@friedbotstudio/create-baseline 0.1.0 → 0.2.1

package/README.md

@@ -106,8 +106,13 @@ npx @friedbotstudio/create-baseline ./your-project --dry-run
 
 # Skip the install-time PlantUML jar download
 npx @friedbotstudio/create-baseline ./your-project --no-plantuml
+
+# Materialize a security-hardened target/.npmrc (opt-in)
+npx @friedbotstudio/create-baseline ./your-project --with-npmrc
 ```
 
+By default the scaffolder writes only inside `.claude/`, plus `CLAUDE.md`, `.mcp.json`, and `docs/init/seed.md`. Pass `--with-npmrc` to also drop `ignore-scripts=true` + `min-release-age=7` into `target/.npmrc`. Those defaults blunt the npm post-install-hook attack class and delay consumption of fresh malicious publishes. An existing `target/.npmrc` is preserved verbatim. Operators who already set these defaults in `~/.npmrc` don't need the flag.
+
 ### Doctor
 
 ```bash

package/bin/cli.js

@@ -43,6 +43,11 @@ PlantUML jar (~19 MB, fetched at install time from upstream):
   --no-plantuml       Skip the jar download entirely.
   --require-plantuml  Treat jar fetch failure (network/sha256) as fatal (exit 4).
 
+npm posture (off by default):
+  --with-npmrc        Materialize a security-hardened target/.npmrc
+                      (ignore-scripts=true, min-release-age=7). Existing
+                      target/.npmrc is preserved verbatim.
+
 Misc:
   --help, -h       Show this message.
   --version        Print version.
@@ -97,6 +102,7 @@ async function main(argv) {
         'dry-run': { type: 'boolean' },
         'no-plantuml': { type: 'boolean' },
         'require-plantuml': { type: 'boolean' },
+        'with-npmrc': { type: 'boolean' },
         strict: { type: 'boolean' },
       },
       strict: true,
@@ -209,10 +215,10 @@ async function main(argv) {
       }
     } else if (values.force) {
       if (dryRun) io.log(`Would force-install into ${target}`);
-      else await forceInstall(templateDir, target);
+      else await forceInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
     } else {
       if (dryRun) io.log(`Would fresh-install into ${target}`);
-      else await freshInstall(templateDir, target);
+      else await freshInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
     }
   } catch (err) {
     io.error(`install failed: ${err.message}`);

package/obj/template/.claude/skills/audit-baseline/audit.sh

@@ -139,10 +139,11 @@ disk_baseline_hooks  = disk_hooks  - add_hooks
 disk_baseline_agents = disk_agents - add_agents
 
 # Skill provenance: a skill is baseline iff its SKILL.md frontmatter declares
-# owner: baseline. User-added skills (owner: user) are excluded from baseline
-# counts so headline claims and check_names match even after a user adds skills.
+# owner: baseline. Every other on-disk skill (absent owner: field, or explicit
+# owner: user) is treated as user/third-party and out-of-scope of baseline
+# audit checks. Absence-of-owner is the default so projects with pre-existing
+# skills can install the baseline without annotating every file.
 disk_baseline_skills = {s for s in disk_skills if read_skill_owner(s) == "baseline"}
-disk_user_skills     = {s for s in disk_skills if read_skill_owner(s) == "user"}
 
 # ---------- counts vs seed.md ----------
 seed = read_text("docs/init/seed.md")
@@ -219,11 +220,16 @@ check_names("commands names match seed §4.4", EXPECTED_COMMANDS, set(),
 
 # ---------- skill ownership (per-file hash drift + frontmatter validation) ----------
 def check_skill_ownership():
-    # Frontmatter validation: every on-disk SKILL.md must declare owner: baseline|user.
+    # Frontmatter validation. Absence-of-`owner` is treated as user/third-party
+    # and silently skipped — that is the default for any skill not shipped in
+    # the baseline. Only an `owner:` field that is present but carries an
+    # invalid value (typo, wrong literal) is a FAIL. Baseline-listed slugs
+    # (per manifest.owners.skills) that fail to declare `owner: baseline` are
+    # surfaced by the names-match check ("skills names match seed §4.3"),
+    # which compares manifest keys against `disk_baseline_skills`.
     for slug in sorted(disk_skills):
         owner = read_skill_owner(slug)
         if owner is None:
-            add(f"skill ownership: {slug}", "FAIL", "missing owner frontmatter")
             continue
         if owner not in ("baseline", "user"):
             add(f"skill ownership: {slug}", "FAIL", f"invalid owner={owner}")

package/obj/template/.claude/skills/google-analytics/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: google-analytics
+description: Comprehensive Google Analytics 4 guide covering property setup, events, custom events, recommended events, custom dimensions, user tracking, audiences, reporting, BigQuery integration, gtag.js implementation, GTM integration, Measurement Protocol, DebugView, privacy compliance, and data management. Use when working with GA4 implementation, tracking, analysis, or any GA4-related tasks.
+---
+
+# Google Analytics 4 Complete Guide
+
+## Overview
+
+Google Analytics 4 (GA4) is Google's event-based analytics platform for measuring user interactions across websites and applications. Every user interaction is tracked as an event with associated parameters, providing flexible cross-platform measurement.
+
+## When to Use This Skill
+
+Invoke this skill for any GA4-related task:
+
+- Setting up GA4 properties, data streams, and Measurement IDs
+- Installing GA4 via gtag.js, GTM, or CMS plugins
+- Implementing event tracking (automatic, recommended, custom, ecommerce)
+- Creating custom dimensions, audiences, and reports
+- Exporting data to BigQuery for SQL analysis
+- Server-side tracking via Measurement Protocol
+- User ID and cross-device tracking
+- Privacy compliance, Consent Mode, and GDPR/CCPA
+- Testing and debugging with DebugView
+
+## Quick Start
+
+1. **Create property:** analytics.google.com -> Admin -> Create -> Property
+2. **Create data stream:** Add web stream, note Measurement ID (G-XXXXXXXXXX)
+3. **Install tracking** (choose one):
+   - **GTM (recommended):** Install container, create Google Tag with Measurement ID, trigger on All Pages, publish
+   - **gtag.js direct:**
+     ```html
+     <script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
+     <script>
+       window.dataLayer = window.dataLayer || [];
+       function gtag(){dataLayer.push(arguments);}
+       gtag('js', new Date());
+       gtag('config', 'G-XXXXXXXXXX');
+     </script>
+     ```
+4. **Verify:** Enable GA Debugger extension, check Admin -> DebugView for session_start, page_view
+5. **Send custom events:**
+   ```javascript
+   gtag('event', 'button_click', { button_name: 'Subscribe', button_location: 'header' });
+   ```
+
+## Decision Tree: Which Reference Do I Need?
+
+```
+What are you trying to do?
+
+Setting up GA4 for the first time?         -> references/setup.md
+Understanding how events work?              -> references/events-fundamentals.md
+Implementing standard tracking events?      -> references/recommended-events.md
+Creating business-specific custom events?   -> references/custom-events.md
+Making parameters appear in reports?        -> references/custom-dimensions.md
+Implementing User ID / cross-device?        -> references/user-tracking.md
+Building audiences for remarketing?         -> references/audiences.md
+Analysing data in GA4 reports?              -> references/reporting.md
+Exporting to BigQuery for SQL analysis?     -> references/bigquery.md
+Installing via gtag.js directly?            -> references/gtag.md
+Setting up GA4 in Google Tag Manager?       -> references/gtm-integration.md
+Sending events from server/backend?         -> references/measurement-protocol.md
+Testing and debugging implementation?       -> references/debugview.md
+Implementing GDPR/Consent Mode?             -> references/privacy.md
+Configuring Admin settings?                 -> references/data-management.md
+```
+
+## Core Concepts
+
+### Event-Based Model
+
+GA4 tracks everything as events in four categories:
+
+| Category | Description | Examples |
+|----------|-------------|----------|
+| Automatic | Fire without configuration | session_start, first_visit |
+| Enhanced Measurement | Toggle on/off in settings | scroll, click, file_download |
+| Recommended | Google-defined with standard parameters | purchase, login, sign_up |
+| Custom | Business-specific tracking | demo_requested, trial_started |
+
+### Key Limits
+
+| Limit | Value |
+|-------|-------|
+| Event names per property | 500 distinct |
+| Parameters per event | 25 |
+| Event name length | 40 characters |
+| Parameter name/value length | 40 / 100 characters |
+| Custom dimensions (event/user/item) | 50 / 25 / 10 |
+| Audiences per property | 100 |
+
+### Measurement ID
+
+- Format: `G-XXXXXXXXXX` (G- prefix + 10 alphanumeric characters)
+- Location: Admin -> Data Streams -> Web Stream
+- Used in: gtag.js config, GTM tags, Measurement Protocol
+
+## Common Workflows
+
+### Ecommerce Tracking
+
+1. Review [recommended events](references/recommended-events.md) for the purchase funnel: view_item -> add_to_cart -> begin_checkout -> purchase
+2. Structure items array (required: item_id OR item_name; recommended: price, quantity, item_category)
+3. Test with [DebugView](references/debugview.md), then register custom item parameters as [custom dimensions](references/custom-dimensions.md)
+
+### Cross-Device Tracking
+
+1. Implement [User ID](references/user-tracking.md) and configure Reporting Identity (Admin -> Data Settings)
+2. Set [user properties](references/custom-dimensions.md) and build [cross-device audiences](references/audiences.md)
+
+### GDPR Compliance
+
+1. Set up [Consent Mode](references/privacy.md) with default denied state
+2. Integrate with CMP (OneTrust, Cookiebot, etc.), update consent on user acceptance
+3. Test consent implementation with [DebugView](references/debugview.md)
+
+### Custom Reports
+
+1. Understand available data in [reporting](references/reporting.md)
+2. Register custom parameters as [dimensions](references/custom-dimensions.md), create Explorations
+3. For unsampled data, export to [BigQuery](references/bigquery.md)
+
+## Best Practices
+
+- **Naming:** Use snake_case, be descriptive and action-oriented, keep under 40 characters, avoid generic names
+- **Implementation order:** Enhanced Measurement -> recommended events -> custom events -> custom dimensions
+- **Data quality:** Separate test/production properties, set up internal traffic filters from day one, document all custom events, audit regularly with DebugView, export to BigQuery for backup

package/obj/template/.claude/skills/google-analytics/references/audiences.md

@@ -0,0 +1,389 @@
+# GA4 Audiences and Segmentation
+
+Expert guidance for creating and managing audiences for analysis, remarketing, and personalisation.
+
+## Overview
+
+Audiences in GA4 allow creation of user segments for analysis, remarketing, and personalisation based on dimensions, metrics, and events. Audiences can be exported to Google Ads for targeting and used in GA4 reports for analysis.
+
+## Accessing Audiences
+
+**Path:** Admin -> Audiences
+
+**Available Actions:**
+- View all audiences
+- Create new audiences
+- Edit existing audiences
+- View audience membership
+
+## Predefined Audiences
+
+GA4 includes template audiences:
+
+| Audience | Description |
+|----------|-------------|
+| All Users | All users in selected timeframe |
+| Purchasers | Users who completed purchase (30 days) |
+| New Users | First-time visitors |
+| Returning Users | Repeat visitors |
+| Recent Users | Active in last 7 days |
+
+### Activating Predefined Audiences
+
+1. Admin -> Audiences -> Create Audience
+2. Select suggested template
+3. Customise conditions if needed
+4. Save audience
+
+## Creating Custom Audiences
+
+### Basic Process
+
+1. Admin -> Audiences -> New Audience
+2. Choose method:
+   - Start from scratch
+   - Use suggested template
+   - Create predictive audience
+3. Configure audience:
+   - Name: Descriptive (e.g., "High-Value Shoppers")
+   - Description: Optional notes
+   - Membership duration: 1-540 days
+4. Add conditions
+5. Preview size
+6. Save
+
+### Condition Types
+
+#### Dimension Filters
+
+Filter by user or event attributes:
+
+```
+country == "United States"
+device_category == "mobile"
+platform == "web"
+```
+
+**Available Dimensions:**
+- User: city, country, device_category, platform
+- Event: event_name, page_location, item_id
+- Custom: Any registered custom dimensions
+
+#### Metric Filters
+
+Filter by quantitative measures:
+
+```
+totalRevenue > 100
+sessionCount >= 3
+engagementTime > 60
+```
+
+**Available Metrics:**
+- Event count
+- Session count
+- Revenue
+- Engagement time
+- Conversion count
+
+#### Event Conditions
+
+Include/exclude based on events:
+
+**Include users who:**
+- Have triggered specific event
+- Have NOT triggered event
+- Triggered event with specific parameters
+
+**Example:** Users who triggered `purchase` with `value > 50`
+
+#### Sequence Conditions
+
+Build audiences based on event order:
+
+**Example:** Users who:
+1. Viewed product (view_item)
+2. Added to cart (add_to_cart)
+3. Did NOT complete purchase (within 7 days)
+
+### Membership Duration
+
+| Duration | Use Case |
+|----------|----------|
+| 1-7 days | Short campaigns |
+| 30-90 days | Remarketing |
+| 540 days | Lifetime segments |
+
+**How it works:**
+- User enters when conditions met
+- Stays for duration period
+- Exits after duration (unless conditions still met)
+
+## Audience Examples
+
+### High-Value Customers
+
+```
+Conditions:
+- totalRevenue > 500 (lifetime)
+- purchaseCount >= 3
+
+Membership: 540 days
+```
+
+### Cart Abandoners
+
+```
+Sequence:
+1. add_to_cart (within last 7 days)
+2. Did NOT: purchase
+
+Membership: 7 days
+```
+
+### Engaged Mobile Users
+
+```
+Conditions:
+- deviceCategory == "mobile"
+- sessionCount >= 5 (last 30 days)
+- avgEngagementTime > 60 seconds
+
+Membership: 30 days
+```
+
+### Product Category Viewers
+
+```
+Event Condition:
+- view_item (last 30 days)
+- item_category == "Electronics"
+
+Membership: 30 days
+```
+
+### Geographic Segment
+
+```
+Conditions:
+- country == "United States"
+- region == "California"
+
+Membership: 90 days
+```
+
+### Newsletter Subscribers
+
+```
+Event Condition:
+- sign_up (any time)
+- method == "newsletter"
+
+Membership: 540 days
+```
+
+## Predictive Audiences
+
+GA4 can create audiences based on predicted user behaviour.
+
+### Available Predictions
+
+| Prediction | Description |
+|------------|-------------|
+| Purchase probability | Likelihood to purchase (7 days) |
+| Churn probability | Likelihood to not return (7 days) |
+| Revenue prediction | Expected 28-day revenue |
+
+### Requirements
+
+- 1,000+ users triggering target event (28 days)
+- Sufficient historical data
+- Model quality threshold met
+
+### Creating Predictive Audience
+
+1. Create New Audience
+2. Choose "Predictive"
+3. Select metric (purchase probability, etc.)
+4. Set threshold (e.g., > 50% purchase probability)
+5. Save
+
+### Use Cases
+
+- Target likely purchasers with ads
+- Re-engage likely-to-churn users
+- Focus on high-revenue potential users
+
+## Audience Triggers
+
+### What are Triggers
+
+Actions that fire when user enters audience.
+
+### Supported Actions
+
+- Send event to GA4
+- Create Google Ads remarketing list
+- Send to Google Ads for targeting
+
+### Setup
+
+1. Create audience
+2. In settings, add trigger
+3. Configure action (event name, Ads account)
+4. Save
+
+### Use Cases
+
+- Track when users become high-value
+- Send conversion events to Ads
+- Real-time remarketing lists
+
+## Exporting to Google Ads
+
+### Prerequisites
+
+- Google Ads account linked
+- Admin -> Product Links -> Google Ads Links
+- Minimum audience size met
+
+### Minimum Sizes
+
+| Region | Minimum Users |
+|--------|---------------|
+| Standard | 100 active |
+| EEA/UK | 1,000 active |
+
+### Setup
+
+1. Link Google Ads account
+2. In audience, enable "Ads Personalisation"
+3. Audience appears in Ads within 24-48 hours
+
+### Export Destinations
+
+- Google Ads (remarketing, targeting)
+- Display & Video 360
+- Search Ads 360
+
+## Analysing Audiences
+
+### Viewing Audience Data
+
+**Reports -> Realtime:**
+- Active users in audience
+
+**Reports -> User Acquisition:**
+- How audience members acquired
+
+**Explorations -> Segment Overlap:**
+- Compare audiences
+
+**Explorations -> User Lifetime:**
+- LTV of audience members
+
+### Audience Metrics
+
+| Metric | Description |
+|--------|-------------|
+| Total Users | Current members |
+| New Users (7/30 days) | Recent additions |
+| User Growth | Trend over time |
+
+## Using Audiences in Explorations
+
+### As Segments
+
+1. Open Exploration
+2. Click "+" in Segments
+3. Select audience
+4. Apply to analysis
+
+### Comparing Audiences
+
+1. Add multiple audiences as segments
+2. View side-by-side comparison
+3. Analyse differences
+
+## Limits and Quotas
+
+| Limit | Standard | 360 |
+|-------|----------|-----|
+| Audiences per property | 100 | 400 |
+| Conditions per audience | 10 | 10 |
+| Membership duration max | 540 days | 540 days |
+
+## Common Issues
+
+### Audience Size Too Small
+
+**Causes:**
+- Conditions too restrictive
+- Low traffic volume
+- Date range too narrow
+
+**Solutions:**
+1. Broaden conditions
+2. Increase membership duration
+3. Wait for more traffic
+
+### Audience Not in Google Ads
+
+**Causes:**
+- Below minimum size
+- Link not configured
+- Ads personalisation disabled
+
+**Solutions:**
+1. Check audience size
+2. Verify Google Ads link
+3. Enable Ads Personalisation
+
+### Stale Audience Data
+
+**Cause:** Audiences update with delay
+
+**Solution:** Wait 24-48 hours for updates
+
+## Best Practices
+
+### Naming Conventions
+
+Use clear, descriptive names:
+- "High-Value Customers - $500+"
+- "Cart Abandoners - Last 7 Days"
+- "Newsletter Subscribers"
+
+### Documentation
+
+Document each audience:
+- Purpose
+- Conditions used
+- Expected size
+- Use cases
+
+### Regular Review
+
+- Audit audiences quarterly
+- Remove unused audiences
+- Update conditions as needed
+
+## Quick Reference
+
+### Audience Limits
+
+- Maximum: 100 audiences (standard)
+- Membership: 1-540 days
+- Export minimum: 100 users (1,000 EEA/UK)
+
+### Export Destinations
+
+- Google Ads
+- Display & Video 360
+- Search Ads 360
+
+### Predictive Options
+
+- Purchase probability
+- Churn probability
+- Revenue prediction