pathname === "/favicon.ico"
-    || pathname.startsWith("/icon")
-    || /\.[a-zA-Z0-9]+$/.test(pathname)
-  );
+function isStagingGatedPathForBrand(pathname: string): boolean {
+  return isStagingGatedPath(pathname, getReaderBasePath());
 }
 
-export function middleware(request: NextRequest) {
-  const brandParam = request.nextUrl.searchParams.get("brand");
-  const brandId = normalizeSiteBrandId(brandParam);
-  let response: NextResponse | null = null;
-
-  if (brandId) {
-    response = NextResponse.next();
-    response.cookies.set(BRAND_OVERRIDE_COOKIE, brandId, {
-      path: "/",
-      maxAge: 60 * 60 * 24 * 30,
-      sameSite: "lax",
-    });
+function routeRequest(request: NextRequest): NextResponse {
+  if (isStaticPreviewEnabled() && shouldRewriteToPreview(request.nextUrl.pathname)) {
+    const rewriteUrl = request.nextUrl.clone();
+    rewriteUrl.pathname = previewRewritePathname(request.nextUrl.pathname);
+    return NextResponse.rewrite(rewriteUrl);
   }
-
-  if (!usesNewsroomRootPaths(request)) {
-    return response ?? NextResponse.next();
+  if (!usesNewsroomRootPaths()) {
+    return NextResponse.next();
   }
 
   const { pathname } = request.nextUrl;
   if (isStaticOrApiPath(pathname)) {
-    return response ?? NextResponse.next();
+    return NextResponse.next();
   }
 
   if (pathname === "/newsroom" || pathname === "/newsroom/") {
@@ -55,24 +45,48 @@ export function middleware(request: NextRequest) {
   }
 
   if (pathname === "/" || pathname === "") {
-    return response ?? NextResponse.next();
+    return NextResponse.next();
   }
 
   if (!pathname.startsWith("/newsroom")) {
     const rewriteUrl = request.nextUrl.clone();
     rewriteUrl.pathname = `/newsroom${pathname}`;
-    const rewrite = NextResponse.rewrite(rewriteUrl);
-    if (response) {
-      for (const cookie of response.cookies.getAll()) {
-        rewrite.cookies.set(cookie);
-      }
+    return NextResponse.rewrite(rewriteUrl);
+  }
+
+  return NextResponse.next();
+}
+
+export async function middleware(request: NextRequest): Promise<NextResponse> {
+  let sessionResponse: NextResponse | null = null;
+  const { pathname } = request.nextUrl;
+  const gated = isStaticPreviewEnabled() ? isPreviewGatedPath(pathname) : isStagingGatedPathForBrand(pathname);
+  if (getSiteEnv() === "staging" && gated) {
+    sessionResponse = NextResponse.next();
+    const access = await getStagingAccess(request, sessionResponse);
+    if (access === "anonymous") {
+      return withRobotsHeader(NextResponse.redirect(new URL("/newsroom", request.url)));
+    }
+    if (access === "forbidden") {
+      return withRobotsHeader(new NextResponse("Staging is limited to editors and admins.", { status: 403 }));
     }
-    return rewrite;
   }
 
-  return response ?? NextResponse.next();
+  const response = routeRequest(request);
+  if (sessionResponse) {
+    for (const cookie of sessionResponse.headers.getSetCookie()) {
+      response.headers.append("set-cookie", cookie);
+    }
+  }
+  return withRobotsHeader(response);
+}
+
+function withRobotsHeader(response: NextResponse): NextResponse {
+  if (!isIndexable()) response.headers.set("X-Robots-Tag", "noindex, nofollow");
+  return response;
 }
 
 export const config = {
+  runtime: "nodejs",
   matcher: ["/((?!_next/static|_next/image|favicon.ico|icon).*)"],
 };