@analitikisler/ai-tag-debugger 0.14.0 → 0.16.0

package/src/checks.js

@@ -3,6 +3,7 @@
 
 import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
+import { campaignParamsIn } from "./campaign.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -23,6 +24,20 @@ const SEVERITY_ORDER = { broken: 0, risk: 1, warning: 2, info: 3, ok: 4 };
  * @typedef {{ severity: "broken"|"risk"|"warning"|"info"|"ok", check: string, journey: string, viewport: string, platform?: string, event?: string, step?: string, detail: string, evidence?: string }} Finding
  */
 
+/** Hosts of server containers seen in the run's network calls, the site's own or Stape's. */
+export function serverEndpoints(run) {
+  const hosts = new Set();
+  for (const c of run.network ?? []) {
+    let u;
+    try { u = new URL(c.url); } catch { continue; }
+    if (/(^|\.)(google-analytics\.com|analytics\.google\.com|googletagmanager\.com|google\.[a-z.]+|doubleclick\.net)$/.test(u.hostname)) continue;
+    const ga4Server = c.provider === "ga4" && u.pathname.endsWith("/g/collect");
+    const loader = (c.provider === "gtm" || c.provider === "ga4") && /\/(gtm\.js|gtag\/js)$/.test(u.pathname);
+    if (ga4Server || loader) hosts.add(u.hostname);
+  }
+  return [...hosts];
+}
+
 const key = (platform, name) => `${platform}:${name}`;
 
 // Sites name events in their own way: Elevar's dl_add_to_cart, UA-style addToCart, Add To Cart.
@@ -286,7 +301,12 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     for (const p of byPlatform) findings.push({ ...base, severity: "info", check: "server_side", platform: p.platform, detail: d.serverSide(p.platform, p.server, p.browser, unseenServer) });
   }
   const serverVendors = [...new Set((run.network ?? []).map((c) => c.provider).filter((p) => p === "stape" || p === "elevar"))];
-  if (serverVendors.length || serverHits.length) {
+  // Server containers the browser talked to: GA4 hits on a non-Google host, and GTM or gtag.js
+  // loaded from one (a custom loader, which only a server container serves).
+  const endpoints = serverEndpoints(run);
+  if (endpoints.length && !serverHits.length) findings.push({ ...base, severity: "info", check: "server_endpoint", detail: d.serverEndpoint(endpoints) });
+  const serverSeen = serverVendors.length || serverHits.length || endpoints.length;
+  if (serverSeen) {
     const noId = new Map();
     for (const hit of run.hits) {
       if ((hit.platform === "meta" || hit.platform === "tiktok") && !hit.eventId && !noId.has(key(hit.platform, hit.name))) noId.set(key(hit.platform, hit.name), hit);
@@ -296,6 +316,66 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
+  // One event ID on two different events: the platform keeps the first and drops the other as its
+  // duplicate, so a real event is lost (usually an ID set once per page instead of once per event).
+  const byId = new Map();
+  for (const hit of run.hits) {
+    if (!hit.eventId) continue;
+    const k = `${hit.platform}|${hit.eventId}`;
+    byId.set(k, [...(byId.get(k) ?? []), hit]);
+  }
+  for (const [, hits] of byId) {
+    const events = [...new Set(hits.map((h) => `${h.step}|${canonicalEvent(h.name)}`))];
+    if (events.length < 2) continue;
+    const names = [...new Set(hits.map((h) => h.name))];
+    findings.push({ ...base, severity: "warning", check: "event_id_reused", platform: hits[0].platform, event: names.join(", "), step: stepLabel(hits[1].step), detail: d.eventIdReused(platformName(hits[0].platform), hits[0].eventId, names, events.length), evidence: hits.map((h) => h.url).join("\n") });
+  }
+
+  // With a server container, the Conversions API copy is usually built from the GA4 hit, so the
+  // GA4 hit has to carry the same event_id as the Meta pixel event for Meta to deduplicate them.
+  if (serverSeen) {
+    const ga4ToServer = run.hits.filter((h) => h.platform === "ga4" && h.delivery === "server");
+    const reported = new Set();
+    for (const m of run.hits.filter((h) => h.platform === "meta" && h.eventId)) {
+      const g = ga4ToServer.find((h) => h.step === m.step && canonicalEvent(h.name) === canonicalEvent(m.name));
+      if (!g) continue;
+      const gid = g.params?.event_id;
+      const k = key("meta", m.name);
+      if (reported.has(k) || (gid !== undefined && String(gid) === m.eventId)) continue;
+      reported.add(k);
+      findings.push(gid === undefined
+        ? { ...base, severity: "info", check: "event_id_not_forwarded", platform: "meta", event: m.name, step: stepLabel(m.step), detail: d.eventIdNotForwarded(m.name, g.name) }
+        : { ...base, severity: "warning", check: "event_id_mismatch", platform: "meta", event: m.name, step: stepLabel(m.step), detail: d.eventIdMismatch(m.name, m.eventId, g.name, gid), evidence: JSON.stringify({ meta: m.eventId, ga4: gid }) });
+    }
+  }
+
+  // Campaign parameters (gclid, fbclid, UTM) on the landing address: they must survive redirects and reach the hits.
+  const landing = run.landing;
+  const sent = landing ? campaignParamsIn(landing.requested) : {};
+  if (landing && Object.keys(sent).length) {
+    const kept = campaignParamsIn(landing.final);
+    const lost = Object.keys(sent).filter((n) => kept[n] !== sent[n]);
+    const hop = landing.chain.length > 1 ? landing.chain : null;
+    if (lost.length) {
+      findings.push({ ...base, severity: "broken", check: "campaign_lost_redirect", step: stepLabel(landing.step), detail: d.campaignLost(lost, landing.final), evidence: hop ? hop.join(" -> ") : undefined });
+    }
+    // Hits the landing page sent whose page address leaves out a parameter the page still had.
+    const missing = new Map();
+    for (const hit of run.hits) {
+      const loc = hit.params?.page_location;
+      if (hit.step !== landing.step || !loc || hit.platform === "google_ads") continue;
+      const here = campaignParamsIn(loc);
+      const gone = Object.keys(kept).filter((n) => kept[n] === sent[n] && here[n] !== sent[n] && hit.params?.[n] !== sent[n]);
+      if (gone.length && !missing.has(hit.platform)) missing.set(hit.platform, { hit, gone });
+    }
+    for (const [platform, { hit, gone }] of missing) {
+      findings.push({ ...base, severity: "broken", check: "campaign_missing_in_hits", platform, event: hit.name, step: stepLabel(hit.step), detail: d.campaignMissingInHits(platform, hit.name, gone), evidence: hit.params.page_location });
+    }
+    if (!lost.length && !missing.size) {
+      findings.push({ ...base, severity: "ok", check: "campaign_params", step: stepLabel(landing.step), detail: d.campaignOk(Object.keys(sent)) });
+    }
+  }
+
   // Consent.
   const granted = consentGrantedStep(run);
   // Consent Mode only governs Google tags. Within one step, the push and hit times decide which came first.
@@ -444,7 +524,7 @@ export function groupFindings(findings) {
     const k = f.severity === "ok" ? `ok|${f.journey}|${f.viewport}` : [f.severity, f.check, f.platform, f.event, f.detail].join("|");
     const where = { journey: f.journey, viewport: f.viewport, step: f.step };
     if (groups.has(k)) groups.get(k).where.push(where);
-    else groups.set(k, { severity: f.severity, check: f.check, platform: f.platform, event: f.event, detail: f.detail, evidence: f.evidence, where: [where] });
+    else groups.set(k, { severity: f.severity, check: f.check, platform: f.platform, event: f.event, detail: f.detail, evidence: f.evidence, ...(f.gtm ? { gtm: f.gtm } : {}), where: [where] });
   }
   return [...groups.values()].sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
 }

package/src/cli.js

@@ -205,6 +205,8 @@ async function main(args = process.argv.slice(2)) {
   const rel = path.relative(process.cwd(), result.reportPath);
   console.log(`Report: ${rel.startsWith("..") ? result.reportPath : rel}`);
 
+  if (!against && !values.out) await offerLearnedPlan(result, loaded.config.site, values);
+
   if (failOn !== "never") {
     const threshold = levels.indexOf(failOn);
     if (levels.slice(0, threshold + 1).some((l) => result.counts[l] > 0)) process.exitCode = 1;
@@ -222,6 +224,26 @@ async function main(args = process.argv.slice(2)) {
   }
 }
 
+// The first run of a site with no plan: offer what it already tracks as its plan.
+async function offerLearnedPlan(result, site, values) {
+  const dataDir = values["data-dir"] ?? DEFAULT_DATA_DIR;
+  const { listPlanIds } = await import("./workspace.js");
+  if ((await listPlanIds(dataDir, site).catch(() => [])).length) return;
+  const { learnPlan } = await import("./learn.js");
+  const plan = learnPlan(site, result.runs);
+  if (!plan) return;
+  console.log(`\nNo plan yet for this site. It already sends ${plan.events.length} ${plan.events.length === 1 ? "event" : "events"}: ${plan.events.map((e) => `${e.platform}:${e.name}`).join(", ")}`);
+  let save = values.yes;
+  if (!save && process.stdin.isTTY) save = ["", "y", "yes"].includes((await ask("Save them as the site's plan? (Y/n) ")).toLowerCase());
+  if (!save) {
+    if (!process.stdin.isTTY && !values.yes) console.log("Add --yes to save them as the plan, or draft a fuller one with: aitd plan --site " + site);
+    return;
+  }
+  const { id, dir } = await savePlan(plan, { dataDir, site, branding: !values["no-branding"] });
+  const rel = path.relative(process.cwd(), dir);
+  console.log(`✓ Saved plan ${id} in ${rel.startsWith("..") ? dir : rel}. Next runs can check against it with --against latest.`);
+}
+
 // aitd "check my GA tags": shows the matching command and runs it once confirmed.
 async function fromSentence(sentence, values, extra) {
   const { createProvider } = await import("./providers.js");

package/src/consent.js

@@ -0,0 +1,154 @@
+// Consent scenarios: the start page opened in a fresh browser once per consent choice
+// (accept all, reject all, analytics only), to show which tags each choice lets through.
+// Runs on its own with every audit when the page shows a consent banner.
+import { AuditSession, CMP_BANNER_SELECTORS } from "./browser.js";
+
+export const CONSENT_STATES = ["accept", "reject", "analytics"];
+// Tags that are advertising, so an "analytics only" choice should keep them quiet.
+export const AD_PLATFORMS = new Set(["google_ads", "meta", "tiktok", "pinterest", "snapchat", "x"]);
+
+// Runs in the page: makes the choice through the consent platform's own API when it has one,
+// otherwise by clicking the banner's accept or reject button. Returns how, or null when it could not.
+const applyInPage = ({ state, selectors }) => {
+  const w = window;
+  try {
+    if (w.OneTrust?.AllowAll) {
+      if (state === "accept") w.OneTrust.AllowAll();
+      else {
+        w.OneTrust.RejectAll();
+        // C0002 is OneTrust's performance (analytics) group.
+        if (state === "analytics") w.OneTrust.UpdateConsent?.("Category", "C0002:1");
+      }
+      return "OneTrust";
+    }
+    if (w.Cookiebot?.submitCustomConsent) {
+      // preferences, statistics, marketing
+      w.Cookiebot.submitCustomConsent(state === "accept", state !== "reject", state === "accept");
+      return "Cookiebot";
+    }
+    if (state !== "analytics") {
+      if (w.UC_UI?.acceptAllConsents) {
+        state === "accept" ? w.UC_UI.acceptAllConsents() : w.UC_UI.denyAllConsents();
+        return "Usercentrics";
+      }
+      if (w.Didomi?.setUserAgreeToAll) {
+        state === "accept" ? w.Didomi.setUserAgreeToAll() : w.Didomi.setUserDisagreeToAll();
+        return "Didomi";
+      }
+    }
+  } catch {
+    // An API that throws falls back to the banner's buttons.
+  }
+  if (state === "analytics") return null;
+  const words = state === "accept"
+    ? /^(accept|allow|agree|ok|got it|kabul|tümünü kabul|izin ver|onayla|alle akzeptieren|tout accepter)/i
+    : /^(reject|decline|deny|refuse|necessary only|only necessary|reddet|kabul etme|ablehnen|tout refuser)/i;
+  const visible = (el) => !!(el.offsetWidth || el.offsetHeight || el.getClientRects().length);
+  const banners = [...document.querySelectorAll(selectors)].filter(visible);
+  for (const n of document.querySelectorAll("body *")) {
+    const label = `${n.id} ${typeof n.className === "string" ? n.className : ""}`;
+    if (/(cookie|consent|gdpr|kvkk)/i.test(label) && visible(n) && !banners.some((b) => b.contains(n))) banners.push(n);
+  }
+  for (const banner of banners) {
+    const button = [...banner.querySelectorAll("button, a, [role=button], input[type=button], input[type=submit]")]
+      .filter(visible)
+      .find((b) => words.test((b.innerText || b.value || b.getAttribute("aria-label") || "").trim()));
+    if (button) {
+      button.click();
+      return "banner";
+    }
+  }
+  return null;
+};
+
+// A Google hit that says storage is denied is a cookieless Consent Mode ping, which a "no" allows.
+const cookieless = (h) => !!h.consent && h.consent.ad_storage !== "granted" && h.consent.analytics_storage !== "granted";
+const isAnalyticsOnlyOk = (h) => !!h.consent && h.consent.ad_storage !== "granted";
+
+/** Hits per platform and event: { n, quiet } where quiet counts the ones sent with storage denied. */
+const countBy = (hits) => {
+  const out = {};
+  for (const h of hits) {
+    const c = ((out[h.platform] ??= {})[h.name] ??= { n: 0, cookieless: 0, adDenied: 0 });
+    c.n++;
+    if (cookieless(h)) c.cookieless++;
+    if (isAnalyticsOnlyOk(h)) c.adDenied++;
+  }
+  return out;
+};
+
+/** Opens the start page, makes one consent choice, opens the page again, and returns the hits before and after. */
+async function runState(config, state, opts) {
+  const session = new AuditSession({
+    viewport: "desktop", site: config.site, allowedHosts: config.allowed_hosts, providers: config.providers,
+    blockHits: config.block_hits !== false, headless: !opts.headed,
+  });
+  try {
+    await session.start();
+    const startError = await session.act({ action: "goto", url: config.site, reason: "Open the start page" });
+    if (startError) return { state, error: startError };
+    session.beginStep(`Choose: ${state}`);
+    const via = await session.page.evaluate(applyInPage, { state, selectors: CMP_BANNER_SELECTORS }).catch(() => null);
+    if (!via) return { state, via: null, before: countBy(session.hits) };
+    await session.settle();
+    session.beginStep("Open the start page again");
+    await session.page.reload().catch(() => {});
+    await session.settle();
+    const choice = session.steps.find((s) => s.label.startsWith("Choose:")).index;
+    return {
+      state, via,
+      before: countBy(session.hits.filter((h) => h.step < choice)),
+      after: countBy(session.hits.filter((h) => h.step >= choice)),
+    };
+  } catch (err) {
+    return { state, error: err?.message ?? String(err) };
+  } finally {
+    await session.close().catch(() => {});
+  }
+}
+
+/**
+ * Runs every consent scenario on the site's start page. Returns null when the page has no consent
+ * banner the tool can answer (the first choice found nothing to click), so the report leaves the section out.
+ * @returns {Promise<null | { cmp: string, before: object, states: Record<string, { via: string|null, after?: object, error?: string }> }>}
+ */
+export async function runConsentScenarios(config, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const first = await runState(config, "accept", opts);
+  if (!first.via) return null;
+  log(`\n▶ consent scenarios (${first.via})`);
+  const results = [first];
+  for (const state of CONSENT_STATES.slice(1)) results.push(await runState(config, state, opts));
+  const states = {};
+  for (const r of results) {
+    states[r.state] = r.error ? { via: null, error: r.error } : { via: r.via, ...(r.after ? { after: r.after } : {}) };
+    log(`  ${r.state}: ${r.error ? `✗ ${r.error}` : r.via ? `${Object.values(r.after ?? {}).reduce((s, e) => s + Object.values(e).reduce((a, b) => a + b.n, 0), 0)} tracking hits` : "not supported here"}`);
+  }
+  return { cmp: first.via, before: first.before, states };
+}
+
+/**
+ * The per-state tag table: one row per platform and event, one cell per state (hit count, or null when
+ * the state did not run). A cell is a problem when a tag sent hits a choice should have kept quiet:
+ * anything after "reject all" except cookieless Consent Mode pings, and ad tags after "analytics only"
+ * unless they were sent with ad storage denied.
+ */
+export function consentTable(scenarios) {
+  const keys = new Set();
+  const add = (counts) => Object.entries(counts ?? {}).forEach(([p, events]) => Object.keys(events).forEach((e) => keys.add(`${p}\u0000${e}`)));
+  add(scenarios.before);
+  for (const s of Object.values(scenarios.states)) add(s.after);
+  const cols = ["before", ...CONSENT_STATES];
+  const rows = [...keys].sort().map((k) => {
+    const [platform, event] = k.split("\u0000");
+    const cells = cols.map((col) => {
+      const s = col === "before" ? { after: scenarios.before } : scenarios.states[col];
+      if (!s?.after) return { state: col, count: null, problem: false };
+      const c = s.after[platform]?.[event] ?? { n: 0, cookieless: 0, adDenied: 0 };
+      const problem = (col === "reject" && c.n > c.cookieless) || (col === "analytics" && AD_PLATFORMS.has(platform) && c.n > c.adDenied);
+      return { state: col, count: c.n, problem };
+    });
+    return { platform, event, cells };
+  });
+  return { cols, rows };
+}

package/src/gtm.js

@@ -0,0 +1,92 @@
+// Reads a GTM container export (Admin → Export container) to name the tag and trigger
+// behind a hit. Matching is deterministic: no API call and no AI model.
+
+import { canonicalEvent } from "./checks.js";
+
+// GTM's built-in "All Pages" trigger has no entry in the export's trigger list.
+const BUILT_IN_TRIGGERS = { 2147479553: { name: "All Pages", type: "PAGEVIEW" } };
+const EVENT_PARAMS = ["eventName", "event_name", "event", "eventType", "standardEventName", "customEventName", "eventTypeStandard", "eventTypeCustom"];
+
+/** A tag parameter list as a flat { key: value } map; nested lists and maps are kept as JSON text. */
+function params(list = []) {
+  const out = {};
+  for (const p of list) out[p.key] = p.value ?? (p.list || p.map ? JSON.stringify(p.list ?? p.map) : undefined);
+  return out;
+}
+
+/** Which platform a tag sends to, from its type or, for custom HTML and templates, from its code. */
+function tagPlatform(tag, p) {
+  if (["gaawe", "gaawc", "googtag"].includes(tag.type)) return "ga4";
+  if (["awct", "sp", "gclidw"].includes(tag.type)) return "google_ads";
+  const text = `${tag.type} ${tag.name ?? ""} ${p.html ?? ""}`.toLowerCase();
+  if (/fbq\(|facebook|meta pixel|\bmeta\b/.test(text)) return "meta";
+  if (/ttq\.|tiktok/.test(text)) return "tiktok";
+  return null;
+}
+
+/** The event names a tag sends: its event parameter, a page_view for a GA4 config tag, or the names in fbq/ttq calls. */
+function tagEvents(tag, p) {
+  if (tag.type === "gaawc" || tag.type === "googtag") return ["page_view"];
+  const names = EVENT_PARAMS.map((k) => p[k]).filter((v) => typeof v === "string" && v);
+  for (const m of String(p.html ?? "").matchAll(/(?:fbq|ttq)\s*(?:\(\s*['"](?:track|trackCustom)['"]\s*,|\.track\s*\()\s*['"]([^'"]+)['"]/g)) names.push(m[1]);
+  if (/fbq\s*\(\s*['"]init['"]/.test(p.html ?? "") || /ttq\.page\s*\(/.test(p.html ?? "")) names.push("PageView", "Pageview");
+  return names;
+}
+
+/** The custom event names a trigger fires on, from its "Event name equals …" filter. */
+function triggerEvents(trigger) {
+  return (trigger?.customEventFilter ?? []).map((f) => params(f.parameter).arg1).filter(Boolean);
+}
+
+function describeTrigger(id, byId) {
+  const t = byId.get(String(id)) ?? BUILT_IN_TRIGGERS[id];
+  if (!t) return { id: String(id), name: `#${id}`, type: "unknown" };
+  const events = triggerEvents(t);
+  return { id: String(id), name: t.name, type: t.type, ...(events.length ? { event: events.join(", ") } : {}) };
+}
+
+/**
+ * The tags in a container export with their platform, events and triggers.
+ * @returns {{ id: string, name: string, type: string, platform: string|null, events: string[], paused: boolean, consent: string[], triggers: any[], blocking: any[] }[]}
+ */
+export function containerTags(container) {
+  const v = container?.containerVersion ?? container ?? {};
+  const byId = new Map((v.trigger ?? []).map((t) => [String(t.triggerId), t]));
+  return (v.tag ?? []).map((tag) => {
+    const p = params(tag.parameter);
+    const triggers = (tag.firingTriggerId ?? []).map((id) => describeTrigger(id, byId));
+    let events = tagEvents(tag, p);
+    // An event name taken from a variable such as {{Event}} is whatever the trigger's custom event is.
+    if (events.some((e) => /^\{\{.+\}\}$/.test(e))) events = [...events.filter((e) => !/^\{\{.+\}\}$/.test(e)), ...triggers.flatMap((t) => (t.event ? t.event.split(", ") : []))];
+    const cs = tag.consentSettings;
+    return {
+      id: String(tag.tagId ?? ""),
+      name: tag.name,
+      type: tag.type,
+      platform: tagPlatform(tag, p),
+      events,
+      paused: tag.paused === true,
+      consent: cs?.consentStatus === "NEEDED" ? (cs.consentType?.list ?? []).map((x) => x.value).filter(Boolean) : [],
+      triggers,
+      blocking: (tag.blockingTriggerId ?? []).map((id) => describeTrigger(id, byId)),
+    };
+  });
+}
+
+/** The tags in the container that send an event to a platform. */
+export function tagsForEvent(tags, platform, event) {
+  const want = canonicalEvent(event);
+  return tags.filter((t) => t.platform === platform && t.events.some((e) => canonicalEvent(e) === want));
+}
+
+/** Adds `gtm` to each finding about one platform event: the tags that send it, or an empty list when none does. */
+export function annotateFindings(findings, container) {
+  if (!container) return findings;
+  const tags = containerTags(container);
+  if (!tags.length) return findings;
+  for (const f of findings) {
+    if (!f.platform || !f.event || f.severity === "ok") continue;
+    f.gtm = tagsForEvent(tags, f.platform, f.event).map(({ name, type, paused, consent, triggers, blocking }) => ({ name, type, paused, consent, triggers, blocking }));
+  }
+  return findings;
+}

package/src/i18n.js

@@ -25,6 +25,13 @@ const en = {
     where: "Where",
     causeAndFix: "Cause and fix",
     likelyCause: "Likely cause",
+    gtmTags: "In your GTM container",
+    gtmNoTag: "No tag in the container export sends this event.",
+    gtmFiresOn: "Fires on",
+    gtmNoTrigger: "No firing trigger",
+    gtmBlockedBy: "Blocked by",
+    gtmPaused: "Paused",
+    gtmConsent: (types) => `Needs consent: ${types}`,
     fix: "Fix",
     captured: "Captured",
     noProblems: "No problems found.",
@@ -95,6 +102,7 @@ const en = {
     sections: "Report sections",
     headerMeta: (journeys, providers) => `${journeys} ${journeys === 1 ? "journey" : "journeys"} · ${providers} ${providers === 1 ? "provider" : "providers"}`,
     checkedAgainst: (id) => `Checked against plan ${id}`,
+    planChangesLine: (pc) => (pc.same ? `Plan unchanged since ${pc.previous}` : `Plan changed since ${pc.previous}: ${pc.added.length} added, ${pc.removed.length} removed, ${pc.changed.length} changed`),
     planVsSite: "Plan vs. site",
     changesTitle: "Changed since last run",
     changesLead: (id, mode) => `Compared with run ${id}, by ${mode === "plan" ? "plan coverage" : "health findings"}`,
@@ -132,6 +140,11 @@ const en = {
     consentUpdate: "Update",
     consentLead: "Consent Mode commands the site sent, in order.",
     consentNone: "The site sent no Consent Mode commands on this journey.",
+    scenarios: "Consent scenarios",
+    scenariosLead: (cmp) => `The start page opened once per consent choice (answered through ${cmp === "banner" ? "the banner's buttons" : cmp}). Hits per tag after the choice; red ones should not have been sent.`,
+    scenarioCols: { before: "No choice yet", accept: "Accept all", reject: "Reject all", analytics: "Analytics only" },
+    scenarioNotRun: "Not supported here",
+    scenarioTag: "Tag",
     skippedLine: (list, n) => `${n} out-of-scope ${n === 1 ? "request was" : "requests were"} skipped: ${list}.`,
     findingHint: "Open a finding to see its likely cause, evidence and fix steps.",
     spread: (j, s) => `${j} ${j === 1 ? "journey" : "journeys"}${s ? ` · ${s} ${s === 1 ? "step" : "steps"}` : ""}`,
@@ -145,6 +158,16 @@ const en = {
     notChecked: "not checked",
     noPlan: "No measurement plan was given, so there is nothing to compare against.",
     providers: "Providers",
+    inventoryTitle: "Tag inventory",
+    inventoryLead: "Every vendor the site sent requests to, and where",
+    vendorCol: "Vendor",
+    partyCol: "Party",
+    pagesCol: "Pages",
+    cookiesCol: "Cookies",
+    party: { first: "First party", third: "Third party", both: "Both" },
+    morePages: (n) => `+${n} more`,
+    otherCookies: "Other cookies",
+    noInventory: "No vendor requests were recorded.",
     provider: "Provider",
     requestsCol: "Requests",
     checked: "Checked",
@@ -167,7 +190,14 @@ const en = {
     purchaseItemsEmpty: (platform, name) => `${platform} ${q(name)} was sent with no items, so product and item reports get nothing for this order.`,
     purchaseMismatch: (id, diffs) => `GA4 and Meta reported ${id ? `order ${q(id)}` : "the purchase"} differently: ${diffs.map(([f, g, m]) => `${f} ${q(g)} in GA4 and ${q(m)} in Meta`).join("; ")}. One of the tags reads the wrong data.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}.${unseen.length ? ` Server-side copies of ${unseen.join(" and ")} events never pass through the browser, so they can't be seen here.` : ""}`,
+    serverEndpoint: (hosts) => `A server container answers on ${hosts.map(q).join(", ")} (server-side GTM or a similar setup). Events it forwards to ad platforms never pass through the browser, so they can't be seen here.`,
+    eventIdReused: (platform, id, names, n) => `${platform} event ID ${q(id)} was used for ${n} different events (${names.map(q).join(", ")}). ${platform} keeps the first and drops the rest as duplicates. Give each event its own ID.`,
+    eventIdNotForwarded: (name, ga4Name) => `Meta ${q(name)} has an event ID, but the GA4 ${q(ga4Name)} hit sent to the server container has no event_id. If the server container builds the Conversions API event from that hit, Meta can't match it with the pixel event and counts it twice. Send the same ID as an event_id parameter on the GA4 event.`,
+    eventIdMismatch: (name, metaId, ga4Name, ga4Id) => `Meta ${q(name)} has event ID ${q(metaId)}, but the GA4 ${q(ga4Name)} hit sent to the server container carries event_id ${q(ga4Id)}. A Conversions API event built from that hit won't match the pixel event, so Meta counts it twice. Use one ID for both.`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} was sent from the browser without an event ID, while a server-side setup was seen on this site. If the server also sends this event, ${platform} can't match the two and counts it twice.`,
+    campaignLost: (names, finalUrl) => `The landing address carried ${names.join(", ")}, but the page ended up on ${finalUrl} without ${names.length === 1 ? "it" : "them"}. A redirect dropped ${names.length === 1 ? "the parameter" : "the parameters"}, so ad clicks lose their attribution.`,
+    campaignMissingInHits: (platform, name, names) => `${platform} ${q(name)} on the landing page reports a page address without ${names.join(", ")}, though the page still had ${names.length === 1 ? "it" : "them"}. The visit can be credited to direct traffic instead of the campaign.`,
+    campaignOk: (names) => `${names.join(", ")} survived the landing page's redirects and reached the hits.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)} fired although consent was never given in this journey.`,
@@ -212,6 +242,13 @@ const tr = {
     where: "Nerede",
     causeAndFix: "Neden ve çözüm",
     likelyCause: "Olası neden",
+    gtmTags: "GTM container'ınızda",
+    gtmNoTag: "Container dışa aktarımındaki hiçbir etiket bu olayı göndermiyor.",
+    gtmFiresOn: "Tetikleyici:",
+    gtmNoTrigger: "Tetikleyici yok",
+    gtmBlockedBy: "Engelleyen:",
+    gtmPaused: "Duraklatıldı",
+    gtmConsent: (types) => `İzin gerekiyor: ${types}`,
     fix: "Çözüm",
     captured: "Yakalanan",
     noProblems: "Sorun bulunamadı.",
@@ -282,6 +319,7 @@ const tr = {
     sections: "Rapor bölümleri",
     headerMeta: (journeys, providers) => `${journeys} yolculuk · ${providers} sağlayıcı`,
     checkedAgainst: (id) => `${id} planına göre kontrol edildi`,
+    planChangesLine: (pc) => (pc.same ? `Plan ${pc.previous} sürümünden bu yana değişmedi` : `Plan ${pc.previous} sürümünden bu yana değişti: ${pc.added.length} eklendi, ${pc.removed.length} çıkarıldı, ${pc.changed.length} değişti`),
     planVsSite: "Plan ve site",
     changesTitle: "Son çalıştırmadan bu yana değişenler",
     changesLead: (id, mode) => `${id} çalıştırmasıyla ${mode === "plan" ? "plan kapsamına" : "sağlık bulgularına"} göre karşılaştırıldı`,
@@ -319,6 +357,11 @@ const tr = {
     consentUpdate: "Güncelleme",
     consentLead: "Sitenin gönderdiği Consent Mode komutları, sırasıyla.",
     consentNone: "Site bu yolculukta Consent Mode komutu göndermedi.",
+    scenarios: "Onay senaryoları",
+    scenariosLead: (cmp) => `Başlangıç sayfası her onay seçimi için ayrı açıldı (${cmp === "banner" ? "banner butonlarıyla" : cmp} üzerinden yanıtlandı). Seçimden sonra etiket başına istek sayısı; kırmızılar gönderilmemeliydi.`,
+    scenarioCols: { before: "Henüz seçim yok", accept: "Tümünü kabul", reject: "Tümünü reddet", analytics: "Yalnızca analitik" },
+    scenarioNotRun: "Burada desteklenmiyor",
+    scenarioTag: "Etiket",
     skippedLine: (list, n) => `Kapsam dışı ${n} istek atlandı: ${list}.`,
     findingHint: "Bir bulguyu açınca olası neden, kanıt ve çözüm adımları görünür.",
     spread: (j, s) => `${j} yolculuk${s ? ` · ${s} adım` : ""}`,
@@ -332,6 +375,16 @@ const tr = {
     notChecked: "kontrol edilmedi",
     noPlan: "Ölçüm planı verilmediği için karşılaştırılacak bir şey yok.",
     providers: "Sağlayıcılar",
+    inventoryTitle: "Etiket envanteri",
+    inventoryLead: "Sitenin istek gönderdiği tüm sağlayıcılar ve hangi sayfalarda",
+    vendorCol: "Sağlayıcı",
+    partyCol: "Taraf",
+    pagesCol: "Sayfalar",
+    cookiesCol: "Çerezler",
+    party: { first: "Birinci taraf", third: "Üçüncü taraf", both: "İkisi de" },
+    morePages: (n) => `+${n} daha`,
+    otherCookies: "Diğer çerezler",
+    noInventory: "Sağlayıcıya giden istek kaydedilmedi.",
     provider: "Sağlayıcı",
     requestsCol: "İstek",
     checked: "Kontrol edildi",
@@ -354,7 +407,14 @@ const tr = {
     purchaseItemsEmpty: (platform, name) => `${platform} ${q(name)} ürün listesi boş gönderildi, bu yüzden ürün raporları bu siparişten veri alamaz.`,
     purchaseMismatch: (id, diffs) => `GA4 ve Meta ${id ? `${q(id)} siparişini` : "satın almayı"} farklı bildirdi: ${diffs.map(([f, g, m]) => `${f === "value" ? "değer" : "para birimi"} GA4'te ${q(g)}, Meta'da ${q(m)}`).join("; ")}. Etiketlerden biri yanlış veriyi okuyor.`,
     serverSide: (platform, server, browser, unseen = []) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}.${unseen.length ? ` ${unseen.join(" ve ")} olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.` : ""}`,
+    serverEndpoint: (hosts) => `${hosts.map(q).join(", ")} adresinde bir sunucu konteyneri yanıt veriyor (sunucu tarafı GTM veya benzeri bir kurulum). Reklam platformlarına ilettiği olaylar tarayıcıdan geçmez, bu yüzden burada görünmez.`,
+    eventIdReused: (platform, id, names, n) => `${platform} olay kimliği ${q(id)} ${n} farklı olay için kullanıldı (${names.map(q).join(", ")}). ${platform} ilkini tutar, diğerlerini kopya sayıp atar. Her olaya kendi kimliğini verin.`,
+    eventIdNotForwarded: (name, ga4Name) => `Meta ${q(name)} olay kimliği taşıyor, ancak sunucu konteynerine giden GA4 ${q(ga4Name)} isteğinde event_id yok. Sunucu konteyneri Conversions API olayını bu istekten üretiyorsa Meta onu piksel olayıyla eşleştiremez ve iki kez sayar. Aynı kimliği GA4 olayına event_id parametresi olarak ekleyin.`,
+    eventIdMismatch: (name, metaId, ga4Name, ga4Id) => `Meta ${q(name)} olay kimliği ${q(metaId)}, ancak sunucu konteynerine giden GA4 ${q(ga4Name)} isteği event_id ${q(ga4Id)} taşıyor. Bu istekten üretilen Conversions API olayı piksel olayıyla eşleşmez, Meta onu iki kez sayar. İkisi için tek bir kimlik kullanın.`,
     dedupIdMissing: (platform, name) => `${platform} ${q(name)} tarayıcıdan olay kimliği olmadan gönderildi; sitede sunucu tarafı bir kurulum görüldü. Sunucu da bu olayı gönderiyorsa ${platform} ikisini eşleştiremez ve iki kez sayar.`,
+    campaignLost: (names, finalUrl) => `Açılış adresi ${names.join(", ")} taşıyordu, ancak sayfa ${finalUrl} adresinde ${names.length === 1 ? "onsuz" : "onlarsız"} sonlandı. Bir yönlendirme ${names.length === 1 ? "parametreyi" : "parametreleri"} düşürdü, bu yüzden reklam tıklamalarının atfı kaybolur.`,
+    campaignMissingInHits: (platform, name, names) => `Açılış sayfasındaki ${platform} ${q(name)} isteği ${names.join(", ")} olmadan bir sayfa adresi bildiriyor, oysa sayfada ${names.length === 1 ? "o" : "onlar"} hâlâ vardı. Ziyaret kampanyaya değil doğrudan trafiğe yazılabilir.`,
+    campaignOk: (names) => `${names.join(", ")} açılış sayfasının yönlendirmelerinden geçti ve isteklere ulaştı.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)}, bu yolculukta hiç onay verilmemesine rağmen tetiklendi.`,

package/src/inventory.js

@@ -0,0 +1,69 @@
+import { providerOf } from "./parsers.js";
+import { siteOf } from "./redact.js";
+
+// Cookies the vendors' own scripts set on the site's domain.
+const COOKIE_VENDORS = [
+  [/^(_ga|_gid|_gat)(_|$)/, "ga4"],
+  [/^(_gcl_|_gac_|IDE$|test_cookie$)/, "google_ads"],
+  [/^_fb[pc]$/, "meta"],
+  [/^(_ttp|ttclid|_tt_enable_cookie)$/, "tiktok"],
+  [/^(_li_|li_|bcookie|lidc|UserMatchHistory)/, "linkedin"],
+  [/^(_uet|MUID)/, "microsoft_ads"],
+  [/^(_pin_|_pinterest_)/, "pinterest"],
+  [/^(_scid|sc_at)/, "snapchat"],
+  [/^(_cto_|cto_)/, "criteo"],
+  [/^__kla_id$/, "klaviyo"],
+  [/^_hj/, "hotjar"],
+  [/^_clck|^_clsk/, "clarity"],
+];
+
+const hostOf = (url) => {
+  try { return new URL(url).hostname; } catch { return ""; }
+};
+
+const pathOf = (url) => {
+  try { const u = new URL(url); return `${u.hostname}${u.pathname}`; } catch { return ""; }
+};
+
+/**
+ * Every vendor the site talked to: the pages it loaded or sent from, whether its requests went to the
+ * site's own domain (first party) or to the vendor (third party), and the cookie names tied to it.
+ * Cookies no vendor owns are listed apart. Only cookie names are kept, never values.
+ */
+export function buildInventory(runs) {
+  const vendors = new Map();
+  for (const r of runs) {
+    for (const c of r.network ?? []) {
+      if (!c.vendor || !c.pageUrl) continue;
+      const v = vendors.get(c.vendor) ?? { vendor: c.vendor, keys: new Set(), pages: new Set(), first: 0, third: 0, requests: 0, cookies: new Set() };
+      v.keys.add(c.provider);
+      v.pages.add(pathOf(c.pageUrl));
+      v.requests++;
+      v[siteOf(hostOf(c.url)) === siteOf(hostOf(c.pageUrl)) ? "first" : "third"]++;
+      vendors.set(c.vendor, v);
+    }
+  }
+  const other = new Map();
+  for (const r of runs) {
+    for (const ck of r.cookieLog ?? []) {
+      const domain = String(ck.domain ?? "").replace(/^\./, "");
+      const key = COOKIE_VENDORS.find(([re]) => re.test(ck.name))?.[1] ?? providerOf(`https://${domain}/`)?.key;
+      const owners = [...vendors.values()].filter((v) => key && v.keys.has(key));
+      if (owners.length) for (const v of owners) v.cookies.add(ck.name);
+      else other.set(`${domain}|${ck.name}`, { name: ck.name, domain });
+    }
+  }
+  const sites = new Set(runs.flatMap((r) => (r.network ?? []).map((c) => c.pageUrl)).filter(Boolean).map((u) => siteOf(hostOf(u))));
+  return {
+    vendors: [...vendors.values()]
+      .map((v) => ({
+        vendor: v.vendor,
+        party: v.first && v.third ? "both" : v.first ? "first" : "third",
+        pages: [...v.pages].sort(),
+        requests: v.requests,
+        cookies: [...v.cookies].sort(),
+      }))
+      .sort((a, b) => b.pages.length - a.pages.length || a.vendor.localeCompare(b.vendor)),
+    otherCookies: [...other.values()].map((c) => ({ name: c.name, party: sites.has(siteOf(c.domain)) ? "first" : "third" })).sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}

package/src/learn.js

@@ -0,0 +1,34 @@
+import { PROVIDERS } from "./parsers.js";
+
+/**
+ * A plan learned from what a site already sends: one event per platform and event name seen in
+ * the runs, the parameters it carried,. Parameters sent with every
+ * hit of an event become its required parameters. Values are not copied, so nothing a visitor typed
+ * ends up in the plan. Returns null when the runs captured no named events.
+ */
+export function learnPlan(site, runs) {
+  const byKey = new Map();
+  for (const run of runs) {
+    for (const hit of run.hits ?? []) {
+      if (!hit?.platform || !hit.name || hit.name === "(unnamed)") continue;
+      const k = `${hit.platform}:${hit.name}`;
+      let ev = byKey.get(k);
+      if (!ev) byKey.set(k, (ev = { platform: hit.platform, name: hit.name, hits: 0, params: new Map() }));
+      ev.hits++;
+      for (const p of Object.keys(hit.params ?? {})) ev.params.set(p, (ev.params.get(p) ?? 0) + 1);
+    }
+  }
+  if (!byKey.size) return null;
+  const events = [...byKey.values()].map((ev) => {
+    const required = [...ev.params].filter(([, n]) => n === ev.hits).map(([p]) => p);
+    return {
+      platform: ev.platform,
+      name: ev.name,
+      description: `Learned from what ${PROVIDERS[ev.platform] ?? ev.platform} received on the site.`,
+      ...(required.length ? { required_params: required } : {}),
+      parameters: Object.fromEntries([...ev.params.keys()].map((p) => [p, {}])),
+      seen: true,
+    };
+  });
+  return { site, learned: true, consent_mode: true, pages: [], events, user_properties: [] };
+}

package/src/redact.js

@@ -22,7 +22,7 @@ const SHARED_SECOND_LEVELS = new Set(["com", "co", "org", "net", "gov", "edu", "
 const SHARED_SUFFIXES = ["myshopify.com", "github.io", "vercel.app", "pages.dev", "netlify.app", "herokuapp.com", "web.app", "firebaseapp.com", "appspot.com", "wixsite.com", "blogspot.com", "azurewebsites.net", "cloudfront.net", "workers.dev"];
 
 /** "www.shop.example.com.tr" -> "example.com.tr", "a.shop.myshopify.com" -> "shop.myshopify.com": the part one owner controls. */
-function siteOf(host) {
+export function siteOf(host) {
   const labels = String(host).toLowerCase().replace(/\.$/, "").split(".");
   const name = labels.join(".");
   const shared = SHARED_SUFFIXES.find((s) => name === s || name.endsWith(`.${s}`));