Session Handoff — PeptidePal v2 launch to getpeptidepal.com (Phase 4)

Where it started

Session began with /prime, then a pasted handoff showing PeptidePal v2 (own-stack rebuild, leaving Emergent) built through Phase 3b, TEST mode, nothing public. Sondra chose to launch (Phase 4) starting with /app-safety-check. Scope expanded through the session into: safety fixes, full deploy to her domain, mobile QA, a real CORS bug fix, legal reconciliation to her canonical documents, a Google-sign-in investigation, and replacing a generic homepage with a faithful port of her original v1 landing.

Decisions locked + what shipped

• App is LIVE at https://getpeptidepal.com — Cloudflare Pages project peptidepal (peptidepal-8bh.pages.dev), root CNAME proxied, old Emergent DNS removed, cert active. Redeploy: build then wrangler pages deploy dist --project-name=peptidepal --branch=main --commit-dirty=true.
• Stripe still TEST mode. Checkout verified working end-to-end from the live domain (real cs_test session, 14-day trial, $39.99/yr). Live flip NOT done — STRIPE_API_KEY_MAIN is a restricted live key (rk_live); no live products or live webhook exist for PeptidePal yet.
• /app-safety-check ran → 2 criticals fixed: (1) built Privacy+Terms pages; (2) delete-account edge function (deployed, verified: 401 guard + all 14 tables cascade on auth.users delete). Should-fixes shipped: global ErrorBoundary (src/components/ErrorBoundary.tsx, wrapped in src/main.tsx), Dashboard loading/error states.
• CORS bug found + fixed (real launch-blocker). All 4 browser-invoked edge functions (create-checkout, admin, delete-account, generate-insights) rejected the x-client-info header → checkout/insights/delete failed in-browser. Added x-client-info, apikey to Access-Control-Allow-Headers, redeployed all 4 via supabase functions deploy.
• Branding fix: favicon/app icon was the purple Fable logo → swapped to teal PeptidePal droplet; added PWA manifest.json + apple/mobile meta + real <title>/description (index.html, public/manifest.json, public/favicon.svg).
• Prod config (Supabase project zhcxygxjvcatvdodovtd): auth site_url=https://getpeptidepal.com + uri_allow_list set (domain + pages.dev + localhost:4780); APP_URL edge secret = https://getpeptidepal.com; mailer_autoconfirm already false (email-confirm ON). Magic-link email sign-in works on the live domain (verified via generated link).
• Legal reconciled to her canonical docs. Sondra supplied her real GHL legal pages (ai.sondraverva.com/{terms,privacy,acceptable-use-page,refund-policy-page}). Saved all four to context/legal/ + README + a reference memory. Rebuilt PeptidePal's legal as 4 pages (/terms, /privacy, /acceptable-use, /refund) on her language/entity (Amplifai Your Business LLC, no hyphen), Florida law + AAA arbitration + class-action waiver, $100/12-mo liability cap, All-Sales-Final refund — plus health-specific disclaimers. src/pages/Legal.tsx, routes in src/App.tsx, entity/address in src/branding.ts.
• Google sign-in: verified external_google_enabled=false on ALL 10 of her Supabase apps — never set up anywhere. Removed the broken "Continue with Google" button from src/pages/Login.tsx. Setup is blocked on Sondra creating one OAuth Web client in Google Cloud Console (no API for it) — 10 redirect URIs were provided to her; she owes Client ID + Secret, then next agent enables Google on all projects via management API.
• Homepage: first built a generic teal landing (Sondra rejected it). Replaced with a faithful port of her v1 page from PROJECTS/Peptide Pal/app/frontend/src/pages/Landing.js — editorial cream #FAF6EE / ink-teal #14322F / coral #D45A3A, Fraunces+Inter Tight fonts, rotated card-stack hero, bento features, FAQ. Fonts+utility classes added to src/index.css (scoped). Pricing bullets updated to v2's real Premium features; CTAs go to /login. Routing: logged-out / = Landing, /login = sign-in.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Peptide Pal\PRD.md — §9 cutover, §10 definition of done, §13 phases.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Peptide Pal\app-v2\ — the app (Vite+React19+Supabase+TS). Legal in src\pages\Legal.tsx; Landing in src\pages\Landing.tsx; brand in src\branding.ts.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\context\legal\ — her canonical Terms/Privacy/AUP/Refund + README.md (entity, FL law, All-Sales-Final). Pull from these for ANY app.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Peptide Pal\app\frontend\src\pages\Landing.js + src\index.css — the v1 design source that was ported.
• Plan file: none (PRD served as plan).
• Memory files touched: C:\Users\srver\.claude\projects\c--Users-srver-AIOS-Workspace-aios-starter-kit\memory\reference_canonical_legal_docs.md (new) + MEMORY.md (pointer added).

Running state

• Background processes: none (a few stray background find/screenshot Bash tasks completed; nothing live).
• Dev servers / ports: none. To run locally: cd "PROJECTS\Peptide Pal\app-v2" && npm run dev -- --port 4780.
• Open worktrees / branches: none. app-v2\ is a git repo with uncommitted local changes from this session (nothing was committed; deploys were from dist/).
• Playwright MCP browser was intermittently locked/closed this session — verifications fell back to curl against the deployed bundle.
• Supabase project zhcxygxjvcatvdodovtd, DB confirmed 0 rows at last check (QA user deleted). Edge functions live: send-reminders, create-checkout, stripe-webhook, generate-insights, share-view, admin, delete-account.

Verification — how to confirm things still work

• cd "PROJECTS\Peptide Pal\app-v2" && npx tsc -b --force — expect clean (exit 0).
• npm run build — expect clean (only >500kB chunk-size warning).
• curl -s https://getpeptidepal.com/ | grep -o '<title>[^<]*</title>' — expect "PeptidePal — private peptide & injection tracker".
• Landing content check: curl the assets/index-*.js bundle and grep for "A private tracker for" / "The honest answers".
• Stripe/CORS: on getpeptidepal.com, log in (email link) → Upgrade → "Start free trial" should redirect to a checkout.stripe.com/c/pay/cs_test_... URL with 0 console errors.
• delete-account guard: curl -X POST https://zhcxygxjvcatvdodovtd.supabase.co/functions/v1/delete-account → 401.

Deferred + open questions

• Open: Sondra test-card round-trip — log into getpeptidepal.com, run 4242 4242 4242 4242 checkout, confirm Premium unlocks (proves webhook end-to-end on her account). Only she can enter a card.
• Open: Flip Stripe to live — needs her go; requires creating live $4.99/$39.99 products + live webhook to .../functions/v1/stripe-webhook + swapping edge secrets STRIPE_SECRET_KEY/STRIPE_PRICE_MONTHLY/STRIPE_PRICE_YEARLY/STRIPE_WEBHOOK_SECRET to live. Restricted key may lack a scope. Real money = irreversible; confirm the lawyer-review-skip decision stands (she declined an attorney).
• Open: Google sign-in — awaiting Sondra to create one OAuth Web client in Google Cloud Console (consent screen → Web client → paste the 10 https://<ref>.supabase.co/auth/v1/callback URIs) and send Client ID + Secret. Then: save to master .env, enable Google on the Supabase projects via management API, un-hide the button, redeploy. She wants this on all apps.
• Open: Sondra install PWA on phone — Add to Home Screen on iOS, confirm a scheduled reminder actually fires (the reminder path can't be confirmed server-side).
• Deferred: app-interior palette mismatch — the app UI is teal (#0f766e) while the ported homepage is her cream/ink-teal/coral brand. Offered to re-theme the app interior to match; unanswered.
• Open: Sondra to eyeball the ported homepage in a logged-out/incognito window and flag any copy/layout tweaks.

Pick up here

Confirm whether Sondra wants the app interior re-themed to match her cream/ink-teal/coral homepage; otherwise the next concrete step is her test-card tap on getpeptidepal.com, then flipping Stripe to live.