chore(paddle-webhooks): trim SKILL.md + bump SDKs (review-mode test output)

[leggetter]

Summary

End-to-end demonstration of two generator-prompt features applied to paddle-webhooks via ./scripts/generate-skills.sh review paddle. The review iteration ran twice — once with each feature merged into main — and produced clean, focused fix commits both times.

Commit	Source PR	What the reviewer caught
trim SKILL.md to verification core	#57 — review-skill prompt: trim-convention checks	Full Express + FastAPI handlers duplicated in SKILL.md. Trimmed to verification core (~30 lines each) + canonical pointer block; SKILL.md shrank from 178 → 139 lines.
bump SDKs and tooling	#59 — per-provider SDK version-tracking via sdks field	@paddle/paddle-node-sdk ^1.4.0 was 2 majors behind ^3.8.0 (Express + Next.js). paddle-python-sdk>=1.0.0 was too loose to guarantee the Verifier/Secret API the docs reference. Plus a verification.md "gotcha" describing replay protection the handlers don't implement.

What changed

Commit 1 (909e72a) — SKILL.md trim:

• SKILL.md — "Essential Code (USE THIS)" → "Verification (core)". Removed the full Express + FastAPI route wiring, raw-body middleware, event-type switches, response sending. Kept the byte-identical HMAC verification helpers in Node + Python. Added context about @paddle/paddle-node-sdk's unmarshal() SDK helper. Inserted the canonical pointer block.
• references/verification.md — minor wording adjustment.
• examples/fastapi/main.py — removed dead code path that pretended to use paddle_billing.Notifications.Verifier but always fell back to manual verification.

Commit 2 (cacdf4a) — SDK + tooling bumps:

• examples/express/package.json: @paddle/paddle-node-sdk ^1.4.0 → ^3.8.0
• examples/nextjs/package.json: same SDK bump, plus next ^16.1.6 → ^16.2.6 and typescript ^5.9.3 → ^6.0.3
• examples/fastapi/requirements.txt: paddle-python-sdk>=1.0.0 → >=1.14.1
• references/verification.md: removed a replay-protection "gotcha" — the strict 5-second tolerance described would reject Paddle's legitimate retries, and none of the handlers actually enforced it.

Combined: +47 / −181 lines net across the trim + bump.

Dependencies

This PR's content is a downstream side-effect of two upstream prompt-engineering PRs:

• PR docs(review-skill prompt): enforce SKILL.md inline-code trim convention #57 (merged) added the inline-trim checks to review-skill.md — produced commit 1.
• PR feat(skill-generator): per-provider SDK version-tracking via sdks field #59 (open) adds the per-provider SDK version-tracking — produced commit 2.

Best merged after PR #59 so the SDK-bump commit's pedigree (machine-generated by the reviewer) ties cleanly to the merged spec change.

Test plan

• cd skills/paddle-webhooks/examples/express && npm install && npm test
• cd skills/paddle-webhooks/examples/nextjs && npm install && npm test
• cd skills/paddle-webhooks/examples/fastapi && python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt && pytest test_webhook.py -v
• Verify the SDK v1→v3 jump didn't break the handler's call sites. (The Node SDK's paddle.webhooks.unmarshal() signature is documented as stable across v2/v3 but worth a manual spot-check.)
• Spot-check that SKILL.md still answers "how do I verify a Paddle webhook?" cold without loading the examples
• Confirm the verification helpers in SKILL.md still match examples/<framework>/

Reviewer suggestions (informational, not addressed)

From the original review output:

• None of the three handlers enforce timestamp tolerance / replay protection. Commit 2 dropped the false claim from verification.md. Adding actual replay protection (with a documented-wide-enough window) is a separate concern.
• verification.md previously recommended a 5-second tolerance which matched Paddle's documented value but is tight in production due to clock skew. The recommendation is gone for now; if it's added back, note the production caveat.

https://claude.ai/code/session_01NNTgQRJss1V7gyzzJ9rjnB