@analitikisler/ai-tag-debugger 0.20.1 → 0.22.0

package/src/parsers.js

@@ -18,14 +18,63 @@ function ga4ParamsFrom(searchParams) {
   return params;
 }
 
-// gcs=G1xy: x = ad_storage, y = analytics_storage (1 granted, 0 denied).
-function ga4Consent(searchParams) {
+export const CONSENT_SIGNALS = ["ad_storage", "analytics_storage", "ad_user_data", "ad_personalization"];
+
+// gcd=13r3r3r2r5l1: one letter per signal, in CONSENT_SIGNALS order, each saying the default and the update
+// the Google tag holds. Google publishes no key for the letters. Each one below was read off gtag.js in
+// November 2026 by sending that consent sequence (test/parsers.test.js keeps the strings it sent); a letter
+// not listed is kept as it is and never decides a check.
+const GCD_STATES = {
+  l: {}, // consent mode not used for this signal
+  p: { default: "denied" },
+  q: { default: "denied", update: "denied" },
+  r: { default: "denied", update: "granted" },
+  t: { default: "granted" },
+  u: { default: "granted", update: "denied" },
+  v: { default: "granted", update: "granted" },
+  m: { update: "denied" },
+  n: { update: "granted" },
+};
+
+/** The gcd parameter as { signal: { letter, default?, update?, known } }, or null when it isn't one. */
+export function decodeGcd(gcd) {
+  const m = /^\d{2}([a-z])\d([a-z])\d([a-z])\d([a-z])/i.exec(gcd ?? "");
+  if (!m) return null;
+  return Object.fromEntries(CONSENT_SIGNALS.map((signal, i) => {
+    const letter = m[i + 1].toLowerCase();
+    return [signal, { letter, ...(GCD_STATES[letter] ?? {}), known: Object.hasOwn(GCD_STATES, letter) }];
+  }));
+}
+
+/**
+ * The consent a Google hit says it was sent with. gcs=G1xy gives ad_storage (x) and analytics_storage (y),
+ * 1 granted and 0 denied; gcd adds ad_user_data and ad_personalization, and stands in for gcs when it is absent.
+ */
+export function googleConsent(searchParams) {
+  const out = {};
   const gcs = searchParams.get("gcs");
-  if (!gcs || !/^G1[01-]{2}$/.test(gcs)) return undefined;
-  const state = (c) => (c === "1" ? "granted" : c === "0" ? "denied" : "unknown");
-  return { ad_storage: state(gcs[2]), analytics_storage: state(gcs[3]) };
+  if (gcs && /^G1[01-]{2}$/.test(gcs)) {
+    const state = (c) => (c === "1" ? "granted" : c === "0" ? "denied" : "unknown");
+    out.ad_storage = state(gcs[2]);
+    out.analytics_storage = state(gcs[3]);
+  }
+  const gcd = decodeGcd(searchParams.get("gcd"));
+  for (const signal of CONSENT_SIGNALS) {
+    const state = gcd?.[signal].update ?? gcd?.[signal].default;
+    if (!(signal in out) && state) out[signal] = state;
+  }
+  return Object.keys(out).length ? out : undefined;
 }
 
+// Fields of the Google protocol that are no event parameter but answer consent and session questions:
+// the client and session ids, the session count and engagement, consent state, and the first visit,
+// session start and new session id flags.
+const GOOGLE_PROTOCOL = ["cid", "sid", "sct", "seg", "gcs", "gcd", "dma", "npa", "_fv", "_ss", "_nsi"];
+const protocolOf = (searchParams) => {
+  const out = Object.fromEntries(GOOGLE_PROTOCOL.filter((k) => searchParams.has(k)).map((k) => [k, searchParams.get(k)]));
+  return Object.keys(out).length ? out : undefined;
+};
+
 // Only www.google.<tld> and doubleclick.net: analytics.google.com is a primary GA4 endpoint.
 const GOOGLE_COMPANION_HOST = /^(www\.)?google\.[a-z]{2,3}(\.[a-z]{2})?$|(^|\.)doubleclick\.net$/;
 
@@ -72,7 +121,8 @@ export function parseGa4(url, postData) {
       name: merged.get("en") || "(unnamed)",
       id: merged.get("tid") || undefined,
       params: ga4ParamsFrom(merged),
-      consent: ga4Consent(merged),
+      consent: googleConsent(merged),
+      protocol: protocolOf(merged),
       ...(items.length ? { items } : {}),
       ...(autoEvents.length ? { autoEvents } : {}),
       ...(user.length ? { userFields: Object.fromEntries(user) } : {}),
@@ -112,7 +162,9 @@ export function parseGoogleAds(url) {
   for (const key of ["label", "value", "currency_code", "oid"]) {
     if (u.searchParams.has(key)) params[key === "currency_code" ? "currency" : key === "oid" ? "transaction_id" : key] = u.searchParams.get(key);
   }
-  return [{ platform: "google_ads", name: params.label ? `conversion:${params.label}` : "conversion", id: conversionId, params, url }];
+  const consent = googleConsent(u.searchParams);
+  const protocol = protocolOf(u.searchParams);
+  return [{ platform: "google_ads", name: params.label ? `conversion:${params.label}` : "conversion", id: conversionId, params, ...(consent ? { consent } : {}), ...(protocol ? { protocol } : {}), url }];
 }
 
 /** @returns {Hit[] | null} */
@@ -435,12 +487,14 @@ export const DEFAULT_PROVIDERS = ["ga4", "google_ads", "meta", "tiktok"];
 // Tag managers and consent platforms are always shown: they explain how the tags loaded.
 // Server-side tagging providers are too: their requests show where events are sent from.
 const ALWAYS_SHOWN = { gtm: "Google Tag Manager", consent: "Consent platform", stape: "Stape", elevar: "Elevar" };
+/** The display name of any provider key a network call can carry: a tracking vendor or one that is always shown. */
+export const providerLabel = (key) => PROVIDERS[key] ?? ALWAYS_SHOWN[key] ?? key;
 
 const HOSTS = [
   [/(^|\.)stape\.(io|jp)$/, "stape"],
   [/(^|\.)getelevar\.com$/, "elevar"],
   ...VENDORS.filter((v) => v.hosts).map((v) => [v.hosts, v.key]),
-  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com)$/, "consent"],
+  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com|efilli\.com|cdn-cookieyes\.com)$/, "consent"],
 ];
 
 /**

package/src/report.js

@@ -1,9 +1,11 @@
-import { AD_PLATFORMS, consentTable } from "./consent.js";
+import { AD_PLATFORMS, consentMatrixMarkdown, consentTable } from "./consent.js";
+import { cmpFacts } from "./cmp.js";
 import { ownerOf, verifyLinks } from "./verify.js";
 import { createProvider } from "./providers.js";
 import { canonicalEvent, groupFindings, summarize } from "./checks.js";
 import { messages } from "./i18n.js";
 import { buildInventory } from "./inventory.js";
+import { containerRows } from "./containers.js";
 import { computeMetrics } from "./metrics.js";
 import { historySummaryLines, sparkline } from "./history.js";
 import { cardIds } from "./html/lib.js";
@@ -293,8 +295,10 @@ function mdCell(m, col, cell, raw, adPlatform) {
 }
 
 /** The consent section: the Consent Mode timing sentence, then the scenario table with a reason in every cell. */
-function mdConsent(m, metrics, scenarios) {
+function mdConsent(m, metrics, scenarios, runs = []) {
   const lines = [`## ${m.ui.md.consent}`, ""];
+  const platform = cmpFacts(m, runs);
+  if (platform) lines.push(`${m.ui.cmp.title}: ${mdText(platform.vendor)}. ${platform.facts.map(mdText).join(" ")}`, "");
   const cm = metrics.consent?.consentMode;
   const tested = Boolean(cm?.runs?.length);
   if (tested) {
@@ -307,6 +311,8 @@ function mdConsent(m, metrics, scenarios) {
     lines.push(`| ${m.ui.scenarioTag} | ${cols.map((c) => m.ui.scenarioCols[c]).join(" | ")} |`, `|${" --- |".repeat(cols.length + 1)}`);
     for (const r of rows) lines.push(`| ${mdText(platformLabel(r.platform))} \`${mdCode(r.event)}\` | ${r.cells.map((c) => mdCell(m, c.state, c, rawOf(c.state, r.platform, r.event), AD_PLATFORMS.has(r.platform))).join(" | ")} |`);
     lines.push("", m.ui.md.consentLegend, "");
+    const matrix = consentMatrixMarkdown(m, scenarios);
+    if (matrix.length) lines.push(`### ${m.ui.matrix.title}`, "", ...matrix, "");
   } else if (!tested) lines.push(m.ui.md.consentNotChecked, "");
   return lines;
 }
@@ -391,6 +397,21 @@ function mdInventory(m, runs) {
   return lines;
 }
 
+/** The Google containers and how each reached the page, one row per container and source. Omitted when none loaded. */
+function mdContainers(m, runs) {
+  const rows = containerRows(runs);
+  if (!rows.length) return [];
+  const c = m.ui.containers;
+  const lines = [`## ${m.ui.containersTitle}`, "", `| ${m.ui.containerCol} | ${m.ui.sourceCol} | ${m.ui.layerCol} | ${m.ui.servedCol} | ${m.ui.pagesCol} |`, "|---|---|---|---|---|"];
+  for (const r of rows.slice(0, MD_INVENTORY_ROWS)) {
+    const served = r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`;
+    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${r.pages.length} |`);
+  }
+  if (rows.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(rows.length - MD_INVENTORY_ROWS, "report.html"));
+  lines.push("");
+  return lines;
+}
+
 /** The trend in up to five lines: the text sparkline with the direction, then the open-longest and flapping lines. */
 function mdTrend(m, trend, lang) {
   if (!trend || trend.runs < 2) return [];
@@ -417,6 +438,7 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   const meta = [m.ui.md.meta(mdText(generatedAt), runs.length, m.ui.md.platformsSeen(platformsSeen.length, platformsSeen.map((p) => mdText(platformLabel(p))).join(", ")), VERSION), `[${m.ui.md.htmlReport}](report.html)`, ...(against ? [mdText(m.ui.checkedAgainst(against))] : [])];
   const status = `**${m.verdict.status[metrics.verdict.status]}**${metrics.score?.score === null || metrics.score?.score === undefined ? "" : ` · ${m.ui.md.score(metrics.score.score)}`}`;
   const lines = [`# ${mdText(m.ui.md.title(site ?? title, mdHeadline(m, runs, rows, metrics)))}`, "", meta.join(" · "), status, `**${m.ui.counts(counts)}**${changes && !changes.previous ? ` · ${m.ui.noPreviousRun}` : ""}`, ""];
+  if (runs.some((r) => r.live)) lines.push(`**${mdText(m.ui.liveRun)}**`, "");
   if (accepted) lines.push(mdText(m.ui.acceptedLine(accepted)), "");
   if (planChanges) lines.push(mdText(m.ui.planChangesLine(planChanges)), "", ...planChangeItems(planChanges).map((i) => `- ${mdText(i)}`), ...(planChangeItems(planChanges).length ? [""] : []));
   const sum = summaryParts(explained?.summary);
@@ -436,11 +458,12 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   for (const f of problems.slice(0, MD_BLOCKS)) lines.push(...mdFinding(m, runs, f, ids));
   const rest = problems.slice(MD_BLOCKS);
   if (rest.length) lines.push(`### ${m.ui.md.also}`, ...rest.map((f) => `- **${m.severity[f.severity]}** ${mdDetail(f.detail).replace(/\.$/, "")} · ${mdWhere(m, runs, f.where, { full: false })}`), "");
-  lines.push(...mdConsent(m, metrics, consentScenarios));
+  lines.push(...mdConsent(m, metrics, consentScenarios, runs));
   lines.push(...mdPassed(m, runs, findings, metrics, planCheck));
   lines.push(...mdJourneys(m, runs, rows));
   lines.push(...mdNotChecked(m, runs, rows, plan, consentScenarios));
   lines.push(...mdInventory(m, runs));
+  lines.push(...mdContainers(m, runs));
   // A report with its own name or logo carries no Analitik İşler credit; the ai tag debugger one stays.
   if (brand?.name || brand?.logo) lines.push("---", "", `_${brand.name ? `${brand.name} · ` : ""}${m.ui.generatedBy}_`, "");
   else if (branding) lines.push("---", "", `_${m.ui.generatedBy} · [analitikisler.com](https://analitikisler.com)_`, "");

package/src/verify.js

@@ -15,6 +15,8 @@ const OWNER_BY_CHECK = {
   unplanned_events: "marketing",
   planned_out_of_scope: "marketing",
   ga4_automatic_event: "marketing",
+  page_blocked: "developer",
+  page_crashed: "developer",
 };
 
 /** Who most likely fixes this finding: the site's developer, whoever runs Tag Manager, or marketing (the plan itself). Tag and consent setup is the default. */