feat(autoblog): guest post generation (Pass 2)

Wires the "Generate this" button on each suggested topic in the
opportunity panel through to a full guest-post article generation
and webhook delivery to the partner blog.

Flow:
- Author clicks "Generate this" on (partner, topic) pair.
- /api/lx/guest-posts/generate burns an author credit upfront-check,
  enqueues to the worker.
- Worker calls generateGuestPost (new module). It loads both sites,
  burns the AUTHOR credit (consume_credit RPC against author user),
  calls Claude with a host-voice system prompt + a mandatory
  author-backlink slot, validates the backlink is in the body,
  renders images, persists lx_article with site_id=target,
  author_site_id=author, target_site_id=target, is_guest_post=true.
- Delivery: existing deliverArticle routes to target's webhook
  (now generalized to read target_site_id first, falling back to
  site_id, so own-blog posts behave identically).

Schema:
- New RLS policy "lx_article via owned author" so the author can
  SELECT guest posts they wrote (target's owner already had access
  via the existing site_id policy; the author needed parallel access).

Shared infrastructure (no duplication):
- articleGen.ts now exports ArticleSchema, INLINE_IMAGE_COUNT,
  buildSystemPrompt, generateImage, generateInlineImage, uploadImage,
  uniqueSlug, refundCredit so guestPostGen reuses the visual + LLM
  contract that own-blog posts ship with.

The receiver side needs no changes — the existing crawlproof webhook
+ gatePost flow accepts guest posts identically to own-blog posts
under Phase 2's quality gate, which is shipped on threatcrush,
coinpayportal, and sh1pt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ralyodio

app/(app)/projects/[id]/autoblog/guest-posts.tsx

@@ -15,10 +15,13 @@ export function GuestPostOpportunities({ projectId }: { projectId: string }) {
   const [busy, setBusy] = useState(false);
   const [opps, setOpps] = useState<Opportunity[] | null>(null);
   const [error, setError] = useState<string | null>(null);
+  const [generating, setGenerating] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
 
   async function find() {
     setBusy(true);
     setError(null);
+    setNotice(null);
     try {
       const res = await fetch(
         `/api/lx/guest-posts/opportunities?projectId=${encodeURIComponent(projectId)}`,
@@ -37,6 +40,35 @@ export function GuestPostOpportunities({ projectId }: { projectId: string }) {
     }
   }
 
+  async function generate(opp: Opportunity, topic: string) {
+    const key = `${opp.partner_site_id}:${topic}`;
+    setGenerating(key);
+    setError(null);
+    setNotice(null);
+    try {
+      const res = await fetch(
+        `/api/lx/guest-posts/generate?projectId=${encodeURIComponent(projectId)}`,
+        {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ targetSiteId: opp.partner_site_id, topic }),
+        },
+      );
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok || json?.ok === false) {
+        setError(json?.error ?? "Could not generate guest post.");
+      } else {
+        setNotice(
+          `Guest post queued for ${opp.partner_domain} on "${topic}". Generation takes 1–3 minutes; it will land on the partner blog once delivered.`,
+        );
+      }
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setGenerating(null);
+    }
+  }
+
   return (
     <section className="space-y-3">
       <div className="flex flex-wrap items-baseline justify-between gap-2">
@@ -57,6 +89,9 @@ export function GuestPostOpportunities({ projectId }: { projectId: string }) {
         </button>
       </div>
 
+      {notice && (
+        <p className="text-sm text-[var(--color-pass)]">{notice}</p>
+      )}
       {error && (
         <p className="text-sm text-[var(--color-fail)]">{error}</p>
       )}
@@ -100,10 +135,27 @@ export function GuestPostOpportunities({ projectId }: { projectId: string }) {
                   <p className="text-xs uppercase tracking-wide text-[var(--color-muted)]">
                     Suggested topics
                   </p>
-                  <ul className="ml-4 list-disc space-y-0.5 text-sm">
-                    {o.suggested_topics.map((t) => (
-                      <li key={t}>{t}</li>
-                    ))}
+                  <ul className="space-y-1.5 text-sm">
+                    {o.suggested_topics.map((t) => {
+                      const key = `${o.partner_site_id}:${t}`;
+                      const isBusy = generating === key;
+                      return (
+                        <li
+                          key={t}
+                          className="flex items-center justify-between gap-2"
+                        >
+                          <span className="flex-1">{t}</span>
+                          <button
+                            type="button"
+                            className="btn text-xs"
+                            disabled={generating !== null}
+                            onClick={() => generate(o, t)}
+                          >
+                            {isBusy ? "Queuing…" : "Generate this"}
+                          </button>
+                        </li>
+                      );
+                    })}
                   </ul>
                 </div>
               ) : (

app/api/lx/guest-posts/generate/route.ts

@@ -0,0 +1,84 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { enqueueGuestPostGenerate } from "@/lib/lx/workerClient";
+import { getProjectById } from "@/lib/lx/currentSite";
+
+export const runtime = "nodejs";
+
+// Manually trigger a guest-post generation. Body: { targetSiteId, topic }.
+// Author site is resolved from the projectId query param. Worker is
+// fire-and-forget; the article shows up on the author's dashboard
+// (filter is_guest_post=true) when generation lands.
+export async function POST(req: NextRequest) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) {
+    return NextResponse.json({ ok: false, error: "unauthorized" }, { status: 401 });
+  }
+
+  const projectIdParam = req.nextUrl.searchParams.get("projectId");
+  if (!projectIdParam) {
+    return NextResponse.json(
+      { ok: false, error: "projectId required" },
+      { status: 400 },
+    );
+  }
+  const project = await getProjectById(projectIdParam, { siteColumns: "id, status" });
+  const authorLx = project?.lx_site as { id?: string; status?: string } | null;
+  if (!authorLx?.id) {
+    return NextResponse.json(
+      { ok: false, error: "autoblog not configured for this project" },
+      { status: 400 },
+    );
+  }
+  if (authorLx.status !== "active") {
+    return NextResponse.json(
+      { ok: false, error: `author site is ${authorLx.status}` },
+      { status: 400 },
+    );
+  }
+
+  let body: { targetSiteId?: string; topic?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ ok: false, error: "bad json" }, { status: 400 });
+  }
+  if (!body.targetSiteId || !body.topic) {
+    return NextResponse.json(
+      { ok: false, error: "targetSiteId and topic are required" },
+      { status: 400 },
+    );
+  }
+  if (body.targetSiteId === authorLx.id) {
+    return NextResponse.json(
+      { ok: false, error: "target must differ from author" },
+      { status: 400 },
+    );
+  }
+
+  // Upfront credit check on the author's account — same UX rationale
+  // as own-blog generation. Worker re-checks atomically via
+  // consume_credit before doing any LLM work.
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("credits_balance")
+    .eq("id", user.id)
+    .maybeSingle();
+  const balance = (profile?.credits_balance as number | null | undefined) ?? 0;
+  if (balance < 1) {
+    return NextResponse.json(
+      {
+        ok: false,
+        error: "Out of credits. Buy more to generate guest posts.",
+        credits_balance: balance,
+      },
+      { status: 402 },
+    );
+  }
+
+  await enqueueGuestPostGenerate(authorLx.id, body.targetSiteId, body.topic);
+  return NextResponse.json({ ok: true });
+}

lib/lx/articleGen.ts

@@ -68,10 +68,10 @@ type LinkCandidate = {
   distance: number;
 };
 
-const INLINE_IMAGE_COUNT = 3;
+export const INLINE_IMAGE_COUNT = 3;
 const MAX_PRIOR_ARTICLE_LINKS = 3;
 
-const ArticleSchema = z.object({
+export const ArticleSchema = z.object({
   title: z.string().min(10).max(180),
   slug: z
     .string()
@@ -120,7 +120,7 @@ export function slugify(input: string, max = 80): string {
     .replace(/-+$/g, "");
 }
 
-function buildSystemPrompt(): string {
+export function buildSystemPrompt(): string {
   return [
     "You are writing a long-form SEO blog post in the practical, operator-focused style of ThreatCrush and CoinPayPortal: pragmatic B2B/technical voice, strong opening pain point, the topic reframed as an architecture/workflow problem (not a definition), table of contents, H2/H3 sections, practical rules in blockquotes, bullets/tables, implementation advice, soft product CTA near the end.",
     "",
@@ -301,7 +301,7 @@ async function claimKeyword(
   return !!data;
 }
 
-async function uniqueSlug(
+export async function uniqueSlug(
   supabase: SupabaseClient<any>,
   siteId: string,
   base: string,
@@ -397,7 +397,7 @@ const SHARED_ART_DIRECTION = [
   "Strictly NO text, NO typography, NO UI mockups, NO logos, NO charts with labels, NO people, NO faces, NO stock-photo office scenes, NO generic abstract gradient blobs.",
 ];
 
-async function generateInlineImage(
+export async function generateInlineImage(
   openai: OpenAI,
   promptText: string,
   nicheHint: string | null,
@@ -423,7 +423,7 @@ async function generateInlineImage(
   return Buffer.from(b64, "base64");
 }
 
-async function generateImage(
+export async function generateImage(
   openai: OpenAI,
   title: string,
   nicheHint: string | null,
@@ -451,7 +451,7 @@ async function generateImage(
   return Buffer.from(b64, "base64");
 }
 
-async function uploadImage(
+export async function uploadImage(
   supabase: SupabaseClient<any>,
   siteId: string,
   slug: string,
@@ -949,7 +949,7 @@ async function failKeyword(
 // gated by consume_credit but then failed before producing an article.
 // Best-effort: if the balance read or update fails, we log and move on
 // rather than retry-loop. The cost is one wasted credit, not corruption.
-async function refundCredit(
+export async function refundCredit(
   supabase: SupabaseClient<any>,
   ownerId: string,
 ): Promise<void> {