feat(web): blog-post ingestion webhook + /blog, dynamic RSS & sitemap

Add an autoblog webhook receiver and a Supabase-backed blog to logicsrc-web
(the app had no Supabase usage before).

- Migration: blog_posts table (RLS: public reads published, service-role
  writes). Applied to the linked project.
- POST /api/webhooks/blog: verifies the Standard Webhooks signature against
  BLOG_WEBHOOK_SECRET via @profullstack/autoblog verifyAndParse (no admin
  user — shared secret only) and upserts the post by slug.
- /blog index + /blog/[slug] render published posts from the table.
- /blog/rss.xml and /sitemap.xml are now dynamic, generated from the table;
  removed the static public/sitemap.xml and public/blog/rss.xml.
- BLOG_WEBHOOK_SECRET added to .env.example.

Verified end-to-end: a signed sample post delivered 200 and appeared in the
index, post page, RSS, and sitemap; build + typecheck pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/logicsrc-web/src/app/api/webhooks/blog/route.ts

@@ -0,0 +1,59 @@
+import type { NextRequest } from "next/server";
+import { verifyAndParse } from "@profullstack/autoblog";
+import { json } from "@/lib/http";
+import { serviceClient } from "@/lib/supabase";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+// POST /api/webhooks/blog — receive an autoblog `post.published` webhook,
+// verify the Standard Webhooks signature against BLOG_WEBHOOK_SECRET, and
+// upsert the post into blog_posts. There is no admin user: the shared
+// secret is the only credential, identical to the other Profullstack
+// autoblog receivers.
+export async function POST(request: NextRequest) {
+  const secret = process.env.BLOG_WEBHOOK_SECRET;
+  if (!secret) {
+    return json({ success: false, error: "Blog webhook is not configured" }, 503);
+  }
+
+  // Raw bytes — the signature is computed over the body as received.
+  const body = await request.text();
+  const headers: Record<string, string> = {};
+  request.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+
+  const result = verifyAndParse({ headers, body, opts: { secret } });
+  if (!result.ok) {
+    return json({ success: false, error: result.reason }, result.status);
+  }
+
+  const post = result.post;
+  const supabase = serviceClient();
+  const { error } = await supabase.from("blog_posts").upsert(
+    {
+      external_id: post.id,
+      slug: post.slug,
+      title: post.title,
+      excerpt: post.excerpt ?? null,
+      html: post.html,
+      markdown: post.markdown ?? null,
+      url: post.url ?? null,
+      canonical_url: post.canonical_url ?? null,
+      author: post.author ?? null,
+      tags: post.tags ?? [],
+      categories: post.categories ?? [],
+      featured_image: post.featured_image ?? null,
+      status: post.status ?? "published",
+      published_at: post.published_at,
+      updated_at: post.updated_at,
+    },
+    { onConflict: "slug" },
+  );
+  if (error) {
+    return json({ success: false, error: error.message }, 500);
+  }
+
+  return json({ received: true, slug: post.slug });
+}

apps/logicsrc-web/src/app/blog/[slug]/page.tsx

@@ -0,0 +1,96 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import type { ReactNode } from "react";
+import type { Metadata } from "next";
+import { publicClient } from "@/lib/supabase";
+
+export const dynamic = "force-dynamic";
+
+type PostRow = {
+  slug: string;
+  title: string;
+  excerpt: string | null;
+  html: string;
+  featured_image: { url?: string } | null;
+  published_at: string;
+};
+
+async function loadPost(slug: string): Promise<PostRow | null> {
+  const supabase = publicClient();
+  const { data } = await supabase
+    .from("blog_posts")
+    .select("slug, title, excerpt, html, featured_image, published_at")
+    .eq("slug", slug)
+    .eq("status", "published")
+    .maybeSingle();
+  return (data as PostRow | null) ?? null;
+}
+
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}): Promise<Metadata> {
+  const { slug } = await params;
+  const post = await loadPost(slug);
+  if (!post) return { title: "Not found · LogicSRC" };
+  return {
+    title: `${post.title} · LogicSRC`,
+    description: post.excerpt ?? undefined,
+    alternates: { canonical: `/blog/${post.slug}` },
+    openGraph: {
+      title: post.title,
+      description: post.excerpt ?? undefined,
+      type: "article",
+      images: post.featured_image?.url ? [post.featured_image.url] : undefined,
+    },
+  };
+}
+
+function formatDate(value: string): string {
+  return new Date(value).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+  });
+}
+
+export default async function BlogPostPage({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}): Promise<ReactNode> {
+  const { slug } = await params;
+  const post = await loadPost(slug);
+  if (!post) notFound();
+
+  return (
+    <main style={{ maxWidth: 760, margin: "0 auto", padding: "64px 24px" }}>
+      <p style={{ marginBottom: 32 }}>
+        <Link href="/blog" style={{ color: "#5b6b7a", textDecoration: "none" }}>
+          ← Blog
+        </Link>
+      </p>
+      <article>
+        <h1 style={{ fontSize: 38, fontWeight: 800, margin: "0 0 8px" }}>
+          {post.title}
+        </h1>
+        <div style={{ color: "#8a95a0", fontSize: 14, marginBottom: 32 }}>
+          {formatDate(post.published_at)}
+        </div>
+        {post.featured_image?.url ? (
+          // eslint-disable-next-line @next/next/no-img-element
+          <img
+            src={post.featured_image.url}
+            alt={post.title}
+            style={{ width: "100%", borderRadius: 12, margin: "0 0 32px" }}
+          />
+        ) : null}
+        <div
+          className="blog-content"
+          dangerouslySetInnerHTML={{ __html: post.html }}
+        />
+      </article>
+    </main>
+  );
+}

apps/logicsrc-web/src/app/blog/page.tsx

@@ -0,0 +1,84 @@
+import Link from "next/link";
+import type { ReactNode } from "react";
+import type { Metadata } from "next";
+import { publicClient } from "@/lib/supabase";
+
+export const dynamic = "force-dynamic";
+
+export const metadata: Metadata = {
+  title: "Blog · LogicSRC",
+  description:
+    "Project notes for LogicSRC OpenSpec standards, AgentSwarm, AgentByte, SDKs, MCP, and reference implementations.",
+  alternates: { types: { "application/rss+xml": "/blog/rss.xml" } },
+};
+
+type PostRow = {
+  slug: string;
+  title: string;
+  excerpt: string | null;
+  published_at: string;
+};
+
+function formatDate(value: string): string {
+  return new Date(value).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+  });
+}
+
+export default async function BlogIndex(): Promise<ReactNode> {
+  const supabase = publicClient();
+  const { data } = await supabase
+    .from("blog_posts")
+    .select("slug, title, excerpt, published_at")
+    .eq("status", "published")
+    .order("published_at", { ascending: false });
+  const posts = (data ?? []) as PostRow[];
+
+  return (
+    <main style={{ maxWidth: 760, margin: "0 auto", padding: "64px 24px" }}>
+      <p style={{ marginBottom: 32 }}>
+        <Link href="/" style={{ color: "#5b6b7a", textDecoration: "none" }}>
+          ← LogicSRC
+        </Link>
+      </p>
+      <h1 style={{ fontSize: 40, fontWeight: 800, margin: "0 0 8px" }}>Blog</h1>
+      <p style={{ color: "#5b6b7a", margin: "0 0 40px" }}>
+        Project notes for LogicSRC OpenSpec standards, AgentSwarm, AgentByte,
+        SDKs, MCP, and reference implementations.{" "}
+        <a href="/blog/rss.xml" style={{ color: "#5b6b7a" }}>
+          RSS
+        </a>
+      </p>
+
+      {posts.length === 0 ? (
+        <p style={{ color: "#5b6b7a" }}>No posts yet.</p>
+      ) : (
+        <ul style={{ listStyle: "none", margin: 0, padding: 0 }}>
+          {posts.map((post) => (
+            <li
+              key={post.slug}
+              style={{ padding: "20px 0", borderTop: "1px solid #e3e6e0" }}
+            >
+              <Link
+                href={`/blog/${post.slug}`}
+                style={{ color: "#101418", textDecoration: "none" }}
+              >
+                <h2 style={{ fontSize: 22, fontWeight: 700, margin: "0 0 6px" }}>
+                  {post.title}
+                </h2>
+              </Link>
+              <div style={{ color: "#8a95a0", fontSize: 14, marginBottom: 8 }}>
+                {formatDate(post.published_at)}
+              </div>
+              {post.excerpt ? (
+                <p style={{ color: "#41505d", margin: 0 }}>{post.excerpt}</p>
+              ) : null}
+            </li>
+          ))}
+        </ul>
+      )}
+    </main>
+  );
+}

apps/logicsrc-web/src/app/blog/rss.xml/route.ts

@@ -0,0 +1,70 @@
+import { publicClient } from "@/lib/supabase";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type PostRow = {
+  slug: string;
+  title: string;
+  excerpt: string | null;
+  published_at: string;
+};
+
+function baseUrl(): string {
+  return (process.env.PUBLIC_URL ?? "https://logicsrc.com").replace(/\/$/, "");
+}
+
+function escapeXml(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+// GET /blog/rss.xml — RSS 2.0 feed generated from published blog_posts.
+export async function GET(): Promise<Response> {
+  const base = baseUrl();
+  const supabase = publicClient();
+  const { data } = await supabase
+    .from("blog_posts")
+    .select("slug, title, excerpt, published_at")
+    .eq("status", "published")
+    .order("published_at", { ascending: false })
+    .limit(50);
+  const posts = (data ?? []) as PostRow[];
+
+  const items = posts
+    .map((post) => {
+      const link = `${base}/blog/${post.slug}`;
+      return `    <item>
+      <title>${escapeXml(post.title)}</title>
+      <link>${escapeXml(link)}</link>
+      <guid>${escapeXml(link)}</guid>
+      <description>${escapeXml(post.excerpt ?? "")}</description>
+      <pubDate>${new Date(post.published_at).toUTCString()}</pubDate>
+    </item>`;
+    })
+    .join("\n");
+
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>LogicSRC Blog</title>
+    <link>${base}/blog</link>
+    <description>Project notes for LogicSRC OpenSpec standards, AgentSwarm, AgentByte, SDKs, MCP, and reference implementations.</description>
+    <language>en-us</language>
+    <atom:link href="${base}/blog/rss.xml" rel="self" type="application/rss+xml" />
+${items}
+  </channel>
+</rss>
+`;
+
+  return new Response(xml, {
+    headers: {
+      "content-type": "application/rss+xml; charset=utf-8",
+      "cache-control": "public, max-age=300, s-maxage=300",
+    },
+  });
+}

apps/logicsrc-web/src/app/sitemap.ts

@@ -0,0 +1,58 @@
+import type { MetadataRoute } from "next";
+import { publicClient } from "@/lib/supabase";
+
+export const dynamic = "force-dynamic";
+
+function baseUrl(): string {
+  return (process.env.PUBLIC_URL ?? "https://logicsrc.com").replace(/\/$/, "");
+}
+
+// Static routes preserved from the legacy public/sitemap.xml.
+const STATIC_ROUTES: Array<{
+  path: string;
+  changeFrequency: MetadataRoute.Sitemap[number]["changeFrequency"];
+  priority: number;
+}> = [
+  { path: "/", changeFrequency: "weekly", priority: 1.0 },
+  { path: "/docs", changeFrequency: "weekly", priority: 0.9 },
+  { path: "/openspec", changeFrequency: "weekly", priority: 0.8 },
+  { path: "/agent-swarm", changeFrequency: "weekly", priority: 0.8 },
+  { path: "/agentbyte", changeFrequency: "weekly", priority: 0.8 },
+  { path: "/credential-sharing", changeFrequency: "weekly", priority: 0.8 },
+  { path: "/hire-us", changeFrequency: "weekly", priority: 0.8 },
+  { path: "/blog", changeFrequency: "daily", priority: 0.7 },
+  { path: "/about", changeFrequency: "monthly", priority: 0.6 },
+  { path: "/terms", changeFrequency: "monthly", priority: 0.4 },
+  { path: "/privacy", changeFrequency: "monthly", priority: 0.4 },
+];
+
+export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
+  const base = baseUrl();
+
+  const staticEntries: MetadataRoute.Sitemap = STATIC_ROUTES.map((route) => ({
+    url: `${base}${route.path}`,
+    changeFrequency: route.changeFrequency,
+    priority: route.priority,
+  }));
+
+  let postEntries: MetadataRoute.Sitemap = [];
+  try {
+    const supabase = publicClient();
+    const { data } = await supabase
+      .from("blog_posts")
+      .select("slug, published_at, updated_at")
+      .eq("status", "published")
+      .order("published_at", { ascending: false });
+    postEntries = (data ?? []).map((post) => ({
+      url: `${base}/blog/${post.slug}`,
+      lastModified: new Date(post.updated_at ?? post.published_at),
+      changeFrequency: "weekly",
+      priority: 0.6,
+    }));
+  } catch {
+    // If the DB is unreachable, still serve the static sitemap.
+    postEntries = [];
+  }
+
+  return [...staticEntries, ...postEntries];
+}

apps/logicsrc-web/src/lib/supabase.ts

@@ -0,0 +1,34 @@
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
+
+const url = process.env.SUPABASE_URL;
+const anonKey = process.env.SUPABASE_ANON_KEY ?? process.env.SUPABASE_PUBLISHABLE_KEY;
+const serviceKey = process.env.SUPABASE_SECRET_KEY;
+
+// Public read client (anon key) — used by /blog, /blog/[slug], the RSS feed,
+// and the sitemap. RLS limits it to published posts.
+export function publicClient(): SupabaseClient {
+  if (!url || !anonKey) {
+    throw new Error("SUPABASE_URL and SUPABASE_ANON_KEY (or SUPABASE_PUBLISHABLE_KEY) are required");
+  }
+  return createClient(url, anonKey, { auth: { persistSession: false } });
+}
+
+// Privileged client (service-role key) — used by the blog webhook to upsert
+// posts. Bypasses RLS, so keep it server-only.
+export function serviceClient(): SupabaseClient {
+  if (!url || !serviceKey) {
+    throw new Error("SUPABASE_URL and SUPABASE_SECRET_KEY are required");
+  }
+  return createClient(url, serviceKey, { auth: { persistSession: false } });
+}
+
+export type BlogPost = {
+  slug: string;
+  title: string;
+  excerpt: string | null;
+  html: string;
+  tags: string[];
+  featured_image: { url?: string } | null;
+  published_at: string;
+  updated_at: string;
+};