@ssheleg/sheleg-dev 0.11.7 → 0.11.8

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## v0.11.8 — a Contents entry pointing nowhere is depth the file does not have
+
+The family audit's second round (2026-09-07) read the eight reference files that
+carry tables of contents and found the class the first round had walked past:
+
+- **`error-tracking/references/setup.md` listed a section that never existed at any
+  commit** — `git log -S'## Find what already exists'` is empty; the entry was born
+  dangling when the skill was created. Removed.
+- **Eight files carried TWO tables of contents**: the generated `## Contents` (v0.3.1)
+  sat on top of the older hand-kept `## Table of Contents`, which is where the one
+  genuinely broken anchor lived — `google-auth`'s `#fedcm-migration` pointed at a
+  heading reworded to *FedCM — mandatory, not a migration you are planning*. The
+  stale lists are gone; the generated one stays.
+- **The class is closed, not just the instances**: `check_reference_anchors_resolve`
+  reads every shipped `references/*.md` and `SKILL.md`, strips fenced code, and
+  resolves each intra-document `](#anchor)` against headings slugged by GitHub's
+  NON-collapsing rule (an em-dash heading anchors with two hyphens — the umbrella
+  measured 22 false failures from a collapsing slugger on 2026-08-14). Watched
+  firing on the replanted setup.md entry before being believed; a workflow negative
+  keeps it honest from here. Validator: 26 → **27 checks**.
+
 ## v0.11.7 — the fifth version surface is retired, and one audit finding is refused by a guard that already knew
 
 > **v0.11.6 is a burned tag.** It was pushed before the release PR merged, in a repository

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/references/consent-mode.md

@@ -5,7 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Status check — 2026](#status-check--2026)
 - [Advanced vs Basic Mode](#advanced-vs-basic-mode)
 - [All Consent Types](#all-consent-types)
@@ -18,17 +17,6 @@
 - [Ads Data Redaction](#ads-data-redaction)
 - [Verification](#verification)
 
-## Table of Contents
-
-- [Advanced vs Basic Mode](#advanced-vs-basic-mode)
-- [All Consent Types](#all-consent-types)
-- [Region-Specific Defaults](#region-specific-defaults)
-- [Granular Consent](#granular-consent)
-- [Consent Update Flow](#consent-update-flow)
-- [GTM Implementation](#gtm-implementation)
-- [Tag Behavior When Denied](#tag-behavior-when-denied)
-- [Verification](#verification)
-
 ## Status check — 2026
 
 Consent Mode v2 has been required since **March 2024** for anyone using Google

package/plugins/sheleg-dev/skills/ad-tracking/references/event-tracking.md

@@ -5,19 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [Event Types](#event-types)
-- [Recommended Events](#recommended-events)
-- [Custom Events](#custom-events)
-- [Parameter Rules](#parameter-rules)
-- [Ecommerce Events](#ecommerce-events)
-- [SaaS / Subscription Events](#saas--subscription-events)
-- [trackEvent Wrapper Pattern](#trackevent-wrapper-pattern)
-- [User identification](#user-identification)
-- [UTM Attribution](#utm-attribution)
-
-## Table of Contents
-
 - [Event Types](#event-types)
 - [Recommended Events](#recommended-events)
 - [Custom Events](#custom-events)

package/plugins/sheleg-dev/skills/ad-tracking/references/gtag-api.md

@@ -6,7 +6,6 @@ Source: [Google Tag Platform — gtag.js](https://developers.google.com/tag-plat
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Overview](#overview)
 - [Installation](#installation)
 - [Tag ID Formats](#tag-id-formats)
@@ -17,22 +16,6 @@ Source: [Google Tag Platform — gtag.js](https://developers.google.com/tag-plat
 - [Next.js / React Integration](#nextjs--react-integration)
 
 
-## Table of Contents
-
-- [Overview](#overview)
-- [Installation](#installation)
-- [Tag ID Formats](#tag-id-formats)
-- [Commands](#commands)
-  - [config](#config)
-  - [event](#event)
-  - [set](#set)
-  - [get](#get)
-  - [consent](#consent)
-- [Parameter Scope & Precedence](#parameter-scope--precedence)
-- [Data Routing](#data-routing)
-- [Multi-Product Configuration](#multi-product-configuration)
-- [Next.js / React Integration](#nextjs--react-integration)
-
 ## Overview
 
 The Google tag (`gtag.js`) API consists of a single function:

package/plugins/sheleg-dev/skills/ad-tracking/references/performance-security.md

@@ -5,7 +5,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Script Loading Strategies](#script-loading-strategies)
 - [Content Security Policy](#content-security-policy)
 - [Next.js / React Integration](#nextjs--react-integration)
@@ -15,16 +14,6 @@
 - [Multi-Page Consistency](#multi-page-consistency)
 - [Troubleshooting](#troubleshooting)
 
-## Table of Contents
-
-- [Script Loading Strategies](#script-loading-strategies)
-- [Content Security Policy](#content-security-policy)
-- [SPA (Single Page Application) Handling](#spa-single-page-application-handling)
-- [Debug & Testing](#debug--testing)
-- [Common Mistakes](#common-mistakes)
-- [Multi-Page Consistency](#multi-page-consistency)
-- [Troubleshooting](#troubleshooting)
-
 ## Script Loading Strategies
 
 ### Standard Async (default)

package/plugins/sheleg-dev/skills/error-tracking/references/setup.md

@@ -8,7 +8,6 @@ refused and you need to tell a policy problem from an auth problem.
 - [Install](#install)
 - [Authenticate](#authenticate)
 - [Token taxonomy — which kind can do what](#token-taxonomy--which-kind-can-do-what)
-- [Find what already exists](#find-what-already-exists)
 - [Create a project](#create-a-project)
 - [Get the DSN and wire it in](#get-the-dsn-and-wire-it-in)
 - [Declare the MCP server](#declare-the-mcp-server)

package/plugins/sheleg-dev/skills/google-auth/references/adc-and-service-accounts.md

@@ -3,19 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [ADC Overview](#adc-overview)
-- [ADC Search Order](#adc-search-order)
-- [Setting Up ADC](#setting-up-adc)
-- [Using ADC in Code](#using-adc-in-code)
-- [Service Account Keys (JWT)](#service-account-keys-jwt)
-- [Compute Credentials](#compute-credentials)
-- [Impersonated Credentials](#impersonated-credentials)
-- [Downscoped Client](#downscoped-client)
-- [ID Tokens](#id-tokens)
-- [Environment Variables](#environment-variables)
-
-## Table of Contents
 - [ADC Overview](#adc-overview)
 - [ADC Search Order](#adc-search-order)
 - [Setting Up ADC](#setting-up-adc)

package/plugins/sheleg-dev/skills/google-auth/references/oauth2-web-server.md

@@ -3,7 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Prerequisites](#prerequisites)
 - [Step 1: Set Authorization Parameters](#step-1-set-authorization-parameters)
 - [Step 2: Redirect to Google](#step-2-redirect-to-google)
@@ -18,20 +17,6 @@
 - [Complete FastAPI Example](#complete-fastapi-example)
 - [Scopes Reference](#scopes-reference)
 
-## Table of Contents
-- [Prerequisites](#prerequisites)
-- [Step 1: Set Authorization Parameters](#step-1-set-authorization-parameters)
-- [Step 2: Redirect to Google](#step-2-redirect-to-google)
-- [Step 3: Handle Callback](#step-3-handle-callback)
-- [Step 4: Use Access Token](#step-4-use-access-token)
-- [Refreshing Tokens](#refreshing-tokens)
-- [Revoking Tokens](#revoking-tokens)
-- [Incremental Authorization](#incremental-authorization)
-- [Error Reference](#error-reference)
-- [Complete Express Example](#complete-express-example)
-- [Complete Flask Example](#complete-flask-example)
-- [Complete FastAPI Example](#complete-fastapi-example)
-
 ## Prerequisites
 
 1. Enable APIs in [Google Cloud Console](https://console.developers.google.com/apis/library)

package/plugins/sheleg-dev/skills/google-auth/references/sign-in-with-google.md

@@ -3,7 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
 - [Overview](#overview)
 - [Client-Side Integration](#client-side-integration)
 - [Server-Side ID Token Verification](#server-side-id-token-verification)
@@ -17,19 +16,6 @@
 - [FedCM — mandatory, not a migration you are planning](#fedcm--mandatory-not-a-migration-you-are-planning)
 - [Sign Out](#sign-out)
 
-## Table of Contents
-- [Overview](#overview)
-- [Client-Side Integration](#client-side-integration)
-- [Server-Side ID Token Verification](#server-side-id-token-verification)
-- [CSRF Protection](#csrf-protection)
-- [Nonce Verification](#nonce-verification)
-- [ID Token Payload Fields](#id-token-payload-fields)
-- [Account Linking Flows](#account-linking-flows)
-- [Next.js / React Integration Pattern](#nextjs--react-integration-pattern)
-- [FastAPI Integration Pattern](#fastapi-integration-pattern)
-- [Flask Integration Pattern](#flask-integration-pattern)
-- [FedCM Migration](#fedcm-migration)
-
 ## Overview
 
 Sign In with Google (part of Google Identity Services / GIS) provides:

package/plugins/sheleg-dev/skills/google-auth/references/workload-identity.md

@@ -3,19 +3,6 @@
 
 ## Contents
 
-- [Table of Contents](#table-of-contents)
-- [Overview](#overview)
-- [AWS Federation](#aws-federation)
-- [Azure Federation](#azure-federation)
-- [OIDC Provider Federation](#oidc-provider-federation)
-- [Custom Subject Token Supplier](#custom-subject-token-supplier)
-- [Workforce Identity Federation](#workforce-identity-federation)
-- [Executable-Sourced Credentials](#executable-sourced-credentials)
-- [Using External Identities](#using-external-identities)
-- [Configurable Token Lifetime](#configurable-token-lifetime)
-- [Security Considerations](#security-considerations)
-
-## Table of Contents
 - [Overview](#overview)
 - [AWS Federation](#aws-federation)
 - [Azure Federation](#azure-federation)