@analitikisler/ai-tag-debugger 0.22.0 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.22.1 (2026-11-04)
+
+- Runs can report different findings than 0.22.0 on the same site: an embedded widget's own hits no longer count as the site's, so a planned event only a widget sent is now missing, and the new `widget_tracking` and `iframe_container` (info) findings appear. A baseline written with 0.22.0 can then list stale or new entries; `--update-baseline` rewrites it.
+- Fixed: hits sent from inside an iframe counted as the site's own tracking, so an embedded widget (a booking or chat widget, a payment form, a video) tracking to its vendor's own accounts could satisfy a planned event, be listed as the site's unplanned events, or move the scores. Hits, dataLayer pushes, vendor calls and container loads from an iframe now record its origin, the page it is embedded in and whether it is on the site's own site. A third-party iframe's hits to accounts the site's own tags don't use are the widget's: they are left out of plan matching, coverage, duplicates, unplanned events and the scores, and kept for the consent and personal data checks, whose findings name the widget. A plan drafted with `aitd plan` leaves them out too.
+- New `widget_tracking` (info) finding: each embedded widget that tracked on its own, with its accounts and events. New `iframe_container` (info) finding: a container in a same-site iframe beside one in the page, which the page's dataLayer pushes and consent never reach.
+- The Google containers card and `report.md` table say which containers ran in an iframe. MCP step results mark each hit from an iframe and whether the plan checks count it, and the JSON timeline lists widget hits per step under `widget_hits`.
+
 ## 0.22.0 (2026-11-04)
 
 - Runs can report findings 0.21.0 did not on the same site (`container_duplicate`, `container_environment`, `datalayer_split`, `container_send_to_only`). A baseline written with 0.21.0 can then list new entries; `--update-baseline` rewrites it.

package/README.md

@@ -329,6 +329,14 @@ Each row also gives the dataLayer the container reads (`l=`), whether it came fr
 
 Four checks read it: `container_duplicate` (warning) for a container loaded more than once into one page, `container_environment` (warning) for a GTM environment (`gtm_preview`, `gtm_auth`) loaded instead of Live, `datalayer_split` (info) for containers on one page reading different dataLayers, and `container_send_to_only` (info) for a destination that only an event's `send_to` loaded, with no `gtag('config')` for it.
 
+### Embedded widgets and iframes
+
+Hits, dataLayer pushes, vendor calls and container loads sent from inside an iframe record which iframe: its origin, the page it is embedded in, and whether it is on the site's own site (a checkout or form on a subdomain) or someone else's (a booking or chat widget, a payment form, a video). A hit from a third-party iframe still counts as the site's when it goes to an account the site's own tags use: a GA4 ID, Ads conversion ID, pixel or container the page or a same-site iframe uses or configures, as when a booking engine is set up with the site's GA4 ID. Otherwise it is the widget's own tracking.
+
+A widget's own hits are left out of everything that judges the site's tracking: plan matching, coverage, duplicates, unplanned events and the scores. A widget's `purchase` to its vendor's property can't pass for the site's, and its events aren't listed as the site's. They still count for consent and personal data, since the site answers for what the widgets it embeds collect; those findings begin with "In an embedded widget from …". Each widget that tracked is named once in a `widget_tracking` (info) finding with its accounts and events, and a container running in a same-site iframe beside one in the page is noted as `iframe_container` (info): the page's dataLayer pushes and consent never reach it. A widget's dataLayer pushes are kept apart too, so its consent commands don't stand in for the site's.
+
+`capture.json` keeps the widget's hits under `widgetHits` and its pushes under `widgetDataLayerLog`, and every iframe entry has a `frame`. The Google containers card says which ran in an iframe. Over MCP, step results mark each hit from an iframe and whether the plan checks will count it, pushes from an iframe are prefixed with it, and the JSON timeline lists a widget's hits per step under `widget_hits`. Captures from older versions have no frames, so all of their hits stay the site's.
+
 ### Folder layout and plan IDs
 
 Plans and runs are kept in `aitd/` in the folder you run the tool from:

package/README.tr.md

@@ -329,6 +329,14 @@ Her satır ayrıca container'ın okuduğu dataLayer'ı (`l=`), Google'dan mı yo
 
 Dört kontrol bunu okur: aynı sayfaya birden fazla kez yüklenen bir container için `container_duplicate` (uyarı), Live yerine yüklenen bir GTM ortamı (`gtm_preview`, `gtm_auth`) için `container_environment` (uyarı), aynı sayfada farklı dataLayer'ları okuyan container'lar için `datalayer_split` (bilgi) ve kendisi için `gtag('config')` olmadan yalnızca bir olayın `send_to` değeriyle yüklenen bir hedef için `container_send_to_only` (bilgi).
 
+### Gömülü widget'lar ve iframe'ler
+
+Bir iframe içinden gönderilen istekler, dataLayer push'ları, sağlayıcı çağrıları ve container yüklemeleri hangi iframe'den geldiklerini kaydeder: kaynağını, gömülü olduğu sayfayı ve sitenin kendi sitesinde mi (bir alt alan adındaki ödeme ya da form) yoksa başkasının mı (bir rezervasyon ya da sohbet widget'ı, bir ödeme formu, bir video) olduğunu. Üçüncü taraf bir iframe'den gelen istek, sitenin kendi etiketlerinin kullandığı bir hesaba gidiyorsa yine sitenindir: sayfanın ya da aynı sitedeki bir iframe'in kullandığı veya yapılandırdığı bir GA4 kimliği, Ads dönüşüm kimliği, piksel ya da container; örneğin sitenin GA4 kimliğiyle kurulmuş bir rezervasyon motoru. Aksi hâlde widget'ın kendi izlemesidir.
+
+Bir widget'ın kendi istekleri, sitenin izlemesini değerlendiren her şeyin dışında tutulur: plan eşleştirme, kapsam, tekrarlar, planda olmayan olaylar ve puanlar. Widget'ın sağlayıcısının mülküne giden bir `purchase` sitenin yerine geçemez ve olayları sitenin olayları olarak listelenmez. Yine de onay ve kişisel veri için sayılırlar, çünkü site gömdüğü widget'ların topladıklarından sorumludur; bu bulgular "… kaynaklı gömülü bir widget içinde:" ile başlar. İzleme yapan her widget, hesapları ve olaylarıyla bir kez `widget_tracking` (bilgi) bulgusunda adlandırılır; sayfadakinin yanında aynı sitedeki bir iframe'de çalışan container ise `iframe_container` (bilgi) olarak not edilir: sayfanın dataLayer push'ları ve onayı ona hiç ulaşmaz. Widget'ın dataLayer push'ları da ayrı tutulur, böylece onay komutları sitenin komutlarının yerine geçmez.
+
+`capture.json` widget'ın isteklerini `widgetHits`, push'larını `widgetDataLayerLog` altında saklar ve her iframe kaydında bir `frame` bulunur. Google container'ları kartı hangilerinin bir iframe'de çalıştığını söyler. MCP'de adım sonuçları iframe'den gelen her isteği ve plan kontrollerinin onu sayıp saymayacağını işaretler, iframe'den gelen push'ların başına iframe yazılır ve JSON zaman akışı bir widget'ın isteklerini adım adım `widget_hits` altında listeler. Eski sürümlerin kayıtlarında frame bilgisi yoktur, bu yüzden tüm istekleri sitenin olarak kalır.
+
 ### Klasör yapısı ve plan kimlikleri
 
 Planlar ve çalıştırmalar, aracı çalıştırdığınız klasördeki `aitd/` içinde tutulur:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { AuditSession } from "./browser.js";
+import { splitRun } from "./frames.js";
 import { withCampaignParams } from "./campaign.js";
 import { messages } from "./i18n.js";
 import { createProvider, PROVIDERS } from "./providers.js";
@@ -237,7 +238,7 @@ export const journeyError = (err) => `The journey stopped with an error: ${err?.
 export function failedRun(journey, viewport, err, providers) {
   return {
     journeyId: journey.id, viewport, completed: false, note: journeyError(err), hits: [], steps: [], consentStep: null, rejectStep: null,
-    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
+    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], widgetHits: [], widgetDataLayerLog: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
   };
 }
 
@@ -246,7 +247,8 @@ export function collect(session, journey, viewport) {
     journeyId: journey.id,
     viewport,
     ...(journey.goal ? { goal: journey.goal } : {}),
-    hits: session.hits,
+    // The site's own hits and pushes; an embedded widget's are kept apart (see src/frames.js).
+    ...splitRun(session),
     steps: session.steps,
     consentStep: session.consentStep,
     rejectStep: session.rejectStep,
@@ -255,7 +257,6 @@ export function collect(session, journey, viewport) {
     cmp: session.cmp,
     // Hits let through to the real accounts (block_hits false, or a live MCP audit): the reports say so.
     ...(session.opts.blockHits === false ? { live: true } : {}),
-    dataLayerLog: session.dataLayerLog,
     containerLoads: session.containerLoads,
     network: session.network,
     providers: session.providers,

package/src/browser.js

@@ -11,6 +11,7 @@ import { startEgressProxy } from "./egress.js";
 import { campaignParamsIn } from "./campaign.js";
 import { detectCmpInPage } from "./cmp.js";
 import { callersOf, containerOf } from "./containers.js";
+import { frameInfo } from "./frames.js";
 
 // Consent banners of the common consent platforms (CMPs), by their container. A cover that matches
 // one of these always blocks the journey, and a reject click is checked against them afterwards.
@@ -587,11 +588,13 @@ export class AuditSession {
     }
     const record = this.opts.recordHar ? { recordHar: { path: this.opts.recordHar, mode: "minimal" } } : {};
     this.context = await this.browser.newContext({ ...device, locale: "en-US", ...record });
-    await this.context.exposeBinding("__atdRecord", (_source, entry) => {
+    await this.context.exposeBinding("__atdRecord", (source, entry) => {
+      const frame = frameInfo(source?.frame);
+      if (frame) entry = { ...entry, frame };
       this.lastTrackingAt = Date.now();
       this.record("dataLayerLog", { ...this.redactEntry(entry), step: this.currentStep, t: Date.now() });
     });
-    await this.context.exposeBinding("__atdLoad", (_source, entry) => this.recordLoad(entry));
+    await this.context.exposeBinding("__atdLoad", (source, entry) => this.recordLoad(entry, frameInfo(source?.frame)));
     await this.context.addInitScript(INIT_SCRIPT);
     this.page = await this.context.newPage();
     this.page.on("pageerror", (err) => this.errors.push({ step: this.currentStep, message: err.message }));
@@ -619,9 +622,10 @@ export class AuditSession {
       const hits = parseTrackingRequest(request.url(), request.postData());
       if (!hits) return;
       const recorded = [];
+      const frame = this.frameOf(request);
       for (const hit of hits) {
         if (!this.checks(hit.platform)) continue;
-        const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now() };
+        const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now(), ...(frame ? { frame } : {}) };
         const late = this.lateFor(hit, entry);
         if (late) Object.assign(entry, late);
         if (this.record("hits", entry)) recorded.push(entry);
@@ -660,6 +664,7 @@ export class AuditSession {
         ...this.storeBody(request),
         blocked: this.opts.blockHits && isCollectionEndpoint(request.url()),
         status: null,
+        ...((frame) => (frame ? { frame } : {}))(this.frameOf(request)),
       };
       if (this.record("network", call)) calls.set(request, call);
     });
@@ -823,7 +828,7 @@ export class AuditSession {
    * script did and, for a script, the callers on the stack. Only addresses without their query are kept, so
    * the environment token (gtm_auth) and user data in a page's query string never reach the capture.
    */
-  recordLoad(entry) {
+  recordLoad(entry, frame = null) {
     const container = containerOf(entry?.src);
     if (!container) return;
     this.record("containerLoads", {
@@ -834,9 +839,19 @@ export class AuditSession {
       doc: String(entry.doc ?? "").slice(0, 16),
       step: this.currentStep,
       t: Date.now(),
+      ...(frame ? { frame } : {}),
     });
   }
 
+  /** The iframe a request came from, as frameInfo gives it; null for the page itself or a worker. */
+  frameOf(request) {
+    try {
+      return frameInfo(request.frame());
+    } catch {
+      return null; // service worker requests have no frame
+    }
+  }
+
   /** Adds an entry to one of the logs, up to its limit. Returns false once the limit is reached. */
   record(log, entry) {
     if (this[log].length >= LOG_LIMITS[log]) {

package/src/checks.js

@@ -6,6 +6,7 @@ import { isOwnAddress } from "./redact.js";
 import { campaignParamsIn } from "./campaign.js";
 import { CONSENT_SIGNALS } from "./parsers.js";
 import { duplicateLoads, loadSources, splitLayers } from "./containers.js";
+import { widgetsOf } from "./frames.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -195,6 +196,11 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     if (skipped.length) findings.push({ ...base, severity: "info", check: "planned_out_of_scope", detail: d.plannedOutOfScope(skipped.map((e) => key(e.platform, e.name))) });
   }
   const stepLabel = (i) => run.steps[i]?.label ?? `step ${i}`;
+  // Embedded widgets' hits (run.widgetHits, see src/frames.js) count for consent and personal data only: the site
+  // answers for what the widgets it embeds collect, but they say nothing about its own tracking plan.
+  const legalHits = [...run.hits, ...(run.widgetHits ?? [])].sort((a, b) => (a.t ?? 0) - (b.t ?? 0));
+  const legalKey = (hit) => `${key(hit.platform, hit.name)}${hit.frame?.party === "third" ? `|${hit.frame.origin}` : ""}`;
+  const fromWidget = (hit, text) => ((run.widgetHits ?? []).includes(hit) ? d.fromWidget(hit.frame.origin, text) : text);
   const planEventFor = (hit) => plan.events.find((e) => hitMatchesEvent(e, hit));
   const planKeyOf = (hit) => { const e = planEventFor(hit); return e ? key(e.platform, e.name) : key(hit.platform, hit.name); };
 
@@ -383,6 +389,15 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     findings.push({ ...base, severity: "info", check: "container_send_to_only", platform: l.id.startsWith("G-") ? "ga4" : "google_ads", step: stepLabel(l.step), detail: d.sendToOnly(l.id, l.by) });
   }
 
+  // Widgets that tracked on their own, left out of the plan checks: said once per widget, so nothing goes missing silently.
+  for (const w of widgetsOf(run.widgetHits ?? [])) {
+    const first = (run.widgetHits ?? []).find((h) => h.frame.origin === w.origin);
+    findings.push({ ...base, severity: "info", check: "widget_tracking", step: stepLabel(first.step), detail: d.widgetTracking(w.origin, w.platforms) });
+  }
+  // A container in a same-site iframe beside one in the page: two documents, two dataLayers.
+  const iframeLoad = loads.find((l) => l.frame?.party === "site" && loads.some((t) => !t.frame && t.step <= l.step));
+  if (iframeLoad) findings.push({ ...base, severity: "info", check: "iframe_container", step: stepLabel(iframeLoad.step), detail: d.iframeContainer(iframeLoad.id, iframeLoad.frame.origin, iframeLoad.frame.parent) });
+
   // One event ID on two different events: the platform keeps the first and drops the other as its
   // duplicate, so a real event is lost (usually an ID set once per page instead of once per event).
   const byId = new Map();
@@ -518,15 +533,15 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     if (regranted) findings.push({ ...base, severity: "broken", check: "reject_ignored", step: stepLabel(regranted.step), detail: d.rejectIgnored() });
     else if (reject?.bannerOpenAfter) findings.push({ ...base, severity: "broken", check: "reject_button_failed", step: stepLabel(rejectStep), detail: d.rejectButtonFailed() });
     const afterReject = new Map();
-    for (const hit of run.hits) {
+    for (const hit of legalHits) {
       if (hit.step < rejectStep) continue;
       if (NON_GOOGLE_AD_PLATFORMS.has(hit.platform) || claimsGranted(hit)) {
-        const k = key(hit.platform, hit.name);
+        const k = legalKey(hit);
         if (!afterReject.has(k)) afterReject.set(k, hit);
       }
     }
     for (const [, hit] of afterReject) {
-      findings.push({ ...base, severity: "broken", check: "after_reject", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: d.afterReject(hit.platform, hit.name) });
+      findings.push({ ...base, severity: "broken", check: "after_reject", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: fromWidget(hit, d.afterReject(hit.platform, hit.name)) });
     }
   }
 
@@ -546,14 +561,14 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   }
 
   const beforeConsent = new Map();
-  for (const hit of run.hits) {
+  for (const hit of legalHits) {
     // Hits from the reject click on are covered by the after_reject check.
     if (rejectStep !== null && hit.step >= rejectStep) continue;
     const early = granted === null || hit.step < granted;
     if (!early) continue;
     const adPlatform = NON_GOOGLE_AD_PLATFORMS.has(hit.platform);
     if (adPlatform || claimsGranted(hit)) {
-      const k = key(hit.platform, hit.name);
+      const k = legalKey(hit);
       if (!beforeConsent.has(k)) beforeConsent.set(k, hit);
     }
   }
@@ -565,26 +580,26 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
       platform: hit.platform,
       event: hit.name,
       step: stepLabel(hit.step),
-      detail: granted === null ? d.beforeConsentNever(hit.platform, hit.name) : d.beforeConsent(hit.platform, hit.name),
+      detail: fromWidget(hit, granted === null ? d.beforeConsentNever(hit.platform, hit.name) : d.beforeConsent(hit.platform, hit.name)),
     });
   }
 
   // Personal data in hits.
   const piiSeen = new Set();
-  for (const hit of run.hits) {
+  for (const hit of legalHits) {
     let url = hit.url;
     try {
       url = decodeURIComponent(hit.url);
     } catch { /* malformed % sequence, e.g. "50%": search the raw URL */ }
     const haystack = url + " " + JSON.stringify(hit.params);
-    if (piiSeen.has(key(hit.platform, hit.name))) continue;
+    if (piiSeen.has(legalKey(hit))) continue;
     // User data for ad matching is redacted at capture; userData.plain lists the fields that were not hashed.
     if (hit.userData?.plain?.length) {
-      piiSeen.add(key(hit.platform, hit.name));
-      findings.push({ ...base, severity: "risk", check: "pii", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: d.piiUnhashed(hit.platform, hit.name, hit.userData.plain) });
+      piiSeen.add(legalKey(hit));
+      findings.push({ ...base, severity: "risk", check: "pii", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: fromWidget(hit, d.piiUnhashed(hit.platform, hit.name, hit.userData.plain)) });
     } else if (visitorEmailIn(haystack, hit)) {
-      piiSeen.add(key(hit.platform, hit.name));
-      findings.push({ ...base, severity: "risk", check: "pii", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: d.pii(hit.platform, hit.name) });
+      piiSeen.add(legalKey(hit));
+      findings.push({ ...base, severity: "risk", check: "pii", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: fromWidget(hit, d.pii(hit.platform, hit.name)) });
     }
   }
 

package/src/containers.js

@@ -114,16 +114,17 @@ export function loadSources(run) {
 
 /**
  * One row per container and source across runs, in the order first seen: { id, script, layer, served, host,
- * environment?, kind, by?, pages, journeys }.
+ * environment?, kind, by?, frame?, pages, journeys }, where frame is the iframe it loaded in, if any.
  */
 export function containerRows(runs) {
   const rows = new Map();
   for (const run of runs) {
     for (const l of loadSources(run)) {
-      const k = [l.id, l.kind, l.by ?? "", l.host, l.layer, l.environment ?? ""].join("|");
+      const k = [l.id, l.kind, l.by ?? "", l.host, l.layer, l.environment ?? "", l.frame?.origin ?? ""].join("|");
       const row = rows.get(k) ?? {
         id: l.id, script: l.script, layer: l.layer, served: l.served, host: l.host,
         ...(l.environment ? { environment: l.environment } : {}), kind: l.kind, ...(l.by ? { by: l.by } : {}),
+        ...(l.frame ? { frame: { origin: l.frame.origin, party: l.frame.party } } : {}),
         pages: new Set(), journeys: new Set(),
       };
       if (l.page) row.pages.add(l.page);

package/src/discover.js

@@ -1,5 +1,6 @@
 import { AuditSession } from "./browser.js";
 import { runAgentJourney, StepTimeout } from "./agent.js";
+import { splitRun } from "./frames.js";
 
 /** The goal of the browsing part: one page of each type, nothing submitted. */
 export const DISCOVER_GOAL = `Explore this site to draft its analytics measurement plan. You are not completing a purchase or any other task: visit ONE example of each kind of page that exists here and look at what a visitor can do on it, then call finish with success true.
@@ -169,14 +170,16 @@ export async function discoverPlan(opts) {
   const pages = pagesSeen(snapshots);
   if (!pages.length) throw new Error("The explorer saw no pages, so there is nothing to plan from.");
   log(`\nExplored ${pages.length} pages${outcome.completed ? "" : ` (${outcome.note})`}. Drafting the plan…`);
-  const existing = [...new Set(session.hits.map((h) => `${h.platform}:${h.name}`))];
+  // An embedded widget's hits are not the site's tracking, so the plan leaves them out.
+  const ownHits = splitRun(session).hits;
+  const existing = [...new Set(ownHits.map((h) => `${h.platform}:${h.name}`))];
   const result = await opts.provider.json({
     system: topic ? `${PLAN_SYSTEM}\nThis plan covers only ${opts.topic}. Propose only ${topic.propose}.` : PLAN_SYSTEM,
     texts: [`Site: ${opts.site}`, `Pages visited:\n${JSON.stringify(pages, null, 1)}`, `Tracking hits the site already sends: ${existing.length ? existing.join(", ") : "none"}`],
     schema: PLAN_SCHEMA,
   });
   if (result.error) throw new Error(`The model did not return a plan (${result.error}).`);
-  const plan = toPlan(opts.site, result.value, session.hits);
+  const plan = toPlan(opts.site, result.value, ownHits);
   if (topic) plan.events = plan.events.filter(topic.keep);
   const coverage = pageTypeCoverage(plan.pages);
   log(`Page types found: ${coverage.found.join(", ") || "none"}`);

package/src/frames.js

@@ -0,0 +1,90 @@
+// Whose tracking a hit is: the site's own, or an embedded widget's. Hits, dataLayer pushes, vendor calls and
+// container loads from an iframe carry { origin, party, parent }: party "site" when the iframe is on the page's
+// own site (a checkout or form on a subdomain), "third" when it is someone else's (a booking or chat widget,
+// a payment form, a video). A third-party iframe's hit is still the site's when it goes to an account the
+// site's own tags use (a booking engine set up with the site's GA4 ID); otherwise it is the widget's.
+import { siteOf } from "./redact.js";
+
+/**
+ * A Playwright frame as { origin, party, parent }, or null for a page's main frame and for frames without an
+ * http(s) address (about:blank, srcdoc), which the page's own scripts write. parent is the address of the
+ * page it is embedded in, without its query.
+ */
+export function frameInfo(frame) {
+  if (!frame) return null;
+  let top;
+  try {
+    top = frame.page()?.mainFrame();
+  } catch {
+    return null;
+  }
+  if (!top || frame === top) return null;
+  let u;
+  let t;
+  try {
+    u = new URL(frame.url());
+    t = new URL(top.url());
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || !/^https?:$/.test(t.protocol)) return null;
+  return { origin: u.origin, party: siteOf(u.hostname) === siteOf(t.hostname) ? "site" : "third", parent: t.origin + t.pathname };
+}
+
+/** Whether a hit, push or load came from the page itself or an iframe on the same site. */
+export const isSiteFrame = (x) => !x?.frame || x.frame.party !== "third";
+
+// Account IDs as the hits and the containers name them: GA4's G-…, Google Ads' AW-… (a numeric conversion ID in
+// its hits), Meta's pixel ID and so on. Compared per platform family, without the AW- prefix.
+const idKey = (id) => String(id).trim().toUpperCase().replace(/^AW-/, "");
+
+/**
+ * The account IDs the site's own tags use: the containers loaded in the page or a same-site iframe, the IDs its
+ * hits went to, and the destinations its gtag('config') commands name.
+ */
+export function siteIds({ hits = [], containerLoads = [], dataLayerLog = [] }) {
+  const ids = new Set();
+  for (const l of containerLoads) if (isSiteFrame(l)) ids.add(idKey(l.id));
+  for (const h of hits) if (isSiteFrame(h) && h.id) ids.add(idKey(h.id));
+  for (const e of dataLayerLog) {
+    if (isSiteFrame(e) && Array.isArray(e.value) && e.value[0] === "config" && typeof e.value[1] === "string") ids.add(idKey(e.value[1]));
+  }
+  return ids;
+}
+
+/** Whether a hit is an embedded widget's: sent from a third-party iframe to an account the site's tags don't use. */
+export function isWidgetHit(hit, ids) {
+  return !isSiteFrame(hit) && !(hit.id && ids.has(idKey(hit.id)));
+}
+
+/**
+ * The run's hits and dataLayer pushes split into the site's own and the widgets': { hits, widgetHits,
+ * dataLayerLog, widgetDataLayerLog }. Plan, coverage and duplicate checks read only the site's; the consent and
+ * personal data checks read both, since the site answers for what the widgets it embeds collect.
+ */
+export function splitRun({ hits = [], containerLoads = [], dataLayerLog = [] }) {
+  const ids = siteIds({ hits, containerLoads, dataLayerLog });
+  return {
+    hits: hits.filter((h) => !isWidgetHit(h, ids)),
+    widgetHits: hits.filter((h) => isWidgetHit(h, ids)),
+    dataLayerLog: dataLayerLog.filter(isSiteFrame),
+    widgetDataLayerLog: dataLayerLog.filter((e) => !isSiteFrame(e)),
+  };
+}
+
+/** The widgets that sent hits, by iframe origin: [{ origin, parent, platforms: [{ platform, ids, events }] }]. */
+export function widgetsOf(widgetHits = []) {
+  const byOrigin = new Map();
+  for (const h of widgetHits) {
+    const w = byOrigin.get(h.frame.origin) ?? { origin: h.frame.origin, parent: h.frame.parent, platforms: new Map() };
+    const p = w.platforms.get(h.platform) ?? { platform: h.platform, ids: new Set(), events: new Set() };
+    if (h.id) p.ids.add(h.id);
+    p.events.add(h.name);
+    w.platforms.set(h.platform, p);
+    byOrigin.set(h.frame.origin, w);
+  }
+  return [...byOrigin.values()].map((w) => ({
+    origin: w.origin, parent: w.parent,
+    platforms: [...w.platforms.values()].map((p) => ({ platform: p.platform, ids: [...p.ids], events: [...p.events] })),
+  }));
+}

package/src/html/scope.js

@@ -200,7 +200,7 @@ function containersCard(ctx) {
   const rows = containerRows(runs);
   if (!rows.length) return null;
   const c = m.ui.containers;
-  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
+  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
   const ids = uniq(rows.map((r) => r.id));
   return `<li><details class="card inv" id="inv-containers"><summary><span class="t">${esc(m.ui.containersTitle)}</span>${plain(n(ids.length))}<span class="inv-m">${esc(ids.slice(0, 3).join(", "))}${ids.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.containersIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
 }

package/src/i18n.js

@@ -213,6 +213,7 @@ const en = {
       script: { gtm: "GTM container", gtag: "Google tag" },
       served: { google: "Google", site: "The site's own domain" },
       environment: (env) => (env === "unnamed" ? "GTM environment" : `GTM environment ${env}`),
+      iframe: (origin, party) => `In an iframe from ${origin} (${party === "site" ? "same site" : "third party"})`,
       kinds: {
         html: () => "A script tag in the page's HTML",
         inline: () => "Inline code in the page (the snippet)",
@@ -350,6 +351,9 @@ const en = {
     containerEnvironment: (id, env) => `${id} is loaded from a GTM environment (${env === "unnamed" ? "gtm_auth" : `gtm_preview=${env}`}) instead of the Live version, so visitors run whatever was last published to that environment, often a staging or development version.`,
     dataLayerSplit: (list, step) => `Containers on one page at "${step}" read different dataLayers: ${list.join(", ")}. A push to one is never seen by the containers reading another, so events and consent commands may reach only some of them.`,
     sendToOnly: (id, by) => `${id} was loaded only because an event named it in send_to; no gtag('config', '${id}') ran. ${by} sends to it with default settings, so whatever a config command would set for it does not apply.`,
+    fromWidget: (origin, text) => `In an embedded widget from ${origin}: ${text}`,
+    widgetTracking: (origin, platforms) => `An embedded widget from ${origin} sent its own tracking: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. It goes to accounts the site's own tags don't use, so it was left out of the plan, coverage and duplicate checks; the consent and personal data checks still include it.`,
+    iframeContainer: (id, origin, parent) => `${id} runs in an iframe from ${origin} embedded in ${parent}. The iframe has its own dataLayer: events and consent commands pushed in the page never reach it, so it needs its own.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     consentDefaultNotApplied: () => "The page pushed a Consent Mode default, but the Google tag never applied it, so its tags ran without one. Tag Assistant shows Consent Mode as not configured.",
@@ -409,6 +413,8 @@ const en = {
     container_environment: "Visitors run a non-Live version of the container, so tags still under test, or an old setup, collect production data.",
     datalayer_split: "Events and consent commands pushed to one dataLayer never reach the containers reading another, so some tags miss them.",
     container_send_to_only: "The destination runs without its own config, so the settings a config command would give it are missing.",
+    widget_tracking: "Nothing is wrong with the site's tracking: the widget's own hits were kept out of the plan checks so they can't pass for the site's.",
+    iframe_container: "Tags in the iframe miss what the page pushes, so conversions completed in it can go untracked or be sent without the visitor's consent.",
     campaign_params: "Campaign parameters survived the landing redirect and reached the hits, so paid clicks are credited to their campaigns.",
     event_id_reused: "Two different events share one event ID, so the platform keeps the first and silently drops the other: a real event is lost.",
     event_id_mismatch: "The browser and server copies of this event carry different IDs, so Meta cannot pair them and counts the conversion twice.",
@@ -455,6 +461,8 @@ const en = {
     container_environment: "Use the Live snippet in production: take gtm_auth and gtm_preview out of the GTM snippet, or publish what the environment holds to Live.",
     datalayer_split: "Point every container at the same dataLayer, or push events and consent commands to each dataLayer the containers read.",
     container_send_to_only: "Add a gtag('config', ID) for the destination before the events that send to it, or a Google tag for it in GTM.",
+    widget_tracking: "Nothing to fix for the plan. If the widget sets cookies or sends data before consent, the consent findings name it; ask its vendor how to hold it back.",
+    iframe_container: "Push the events and the consent state inside the iframe as well (or pass them in with postMessage), or track the iframe's steps from the page.",
     campaign_params: "Nothing to fix. Check the redirects again when the landing pages change.",
     event_id_reused: "Generate a new event ID for every event, not once per page load.",
     event_id_mismatch: "Use one event ID for the pixel event and the server copy: pass the same value to both tags.",
@@ -501,6 +509,8 @@ const en = {
     container_environment: "hygiene",
     datalayer_split: "hygiene",
     container_send_to_only: "hygiene",
+    widget_tracking: "hygiene",
+    iframe_container: "hygiene",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",
@@ -1030,6 +1040,7 @@ const tr = {
       script: { gtm: "GTM container'ı", gtag: "Google etiketi" },
       served: { google: "Google", site: "Sitenin kendi alan adı" },
       environment: (env) => (env === "unnamed" ? "GTM ortamı" : `GTM ortamı ${env}`),
+      iframe: (origin, party) => `${origin} kaynaklı bir iframe içinde (${party === "site" ? "aynı site" : "üçüncü taraf"})`,
       kinds: {
         html: () => "Sayfanın HTML'indeki bir script etiketi",
         inline: () => "Sayfadaki satır içi kod (snippet)",
@@ -1163,6 +1174,9 @@ const tr = {
     containerEnvironment: (id, env) => `${id}, Live sürüm yerine bir GTM ortamından (${env === "unnamed" ? "gtm_auth" : `gtm_preview=${env}`}) yükleniyor; ziyaretçiler o ortama en son ne yayımlandıysa onu, çoğu zaman bir test veya geliştirme sürümünü çalıştırıyor.`,
     dataLayerSplit: (list, step) => `"${step}" adımında aynı sayfadaki container'lar farklı dataLayer'ları okuyor: ${list.join(", ")}. Birine yapılan push diğerini okuyan container'lar tarafından hiç görülmez; olaylar ve onay komutları yalnızca bazılarına ulaşabilir.`,
     sendToOnly: (id, by) => `${id} yalnızca bir olay send_to ile onu adlandırdığı için yüklendi; gtag('config', '${id}') hiç çalışmadı. ${by} ona varsayılan ayarlarla gönderiyor, bu yüzden bir config komutunun onun için ayarlayacağı hiçbir şey uygulanmıyor.`,
+    fromWidget: (origin, text) => `${origin} kaynaklı gömülü bir widget içinde: ${text}`,
+    widgetTracking: (origin, platforms) => `${origin} kaynaklı gömülü bir widget kendi izlemesini gönderdi: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. Bunlar sitenin kendi etiketlerinin kullanmadığı hesaplara gidiyor; bu yüzden plan, kapsam ve tekrar kontrollerinin dışında tutuldu, onay ve kişisel veri kontrolleri ise onları yine içeriyor.`,
+    iframeContainer: (id, origin, parent) => `${id}, ${parent} içine gömülü ${origin} kaynaklı bir iframe içinde çalışıyor. iframe'in kendi dataLayer'ı var: sayfada gönderilen olaylar ve onay komutları ona hiç ulaşmaz, bu yüzden kendi olaylarına ve onayına ihtiyacı var.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     consentDefaultNotApplied: () => "Sayfa bir Consent Mode varsayılanı gönderdi, ancak Google etiketi onu hiç uygulamadı; etiketleri varsayılan olmadan çalıştı. Tag Assistant, Consent Mode'u yapılandırılmamış gösterir.",
@@ -1221,6 +1235,8 @@ const tr = {
     container_environment: "Ziyaretçiler container'ın Live olmayan bir sürümünü çalıştırıyor; hâlâ test edilen etiketler ya da eski bir kurulum canlı veri topluyor.",
     datalayer_split: "Bir dataLayer'a gönderilen olaylar ve onay komutları diğerini okuyan container'lara hiç ulaşmaz; bazı etiketler onları kaçırır.",
     container_send_to_only: "Hedef kendi config'i olmadan çalışıyor; bir config komutunun ona vereceği ayarlar eksik.",
+    widget_tracking: "Sitenin izlemesinde bir sorun yok: widget'ın kendi istekleri sitenin isteklerinin yerine geçmesin diye plan kontrollerinin dışında tutuldu.",
+    iframe_container: "iframe içindeki etiketler sayfanın gönderdiklerini görmez; içinde tamamlanan dönüşümler izlenmeyebilir ya da ziyaretçinin onayı olmadan gönderilebilir.",
     campaign_params: "Kampanya parametreleri açılış yönlendirmesinden geçip isteklere ulaştı; ücretli tıklamalar kendi kampanyalarına yazılıyor.",
     event_id_reused: "İki farklı olay tek bir olay kimliğini paylaşıyor; platform ilkini tutup diğerini sessizce atıyor, gerçek bir olay kayboluyor.",
     event_id_mismatch: "Bu olayın tarayıcı ve sunucu kopyaları farklı kimlik taşıyor; Meta ikisini eşleştiremiyor ve dönüşümü iki kez sayıyor.",
@@ -1265,6 +1281,8 @@ const tr = {
     container_environment: "Canlı sitede Live snippet'ini kullanın: GTM snippet'inden gtm_auth ve gtm_preview'ı çıkarın ya da ortamdaki sürümü Live'a yayımlayın.",
     datalayer_split: "Tüm container'ları aynı dataLayer'a yönlendirin ya da olayları ve onay komutlarını container'ların okuduğu her dataLayer'a gönderin.",
     container_send_to_only: "Hedefe gönderen olaylardan önce onun için bir gtag('config', ID) ya da GTM'de onun için bir Google etiketi ekleyin.",
+    widget_tracking: "Plan için düzeltilecek bir şey yok. Widget onaydan önce çerez yazıyor ya da veri gönderiyorsa onay bulguları onu adlandırır; nasıl durdurulacağını sağlayıcısına sorun.",
+    iframe_container: "Olayları ve onay durumunu iframe içinde de gönderin (ya da postMessage ile iletin) veya iframe'deki adımları sayfadan izleyin.",
     campaign_params: "Düzeltilecek bir şey yok. Açılış sayfaları değiştiğinde yönlendirmeleri yeniden kontrol edin.",
     event_id_reused: "Her olay için yeni bir olay kimliği üretin; sayfa yüklemesi başına bir kez değil.",
     event_id_mismatch: "Piksel olayı ve sunucu kopyası için tek bir olay kimliği kullanın: aynı değeri iki etikete de verin.",
@@ -1310,6 +1328,8 @@ const tr = {
     container_environment: "hygiene",
     datalayer_split: "hygiene",
     container_send_to_only: "hygiene",
+    widget_tracking: "hygiene",
+    iframe_container: "hygiene",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",

package/src/mcp.js

@@ -34,6 +34,7 @@ import { hitParams } from "./hit-params.js";
 import { CAMPAIGN_PARAMS, campaignParamsIn, withCampaignParams } from "./campaign.js";
 import { cmpFacts } from "./cmp.js";
 import { containerRows, loadSources } from "./containers.js";
+import { isWidgetHit, siteIds } from "./frames.js";
 import { consentMatrixMarkdown, consentTable, runConsentScenarios } from "./consent.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
@@ -91,20 +92,29 @@ const consentText = (c) => Object.entries(c).map(([k, v]) => `${k}=${v}`).join("
 /** The Google protocol fields of a hit, short: values for the ids and consent strings, bare names for the 1-flags. */
 const protocolText = (p) => Object.entries(p).map(([k, v]) => (["_fv", "_ss", "_nsi"].includes(k) && v === "1" ? k : `${k}=${v}`)).join(" ");
 
-function describeHit(h, steps, index) {
+/** Where an iframe's hit came from, and whether the plan checks will count it (see src/frames.js). */
+function frameNote(h, ids) {
+  if (!h.frame) return "";
+  if (h.frame.party === "site") return ` (from an iframe on the site: ${h.frame.origin})`;
+  return isWidgetHit(h, ids)
+    ? ` (from an embedded widget at ${h.frame.origin}, to an account the site's tags don't use: left out of the plan checks, kept for consent and personal data)`
+    : ` (from a third-party iframe at ${h.frame.origin}, to the site's own account)`;
+}
+
+function describeHit(h, steps, index, ids = new Set()) {
   const entries = Object.entries(h.params ?? {}).filter(([k]) => !["v", "tid", "gtm", "_p", "cid", "sid", "_s", "sct", "seg", "dl", "dr", "dt", "ul", "sr", "_et", "en"].includes(k));
   const params = [
     ...entries.filter(([k]) => !WHOLE_FIELDS.has(k)).slice(0, 12).map(([k, v]) => cut(`${k}=${show(v)}`, VALUE_LIMIT)),
     ...entries.filter(([k]) => WHOLE_FIELDS.has(k)).map(([k, v]) => `${k}=${show(v)}`),
   ].join(", ");
   const late = h.late ? ` (arrived ${(h.late.ms / 1000).toFixed(1)} s late, after the step that loaded its page: "${steps[h.step]?.label ?? `step ${h.step}`}")` : "";
-  return `- [h${index}] ${h.platform} ${h.name}${h.consent ? ` [consent ${consentText(h.consent)}]` : ""}${h.protocol ? ` {${protocolText(h.protocol)}}` : ""}${params ? `: ${params}` : ""}${late}`;
+  return `- [h${index}] ${h.platform} ${h.name}${h.consent ? ` [consent ${consentText(h.consent)}]` : ""}${h.protocol ? ` {${protocolText(h.protocol)}}` : ""}${params ? `: ${params}` : ""}${late}${frameNote(h, ids)}`;
 }
 
 /** A consent command in full, as key=value; any other push as JSON, cut, with its page address fields whole. */
 function describePush(p) {
   // Pushes to a dataLayer of another name (a container's l=) say which.
-  const layer = p.layer ? `[${p.layer}] ` : "";
+  const layer = `${p.frame ? `[iframe ${p.frame.origin}] ` : ""}${p.layer ? `[${p.layer}] ` : ""}`;
   if (isConsentCommand(p, "default") || isConsentCommand(p, "update")) {
     const signals = p.value[2] && typeof p.value[2] === "object" ? Object.entries(p.value[2]).map(([k, v]) => `${k}=${show(v)}`).join(" ") : show(p.value[2]);
     return `- ${layer}consent ${p.value[1]}: ${signals}`;
@@ -156,13 +166,14 @@ function cookieLines(session, step) {
 /** One container load in words: its ID, what inserted it, its dataLayer and where it came from. */
 function describeLoad(l) {
   const c = messages("en").ui.containers;
-  const extra = [l.layer !== "dataLayer" && `dataLayer ${l.layer}`, l.served === "site" && `served from ${l.host}`, l.environment && c.environment(l.environment)].filter(Boolean);
+  const extra = [l.layer !== "dataLayer" && `dataLayer ${l.layer}`, l.served === "site" && `served from ${l.host}`, l.environment && c.environment(l.environment), l.frame && c.iframe(l.frame.origin, l.frame.party)].filter(Boolean);
   return `  ${l.id} (${c.script[l.script]}): ${c.kinds[l.kind](l.by)}${extra.length ? `; ${extra.join(", ")}` : ""}`;
 }
 
 export function stepCapture(audit, step) {
   const { session } = audit;
   const hits = session.hits.filter((h) => h.step === step);
+  const ids = siteIds(session);
   const pushes = session.dataLayerLog.filter((e) => e.step === step);
   // Hits that arrived during this step for a page an earlier step loaded are listed there, and noted here.
   const lateHere = session.hits.filter((h) => h.late?.during === step);
@@ -173,7 +184,7 @@ export function stepCapture(audit, step) {
     ...(problem?.kind === "crash" ? [`WARNING: the page crashed in the browser (the ${problem.vendor} error screen)${problem.refusedScripts ? `; ${problem.refusedScripts} of its own scripts came back as HTML pages, which bot protection or a mismatched deployment does` : ""}. Its tags may never have run.`] : []),
     `Step ${step}: "${session.steps[step]?.label ?? ""}". Read a hit's full parameters with get_hit (audit_id, step ${step}, its [h] number).`,
     `Tracking hits sent by this step: ${hits.length}`,
-    ...hits.map((h, i) => describeHit(h, session.steps, i)),
+    ...hits.map((h, i) => describeHit(h, session.steps, i, ids)),
   ];
   if (lateHere.length) lines.push(`Arrived during this step but belong to the step that loaded their page: ${lateHere.map((h) => `${h.platform} ${h.name} (step "${session.steps[h.step]?.label ?? h.step}")`).join(", ")}`);
   if (pings.length) lines.push("Other calls to analytics and ad endpoints, not read as events (Consent Mode pings, resends, remarketing):", ...pings.map(describeCall));
@@ -233,6 +244,7 @@ function containerJson(l) {
     ...(l.layer !== "dataLayer" ? { data_layer: l.layer } : {}),
     ...(l.served === "site" ? { served_from: l.host } : {}),
     ...(l.environment ? { gtm_environment: l.environment } : {}),
+    ...(l.frame ? { iframe: { origin: l.frame.origin, party: l.frame.party } } : {}),
     ...(l.pages ? { pages: l.pages } : {}),
   };
 }
@@ -245,7 +257,7 @@ export function containerLines(runs) {
   return [
     "Google containers (how each reached the page):",
     ...rows.map((r) => {
-      const extra = [r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
+      const extra = [r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), r.frame && c.iframe(r.frame.origin, r.frame.party), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
       return `  ${r.id} (${c.script[r.script]}): ${c.kinds[r.kind](r.by)}; ${extra.join(", ")}`;
     }),
   ];
@@ -261,7 +273,10 @@ export function timelineOf(run) {
     const names = (kind) => [...new Set(changes.filter((c) => c.change === kind).map((c) => c.name))];
     const entry = { step: st.index, action: st.label, ...(st.pagePath ? { page: st.pagePath } : {}) };
     if (st.error) entry.error = st.error;
-    if (hits.length) entry.hits = hits.map((h) => ({ platform: h.platform, event: h.name, ...(h.consent ? { consent: h.consent } : {}), ...(h.late ? { late_ms: h.late.ms } : {}) }));
+    if (hits.length) entry.hits = hits.map((h) => ({ platform: h.platform, event: h.name, ...(h.consent ? { consent: h.consent } : {}), ...(h.late ? { late_ms: h.late.ms } : {}), ...(h.frame ? { iframe: h.frame.origin } : {}) }));
+    // An embedded widget's own hits, kept apart from the site's (see src/frames.js).
+    const widget = (run.widgetHits ?? []).filter((h) => h.step === st.index);
+    if (widget.length) entry.widget_hits = widget.map((h) => ({ widget: h.frame.origin, platform: h.platform, event: h.name, ...(h.id ? { id: h.id } : {}), ...(h.consent ? { consent: h.consent } : {}) }));
     if (others.length) entry.other_tracking_calls = others.length;
     if (commands.length) entry.consent_commands = commands.map((e) => ({ [e.value[1]]: e.value[2] }));
     if (st.tagConsent) entry.tag_consent = Object.fromEntries(Object.entries(st.tagConsent.entries).map(([k, e]) => [k, e.update ?? e.default ?? null]));

package/src/report.js

@@ -405,7 +405,7 @@ function mdContainers(m, runs) {
   const lines = [`## ${m.ui.containersTitle}`, "", `| ${m.ui.containerCol} | ${m.ui.sourceCol} | ${m.ui.layerCol} | ${m.ui.servedCol} | ${m.ui.pagesCol} |`, "|---|---|---|---|---|"];
   for (const r of rows.slice(0, MD_INVENTORY_ROWS)) {
     const served = r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`;
-    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${r.pages.length} |`);
+    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.frame ? `, ${mdText(c.iframe(r.frame.origin, r.frame.party))}` : ""}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${r.pages.length} |`);
   }
   if (rows.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(rows.length - MD_INVENTORY_ROWS, "report.html"));
   lines.push("");