@analitikisler/ai-tag-debugger 0.13.0 → 0.15.0

package/src/changes.js

@@ -1,6 +1,8 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { listRunIds, runsDir } from "./workspace.js";
+import { messages } from "./i18n.js";
+import { platformLabel } from "./report.js";
+import { PLAN_FILE, listPlanIds, listRunIds, plansDir, runsDir } from "./workspace.js";
 
 const PROBLEMS = new Set(["broken", "risk", "warning"]);
 const PLAN_PROBLEMS = new Set(["missing", "missing_params", "wrong_values"]);
@@ -36,16 +38,36 @@ function planProblems(pc) {
 }
 
 /** The pages one run visited, in order, one entry per journey and viewport. Null when it recorded none (older runs). */
-function routes(runs = []) {
+function routes(runs = [], completedOnly = false) {
   const out = new Map();
   for (const r of runs) {
+    if (completedOnly && (!r.completed || !r.goal)) continue;
     const pages = [];
     for (const s of r.steps ?? []) if (s.pagePath && pages.at(-1) !== s.pagePath) pages.push(s.pagePath);
-    if (pages.length) out.set(`${r.journeyId}|${r.viewport}`, { journeyId: r.journeyId, viewport: r.viewport, pages });
+    if (pages.length) out.set(`${r.journeyId}|${r.viewport}`, { journeyId: r.journeyId, viewport: r.viewport, goal: r.goal, pages });
   }
   return out;
 }
 
+const HINT_SCAN = 10;
+
+/**
+ * The pages each journey visited the last time it completed on this site, so a repeat run can start from a
+ * known route: Map of "journeyId|viewport" to { goal, pages }. A run only counts for the same goal, since
+ * "custom" and the like are reused for different goals, and only if it recorded its goal (older runs didn't).
+ */
+export async function routeHints(dataDir, site) {
+  const hints = new Map();
+  let before = null;
+  for (let i = 0; i < HINT_SCAN; i++) {
+    const prev = await previousRun(dataDir, site, before);
+    if (!prev) break;
+    for (const [k, r] of routes(prev.capture?.runs, true)) if (!hints.has(k)) hints.set(k, { goal: r.goal, pages: r.pages });
+    before = prev.id;
+  }
+  return hints;
+}
+
 /** Journeys whose route through the site differs from the previous run: [{ journeyId, viewport, before, after }]. */
 export function compareRoutes(prevRuns, runs) {
   const before = routes(prevRuns);
@@ -92,3 +114,69 @@ function compareFindings(prev, { findings, planCheck }) {
     new: [...now].filter(([k]) => !before.has(k)).map(([, f]) => f),
   };
 }
+
+/**
+ * The "since last run" diff for a site's newest saved run, as the report showed it: that run compared
+ * with the one before. Returns { run: null } when nothing is saved, else { run, ...compareRuns() }.
+ * Shared by anything that reports the diff outside the report (MCP, alerts).
+ */
+export async function sinceLastRun(dataDir, site) {
+  const latest = await previousRun(dataDir, site);
+  if (!latest) return { run: null, previous: null };
+  const saved = latest.capture.changes;
+  if (saved) return { run: latest.id, ...saved };
+  const prev = await previousRun(dataDir, site, latest.id);
+  return { run: latest.id, ...compareRuns(prev, { findings: latest.capture.findings ?? [], planCheck: latest.planCheck, runs: latest.capture.runs }) };
+}
+
+/** The diff as plain lines: a headline, then one line per fixed and new problem. */
+export function changesLines(ch, lang = "en") {
+  const m = messages(lang);
+  if (!ch.run) return [m.ui.noSavedRun];
+  if (!ch.previous) return [m.ui.noPreviousRun];
+  const label = (c) => `${platformLabel(c.platform ?? "")} ${c.event ?? ""}`.trim() || c.check;
+  const why = (c, bucket) => (ch.mode === "findings" ? c.detail : m.ui.bucket[bucket]);
+  return [
+    `${m.ui.changesLine(ch)}. ${m.ui.changesLead(ch.previous, ch.mode)} (${ch.run}).`,
+    ...ch.fixed.map((c) => `- ${m.ui.changeFixed}: ${label(c)} (${why(c, c.was)})`),
+    ...ch.new.map((c) => `- ${m.ui.changeNew}: ${label(c)} (${why(c, c.bucket)})`),
+    ...(ch.routes?.length ? [m.ui.routeChanged(ch.routes.map((r) => `${r.journeyId} (${r.viewport})`).join(", "))] : []),
+  ];
+}
+
+const planKey = (e) => [e.platform ?? "ga4", e.name].join("|");
+const sortedList = (v) => JSON.stringify([...(v ?? [])].sort());
+
+/** What differs for an event kept in both plans: its required parameters, parameter list or journeys. */
+function eventChanges(a, b) {
+  const out = [];
+  if (sortedList(a.required_params) !== sortedList(b.required_params)) out.push("required parameters");
+  if (sortedList(Object.keys(a.parameters ?? {})) !== sortedList(Object.keys(b.parameters ?? {}))) out.push("parameters");
+  if (sortedList(a.journeys) !== sortedList(b.journeys)) out.push("journeys");
+  return out;
+}
+
+/**
+ * How a plan differs from the version before it: events added, removed and changed.
+ * Returns null when there is no earlier version, else { previous, added, removed, changed, same }.
+ */
+export function comparePlans(prevPlan, plan, previousId = null) {
+  if (!prevPlan || !plan) return null;
+  const before = new Map((prevPlan.events ?? []).map((e) => [planKey(e), e]));
+  const now = new Map((plan.events ?? []).map((e) => [planKey(e), e]));
+  const label = (e) => ({ platform: e.platform ?? "ga4", event: e.name });
+  const added = [...now].filter(([k]) => !before.has(k)).map(([, e]) => label(e));
+  const removed = [...before].filter(([k]) => !now.has(k)).map(([, e]) => label(e));
+  const changed = [...now].filter(([k]) => before.has(k)).map(([k, e]) => ({ ...label(e), what: eventChanges(before.get(k), e) })).filter((c) => c.what.length);
+  return { previous: previousId, added, removed, changed, same: !added.length && !removed.length && !changed.length };
+}
+
+/** The saved plan right before `planId` for the site, compared with `plan`; null for the first version or an unsaved plan. */
+export async function previousPlanChanges(dataDir, site, planId, plan) {
+  if (!planId) return null;
+  const ids = await listPlanIds(dataDir, site);
+  const prevId = ids.filter((id) => id < planId).at(-1);
+  if (!prevId) return null;
+  const prevPlan = await readJson(path.join(plansDir(dataDir, site), prevId, PLAN_FILE));
+  return comparePlans(prevPlan, plan, prevId);
+}

package/src/checks.js

@@ -3,6 +3,7 @@
 
 import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
+import { campaignParamsIn } from "./campaign.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -296,6 +297,33 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
+  // Campaign parameters (gclid, fbclid, UTM) on the landing address: they must survive redirects and reach the hits.
+  const landing = run.landing;
+  const sent = landing ? campaignParamsIn(landing.requested) : {};
+  if (landing && Object.keys(sent).length) {
+    const kept = campaignParamsIn(landing.final);
+    const lost = Object.keys(sent).filter((n) => kept[n] !== sent[n]);
+    const hop = landing.chain.length > 1 ? landing.chain : null;
+    if (lost.length) {
+      findings.push({ ...base, severity: "broken", check: "campaign_lost_redirect", step: stepLabel(landing.step), detail: d.campaignLost(lost, landing.final), evidence: hop ? hop.join(" -> ") : undefined });
+    }
+    // Hits the landing page sent whose page address leaves out a parameter the page still had.
+    const missing = new Map();
+    for (const hit of run.hits) {
+      const loc = hit.params?.page_location;
+      if (hit.step !== landing.step || !loc || hit.platform === "google_ads") continue;
+      const here = campaignParamsIn(loc);
+      const gone = Object.keys(kept).filter((n) => kept[n] === sent[n] && here[n] !== sent[n] && hit.params?.[n] !== sent[n]);
+      if (gone.length && !missing.has(hit.platform)) missing.set(hit.platform, { hit, gone });
+    }
+    for (const [platform, { hit, gone }] of missing) {
+      findings.push({ ...base, severity: "broken", check: "campaign_missing_in_hits", platform, event: hit.name, step: stepLabel(hit.step), detail: d.campaignMissingInHits(platform, hit.name, gone), evidence: hit.params.page_location });
+    }
+    if (!lost.length && !missing.size) {
+      findings.push({ ...base, severity: "ok", check: "campaign_params", step: stepLabel(landing.step), detail: d.campaignOk(Object.keys(sent)) });
+    }
+  }
+
   // Consent.
   const granted = consentGrantedStep(run);
   // Consent Mode only governs Google tags. Within one step, the push and hit times decide which came first.

package/src/cli.js

@@ -205,6 +205,8 @@ async function main(args = process.argv.slice(2)) {
   const rel = path.relative(process.cwd(), result.reportPath);
   console.log(`Report: ${rel.startsWith("..") ? result.reportPath : rel}`);
 
+  if (!against && !values.out) await offerLearnedPlan(result, loaded.config.site, values);
+
   if (failOn !== "never") {
     const threshold = levels.indexOf(failOn);
     if (levels.slice(0, threshold + 1).some((l) => result.counts[l] > 0)) process.exitCode = 1;
@@ -222,6 +224,26 @@ async function main(args = process.argv.slice(2)) {
   }
 }
 
+// The first run of a site with no plan: offer what it already tracks as its plan.
+async function offerLearnedPlan(result, site, values) {
+  const dataDir = values["data-dir"] ?? DEFAULT_DATA_DIR;
+  const { listPlanIds } = await import("./workspace.js");
+  if ((await listPlanIds(dataDir, site).catch(() => [])).length) return;
+  const { learnPlan } = await import("./learn.js");
+  const plan = learnPlan(site, result.runs);
+  if (!plan) return;
+  console.log(`\nNo plan yet for this site. It already sends ${plan.events.length} ${plan.events.length === 1 ? "event" : "events"}: ${plan.events.map((e) => `${e.platform}:${e.name}`).join(", ")}`);
+  let save = values.yes;
+  if (!save && process.stdin.isTTY) save = ["", "y", "yes"].includes((await ask("Save them as the site's plan? (Y/n) ")).toLowerCase());
+  if (!save) {
+    if (!process.stdin.isTTY && !values.yes) console.log("Add --yes to save them as the plan, or draft a fuller one with: aitd plan --site " + site);
+    return;
+  }
+  const { id, dir } = await savePlan(plan, { dataDir, site, branding: !values["no-branding"] });
+  const rel = path.relative(process.cwd(), dir);
+  console.log(`✓ Saved plan ${id} in ${rel.startsWith("..") ? dir : rel}. Next runs can check against it with --against latest.`);
+}
+
 // aitd "check my GA tags": shows the matching command and runs it once confirmed.
 async function fromSentence(sentence, values, extra) {
   const { createProvider } = await import("./providers.js");

package/src/consent.js

@@ -0,0 +1,154 @@
+// Consent scenarios: the start page opened in a fresh browser once per consent choice
+// (accept all, reject all, analytics only), to show which tags each choice lets through.
+// Runs on its own with every audit when the page shows a consent banner.
+import { AuditSession, CMP_BANNER_SELECTORS } from "./browser.js";
+
+export const CONSENT_STATES = ["accept", "reject", "analytics"];
+// Tags that are advertising, so an "analytics only" choice should keep them quiet.
+export const AD_PLATFORMS = new Set(["google_ads", "meta", "tiktok", "pinterest", "snapchat", "x"]);
+
+// Runs in the page: makes the choice through the consent platform's own API when it has one,
+// otherwise by clicking the banner's accept or reject button. Returns how, or null when it could not.
+const applyInPage = ({ state, selectors }) => {
+  const w = window;
+  try {
+    if (w.OneTrust?.AllowAll) {
+      if (state === "accept") w.OneTrust.AllowAll();
+      else {
+        w.OneTrust.RejectAll();
+        // C0002 is OneTrust's performance (analytics) group.
+        if (state === "analytics") w.OneTrust.UpdateConsent?.("Category", "C0002:1");
+      }
+      return "OneTrust";
+    }
+    if (w.Cookiebot?.submitCustomConsent) {
+      // preferences, statistics, marketing
+      w.Cookiebot.submitCustomConsent(state === "accept", state !== "reject", state === "accept");
+      return "Cookiebot";
+    }
+    if (state !== "analytics") {
+      if (w.UC_UI?.acceptAllConsents) {
+        state === "accept" ? w.UC_UI.acceptAllConsents() : w.UC_UI.denyAllConsents();
+        return "Usercentrics";
+      }
+      if (w.Didomi?.setUserAgreeToAll) {
+        state === "accept" ? w.Didomi.setUserAgreeToAll() : w.Didomi.setUserDisagreeToAll();
+        return "Didomi";
+      }
+    }
+  } catch {
+    // An API that throws falls back to the banner's buttons.
+  }
+  if (state === "analytics") return null;
+  const words = state === "accept"
+    ? /^(accept|allow|agree|ok|got it|kabul|tümünü kabul|izin ver|onayla|alle akzeptieren|tout accepter)/i
+    : /^(reject|decline|deny|refuse|necessary only|only necessary|reddet|kabul etme|ablehnen|tout refuser)/i;
+  const visible = (el) => !!(el.offsetWidth || el.offsetHeight || el.getClientRects().length);
+  const banners = [...document.querySelectorAll(selectors)].filter(visible);
+  for (const n of document.querySelectorAll("body *")) {
+    const label = `${n.id} ${typeof n.className === "string" ? n.className : ""}`;
+    if (/(cookie|consent|gdpr|kvkk)/i.test(label) && visible(n) && !banners.some((b) => b.contains(n))) banners.push(n);
+  }
+  for (const banner of banners) {
+    const button = [...banner.querySelectorAll("button, a, [role=button], input[type=button], input[type=submit]")]
+      .filter(visible)
+      .find((b) => words.test((b.innerText || b.value || b.getAttribute("aria-label") || "").trim()));
+    if (button) {
+      button.click();
+      return "banner";
+    }
+  }
+  return null;
+};
+
+// A Google hit that says storage is denied is a cookieless Consent Mode ping, which a "no" allows.
+const cookieless = (h) => !!h.consent && h.consent.ad_storage !== "granted" && h.consent.analytics_storage !== "granted";
+const isAnalyticsOnlyOk = (h) => !!h.consent && h.consent.ad_storage !== "granted";
+
+/** Hits per platform and event: { n, quiet } where quiet counts the ones sent with storage denied. */
+const countBy = (hits) => {
+  const out = {};
+  for (const h of hits) {
+    const c = ((out[h.platform] ??= {})[h.name] ??= { n: 0, cookieless: 0, adDenied: 0 });
+    c.n++;
+    if (cookieless(h)) c.cookieless++;
+    if (isAnalyticsOnlyOk(h)) c.adDenied++;
+  }
+  return out;
+};
+
+/** Opens the start page, makes one consent choice, opens the page again, and returns the hits before and after. */
+async function runState(config, state, opts) {
+  const session = new AuditSession({
+    viewport: "desktop", site: config.site, allowedHosts: config.allowed_hosts, providers: config.providers,
+    blockHits: config.block_hits !== false, headless: !opts.headed,
+  });
+  try {
+    await session.start();
+    const startError = await session.act({ action: "goto", url: config.site, reason: "Open the start page" });
+    if (startError) return { state, error: startError };
+    session.beginStep(`Choose: ${state}`);
+    const via = await session.page.evaluate(applyInPage, { state, selectors: CMP_BANNER_SELECTORS }).catch(() => null);
+    if (!via) return { state, via: null, before: countBy(session.hits) };
+    await session.settle();
+    session.beginStep("Open the start page again");
+    await session.page.reload().catch(() => {});
+    await session.settle();
+    const choice = session.steps.find((s) => s.label.startsWith("Choose:")).index;
+    return {
+      state, via,
+      before: countBy(session.hits.filter((h) => h.step < choice)),
+      after: countBy(session.hits.filter((h) => h.step >= choice)),
+    };
+  } catch (err) {
+    return { state, error: err?.message ?? String(err) };
+  } finally {
+    await session.close().catch(() => {});
+  }
+}
+
+/**
+ * Runs every consent scenario on the site's start page. Returns null when the page has no consent
+ * banner the tool can answer (the first choice found nothing to click), so the report leaves the section out.
+ * @returns {Promise<null | { cmp: string, before: object, states: Record<string, { via: string|null, after?: object, error?: string }> }>}
+ */
+export async function runConsentScenarios(config, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const first = await runState(config, "accept", opts);
+  if (!first.via) return null;
+  log(`\n▶ consent scenarios (${first.via})`);
+  const results = [first];
+  for (const state of CONSENT_STATES.slice(1)) results.push(await runState(config, state, opts));
+  const states = {};
+  for (const r of results) {
+    states[r.state] = r.error ? { via: null, error: r.error } : { via: r.via, ...(r.after ? { after: r.after } : {}) };
+    log(`  ${r.state}: ${r.error ? `✗ ${r.error}` : r.via ? `${Object.values(r.after ?? {}).reduce((s, e) => s + Object.values(e).reduce((a, b) => a + b.n, 0), 0)} tracking hits` : "not supported here"}`);
+  }
+  return { cmp: first.via, before: first.before, states };
+}
+
+/**
+ * The per-state tag table: one row per platform and event, one cell per state (hit count, or null when
+ * the state did not run). A cell is a problem when a tag sent hits a choice should have kept quiet:
+ * anything after "reject all" except cookieless Consent Mode pings, and ad tags after "analytics only"
+ * unless they were sent with ad storage denied.
+ */
+export function consentTable(scenarios) {
+  const keys = new Set();
+  const add = (counts) => Object.entries(counts ?? {}).forEach(([p, events]) => Object.keys(events).forEach((e) => keys.add(`${p}\u0000${e}`)));
+  add(scenarios.before);
+  for (const s of Object.values(scenarios.states)) add(s.after);
+  const cols = ["before", ...CONSENT_STATES];
+  const rows = [...keys].sort().map((k) => {
+    const [platform, event] = k.split("\u0000");
+    const cells = cols.map((col) => {
+      const s = col === "before" ? { after: scenarios.before } : scenarios.states[col];
+      if (!s?.after) return { state: col, count: null, problem: false };
+      const c = s.after[platform]?.[event] ?? { n: 0, cookieless: 0, adDenied: 0 };
+      const problem = (col === "reject" && c.n > c.cookieless) || (col === "analytics" && AD_PLATFORMS.has(platform) && c.n > c.adDenied);
+      return { state: col, count: c.n, problem };
+    });
+    return { platform, event, cells };
+  });
+  return { cols, rows };
+}

package/src/help.js

@@ -41,7 +41,7 @@ Options:
   --headed             Show the browser window
   --fail-on <level>    Exit 1 at this level: broken (default), risk, warning, never
 
-AI:  --provider <name>   --model <id>   (default: whichever API key is set)
+AI:  --provider <name>   --model <id|cheap>   (default: whichever API key is set)
 
 Advanced:
   --max-steps <n>   --platforms <list>   --viewport <name>   --data-dir <dir>
@@ -67,7 +67,7 @@ Options:
   --topic <name>       Only plan one kind of event: custom-events, ecommerce, forms or consent
   --headed             Show the browser window
 
-AI:  --provider <name>   --model <id>   (default: whichever API key is set)
+AI:  --provider <name>   --model <id|cheap>   (default: whichever API key is set)
 
 Advanced:
   --max-steps <n>   --data-dir <dir>   --format <xlsx|csv>   (see the README)`;

package/src/i18n.js

@@ -95,12 +95,14 @@ const en = {
     sections: "Report sections",
     headerMeta: (journeys, providers) => `${journeys} ${journeys === 1 ? "journey" : "journeys"} · ${providers} ${providers === 1 ? "provider" : "providers"}`,
     checkedAgainst: (id) => `Checked against plan ${id}`,
+    planChangesLine: (pc) => (pc.same ? `Plan unchanged since ${pc.previous}` : `Plan changed since ${pc.previous}: ${pc.added.length} added, ${pc.removed.length} removed, ${pc.changed.length} changed`),
     planVsSite: "Plan vs. site",
     changesTitle: "Changed since last run",
     changesLead: (id, mode) => `Compared with run ${id}, by ${mode === "plan" ? "plan coverage" : "health findings"}`,
     changesLine: (ch) => ch.fixed.length || ch.new.length ? [ch.fixed.length ? `${ch.fixed.length} ${ch.mode === "plan" ? (ch.fixed.length === 1 ? "event" : "events") : (ch.fixed.length === 1 ? "problem" : "problems")} fixed` : "", ch.new.length ? `${ch.new.length} new ${ch.new.length === 1 ? "problem" : "problems"}` : ""].filter(Boolean).join(", ") : "No changes since the last run",
     changeFixed: "Fixed",
     changeNew: "New",
+    noSavedRun: "No saved run for this site yet. Run `aitd run` first; each run is compared with the one before it.",
     routeChanged: (list) => `The AI took a different route through the site than in the last run: ${list}`,
     noPreviousRun: "This is the first saved run for this site, so there is nothing to compare yet.",
     planVsSiteLead: "Each planned event, and what the site actually sent",
@@ -131,6 +133,11 @@ const en = {
     consentUpdate: "Update",
     consentLead: "Consent Mode commands the site sent, in order.",
     consentNone: "The site sent no Consent Mode commands on this journey.",
+    scenarios: "Consent scenarios",
+    scenariosLead: (cmp) => `The start page opened once per consent choice (answered through ${cmp === "banner" ? "the banner's buttons" : cmp}). Hits per tag after the choice; red ones should not have been sent.`,
+    scenarioCols: { before: "No choice yet", accept: "Accept all", reject: "Reject all", analytics: "Analytics only" },
+    scenarioNotRun: "Not supported here",
+    scenarioTag: "Tag",
     skippedLine: (list, n) => `${n} out-of-scope ${n === 1 ? "request was" : "requests were"} skipped: ${list}.`,
     findingHint: "Open a finding to see its likely cause, evidence and fix steps.",
     spread: (j, s) => `${j} ${j === 1 ? "journey" : "journeys"}${s ? ` · ${s} ${s === 1 ? "step" : "steps"}` : ""}`,
@@ -144,6 +151,16 @@ const en = {
     notChecked: "not checked",
     noPlan: "No measurement plan was given, so there is nothing to compare against.",
     providers: "Providers",
+    inventoryTitle: "Tag inventory",
+    inventoryLead: "Every vendor the site sent requests to, and where",
+    vendorCol: "Vendor",
+    partyCol: "Party",
+    pagesCol: "Pages",
+    cookiesCol: "Cookies",
+    party: { first: "First party", third: "Third party", both: "Both" },
+    morePages: (n) => `+${n} more`,
+    otherCookies: "Other cookies",
+    noInventory: "No vendor requests were recorded.",
     provider: "Provider",
     requestsCol: "Requests",
     checked: "Checked",
@@ -167,6 +184,9 @@ const en = {
     purchaseMismatch: (id, diffs) => `GA4 and Meta reported ${id ? `order ${q(id)}` : "the purchase"} differently: ${diffs.map(([f, g, m]) => `${f} ${q(g)} in GA4 and ${q(m)} in Meta`).join("; ")}. One of the tags reads the wrong data.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}.${unseen.length ? ` Server-side copies of ${unseen.join(" and ")} events never pass through the browser, so they can't be seen here.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} was sent from the browser without an event ID, while a server-side setup was seen on this site. If the server also sends this event, ${platform} can't match the two and counts it twice.`,
+    campaignLost: (names, finalUrl) => `The landing address carried ${names.join(", ")}, but the page ended up on ${finalUrl} without ${names.length === 1 ? "it" : "them"}. A redirect dropped ${names.length === 1 ? "the parameter" : "the parameters"}, so ad clicks lose their attribution.`,
+    campaignMissingInHits: (platform, name, names) => `${platform} ${q(name)} on the landing page reports a page address without ${names.join(", ")}, though the page still had ${names.length === 1 ? "it" : "them"}. The visit can be credited to direct traffic instead of the campaign.`,
+    campaignOk: (names) => `${names.join(", ")} survived the landing page's redirects and reached the hits.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)} fired although consent was never given in this journey.`,
@@ -281,12 +301,14 @@ const tr = {
     sections: "Rapor bölümleri",
     headerMeta: (journeys, providers) => `${journeys} yolculuk · ${providers} sağlayıcı`,
     checkedAgainst: (id) => `${id} planına göre kontrol edildi`,
+    planChangesLine: (pc) => (pc.same ? `Plan ${pc.previous} sürümünden bu yana değişmedi` : `Plan ${pc.previous} sürümünden bu yana değişti: ${pc.added.length} eklendi, ${pc.removed.length} çıkarıldı, ${pc.changed.length} değişti`),
     planVsSite: "Plan ve site",
     changesTitle: "Son çalıştırmadan bu yana değişenler",
     changesLead: (id, mode) => `${id} çalıştırmasıyla ${mode === "plan" ? "plan kapsamına" : "sağlık bulgularına"} göre karşılaştırıldı`,
     changesLine: (ch) => ch.fixed.length || ch.new.length ? [ch.fixed.length ? `${ch.fixed.length} ${ch.mode === "plan" ? "olay" : "sorun"} düzeldi` : "", ch.new.length ? `${ch.new.length} yeni sorun` : ""].filter(Boolean).join(", ") : "Son çalıştırmadan bu yana değişiklik yok",
     changeFixed: "Düzeldi",
     changeNew: "Yeni",
+    noSavedRun: "Bu site için henüz kayıtlı çalıştırma yok. Önce `aitd run` çalıştırın; her çalıştırma bir öncekiyle karşılaştırılır.",
     routeChanged: (list) => `Yapay zeka siteyi son çalıştırmadan farklı bir yoldan gezdi: ${list}`,
     noPreviousRun: "Bu site için kayıtlı ilk çalıştırma bu, karşılaştırılacak bir şey henüz yok.",
     planVsSiteLead: "Plandaki her olay ve sitenin gerçekte gönderdiği",
@@ -317,6 +339,11 @@ const tr = {
     consentUpdate: "Güncelleme",
     consentLead: "Sitenin gönderdiği Consent Mode komutları, sırasıyla.",
     consentNone: "Site bu yolculukta Consent Mode komutu göndermedi.",
+    scenarios: "Onay senaryoları",
+    scenariosLead: (cmp) => `Başlangıç sayfası her onay seçimi için ayrı açıldı (${cmp === "banner" ? "banner butonlarıyla" : cmp} üzerinden yanıtlandı). Seçimden sonra etiket başına istek sayısı; kırmızılar gönderilmemeliydi.`,
+    scenarioCols: { before: "Henüz seçim yok", accept: "Tümünü kabul", reject: "Tümünü reddet", analytics: "Yalnızca analitik" },
+    scenarioNotRun: "Burada desteklenmiyor",
+    scenarioTag: "Etiket",
     skippedLine: (list, n) => `Kapsam dışı ${n} istek atlandı: ${list}.`,
     findingHint: "Bir bulguyu açınca olası neden, kanıt ve çözüm adımları görünür.",
     spread: (j, s) => `${j} yolculuk${s ? ` · ${s} adım` : ""}`,
@@ -330,6 +357,16 @@ const tr = {
     notChecked: "kontrol edilmedi",
     noPlan: "Ölçüm planı verilmediği için karşılaştırılacak bir şey yok.",
     providers: "Sağlayıcılar",
+    inventoryTitle: "Etiket envanteri",
+    inventoryLead: "Sitenin istek gönderdiği tüm sağlayıcılar ve hangi sayfalarda",
+    vendorCol: "Sağlayıcı",
+    partyCol: "Taraf",
+    pagesCol: "Sayfalar",
+    cookiesCol: "Çerezler",
+    party: { first: "Birinci taraf", third: "Üçüncü taraf", both: "İkisi de" },
+    morePages: (n) => `+${n} daha`,
+    otherCookies: "Diğer çerezler",
+    noInventory: "Sağlayıcıya giden istek kaydedilmedi.",
     provider: "Sağlayıcı",
     requestsCol: "İstek",
     checked: "Kontrol edildi",
@@ -353,6 +390,9 @@ const tr = {
     purchaseMismatch: (id, diffs) => `GA4 ve Meta ${id ? `${q(id)} siparişini` : "satın almayı"} farklı bildirdi: ${diffs.map(([f, g, m]) => `${f === "value" ? "değer" : "para birimi"} GA4'te ${q(g)}, Meta'da ${q(m)}`).join("; ")}. Etiketlerden biri yanlış veriyi okuyor.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}.${unseen.length ? ` ${unseen.join(" ve ")} olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} tarayıcıdan olay kimliği olmadan gönderildi; sitede sunucu tarafı bir kurulum görüldü. Sunucu da bu olayı gönderiyorsa ${platform} ikisini eşleştiremez ve iki kez sayar.`,
+    campaignLost: (names, finalUrl) => `Açılış adresi ${names.join(", ")} taşıyordu, ancak sayfa ${finalUrl} adresinde ${names.length === 1 ? "onsuz" : "onlarsız"} sonlandı. Bir yönlendirme ${names.length === 1 ? "parametreyi" : "parametreleri"} düşürdü, bu yüzden reklam tıklamalarının atfı kaybolur.`,
+    campaignMissingInHits: (platform, name, names) => `Açılış sayfasındaki ${platform} ${q(name)} isteği ${names.join(", ")} olmadan bir sayfa adresi bildiriyor, oysa sayfada ${names.length === 1 ? "o" : "onlar"} hâlâ vardı. Ziyaret kampanyaya değil doğrudan trafiğe yazılabilir.`,
+    campaignOk: (names) => `${names.join(", ")} açılış sayfasının yönlendirmelerinden geçti ve isteklere ulaştı.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)}, bu yolculukta hiç onay verilmemesine rağmen tetiklendi.`,

package/src/inventory.js

@@ -0,0 +1,69 @@
+import { providerOf } from "./parsers.js";
+import { siteOf } from "./redact.js";
+
+// Cookies the vendors' own scripts set on the site's domain.
+const COOKIE_VENDORS = [
+  [/^(_ga|_gid|_gat)(_|$)/, "ga4"],
+  [/^(_gcl_|_gac_|IDE$|test_cookie$)/, "google_ads"],
+  [/^_fb[pc]$/, "meta"],
+  [/^(_ttp|ttclid|_tt_enable_cookie)$/, "tiktok"],
+  [/^(_li_|li_|bcookie|lidc|UserMatchHistory)/, "linkedin"],
+  [/^(_uet|MUID)/, "microsoft_ads"],
+  [/^(_pin_|_pinterest_)/, "pinterest"],
+  [/^(_scid|sc_at)/, "snapchat"],
+  [/^(_cto_|cto_)/, "criteo"],
+  [/^__kla_id$/, "klaviyo"],
+  [/^_hj/, "hotjar"],
+  [/^_clck|^_clsk/, "clarity"],
+];
+
+const hostOf = (url) => {
+  try { return new URL(url).hostname; } catch { return ""; }
+};
+
+const pathOf = (url) => {
+  try { const u = new URL(url); return `${u.hostname}${u.pathname}`; } catch { return ""; }
+};
+
+/**
+ * Every vendor the site talked to: the pages it loaded or sent from, whether its requests went to the
+ * site's own domain (first party) or to the vendor (third party), and the cookie names tied to it.
+ * Cookies no vendor owns are listed apart. Only cookie names are kept, never values.
+ */
+export function buildInventory(runs) {
+  const vendors = new Map();
+  for (const r of runs) {
+    for (const c of r.network ?? []) {
+      if (!c.vendor || !c.pageUrl) continue;
+      const v = vendors.get(c.vendor) ?? { vendor: c.vendor, keys: new Set(), pages: new Set(), first: 0, third: 0, requests: 0, cookies: new Set() };
+      v.keys.add(c.provider);
+      v.pages.add(pathOf(c.pageUrl));
+      v.requests++;
+      v[siteOf(hostOf(c.url)) === siteOf(hostOf(c.pageUrl)) ? "first" : "third"]++;
+      vendors.set(c.vendor, v);
+    }
+  }
+  const other = new Map();
+  for (const r of runs) {
+    for (const ck of r.cookieLog ?? []) {
+      const domain = String(ck.domain ?? "").replace(/^\./, "");
+      const key = COOKIE_VENDORS.find(([re]) => re.test(ck.name))?.[1] ?? providerOf(`https://${domain}/`)?.key;
+      const owners = [...vendors.values()].filter((v) => key && v.keys.has(key));
+      if (owners.length) for (const v of owners) v.cookies.add(ck.name);
+      else other.set(`${domain}|${ck.name}`, { name: ck.name, domain });
+    }
+  }
+  const sites = new Set(runs.flatMap((r) => (r.network ?? []).map((c) => c.pageUrl)).filter(Boolean).map((u) => siteOf(hostOf(u))));
+  return {
+    vendors: [...vendors.values()]
+      .map((v) => ({
+        vendor: v.vendor,
+        party: v.first && v.third ? "both" : v.first ? "first" : "third",
+        pages: [...v.pages].sort(),
+        requests: v.requests,
+        cookies: [...v.cookies].sort(),
+      }))
+      .sort((a, b) => b.pages.length - a.pages.length || a.vendor.localeCompare(b.vendor)),
+    otherCookies: [...other.values()].map((c) => ({ name: c.name, party: sites.has(siteOf(c.domain)) ? "first" : "third" })).sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}

package/src/learn.js

@@ -0,0 +1,34 @@
+import { PROVIDERS } from "./parsers.js";
+
+/**
+ * A plan learned from what a site already sends: one event per platform and event name seen in
+ * the runs, the parameters it carried,. Parameters sent with every
+ * hit of an event become its required parameters. Values are not copied, so nothing a visitor typed
+ * ends up in the plan. Returns null when the runs captured no named events.
+ */
+export function learnPlan(site, runs) {
+  const byKey = new Map();
+  for (const run of runs) {
+    for (const hit of run.hits ?? []) {
+      if (!hit?.platform || !hit.name || hit.name === "(unnamed)") continue;
+      const k = `${hit.platform}:${hit.name}`;
+      let ev = byKey.get(k);
+      if (!ev) byKey.set(k, (ev = { platform: hit.platform, name: hit.name, hits: 0, params: new Map() }));
+      ev.hits++;
+      for (const p of Object.keys(hit.params ?? {})) ev.params.set(p, (ev.params.get(p) ?? 0) + 1);
+    }
+  }
+  if (!byKey.size) return null;
+  const events = [...byKey.values()].map((ev) => {
+    const required = [...ev.params].filter(([, n]) => n === ev.hits).map(([p]) => p);
+    return {
+      platform: ev.platform,
+      name: ev.name,
+      description: `Learned from what ${PROVIDERS[ev.platform] ?? ev.platform} received on the site.`,
+      ...(required.length ? { required_params: required } : {}),
+      parameters: Object.fromEntries([...ev.params.keys()].map((p) => [p, {}])),
+      seen: true,
+    };
+  });
+  return { site, learned: true, consent_mode: true, pages: [], events, user_properties: [] };
+}

package/src/mcp.js

@@ -24,6 +24,7 @@ import { DEFAULT_DATA_DIR, resolvePlan } from "./workspace.js";
 import { checkTopic, discoverPlan, TOPICS } from "./discover.js";
 import { createProvider } from "./providers.js";
 import { savePlan } from "./plan.js";
+import { changesLines, sinceLastRun } from "./changes.js";
 import { DEFAULT_PROVIDERS, PROVIDERS as TRACKING_PROVIDERS } from "./parsers.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
@@ -282,7 +283,7 @@ export function buildServer(opts) {
       const grouped = groupFindings(findings);
       const counts = summarize(grouped);
       const outDir = path.join(opts.reportsDir, `${new Date().toISOString().replace(/[:.]/g, "-")}-${audit.journey}`);
-      const reportPath = await writeReports({ outDir, config: { site: audit.site }, plan, runs: [run], findings, explained: null, lang, against: againstPlan, branding: branding !== false });
+      const { reportPath } = await writeReports({ outDir, config: { site: audit.site }, plan, runs: [run], findings, explained: null, lang, against: againstPlan, branding: branding !== false });
       const m = messages(lang);
       const lines = [
         m.ui.counts(counts),
@@ -351,6 +352,28 @@ export function buildServer(opts) {
     },
   );
 
+  server.registerTool(
+    "what_changed",
+    {
+      title: "What changed since the last run",
+      description:
+        "Returns only the \"since last run\" diff for a site: which problems were fixed and which are new in its newest saved run (`aitd run`) compared with the run before it. Compares plan coverage when both runs were checked against a plan, health findings otherwise. Does not browse or use an AI. Use it to answer \"what changed on this site?\" without re-reading a whole report.",
+      inputSchema: {
+        site: z.string().describe("The site, e.g. https://www.example.com/. Its saved runs are the ones in the data folder of the computer running this server."),
+        language: z.enum(Object.keys(LANGUAGES)).optional().describe("Language of the answer. Default en."),
+      },
+      annotations: { readOnlyHint: true },
+    },
+    async ({ site, language }) => {
+      try {
+        const diff = await sinceLastRun(opts.dataDir ?? DEFAULT_DATA_DIR, site);
+        return text(changesLines(diff, language ?? "en").join("\n"));
+      } catch (err) {
+        return fail(err.message);
+      }
+    },
+  );
+
   if (opts.allowFiles) {
     server.registerTool(
       "run_audit",