@analitikisler/ai-tag-debugger 0.11.3 → 0.13.0

package/src/checks.js

@@ -4,6 +4,7 @@
 import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
 
+const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
 const GOOGLE_PLATFORMS = new Set(["ga4", "google_ads"]);
 
@@ -136,6 +137,7 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   // Platforms are compared in lower case ("GA4" in a plan is ga4). Planned events for
   // providers the user chose not to check are left out, and listed in one info line.
   plan = { ...plan, events: plan.events.map((e) => ({ ...e, platform: String(e.platform ?? "").toLowerCase() })) };
+  const hasPlan = plan.events.length > 0;
   if (run.providers) {
     const skipped = plan.events.filter((e) => !run.providers.includes(e.platform) && expectedIn(e, run.journeyId));
     plan = { ...plan, events: plan.events.filter((e) => run.providers.includes(e.platform)) };
@@ -279,7 +281,9 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
       const own = run.hits.filter((h) => h.platform === platform);
       return { platform, server: names(own.filter((h) => h.delivery === "server")), browser: names(own.filter((h) => h.delivery !== "server")) };
     }).filter((p) => p.server.length);
-    for (const p of byPlatform) findings.push({ ...base, severity: "info", check: "server_side", platform: p.platform, detail: d.serverSide(p.platform, p.server, p.browser) });
+    // Only name the platforms whose server-side copies this run would have checked.
+    const unseenServer = ["meta", "tiktok"].filter((p) => !run.providers || run.providers.includes(p)).map(platformName);
+    for (const p of byPlatform) findings.push({ ...base, severity: "info", check: "server_side", platform: p.platform, detail: d.serverSide(p.platform, p.server, p.browser, unseenServer) });
   }
   const serverVendors = [...new Set((run.network ?? []).map((c) => c.provider).filter((p) => p === "stape" || p === "elevar"))];
   if (serverVendors.length || serverHits.length) {
@@ -408,9 +412,9 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     findings.push({ ...base, severity: "warning", check: "pii_datalayer", step: stepLabel(plainPush.step), detail: d.piiDataLayer(plainPush.userData.plain) });
   }
 
-  // Events that are not in the plan.
+  // Events that are not in the plan. Without a plan every event would be listed, which says nothing.
   const unplanned = [...new Set(run.hits.filter((h) => !planEventFor(h)).map((h) => key(h.platform, h.name)))];
-  if (unplanned.length) {
+  if (hasPlan && unplanned.length) {
     findings.push({ ...base, severity: "info", check: "unplanned_events", detail: d.unplanned(unplanned) });
   }
 

package/src/i18n.js

@@ -53,6 +53,12 @@ const en = {
     whereStep: (journey, viewport, step) => `${journey} (${viewport})${step ? `, step "${step}"` : ""}`,
     allGood: "All planned events fired correctly on every journey tested.",
     tabEvents: "Events",
+    tabTimeline: "Timeline",
+    timelineGtmEvent: "GTM event",
+    timelineConsent: "Consent command",
+    timelineNoEvent: "No GTM event (data only)",
+    timelineNoHits: "No platform hit followed this push.",
+    timelineOther: "Hits without a dataLayer push",
     bodyDropped: "Request body not stored: this audit reached its 2 MB limit for stored request bodies.",
     tabNetwork: "Network requests",
     filterBy: "Filter by source",
@@ -75,6 +81,9 @@ const en = {
     impact: "Impact",
     evidence: "Evidence",
     fixSteps: "Fix",
+    verify: "How to verify",
+    owners: { developer: "Developer", gtm: "Tag Manager", marketing: "Marketing" },
+    ownerHint: { developer: "Site code and dataLayer", gtm: "Tags, triggers and consent setup", marketing: "The measurement plan" },
     places: (n) => `${n} ${n === 1 ? "place" : "places"}`,
     alsoCheck: "Not in the findings list, but worth checking",
     providersChecked: "Providers checked:",
@@ -92,6 +101,7 @@ const en = {
     changesLine: (ch) => ch.fixed.length || ch.new.length ? [ch.fixed.length ? `${ch.fixed.length} ${ch.mode === "plan" ? (ch.fixed.length === 1 ? "event" : "events") : (ch.fixed.length === 1 ? "problem" : "problems")} fixed` : "", ch.new.length ? `${ch.new.length} new ${ch.new.length === 1 ? "problem" : "problems"}` : ""].filter(Boolean).join(", ") : "No changes since the last run",
     changeFixed: "Fixed",
     changeNew: "New",
+    routeChanged: (list) => `The AI took a different route through the site than in the last run: ${list}`,
     noPreviousRun: "This is the first saved run for this site, so there is nothing to compare yet.",
     planVsSiteLead: "Each planned event, and what the site actually sent",
     coverageLine: (c) => `Coverage ${c.implemented} of ${c.checkable}${c.percent === null ? "" : ` (${c.percent}%)`}${c.not_checked ? `, ${c.not_checked} ${c.not_checked === 1 ? "event" : "events"} not checked` : ""}`,
@@ -104,6 +114,23 @@ const en = {
     stepsCol: "Steps",
     problemsCol: "Problems",
     scopeCard: "Scope",
+    site: "Site",
+    runCard: "This run",
+    runPlatforms: "Platforms",
+    runAi: "AI",
+    runAiOn: (name, model) => `On · ${name}${model ? ` · ${model}` : ""}`,
+    runAiOff: "Off",
+    runPlan: "Plan",
+    runPlanEvents: (n) => `${n} ${n === 1 ? "event" : "events"}`,
+    runNoPlan: "None",
+    runJourneys: "Journeys",
+    runViewports: "Viewports",
+    runLanguage: "Language",
+    runVersion: "Version",
+    consentDefault: "Default",
+    consentUpdate: "Update",
+    consentLead: "Consent Mode commands the site sent, in order.",
+    consentNone: "The site sent no Consent Mode commands on this journey.",
     skippedLine: (list, n) => `${n} out-of-scope ${n === 1 ? "request was" : "requests were"} skipped: ${list}.`,
     findingHint: "Open a finding to see its likely cause, evidence and fix steps.",
     spread: (j, s) => `${j} ${j === 1 ? "journey" : "journeys"}${s ? ` · ${s} ${s === 1 ? "step" : "steps"}` : ""}`,
@@ -138,7 +165,7 @@ const en = {
     purchaseCurrency: (platform, name, c) => `${platform} ${q(name)} was sent with currency ${q(c)}, which is not a 3-letter ISO 4217 code in capitals (such as USD, EUR or TRY). Platforms may drop the revenue or convert it wrongly.`,
     purchaseItemsEmpty: (platform, name) => `${platform} ${q(name)} was sent with no items, so product and item reports get nothing for this order.`,
     purchaseMismatch: (id, diffs) => `GA4 and Meta reported ${id ? `order ${q(id)}` : "the purchase"} differently: ${diffs.map(([f, g, m]) => `${f} ${q(g)} in GA4 and ${q(m)} in Meta`).join("; ")}. One of the tags reads the wrong data.`,
-    serverSide: (platform, server, browser) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}. Server-side copies of Meta and TikTok events never pass through the browser, so they can't be seen here.`,
+    serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}.${unseen.length ? ` Server-side copies of ${unseen.join(" and ")} events never pass through the browser, so they can't be seen here.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} was sent from the browser without an event ID, while a server-side setup was seen on this site. If the server also sends this event, ${platform} can't match the two and counts it twice.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
@@ -212,6 +239,12 @@ const tr = {
     whereStep: (journey, viewport, step) => `${journey} (${viewport})${step ? `, "${step}" adımı` : ""}`,
     allGood: "Test edilen tüm yolculuklarda plandaki tüm olaylar doğru çalıştı.",
     tabEvents: "Olaylar",
+    tabTimeline: "Zaman çizelgesi",
+    timelineGtmEvent: "GTM olayı",
+    timelineConsent: "İzin komutu",
+    timelineNoEvent: "GTM olayı yok (yalnızca veri)",
+    timelineNoHits: "Bu gönderimin ardından platform isteği gelmedi.",
+    timelineOther: "dataLayer gönderimi olmayan istekler",
     bodyDropped: "İstek gövdesi saklanmadı: bu denetim, saklanan istek gövdeleri için 2 MB sınırına ulaştı.",
     tabNetwork: "Ağ istekleri",
     filterBy: "Kaynağa göre filtrele",
@@ -234,6 +267,9 @@ const tr = {
     impact: "Etkisi",
     evidence: "Kanıt",
     fixSteps: "Çözüm",
+    verify: "Nasıl doğrulanır",
+    owners: { developer: "Yazılımcı", gtm: "Tag Manager", marketing: "Pazarlama" },
+    ownerHint: { developer: "Site kodu ve dataLayer", gtm: "Etiketler, tetikleyiciler ve onay ayarları", marketing: "Ölçüm planı" },
     places: (n) => `${n} yer`,
     alsoCheck: "Bulgu listesinde olmayan, ama kontrol edilmesi gerekenler",
     providersChecked: "Kontrol edilen sağlayıcılar:",
@@ -251,6 +287,7 @@ const tr = {
     changesLine: (ch) => ch.fixed.length || ch.new.length ? [ch.fixed.length ? `${ch.fixed.length} ${ch.mode === "plan" ? "olay" : "sorun"} düzeldi` : "", ch.new.length ? `${ch.new.length} yeni sorun` : ""].filter(Boolean).join(", ") : "Son çalıştırmadan bu yana değişiklik yok",
     changeFixed: "Düzeldi",
     changeNew: "Yeni",
+    routeChanged: (list) => `Yapay zeka siteyi son çalıştırmadan farklı bir yoldan gezdi: ${list}`,
     noPreviousRun: "Bu site için kayıtlı ilk çalıştırma bu, karşılaştırılacak bir şey henüz yok.",
     planVsSiteLead: "Plandaki her olay ve sitenin gerçekte gönderdiği",
     coverageLine: (c) => `Kapsam ${c.checkable} olaydan ${c.implemented}${c.percent === null ? "" : ` (%${c.percent})`}${c.not_checked ? `, ${c.not_checked} olay kontrol edilmedi` : ""}`,
@@ -263,6 +300,23 @@ const tr = {
     stepsCol: "Adım",
     problemsCol: "Sorun",
     scopeCard: "Kapsam",
+    site: "Site",
+    runCard: "Bu çalıştırma",
+    runPlatforms: "Platformlar",
+    runAi: "Yapay zekâ",
+    runAiOn: (name, model) => `Açık · ${name}${model ? ` · ${model}` : ""}`,
+    runAiOff: "Kapalı",
+    runPlan: "Plan",
+    runPlanEvents: (n) => `${n} olay`,
+    runNoPlan: "Yok",
+    runJourneys: "Yolculuklar",
+    runViewports: "Ekranlar",
+    runLanguage: "Dil",
+    runVersion: "Sürüm",
+    consentDefault: "Varsayılan",
+    consentUpdate: "Güncelleme",
+    consentLead: "Sitenin gönderdiği Consent Mode komutları, sırasıyla.",
+    consentNone: "Site bu yolculukta Consent Mode komutu göndermedi.",
     skippedLine: (list, n) => `Kapsam dışı ${n} istek atlandı: ${list}.`,
     findingHint: "Bir bulguyu açınca olası neden, kanıt ve çözüm adımları görünür.",
     spread: (j, s) => `${j} yolculuk${s ? ` · ${s} adım` : ""}`,
@@ -297,7 +351,7 @@ const tr = {
     purchaseCurrency: (platform, name, c) => `${platform} ${q(name)} ${q(c)} para birimiyle gönderildi; bu, büyük harfli 3 harfli bir ISO 4217 kodu değil (USD, EUR veya TRY gibi). Platformlar geliri atabilir veya yanlış çevirebilir.`,
     purchaseItemsEmpty: (platform, name) => `${platform} ${q(name)} ürün listesi boş gönderildi, bu yüzden ürün raporları bu siparişten veri alamaz.`,
     purchaseMismatch: (id, diffs) => `GA4 ve Meta ${id ? `${q(id)} siparişini` : "satın almayı"} farklı bildirdi: ${diffs.map(([f, g, m]) => `${f === "value" ? "değer" : "para birimi"} GA4'te ${q(g)}, Meta'da ${q(m)}`).join("; ")}. Etiketlerden biri yanlış veriyi okuyor.`,
-    serverSide: (platform, server, browser) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}. Meta ve TikTok olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.`,
+    serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}.${unseen.length ? ` ${unseen.join(" ve ")} olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} tarayıcıdan olay kimliği olmadan gönderildi; sitede sunucu tarafı bir kurulum görüldü. Sunucu da bu olayı gönderiyorsa ${platform} ikisini eşleştiremez ve iki kez sayar.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",

package/src/mcp.js

@@ -37,7 +37,7 @@ const INSTRUCTIONS = `ai-tag-debugger checks a website's analytics and ad tracki
 
 Two kinds of request: a PLAN is what should be tracked, an AUDIT is what the site actually sends. If the user wants to know what to track, which events a site needs, or asks for a tracking or measurement plan, call make_plan (with topic when they only care about one kind of event: ${Object.keys(TOPICS).join(", ")}). If they want to know whether tracking works, what a site sends, or what changed, run an audit. To audit against the plan afterwards, pass against to finish_audit.
 
-Before starting, ask the user which platforms to check and suggest the default (${DEFAULT_PROVIDERS.map((k) => TRACKING_PROVIDERS[k]).join(", ")}); pass their choice as providers.
+Before starting, ask the user which platforms to check and suggest the default (${DEFAULT_PROVIDERS.map((k) => TRACKING_PROVIDERS[k]).join(", ")}, plus any other platform the site turns out to use); pass their choice as providers, or leave it out for the default.
 
 To audit a journey yourself: call start_audit with the site URL and a journey (a ready-made one: ${Object.keys(JOURNEY_PRESETS).join(", ")}, or the user's own description), then browser_action one step at a time until the journey is done (each result shows the page and the tracking hits that step sent), then finish_audit (with against to check the run against a saved plan) to get the findings and the report. Explain the findings to the user in plain language.
 
@@ -153,7 +153,7 @@ export function buildServer(opts) {
         providers: z
           .array(z.enum(Object.keys(TRACKING_PROVIDERS)))
           .optional()
-          .describe(`Tracking providers to check. Default ${DEFAULT_PROVIDERS.join(", ")}. Requests to the others are still answered locally, but they are only counted, not shown or checked.`),
+          .describe(`Tracking providers to check. Default ${DEFAULT_PROVIDERS.join(", ")} plus any other known platform the site sends to. When given, requests to the others are still answered locally, but they are only counted, not shown or checked.`),
       },
     },
     async ({ site, journey, viewport, allowed_hosts, providers }) => {
@@ -367,7 +367,7 @@ export function buildServer(opts) {
           providers: z
             .array(z.enum(Object.keys(TRACKING_PROVIDERS)))
             .optional()
-            .describe(`Tracking providers to check. Default ${DEFAULT_PROVIDERS.join(", ")}. Requests to the others are still answered locally, but they are only counted, not shown or checked.`),
+            .describe(`Tracking providers to check. Default ${DEFAULT_PROVIDERS.join(", ")} plus any other known platform the site sends to. When given, requests to the others are still answered locally, but they are only counted, not shown or checked.`),
         },
       },
       async ({ config: configFile, against, scripted, language, branding, providers }) => {

package/src/parsers.js

@@ -196,16 +196,162 @@ export function parseKlaviyo(url, postData) {
   }];
 }
 
-/** Hotjar: calls to its in.hotjar.com / .hotjar.io API carry the site id in the path. Only the id is read. @returns {Hit[] | null} */
+/**
+ * LinkedIn Insight Tag: px.ads.linkedin.com/collect with the partner id (pid), and conversionId
+ * for a conversion; without one the hit is the page view. eventId pairs it with a Conversions API copy.
+ * @returns {Hit[] | null}
+ */
+export function parseLinkedIn(url) {
+  const u = new URL(url);
+  const q = u.searchParams;
+  if (u.hostname !== "px.ads.linkedin.com" || !/^\/(collect|wa)\/?$/.test(u.pathname) || !q.has("pid")) return null;
+  const params = {};
+  for (const [from, to] of [["value", "value"], ["currency", "currency"], ["url", "page_location"]]) if (q.has(from)) params[to] = q.get(from);
+  const eventId = q.get("eventId") || undefined;
+  if (eventId) params.event_id = eventId;
+  const conversion = q.get("conversionId");
+  return [{ platform: "linkedin", name: conversion ? `conversion:${conversion}` : "pageview", id: q.get("pid"), ...(eventId ? { eventId } : {}), params, url }];
+}
+
+/**
+ * Microsoft Advertising UET: bat.bing.com/action/0 with the tag id (ti) and evt: "pageLoad" for page
+ * views, "custom" for events, named by their action (ea). gv and gc are the revenue and currency.
+ * @returns {Hit[] | null}
+ */
+export function parseBing(url) {
+  const u = new URL(url);
+  const q = u.searchParams;
+  if (u.hostname !== "bat.bing.com" || !/^\/action\/\d+$/.test(u.pathname) || !q.has("ti")) return null;
+  const params = {};
+  for (const [from, to] of [["ec", "event_category"], ["el", "event_label"], ["ev", "event_value"], ["gv", "value"], ["gc", "currency"], ["p", "page_location"]]) {
+    if (q.has(from)) params[to] = q.get(from);
+  }
+  const evt = q.get("evt") || "";
+  const name = evt === "custom" ? q.get("ea") || "custom" : evt || "(unnamed)";
+  return [{ platform: "microsoft_ads", name, id: q.get("ti"), params, url }];
+}
+
+// Criteo OneTag event codes. Setup entries (site type, email, …) ride along in the same request.
+const CRITEO_EVENTS = { vh: "viewHome", vl: "viewList", vp: "viewItem", vb: "viewBasket", vc: "trackTransaction", vs: "viewSearch" };
+
+/**
+ * Criteo OneTag: sslwidget.criteo.com/event with the account (a) and one entry per pushed event
+ * in p0, p1, … (each itself a query string with e = the event code). Hashed emails are user data.
+ * @returns {Hit[] | null}
+ */
+export function parseCriteo(url, postData) {
+  const u = new URL(url);
+  if (!/(^|\.)criteo\.(com|net)$/.test(u.hostname) || !/^\/(event|m\/event)\/?$/.test(u.pathname)) return null;
+  const q = new URLSearchParams(u.search);
+  if (postData && !postData.trim().startsWith("{")) for (const [k, v] of new URLSearchParams(postData)) q.set(k, v);
+  const entries = [...q].filter(([k]) => /^p\d+$/.test(k)).map(([, v]) => new URLSearchParams(v));
+  if (!q.has("a") || !entries.length) return null;
+  const params = {};
+  const user = {};
+  let name = "";
+  for (const e of entries) {
+    const code = e.get("e");
+    if (CRITEO_EVENTS[code] && !name) name = CRITEO_EVENTS[code];
+    for (const [k, v] of e) {
+      if (k === "e") continue;
+      if (/^m(\[\d*\])?$/.test(k) || isUserDataKey(k)) user[`${code}.${k}`] = v;
+      else if (k === "p") params.content_ids = v;
+      else if (k === "id" && code === "vc") params.transaction_id = v;
+      else if (k === "site_type") params.site_type = v;
+      else if (k === "c") params.currency = v;
+      else if (k === "item" || k === "i") params.items = v;
+    }
+  }
+  return [{ platform: "criteo", name: name || "(unnamed)", id: q.get("a"), params, ...(Object.keys(user).length ? { userFields: user } : {}), url }];
+}
+
+/**
+ * Adobe Analytics image request: /b/ss/<report suite>/<version>/<code>/s<random> on omtrdc.net,
+ * 2o7.net or a first-party host. A link (pe: lnk_o, lnk_d, lnk_e) is named by its link name (pev2),
+ * anything else is the page view. events, products, purchase id, currency and the page are kept.
+ * @returns {Hit[] | null}
+ */
+export function parseAdobe(url) {
+  const u = new URL(url);
+  const m = u.pathname.match(/^\/b\/ss\/([^/]+)\/[^/]+\//);
+  if (!m) return null;
+  const q = u.searchParams;
+  const params = {};
+  for (const [from, to] of [["pageName", "page_title"], ["events", "events"], ["products", "items"], ["purchaseID", "transaction_id"], ["xact", "transaction_id"], ["cc", "currency"], ["g", "page_location"]]) {
+    if (q.has(from)) params[to] = q.get(from);
+  }
+  const pe = q.get("pe");
+  return [{ platform: "adobe", name: pe ? `link:${q.get("pev2") || pe}` : "pageView", id: decodeURIComponent(m[1]), params, url }];
+}
+
+// Matomo and Piwik PRO share one tracking protocol: an idsite and either an event (e_c, e_a, e_n),
+// a goal (idgoal) or an ecommerce order (idgoal=0 with ec_id), otherwise a page view.
+function matomoHit(platform, q, url) {
+  const params = {};
+  for (const [from, to] of [["revenue", "value"], ["ec_id", "transaction_id"], ["ec_items", "items"], ["ec_tx", "tax"], ["ec_sh", "shipping"], ["e_v", "event_value"], ["action_name", "page_title"], ["url", "page_location"], ["search", "search_term"]]) {
+    if (q.has(from)) params[to] = q.get(from);
+  }
+  const goal = q.get("idgoal");
+  let name = "pageview";
+  if (q.has("e_c")) name = q.get("e_a") ? `${q.get("e_c")}:${q.get("e_a")}` : q.get("e_c");
+  else if (goal === "0") name = q.has("ec_id") ? "ecommerce_order" : "ecommerce_cart_update";
+  else if (goal) name = `goal:${goal}`;
+  else if (q.has("search")) name = "site_search";
+  else if (q.has("link")) name = "outlink";
+  else if (q.has("download")) name = "download";
+  const user = [...q].filter(([k, v]) => isUserDataKey(k) && v);
+  return { platform, name, id: q.get("idsite") || undefined, params, ...(user.length ? { userFields: Object.fromEntries(user) } : {}), url };
+}
+
+// Matomo's tracker can batch hits: a JSON POST of { requests: ["?idsite=1&…", …] }.
+function matomoHits(platform, u, postData) {
+  const requests = jsonOr(postData ?? "{}", {})?.requests;
+  const batched = Array.isArray(requests) ? requests.filter((r) => typeof r === "string").map((r) => new URLSearchParams(r.replace(/^\?/, ""))) : [];
+  const queries = batched.length ? batched.map((b) => { for (const [k, v] of u.searchParams) if (!b.has(k)) b.set(k, v); return b; }) : [u.searchParams];
+  return queries.filter((q) => q.has("idsite")).map((q) => matomoHit(platform, q, u.href));
+}
+
+/** Matomo (self-hosted or cloud): /matomo.php or /piwik.php with idsite, on any host. @returns {Hit[] | null} */
+export function parseMatomo(url, postData) {
+  const u = new URL(url);
+  if (!/(^|\/)(matomo|piwik)\.php$/.test(u.pathname)) return null;
+  const hits = matomoHits("matomo", u, postData);
+  return hits.length ? hits : null;
+}
+
+/** Piwik PRO: /ppms.php with idsite (a UUID), on its cloud or a first-party host. @returns {Hit[] | null} */
+export function parsePiwikPro(url, postData) {
+  const u = new URL(url);
+  if (!/(^|\/)ppms\.php$/.test(u.pathname)) return null;
+  const hits = matomoHits("piwik_pro", u, postData);
+  return hits.length ? hits : null;
+}
+
+/**
+ * Microsoft Clarity: the tag load (www.clarity.ms/tag/<project>) names the project; the data
+ * itself goes to <letter>.clarity.ms/collect as a compressed payload, so only the call is shown.
+ * @returns {Hit[] | null}
+ */
+export function parseClarity(url) {
+  const u = new URL(url);
+  if (!/(^|\.)clarity\.ms$/.test(u.hostname)) return null;
+  const tag = u.pathname.match(/^\/tag\/([a-z0-9]+)\/?$/i);
+  if (tag) return [{ platform: "clarity", name: "script_load", id: tag[1], params: {}, url }];
+  if (/^\/collect\/?$/.test(u.pathname)) return [{ platform: "clarity", name: "collect", params: {}, url }];
+  return null;
+}
+
+/** Hotjar: the tag load (static.hotjar.com/c/hotjar-<id>.js) and calls to its API carry the site id in the path. Only the id is read. @returns {Hit[] | null} */
 export function parseHotjar(url) {
   const u = new URL(url);
   if (!/(^|\.)hotjar\.(com|io)$/.test(u.hostname)) return null;
+  const script = u.pathname.match(/^\/c\/hotjar-(\d+)\.js$/);
+  if (script) return [{ platform: "hotjar", name: "script_load", id: script[1], params: {}, url }];
   const m = u.pathname.match(/^\/api\/v\d+\/client\/sites\/(\d+)\/([a-z-]+)/i);
   if (!m) return null;
   return [{ platform: "hotjar", name: m[2], id: m[1], params: {}, url }];
 }
 
-const PARSERS = [parseGa4, parseMeta, parseGoogleAds, parseTikTok, parseX, parsePinterest, parseSnapchat, parseKlaviyo, parseHotjar];
 
 /** Returns normalized hits for a request, or null when it is not a tracking request. */
 export function parseTrackingRequest(url, postData) {
@@ -231,7 +377,7 @@ const OTHER_BEACONS = [
   [/./, /\/(ccm|ccm\/s|g\/s)\/collect$/],
   [/^td\.doubleclick\.net$/, /^\/td\//],
   [/(^|\.)facebook\.com$/, /^\/privacy_sandbox\/pixel\//],
-  [/^bat\.bing\.com$/, /^\/action\//],
+  [/^bat\.bing\.com$/, /^\/action\//], // UET requests without a tag id
   [/^px\.ads\.linkedin\.com$/, /^\/(collect|wa)/],
   [/^ct\.pinterest\.com$/, /^\/(v3|user)/],
   [/^tr\.snapchat\.com$/, /^\//],
@@ -249,24 +395,39 @@ export function isCollectionEndpoint(url) {
   return OTHER_BEACONS.some(([host, pathname]) => host.test(u.hostname) && pathname.test(u.pathname));
 }
 
-// Providers the user can choose to check. Requests to the ones not chosen are still
+/**
+ * Every tracking vendor: its key, display name, the hosts its requests go to (path: how its
+ * tracker is told apart on a first-party host) and, when its events are read, a parser. Adding a vendor is one entry here plus its icon in report.js.
+ */
+export const VENDORS = [
+  { key: "ga4", label: "GA4", hosts: /(^|\.)(google-analytics|analytics\.google)\.com$/, parse: parseGa4 },
+  { key: "google_ads", label: "Google Ads", hosts: /(^|\.)googleadservices\.com$/, parse: parseGoogleAds },
+  { key: "meta", label: "Meta", hosts: /(^|\.)(facebook\.com|facebook\.net)$/, parse: parseMeta },
+  { key: "tiktok", label: "TikTok", hosts: /(^|\.)tiktok\.com$/, parse: parseTikTok },
+  { key: "x", label: "X", hosts: /(^|\.)(x\.com|twitter\.com|t\.co|ads-twitter\.com)$/, parse: parseX },
+  { key: "linkedin", label: "LinkedIn", hosts: /(^|\.)(licdn\.com|ads\.linkedin\.com)$/, parse: parseLinkedIn },
+  { key: "microsoft_ads", label: "Microsoft Ads", hosts: /(^|\.)bing\.com$/, parse: parseBing },
+  { key: "pinterest", label: "Pinterest", hosts: /(^|\.)(pinterest\.com|pinimg\.com)$/, parse: parsePinterest },
+  { key: "snapchat", label: "Snapchat", hosts: /(^|\.)(snapchat\.com|sc-static\.net)$/, parse: parseSnapchat },
+  { key: "criteo", label: "Criteo", hosts: /(^|\.)(criteo\.com|criteo\.net)$/, parse: parseCriteo },
+  { key: "klaviyo", label: "Klaviyo", hosts: /(^|\.)klaviyo\.com$/, parse: parseKlaviyo },
+  { key: "adobe", label: "Adobe Analytics", hosts: /(^|\.)(omtrdc|2o7)\.net$/, path: /^\/b\/ss\//, parse: parseAdobe },
+  { key: "matomo", label: "Matomo", hosts: /(^|\.)(matomo\.cloud|innocraft\.cloud)$/, path: /(^|\/)(matomo|piwik)\.php$/, parse: parseMatomo },
+  // No host: piwik.pro also serves consent management, so its tracker is recognized by path.
+  { key: "piwik_pro", label: "Piwik PRO", path: /(^|\/)ppms\.php$/, parse: parsePiwikPro },
+  { key: "clarity", label: "Microsoft Clarity", hosts: /(^|\.)clarity\.ms$/, parse: parseClarity },
+  { key: "hotjar", label: "Hotjar", hosts: /(^|\.)hotjar\.(com|io)$/, parse: parseHotjar },
+  { key: "doubleclick", label: "DoubleClick" },
+  { key: "adsense", label: "Google AdSense", hosts: /(^|\.)googlesyndication\.com$/ },
+];
+
+const PARSERS = VENDORS.filter((v) => v.parse).map((v) => v.parse);
+
+// Providers the user can choose to check. Requests to the ones not checked are still
 // answered locally, but they are left out of the timeline and only counted.
-export const PROVIDERS = {
-  ga4: "GA4",
-  google_ads: "Google Ads",
-  meta: "Meta",
-  tiktok: "TikTok",
-  x: "X",
-  linkedin: "LinkedIn",
-  microsoft_ads: "Microsoft Ads",
-  pinterest: "Pinterest",
-  snapchat: "Snapchat",
-  klaviyo: "Klaviyo",
-  clarity: "Microsoft Clarity",
-  hotjar: "Hotjar",
-  doubleclick: "DoubleClick",
-  adsense: "Google AdSense",
-};
+export const PROVIDERS = Object.fromEntries(VENDORS.map((v) => [v.key, v.label]));
+// Always checked. Any other vendor the site sends to is added on its first request,
+// unless the platforms to check were chosen.
 export const DEFAULT_PROVIDERS = ["ga4", "google_ads", "meta", "tiktok"];
 // Tag managers and consent platforms are always shown: they explain how the tags loaded.
 // Server-side tagging providers are too: their requests show where events are sent from.
@@ -275,19 +436,7 @@ const ALWAYS_SHOWN = { gtm: "Google Tag Manager", consent: "Consent platform", s
 const HOSTS = [
   [/(^|\.)stape\.(io|jp)$/, "stape"],
   [/(^|\.)getelevar\.com$/, "elevar"],
-  [/(^|\.)(google-analytics|analytics\.google)\.com$/, "ga4"],
-  [/(^|\.)googleadservices\.com$/, "google_ads"],
-  [/(^|\.)googlesyndication\.com$/, "adsense"],
-  [/(^|\.)(facebook\.com|facebook\.net)$/, "meta"],
-  [/(^|\.)tiktok\.com$/, "tiktok"],
-  [/(^|\.)(x\.com|twitter\.com|t\.co|ads-twitter\.com)$/, "x"],
-  [/(^|\.)(licdn\.com|ads\.linkedin\.com)$/, "linkedin"],
-  [/(^|\.)bing\.com$/, "microsoft_ads"],
-  [/(^|\.)clarity\.ms$/, "clarity"],
-  [/(^|\.)hotjar\.(com|io)$/, "hotjar"],
-  [/(^|\.)(pinterest\.com|pinimg\.com)$/, "pinterest"],
-  [/(^|\.)(snapchat\.com|sc-static\.net)$/, "snapchat"],
-  [/(^|\.)klaviyo\.com$/, "klaviyo"],
+  ...VENDORS.filter((v) => v.hosts).map((v) => [v.hosts, v.key]),
   [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com)$/, "consent"],
 ];
 
@@ -310,6 +459,8 @@ export function providerOf(url) {
   if (/(^|\.)doubleclick\.net$/.test(host)) return of("doubleclick");
   // Before the vendor hosts: a GA4 hit to a Stape or Elevar endpoint is still a GA4 hit.
   if (isGa4Path(u) && !GOOGLE_COMPANION_HOST.test(host)) return of("ga4");
+  // Before the hosts too: trackers on a first-party or consent vendor host are told apart by path.
+  for (const v of VENDORS) if (v.path?.test(u.pathname)) return of(v.key);
   for (const [pattern, key] of HOSTS) if (pattern.test(host)) return of(key);
   if (isGa4Path(u)) return of("ga4");
   if (u.pathname.startsWith("/pagead/") || /\/as\/p\/c\/\d+\/?$/.test(u.pathname)) return of("google_ads");

package/src/redact.js

@@ -88,12 +88,29 @@ function note(found, key, value) {
 }
 
 /** Redacts form-encoded parameters (a URL query or a GA4 body line). Returns null when nothing needed it. */
+// Criteo OneTag nests each event as a query string in p0, p1, …; its setEmail entry (e=ce) carries the email hash in m.
+const isNestedEvent = (k, v) => /^p\d+$/.test(k) && /^e=/.test(v);
+const nestedUserKey = (k) => /^m(\[\d*\])?$/.test(k) || isUserDataKey(k);
+
 function redactParamString(text, found, site) {
   const params = new URLSearchParams(text);
-  if (![...params].some(([k, v]) => isUserDataKey(k) || isEmail(v, site, k))) return null;
+  let changed = false;
   const out = new URLSearchParams();
-  for (const [k, v] of params) out.append(k, isUserDataKey(k) || isEmail(v, site, k) ? note(found, k, v) : v);
-  return out.toString();
+  for (const [k, v] of params) {
+    if (isNestedEvent(k, v)) {
+      const inner = new URLSearchParams();
+      for (const [ik, iv] of new URLSearchParams(v)) {
+        const hide = nestedUserKey(ik) || isEmail(iv, site, ik);
+        if (hide) changed = true;
+        inner.append(ik, hide ? note(found, ik, iv) : iv);
+      }
+      out.append(k, inner.toString());
+    } else if (isUserDataKey(k) || isEmail(v, site, k)) {
+      changed = true;
+      out.append(k, note(found, k, v));
+    } else out.append(k, v);
+  }
+  return changed ? out.toString() : null;
 }
 
 /** Redacts user data in a URL's query. Returns the URL unchanged when there is none. site: see isOwnAddress. */