@analitikisler/ai-tag-debugger 0.21.0 → 0.22.1

package/src/containers.js

@@ -0,0 +1,164 @@
+// How each Google container got onto the page: GTM (gtm.js) and Google tag (gtag/js) scripts, with what
+// inserted them. The browser records every container script as it is added (see CONTAINER_HOOK in browser.js):
+// parser-inserted from the HTML, or set by a script, with the scripts on the call stack at that moment. This
+// module turns that into a load source: the snippet, a script tag in the HTML, another script on the page,
+// a tag or Zone in another container, or a gtag config or send_to command the Google tag acted on.
+
+// Container and destination IDs gtm.js and gtag/js are loaded with.
+const CONTAINER_ID = /^(GTM|G|GT|AW|DC|MC|HA)-[A-Z0-9]+$/;
+
+/**
+ * The container a script URL loads, or null: its ID, gtm or gtag, the dataLayer it reads (`l`), the host it
+ * came from (Google's, or the site's own through the Google tag gateway or a server container) and the GTM
+ * environment when one is named (`gtm_preview`). gtm_auth, the environment's token, is never kept.
+ */
+export function containerOf(url) {
+  let u;
+  try { u = new URL(url); } catch { return null; }
+  if (!/^https?:$/.test(u.protocol)) return null;
+  const id = (u.searchParams.get("id") ?? "").toUpperCase();
+  if (!CONTAINER_ID.test(id)) return null;
+  const script = /\/gtm\.js$/.test(u.pathname) ? "gtm" : /\/gtag\/js$/.test(u.pathname) ? "gtag" : null;
+  if (!script) return null;
+  const environment = u.searchParams.get("gtm_preview") || (u.searchParams.has("gtm_auth") ? "unnamed" : null);
+  return {
+    id,
+    script,
+    layer: u.searchParams.get("l") || "dataLayer",
+    host: u.hostname,
+    served: /(^|\.)googletagmanager\.com$/.test(u.hostname) ? "google" : "site",
+    ...(environment ? { environment } : {}),
+  };
+}
+
+/** origin + path, so a caller's query string (which may carry user data) is never kept. */
+export function scriptPath(url) {
+  try {
+    const u = new URL(url);
+    return /^https?:$/.test(u.protocol) ? u.origin + u.pathname : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The call stack the browser captured, as callers from the innermost out: { inline: true } for script in the
+ * page itself (the page's address, or "inline" for code injected without one) (the snippet, or a Custom HTML tag GTM injected), { container: id } for a container script and
+ * { script: url } for any other script. Repeats in a row are folded.
+ */
+export function callersOf(frames, documentUrl) {
+  const doc = String(documentUrl ?? "").split("#")[0];
+  const out = [];
+  for (const f of frames ?? []) {
+    const url = String(f).split("#")[0];
+    const c = containerOf(url);
+    const caller = url === doc || url === "inline" ? { inline: true } : c ? { container: c.id } : scriptPath(url) ? { script: scriptPath(url) } : null;
+    if (!caller) continue;
+    const last = out.at(-1);
+    if (last && JSON.stringify(last) === JSON.stringify(caller)) continue;
+    out.push(caller);
+  }
+  return out;
+}
+
+const pathOf = (href) => scriptPath(href);
+
+/** Whether a gtag command in the dataLayer names this ID: ["config", id] or ["event", name, { send_to }]. */
+function commandFor(load, pushes) {
+  const earlier = pushes.filter((e) => Array.isArray(e.value) && (e.t ?? 0) <= (load.t ?? Infinity) && (!load.page || pathOf(e.url) === load.page));
+  if (earlier.some((e) => e.value[0] === "config" && String(e.value[1]).toUpperCase() === load.id)) return "config";
+  const sendsTo = (e) => {
+    const to = e.value[0] === "event" ? e.value[2]?.send_to : undefined;
+    const list = Array.isArray(to) ? to : String(to ?? "").split(",");
+    return list.some((s) => String(s).trim().toUpperCase().split("/")[0] === load.id);
+  };
+  return earlier.some(sendsTo) ? "send_to" : null;
+}
+
+/**
+ * Where one recorded load came from, as { kind, by? }:
+ * - html: a script tag in the page's HTML (the gtag.js snippet, or gtm.js referenced directly)
+ * - inline: code in the page itself (the GTM snippet, or a hand-written loader)
+ * - script: another script on the page; by is its address (a consent platform, the site's bundle)
+ * - custom_html: a Custom HTML tag in the GTM container `by`
+ * - google_tag: a Google tag or template in the GTM container `by`, through GTM's load_google_tags
+ * - nested: GTM container `by` loaded another GTM container itself, as a Zone or a tag template does
+ * - config / send_to: a gtag('config') or an event's send_to naming the ID, acted on by `by`
+ * - destination: the Google tag `by` loaded it as one of its destinations, with no command in the page
+ */
+export function sourceOf(load, pushes = []) {
+  if (load.how === "parser") return { kind: "html" };
+  const callers = load.callers ?? [];
+  const at = callers.findIndex((c) => c.container && c.container !== load.id);
+  if (at >= 0) {
+    const by = callers[at].container;
+    const command = commandFor(load, pushes);
+    if (command) return { kind: command, by };
+    if (by.startsWith("GTM-")) {
+      // Code in the page between the call and the container is a Custom HTML tag the container injected.
+      if (callers.slice(0, at).some((c) => c.inline)) return { kind: "custom_html", by };
+      return { kind: load.id.startsWith("GTM-") ? "nested" : "google_tag", by };
+    }
+    return { kind: "destination", by };
+  }
+  const other = callers.find((c) => c.script);
+  if (other) return { kind: "script", by: other.script };
+  return { kind: "inline" };
+}
+
+/** A run's container loads with their sources, in the order they happened. Runs saved by older versions have none. */
+export function loadSources(run) {
+  const pushes = run.dataLayerLog ?? [];
+  return (run.containerLoads ?? []).map((load) => ({ ...load, ...sourceOf(load, pushes) }));
+}
+
+/**
+ * One row per container and source across runs, in the order first seen: { id, script, layer, served, host,
+ * environment?, kind, by?, frame?, pages, journeys }, where frame is the iframe it loaded in, if any.
+ */
+export function containerRows(runs) {
+  const rows = new Map();
+  for (const run of runs) {
+    for (const l of loadSources(run)) {
+      const k = [l.id, l.kind, l.by ?? "", l.host, l.layer, l.environment ?? "", l.frame?.origin ?? ""].join("|");
+      const row = rows.get(k) ?? {
+        id: l.id, script: l.script, layer: l.layer, served: l.served, host: l.host,
+        ...(l.environment ? { environment: l.environment } : {}), kind: l.kind, ...(l.by ? { by: l.by } : {}),
+        ...(l.frame ? { frame: { origin: l.frame.origin, party: l.frame.party } } : {}),
+        pages: new Set(), journeys: new Set(),
+      };
+      if (l.page) row.pages.add(l.page);
+      row.journeys.add(`${run.journeyId} (${run.viewport})`);
+      rows.set(k, row);
+    }
+  }
+  return [...rows.values()].map((r) => ({ ...r, pages: [...r.pages].sort(), journeys: [...r.journeys] }));
+}
+
+/** The containers loaded more than once into one page, as [{ id, loads }] with the loads in order. */
+export function duplicateLoads(run) {
+  const byDoc = new Map();
+  for (const l of loadSources(run)) {
+    const k = `${l.doc ?? l.page}|${l.id}`;
+    byDoc.set(k, [...(byDoc.get(k) ?? []), l]);
+  }
+  return [...byDoc.values()].filter((list) => list.length > 1).map((loads) => ({ id: loads[0].id, loads }));
+}
+
+/** Pages where containers read different dataLayers, as [{ page, step, layers: [{ id, layer }] }]. */
+export function splitLayers(run) {
+  const byDoc = new Map();
+  for (const l of loadSources(run)) {
+    // A destination a Google tag loaded reads that tag's dataLayer, whatever its own URL says.
+    if (["config", "send_to", "destination"].includes(l.kind)) continue;
+    const k = l.doc ?? l.page;
+    byDoc.set(k, [...(byDoc.get(k) ?? []), l]);
+  }
+  const out = [];
+  for (const loads of byDoc.values()) {
+    if (new Set(loads.map((l) => l.layer)).size < 2) continue;
+    const seen = new Map(loads.map((l) => [l.id, { id: l.id, layer: l.layer }]));
+    out.push({ page: loads[0].page, step: loads[0].step, layers: [...seen.values()] });
+  }
+  return out;
+}

package/src/discover.js

@@ -1,5 +1,6 @@
 import { AuditSession } from "./browser.js";
 import { runAgentJourney, StepTimeout } from "./agent.js";
+import { splitRun } from "./frames.js";
 
 /** The goal of the browsing part: one page of each type, nothing submitted. */
 export const DISCOVER_GOAL = `Explore this site to draft its analytics measurement plan. You are not completing a purchase or any other task: visit ONE example of each kind of page that exists here and look at what a visitor can do on it, then call finish with success true.
@@ -169,14 +170,16 @@ export async function discoverPlan(opts) {
   const pages = pagesSeen(snapshots);
   if (!pages.length) throw new Error("The explorer saw no pages, so there is nothing to plan from.");
   log(`\nExplored ${pages.length} pages${outcome.completed ? "" : ` (${outcome.note})`}. Drafting the plan…`);
-  const existing = [...new Set(session.hits.map((h) => `${h.platform}:${h.name}`))];
+  // An embedded widget's hits are not the site's tracking, so the plan leaves them out.
+  const ownHits = splitRun(session).hits;
+  const existing = [...new Set(ownHits.map((h) => `${h.platform}:${h.name}`))];
   const result = await opts.provider.json({
     system: topic ? `${PLAN_SYSTEM}\nThis plan covers only ${opts.topic}. Propose only ${topic.propose}.` : PLAN_SYSTEM,
     texts: [`Site: ${opts.site}`, `Pages visited:\n${JSON.stringify(pages, null, 1)}`, `Tracking hits the site already sends: ${existing.length ? existing.join(", ") : "none"}`],
     schema: PLAN_SCHEMA,
   });
   if (result.error) throw new Error(`The model did not return a plan (${result.error}).`);
-  const plan = toPlan(opts.site, result.value, session.hits);
+  const plan = toPlan(opts.site, result.value, ownHits);
   if (topic) plan.events = plan.events.filter(topic.keep);
   const coverage = pageTypeCoverage(plan.pages);
   log(`Page types found: ${coverage.found.join(", ") || "none"}`);

package/src/frames.js

@@ -0,0 +1,90 @@
+// Whose tracking a hit is: the site's own, or an embedded widget's. Hits, dataLayer pushes, vendor calls and
+// container loads from an iframe carry { origin, party, parent }: party "site" when the iframe is on the page's
+// own site (a checkout or form on a subdomain), "third" when it is someone else's (a booking or chat widget,
+// a payment form, a video). A third-party iframe's hit is still the site's when it goes to an account the
+// site's own tags use (a booking engine set up with the site's GA4 ID); otherwise it is the widget's.
+import { siteOf } from "./redact.js";
+
+/**
+ * A Playwright frame as { origin, party, parent }, or null for a page's main frame and for frames without an
+ * http(s) address (about:blank, srcdoc), which the page's own scripts write. parent is the address of the
+ * page it is embedded in, without its query.
+ */
+export function frameInfo(frame) {
+  if (!frame) return null;
+  let top;
+  try {
+    top = frame.page()?.mainFrame();
+  } catch {
+    return null;
+  }
+  if (!top || frame === top) return null;
+  let u;
+  let t;
+  try {
+    u = new URL(frame.url());
+    t = new URL(top.url());
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || !/^https?:$/.test(t.protocol)) return null;
+  return { origin: u.origin, party: siteOf(u.hostname) === siteOf(t.hostname) ? "site" : "third", parent: t.origin + t.pathname };
+}
+
+/** Whether a hit, push or load came from the page itself or an iframe on the same site. */
+export const isSiteFrame = (x) => !x?.frame || x.frame.party !== "third";
+
+// Account IDs as the hits and the containers name them: GA4's G-…, Google Ads' AW-… (a numeric conversion ID in
+// its hits), Meta's pixel ID and so on. Compared per platform family, without the AW- prefix.
+const idKey = (id) => String(id).trim().toUpperCase().replace(/^AW-/, "");
+
+/**
+ * The account IDs the site's own tags use: the containers loaded in the page or a same-site iframe, the IDs its
+ * hits went to, and the destinations its gtag('config') commands name.
+ */
+export function siteIds({ hits = [], containerLoads = [], dataLayerLog = [] }) {
+  const ids = new Set();
+  for (const l of containerLoads) if (isSiteFrame(l)) ids.add(idKey(l.id));
+  for (const h of hits) if (isSiteFrame(h) && h.id) ids.add(idKey(h.id));
+  for (const e of dataLayerLog) {
+    if (isSiteFrame(e) && Array.isArray(e.value) && e.value[0] === "config" && typeof e.value[1] === "string") ids.add(idKey(e.value[1]));
+  }
+  return ids;
+}
+
+/** Whether a hit is an embedded widget's: sent from a third-party iframe to an account the site's tags don't use. */
+export function isWidgetHit(hit, ids) {
+  return !isSiteFrame(hit) && !(hit.id && ids.has(idKey(hit.id)));
+}
+
+/**
+ * The run's hits and dataLayer pushes split into the site's own and the widgets': { hits, widgetHits,
+ * dataLayerLog, widgetDataLayerLog }. Plan, coverage and duplicate checks read only the site's; the consent and
+ * personal data checks read both, since the site answers for what the widgets it embeds collect.
+ */
+export function splitRun({ hits = [], containerLoads = [], dataLayerLog = [] }) {
+  const ids = siteIds({ hits, containerLoads, dataLayerLog });
+  return {
+    hits: hits.filter((h) => !isWidgetHit(h, ids)),
+    widgetHits: hits.filter((h) => isWidgetHit(h, ids)),
+    dataLayerLog: dataLayerLog.filter(isSiteFrame),
+    widgetDataLayerLog: dataLayerLog.filter((e) => !isSiteFrame(e)),
+  };
+}
+
+/** The widgets that sent hits, by iframe origin: [{ origin, parent, platforms: [{ platform, ids, events }] }]. */
+export function widgetsOf(widgetHits = []) {
+  const byOrigin = new Map();
+  for (const h of widgetHits) {
+    const w = byOrigin.get(h.frame.origin) ?? { origin: h.frame.origin, parent: h.frame.parent, platforms: new Map() };
+    const p = w.platforms.get(h.platform) ?? { platform: h.platform, ids: new Set(), events: new Set() };
+    if (h.id) p.ids.add(h.id);
+    p.events.add(h.name);
+    w.platforms.set(h.platform, p);
+    byOrigin.set(h.frame.origin, w);
+  }
+  return [...byOrigin.values()].map((w) => ({
+    origin: w.origin, parent: w.parent,
+    platforms: [...w.platforms.values()].map((p) => ({ platform: p.platform, ids: [...p.ids], events: [...p.events] })),
+  }));
+}

package/src/html/scope.js

@@ -3,6 +3,7 @@
 // handling (which runs check which platform, the funnel cells, the inventory's parties and cookies, the skipped
 // vendors, the trend) is the 0.17 renderer's, so the numbers match the Markdown report and the CLI.
 import { buildInventory } from "../inventory.js";
+import { containerRows } from "../containers.js";
 import { providerOf } from "../parsers.js";
 import { siteOf } from "../redact.js";
 import { VERSION, BUCKET_ORDER, coverageLines, pcSort, planChangeItems, routeList } from "../report-shared.js";
@@ -193,12 +194,24 @@ function inventoryLines(ctx) {
   return { lines, otherCookies: inv.otherCookies };
 }
 
+/** The Google containers card: one line per container and the way it reached the page. Null when none was recorded. */
+function containersCard(ctx) {
+  const { m, runs } = ctx;
+  const rows = containerRows(runs);
+  if (!rows.length) return null;
+  const c = m.ui.containers;
+  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
+  const ids = uniq(rows.map((r) => r.id));
+  return `<li><details class="card inv" id="inv-containers"><summary><span class="t">${esc(m.ui.containersTitle)}</span>${plain(n(ids.length))}<span class="inv-m">${esc(ids.slice(0, 3).join(", "))}${ids.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.containersIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
+}
+
 function inventorySection(ctx) {
   const { m, runs } = ctx;
   const t = m.html.scope;
   const { lines, otherCookies } = inventoryLines(ctx);
   const skipped = skippedTotals(runs);
-  if (!lines.length && !skipped.length) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
+  const containers = containersCard(ctx);
+  if (!lines.length && !skipped.length && !containers) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
   const counts = (x) => `<span class="inv-m">${t.requests(x.requests, bold(x.requests))}</span><span class="inv-m">${t.pages(x.pages.size, bold(x.pages.size))}</span><span class="inv-m${x.cookies.length ? "" : " zero"}">${t.cookies(x.cookies.length, bold(x.cookies.length))}</span>`;
   const out = lines.map((x) => {
     const id = `inv-${safeKey(x.p)}`;
@@ -214,6 +227,7 @@ function inventorySection(ctx) {
 <div role="tabpanel" id="${tid("pages")}" data-label="${esc(m.ui.pagesCol)}">${pages ? `<ul class="inv-list">${pages}</ul>` : none}</div>
 <div role="tabpanel" id="${tid("cookies")}" data-label="${esc(m.ui.cookiesCol)}">${x.cookies.length ? `<ul class="inv-list">${x.cookies.map((ck) => `<li>${code(ck)}</li>`).join("")}</ul>` : none}</div></div></div></details></li>`;
   });
+  if (containers) out.unshift(containers);
   const skippedN = skipped.reduce((a, [, k]) => a + k, 0);
   if (skipped.length) {
     out.push(`<li><details class="card inv" id="inv-out-of-scope"><summary><span class="t">${esc(m.ui.outOfScopeStatus)}</span>${plain(t.requests(skippedN, bold(skippedN)))}<span class="inv-m">${esc(skipped.slice(0, 3).map(([v]) => v).join(", "))}${skipped.length > 3 ? " …" : ""}</span></summary><div class="body"><ul class="inv-list">${skipped.map(([v, k]) => `<li><span>${esc(v)}</span>${badge("muted", m.ui.outOfScopeStatus)}<span class="inv-n">${t.requests(k, bold(k))}</span></li>`).join("")}</ul></div></details></li>`);

package/src/i18n.js

@@ -202,6 +202,30 @@ const en = {
     party: { first: "First party", third: "Third party", both: "Both" },
     otherCookies: "Other cookies",
     noInventory: "No vendor requests were recorded.",
+    containersTitle: "Google containers",
+    containersIntro: "How each GTM container and Google tag got onto the page: what inserted its script, the dataLayer it reads and where it was served from.",
+    noContainers: "No GTM container or Google tag script was loaded.",
+    containerCol: "Container",
+    sourceCol: "Loaded by",
+    layerCol: "dataLayer",
+    servedCol: "Served from",
+    containers: {
+      script: { gtm: "GTM container", gtag: "Google tag" },
+      served: { google: "Google", site: "The site's own domain" },
+      environment: (env) => (env === "unnamed" ? "GTM environment" : `GTM environment ${env}`),
+      iframe: (origin, party) => `In an iframe from ${origin} (${party === "site" ? "same site" : "third party"})`,
+      kinds: {
+        html: () => "A script tag in the page's HTML",
+        inline: () => "Inline code in the page (the snippet)",
+        script: (by) => `Another script on the page: ${by}`,
+        custom_html: (by) => `A Custom HTML tag in ${by}`,
+        google_tag: (by) => `A Google tag in ${by} (load_google_tags)`,
+        nested: (by) => `${by} itself: a Zone or a tag template`,
+        config: (by) => `A gtag('config') command, loaded by ${by}`,
+        send_to: (by) => `An event's send_to with no config, loaded by ${by}`,
+        destination: (by) => `A destination of the Google tag ${by}`,
+      },
+    },
     provider: "Provider",
     checked: "Checked",
     outOfScopeStatus: "Out of scope",
@@ -323,6 +347,13 @@ const en = {
     campaignOk: (names) => `${names.join(", ")} survived the landing page's redirects and reached the hits.`,
     gclidNotStored: () => `The landing address carried a gclid and ad storage was granted, but the _gcl_aw cookie never held it. Google Ads cannot tie a conversion later in the visit, or on a later visit, to the ad click.`,
     clientIdChanged: (from, at) => `The GA4 client id in the _ga cookie changed between "${from}" and "${at}". GA4 counts the visit before and after as two different users.`,
+    containerDuplicate: (id, sources, step) => `${id} was loaded ${sources.length} times into one page at "${step}": ${sources.join("; ")}. Each copy can run the container's tags again, so hits can go out twice; at best one install is dead weight.`,
+    containerEnvironment: (id, env) => `${id} is loaded from a GTM environment (${env === "unnamed" ? "gtm_auth" : `gtm_preview=${env}`}) instead of the Live version, so visitors run whatever was last published to that environment, often a staging or development version.`,
+    dataLayerSplit: (list, step) => `Containers on one page at "${step}" read different dataLayers: ${list.join(", ")}. A push to one is never seen by the containers reading another, so events and consent commands may reach only some of them.`,
+    sendToOnly: (id, by) => `${id} was loaded only because an event named it in send_to; no gtag('config', '${id}') ran. ${by} sends to it with default settings, so whatever a config command would set for it does not apply.`,
+    fromWidget: (origin, text) => `In an embedded widget from ${origin}: ${text}`,
+    widgetTracking: (origin, platforms) => `An embedded widget from ${origin} sent its own tracking: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. It goes to accounts the site's own tags don't use, so it was left out of the plan, coverage and duplicate checks; the consent and personal data checks still include it.`,
+    iframeContainer: (id, origin, parent) => `${id} runs in an iframe from ${origin} embedded in ${parent}. The iframe has its own dataLayer: events and consent commands pushed in the page never reach it, so it needs its own.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     consentDefaultNotApplied: () => "The page pushed a Consent Mode default, but the Google tag never applied it, so its tags ran without one. Tag Assistant shows Consent Mode as not configured.",
@@ -378,6 +409,12 @@ const en = {
     page_crashed: "Visitors who get the same error see a broken page, and the tags on it may not run.",
     gclid_not_stored: "Conversions are not linked to the ad click that brought the visitor, so Google Ads under-reports them and bids on less data.",
     client_id_changed: "One visitor becomes two users in GA4: the visit is split, the journey before the change loses its conversions, and attribution starts over.",
+    container_duplicate: "A container loaded twice can fire its tags twice, inflating page views and conversions; at best one install is redundant.",
+    container_environment: "Visitors run a non-Live version of the container, so tags still under test, or an old setup, collect production data.",
+    datalayer_split: "Events and consent commands pushed to one dataLayer never reach the containers reading another, so some tags miss them.",
+    container_send_to_only: "The destination runs without its own config, so the settings a config command would give it are missing.",
+    widget_tracking: "Nothing is wrong with the site's tracking: the widget's own hits were kept out of the plan checks so they can't pass for the site's.",
+    iframe_container: "Tags in the iframe miss what the page pushes, so conversions completed in it can go untracked or be sent without the visitor's consent.",
     campaign_params: "Campaign parameters survived the landing redirect and reached the hits, so paid clicks are credited to their campaigns.",
     event_id_reused: "Two different events share one event ID, so the platform keeps the first and silently drops the other: a real event is lost.",
     event_id_mismatch: "The browser and server copies of this event carry different IDs, so Meta cannot pair them and counts the conversion twice.",
@@ -420,6 +457,12 @@ const en = {
     page_crashed: "Open the page in an ordinary browser. If it works there, the site's bot protection refused its scripts to the audit's network; if not, a deployment serves pages that ask for script files it no longer has.",
     gclid_not_stored: "Fire the Conversion Linker tag (or the Google tag with the Ads ID) on every page, on consent granted as well as on page load, and keep the gclid on the landing address until it has run.",
     client_id_changed: "Look for what rewrites or deletes _ga at that step: a consent platform clearing cookies, a second GA4 setup with another cookie_domain or cookie_prefix, or a cross-domain link without the _gl parameter.",
+    container_duplicate: "Keep one install: remove the extra snippet, or the tag in the other container that loads it again.",
+    container_environment: "Use the Live snippet in production: take gtm_auth and gtm_preview out of the GTM snippet, or publish what the environment holds to Live.",
+    datalayer_split: "Point every container at the same dataLayer, or push events and consent commands to each dataLayer the containers read.",
+    container_send_to_only: "Add a gtag('config', ID) for the destination before the events that send to it, or a Google tag for it in GTM.",
+    widget_tracking: "Nothing to fix for the plan. If the widget sets cookies or sends data before consent, the consent findings name it; ask its vendor how to hold it back.",
+    iframe_container: "Push the events and the consent state inside the iframe as well (or pass them in with postMessage), or track the iframe's steps from the page.",
     campaign_params: "Nothing to fix. Check the redirects again when the landing pages change.",
     event_id_reused: "Generate a new event ID for every event, not once per page load.",
     event_id_mismatch: "Use one event ID for the pixel event and the server copy: pass the same value to both tags.",
@@ -462,6 +505,12 @@ const en = {
     page_crashed: "hygiene",
     gclid_not_stored: "money",
     client_id_changed: "money",
+    container_duplicate: "money",
+    container_environment: "hygiene",
+    datalayer_split: "hygiene",
+    container_send_to_only: "hygiene",
+    widget_tracking: "hygiene",
+    iframe_container: "hygiene",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",
@@ -980,6 +1029,30 @@ const tr = {
     party: { first: "Birinci taraf", third: "Üçüncü taraf", both: "İkisi de" },
     otherCookies: "Diğer çerezler",
     noInventory: "Sağlayıcıya giden istek kaydedilmedi.",
+    containersTitle: "Google container'ları",
+    containersIntro: "Her GTM container'ının ve Google etiketinin sayfaya nasıl geldiği: betiğini neyin eklediği, okuduğu dataLayer ve nereden sunulduğu.",
+    noContainers: "Hiçbir GTM container'ı veya Google etiketi betiği yüklenmedi.",
+    containerCol: "Container",
+    sourceCol: "Yükleyen",
+    layerCol: "dataLayer",
+    servedCol: "Sunulduğu yer",
+    containers: {
+      script: { gtm: "GTM container'ı", gtag: "Google etiketi" },
+      served: { google: "Google", site: "Sitenin kendi alan adı" },
+      environment: (env) => (env === "unnamed" ? "GTM ortamı" : `GTM ortamı ${env}`),
+      iframe: (origin, party) => `${origin} kaynaklı bir iframe içinde (${party === "site" ? "aynı site" : "üçüncü taraf"})`,
+      kinds: {
+        html: () => "Sayfanın HTML'indeki bir script etiketi",
+        inline: () => "Sayfadaki satır içi kod (snippet)",
+        script: (by) => `Sayfadaki başka bir betik: ${by}`,
+        custom_html: (by) => `${by} içindeki bir Özel HTML etiketi`,
+        google_tag: (by) => `${by} içindeki bir Google etiketi (load_google_tags)`,
+        nested: (by) => `${by} kendisi: bir Zone veya etiket şablonu`,
+        config: (by) => `Bir gtag('config') komutu, ${by} yükledi`,
+        send_to: (by) => `config olmadan bir olayın send_to değeri, ${by} yükledi`,
+        destination: (by) => `${by} Google etiketinin bir hedefi`,
+      },
+    },
     provider: "Sağlayıcı",
     checked: "Kontrol edildi",
     outOfScopeStatus: "Kapsam dışı",
@@ -1097,6 +1170,13 @@ const tr = {
     campaignOk: (names) => `${names.join(", ")} açılış sayfasının yönlendirmelerinden geçti ve isteklere ulaştı.`,
     gclidNotStored: () => `Açılış adresi bir gclid taşıyordu ve reklam depolamasına izin verildi, ancak _gcl_aw çerezi onu hiç tutmadı. Google Ads, ziyaretin ilerleyen adımlarındaki ya da sonraki bir ziyaretteki dönüşümü reklam tıklamasına bağlayamaz.`,
     clientIdChanged: (from, at) => `_ga çerezindeki GA4 istemci kimliği "${from}" ile "${at}" arasında değişti. GA4 değişiklikten önceki ve sonraki ziyareti iki ayrı kullanıcı sayar.`,
+    containerDuplicate: (id, sources, step) => `${id}, "${step}" adımında aynı sayfaya ${sources.length} kez yüklendi: ${sources.join("; ")}. Her kopya container'ın etiketlerini yeniden çalıştırabilir, bu yüzden istekler iki kez gidebilir; en iyi ihtimalle kurulumlardan biri boşuna yükleniyor.`,
+    containerEnvironment: (id, env) => `${id}, Live sürüm yerine bir GTM ortamından (${env === "unnamed" ? "gtm_auth" : `gtm_preview=${env}`}) yükleniyor; ziyaretçiler o ortama en son ne yayımlandıysa onu, çoğu zaman bir test veya geliştirme sürümünü çalıştırıyor.`,
+    dataLayerSplit: (list, step) => `"${step}" adımında aynı sayfadaki container'lar farklı dataLayer'ları okuyor: ${list.join(", ")}. Birine yapılan push diğerini okuyan container'lar tarafından hiç görülmez; olaylar ve onay komutları yalnızca bazılarına ulaşabilir.`,
+    sendToOnly: (id, by) => `${id} yalnızca bir olay send_to ile onu adlandırdığı için yüklendi; gtag('config', '${id}') hiç çalışmadı. ${by} ona varsayılan ayarlarla gönderiyor, bu yüzden bir config komutunun onun için ayarlayacağı hiçbir şey uygulanmıyor.`,
+    fromWidget: (origin, text) => `${origin} kaynaklı gömülü bir widget içinde: ${text}`,
+    widgetTracking: (origin, platforms) => `${origin} kaynaklı gömülü bir widget kendi izlemesini gönderdi: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. Bunlar sitenin kendi etiketlerinin kullanmadığı hesaplara gidiyor; bu yüzden plan, kapsam ve tekrar kontrollerinin dışında tutuldu, onay ve kişisel veri kontrolleri ise onları yine içeriyor.`,
+    iframeContainer: (id, origin, parent) => `${id}, ${parent} içine gömülü ${origin} kaynaklı bir iframe içinde çalışıyor. iframe'in kendi dataLayer'ı var: sayfada gönderilen olaylar ve onay komutları ona hiç ulaşmaz, bu yüzden kendi olaylarına ve onayına ihtiyacı var.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     consentDefaultNotApplied: () => "Sayfa bir Consent Mode varsayılanı gönderdi, ancak Google etiketi onu hiç uygulamadı; etiketleri varsayılan olmadan çalıştı. Tag Assistant, Consent Mode'u yapılandırılmamış gösterir.",
@@ -1151,6 +1231,12 @@ const tr = {
     page_crashed: "Aynı hatayı alan ziyaretçiler bozuk bir sayfa görür ve sayfadaki etiketler çalışmayabilir.",
     gclid_not_stored: "Dönüşümler ziyaretçiyi getiren reklam tıklamasına bağlanmıyor; Google Ads onları eksik raporluyor ve daha az veriyle teklif veriyor.",
     client_id_changed: "Bir ziyaretçi GA4'te iki kullanıcıya dönüşüyor: ziyaret bölünüyor, değişiklikten önceki yolculuk dönüşümlerini kaybediyor ve atıf baştan başlıyor.",
+    container_duplicate: "İki kez yüklenen bir container etiketlerini iki kez çalıştırabilir; sayfa görüntülemeleri ve dönüşümler şişer, en iyi ihtimalle kurulumlardan biri gereksizdir.",
+    container_environment: "Ziyaretçiler container'ın Live olmayan bir sürümünü çalıştırıyor; hâlâ test edilen etiketler ya da eski bir kurulum canlı veri topluyor.",
+    datalayer_split: "Bir dataLayer'a gönderilen olaylar ve onay komutları diğerini okuyan container'lara hiç ulaşmaz; bazı etiketler onları kaçırır.",
+    container_send_to_only: "Hedef kendi config'i olmadan çalışıyor; bir config komutunun ona vereceği ayarlar eksik.",
+    widget_tracking: "Sitenin izlemesinde bir sorun yok: widget'ın kendi istekleri sitenin isteklerinin yerine geçmesin diye plan kontrollerinin dışında tutuldu.",
+    iframe_container: "iframe içindeki etiketler sayfanın gönderdiklerini görmez; içinde tamamlanan dönüşümler izlenmeyebilir ya da ziyaretçinin onayı olmadan gönderilebilir.",
     campaign_params: "Kampanya parametreleri açılış yönlendirmesinden geçip isteklere ulaştı; ücretli tıklamalar kendi kampanyalarına yazılıyor.",
     event_id_reused: "İki farklı olay tek bir olay kimliğini paylaşıyor; platform ilkini tutup diğerini sessizce atıyor, gerçek bir olay kayboluyor.",
     event_id_mismatch: "Bu olayın tarayıcı ve sunucu kopyaları farklı kimlik taşıyor; Meta ikisini eşleştiremiyor ve dönüşümü iki kez sayıyor.",
@@ -1191,6 +1277,12 @@ const tr = {
     page_crashed: "Sayfayı sıradan bir tarayıcıda açın. Orada çalışıyorsa sitenin bot koruması betiklerini denetimin ağına vermedi; çalışmıyorsa bir dağıtım artık sahip olmadığı betik dosyalarını isteyen sayfalar sunuyor.",
     gclid_not_stored: "Dönüşüm bağlayıcı etiketini (ya da Ads kimliğiyle Google etiketini) her sayfada, sayfa yüklenince olduğu kadar onay verildiğinde de çalıştırın ve gclid'i o etiket çalışana kadar açılış adresinde tutun.",
     client_id_changed: "O adımda _ga'yı yeniden yazan ya da silen şeyi arayın: çerezleri temizleyen bir onay platformu, başka bir cookie_domain ya da cookie_prefix ile ikinci bir GA4 kurulumu, ya da _gl parametresi olmayan alan adları arası bir bağlantı.",
+    container_duplicate: "Tek bir kurulum bırakın: fazladan snippet'i ya da onu diğer container'da yeniden yükleyen etiketi kaldırın.",
+    container_environment: "Canlı sitede Live snippet'ini kullanın: GTM snippet'inden gtm_auth ve gtm_preview'ı çıkarın ya da ortamdaki sürümü Live'a yayımlayın.",
+    datalayer_split: "Tüm container'ları aynı dataLayer'a yönlendirin ya da olayları ve onay komutlarını container'ların okuduğu her dataLayer'a gönderin.",
+    container_send_to_only: "Hedefe gönderen olaylardan önce onun için bir gtag('config', ID) ya da GTM'de onun için bir Google etiketi ekleyin.",
+    widget_tracking: "Plan için düzeltilecek bir şey yok. Widget onaydan önce çerez yazıyor ya da veri gönderiyorsa onay bulguları onu adlandırır; nasıl durdurulacağını sağlayıcısına sorun.",
+    iframe_container: "Olayları ve onay durumunu iframe içinde de gönderin (ya da postMessage ile iletin) veya iframe'deki adımları sayfadan izleyin.",
     campaign_params: "Düzeltilecek bir şey yok. Açılış sayfaları değiştiğinde yönlendirmeleri yeniden kontrol edin.",
     event_id_reused: "Her olay için yeni bir olay kimliği üretin; sayfa yüklemesi başına bir kez değil.",
     event_id_mismatch: "Piksel olayı ve sunucu kopyası için tek bir olay kimliği kullanın: aynı değeri iki etikete de verin.",
@@ -1232,6 +1324,12 @@ const tr = {
     page_crashed: "hygiene",
     gclid_not_stored: "money",
     client_id_changed: "money",
+    container_duplicate: "money",
+    container_environment: "hygiene",
+    datalayer_split: "hygiene",
+    container_send_to_only: "hygiene",
+    widget_tracking: "hygiene",
+    iframe_container: "hygiene",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",