@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.21

package/amplify/site-backend.ts

@@ -8,17 +8,18 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as ses from "aws-cdk-lib/aws-ses";
 import * as sesActions from "aws-cdk-lib/aws-ses-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { CfnEventSourceMapping, CfnFunction, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+import { CfnEventSourceMapping, Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { CfnIndex, CfnVectorBucket, CfnVectorBucketPolicy } from "aws-cdk-lib/aws-s3vectors";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
-import { graphqlJwtAuthorizer } from "./functions/graphql-jwt-authorizer/resource";
+import { contentActions } from "./functions/content-actions/resource";
 import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
@@ -86,12 +87,13 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = site.features?.slack ?? readEnvFlag("PAPYRUS_ENABLE_SLACK", false);
   const enableStorageBackups = site.features?.storageBackups ?? readEnvFlag("PAPYRUS_ENABLE_STORAGE_BACKUPS", isAmplifyProductionPipeline);
 
+  const authConfig = site.auth ?? authConfigFromEnv();
   const backend = defineBackend({
     assignmentAction,
-    auth: defineSiteAuth(site.auth ?? authConfigFromEnv()),
+    auth: defineSiteAuth(authConfig),
     categoryAction,
+    contentActions,
     data,
-    graphqlJwtAuthorizer,
     knowledgeQuery,
     manageUserRole,
     modelAttachmentUpload,
@@ -105,6 +107,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
+  if (
+    authConfig.applyCognitoDomainPrefix === true
+    && requestedCognitoDomainPrefix !== ""
+    && authConfig.disableGoogleOAuth !== true
+  ) {
+    applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
+  }
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
@@ -157,43 +168,19 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     const messageThreadTable = backend.data.resources.tables.MessageThread;
     const dataStack = Stack.of(messageTable);
     const graphqlEndpoint = backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl;
-    const jwtAuthorizerCfn = backend.graphqlJwtAuthorizer.resources.lambda.node.defaultChild as CfnFunction | undefined;
-    const jwtAuthorizerEnvironment = jwtAuthorizerCfn?.environment;
-    const jwtAuthorizerVariables =
-      jwtAuthorizerEnvironment
-      && typeof jwtAuthorizerEnvironment === "object"
-      && "variables" in jwtAuthorizerEnvironment
-        ? (jwtAuthorizerEnvironment as { variables?: Record<string, string> }).variables
-        : undefined;
-    const jwtSsmEnvConfig =
-      process.env.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || jwtAuthorizerVariables?.AMPLIFY_SSM_ENV_CONFIG?.trim()
-      || "";
+    const amplifySsmEnvConfig = process.env.AMPLIFY_SSM_ENV_CONFIG?.trim() || "";
 
     if (enableConsoleResponder) {
-      const consoleChatResponder = new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
+      new ConsoleChatResponderStack(dataStack, "ConsoleChatResponder", {
         messageTable,
         messageStreamArn,
         threadTable: messageThreadTable,
         projectRoot,
         graphqlEndpoint,
-        amplifySsmEnvConfig: jwtSsmEnvConfig || undefined,
         responseTarget: process.env.PAPYRUS_CONSOLE_RESPONSE_TARGET,
         model: process.env.PAPYRUS_CONSOLE_MODEL,
         prebuiltImageUri: process.env.PAPYRUS_CONSOLE_RESPONDER_IMAGE_URI,
       });
-      if (jwtSsmEnvConfig) {
-        consoleChatResponder.responderFunction.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-      }
-      const jwtSecretSsmParam =
-        process.env.PAPYRUS_JWT_SECRET_SSM_PARAM?.trim()
-        || (productionAppId !== "" && amplifyAppId === productionAppId
-          ? `/amplify/${amplifyAppId}/main-branch-cb38ada667/PAPYRUS_JWT_SECRET`
-          : "/amplify/papyrus/ryan-sandbox-adcd88a186/PAPYRUS_JWT_SECRET");
-      consoleChatResponder.responderFunction.addEnvironment(
-        "PAPYRUS_JWT_SECRET_SSM_PARAM",
-        jwtSecretSsmParam,
-      );
     }
 
     if (enableSlackAgent) {
@@ -214,9 +201,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         "PAPYRUS_SLACK_ALLOWED_USER_IDS",
         (process.env.PAPYRUS_SLACK_ALLOWED_USER_IDS ?? "").trim(),
       );
-      if (jwtSsmEnvConfig) {
-        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
-        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", jwtSsmEnvConfig);
+      if (amplifySsmEnvConfig) {
+        backend.slackEvents.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
+        backend.slackDelivery.addEnvironment("AMPLIFY_SSM_ENV_CONFIG", amplifySsmEnvConfig);
       }
       backend.slackDelivery.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", graphqlEndpoint);
       backend.slackDelivery.addEnvironment(
@@ -386,6 +373,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   for (const resource of [
     backend.assignmentAction,
     backend.categoryAction,
+    backend.contentActions,
     backend.emailSubmissionProcessor,
     backend.knowledgeQuery,
     backend.modelAttachmentUpload,
@@ -399,6 +387,50 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   grantNewsroomReadWrite(backend.assignmentAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.categoryAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda as LambdaFunction);
+  const contentActionsLambda = backend.contentActions.resources.lambda as LambdaFunction;
+  grantNewsroomReadWriteDelete(contentActionsLambda);
+  contentActionsLambda.addEnvironment(
+    "PAPYRUS_GRAPHQL_ENDPOINT",
+    backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
+  );
+  contentActionsLambda.addToRolePolicy(
+    new PolicyStatement({
+      actions: ["appsync:GraphQL"],
+      resources: ["*"],
+    }),
+  );
+  const rebuildSettings = rebuildTriggerSettings({
+    reader: site.reader,
+    stagingBuildEnabled: site.stagingBuild?.enabled === true,
+    cmsAppId: amplifyAppId,
+    region: Stack.of(contentActionsLambda).region,
+    account: Stack.of(contentActionsLambda).account,
+  });
+  for (const [name, value] of Object.entries(rebuildSettings.environment)) {
+    contentActionsLambda.addEnvironment(name, value);
+  }
+  if (rebuildSettings.resources.length > 0) {
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({ actions: rebuildSettings.actions, resources: rebuildSettings.resources }),
+    );
+  }
+  if ((site.revalidateBaseUrl ?? "").trim() !== "") {
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_BASE_URL", (site.revalidateBaseUrl ?? "").trim());
+    const revalidateSecretParameter = (process.env.PAPYRUS_REVALIDATE_SECRET_PARAMETER ?? "").trim();
+    if (!revalidateSecretParameter.startsWith("/")) {
+      throw new Error(
+        "revalidateBaseUrl is set but PAPYRUS_REVALIDATE_SECRET_PARAMETER is not (an SSM parameter name starting with /). The app-shell template sets it on the production branch for Pretext sites; see docs/site-hosting.md.",
+      );
+    }
+    backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
+    const revalidateStack = Stack.of(contentActionsLambda);
+    contentActionsLambda.addToRolePolicy(
+      new PolicyStatement({
+        actions: ["ssm:GetParameter"],
+        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
+      }),
+    );
+  }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);
   if (backend.sesInboundReceive) {

package/amplify/storage/resource.js

@@ -11,6 +11,9 @@ export const storage = defineStorage({
         "corpora/*": [
             allow.groups(["editor", "admin"]).to(["read"]),
         ],
+        "preview/*": [
+            allow.groups(["editor", "admin"]).to(["read"]),
+        ],
         "newsroom/*": [
             allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
         ],

package/amplify/storage/resource.ts

@@ -12,6 +12,9 @@ export const storage = defineStorage({
     "corpora/*": [
       allow.groups(["editor", "admin"]).to(["read"]),
     ],
+    "preview/*": [
+      allow.groups(["editor", "admin"]).to(["read"]),
+    ],
     "newsroom/*": [
       allow.groups(["editor", "admin"]).to(["read", "write", "delete"]),
     ],

package/app/%5F_preview/[[...path]]/route.ts

@@ -0,0 +1,8 @@
+import type { NextRequest } from "next/server";
+import { streamPreviewObject } from "../../../lib/staging-preview-object";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest): Promise<Response> {
+  return streamPreviewObject(request.nextUrl.pathname);
+}

package/app/[year]/[month]/[day]/[articleSlug]/page.tsx

@@ -52,10 +52,12 @@ export default async function DateScopedArticlePage({ params }: DateScopedArticl
       editionFooter={{
         editionBasePath,
         entries: buildPresentationFooterEntries(content),
-        subtitle: SITE_BRAND.id === "threat-intelligence" ? "" : (content.description?.trim() || "Inside Papyrus"),
-        title: SITE_BRAND.id === "threat-intelligence" ? "ANTHUS THREAT INTELLIGENCE" : undefined,
+        sections: content.sections.map((section) => ({ key: section.key, label: section.label })),
+        subtitle: SITE_BRAND.footerSubtitleOverride ?? (content.description?.trim() || "Inside Papyrus"),
+        title: SITE_BRAND.footerTitle,
       }}
       item={item}
+      videoScript={content.videoScripts?.[item.slug] ?? null}
       backHref={`${editionBasePath}#${item.slug}`}
     />
   );

package/app/[year]/[month]/[day]/edition-route-page.tsx

@@ -1,4 +1,5 @@
 import { notFound, redirect } from "next/navigation";
+import { siteServesNextReaderRoutes } from "../../../../lib/reader-static-params";
 import { getSiteRenderer } from "../../../../lib/site-renderer";
 import type { PresentationTarget } from "../../../../renderers/pretext";
 import { loadCachedEditionContent } from "../../../../lib/cached-content-repository";
@@ -22,6 +23,7 @@ export async function EditionRoutePage({
   lockedPresentation,
   target = { kind: "edition" },
 }: EditionRoutePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const route = parseEditionDateRoute({ year, month, day });
   if (!route) notFound();
   if (!route.isCanonical) redirect(route.canonicalPath);

package/app/api/revalidate/route.ts

@@ -1,3 +1,4 @@
+import { toPublicReaderPath } from "../../../lib/reader-base-path";
 import { revalidatePath, revalidateTag } from "next/cache";
 import { NextResponse } from "next/server";
 import {
@@ -8,6 +9,7 @@ import {
   editionContentCacheTag,
   editionItemCacheTag,
 } from "../../../lib/cached-content-repository";
+import { isAuthorizedRevalidateRequest } from "../../../lib/revalidate-secret";
 import { getEditionArticlePath, getEditionDatePath } from "../../../lib/edition-routes";
 
 export const dynamic = "force-dynamic";
@@ -21,9 +23,8 @@ type RevalidateRequestBody = {
 };
 
 export async function POST(request: Request) {
-  const configuredSecret = process.env.PAPYRUS_REVALIDATE_SECRET?.trim();
-  const providedSecret = request.headers.get("x-papyrus-revalidate-secret")?.trim();
-  if (!configuredSecret || providedSecret !== configuredSecret) {
+  const providedSecret = request.headers.get("x-papyrus-revalidate-secret");
+  if (!(await isAuthorizedRevalidateRequest(providedSecret))) {
     return NextResponse.json({ ok: false, error: "Unauthorized." }, { status: 401 });
   }
 
@@ -44,8 +45,8 @@ export async function POST(request: Request) {
     if (!normalized) continue;
     revalidateTag(articleCacheTag(normalized));
     revalidatedTags.add(articleCacheTag(normalized));
-    revalidatePath(`/articles/${encodeURIComponent(normalized)}`);
-    revalidatedPaths.add(`/articles/${encodeURIComponent(normalized)}`);
+    revalidatePath(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
+    revalidatedPaths.add(toPublicReaderPath(`/articles/${encodeURIComponent(normalized)}`));
     if (editionDate) {
       revalidateTag(editionItemCacheTag(editionDate, normalized));
       revalidatedTags.add(editionItemCacheTag(editionDate, normalized));
@@ -76,8 +77,8 @@ export async function POST(request: Request) {
   revalidatedTags.add(ARCHIVE_CACHE_TAG);
   revalidateTag(ARTICLES_CACHE_TAG);
   revalidatedTags.add(ARTICLES_CACHE_TAG);
-  revalidatePath("/archive");
-  revalidatedPaths.add("/archive");
+  revalidatePath(toPublicReaderPath("/archive"));
+  revalidatedPaths.add(toPublicReaderPath("/archive"));
 
   for (const path of body.paths ?? []) {
     const normalized = path.trim();

package/app/articles/[slug]/page.tsx

@@ -1,7 +1,7 @@
 import { notFound } from "next/navigation";
 import { getSiteRenderer } from "../../../lib/site-renderer";
-import { getCachedArticle } from "../../../lib/cached-content-repository";
-import { generateArticleStaticParams } from "../../../lib/reader-static-params";
+import { getCachedArticle, getCachedVideoScript } from "../../../lib/cached-content-repository";
+import { generateArticleStaticParams, siteServesNextReaderRoutes } from "../../../lib/reader-static-params";
 import { SITE_BRAND } from "../../../lib/site-brand";
 
 // Keep in sync with READER_REVALIDATE_SECONDS in lib/reader-route-config.ts
@@ -16,6 +16,7 @@ type ArticlePageProps = {
 };
 
 export async function generateMetadata({ params }: ArticlePageProps) {
+  if (!siteServesNextReaderRoutes()) return {};
   const { slug } = await params;
   const article = await getCachedArticle(slug);
   if (!article) return {};
@@ -26,10 +27,11 @@ export async function generateMetadata({ params }: ArticlePageProps) {
 }
 
 export default async function ArticlePage({ params }: ArticlePageProps) {
+  if (!siteServesNextReaderRoutes()) notFound();
   const { slug } = await params;
-  const article = await getCachedArticle(slug);
+  const [article, videoScript] = await Promise.all([getCachedArticle(slug), getCachedVideoScript(slug)]);
   if (!article) notFound();
 
   const siteRenderer = getSiteRenderer();
-  return <siteRenderer.renderArticle article={article} backHref="/" />;
+  return <siteRenderer.renderArticle article={article} videoScript={videoScript} backHref="/" />;
 }

package/app/blog-rhythm.css

@@ -0,0 +1,278 @@
+/*
+  Structural CSS for the rhythm blog layout (blogLayout: "rhythm").
+  Every rule is scoped to .blog-rhythm-shell, which only the rhythm layout
+  renders, so classic layouts are unaffected. The shell sets --blog-rhythm,
+  --blog-row-height, --blog-paint-buffer and --blog-paint-height inline.
+  Typography, colors and the header look belong to the publication's theme.css.
+  Optional tokens a publication may set:
+    --blog-hrule-foreground, --blog-section-rule, --blog-section-band-height,
+    --blog-page-padding-x, --blog-secondary-pair-min-width.
+*/
+
+.blog-rhythm-shell {
+  --blog-hrule-foreground: var(--border);
+  --blog-section-rule: var(--border);
+  --blog-section-band-height: calc(var(--blog-row-height) * 2);
+  --blog-page-padding-x: calc(var(--blog-rhythm) * 3);
+  --paper-rhythm: var(--blog-row-height);
+
+  isolation: isolate;
+  position: relative;
+}
+
+.blog-rhythm-shell.presentation-page--blog {
+  padding: calc(var(--blog-row-height) * 4) var(--blog-page-padding-x) 0;
+}
+
+.blog-rhythm-shell > :not(.blog-page-background) {
+  position: relative;
+  z-index: 1;
+}
+
+.blog-rhythm-shell[data-rhythm-overlay="true"]::before {
+  background-image:
+    repeating-linear-gradient(
+      to bottom,
+      rgb(var(--rhythm-overlay-rule-rgb) / var(--rhythm-overlay-rule-alpha)) 0,
+      rgb(var(--rhythm-overlay-rule-rgb) / var(--rhythm-overlay-rule-alpha)) 1px,
+      transparent 1px,
+      transparent var(--blog-row-height)
+    ),
+    repeating-linear-gradient(
+      to bottom,
+      rgb(var(--rhythm-overlay-blue-rgb) / var(--rhythm-overlay-blue-alpha)) 0,
+      rgb(var(--rhythm-overlay-blue-rgb) / var(--rhythm-overlay-blue-alpha)) var(--blog-row-height),
+      rgb(var(--rhythm-overlay-yellow-rgb) / var(--rhythm-overlay-yellow-alpha)) var(--blog-row-height),
+      rgb(var(--rhythm-overlay-yellow-rgb) / var(--rhythm-overlay-yellow-alpha)) calc(var(--blog-row-height) * 2)
+    );
+  content: "";
+  inset: 0;
+  pointer-events: none;
+  position: absolute;
+  z-index: 900;
+}
+
+.blog-rhythm-shell .presentation-header {
+  max-width: 100%;
+  min-width: 0;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header,
+.blog-rhythm-shell .presentation-item,
+.blog-rhythm-shell .presentation-item__copy {
+  max-width: 100%;
+  min-width: 0;
+}
+
+.blog-rhythm-shell .presentation-section-header {
+  align-items: stretch;
+  border-bottom: 0;
+  border-top: 0;
+  display: flex;
+  flex-direction: column;
+  gap: var(--blog-row-height);
+  margin: 0;
+  min-height: 0;
+  padding: calc(var(--blog-row-height) * 4) 0 calc(var(--blog-row-height) * 2);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header__band {
+  align-items: center;
+  display: grid;
+  gap: 0 var(--blog-rhythm);
+  grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr);
+  grid-template-rows: var(--blog-section-band-height);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-section-header__band::before,
+.blog-rhythm-shell .presentation-section-header__band::after {
+  background: var(--blog-section-rule);
+  content: "";
+  grid-row: 1;
+  height: var(--blog-section-band-height);
+}
+
+.blog-rhythm-shell .presentation-section-header__band::before {
+  grid-column: 1;
+}
+
+.blog-rhythm-shell .presentation-section-header__band::after {
+  grid-column: 3;
+}
+
+.blog-rhythm-shell .presentation-section-header__band p {
+  grid-column: 2;
+  grid-row: 1;
+  height: var(--blog-section-band-height);
+  justify-self: center;
+  line-height: var(--blog-section-band-height);
+  margin: 0;
+  padding: 0 var(--blog-rhythm);
+  width: max-content;
+}
+
+.blog-rhythm-shell .presentation-item {
+  border-bottom: 0;
+  gap: var(--blog-row-height) calc(var(--blog-rhythm) * 4);
+  padding-bottom: 0;
+}
+
+.blog-rhythm-shell .presentation-item--blog {
+  grid-template-columns: minmax(0, 1fr);
+}
+
+.blog-rhythm-shell .presentation-rhythm-hrule {
+  display: grid;
+  grid-column: 1 / -1;
+  grid-template-rows: repeat(5, var(--blog-row-height));
+  height: calc(var(--blog-row-height) * 5);
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-rhythm-hrule__line {
+  background: var(--blog-hrule-foreground);
+  grid-row: 3;
+  height: var(--blog-row-height);
+}
+
+@media (min-width: 1100px) {
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) {
+    column-gap: calc(var(--blog-row-height) * 2);
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-section-header,
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-item[data-item-index="0"] {
+    grid-column: 1 / -1;
+  }
+
+  .blog-rhythm-shell .blog-section:has(> .presentation-item[data-item-index="2"]) > .presentation-rhythm-hrule[data-hide-in-secondary-pair="true"] {
+    display: none;
+  }
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout][data-has-image="true"] {
+  display: flex;
+  flex-direction: column;
+  gap: 0;
+  grid-template-columns: minmax(0, 1fr);
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .presentation-item__text-frame {
+  height: var(--feature-text-frame-height);
+  max-width: none;
+  overflow: hidden;
+  position: relative;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .presentation-item__media {
+  height: var(--feature-media-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .presentation-item[data-feature-layout] .pictogram-figure__frame {
+  aspect-ratio: auto;
+  height: var(--feature-image-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__copy {
+  display: contents;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__header {
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__body {
+  min-width: 0;
+  position: relative;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__body .presentation-item__text-frame {
+  margin-top: 0;
+}
+
+.blog-rhythm-shell .presentation-item--blog[data-feature-layout][data-has-image="true"] .presentation-item__media {
+  margin: 0;
+  position: absolute;
+  right: 0;
+  top: 0;
+  z-index: 1;
+}
+
+.blog-rhythm-shell .presentation-item__image img {
+  height: 100%;
+  object-fit: contain;
+  width: 100%;
+}
+
+.blog-rhythm-shell .presentation-item__video {
+  grid-column: 1 / -1;
+  margin: var(--blog-row-height) 0 0;
+}
+
+.blog-rhythm-shell .article-page__hero-video {
+  margin: 0 0 calc(var(--blog-rhythm) * 5);
+}
+
+.blog-rhythm-shell .article-page__hero-video .article-video,
+.blog-rhythm-shell .presentation-item__video-figure {
+  container-type: inline-size;
+}
+
+.blog-rhythm-shell .presentation-item__video-figure .article-video__media,
+.blog-rhythm-shell .article-page__hero-video .article-video__media {
+  height: round(up, calc(100cqw * 9 / 16), var(--blog-row-height));
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout][data-has-image="true"] {
+  display: grid;
+  gap: var(--feature-layout-gap);
+  grid-template-columns: minmax(0, 1fr) var(--feature-image-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-page__hero-video,
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__header {
+  grid-column: 1 / -1;
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__body {
+  align-self: start;
+  grid-column: 1;
+  max-width: var(--feature-copy-width);
+  min-width: 0;
+  width: var(--feature-copy-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__media,
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .pictogram-figure__frame {
+  height: var(--feature-image-height);
+  width: var(--feature-image-width);
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .pictogram-figure__frame {
+  aspect-ratio: auto;
+}
+
+.blog-rhythm-shell .article-float-grid[data-feature-layout] .article-float-grid__media {
+  align-self: start;
+  grid-column: 2;
+  margin: 0;
+  position: relative;
+}
+
+.blog-rhythm-shell .article-float-grid .presentation-item__image {
+  margin: 0;
+}
+
+@media (max-width: 900px) {
+  .blog-rhythm-shell .presentation-item--blog {
+    grid-template-columns: 1fr;
+  }
+}

package/app/globals.css

@@ -1,7 +1,4 @@
-@import "../publications/threat_intelligence/theme.css";
-@import "../publications/papyrus/theme.css";
-@import "../publications/pilobol_us/theme.css";
-@import "../publications/anth_us/theme.css";
+@import "./papyrus-theme.css";
 
 @import "tailwindcss";
 @import "tw-animate-css";
@@ -48,6 +45,7 @@
   --color-surface-foreground: var(--surface-foreground);
   --color-foreground-strong: var(--foreground-strong);
   --color-foreground-muted: var(--foreground-muted);
+  --color-foreground-subtle: var(--foreground-subtle);
 }
 
 :root {
@@ -74,6 +72,7 @@
   --surface-foreground: var(--card-foreground);
   --foreground-strong: var(--slate-12);
   --foreground-muted: var(--slate-10);
+  --foreground-subtle: var(--slate-9);
   --border: var(--slate-6);
   --input: var(--slate-6);
   --ring: var(--slate-8);
@@ -2285,6 +2284,25 @@ img {
   width: 100%;
 }
 
+.article-video__preview-frame {
+  aspect-ratio: 16 / 9;
+  background: #000;
+  border: 0;
+  display: block;
+  width: 100%;
+}
+
+.article-video__preview-controls {
+  align-items: center;
+  display: flex;
+  gap: 0.75rem;
+  margin-top: 0.5rem;
+}
+
+.article-video__preview-controls input[type="range"] {
+  flex: 1;
+}
+
 .article-video__credit {
   color: rgb(var(--ink-solid-rgb) / 0.62);
   font-size: 0.82rem;