@analitikisler/ai-tag-debugger 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.0 (2026-10-17)
+
+- The first run learns the plan. When a site has no saved plan, `aitd run` lists the events it already sends and asks whether to save them as its plan. Add `--yes` to save without asking; in a script without `--yes`, nothing is saved.
+- With `--against`, the report header says how the plan changed since the version before it: `Plan changed since <id>: 1 added, 0 removed, 2 changed`, or `Plan unchanged since <id>`. Each change is listed. `capture.json` has the same comparison under `planChanges`.
+- `aitd plan import` reads Google Sheets downloads: the events CSV with its `<Doc> - user_properties.csv` beside it, and checkboxes as yes and no (TRUE and FALSE).
+- Consent scenarios: each audit opens the start page once per consent choice (accept all, reject all, analytics only) and shows the hits each tag sent after each choice. Analytics only works with OneTrust and Cookiebot. Set `"consent_scenarios": false` in the config to turn them off.
+- Tag inventory: the report lists every vendor the site sent requests to, first or third party, the pages it was seen on, and its cookie names (never values). Each network call in `capture.json` now has a `pageUrl`, redacted unless `keep_bodies` is on.
+
 ## 0.14.0 (2026-10-17)
 
 - The MCP server has a `what_changed` tool that returns only the "since last run" diff for a site: what was fixed and what is new, without browsing or an AI.

package/README.md

@@ -58,6 +58,10 @@ By default an audit checks GA4, Google Ads, Meta and TikTok, and also any other
 
 Requests to platforms you didn't choose are still answered locally, so they never reach those accounts either. They are left out of the timeline, the CSV and the checks, and only counted: the report lists them with their request counts (for example "61 out-of-scope requests were skipped: Microsoft Clarity, DoubleClick"), and each step says how many it skipped. Without `--platforms`, any platform your measurement plan names or the site sends to is added to the default list. Planned events for platforms you did leave out are listed in one info finding instead of being reported as missing. Tag manager and consent platform requests are always shown.
 
+### Consent scenarios
+
+Each audit also opens the start page once per consent choice, each time in a fresh browser: accept all, reject all and analytics only. The choice goes through the consent platform's own API (OneTrust, Cookiebot, Usercentrics or Didomi) when it has one, or else by clicking the banner's buttons. The report then shows how many hits each tag sent after each choice. Analytics only works with OneTrust and Cookiebot; with other platforms that column says "Not supported here". A tag that sends after reject all is flagged, except cookieless Consent Mode pings. An advertising tag that sends after analytics only is flagged unless it was sent with ad storage denied. The table is at the top of the **Journeys** tab and above the findings in `report.md`. It is skipped when the page shows no banner the tool can answer, and when a saved site is replayed. No AI model is called, but the start page is visited three more times. Set `"consent_scenarios": false` in the config to turn it off.
+
 ## How it works
 
 1. **Browse:** the AI model gets a goal in plain language ("add any product to the cart and complete checkout with the test payment") and a text view of the page. It acts through two tools, `browser_action` (goto, click, fill, select, scroll, wait) and `finish`, one step at a time with Playwright.
@@ -238,7 +242,7 @@ Events your site already sends are marked `"seen": true`.
 
 Review the plan before you use it. The examples and suggestions come from the pages the AI saw, so check that each event fits your business. The extra fields are ignored by the checks.
 
-**Spreadsheet import and export.** `aitd plan export <plan> --site <url>` writes `plan.xlsx` next to the plan, with one row per event parameter on an `events` tab (`event, platform, parameter, required, example, trigger, description`) and one row per user property on a `user_properties` tab. Add `--format csv` to get `events.csv` and `user_properties.csv` instead; CSV needs no extra package. `.xlsx` uses one small library, `fflate`, which is installed with the tool as an optional dependency. `aitd plan import <file> --site <url>` reads the spreadsheet back and saves it as a new plan folder. Import never edits an existing plan. Unknown columns are ignored with a warning, and an error names the tab, row and fix, for example `events, row 7: "required" must be yes or no (found "maybe").`
+**Spreadsheet import and export.** `aitd plan export <plan> --site <url>` writes `plan.xlsx` next to the plan, with one row per event parameter on an `events` tab (`event, platform, parameter, required, example, trigger, description`) and one row per user property on a `user_properties` tab. Add `--format csv` to get `events.csv` and `user_properties.csv` instead; CSV needs no extra package. `.xlsx` uses one small library, `fflate`, which is installed with the tool as an optional dependency. `aitd plan import <file> --site <url>` reads the spreadsheet back (from Google Sheets, use File > Download > Microsoft Excel (.xlsx), or download each tab as CSV: `Shop plan - events.csv` is imported together with `Shop plan - user_properties.csv` beside it, and checkbox cells work as yes/no) and saves it as a new plan folder. Import never edits an existing plan. Unknown columns are ignored with a warning, and an error names the tab, row and fix, for example `events, row 7: "required" must be yes or no (found "maybe").`
 
 `measurement-plan.json` looks like this:
 
@@ -263,6 +267,15 @@ Event names are matched loosely, so `dl_add_to_cart` (Elevar), `addToCart` and `
 
 `aitd plan list --site <url>` lists the site's plan IDs, oldest first.
 
+**Learn the plan from the first run.** When a site has no saved plan, a run without `--against` or `--out` lists the events the site already sends and asks whether to save them as its plan:
+
+```
+No plan yet for this site. It already sends 3 events: ga4:page_view, ga4:purchase, meta:PageView
+Save them as the site's plan? (Y/n)
+```
+
+Say yes, and the next runs can check against it with `--against latest`. A parameter that every hit of an event carries becomes one of its required parameters. No values are copied, so nothing a visitor typed ends up in the plan. In a script or CI job nothing is saved unless you add `--yes`; the run then prints the `aitd plan --site` command for drafting a fuller plan.
+
 ### Plan vs. site
 
 When a run uses `--against`, the report starts with a **Plan vs. site** section, in `report.html` and `report.md`. Each planned event lands in one bucket:
@@ -278,6 +291,12 @@ When a run uses `--against`, the report starts with a **Plan vs. site** section,
 
 The coverage score is implemented divided by the planned events that were checkable (all except not checked), shown overall and per platform, for example `Coverage 7 of 11 (64%), 2 events not checked`. The same entries are in `plan-check.json`, one per planned event with its bucket. Exit codes don't change: `--fail-on` still looks at finding severity. Without `--against`, the report is exactly as before.
 
+When the plan is not the site's first, the header compares it with the version saved before it: `Plan changed since 2026-10-01_0900: 1 added, 0 removed, 2 changed`, or `Plan unchanged since 2026-10-01_0900`. The header in `report.html` and `report.md` then lists each change: `+` for an added event, `−` for a removed one and `~` for a changed one, followed by what changed (required parameters, parameters or journeys). The first version has nothing to compare with, and `capture.json` keeps the same comparison under `planChanges`.
+
+### Tag inventory
+
+Every report also has a **tag inventory**: each vendor the site sent requests to, marked first party when its requests went to the site's own domain, third party when they went to the vendor, or both. It shows how many pages the vendor was seen on and the cookies tied to it. Cookies that no vendor owns are listed apart, as first or third party. Only cookie names are recorded, never their values. It is in the **Scope and plan** tab of `report.html` and as a table in `report.md`.
+
 ### Folder layout and plan IDs
 
 Plans and runs are kept in `aitd/` in the folder you run the tool from:
@@ -392,7 +411,9 @@ When a journey ran on both viewports, only the first viewport's steps are kept.
 | `journeys[].steps` | Optional fixed steps for `--scripted` runs: `{ "action": "click", "selector": "#add-to-cart" }`. |
 | `allowed_hosts` | Other hosts journeys may visit, e.g. `["checkout.payments-provider.com"]` for a hosted checkout. The browser otherwise stays on the `site` host and its subdomains. Same as `--allow-host`. |
 | `providers` | Tracking platforms to check, e.g. `["ga4", "meta"]`. Default `["ga4", "google_ads", "meta", "tiktok"]`, plus any other platform the site sends to while this is unset. Same as `--platforms`. |
+| `campaign_checks` | Default `true`. Each run opens the first page like an ad click (UTM parameters, `gclid`, `fbclid`, or the ones already in the start address) and checks they survive redirects and reach the hits. Set to `false` to open the plain address. |
 | `block_hits` | Default `true`. Set to `false` to let hits reach your real endpoints. |
+| `consent_scenarios` | Default `true`. Set to `false` to skip the [consent scenarios](#consent-scenarios), which visit the start page once per consent choice. |
 | `language` | Report language, `en` (default) or `tr`. Same as `--lang`. |
 | `keep_bodies` | Default `false`. Set to `true` to store tracking requests as sent, without redacting user data. Same as `--keep-bodies`. |
 | `branding` | Default `true`. Set to `false` to leave the Analitik İşler logo and the "Generated by AI Tag Debugger · analitikisler.com" line out of the reports. Same as `--no-branding`, or `branding: false` on the MCP `finish_audit` and `run_audit` tools. |
@@ -477,12 +498,12 @@ Output:
 - `report.html`: one file with four tabs. Links work across tabs (a finding's "Where" chip opens that step), and every view has its own URL you can bookmark or share.
   - **Overview**: problem counts, the AI summary (most important problem first, plus things worth checking that the findings don't cover), the journeys with their problem counts, a **This run** card (platforms, AI provider and model, plan, journeys, viewports, language, version), and, with `--against`, the [Plan vs. site](#plan-vs-site) coverage. When the AI took a different route through the site than in the last run, the header names the journeys whose route changed, and the **Changed since last run** section shows the pages before and after.
   - **Findings**: grouped by who fixes them (Developer, Tag Manager, Marketing) and filterable by severity. Each one has its impact, likely cause, evidence, numbered fix steps, the steps where it happened, and a **How to verify** list of tools to check the fix in, such as Tag Assistant, GA4 DebugView, Meta Test Events or TikTok Pixel Helper.
-  - **Journeys**: one journey at a time. A **Consent** card at the top lists the Consent Mode default and every update, one tile per signal. Below it are the steps on the left and the selected step on the right. It opens on the first step with a problem. Each step has four tabs:
+  - **Journeys**: one journey at a time. Above them, when the start page has a consent banner, the [consent scenarios](#consent-scenarios) table. A **Consent** card at the top lists the Consent Mode default and every update, one tile per signal. Below it are the steps on the left and the selected step on the right. It opens on the first step with a problem. Each step has four tabs:
     - **Timeline**: the step in order. Each dataLayer push comes first, then the GTM event it raised (or the consent command), then the platform hits it caused. Hits with no push are listed last.
     - **Events**: each tracking hit with its parameters, consent state, the dataLayer push and request behind it, and a note when a finding points at it.
     - **dataLayer**: every push in the step.
     - **Network requests**: every request to the chosen platforms, decoded into a parameter table with a `?` tip on each parameter. A batched GA4 request shows each of its events.
-  - **Scope and plan**: whether each planned event was sent on each journey, and the platforms checked or left out, with request counts.
+  - **Scope and plan**: whether each planned event was sent on each journey, and the platforms checked or left out, with request counts. The [tag inventory](#tag-inventory) lists each vendor with its party, pages and cookies.
 
   Events and requests can be filtered by source. GA4 item strings (`pr1`…) and dataLayer `ecommerce.items` are shown as item cards, with custom item parameters in their own group. The report has no scripts: tabs and filters are plain HTML and CSS (they need Chrome 105, Safari 15.4 or Firefox 121 or newer), and printing shows every tab. The logos are embedded, so nothing is loaded from the internet. `--no-branding` leaves out the Analitik İşler logo and credit line.
 - `timeline.csv`: the same timeline as one row per hit, dataLayer push and network call, ready for Excel or Google Sheets.

package/README.tr.md

@@ -58,6 +58,10 @@ Varsayılan olarak bir denetim GA4, Google Ads, Meta ve TikTok'u kontrol eder; a
 
 Seçmediğiniz platformlara giden istekler de yerelde yanıtlanır, yani o hesaplara da ulaşmaz. Bu istekler zaman akışına, CSV'ye ve kontrollere alınmaz, sadece sayılır: rapor bunları istek sayılarıyla listeler (örneğin "Kapsam dışı 61 istek atlandı: Microsoft Clarity, DoubleClick") ve her adım kaç istek atladığını gösterir. `--platforms` vermezseniz, ölçümleme planınızda geçen ya da sitenin gönderdiği her platform varsayılan listeye eklenir. Dışarıda bıraktığınız platformlar için planlanmış event'ler eksik olarak raporlanmaz, tek bir bilgi bulgusunda listelenir. Etiket yöneticisi ve çerez onayı platformu istekleri her zaman gösterilir.
 
+### Onay senaryoları
+
+Her denetim ayrıca başlangıç sayfasını her çerez onay seçimi için bir kez açar; her seçim yeni bir tarayıcıda yapılır: tümünü kabul, tümünü reddet ve yalnızca analitik. Seçim, consent platformunun kendi API'siyle (OneTrust, Cookiebot, Usercentrics ya da Didomi) yapılır; API yoksa bannerın düğmelerine tıklanır. Rapor, her seçimden sonra her etiketin kaç istek gönderdiğini gösterir. Yalnızca analitik seçeneği OneTrust ve Cookiebot ile çalışır; diğer platformlarda o sütun "Burada desteklenmiyor" yazar. Tümünü reddet'ten sonra gönderilen bir etiket işaretlenir; Consent Mode'un çerezsiz ping'leri hariç. Yalnızca analitik'ten sonra gönderilen bir reklam etiketi, reklam depolaması reddedilmiş olarak gönderilmediği sürece işaretlenir. Tablo **Yolculuklar** sekmesinin en üstünde ve `report.md` içinde bulgulardan önce yer alır. Başlangıç sayfasında aracın yanıtlayabileceği bir banner yoksa ya da kayıtlı bir site tekrar oynatılıyorsa atlanır. Yapay zekâ modeli çağrılmaz, ama başlangıç sayfası üç kez daha ziyaret edilir. Kapatmak için ayar dosyasına `"consent_scenarios": false` yazın.
+
 ## Nasıl çalışır
 
 1. **Gezinme:** Yapay zekâ modeli, sade bir dille yazılmış bir hedef ("sepete herhangi bir ürün ekle ve test ödeme yöntemiyle siparişi tamamla") ve sayfanın metin görünümünü alır. İki araçla çalışır: `browser_action` (goto, click, fill, select, scroll, wait) ve `finish`. Playwright ile her seferinde bir adım atar.
@@ -238,7 +242,7 @@ Siteniz zaten gönderdiği event'ler `"seen": true` ile işaretlenir.
 
 Kullanmadan önce planı gözden geçirin. Örnekler ve öneriler yapay zekânın gördüğü sayfalardan gelir, bu yüzden her event'in işinize uyduğunu kontrol edin. Ek alanları kontroller yok sayar.
 
-**Elektronik tablo ile içe ve dışa aktarma.** `aitd plan export <plan> --site <url>`, planın yanına `plan.xlsx` yazar: `events` sekmesinde her event parametresi için bir satır (`event, platform, parameter, required, example, trigger, description`) ve `user_properties` sekmesinde her kullanıcı özelliği için bir satır. Bunun yerine `events.csv` ve `user_properties.csv` almak için `--format csv` ekleyin; CSV ek bir paket gerektirmez. `.xlsx`, araçla birlikte isteğe bağlı bir bağımlılık olarak gelen küçük bir kütüphane, `fflate` kullanır. `aitd plan import <dosya> --site <url>` elektronik tabloyu okuyup yeni bir plan klasörü olarak kaydeder. İçe aktarma mevcut bir planı asla düzenlemez. Tanınmayan sütunlar bir uyarıyla yok sayılır; bir hata, sekmeyi, satırı ve düzeltmeyi belirtir, örneğin `events, row 7: "required" must be yes or no (found "maybe").`
+**Elektronik tablo ile içe ve dışa aktarma.** `aitd plan export <plan> --site <url>`, planın yanına `plan.xlsx` yazar: `events` sekmesinde her event parametresi için bir satır (`event, platform, parameter, required, example, trigger, description`) ve `user_properties` sekmesinde her kullanıcı özelliği için bir satır. Bunun yerine `events.csv` ve `user_properties.csv` almak için `--format csv` ekleyin; CSV ek bir paket gerektirmez. `.xlsx`, araçla birlikte isteğe bağlı bir bağımlılık olarak gelen küçük bir kütüphane, `fflate` kullanır. `aitd plan import <dosya> --site <url>` elektronik tabloyu okuyup yeni bir plan klasörü olarak kaydeder. Google E-Tablolar'dan indirirken Dosya > İndir > Microsoft Excel (.xlsx) seçin ya da her sekmeyi CSV olarak indirin: `Shop plan - events.csv` dosyası, yanındaki `Shop plan - user_properties.csv` ile birlikte okunur ve onay kutuları evet/hayır olarak tanınır. İçe aktarma mevcut bir planı asla düzenlemez. Tanınmayan sütunlar bir uyarıyla yok sayılır; bir hata, sekmeyi, satırı ve düzeltmeyi belirtir, örneğin `events, row 7: "required" must be yes or no (found "maybe").`
 
 `measurement-plan.json` şöyle görünür:
 
@@ -263,6 +267,15 @@ Event adları gevşek eşleştirilir: `dl_add_to_cart` (Elevar), `addToCart` ve
 
 `aitd plan list --site <url>`, sitenin plan kimliklerini en eskiden en yeniye listeler.
 
+**Planı ilk çalıştırmadan öğrenin.** Sitenin kayıtlı bir planı yokken, `--against` ya da `--out` olmadan yapılan bir çalıştırma, sitenin zaten gönderdiği event'leri listeler ve bunları sitenin planı olarak kaydedip kaydetmeyeceğinizi sorar:
+
+```
+No plan yet for this site. It already sends 3 events: ga4:page_view, ga4:purchase, meta:PageView
+Save them as the site's plan? (Y/n)
+```
+
+Evet derseniz sonraki çalıştırmalar `--against latest` ile bu plana karşı kontrol yapabilir. Bir event'in her isteğinde bulunan bir parametre, o event'in zorunlu parametrelerinden biri olur. Hiçbir değer kopyalanmaz, bu yüzden bir ziyaretçinin yazdıkları plana girmez. Bir betikte ya da CI işinde `--yes` eklemedikçe hiçbir şey kaydedilmez; çalıştırma bunun yerine daha ayrıntılı bir plan taslağı için `aitd plan --site` komutunu yazdırır.
+
 ### Plan ve site
 
 Bir çalıştırma `--against` kullandığında rapor, `report.html` ve `report.md` dosyalarında **Plan ve site** bölümüyle başlar. Planlanan her event bir kovaya düşer:
@@ -278,6 +291,12 @@ Bir çalıştırma `--against` kullandığında rapor, `report.html` ve `report.
 
 Kapsam puanı, uygulanmış olanların kontrol edilebilir planlanmış event'lere (kontrol edilmedi hariç hepsi) bölünmesiyle bulunur; genel ve platform başına gösterilir, örneğin `Kapsam 11 olaydan 7 (%64), 2 olay kontrol edilmedi`. Aynı kayıtlar `plan-check.json` dosyasında da bulunur: planlanan her event için kovasıyla birlikte bir kayıt. Çıkış kodları değişmez: `--fail-on` yine bulgu önemine bakar. `--against` olmadan rapor tam olarak eskisi gibidir.
 
+Kontrol edilen plan sitenin ilk planı değilse, rapor başlığı onu bir önceki kayıtlı sürümle karşılaştırır: `Plan 2026-10-01_0900 sürümünden bu yana değişti: 1 eklendi, 0 çıkarıldı, 2 değişti` ya da `Plan 2026-10-01_0900 sürümünden bu yana değişmedi`. Başlık her değişikliği `report.html` ve `report.md` içinde listeler: eklenen event için `+`, çıkarılan için `−`, değişen için `~`, ardından neyin değiştiği (zorunlu parametreler, parametreler ya da yolculuklar). İlk sürümün karşılaştırılacak bir şeyi yoktur; `capture.json` aynı karşılaştırmayı `planChanges` altında da saklar.
+
+### Etiket envanteri
+
+Her raporda ayrıca bir **etiket envanteri** bulunur: sitenin istek gönderdiği her sağlayıcı; istekleri sitenin kendi alan adına gittiyse birinci taraf, sağlayıcıya gittiyse üçüncü taraf, ikisine de gittiyse ikisi olarak işaretlenir. Sağlayıcının görüldüğü sayfa sayısını ve ona bağlı çerezleri gösterir. Hiçbir sağlayıcıya ait olmayan çerezler ayrıca birinci ya da üçüncü taraf olarak listelenir. Yalnızca çerez adları kaydedilir, değerleri asla. Envanter `report.html` içindeki **Kapsam ve plan** sekmesinde, `report.md` içinde ise bir tablo olarak yer alır.
+
 ### Klasör yapısı ve plan kimlikleri
 
 Planlar ve çalıştırmalar, aracı çalıştırdığınız klasördeki `aitd/` içinde tutulur:
@@ -392,7 +411,9 @@ Bir yolculuk her iki görünümde de çalıştıysa yalnızca ilk görünümün
 | `journeys[].steps` | `--scripted` çalıştırmaları için isteğe bağlı sabit adımlar: `{ "action": "click", "selector": "#add-to-cart" }`. |
 | `allowed_hosts` | Yolculukların ziyaret edebileceği başka ana makineler, örneğin barındırılan bir ödeme için `["checkout.payments-provider.com"]`. Tarayıcı aksi halde `site` ana makinesinde ve alt alan adlarında kalır. `--allow-host` ile aynıdır. |
 | `providers` | Kontrol edilecek takip platformları, örneğin `["ga4", "meta"]`. Varsayılan `["ga4", "google_ads", "meta", "tiktok"]`; bu ayar boşken sitenin gönderdiği diğer platformlar da eklenir. `--platforms` ile aynıdır. |
+| `campaign_checks` | Varsayılan `true`. Her çalıştırma ilk sayfayı bir reklam tıklaması gibi açar (UTM parametreleri, `gclid`, `fbclid` ya da başlangıç adresinde zaten olanlar) ve bunların yönlendirmelerden geçip isteklere ulaştığını denetler. Düz adresi açmak için `false` yapın. |
 | `block_hits` | Varsayılan `true`. Takip isteklerinin gerçek uç noktalarınıza ulaşmasına izin vermek için `false` yapın. |
+| `consent_scenarios` | Varsayılan `true`. [Onay senaryolarını](#onay-senaryoları) atlamak için `false` yapın; her onay seçimi için başlangıç sayfasını bir kez ziyaret ederler. |
 | `language` | Rapor dili, `en` (varsayılan) ya da `tr`. `--lang` ile aynıdır. |
 | `keep_bodies` | Varsayılan `false`. Takip isteklerini gönderildiği gibi, kullanıcı verisi gizlenmeden saklamak için `true` yapın. `--keep-bodies` ile aynıdır. |
 | `branding` | Varsayılan `true`. Analitik İşler logosunu ve "Generated by AI Tag Debugger · analitikisler.com" satırını raporlardan çıkarmak için `false` yapın. `--no-branding` ile aynıdır, ya da MCP `finish_audit` ve `run_audit` araçlarında `branding: false`. |
@@ -479,12 +500,12 @@ aitd mcp [--http] [--port <n>] [--host <adres>] [--token <gizli>] [--public-url
 - `report.html`: dört sekmeli tek bir dosya. Bağlantılar sekmeler arasında çalışır (bir bulgunun "Nerede" çipi o adımı açar) ve her görünümün paylaşılabilir ya da yer imine eklenebilir kendi URL'si vardır.
   - **Genel bakış**: sorun sayıları, yapay zekâ özeti (en önemli sorun önce, ve bulguların kapsamadığı kontrol edilmeye değer şeyler), yolculuklar ve sorun sayıları, bir **Bu çalıştırma** kartı (platformlar, yapay zekâ sağlayıcısı ve modeli, plan, yolculuklar, ekranlar, dil, sürüm) `--against` ile [Plan ve site](#plan-ve-site) kapsamı. Yapay zekâ siteyi son çalıştırmadan farklı bir yoldan gezdiyse, başlıkta yolu değişen yolculukları gösteren bir not ve **Son çalıştırmadan bu yana değişenler** bölümünde değişiklikten önceki ve sonraki sayfalar bulunur.
   - **Bulgular**: düzeltmesini kimin yapacağına göre gruplu (Yazılımcı, Tag Manager, Pazarlama) ve önem düzeyine göre filtrelenebilir. Her birinde etkisi, olası nedeni, kanıtı, numaralı düzeltme adımları, olayın yaşandığı adımlar ve **Nasıl doğrulanır** listesi bulunur; bu liste düzeltmeyi kontrol edebileceğiniz araçlara bağlantı verir (Tag Assistant, GA4 DebugView, Meta Test Events, TikTok Pixel Helper).
-  - **Yolculuklar**: her seferinde bir yolculuk. Üstteki **Onay** kartı Consent Mode varsayılanını ve her güncellemeyi, sinyal başına bir kutuyla gösterir. Altında solda adımları, sağda seçili adım. Sorunlu ilk adımda açılır. Her adımın dört sekmesi vardır:
+  - **Yolculuklar**: her seferinde bir yolculuk. Başlangıç sayfasında bir onay bannerı varsa, yolculukların üstünde [onay senaryoları](#onay-senaryoları) tablosu yer alır. Üstteki **Onay** kartı Consent Mode varsayılanını ve her güncellemeyi, sinyal başına bir kutuyla gösterir. Altında solda adımları, sağda seçili adım. Sorunlu ilk adımda açılır. Her adımın dört sekmesi vardır:
     - **Zaman akışı**: adım sırasıyla. Önce her dataLayer gönderimi, ardından onu tetikleyen GTM event'i (ya da çerez onayı komutu), sonra da yol açtığı platform istekleri gelir. Gönderimi olmayan istekler en sonda listelenir.
     - **Event'ler**: her takip isteği, parametreleri, çerez onayı durumu, arkasındaki dataLayer gönderimi ve isteği ve bir bulgu buraya işaret ediyorsa bir not.
     - **dataLayer**: adımdaki her gönderim.
     - **Ağ istekleri**: seçilen platformlara giden her istek; her parametrede bir `?` ipucuyla bir parametre tablosuna çözülmüş. Toplu bir GA4 isteği, içindeki her event'i gösterir.
-  - **Kapsam ve plan**: planlanan her event'in her yolculukta gönderilip gönderilmediği ve kontrol edilen ya da dışarıda bırakılan platformlar, istek sayılarıyla.
+  - **Kapsam ve plan**: planlanan her event'in her yolculukta gönderilip gönderilmediği ve kontrol edilen ya da dışarıda bırakılan platformlar, istek sayılarıyla. Ayrıca [etiket envanteri](#etiket-envanteri): her sağlayıcı, birinci ya da üçüncü taraf, sayfaları ve çerezleri.
 
   Event'ler ve istekler kaynağa göre filtrelenebilir. GA4 ürün dizgileri (`pr1`…) ve dataLayer `ecommerce.items` ürün kartları olarak gösterilir; özel ürün parametreleri kendi grubunda yer alır. Raporda betik yoktur: sekmeler ve filtreler düz HTML ve CSS'tir (Chrome 105, Safari 15.4 ya da Firefox 121 ve sonrası gerekir) ve yazdırırken her sekme görünür. Logolar gömülüdür, bu yüzden internetten hiçbir şey yüklenmez. `--no-branding`, Analitik İşler logosunu ve kredi satırını çıkarır.
 - `timeline.csv`: aynı zaman akışı, her isteğe, dataLayer gönderimine ve ağ çağrısına bir satır olarak; Excel ya da Google Sheets için hazır.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { AuditSession } from "./browser.js";
+import { withCampaignParams } from "./campaign.js";
 import { messages } from "./i18n.js";
 import { createProvider, PROVIDERS } from "./providers.js";
 
@@ -200,8 +201,10 @@ export async function runJourney(config, journey, viewport, opts = {}) {
   });
   try {
     await session.start();
-    const startUrl = new URL(journey.start ?? "/", config.site).href;
-    const startError = await session.act({ action: "goto", url: startUrl, reason: `Open ${startUrl}` });
+    // The first page is opened the way an ad click opens it, so the campaign checks have something to follow.
+    const start = new URL(journey.start ?? "/", config.site).href;
+    const startUrl = config.campaign_checks === false ? start : withCampaignParams(start);
+    const startError = await session.act({ action: "goto", url: startUrl, reason: `Open ${start}` });
     // A replayed journey that was unfinished when saved keeps its saved note, however it fails this time.
     if (startError) return { ...collect(session, journey, viewport), completed: false, note: journey.incomplete ?? `Could not open the start page: ${startError}` };
 
@@ -248,5 +251,6 @@ export function collect(session, journey, viewport) {
     bodyBudgetStep: session.bodyBudgetStep,
     startedAt: session.startedAt,
     pageErrors: session.errors,
+    landing: session.landing,
   };
 }

package/src/audit.js

@@ -1,7 +1,7 @@
 // A full audit from a config file: run every journey, check, explain, write the reports.
 // Shared by the CLI and the MCP server's run_audit tool.
 import { newRunDir } from "./workspace.js";
-import { compareRuns, previousRun, routeHints } from "./changes.js";
+import { compareRuns, previousPlanChanges, previousRun, routeHints } from "./changes.js";
 import { sendAlerts } from "./notify.js";
 import { readFile, mkdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -14,6 +14,7 @@ import { createProvider, alsoSet } from "./providers.js";
 import { filterFindings, JOURNEY_PRESETS, planRun } from "./journeys.js";
 import { resolveProviders } from "./parsers.js";
 import { SAVED_SITE_FILE, writeSavedSite } from "./replay.js";
+import { runConsentScenarios } from "./consent.js";
 
 export async function readJson(file, baseDir = ".") {
   const full = path.resolve(baseDir, file);
@@ -41,19 +42,19 @@ export async function loadConfig(configFile) {
  * previous: the site's last saved run (see previousRun), null when there is none, or undefined to skip
  * the "Changed since last run" section. Returns { reportPath, changes }.
  */
-export async function writeReports({ outDir, config, plan, runs, findings, explained, lang, ai = null, against = null, branding = config.branding !== false, previous = undefined }) {
+export async function writeReports({ outDir, config, plan, runs, findings, explained, lang, ai = null, against = null, branding = config.branding !== false, previous = undefined, planChanges = null, consentScenarios = null }) {
   await mkdir(outDir, { recursive: true });
   const site = new URL(config.site).hostname;
   const title = messages(lang).ui.title(site);
   const generatedAt = new Date().toISOString().slice(0, 16).replace("T", " ") + " UTC";
   const check = against ? { plan_id: against.id ?? null, ...planCheck(plan, runs, findings) } : null;
   const changes = previous === undefined ? null : compareRuns(previous, { findings, planCheck: check, runs });
-  const report = { title, site, ai, generatedAt, findings, explained, runs, plan, lang, branding, against: against?.label ?? null, planCheck: check, changes };
+  const report = { title, site, ai, generatedAt, findings, explained, runs, plan, lang, branding, against: against?.label ?? null, planCheck: check, changes, planChanges, consentScenarios };
   await writeFile(path.join(outDir, "report.md"), renderMarkdown(report));
   await writeFile(path.join(outDir, "report.html"), renderHtml(report));
   await writeFile(path.join(outDir, "timeline.csv"), renderCsv(report));
   if (check) await writeFile(path.join(outDir, "plan-check.json"), JSON.stringify(check, null, 2));
-  await writeFile(path.join(outDir, "capture.json"), JSON.stringify({ config: { ...config, plan }, ...(against ? { against: { plan_id: against.id, file: against.file } } : {}), runs, findings, explained, ...(changes ? { changes } : {}) }, null, 2));
+  await writeFile(path.join(outDir, "capture.json"), JSON.stringify({ config: { ...config, plan }, ...(against ? { against: { plan_id: against.id, file: against.file } } : {}), runs, findings, explained, ...(changes ? { changes } : {}), ...(planChanges ? { planChanges } : {}), ...(consentScenarios ? { consentScenarios } : {}) }, null, 2));
   return { reportPath: path.join(outDir, "report.html"), changes };
 }
 
@@ -127,6 +128,11 @@ export async function runAudit(opts) {
     }
   }
 
+  // Consent scenarios need the live site, so a replay from a saved site skips them. "consent_scenarios": false turns them off.
+  const consentScenarios = opts.replaySite || config.consent_scenarios === false
+    ? null
+    : await runConsentScenarios(config, { headed: opts.headed, log }).catch((err) => (log(`  Consent scenarios failed: ${err.message}`), null));
+
   const findings = filterFindings(runs.flatMap((run) => checkRun(plan, run, { lang })), events);
   let saveError = null;
   if (opts.saveSite) {
@@ -149,12 +155,12 @@ export async function runAudit(opts) {
   // Runs saved in the site's runs folder are compared with the one before; a run sent to --out is not.
   const previous = opts.outDir ? undefined : await previousRun(opts.dataDir, config.site);
   const outDir = path.resolve(opts.outDir ?? (await newRunDir(opts.dataDir, config.site)).dir);
-  const { reportPath, changes } = await writeReports({ outDir, config, plan, runs, findings, explained, lang, ai: provider ? { name: provider.name, model: provider.model } : null, against, branding: opts.branding ?? config.branding !== false, previous });
+  const { reportPath, changes } = await writeReports({ outDir, config, plan, runs, findings, explained, lang, ai: provider ? { name: provider.name, model: provider.model } : null, against, branding: opts.branding ?? config.branding !== false, previous, planChanges: against ? await previousPlanChanges(opts.dataDir, config.site, against.id, plan).catch(() => null) : null, consentScenarios });
   if (config.notify && changes) {
     const { sent, errors } = await sendAlerts({ notify: config.notify, site: new URL(config.site).hostname, changes: { run: path.basename(outDir), ...changes }, lang, reportPath });
     if (sent.length) log(`\nSent the changes since the last run to ${sent.join(" and ")}.`);
     for (const e of errors) log(`\nCould not send an alert. ${e}`);
   }
   const counts = summarize(groupFindings(findings));
-  return { journeys, plan, runs, findings, explained, counts, reportPath, outDir, lang, ...(against ? { againstId: against.id } : {}), ...(saveError ? { saveError } : {}) };
+  return { journeys, plan, runs, findings, explained, counts, reportPath, outDir, lang, consentScenarios, ...(against ? { againstId: against.id } : {}), ...(saveError ? { saveError } : {}) };
 }

package/src/browser.js

@@ -382,6 +382,7 @@ export class AuditSession {
     this.dataLayerLog = [];
     this.network = [];
     this.providers = resolveProviders(this.opts.providers);
+    this.landing = null; // the first page: { step, requested, chain, final }
     this.detect = this.opts.detect ?? !this.opts.providers?.length;
     this.skipped = {}; // step index -> { vendor label: requests }
     this.loadedIn = new Map(); // page address -> the last step whose main-frame navigation reached it
@@ -426,6 +427,8 @@ export class AuditSession {
       if (frame !== this.page.mainFrame()) return;
       this.loadedIn.set(pageKey(frame.url()), this.currentStep);
       this.leaving = null;
+      // Script redirects on the first page move where it ends up.
+      if (this.landing && this.landing.step === this.currentStep) this.landing.final = frame.url();
     });
     // From the moment the main frame starts loading another document, the open page is leaving.
     this.page.on("request", (request) => {
@@ -464,6 +467,7 @@ export class AuditSession {
       const vendor = vendorOf(request.url());
       const call = {
         step: this.currentStep,
+        pageUrl: this.opts.keepBodies ? this.page.url() : redactUrl(this.page.url()).url,
         t: Date.now(),
         method: request.method(),
         url: this.opts.keepBodies ? request.url() : redactUrl(request.url()).url,
@@ -844,7 +848,13 @@ export class AuditSession {
           step.replay = { action: "goto", url: target };
           const refused = await this.checkUrl(target);
           if (refused) return refused;
-          await this.page.goto(target, { waitUntil: "domcontentloaded", timeout: 30000 });
+          const response = await this.page.goto(target, { waitUntil: "domcontentloaded", timeout: 30000 });
+          if (!this.landing) {
+            // The first page: the address asked for, each redirect on the way, and where it ended up.
+            const chain = [];
+            for (let r = response?.request(); r; r = r.redirectedFrom()) chain.unshift(r.url());
+            this.landing = { step: this.currentStep, requested: target, chain, final: this.page.url() };
+          }
           break;
         }
         case "click":

package/src/campaign.js

@@ -0,0 +1,28 @@
+// Campaign parameters an ad click puts on the landing address. They have to survive the site's
+// redirects and show up in the page address its tags report, or the visit is credited to "direct".
+
+export const CLICK_IDS = ["gclid", "wbraid", "gbraid", "fbclid", "ttclid", "msclkid"];
+export const UTM_PARAMS = ["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content"];
+export const CAMPAIGN_PARAMS = [...CLICK_IDS, ...UTM_PARAMS];
+
+// Values a run adds to a landing address that has none of its own. Hits are held back by default
+// (block_hits), so these never reach a real analytics property.
+const TEST_PARAMS = { utm_source: "aitd", utm_medium: "check", utm_campaign: "aitd-campaign-check", gclid: "aitd-gclid", fbclid: "aitd-fbclid" };
+
+/** The campaign parameters in an address, as {name: value}. */
+export function campaignParamsIn(url) {
+  try {
+    const u = new URL(url);
+    return Object.fromEntries(CAMPAIGN_PARAMS.filter((n) => u.searchParams.get(n)).map((n) => [n, u.searchParams.get(n)]));
+  } catch {
+    return {};
+  }
+}
+
+/** The address with test campaign parameters added, unless it already carries campaign parameters. */
+export function withCampaignParams(url) {
+  if (Object.keys(campaignParamsIn(url)).length) return url;
+  const u = new URL(url);
+  for (const [k, v] of Object.entries(TEST_PARAMS)) u.searchParams.set(k, v);
+  return u.href;
+}

package/src/changes.js

@@ -2,7 +2,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { messages } from "./i18n.js";
 import { platformLabel } from "./report.js";
-import { listRunIds, runsDir } from "./workspace.js";
+import { PLAN_FILE, listPlanIds, listRunIds, plansDir, runsDir } from "./workspace.js";
 
 const PROBLEMS = new Set(["broken", "risk", "warning"]);
 const PLAN_PROBLEMS = new Set(["missing", "missing_params", "wrong_values"]);
@@ -143,3 +143,40 @@ export function changesLines(ch, lang = "en") {
     ...(ch.routes?.length ? [m.ui.routeChanged(ch.routes.map((r) => `${r.journeyId} (${r.viewport})`).join(", "))] : []),
   ];
 }
+
+const planKey = (e) => [e.platform ?? "ga4", e.name].join("|");
+const sortedList = (v) => JSON.stringify([...(v ?? [])].sort());
+
+/** What differs for an event kept in both plans: its required parameters, parameter list or journeys. */
+function eventChanges(a, b) {
+  const out = [];
+  if (sortedList(a.required_params) !== sortedList(b.required_params)) out.push("required parameters");
+  if (sortedList(Object.keys(a.parameters ?? {})) !== sortedList(Object.keys(b.parameters ?? {}))) out.push("parameters");
+  if (sortedList(a.journeys) !== sortedList(b.journeys)) out.push("journeys");
+  return out;
+}
+
+/**
+ * How a plan differs from the version before it: events added, removed and changed.
+ * Returns null when there is no earlier version, else { previous, added, removed, changed, same }.
+ */
+export function comparePlans(prevPlan, plan, previousId = null) {
+  if (!prevPlan || !plan) return null;
+  const before = new Map((prevPlan.events ?? []).map((e) => [planKey(e), e]));
+  const now = new Map((plan.events ?? []).map((e) => [planKey(e), e]));
+  const label = (e) => ({ platform: e.platform ?? "ga4", event: e.name });
+  const added = [...now].filter(([k]) => !before.has(k)).map(([, e]) => label(e));
+  const removed = [...before].filter(([k]) => !now.has(k)).map(([, e]) => label(e));
+  const changed = [...now].filter(([k]) => before.has(k)).map(([k, e]) => ({ ...label(e), what: eventChanges(before.get(k), e) })).filter((c) => c.what.length);
+  return { previous: previousId, added, removed, changed, same: !added.length && !removed.length && !changed.length };
+}
+
+/** The saved plan right before `planId` for the site, compared with `plan`; null for the first version or an unsaved plan. */
+export async function previousPlanChanges(dataDir, site, planId, plan) {
+  if (!planId) return null;
+  const ids = await listPlanIds(dataDir, site);
+  const prevId = ids.filter((id) => id < planId).at(-1);
+  if (!prevId) return null;
+  const prevPlan = await readJson(path.join(plansDir(dataDir, site), prevId, PLAN_FILE));
+  return comparePlans(prevPlan, plan, prevId);
+}

package/src/checks.js

@@ -3,6 +3,7 @@
 
 import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
+import { campaignParamsIn } from "./campaign.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -296,6 +297,33 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
+  // Campaign parameters (gclid, fbclid, UTM) on the landing address: they must survive redirects and reach the hits.
+  const landing = run.landing;
+  const sent = landing ? campaignParamsIn(landing.requested) : {};
+  if (landing && Object.keys(sent).length) {
+    const kept = campaignParamsIn(landing.final);
+    const lost = Object.keys(sent).filter((n) => kept[n] !== sent[n]);
+    const hop = landing.chain.length > 1 ? landing.chain : null;
+    if (lost.length) {
+      findings.push({ ...base, severity: "broken", check: "campaign_lost_redirect", step: stepLabel(landing.step), detail: d.campaignLost(lost, landing.final), evidence: hop ? hop.join(" -> ") : undefined });
+    }
+    // Hits the landing page sent whose page address leaves out a parameter the page still had.
+    const missing = new Map();
+    for (const hit of run.hits) {
+      const loc = hit.params?.page_location;
+      if (hit.step !== landing.step || !loc || hit.platform === "google_ads") continue;
+      const here = campaignParamsIn(loc);
+      const gone = Object.keys(kept).filter((n) => kept[n] === sent[n] && here[n] !== sent[n] && hit.params?.[n] !== sent[n]);
+      if (gone.length && !missing.has(hit.platform)) missing.set(hit.platform, { hit, gone });
+    }
+    for (const [platform, { hit, gone }] of missing) {
+      findings.push({ ...base, severity: "broken", check: "campaign_missing_in_hits", platform, event: hit.name, step: stepLabel(hit.step), detail: d.campaignMissingInHits(platform, hit.name, gone), evidence: hit.params.page_location });
+    }
+    if (!lost.length && !missing.size) {
+      findings.push({ ...base, severity: "ok", check: "campaign_params", step: stepLabel(landing.step), detail: d.campaignOk(Object.keys(sent)) });
+    }
+  }
+
   // Consent.
   const granted = consentGrantedStep(run);
   // Consent Mode only governs Google tags. Within one step, the push and hit times decide which came first.

package/src/cli.js

@@ -205,6 +205,8 @@ async function main(args = process.argv.slice(2)) {
   const rel = path.relative(process.cwd(), result.reportPath);
   console.log(`Report: ${rel.startsWith("..") ? result.reportPath : rel}`);
 
+  if (!against && !values.out) await offerLearnedPlan(result, loaded.config.site, values);
+
   if (failOn !== "never") {
     const threshold = levels.indexOf(failOn);
     if (levels.slice(0, threshold + 1).some((l) => result.counts[l] > 0)) process.exitCode = 1;
@@ -222,6 +224,26 @@ async function main(args = process.argv.slice(2)) {
   }
 }
 
+// The first run of a site with no plan: offer what it already tracks as its plan.
+async function offerLearnedPlan(result, site, values) {
+  const dataDir = values["data-dir"] ?? DEFAULT_DATA_DIR;
+  const { listPlanIds } = await import("./workspace.js");
+  if ((await listPlanIds(dataDir, site).catch(() => [])).length) return;
+  const { learnPlan } = await import("./learn.js");
+  const plan = learnPlan(site, result.runs);
+  if (!plan) return;
+  console.log(`\nNo plan yet for this site. It already sends ${plan.events.length} ${plan.events.length === 1 ? "event" : "events"}: ${plan.events.map((e) => `${e.platform}:${e.name}`).join(", ")}`);
+  let save = values.yes;
+  if (!save && process.stdin.isTTY) save = ["", "y", "yes"].includes((await ask("Save them as the site's plan? (Y/n) ")).toLowerCase());
+  if (!save) {
+    if (!process.stdin.isTTY && !values.yes) console.log("Add --yes to save them as the plan, or draft a fuller one with: aitd plan --site " + site);
+    return;
+  }
+  const { id, dir } = await savePlan(plan, { dataDir, site, branding: !values["no-branding"] });
+  const rel = path.relative(process.cwd(), dir);
+  console.log(`✓ Saved plan ${id} in ${rel.startsWith("..") ? dir : rel}. Next runs can check against it with --against latest.`);
+}
+
 // aitd "check my GA tags": shows the matching command and runs it once confirmed.
 async function fromSentence(sentence, values, extra) {
   const { createProvider } = await import("./providers.js");

package/src/consent.js

@@ -0,0 +1,154 @@
+// Consent scenarios: the start page opened in a fresh browser once per consent choice
+// (accept all, reject all, analytics only), to show which tags each choice lets through.
+// Runs on its own with every audit when the page shows a consent banner.
+import { AuditSession, CMP_BANNER_SELECTORS } from "./browser.js";
+
+export const CONSENT_STATES = ["accept", "reject", "analytics"];
+// Tags that are advertising, so an "analytics only" choice should keep them quiet.
+export const AD_PLATFORMS = new Set(["google_ads", "meta", "tiktok", "pinterest", "snapchat", "x"]);
+
+// Runs in the page: makes the choice through the consent platform's own API when it has one,
+// otherwise by clicking the banner's accept or reject button. Returns how, or null when it could not.
+const applyInPage = ({ state, selectors }) => {
+  const w = window;
+  try {
+    if (w.OneTrust?.AllowAll) {
+      if (state === "accept") w.OneTrust.AllowAll();
+      else {
+        w.OneTrust.RejectAll();
+        // C0002 is OneTrust's performance (analytics) group.
+        if (state === "analytics") w.OneTrust.UpdateConsent?.("Category", "C0002:1");
+      }
+      return "OneTrust";
+    }
+    if (w.Cookiebot?.submitCustomConsent) {
+      // preferences, statistics, marketing
+      w.Cookiebot.submitCustomConsent(state === "accept", state !== "reject", state === "accept");
+      return "Cookiebot";
+    }
+    if (state !== "analytics") {
+      if (w.UC_UI?.acceptAllConsents) {
+        state === "accept" ? w.UC_UI.acceptAllConsents() : w.UC_UI.denyAllConsents();
+        return "Usercentrics";
+      }
+      if (w.Didomi?.setUserAgreeToAll) {
+        state === "accept" ? w.Didomi.setUserAgreeToAll() : w.Didomi.setUserDisagreeToAll();
+        return "Didomi";
+      }
+    }
+  } catch {
+    // An API that throws falls back to the banner's buttons.
+  }
+  if (state === "analytics") return null;
+  const words = state === "accept"
+    ? /^(accept|allow|agree|ok|got it|kabul|tümünü kabul|izin ver|onayla|alle akzeptieren|tout accepter)/i
+    : /^(reject|decline|deny|refuse|necessary only|only necessary|reddet|kabul etme|ablehnen|tout refuser)/i;
+  const visible = (el) => !!(el.offsetWidth || el.offsetHeight || el.getClientRects().length);
+  const banners = [...document.querySelectorAll(selectors)].filter(visible);
+  for (const n of document.querySelectorAll("body *")) {
+    const label = `${n.id} ${typeof n.className === "string" ? n.className : ""}`;
+    if (/(cookie|consent|gdpr|kvkk)/i.test(label) && visible(n) && !banners.some((b) => b.contains(n))) banners.push(n);
+  }
+  for (const banner of banners) {
+    const button = [...banner.querySelectorAll("button, a, [role=button], input[type=button], input[type=submit]")]
+      .filter(visible)
+      .find((b) => words.test((b.innerText || b.value || b.getAttribute("aria-label") || "").trim()));
+    if (button) {
+      button.click();
+      return "banner";
+    }
+  }
+  return null;
+};
+
+// A Google hit that says storage is denied is a cookieless Consent Mode ping, which a "no" allows.
+const cookieless = (h) => !!h.consent && h.consent.ad_storage !== "granted" && h.consent.analytics_storage !== "granted";
+const isAnalyticsOnlyOk = (h) => !!h.consent && h.consent.ad_storage !== "granted";
+
+/** Hits per platform and event: { n, quiet } where quiet counts the ones sent with storage denied. */
+const countBy = (hits) => {
+  const out = {};
+  for (const h of hits) {
+    const c = ((out[h.platform] ??= {})[h.name] ??= { n: 0, cookieless: 0, adDenied: 0 });
+    c.n++;
+    if (cookieless(h)) c.cookieless++;
+    if (isAnalyticsOnlyOk(h)) c.adDenied++;
+  }
+  return out;
+};
+
+/** Opens the start page, makes one consent choice, opens the page again, and returns the hits before and after. */
+async function runState(config, state, opts) {
+  const session = new AuditSession({
+    viewport: "desktop", site: config.site, allowedHosts: config.allowed_hosts, providers: config.providers,
+    blockHits: config.block_hits !== false, headless: !opts.headed,
+  });
+  try {
+    await session.start();
+    const startError = await session.act({ action: "goto", url: config.site, reason: "Open the start page" });
+    if (startError) return { state, error: startError };
+    session.beginStep(`Choose: ${state}`);
+    const via = await session.page.evaluate(applyInPage, { state, selectors: CMP_BANNER_SELECTORS }).catch(() => null);
+    if (!via) return { state, via: null, before: countBy(session.hits) };
+    await session.settle();
+    session.beginStep("Open the start page again");
+    await session.page.reload().catch(() => {});
+    await session.settle();
+    const choice = session.steps.find((s) => s.label.startsWith("Choose:")).index;
+    return {
+      state, via,
+      before: countBy(session.hits.filter((h) => h.step < choice)),
+      after: countBy(session.hits.filter((h) => h.step >= choice)),
+    };
+  } catch (err) {
+    return { state, error: err?.message ?? String(err) };
+  } finally {
+    await session.close().catch(() => {});
+  }
+}
+
+/**
+ * Runs every consent scenario on the site's start page. Returns null when the page has no consent
+ * banner the tool can answer (the first choice found nothing to click), so the report leaves the section out.
+ * @returns {Promise<null | { cmp: string, before: object, states: Record<string, { via: string|null, after?: object, error?: string }> }>}
+ */
+export async function runConsentScenarios(config, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const first = await runState(config, "accept", opts);
+  if (!first.via) return null;
+  log(`\n▶ consent scenarios (${first.via})`);
+  const results = [first];
+  for (const state of CONSENT_STATES.slice(1)) results.push(await runState(config, state, opts));
+  const states = {};
+  for (const r of results) {
+    states[r.state] = r.error ? { via: null, error: r.error } : { via: r.via, ...(r.after ? { after: r.after } : {}) };
+    log(`  ${r.state}: ${r.error ? `✗ ${r.error}` : r.via ? `${Object.values(r.after ?? {}).reduce((s, e) => s + Object.values(e).reduce((a, b) => a + b.n, 0), 0)} tracking hits` : "not supported here"}`);
+  }
+  return { cmp: first.via, before: first.before, states };
+}
+
+/**
+ * The per-state tag table: one row per platform and event, one cell per state (hit count, or null when
+ * the state did not run). A cell is a problem when a tag sent hits a choice should have kept quiet:
+ * anything after "reject all" except cookieless Consent Mode pings, and ad tags after "analytics only"
+ * unless they were sent with ad storage denied.
+ */
+export function consentTable(scenarios) {
+  const keys = new Set();
+  const add = (counts) => Object.entries(counts ?? {}).forEach(([p, events]) => Object.keys(events).forEach((e) => keys.add(`${p}\u0000${e}`)));
+  add(scenarios.before);
+  for (const s of Object.values(scenarios.states)) add(s.after);
+  const cols = ["before", ...CONSENT_STATES];
+  const rows = [...keys].sort().map((k) => {
+    const [platform, event] = k.split("\u0000");
+    const cells = cols.map((col) => {
+      const s = col === "before" ? { after: scenarios.before } : scenarios.states[col];
+      if (!s?.after) return { state: col, count: null, problem: false };
+      const c = s.after[platform]?.[event] ?? { n: 0, cookieless: 0, adDenied: 0 };
+      const problem = (col === "reject" && c.n > c.cookieless) || (col === "analytics" && AD_PLATFORMS.has(platform) && c.n > c.adDenied);
+      return { state: col, count: c.n, problem };
+    });
+    return { platform, event, cells };
+  });
+  return { cols, rows };
+}

package/src/i18n.js

@@ -95,6 +95,7 @@ const en = {
     sections: "Report sections",
     headerMeta: (journeys, providers) => `${journeys} ${journeys === 1 ? "journey" : "journeys"} · ${providers} ${providers === 1 ? "provider" : "providers"}`,
     checkedAgainst: (id) => `Checked against plan ${id}`,
+    planChangesLine: (pc) => (pc.same ? `Plan unchanged since ${pc.previous}` : `Plan changed since ${pc.previous}: ${pc.added.length} added, ${pc.removed.length} removed, ${pc.changed.length} changed`),
     planVsSite: "Plan vs. site",
     changesTitle: "Changed since last run",
     changesLead: (id, mode) => `Compared with run ${id}, by ${mode === "plan" ? "plan coverage" : "health findings"}`,
@@ -132,6 +133,11 @@ const en = {
     consentUpdate: "Update",
     consentLead: "Consent Mode commands the site sent, in order.",
     consentNone: "The site sent no Consent Mode commands on this journey.",
+    scenarios: "Consent scenarios",
+    scenariosLead: (cmp) => `The start page opened once per consent choice (answered through ${cmp === "banner" ? "the banner's buttons" : cmp}). Hits per tag after the choice; red ones should not have been sent.`,
+    scenarioCols: { before: "No choice yet", accept: "Accept all", reject: "Reject all", analytics: "Analytics only" },
+    scenarioNotRun: "Not supported here",
+    scenarioTag: "Tag",
     skippedLine: (list, n) => `${n} out-of-scope ${n === 1 ? "request was" : "requests were"} skipped: ${list}.`,
     findingHint: "Open a finding to see its likely cause, evidence and fix steps.",
     spread: (j, s) => `${j} ${j === 1 ? "journey" : "journeys"}${s ? ` · ${s} ${s === 1 ? "step" : "steps"}` : ""}`,
@@ -145,6 +151,16 @@ const en = {
     notChecked: "not checked",
     noPlan: "No measurement plan was given, so there is nothing to compare against.",
     providers: "Providers",
+    inventoryTitle: "Tag inventory",
+    inventoryLead: "Every vendor the site sent requests to, and where",
+    vendorCol: "Vendor",
+    partyCol: "Party",
+    pagesCol: "Pages",
+    cookiesCol: "Cookies",
+    party: { first: "First party", third: "Third party", both: "Both" },
+    morePages: (n) => `+${n} more`,
+    otherCookies: "Other cookies",
+    noInventory: "No vendor requests were recorded.",
     provider: "Provider",
     requestsCol: "Requests",
     checked: "Checked",
@@ -168,6 +184,9 @@ const en = {
     purchaseMismatch: (id, diffs) => `GA4 and Meta reported ${id ? `order ${q(id)}` : "the purchase"} differently: ${diffs.map(([f, g, m]) => `${f} ${q(g)} in GA4 and ${q(m)} in Meta`).join("; ")}. One of the tags reads the wrong data.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}.${unseen.length ? ` Server-side copies of ${unseen.join(" and ")} events never pass through the browser, so they can't be seen here.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} was sent from the browser without an event ID, while a server-side setup was seen on this site. If the server also sends this event, ${platform} can't match the two and counts it twice.`,
+    campaignLost: (names, finalUrl) => `The landing address carried ${names.join(", ")}, but the page ended up on ${finalUrl} without ${names.length === 1 ? "it" : "them"}. A redirect dropped ${names.length === 1 ? "the parameter" : "the parameters"}, so ad clicks lose their attribution.`,
+    campaignMissingInHits: (platform, name, names) => `${platform} ${q(name)} on the landing page reports a page address without ${names.join(", ")}, though the page still had ${names.length === 1 ? "it" : "them"}. The visit can be credited to direct traffic instead of the campaign.`,
+    campaignOk: (names) => `${names.join(", ")} survived the landing page's redirects and reached the hits.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)} fired although consent was never given in this journey.`,
@@ -282,6 +301,7 @@ const tr = {
     sections: "Rapor bölümleri",
     headerMeta: (journeys, providers) => `${journeys} yolculuk · ${providers} sağlayıcı`,
     checkedAgainst: (id) => `${id} planına göre kontrol edildi`,
+    planChangesLine: (pc) => (pc.same ? `Plan ${pc.previous} sürümünden bu yana değişmedi` : `Plan ${pc.previous} sürümünden bu yana değişti: ${pc.added.length} eklendi, ${pc.removed.length} çıkarıldı, ${pc.changed.length} değişti`),
     planVsSite: "Plan ve site",
     changesTitle: "Son çalıştırmadan bu yana değişenler",
     changesLead: (id, mode) => `${id} çalıştırmasıyla ${mode === "plan" ? "plan kapsamına" : "sağlık bulgularına"} göre karşılaştırıldı`,
@@ -319,6 +339,11 @@ const tr = {
     consentUpdate: "Güncelleme",
     consentLead: "Sitenin gönderdiği Consent Mode komutları, sırasıyla.",
     consentNone: "Site bu yolculukta Consent Mode komutu göndermedi.",
+    scenarios: "Onay senaryoları",
+    scenariosLead: (cmp) => `Başlangıç sayfası her onay seçimi için ayrı açıldı (${cmp === "banner" ? "banner butonlarıyla" : cmp} üzerinden yanıtlandı). Seçimden sonra etiket başına istek sayısı; kırmızılar gönderilmemeliydi.`,
+    scenarioCols: { before: "Henüz seçim yok", accept: "Tümünü kabul", reject: "Tümünü reddet", analytics: "Yalnızca analitik" },
+    scenarioNotRun: "Burada desteklenmiyor",
+    scenarioTag: "Etiket",
     skippedLine: (list, n) => `Kapsam dışı ${n} istek atlandı: ${list}.`,
     findingHint: "Bir bulguyu açınca olası neden, kanıt ve çözüm adımları görünür.",
     spread: (j, s) => `${j} yolculuk${s ? ` · ${s} adım` : ""}`,
@@ -332,6 +357,16 @@ const tr = {
     notChecked: "kontrol edilmedi",
     noPlan: "Ölçüm planı verilmediği için karşılaştırılacak bir şey yok.",
     providers: "Sağlayıcılar",
+    inventoryTitle: "Etiket envanteri",
+    inventoryLead: "Sitenin istek gönderdiği tüm sağlayıcılar ve hangi sayfalarda",
+    vendorCol: "Sağlayıcı",
+    partyCol: "Taraf",
+    pagesCol: "Sayfalar",
+    cookiesCol: "Çerezler",
+    party: { first: "Birinci taraf", third: "Üçüncü taraf", both: "İkisi de" },
+    morePages: (n) => `+${n} daha`,
+    otherCookies: "Diğer çerezler",
+    noInventory: "Sağlayıcıya giden istek kaydedilmedi.",
     provider: "Sağlayıcı",
     requestsCol: "İstek",
     checked: "Kontrol edildi",
@@ -355,6 +390,9 @@ const tr = {
     purchaseMismatch: (id, diffs) => `GA4 ve Meta ${id ? `${q(id)} siparişini` : "satın almayı"} farklı bildirdi: ${diffs.map(([f, g, m]) => `${f === "value" ? "değer" : "para birimi"} GA4'te ${q(g)}, Meta'da ${q(m)}`).join("; ")}. Etiketlerden biri yanlış veriyi okuyor.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}.${unseen.length ? ` ${unseen.join(" ve ")} olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.` : ""}`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} tarayıcıdan olay kimliği olmadan gönderildi; sitede sunucu tarafı bir kurulum görüldü. Sunucu da bu olayı gönderiyorsa ${platform} ikisini eşleştiremez ve iki kez sayar.`,
+    campaignLost: (names, finalUrl) => `Açılış adresi ${names.join(", ")} taşıyordu, ancak sayfa ${finalUrl} adresinde ${names.length === 1 ? "onsuz" : "onlarsız"} sonlandı. Bir yönlendirme ${names.length === 1 ? "parametreyi" : "parametreleri"} düşürdü, bu yüzden reklam tıklamalarının atfı kaybolur.`,
+    campaignMissingInHits: (platform, name, names) => `Açılış sayfasındaki ${platform} ${q(name)} isteği ${names.join(", ")} olmadan bir sayfa adresi bildiriyor, oysa sayfada ${names.length === 1 ? "o" : "onlar"} hâlâ vardı. Ziyaret kampanyaya değil doğrudan trafiğe yazılabilir.`,
+    campaignOk: (names) => `${names.join(", ")} açılış sayfasının yönlendirmelerinden geçti ve isteklere ulaştı.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)}, bu yolculukta hiç onay verilmemesine rağmen tetiklendi.`,

package/src/inventory.js

@@ -0,0 +1,69 @@
+import { providerOf } from "./parsers.js";
+import { siteOf } from "./redact.js";
+
+// Cookies the vendors' own scripts set on the site's domain.
+const COOKIE_VENDORS = [
+  [/^(_ga|_gid|_gat)(_|$)/, "ga4"],
+  [/^(_gcl_|_gac_|IDE$|test_cookie$)/, "google_ads"],
+  [/^_fb[pc]$/, "meta"],
+  [/^(_ttp|ttclid|_tt_enable_cookie)$/, "tiktok"],
+  [/^(_li_|li_|bcookie|lidc|UserMatchHistory)/, "linkedin"],
+  [/^(_uet|MUID)/, "microsoft_ads"],
+  [/^(_pin_|_pinterest_)/, "pinterest"],
+  [/^(_scid|sc_at)/, "snapchat"],
+  [/^(_cto_|cto_)/, "criteo"],
+  [/^__kla_id$/, "klaviyo"],
+  [/^_hj/, "hotjar"],
+  [/^_clck|^_clsk/, "clarity"],
+];
+
+const hostOf = (url) => {
+  try { return new URL(url).hostname; } catch { return ""; }
+};
+
+const pathOf = (url) => {
+  try { const u = new URL(url); return `${u.hostname}${u.pathname}`; } catch { return ""; }
+};
+
+/**
+ * Every vendor the site talked to: the pages it loaded or sent from, whether its requests went to the
+ * site's own domain (first party) or to the vendor (third party), and the cookie names tied to it.
+ * Cookies no vendor owns are listed apart. Only cookie names are kept, never values.
+ */
+export function buildInventory(runs) {
+  const vendors = new Map();
+  for (const r of runs) {
+    for (const c of r.network ?? []) {
+      if (!c.vendor || !c.pageUrl) continue;
+      const v = vendors.get(c.vendor) ?? { vendor: c.vendor, keys: new Set(), pages: new Set(), first: 0, third: 0, requests: 0, cookies: new Set() };
+      v.keys.add(c.provider);
+      v.pages.add(pathOf(c.pageUrl));
+      v.requests++;
+      v[siteOf(hostOf(c.url)) === siteOf(hostOf(c.pageUrl)) ? "first" : "third"]++;
+      vendors.set(c.vendor, v);
+    }
+  }
+  const other = new Map();
+  for (const r of runs) {
+    for (const ck of r.cookieLog ?? []) {
+      const domain = String(ck.domain ?? "").replace(/^\./, "");
+      const key = COOKIE_VENDORS.find(([re]) => re.test(ck.name))?.[1] ?? providerOf(`https://${domain}/`)?.key;
+      const owners = [...vendors.values()].filter((v) => key && v.keys.has(key));
+      if (owners.length) for (const v of owners) v.cookies.add(ck.name);
+      else other.set(`${domain}|${ck.name}`, { name: ck.name, domain });
+    }
+  }
+  const sites = new Set(runs.flatMap((r) => (r.network ?? []).map((c) => c.pageUrl)).filter(Boolean).map((u) => siteOf(hostOf(u))));
+  return {
+    vendors: [...vendors.values()]
+      .map((v) => ({
+        vendor: v.vendor,
+        party: v.first && v.third ? "both" : v.first ? "first" : "third",
+        pages: [...v.pages].sort(),
+        requests: v.requests,
+        cookies: [...v.cookies].sort(),
+      }))
+      .sort((a, b) => b.pages.length - a.pages.length || a.vendor.localeCompare(b.vendor)),
+    otherCookies: [...other.values()].map((c) => ({ name: c.name, party: sites.has(siteOf(c.domain)) ? "first" : "third" })).sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}

package/src/learn.js

@@ -0,0 +1,34 @@
+import { PROVIDERS } from "./parsers.js";
+
+/**
+ * A plan learned from what a site already sends: one event per platform and event name seen in
+ * the runs, the parameters it carried,. Parameters sent with every
+ * hit of an event become its required parameters. Values are not copied, so nothing a visitor typed
+ * ends up in the plan. Returns null when the runs captured no named events.
+ */
+export function learnPlan(site, runs) {
+  const byKey = new Map();
+  for (const run of runs) {
+    for (const hit of run.hits ?? []) {
+      if (!hit?.platform || !hit.name || hit.name === "(unnamed)") continue;
+      const k = `${hit.platform}:${hit.name}`;
+      let ev = byKey.get(k);
+      if (!ev) byKey.set(k, (ev = { platform: hit.platform, name: hit.name, hits: 0, params: new Map() }));
+      ev.hits++;
+      for (const p of Object.keys(hit.params ?? {})) ev.params.set(p, (ev.params.get(p) ?? 0) + 1);
+    }
+  }
+  if (!byKey.size) return null;
+  const events = [...byKey.values()].map((ev) => {
+    const required = [...ev.params].filter(([, n]) => n === ev.hits).map(([p]) => p);
+    return {
+      platform: ev.platform,
+      name: ev.name,
+      description: `Learned from what ${PROVIDERS[ev.platform] ?? ev.platform} received on the site.`,
+      ...(required.length ? { required_params: required } : {}),
+      parameters: Object.fromEntries([...ev.params.keys()].map((p) => [p, {}])),
+      seen: true,
+    };
+  });
+  return { site, learned: true, consent_mode: true, pages: [], events, user_properties: [] };
+}

package/src/redact.js

@@ -22,7 +22,7 @@ const SHARED_SECOND_LEVELS = new Set(["com", "co", "org", "net", "gov", "edu", "
 const SHARED_SUFFIXES = ["myshopify.com", "github.io", "vercel.app", "pages.dev", "netlify.app", "herokuapp.com", "web.app", "firebaseapp.com", "appspot.com", "wixsite.com", "blogspot.com", "azurewebsites.net", "cloudfront.net", "workers.dev"];
 
 /** "www.shop.example.com.tr" -> "example.com.tr", "a.shop.myshopify.com" -> "shop.myshopify.com": the part one owner controls. */
-function siteOf(host) {
+export function siteOf(host) {
   const labels = String(host).toLowerCase().replace(/\.$/, "").split(".");
   const name = labels.join(".");
   const shared = SHARED_SUFFIXES.find((s) => name === s || name.endsWith(`.${s}`));

package/src/report.js

@@ -1,9 +1,11 @@
+import { consentTable } from "./consent.js";
 import { OWNERS, ownerOf, verifyLinks } from "./verify.js";
 import { createProvider } from "./providers.js";
 import { groupFindings, hitMatchesEvent, summarize } from "./checks.js";
 import { messages } from "./i18n.js";
 import { parseTrackingRequest, providerOf, PROVIDERS } from "./parsers.js";
 import { decodeGa4Item, isEventParam, paramTip } from "./glossary.js";
+import { buildInventory } from "./inventory.js";
 import { LOGOS } from "./brand.js";
 import { readFileSync } from "node:fs";
 
@@ -152,19 +154,27 @@ const mdCode = (v) => String(v ?? "").replace(/`/g, "'").replace(/\n/g, " ");
 
 const routeList = (ch) => (ch?.routes ?? []).map((r) => `${r.journeyId} (${r.viewport})`).join(", ");
 
-export function renderMarkdown({ title, generatedAt, findings, explained, runs, lang = "en", branding = true, against = null, planCheck = null, changes = null }) {
+export function renderMarkdown({ title, generatedAt, findings, explained, runs, lang = "en", branding = true, against = null, planCheck = null, changes = null, planChanges = null, consentScenarios = null }) {
   const m = messages(lang);
   const rows = attachExplanations(findings, explained);
   const counts = summarize(rows);
-  const lines = [`# ${mdText(title)}`, "", m.ui.generated(generatedAt), "", ...(against ? [mdText(m.ui.checkedAgainst(against)), ""] : []), ...(changes?.routes?.length ? [mdText(m.ui.routeChanged(routeList(changes))), ""] : []), `**${m.ui.counts(counts)}**`, ""];
+  const lines = [`# ${mdText(title)}`, "", m.ui.generated(generatedAt), "", ...(against ? [mdText(m.ui.checkedAgainst(against)), ""] : []), ...(planChanges ? [mdText(m.ui.planChangesLine(planChanges)), "", ...planChangeItems(planChanges).map((i) => `- ${mdText(i)}`), ...(planChangeItems(planChanges).length ? [""] : [])] : []), ...(changes?.routes?.length ? [mdText(m.ui.routeChanged(routeList(changes))), ""] : []), `**${m.ui.counts(counts)}**`, ""];
   if (changes) lines.push(...changesMd(m, changes));
   if (planCheck) lines.push(...planVsSiteMd(m, planCheck));
+  lines.push(...inventoryMd(m, runs));
   const sum = summaryParts(explained?.summary);
   if (sum) {
     lines.push(`## ${m.ui.summary}`, "", sum.text ? mdText(sum.text) : `**${mdText(sum.headline)}**`, "");
     if (sum.points.length) lines.push(...sum.points.map((p) => `- **${m.severity[p.severity]}**: ${mdText(p.text)}`), "");
     if (sum.also_check.length) lines.push(`### ${m.ui.alsoCheck}`, "", ...sum.also_check.map((t) => `- ${mdText(t)}`), "");
   }
+  if (consentScenarios) {
+    const { cols, rows: tagRows } = consentTable(consentScenarios);
+    lines.push(`## ${m.ui.scenarios}`, "", mdText(m.ui.scenariosLead(consentScenarios.cmp)), "");
+    lines.push(`| ${m.ui.scenarioTag} | ${cols.map((c) => m.ui.scenarioCols[c]).join(" | ")} |`, `|${" --- |".repeat(cols.length + 1)}`);
+    for (const r of tagRows) lines.push(`| ${mdText(platformLabel(r.platform))} \`${mdCode(r.event)}\` | ${r.cells.map((c) => (c.count === null ? "–" : c.problem ? `**${c.count}** ⚠` : String(c.count))).join(" | ")} |`);
+    lines.push("");
+  }
   lines.push(`## ${m.ui.findings}`, "");
   for (const f of rows.filter((r) => r.severity !== "ok")) {
     lines.push(`### ${m.severity[f.severity]}: ${mdText(f.detail)}`, "");
@@ -558,10 +568,20 @@ function journeyPanel(m, lang, findings, run, ri, flagged) {
 ${consentCard(m, run)}${body}</article>`;
 }
 
-function journeysTab(m, lang, findings, runs, flagged) {
-  if (!runs.length) return `<p class="empty">${m.ui.noSteps}</p>`;
+/** Consent scenarios: one row per tag, one column per consent choice, hit counts after the choice. */
+function scenariosCard(m, scenarios) {
+  if (!scenarios) return "";
+  const { cols, rows } = consentTable(scenarios);
+  const head = `<tr><th>${m.ui.scenarioTag}</th>${cols.map((c) => `<th>${m.ui.scenarioCols[c]}</th>`).join("")}</tr>`;
+  const body = rows.map((r) => `<tr><td><span class="ptag p-${safeKey(r.platform)}">${escapeHtml(platformLabel(r.platform))}</span> <code>${escapeHtml(r.event)}</code></td>${r.cells.map((c) => (c.count === null ? `<td class="muted xs">–</td>` : `<td class="num${c.problem ? " bad" : ""}">${c.count}</td>`)).join("")}</tr>`).join("");
+  const notRun = cols.filter((c) => c !== "before" && !scenarios.states[c]?.via).map((c) => m.ui.scenarioCols[c]);
+  return `<div class="card jconsent scenarios"><div class="card-h"><div class="card-t">${m.ui.scenarios}</div><div class="card-d">${escapeHtml(m.ui.scenariosLead(scenarios.cmp))}${notRun.length ? ` ${escapeHtml(m.ui.scenarioNotRun)}: ${escapeHtml(notRun.join(", "))}.` : ""}</div></div><div class="card-c tight"><table class="dt"><thead>${head}</thead><tbody>${body}</tbody></table></div></div>`;
+}
+
+function journeysTab(m, lang, findings, runs, flagged, scenarios = null) {
+  if (!runs.length) return `${scenariosCard(m, scenarios)}<p class="empty">${m.ui.noSteps}</p>`;
   const tabs = runs.map((r, ri) => `<a href="#j${ri}">${escapeHtml(r.journeyId)} <span class="muted">· ${escapeHtml(r.viewport)}</span><span class="n">${problemCount(findings, r)}</span></a>`).join("");
-  return `<nav class="jtabs" aria-label="${m.ui.chooseJourney}">${tabs}</nav>\n${runs.map((r, ri) => journeyPanel(m, lang, findings, r, ri, flagged)).join("\n")}`;
+  return `${scenariosCard(m, scenarios)}<nav class="jtabs" aria-label="${m.ui.chooseJourney}">${tabs}</nav>\n${runs.map((r, ri) => journeyPanel(m, lang, findings, r, ri, flagged)).join("\n")}`;
 }
 
 /** Evidence as a table when it is a JSON object (captured parameters), otherwise as text. */
@@ -704,6 +724,12 @@ const coverageLines = (m, pc) => [
 const pcSort = (pc) => [...pc.events].sort((a, b) => BUCKET_ORDER.indexOf(a.bucket) - BUCKET_ORDER.indexOf(b.bucket) || platformRank(a.platform) - platformRank(b.platform));
 const BUCKET_ORDER = ["missing", "missing_params", "wrong_values", "implemented", "unplanned", "not_checked"];
 
+const planChangeItems = (pc) => [
+  ...pc.added.map((c) => `+ ${changeLabel(c)}`),
+  ...pc.removed.map((c) => `− ${changeLabel(c)}`),
+  ...pc.changed.map((c) => `~ ${changeLabel(c)}: ${c.what.join(", ")}`),
+];
+
 /** "Changed since last run": one headline, then what was fixed and what is new. */
 const changeLabel = (c) => `${platformLabel(c.platform ?? "")} ${c.event ?? ""}`.trim() || c.check;
 const changeItems = (m, ch) => [
@@ -761,6 +787,30 @@ function coverageCard(m, plan, runs) {
   return `<div class="card">${head}<div class="card-c"><div class="tscroll"><table class="dt cov"><thead><tr><th>${m.ui.event}</th>${runs.map((r) => `<th>${escapeHtml(r.journeyId)} · ${escapeHtml(r.viewport)}</th>`).join("")}</tr></thead><tbody>${body}</tbody></table></div><p class="muted xs legend">${m.ui.coverageLegend}</p></div></div>`;
 }
 
+const PAGES_SHOWN = 5;
+
+function inventoryMd(m, runs) {
+  const inv = buildInventory(runs);
+  const lines = [`## ${m.ui.inventoryTitle}`, ""];
+  if (!inv.vendors.length) return [...lines, m.ui.noInventory, ""];
+  lines.push(`| ${m.ui.vendorCol} | ${m.ui.partyCol} | ${m.ui.pagesCol} | ${m.ui.cookiesCol} |`, "|---|---|---|---|");
+  for (const v of inv.vendors) lines.push(`| ${mdText(v.vendor)} | ${m.ui.party[v.party]} | ${v.pages.length} | ${mdText(v.cookies.join(", "))} |`);
+  if (inv.otherCookies.length) lines.push("", `${m.ui.otherCookies}: ${mdText(inv.otherCookies.map((c) => c.name).join(", "))}`);
+  lines.push("");
+  return lines;
+}
+
+function inventoryCard(m, runs) {
+  const inv = buildInventory(runs);
+  const head = `<div class="card-h"><div class="card-t">${m.ui.inventoryTitle}</div><div class="card-d">${m.ui.inventoryLead}</div></div>`;
+  if (!inv.vendors.length) return `<div class="card" id="inventory">${head}<div class="card-c"><p class="muted">${m.ui.noInventory}</p></div></div>`;
+  const names = (xs) => xs.map((x) => `<code>${escapeHtml(x)}</code>`).join(" ");
+  const pages = (v) => `${names(v.pages.slice(0, PAGES_SHOWN))}${v.pages.length > PAGES_SHOWN ? ` <span class="muted">${m.ui.morePages(v.pages.length - PAGES_SHOWN)}</span>` : ""}`;
+  const rows = inv.vendors.map((v) => `<tr><td>${escapeHtml(v.vendor)}</td><td>${escapeHtml(m.ui.party[v.party])}</td><td class="xs">${pages(v)}</td><td class="xs">${v.cookies.length ? names(v.cookies) : '<span class="muted">–</span>'}</td></tr>`).join("");
+  const other = inv.otherCookies.length ? `<p class="muted xs legend">${m.ui.otherCookies}: ${inv.otherCookies.map((c) => `${escapeHtml(c.name)} (${escapeHtml(m.ui.party[c.party])})`).join(", ")}</p>` : "";
+  return `<div class="card" id="inventory">${head}<div class="card-c tight"><div class="tscroll"><table class="dt"><thead><tr><th>${m.ui.vendorCol}</th><th>${m.ui.partyCol}</th><th>${m.ui.pagesCol}</th><th>${m.ui.cookiesCol}</th></tr></thead><tbody>${rows}</tbody></table></div></div>${other ? `<div class="card-c">${other}</div>` : ""}</div>`;
+}
+
 function providersCard(m, runs) {
   const provs = checkedProviders(runs);
   const skipped = skippedTotals(runs);
@@ -858,6 +908,7 @@ code{font-size:12px;background:var(--muted-bg);padding:1px 5px;border-radius:4px
 .jconsent{margin-bottom:16px}
 .eyebrow{font:500 12px var(--font-mono);color:var(--accent-fg);text-transform:uppercase;letter-spacing:.06em;margin-bottom:6px}
 .title .meta{margin-top:4px;font-size:12px;color:var(--muted)}
+.title .plan-changes ul{margin:4px 0 0;padding-left:18px}
 .toptabs{position:sticky;top:0;z-index:10;background:var(--page);border-bottom:1px solid var(--border);margin-top:16px}
 .toptabs .wrap{display:flex;gap:4px;overflow-x:auto;scrollbar-width:none}
 .toptabs a{display:inline-flex;align-items:center;gap:6px;padding:12px 10px;color:var(--muted);font-weight:500;white-space:nowrap;border-bottom:2px solid transparent;margin-bottom:-1px}
@@ -1075,7 +1126,7 @@ pre{margin:8px 0 0;font-size:12px;line-height:1.5;background:var(--muted-bg);bor
 @media print{.toptabs,.jtabs,.stepnav,.filter>label,.filter>input,.tabs.seg>label,.sevfilter{display:none}.tabpanel,.jpanel,.sdetail,.tabs.seg>.panel{display:block!important}.jpanel{margin-bottom:32px}.sdetail{margin-bottom:16px;break-inside:avoid-page}details>*{display:block}}
 `;
 
-export function renderHtml({ title, site = null, ai = null, generatedAt, findings, explained, runs, plan = null, lang = "en", branding = true, against = null, planCheck = null, changes = null }) {
+export function renderHtml({ title, site = null, ai = null, generatedAt, findings, explained, runs, plan = null, lang = "en", branding = true, against = null, planCheck = null, changes = null, planChanges = null, consentScenarios = null }) {
   const m = messages(lang);
   const rows = attachExplanations(findings, explained);
   const counts = summarize(rows);
@@ -1096,15 +1147,15 @@ ${navCss(runs)}</style></head><body>
 <div class="topbar"><div class="wrap"><span class="product-logo">${logo("atd-lockup", "AI Tag Debugger", 26, "logo-atd")}</span>${branding ? `<a href="https://analitikisler.com" class="byline" rel="noopener noreferrer"><span>${m.ui.by}</span>${logo("horizontal", "Analitik İşler", 18, "logo-h")}</a>` : ""}</div></div>
 <header class="wrap title">
 <h1 class="site"><span class="k">${m.ui.site}</span><span class="v">${escapeHtml(site ?? title)}</span></h1>
-<div class="meta">${escapeHtml(generatedAt)} · ${escapeHtml(m.ui.headerMeta(runs.length, checkedProviders(runs).length))} · ai-tag-debugger ${VERSION}</div>${against ? `\n<div class="meta">${escapeHtml(m.ui.checkedAgainst(against))}</div>` : ""}${changes?.routes?.length ? `\n<div class="meta"><a href="#changes">${escapeHtml(m.ui.routeChanged(routeList(changes)))}</a></div>` : ""}
+<div class="meta">${escapeHtml(generatedAt)} · ${escapeHtml(m.ui.headerMeta(runs.length, checkedProviders(runs).length))} · ai-tag-debugger ${VERSION}</div>${against ? `\n<div class="meta">${escapeHtml(m.ui.checkedAgainst(against))}</div>` : ""}${planChanges ? `\n<div class="meta plan-changes">${escapeHtml(m.ui.planChangesLine(planChanges))}${planChangeItems(planChanges).length ? `<ul>${planChangeItems(planChanges).map((i) => `<li>${escapeHtml(i)}</li>`).join("")}</ul>` : ""}</div>` : ""}${changes?.routes?.length ? `\n<div class="meta"><a href="#changes">${escapeHtml(m.ui.routeChanged(routeList(changes)))}</a></div>` : ""}
 </header>
 <nav class="toptabs" aria-label="${m.ui.sections}"><div class="wrap">
 <a href="#overview">${m.ui.tabOverview}</a><a href="#findings">${m.ui.findings} <span class="n">${problems}</span></a><a href="#journeys">${m.ui.tabJourneys} <span class="n">${runs.length}</span></a><a href="#scope">${m.ui.tabScope}</a></div></nav>
 <main class="wrap">
 <section class="tabpanel" id="overview" aria-label="${m.ui.tabOverview}">${changes ? changesCard(m, changes) : ""}${planCheck ? planVsSiteCard(m, planCheck) : ""}${overviewTab(m, findings, rows, counts, explained, runs, { ai, plan, lang })}</section>
 <section class="tabpanel" id="findings" aria-label="${m.ui.findings}">${findingsTab(m, runs, rows, Boolean(explained))}</section>
-<section class="tabpanel" id="journeys" aria-label="${m.ui.tabJourneys}">${journeysTab(m, lang, findings, runs, flagged)}</section>
-<section class="tabpanel" id="scope" aria-label="${m.ui.tabScope}"><div class="stack">${coverageCard(m, plan, runs)}${providersCard(m, runs)}</div></section>
+<section class="tabpanel" id="journeys" aria-label="${m.ui.tabJourneys}">${journeysTab(m, lang, findings, runs, flagged, consentScenarios)}</section>
+<section class="tabpanel" id="scope" aria-label="${m.ui.tabScope}"><div class="stack">${coverageCard(m, plan, runs)}${inventoryCard(m, runs)}${providersCard(m, runs)}</div></section>
 </main>
 <footer class="footer">${footer}</footer>
 </body></html>`;

package/src/sheet.js

@@ -84,7 +84,8 @@ export function rowsToPlan({ events: eventRows = [], user_properties: upRows = n
     if (!r.event) throw fail(`${at}: "event" is empty. Give the event name, e.g. purchase.`);
     const platform = (r.platform || "ga4").toLowerCase();
     if (!PLATFORMS[platform]) throw fail(`${at}: "platform" must be one of ${Object.keys(PLATFORMS).join(", ")} (found "${r.platform}").`);
-    const required = (r.required ?? "").toLowerCase();
+    // Google Sheets checkboxes export as TRUE/FALSE.
+    const required = { true: "yes", false: "no" }[(r.required ?? "").toLowerCase()] ?? (r.required ?? "").toLowerCase();
     if (!["yes", "no", ""].includes(required)) throw fail(`${at}: "required" must be yes or no (found "${r.required}").`);
     if (required && !r.parameter) throw fail(`${at}: "required" is set but "parameter" is empty. Name the parameter, or leave "required" empty on the event's own row.`);
     const custom = (r.custom ?? "").toLowerCase().split(",").map((s) => s.trim()).filter(Boolean);
@@ -290,15 +291,17 @@ export async function readPlanSheet(file, { site } = {}) {
     if (!events) throw new Error(`${path.basename(file)} has no tab named "events" (found ${Object.keys(sheets).map((k) => `"${k}"`).join(", ") || "none"}). Rename the tab with the events to "events".`);
     tabs = { events, user_properties: find("user_properties") ?? null };
   } else if (ext === ".csv") {
-    const upFile = path.join(path.dirname(file), "user_properties.csv");
-    const isUp = path.basename(file).toLowerCase() === "user_properties.csv";
-    if (isUp) throw new Error(`Import the events file (events.csv); ${path.basename(file)} beside it is read too.`);
+    // Google Sheets downloads each tab as "<Document> - <tab>.csv"; the sibling file keeps that prefix.
+    const base = path.basename(file);
+    const prefix = base.match(/^(.*?)events\.csv$/i)?.[1] ?? "";
+    const upFile = path.join(path.dirname(file), `${prefix}user_properties.csv`);
+    if (/user_properties\.csv$/i.test(base)) throw new Error(`Import the events file (${base.replace(/user_properties\.csv$/i, "events.csv")}); ${base} beside it is read too.`);
     tabs = { events: parseCsv(await readFile(file, "utf8")), user_properties: (await exists(upFile)) ? parseCsv(await readFile(upFile, "utf8")) : null };
   } else {
     throw new Error(`Import a .xlsx or .csv file (got ${path.basename(file)}).`);
   }
   const result = rowsToPlan(tabs, { site });
-  if (!tabs.user_properties) result.warnings.push(ext === ".csv" ? "No user_properties.csv beside the file, so the plan has no user properties." : 'No "user_properties" tab, so the plan has no user properties.');
+  if (!tabs.user_properties) result.warnings.push(ext === ".csv" ? `No ${path.basename(upFile)} beside the file, so the plan has no user properties.` : 'No "user_properties" tab, so the plan has no user properties.');
   return result;
 }