@analitikisler/ai-tag-debugger 0.20.0 → 0.21.0

package/src/parsers.js

@@ -18,14 +18,63 @@ function ga4ParamsFrom(searchParams) {
   return params;
 }
 
-// gcs=G1xy: x = ad_storage, y = analytics_storage (1 granted, 0 denied).
-function ga4Consent(searchParams) {
+export const CONSENT_SIGNALS = ["ad_storage", "analytics_storage", "ad_user_data", "ad_personalization"];
+
+// gcd=13r3r3r2r5l1: one letter per signal, in CONSENT_SIGNALS order, each saying the default and the update
+// the Google tag holds. Google publishes no key for the letters. Each one below was read off gtag.js in
+// November 2026 by sending that consent sequence (test/parsers.test.js keeps the strings it sent); a letter
+// not listed is kept as it is and never decides a check.
+const GCD_STATES = {
+  l: {}, // consent mode not used for this signal
+  p: { default: "denied" },
+  q: { default: "denied", update: "denied" },
+  r: { default: "denied", update: "granted" },
+  t: { default: "granted" },
+  u: { default: "granted", update: "denied" },
+  v: { default: "granted", update: "granted" },
+  m: { update: "denied" },
+  n: { update: "granted" },
+};
+
+/** The gcd parameter as { signal: { letter, default?, update?, known } }, or null when it isn't one. */
+export function decodeGcd(gcd) {
+  const m = /^\d{2}([a-z])\d([a-z])\d([a-z])\d([a-z])/i.exec(gcd ?? "");
+  if (!m) return null;
+  return Object.fromEntries(CONSENT_SIGNALS.map((signal, i) => {
+    const letter = m[i + 1].toLowerCase();
+    return [signal, { letter, ...(GCD_STATES[letter] ?? {}), known: Object.hasOwn(GCD_STATES, letter) }];
+  }));
+}
+
+/**
+ * The consent a Google hit says it was sent with. gcs=G1xy gives ad_storage (x) and analytics_storage (y),
+ * 1 granted and 0 denied; gcd adds ad_user_data and ad_personalization, and stands in for gcs when it is absent.
+ */
+export function googleConsent(searchParams) {
+  const out = {};
   const gcs = searchParams.get("gcs");
-  if (!gcs || !/^G1[01-]{2}$/.test(gcs)) return undefined;
-  const state = (c) => (c === "1" ? "granted" : c === "0" ? "denied" : "unknown");
-  return { ad_storage: state(gcs[2]), analytics_storage: state(gcs[3]) };
+  if (gcs && /^G1[01-]{2}$/.test(gcs)) {
+    const state = (c) => (c === "1" ? "granted" : c === "0" ? "denied" : "unknown");
+    out.ad_storage = state(gcs[2]);
+    out.analytics_storage = state(gcs[3]);
+  }
+  const gcd = decodeGcd(searchParams.get("gcd"));
+  for (const signal of CONSENT_SIGNALS) {
+    const state = gcd?.[signal].update ?? gcd?.[signal].default;
+    if (!(signal in out) && state) out[signal] = state;
+  }
+  return Object.keys(out).length ? out : undefined;
 }
 
+// Fields of the Google protocol that are no event parameter but answer consent and session questions:
+// the client and session ids, the session count and engagement, consent state, and the first visit,
+// session start and new session id flags.
+const GOOGLE_PROTOCOL = ["cid", "sid", "sct", "seg", "gcs", "gcd", "dma", "npa", "_fv", "_ss", "_nsi"];
+const protocolOf = (searchParams) => {
+  const out = Object.fromEntries(GOOGLE_PROTOCOL.filter((k) => searchParams.has(k)).map((k) => [k, searchParams.get(k)]));
+  return Object.keys(out).length ? out : undefined;
+};
+
 // Only www.google.<tld> and doubleclick.net: analytics.google.com is a primary GA4 endpoint.
 const GOOGLE_COMPANION_HOST = /^(www\.)?google\.[a-z]{2,3}(\.[a-z]{2})?$|(^|\.)doubleclick\.net$/;
 
@@ -64,14 +113,18 @@ export function parseGa4(url, postData) {
     for (const [k, v] of new URLSearchParams(line)) merged.set(k, v);
     const items = [...merged].filter(([k]) => /^pr\d+$/.test(k)).map(([, v]) => v);
     const user = [...merged].filter(([k]) => isUserDataKey(k));
+    // GA4 makes first_visit and session_start from these flags on another hit; they are never sent by name.
+    const autoEvents = [["_fv", "first_visit"], ["_ss", "session_start"]].filter(([flag]) => merged.has(flag)).map(([, name]) => name);
     return {
       platform: "ga4",
       delivery: ga4Delivery(u),
       name: merged.get("en") || "(unnamed)",
       id: merged.get("tid") || undefined,
       params: ga4ParamsFrom(merged),
-      consent: ga4Consent(merged),
+      consent: googleConsent(merged),
+      protocol: protocolOf(merged),
       ...(items.length ? { items } : {}),
+      ...(autoEvents.length ? { autoEvents } : {}),
       ...(user.length ? { userFields: Object.fromEntries(user) } : {}),
       url,
     };
@@ -109,7 +162,9 @@ export function parseGoogleAds(url) {
   for (const key of ["label", "value", "currency_code", "oid"]) {
     if (u.searchParams.has(key)) params[key === "currency_code" ? "currency" : key === "oid" ? "transaction_id" : key] = u.searchParams.get(key);
   }
-  return [{ platform: "google_ads", name: params.label ? `conversion:${params.label}` : "conversion", id: conversionId, params, url }];
+  const consent = googleConsent(u.searchParams);
+  const protocol = protocolOf(u.searchParams);
+  return [{ platform: "google_ads", name: params.label ? `conversion:${params.label}` : "conversion", id: conversionId, params, ...(consent ? { consent } : {}), ...(protocol ? { protocol } : {}), url }];
 }
 
 /** @returns {Hit[] | null} */
@@ -432,12 +487,14 @@ export const DEFAULT_PROVIDERS = ["ga4", "google_ads", "meta", "tiktok"];
 // Tag managers and consent platforms are always shown: they explain how the tags loaded.
 // Server-side tagging providers are too: their requests show where events are sent from.
 const ALWAYS_SHOWN = { gtm: "Google Tag Manager", consent: "Consent platform", stape: "Stape", elevar: "Elevar" };
+/** The display name of any provider key a network call can carry: a tracking vendor or one that is always shown. */
+export const providerLabel = (key) => PROVIDERS[key] ?? ALWAYS_SHOWN[key] ?? key;
 
 const HOSTS = [
   [/(^|\.)stape\.(io|jp)$/, "stape"],
   [/(^|\.)getelevar\.com$/, "elevar"],
   ...VENDORS.filter((v) => v.hosts).map((v) => [v.hosts, v.key]),
-  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com)$/, "consent"],
+  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com|efilli\.com|cdn-cookieyes\.com)$/, "consent"],
 ];
 
 /**

package/src/report.js

@@ -1,4 +1,5 @@
-import { AD_PLATFORMS, consentTable } from "./consent.js";
+import { AD_PLATFORMS, consentMatrixMarkdown, consentTable } from "./consent.js";
+import { cmpFacts } from "./cmp.js";
 import { ownerOf, verifyLinks } from "./verify.js";
 import { createProvider } from "./providers.js";
 import { canonicalEvent, groupFindings, summarize } from "./checks.js";
@@ -293,8 +294,10 @@ function mdCell(m, col, cell, raw, adPlatform) {
 }
 
 /** The consent section: the Consent Mode timing sentence, then the scenario table with a reason in every cell. */
-function mdConsent(m, metrics, scenarios) {
+function mdConsent(m, metrics, scenarios, runs = []) {
   const lines = [`## ${m.ui.md.consent}`, ""];
+  const platform = cmpFacts(m, runs);
+  if (platform) lines.push(`${m.ui.cmp.title}: ${mdText(platform.vendor)}. ${platform.facts.map(mdText).join(" ")}`, "");
   const cm = metrics.consent?.consentMode;
   const tested = Boolean(cm?.runs?.length);
   if (tested) {
@@ -307,6 +310,8 @@ function mdConsent(m, metrics, scenarios) {
     lines.push(`| ${m.ui.scenarioTag} | ${cols.map((c) => m.ui.scenarioCols[c]).join(" | ")} |`, `|${" --- |".repeat(cols.length + 1)}`);
     for (const r of rows) lines.push(`| ${mdText(platformLabel(r.platform))} \`${mdCode(r.event)}\` | ${r.cells.map((c) => mdCell(m, c.state, c, rawOf(c.state, r.platform, r.event), AD_PLATFORMS.has(r.platform))).join(" | ")} |`);
     lines.push("", m.ui.md.consentLegend, "");
+    const matrix = consentMatrixMarkdown(m, scenarios);
+    if (matrix.length) lines.push(`### ${m.ui.matrix.title}`, "", ...matrix, "");
   } else if (!tested) lines.push(m.ui.md.consentNotChecked, "");
   return lines;
 }
@@ -417,6 +422,7 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   const meta = [m.ui.md.meta(mdText(generatedAt), runs.length, m.ui.md.platformsSeen(platformsSeen.length, platformsSeen.map((p) => mdText(platformLabel(p))).join(", ")), VERSION), `[${m.ui.md.htmlReport}](report.html)`, ...(against ? [mdText(m.ui.checkedAgainst(against))] : [])];
   const status = `**${m.verdict.status[metrics.verdict.status]}**${metrics.score?.score === null || metrics.score?.score === undefined ? "" : ` · ${m.ui.md.score(metrics.score.score)}`}`;
   const lines = [`# ${mdText(m.ui.md.title(site ?? title, mdHeadline(m, runs, rows, metrics)))}`, "", meta.join(" · "), status, `**${m.ui.counts(counts)}**${changes && !changes.previous ? ` · ${m.ui.noPreviousRun}` : ""}`, ""];
+  if (runs.some((r) => r.live)) lines.push(`**${mdText(m.ui.liveRun)}**`, "");
   if (accepted) lines.push(mdText(m.ui.acceptedLine(accepted)), "");
   if (planChanges) lines.push(mdText(m.ui.planChangesLine(planChanges)), "", ...planChangeItems(planChanges).map((i) => `- ${mdText(i)}`), ...(planChangeItems(planChanges).length ? [""] : []));
   const sum = summaryParts(explained?.summary);
@@ -436,7 +442,7 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   for (const f of problems.slice(0, MD_BLOCKS)) lines.push(...mdFinding(m, runs, f, ids));
   const rest = problems.slice(MD_BLOCKS);
   if (rest.length) lines.push(`### ${m.ui.md.also}`, ...rest.map((f) => `- **${m.severity[f.severity]}** ${mdDetail(f.detail).replace(/\.$/, "")} · ${mdWhere(m, runs, f.where, { full: false })}`), "");
-  lines.push(...mdConsent(m, metrics, consentScenarios));
+  lines.push(...mdConsent(m, metrics, consentScenarios, runs));
   lines.push(...mdPassed(m, runs, findings, metrics, planCheck));
   lines.push(...mdJourneys(m, runs, rows));
   lines.push(...mdNotChecked(m, runs, rows, plan, consentScenarios));

package/src/verify.js

@@ -14,6 +14,9 @@ const OWNER_BY_CHECK = {
   server_side: "developer",
   unplanned_events: "marketing",
   planned_out_of_scope: "marketing",
+  ga4_automatic_event: "marketing",
+  page_blocked: "developer",
+  page_crashed: "developer",
 };
 
 /** Who most likely fixes this finding: the site's developer, whoever runs Tag Manager, or marketing (the plan itself). Tag and consent setup is the default. */