@ssheleg/sheleg-dev 0.11.4 → 0.11.7

package/CHANGELOG.md

@@ -1,3 +1,47 @@
+## v0.11.7 — the fifth version surface is retired, and one audit finding is refused by a guard that already knew
+
+> **v0.11.6 is a burned tag.** It was pushed before the release PR merged, in a repository
+> that squash-merges — so it points beside `main` at `7088752`, the release run refused it
+> at *The tag must be reachable from the default branch*, and the remote forbids tag
+> deletion. Nothing shipped under it; this version is the same tree, tagged on `main`.
+
+A family audit (2026-09-06, `sshlg-skills` wave `AUDIT-WAVE-0906`) read all seven skills
+against the standard. What it found here, closed:
+
+- **`error-tracking` carried `metadata.version: 0.9.2` under a release whose every other
+  surface said 0.11.5** — the only skill in the member carrying the key, a fifth version
+  surface the ×4 sync never read. The key is dropped rather than synced: four surfaces
+  move together under a guard, and a fifth existed only to drift.
+- **Five skills declared no `license:`** while their two siblings did — `ad-tracking`,
+  `crypto-payments`, `frontend-performance`, `google-auth`, `google-signin` all say MIT now.
+- **`error-tracking`'s NOT-for clause named `triage-issue`**, an id that resolves only on
+  machines carrying one specific tracker plugin; it names the class now.
+- **`heleket-provider.md` pointed at a bare `references/price-integrity.md`**, which
+  resolves only in the sibling skill; the pointer carries `../stripe-billing/` now.
+- **`ad-tracking`'s troubleshooting table moved into `references/performance-security.md`**
+  (~285 body tokens), and `stripe-billing`'s cancellation bullets compressed against their
+  own reference (~65) — headroom bought by moving depth, never by deleting it. What still
+  sits near the ceiling is `B-106` on the board.
+
+One finding was refused, and the refusal is the record: the audit asked for the shared
+`webhook signature` literal to be qualified per provider, and `test/validate.py` already
+carries `TRIGGERS_SHARED_BY_DESIGN` saying both rails own that seam — the attempted
+removal turned the gate red, which is the exemption doing its job.
+
+Board: `B-106` filed. Source: family audit 2026-09-06.
+
+## v0.11.5 — the card is the umbrella's render, and the eyebrow stops painting past the canvas
+
+The committed social preview is now generated by the umbrella with the CORRECTED fit
+metric and copied here byte for byte. Nothing about this pack changed.
+
+**Why it was stale.** This member sat in `scripts/site.js`'s `LEGACY_FIT` set, so its card
+was rendered with the pre-correction metric and its eyebrow painted to x=1199 — over the
+padding box the fix exists to remove. A member's card pixels are committed here and
+byte-checked from the umbrella, so only this repository's own release can move them.
+
+Board: `B-118`.
+
 # Changelog
 
 All notable changes to this project are documented here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.11.4",
+  "version": "0.11.7",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.11.4",
+  "version": "0.11.7",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "enhanced conversions", "retargeting", "purchase event", "CAPI", "gclid", "UTM",
   "attribution", "отслеживание конверсий", "пиксель Meta", "согласие на куки", "ретаргетинг",
   "аналитика рекламы". Not for running the ad campaigns themselves.
+license: MIT
 ---
 
 # Advertising Analytics & Conversion Tracking Integration
@@ -364,31 +365,11 @@ failure this whole skill exists to prevent, and it looks fine in every test
 that starts by accepting.
 ## Troubleshooting
 
-### Common Issues
-
-| Problem | Cause | Fix |
-|---|---|---|
-| No events in GA4 | Consent defaults not set before gtag.js loads | Ensure consent `default` call is **before** the script tag |
-| CSP violations in console | Missing domain in CSP header | Add the domain to the correct CSP directive |
-| Meta Pixel not firing | Consent-gated component not rendering | Check localStorage consent value, check CustomEvent listener |
-| Duplicate `PageView` events | Multiple pixel instances or route change listeners | Ensure pixel init code has `if(f.fbq)return;` guard |
-| Purchase events without value | Missing `value`/`currency` params | Both GA4 and Meta **require** these for conversion optimisation |
-| Advanced Matching not working | `fbq('init')` called before pixel SDK loads | Ensure `fbevents.js` is loaded before calling `setFbAdvancedMatching()` |
-| Enhanced Conversions not matching | `user_data` set after conversion event | Call `setEnhancedConversionData()` **before** the conversion event fires |
-| gclid lost after Stripe redirect | — (shouldn't happen) | `_gcl_aw` cookie is first-party, persists across redirects |
-| Events firing on localhost | Missing `isLocal` guard | Add `if (window.location.hostname === 'localhost') return;` |
-
-### Debug Mode
-
-Enable debug logging for local development:
-
-```typescript
-const isLocal = window.location.hostname === "localhost";
-if (isLocal) {
-  console.debug("[Analytics]", eventName, params);
-  return; // don't fire real events
-}
-```
+Read `references/performance-security.md` → **Troubleshooting** for the
+common-issues table (consent ordering, duplicate `PageView`, Advanced/Enhanced
+Matching timing, the localhost guard) and the debug-mode snippet. The two seen
+most: consent `default` must run **before** gtag.js loads, and a purchase
+without `value`/`currency` cannot be optimised against by either platform.
 
 ---
 

package/plugins/sheleg-dev/skills/ad-tracking/references/performance-security.md

@@ -13,6 +13,7 @@
 - [Debug & Testing](#debug--testing)
 - [Common Mistakes](#common-mistakes)
 - [Multi-Page Consistency](#multi-page-consistency)
+- [Troubleshooting](#troubleshooting)
 
 ## Table of Contents
 
@@ -22,6 +23,7 @@
 - [Debug & Testing](#debug--testing)
 - [Common Mistakes](#common-mistakes)
 - [Multi-Page Consistency](#multi-page-consistency)
+- [Troubleshooting](#troubleshooting)
 
 ## Script Loading Strategies
 
@@ -288,3 +290,34 @@ terser js/consent.js -o js/consent.min.js -c -m
 ```
 
 Use the minified version in production, source version in development.
+
+## Troubleshooting
+
+Moved here from `SKILL.md` — the lookup table for symptoms whose causes are
+covered in the sections above.
+
+### Common Issues
+
+| Problem | Cause | Fix |
+|---|---|---|
+| No events in GA4 | Consent defaults not set before gtag.js loads | Ensure consent `default` call is **before** the script tag |
+| CSP violations in console | Missing domain in CSP header | Add the domain to the correct CSP directive |
+| Meta Pixel not firing | Consent-gated component not rendering | Check localStorage consent value, check CustomEvent listener |
+| Duplicate `PageView` events | Multiple pixel instances or route change listeners | Ensure pixel init code has `if(f.fbq)return;` guard |
+| Purchase events without value | Missing `value`/`currency` params | Both GA4 and Meta **require** these for conversion optimisation |
+| Advanced Matching not working | `fbq('init')` called before pixel SDK loads | Ensure `fbevents.js` is loaded before calling `setFbAdvancedMatching()` |
+| Enhanced Conversions not matching | `user_data` set after conversion event | Call `setEnhancedConversionData()` **before** the conversion event fires |
+| gclid lost after Stripe redirect | — (shouldn't happen) | `_gcl_aw` cookie is first-party, persists across redirects |
+| Events firing on localhost | Missing `isLocal` guard | Add `if (window.location.hostname === 'localhost') return;` |
+
+### Debug Mode
+
+Enable debug logging for local development:
+
+```typescript
+const isLocal = window.location.hostname === "localhost";
+if (isLocal) {
+  console.debug("[Analytics]", eventName, params);
+  return; // don't fire real events
+}
+```

package/plugins/sheleg-dev/skills/crypto-payments/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   checkout", "pay with crypto", "USDT payment", "TRC20", "payment webhook", "IPN", "webhook
   signature", "underpayment", "Heleket", "NOWPayments", "приём криптоплатежей", "оплата
   криптой", "вебхук платежа", "недоплата". Not for card billing — use stripe-billing.
+license: MIT
 ---
 
 # Crypto payments

package/plugins/sheleg-dev/skills/crypto-payments/references/heleket-provider.md

@@ -174,8 +174,9 @@ than Stripe's and the difference decides the design:
 | Key also signs webhooks | no, a separate `whsec_` | **yes, the same value** |
 
 So the house pattern — declare the environment in a variable separate from the secret,
-then assert at boot that the two agree (the `stripe-billing` skill, `references/price-integrity.md`,
-*Test and live mode*) — applies, but its Stripe implementation does not: there is no key
+then assert at boot that the two agree (the `stripe-billing` skill,
+`../stripe-billing/references/price-integrity.md`, *Test and live mode*) — applies, but its
+Stripe implementation does not: there is no key
 prefix to read. The comparison has to be made against something else, and Heleket gives
 exactly two candidates, both non-secret:
 

package/plugins/sheleg-dev/skills/error-tracking/SKILL.md

@@ -10,11 +10,9 @@ description: >-
   "set up error tracking", "SENTRY_DSN", "sentry-cli", "sentry mcp", "scrub secrets from
   errors", "release tracking", "suspect commits", "why is Sentry empty", "подключить Sentry",
   "трекинг ошибок", "секреты в Sentry", "релизы в Sentry", "наблюдаемость". NOT for judging an
-  agent's trajectory (agent-evals), triaging tickets in a tracker (triage-issue), or choosing an
-  uptime vendor.
+  agent's trajectory (agent-evals), triaging tickets in a tracker (your tracker's own triage
+  skill), or choosing an uptime vendor.
 license: MIT
-metadata:
-  version: 0.9.2
 ---
 
 # error-tracking — Sentry wired so it does not leak, and so a stack trace names a commit

package/plugins/sheleg-dev/skills/frontend-performance/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "render-blocking", "bundle size", "code splitting", "lazy loading", "cache headers",
   "performance budget", "ускорить сайт", "медленно грузится", "оптимизация скорости", "вес
   бандла". Not for visual design or conversion work.
+license: MIT
 ---
 
 # Frontend Performance

package/plugins/sheleg-dev/skills/google-auth/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "авторизация Google", "сервисный аккаунт",
   "ключи сервисного аккаунта", "проверить ID-токен". For end-user web sign-in only, use the
   google-signin skill instead.
+license: MIT
 ---
 
 # Google Authentication for Node.js & Python

package/plugins/sheleg-dev/skills/google-signin/SKILL.md

@@ -10,6 +10,7 @@ description: >-
   "google.accounts.id", "gsi/client", "verify google token", "one tap", "account linking",
   "login csrf", "g_csrf_token", "вход через Google", "кнопка входа Google", "связать аккаунты",
   "проверить токен Google". For the broader library surface use google-auth instead.
+license: MIT
 ---
 
 # Google Sign-In (GIS) — production web login

package/plugins/sheleg-dev/skills/stripe-billing/SKILL.md

@@ -314,18 +314,15 @@ product decision `stripe-best-practices` owns.
 
 - **At period end is the default** — the user keeps what they paid for and
   `status` stays `active`. Under **flexible** `billing_mode` a portal
-  cancellation sets `cancel_at` and leaves `cancel_at_period_end` **false**, so a
-  banner reading that boolean tells a customer who cancelled ten seconds ago that
-  their plan renews. Store the timestamp, derived from both fields.
+  cancellation sets `cancel_at` and leaves `cancel_at_period_end` **false** —
+  derive "is cancelling" from both fields, never from the boolean alone.
 - **Do the teardown in `customer.subscription.deleted`**, never beside the API
   call, so one path serves your UI, the portal and dunning alike.
 - On `invoice.payment_failed`, mark `past_due` and notify — do not cancel.
   Stripe's dunning decides the retries and the terminal state.
-- **A save offer's eligibility is yours.** Stripe's cancel page shows a coupon
-  card when you pass `flow_data.subscription_cancel.retention`, but a coupon
-  cannot be restricted to one customer and a `duration=once` discount leaves
-  `subscription.discounts` once its invoice finalizes. Ask Stripe whether this
-  customer was already discounted and the answer is no, every month, forever.
+- **A save offer's eligibility is yours.** Stripe cannot answer "was this
+  customer already discounted" — a `duration=once` discount leaves
+  `subscription.discounts` at finalization — so track eligibility yourself.
 
 Both, with the code:
 [`references/cancellation-and-retention.md`](references/cancellation-and-retention.md).