NORMSA AI
Automated social commerce workflows for SMEs by implementing an AI-native architecture that processes high-volume Facebook/Telegram messages into structured data with zero merchant involvement.
Business Context
Cambodian SME merchants face a manual, multi-platform hell, monitoring Facebook Messenger and Telegram simultaneously. They manually type repetitive replies, transcribe unstructured 'Khmerish' text, and suffer high error rates and lost sales during peak Facebook Live comment bursts.
The Solution
An AI-native, dual-architecture workflow featuring an AI Sales Agent for conversational checkouts and a Merchant Web Dashboard for real-time order ledger management.
- Khmerish NLP for intent classification and entity extraction
- RAG-only responses grounded strictly in the merchant's catalog
- Multi-turn conversational checkout state machine
Architecture Overview
The architecture follows a tool-calling agent model where RAG is implemented as an MCP tool backed by pgvector. Webhooks are ingested asynchronously, authenticated, deduplicated via UUIDv5, and processed through an atomic usage gate before hitting the LLM.
Tech Stack & Reasoning
| Technology | Why it was used |
|---|---|
| Next.js | Powers the merchant dashboard (App Router) and handles async background webhook processing via after() to ensure <300ms response times. |
| Supabase & pgvector | Provides PostgreSQL database, strict Row-Level Security, and vector similarity search for product retrieval (RAG). |
| Vercel AI SDK | Offers a unified interface for streaming, tool calling, and seamless model routing between OpenAI, Gemini, and Ollama. |
| Stripe | Handles subscription billing, checkout sessions, and webhook-driven tier upgrades for the SaaS platform. |
| Ollama | Powers local model inference using models like Qwen3.5-9B and Qwen3 1.7B for offline intent classification and a secure, cost-effective fallback. |
| Cloud API Providers (OpenAI / Gemini) | Provides primary LLM generation and embeddings, securely orchestrated using API keys through environment variables to enable dynamic multi-provider fallback chains without exposing secrets. |
Key Features
- Real-time Order Ledger auto-populated by AI entity extraction with zero typing
- Multi-provider AI support allowing hot-swapping between cloud (OpenAI/Gemini) and local (Ollama) inference
- Webhook signature verification and UUIDv5 deduplication for idempotent processing
Engineering Highlights
Architected a tool-calling agent workflow where RAG acts as an MCP tool, separating the LLM from direct database access to prevent hallucinations.
Implemented an atomic PL/pgSQL usage gate and idempotent UUIDv5 hashing to prevent double-booking and race conditions during webhook bursts.
Designed robust Row-Level Security (RLS) ensuring every Supabase table is strictly scoped by the authenticated merchant_id to prevent cross-tenant data leakage.
Challenges & Solutions
Handling concurrent webhook bursts during Facebook Live events could lead to race conditions, double-booking, and API timeout failures.
Implemented asynchronous processing via Next.js after() and an atomic PL/pgSQL function to enforce usage quotas at the database level.
Impact: Achieved <300ms webhook response times and a 100% success rate under 50-concurrent load testing.
Performance Metrics
What I Learned
- •Building multi-turn conversational state machines strictly guided by agentic tool-calling
- •Optimizing RAG retrieval using pgvector and cosine similarity for mixed-language (Khmerish) text
- •Securing SaaS platforms with tenant-isolated database layers and verifying HMAC-SHA256 signatures for third-party webhooks
System Interface
Want to see more projects?
Explore my other recent work to see a broader range of system architectures and full-stack solutions.
