Skill Finder widget + buyer tracking — 2026-07-05 (evening session)

What shipped (all LIVE on skills.amplifaiyourbusiness.com)

1. Buyer tracking + delivery email (Stripe webhook)

• app/functions/api/stripe-webhook.js — new endpoint we_1Tpt4CRvzUwDwHkjuSZGZKJi

(events: checkout.session.completed + checkout.session.async_payment_succeeded)

• Every purchase now: GHL contact upsert with tags skill-studio-buyer + bought-<slug>

(packs: bought-pack-<slug>) + purchase note, AND a branded delivery email (navy/gold, from skills@sondraverva.com, reply-to her Gmail) with the access-page link + install steps. Pack emails list every included skill; the pack access page has all the download buttons.

• Signature-verified (HMAC v1, timing-safe, 5-min replay window), idempotent via KV

(webhook-seen:<event.id>), delivers only when payment_status === 'paid', filters metadata.store === 'skill-studio' (other stores' events hit this endpoint too), always returns 200 on handled branches so Stripe never retry-loops.

• Data source: app/src/data/delivery.js GENERATED by app-data/build_delivery_data.py

(run it after build_access_pages.py whenever skills/packs change). ⚠️ delivery.js contains all access tokens — server-side import ONLY, never import it from client code (verified not in the client bundle).

2. Skill Finder widget (floating, lower-right, every page)

• app/src/components/SkillFinder.jsx, mounted in App.jsx inside a silent ErrorBoundary.
• Three tabs: Search (instant client-side, skills + packs, live catalog),

Ask AI (Haiku chat), Custom skill (request form).

• Auto-feed: search + chat both read the same skills.js/bundles.js the store renders

from — adding a skill + rebuilding feeds everything, no extra step.

3. Custom skill requests → GHL + notify

• app/functions/api/custom-request.js: honeypot + validation + KV daily cap (30/day,

fails closed) → GHL upsert tag skill-custom-request + description note → notification email to srverva@gmail.com (reply-to = requester). No fixed pricing shown anywhere — Sondra quotes each personally.

4. Haiku chat (app/functions/api/skill-chat.js)

• claude-haiku-4-5, compact catalog in a cached system prompt, plain-text-only replies

(+ server-side de-markdown), widget linkifies /skills/... + /bundles/... paths.

• Caps: 8 turns/conversation, 500 chars/message, 400 output tokens, 300 msgs/day global,

20 msgs/day per IP — all KV (FINDER_KV), ALL fail closed. Worst case ≈ $1–2/day; realistic ≈ a few $/month.

Infra added

• KV namespace finder-kv = 338d8b0c34bb4e66ad8f263a1279a700, bound as FINDER_KV

(prod + preview) on Pages project amplifai-skill-studio.

• Pages secrets added: STRIPE_WEBHOOK_SECRET, RESEND_API_KEY, ANTHROPIC_API_KEY.
• Resend: free plan = 1 domain (sondraverva.com). amplifaiyourbusiness.com NOT added

(403 plan limit). Emails send from skills@sondraverva.com. Upgrade Resend or move delivery email to GHL later if she wants the matching domain.

Verified live (2026-07-05)

• Site 200 · webhook rejects unsigned (400) · custom-request validates (400 on bad email)
• Custom request happy path: GHL contact nze3eGbKOXFNPkyrxlba created with tag + note,

notification email confirmed in her Gmail

• Chat: real Haiku replies recommending real skills w/ correct prices, plain text
• Widget visually verified via Playwright at 1280×850 (on-brand, search returns results)
• Safety review (app-reviewer agent): 1 RED + 4 YELLOW found → ALL FIXED same session

(custom-request cap, chat fail-closed + per-IP cap, webhook idempotency + payment_status)

Open / for Sondra

• $17 test buy → refund (deferred from last session) now also proves the NEW delivery

email + GHL buyer tags end-to-end. Do this before announcing.

• Delete GHL test contacts: srverva+skillstudio-test@gmail.com (prior session) and

srverva+finder-test@gmail.com (this session, id nze3eGbKOXFNPkyrxlba).

• Optional GHL workflow (her UI): trigger on tag skill-custom-request → send prospect a

"got your request" confirmation. The notify-Sondra email already works without it.

• Optional: GHL workflows on skill-studio-buyer tags for nurture sequences.
• Custom-skill quoting: no price anchor shown by design; she quotes per request.