@ssheleg/sheleg-dev 0.11.5 → 0.11.8

package/CHANGELOG.md

@@ -1,3 +1,56 @@
+## v0.11.8 — a Contents entry pointing nowhere is depth the file does not have
+
+The family audit's second round (2026-09-07) read the eight reference files that
+carry tables of contents and found the class the first round had walked past:
+
+- **`error-tracking/references/setup.md` listed a section that never existed at any
+  commit** — `git log -S'## Find what already exists'` is empty; the entry was born
+  dangling when the skill was created. Removed.
+- **Eight files carried TWO tables of contents**: the generated `## Contents` (v0.3.1)
+  sat on top of the older hand-kept `## Table of Contents`, which is where the one
+  genuinely broken anchor lived — `google-auth`'s `#fedcm-migration` pointed at a
+  heading reworded to *FedCM — mandatory, not a migration you are planning*. The
+  stale lists are gone; the generated one stays.
+- **The class is closed, not just the instances**: `check_reference_anchors_resolve`
+  reads every shipped `references/*.md` and `SKILL.md`, strips fenced code, and
+  resolves each intra-document `](#anchor)` against headings slugged by GitHub's
+  NON-collapsing rule (an em-dash heading anchors with two hyphens — the umbrella
+  measured 22 false failures from a collapsing slugger on 2026-08-14). Watched
+  firing on the replanted setup.md entry before being believed; a workflow negative
+  keeps it honest from here. Validator: 26 → **27 checks**.
+
+## v0.11.7 — the fifth version surface is retired, and one audit finding is refused by a guard that already knew
+
+> **v0.11.6 is a burned tag.** It was pushed before the release PR merged, in a repository
+> that squash-merges — so it points beside `main` at `7088752`, the release run refused it
+> at *The tag must be reachable from the default branch*, and the remote forbids tag
+> deletion. Nothing shipped under it; this version is the same tree, tagged on `main`.
+
+A family audit (2026-09-06, `sshlg-skills` wave `AUDIT-WAVE-0906`) read all seven skills
+against the standard. What it found here, closed:
+
+- **`error-tracking` carried `metadata.version: 0.9.2` under a release whose every other
+  surface said 0.11.5** — the only skill in the member carrying the key, a fifth version
+  surface the ×4 sync never read. The key is dropped rather than synced: four surfaces
+  move together under a guard, and a fifth existed only to drift.
+- **Five skills declared no `license:`** while their two siblings did — `ad-tracking`,
+  `crypto-payments`, `frontend-performance`, `google-auth`, `google-signin` all say MIT now.
+- **`error-tracking`'s NOT-for clause named `triage-issue`**, an id that resolves only on
+  machines carrying one specific tracker plugin; it names the class now.
+- **`heleket-provider.md` pointed at a bare `references/price-integrity.md`**, which
+  resolves only in the sibling skill; the pointer carries `../stripe-billing/` now.
+- **`ad-tracking`'s troubleshooting table moved into `references/performance-security.md`**
+  (~285 body tokens), and `stripe-billing`'s cancellation bullets compressed against their
+  own reference (~65) — headroom bought by moving depth, never by deleting it. What still
+  sits near the ceiling is `B-106` on the board.
+
+One finding was refused, and the refusal is the record: the audit asked for the shared
+`webhook signature` literal to be qualified per provider, and `test/validate.py` already
+carries `TRIGGERS_SHARED_BY_DESIGN` saying both rails own that seam — the attempted
+removal turned the gate red, which is the exemption doing its job.
+
+Board: `B-106` filed. Source: family audit 2026-09-06.
+
 ## v0.11.5 — the card is the umbrella's render, and the eyebrow stops painting past the canvas
 
 The committed social preview is now generated by the umbrella with the CORRECTED fit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.11.5",
+  "version": "0.11.8",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.11.5",
+  "version": "0.11.8",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "enhanced conversions", "retargeting", "purchase event", "CAPI", "gclid", "UTM",
   "attribution", "отслеживание конверсий", "пиксель Meta", "согласие на куки", "ретаргетинг",
   "аналитика рекламы". Not for running the ad campaigns themselves.
+license: MIT
 ---
 
 # Advertising Analytics & Conversion Tracking Integration
@@ -364,31 +365,11 @@ failure this whole skill exists to prevent, and it looks fine in every test
 that starts by accepting.
 ## Troubleshooting
 
-### Common Issues
-
-| Problem | Cause | Fix |
-|---|---|---|
-| No events in GA4 | Consent defaults not set before gtag.js loads | Ensure consent `default` call is **before** the script tag |
-| CSP violations in console | Missing domain in CSP header | Add the domain to the correct CSP directive |
-| Meta Pixel not firing | Consent-gated component not rendering | Check localStorage consent value, check CustomEvent listener |
-| Duplicate `PageView` events | Multiple pixel instances or route change listeners | Ensure pixel init code has `if(f.fbq)return;` guard |
-| Purchase events without value | Missing `value`/`currency` params | Both GA4 and Meta **require** these for conversion optimisation |
-| Advanced Matching not working | `fbq('init')` called before pixel SDK loads | Ensure `fbevents.js` is loaded before calling `setFbAdvancedMatching()` |
-| Enhanced Conversions not matching | `user_data` set after conversion event | Call `setEnhancedConversionData()` **before** the conversion event fires |
-| gclid lost after Stripe redirect | — (shouldn't happen) | `_gcl_aw` cookie is first-party, persists across redirects |
-| Events firing on localhost | Missing `isLocal` guard | Add `if (window.location.hostname === 'localhost') return;` |
-
-### Debug Mode
-
-Enable debug logging for local development:
-
-```typescript
-const isLocal = window.location.hostname === "localhost";
-if (isLocal) {
-  console.debug("[Analytics]", eventName, params);
-  return; // don't fire real events
-}
-```
+Read `references/performance-security.md` → **Troubleshooting** for the
+common-issues table (consent ordering, duplicate `PageView`, Advanced/Enhanced
+Matching timing, the localhost guard) and the debug-mode snippet. The two seen
+most: consent `default` must run **before** gtag.js loads, and a purchase
+without `value`/`currency` cannot be optimised against by either platform.
 
 ---
 

package/plugins/sheleg-dev/skills/ad-tracking/references/consent-mode.md

@@ -5,7 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Status check — 2026](#status-check--2026)
 - [Advanced vs Basic Mode](#advanced-vs-basic-mode)
 - [All Consent Types](#all-consent-types)
@@ -18,17 +17,6 @@
 - [Ads Data Redaction](#ads-data-redaction)
 - [Verification](#verification)
 
-## Table of Contents
-
-- [Advanced vs Basic Mode](#advanced-vs-basic-mode)
-- [All Consent Types](#all-consent-types)
-- [Region-Specific Defaults](#region-specific-defaults)
-- [Granular Consent](#granular-consent)
-- [Consent Update Flow](#consent-update-flow)
-- [GTM Implementation](#gtm-implementation)
-- [Tag Behavior When Denied](#tag-behavior-when-denied)
-- [Verification](#verification)
-
 ## Status check — 2026
 
 Consent Mode v2 has been required since **March 2024** for anyone using Google

package/plugins/sheleg-dev/skills/ad-tracking/references/event-tracking.md

@@ -5,19 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [Event Types](#event-types)
-- [Recommended Events](#recommended-events)
-- [Custom Events](#custom-events)
-- [Parameter Rules](#parameter-rules)
-- [Ecommerce Events](#ecommerce-events)
-- [SaaS / Subscription Events](#saas--subscription-events)
-- [trackEvent Wrapper Pattern](#trackevent-wrapper-pattern)
-- [User identification](#user-identification)
-- [UTM Attribution](#utm-attribution)
-
-## Table of Contents
-
 - [Event Types](#event-types)
 - [Recommended Events](#recommended-events)
 - [Custom Events](#custom-events)

package/plugins/sheleg-dev/skills/ad-tracking/references/gtag-api.md

@@ -6,7 +6,6 @@ Source: [Google Tag Platform — gtag.js](https://developers.google.com/tag-plat
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Overview](#overview)
 - [Installation](#installation)
 - [Tag ID Formats](#tag-id-formats)
@@ -17,22 +16,6 @@ Source: [Google Tag Platform — gtag.js](https://developers.google.com/tag-plat
 - [Next.js / React Integration](#nextjs--react-integration)
 
 
-## Table of Contents
-
-- [Overview](#overview)
-- [Installation](#installation)
-- [Tag ID Formats](#tag-id-formats)
-- [Commands](#commands)
-  - [config](#config)
-  - [event](#event)
-  - [set](#set)
-  - [get](#get)
-  - [consent](#consent)
-- [Parameter Scope & Precedence](#parameter-scope--precedence)
-- [Data Routing](#data-routing)
-- [Multi-Product Configuration](#multi-product-configuration)
-- [Next.js / React Integration](#nextjs--react-integration)
-
 ## Overview
 
 The Google tag (`gtag.js`) API consists of a single function:

package/plugins/sheleg-dev/skills/ad-tracking/references/performance-security.md

@@ -5,7 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Script Loading Strategies](#script-loading-strategies)
 - [Content Security Policy](#content-security-policy)
 - [Next.js / React Integration](#nextjs--react-integration)
@@ -13,15 +12,7 @@
 - [Debug & Testing](#debug--testing)
 - [Common Mistakes](#common-mistakes)
 - [Multi-Page Consistency](#multi-page-consistency)
-
-## Table of Contents
-
-- [Script Loading Strategies](#script-loading-strategies)
-- [Content Security Policy](#content-security-policy)
-- [SPA (Single Page Application) Handling](#spa-single-page-application-handling)
-- [Debug & Testing](#debug--testing)
-- [Common Mistakes](#common-mistakes)
-- [Multi-Page Consistency](#multi-page-consistency)
+- [Troubleshooting](#troubleshooting)
 
 ## Script Loading Strategies
 
@@ -288,3 +279,34 @@ terser js/consent.js -o js/consent.min.js -c -m
 ```
 
 Use the minified version in production, source version in development.
+
+## Troubleshooting
+
+Moved here from `SKILL.md` — the lookup table for symptoms whose causes are
+covered in the sections above.
+
+### Common Issues
+
+| Problem | Cause | Fix |
+|---|---|---|
+| No events in GA4 | Consent defaults not set before gtag.js loads | Ensure consent `default` call is **before** the script tag |
+| CSP violations in console | Missing domain in CSP header | Add the domain to the correct CSP directive |
+| Meta Pixel not firing | Consent-gated component not rendering | Check localStorage consent value, check CustomEvent listener |
+| Duplicate `PageView` events | Multiple pixel instances or route change listeners | Ensure pixel init code has `if(f.fbq)return;` guard |
+| Purchase events without value | Missing `value`/`currency` params | Both GA4 and Meta **require** these for conversion optimisation |
+| Advanced Matching not working | `fbq('init')` called before pixel SDK loads | Ensure `fbevents.js` is loaded before calling `setFbAdvancedMatching()` |
+| Enhanced Conversions not matching | `user_data` set after conversion event | Call `setEnhancedConversionData()` **before** the conversion event fires |
+| gclid lost after Stripe redirect | — (shouldn't happen) | `_gcl_aw` cookie is first-party, persists across redirects |
+| Events firing on localhost | Missing `isLocal` guard | Add `if (window.location.hostname === 'localhost') return;` |
+
+### Debug Mode
+
+Enable debug logging for local development:
+
+```typescript
+const isLocal = window.location.hostname === "localhost";
+if (isLocal) {
+  console.debug("[Analytics]", eventName, params);
+  return; // don't fire real events
+}
+```

package/plugins/sheleg-dev/skills/crypto-payments/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   checkout", "pay with crypto", "USDT payment", "TRC20", "payment webhook", "IPN", "webhook
   signature", "underpayment", "Heleket", "NOWPayments", "приём криптоплатежей", "оплата
   криптой", "вебхук платежа", "недоплата". Not for card billing — use stripe-billing.
+license: MIT
 ---
 
 # Crypto payments

package/plugins/sheleg-dev/skills/crypto-payments/references/heleket-provider.md

@@ -174,8 +174,9 @@ than Stripe's and the difference decides the design:
 | Key also signs webhooks | no, a separate `whsec_` | **yes, the same value** |
 
 So the house pattern — declare the environment in a variable separate from the secret,
-then assert at boot that the two agree (the `stripe-billing` skill, `references/price-integrity.md`,
-*Test and live mode*) — applies, but its Stripe implementation does not: there is no key
+then assert at boot that the two agree (the `stripe-billing` skill,
+`../stripe-billing/references/price-integrity.md`, *Test and live mode*) — applies, but its
+Stripe implementation does not: there is no key
 prefix to read. The comparison has to be made against something else, and Heleket gives
 exactly two candidates, both non-secret:
 

package/plugins/sheleg-dev/skills/error-tracking/SKILL.md

@@ -10,11 +10,9 @@ description: >-
   "set up error tracking", "SENTRY_DSN", "sentry-cli", "sentry mcp", "scrub secrets from
   errors", "release tracking", "suspect commits", "why is Sentry empty", "подключить Sentry",
   "трекинг ошибок", "секреты в Sentry", "релизы в Sentry", "наблюдаемость". NOT for judging an
-  agent's trajectory (agent-evals), triaging tickets in a tracker (triage-issue), or choosing an
-  uptime vendor.
+  agent's trajectory (agent-evals), triaging tickets in a tracker (your tracker's own triage
+  skill), or choosing an uptime vendor.
 license: MIT
-metadata:
-  version: 0.9.2
 ---
 
 # error-tracking — Sentry wired so it does not leak, and so a stack trace names a commit

package/plugins/sheleg-dev/skills/error-tracking/references/setup.md

@@ -8,7 +8,6 @@ refused and you need to tell a policy problem from an auth problem.
 - [Install](#install)
 - [Authenticate](#authenticate)
 - [Token taxonomy — which kind can do what](#token-taxonomy--which-kind-can-do-what)
-- [Find what already exists](#find-what-already-exists)
 - [Create a project](#create-a-project)
 - [Get the DSN and wire it in](#get-the-dsn-and-wire-it-in)
 - [Declare the MCP server](#declare-the-mcp-server)

package/plugins/sheleg-dev/skills/frontend-performance/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "render-blocking", "bundle size", "code splitting", "lazy loading", "cache headers",
   "performance budget", "ускорить сайт", "медленно грузится", "оптимизация скорости", "вес
   бандла". Not for visual design or conversion work.
+license: MIT
 ---
 
 # Frontend Performance

package/plugins/sheleg-dev/skills/google-auth/SKILL.md

@@ -11,6 +11,7 @@ description: >-
   "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "авторизация Google", "сервисный аккаунт",
   "ключи сервисного аккаунта", "проверить ID-токен". For end-user web sign-in only, use the
   google-signin skill instead.
+license: MIT
 ---
 
 # Google Authentication for Node.js & Python

package/plugins/sheleg-dev/skills/google-auth/references/adc-and-service-accounts.md

@@ -3,19 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [ADC Overview](#adc-overview)
-- [ADC Search Order](#adc-search-order)
-- [Setting Up ADC](#setting-up-adc)
-- [Using ADC in Code](#using-adc-in-code)
-- [Service Account Keys (JWT)](#service-account-keys-jwt)
-- [Compute Credentials](#compute-credentials)
-- [Impersonated Credentials](#impersonated-credentials)
-- [Downscoped Client](#downscoped-client)
-- [ID Tokens](#id-tokens)
-- [Environment Variables](#environment-variables)
-
-## Table of Contents
 - [ADC Overview](#adc-overview)
 - [ADC Search Order](#adc-search-order)
 - [Setting Up ADC](#setting-up-adc)

package/plugins/sheleg-dev/skills/google-auth/references/oauth2-web-server.md

@@ -3,7 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Prerequisites](#prerequisites)
 - [Step 1: Set Authorization Parameters](#step-1-set-authorization-parameters)
 - [Step 2: Redirect to Google](#step-2-redirect-to-google)
@@ -18,20 +17,6 @@
 - [Complete FastAPI Example](#complete-fastapi-example)
 - [Scopes Reference](#scopes-reference)
 
-## Table of Contents
-- [Prerequisites](#prerequisites)
-- [Step 1: Set Authorization Parameters](#step-1-set-authorization-parameters)
-- [Step 2: Redirect to Google](#step-2-redirect-to-google)
-- [Step 3: Handle Callback](#step-3-handle-callback)
-- [Step 4: Use Access Token](#step-4-use-access-token)
-- [Refreshing Tokens](#refreshing-tokens)
-- [Revoking Tokens](#revoking-tokens)
-- [Incremental Authorization](#incremental-authorization)
-- [Error Reference](#error-reference)
-- [Complete Express Example](#complete-express-example)
-- [Complete Flask Example](#complete-flask-example)
-- [Complete FastAPI Example](#complete-fastapi-example)
-
 ## Prerequisites
 
 1. Enable APIs in [Google Cloud Console](https://console.developers.google.com/apis/library)

package/plugins/sheleg-dev/skills/google-auth/references/sign-in-with-google.md

@@ -3,7 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Overview](#overview)
 - [Client-Side Integration](#client-side-integration)
 - [Server-Side ID Token Verification](#server-side-id-token-verification)
@@ -17,19 +16,6 @@
 - [FedCM — mandatory, not a migration you are planning](#fedcm--mandatory-not-a-migration-you-are-planning)
 - [Sign Out](#sign-out)
 
-## Table of Contents
-- [Overview](#overview)
-- [Client-Side Integration](#client-side-integration)
-- [Server-Side ID Token Verification](#server-side-id-token-verification)
-- [CSRF Protection](#csrf-protection)
-- [Nonce Verification](#nonce-verification)
-- [ID Token Payload Fields](#id-token-payload-fields)
-- [Account Linking Flows](#account-linking-flows)
-- [Next.js / React Integration Pattern](#nextjs--react-integration-pattern)
-- [FastAPI Integration Pattern](#fastapi-integration-pattern)
-- [Flask Integration Pattern](#flask-integration-pattern)
-- [FedCM Migration](#fedcm-migration)
-
 ## Overview
 
 Sign In with Google (part of Google Identity Services / GIS) provides:

package/plugins/sheleg-dev/skills/google-auth/references/workload-identity.md

@@ -3,19 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [Overview](#overview)
-- [AWS Federation](#aws-federation)
-- [Azure Federation](#azure-federation)
-- [OIDC Provider Federation](#oidc-provider-federation)
-- [Custom Subject Token Supplier](#custom-subject-token-supplier)
-- [Workforce Identity Federation](#workforce-identity-federation)
-- [Executable-Sourced Credentials](#executable-sourced-credentials)
-- [Using External Identities](#using-external-identities)
-- [Configurable Token Lifetime](#configurable-token-lifetime)
-- [Security Considerations](#security-considerations)
-
-## Table of Contents
 - [Overview](#overview)
 - [AWS Federation](#aws-federation)
 - [Azure Federation](#azure-federation)

package/plugins/sheleg-dev/skills/google-signin/SKILL.md

@@ -10,6 +10,7 @@ description: >-
   "google.accounts.id", "gsi/client", "verify google token", "one tap", "account linking",
   "login csrf", "g_csrf_token", "вход через Google", "кнопка входа Google", "связать аккаунты",
   "проверить токен Google". For the broader library surface use google-auth instead.
+license: MIT
 ---
 
 # Google Sign-In (GIS) — production web login

package/plugins/sheleg-dev/skills/stripe-billing/SKILL.md

@@ -314,18 +314,15 @@ product decision `stripe-best-practices` owns.
 
 - **At period end is the default** — the user keeps what they paid for and
   `status` stays `active`. Under **flexible** `billing_mode` a portal
-  cancellation sets `cancel_at` and leaves `cancel_at_period_end` **false**, so a
-  banner reading that boolean tells a customer who cancelled ten seconds ago that
-  their plan renews. Store the timestamp, derived from both fields.
+  cancellation sets `cancel_at` and leaves `cancel_at_period_end` **false** —
+  derive "is cancelling" from both fields, never from the boolean alone.
 - **Do the teardown in `customer.subscription.deleted`**, never beside the API
   call, so one path serves your UI, the portal and dunning alike.
 - On `invoice.payment_failed`, mark `past_due` and notify — do not cancel.
   Stripe's dunning decides the retries and the terminal state.
-- **A save offer's eligibility is yours.** Stripe's cancel page shows a coupon
-  card when you pass `flow_data.subscription_cancel.retention`, but a coupon
-  cannot be restricted to one customer and a `duration=once` discount leaves
-  `subscription.discounts` once its invoice finalizes. Ask Stripe whether this
-  customer was already discounted and the answer is no, every month, forever.
+- **A save offer's eligibility is yours.** Stripe cannot answer "was this
+  customer already discounted" — a `duration=once` discount leaves
+  `subscription.discounts` at finalization — so track eligibility yourself.
 
 Both, with the code:
 [`references/cancellation-and-retention.md`](references/cancellation-and-retention.md).