[ralyodio]

Do not merge while saasrow.com is stopped. The site's containers on dev2 are stopped on purpose (a dropped site). Merging to main triggers deploy-dev2.yml, which deploys and restarts it.

What moved to c0mpute

The three text features are Supabase edge functions (Deno). New supabase/functions/_shared/c0mpute.ts imports npm:@profullstack/ai-providers@0.2.0 (pinned exact) and uses its c0mpute provider only (paidFallback: false, peer nodes only). Each function's existing provider loop keeps its own OpenAI / Gemini calls as the paid tier, with c0mpute put at the head.

• draft-email-broadcast (admin email draft): c0mpute, then OpenAI, then Gemini. The answer goes through the existing parseDraft.
• fetch-metadata (listing title/description/category/tags on submit): c0mpute (30 s cap, since a submission waits on it), then OpenAI, then Gemini, then the page's own metadata as before.
• generate-news-post (admin blog draft): c0mpute, then OpenAI. The "OpenAI API key not configured" gate now only fires when c0mpute is disabled too.
• .env.example documents C0MPUTE_API_KEY.

Timeouts, and a limit to know about

The self-hosted edge runtime stops a worker after about 60 s of wall clock (the stock main service), so c0mpute gets 40 s by default (C0MPUTE_TIMEOUT_MS overrides). Peer nodes write about 2 tokens a second, so short JSON (metadata, email drafts) fits, but a 500 to 700 word news post usually will not finish in time and will fall through to OpenAI. Raising the worker timeout in volumes/functions/main/index.ts on dev2 would let it.

Stays on the vendor

• generate-banner-images: DALL-E images.
• The Next app's src/lib/aiClients.ts is a user-agent list of AI crawlers, not a model call.

Fallback

Both paid keys are dead today. On a c0mpute failure: drafts fail with the same 502 as now if Gemini is also unset or failing, metadata falls back to the page's own tags as now, and the news post returns the same 500.

Privacy

Inputs are admin-written prompts and public pages of submitted product URLs. No private user content goes to peer nodes.

Deploy notes

• C0MPUTE_API_KEY (fleet ik_live_ account key) must be in the functions container env on dev2, not only app.env; without it c0mpute runs on the 10 a day free tier.
• 0.2.0 was published today. Deno 2.9 locally refuses npm versions under 24 hours old by default; the edge-runtime's bundled Deno may or may not. By the time this is merged it will be old enough either way.

Tests

bun run typecheck clean, bun run test:unit 298 pass (as CI runs it). The edge functions are not covered by tsc or vitest, so: deno check passes for _shared/c0mpute.ts and all three functions (it also showed 2 old error is unknown errors in generate-news-post's catch block, fixed here), and a Deno smoke run of askC0mpute against a fake Infernet job stream returned the parsed JSON with p2p_only: true.

Aside, not changed here: generate-news-post authorizes by comparing a body email field to ADMIN_EMAIL, so anyone who knows that address can create unpublished posts and spend AI calls. draft-email-broadcast uses requireAdmin; this one probably should too.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

15 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 11 | LOW: 2

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	public/sw.js:21
HIGH	js-ssrf-outbound-request	src/lib/edgeProxy.ts:69
MEDIUM	js-unescaped-html-sink	src/components/JsonLd.tsx:13
MEDIUM	redos-nested-quantifier	src/lib/emailMarkdown.ts:43
MEDIUM	redos-nested-quantifier	src/lib/emailMarkdown.ts:302
MEDIUM	js-unescaped-html-sink	src/views/Admin.tsx:1811
MEDIUM	js-unescaped-html-sink	src/views/BlogPost.tsx:168
MEDIUM	js-unescaped-html-sink	src/views/EmailBroadcast.tsx:412
MEDIUM	js-open-redirect	src/views/Featured.tsx:279
MEDIUM	js-unescaped-html-sink	src/views/NewsPost.tsx:137
MEDIUM	js-open-redirect	src/views/SoftwareDetail.tsx:160
MEDIUM	redos-nested-quantifier	supabase/functions/_shared/emailMarkdown.ts:43
MEDIUM	redos-nested-quantifier	supabase/functions/_shared/emailMarkdown.ts:302
LOW	secret-generic-credential	__tests__/lib/webhooks/supabaseStore.test.ts:11
LOW	secret-generic-credential	cli/test/cli.test.mjs:309

Snippets are redacted; ThreatCrush never prints matched credential material.

[ralyodio]

Closed (not merged) on purpose: CI is green, but saasrow.com is a stopped site and merging deploys it. gh-prs-merge sweeps merge any open green PR, so this is parked closed. Branch c0mpute-first-ai is kept; reopen and merge only when the site comes back.