Add Google Analytics

Provision one production GA4 property and web stream per project, then add standard page views and Enhanced Measurement. Use a shared keyless service account; never create or download service-account keys.

Non-negotiable safety rules

• Start with a dry-run plan. Ask for one explicit confirmation before any mutation.
• Plan and verify may run on a dirty tree. Apply requires a clean Git worktree.
• Do not stash, discard, commit, push, or deploy application code.
• Do not delete Analytics resources or collected data.
• Do not install alongside existing analytics. Stop and present findings.
• Do not guess when both Next.js routers, multiple package managers, multiple GA resources, or multiple production URLs are plausible.
• If a strict Content Security Policy affects the integration target or global responses, stop and propose a nonce/hash-aware project-specific change. A CSP isolated to documents outside the instrumentation target requires an explicit boundary review, not a project-wide stop. Never add unsafe-inline or broad origins.
• Never claim that project size creates a privacy-law exemption. This workflow intentionally loads analytics without a consent gate; state that fact in the plan.
• Keep credentials and tokens out of repositories, output, shell arguments, and logs. Measurement IDs and GA resource IDs are public metadata, not secrets.

Supported targets