@analitikisler/ai-tag-debugger 0.22.1 → 0.22.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.22.2 (2026-11-04)
+
+- Runs can report a finding 0.22.1 did not on the same site (`container_failed`). A baseline written with 0.22.1 can then list new entries; `--update-baseline` rewrites it.
+- Each Google container shows its published version (the number its `gtm.js` or `gtag/js` data opens with, as in GTM's Versions tab), the script's size and how long it took to load, in the Google containers card, `report.md` (a new **Version and size** column) and over MCP: step results, `get_containers`, `finish_audit`, `run_audit`, the JSON timeline and `get_report` with `part: "containers"` (`version`, `size_bytes`, `transfer_bytes`, `load_ms`). `capture.json` keeps each container script's answer under `containerScripts`.
+- New check `container_failed` (warning): a container script that failed to load or was answered with an error status, such as a wrong container ID or a server container that doesn't serve `gtm.js`, so none of its tags ran on that page.
+
 ## 0.22.1 (2026-11-04)
 
 - Runs can report different findings than 0.22.0 on the same site: an embedded widget's own hits no longer count as the site's, so a planned event only a widget sent is now missing, and the new `widget_tracking` and `iframe_container` (info) findings appear. A baseline written with 0.22.0 can then list stale or new entries; `--update-baseline` rewrites it.

package/README.md

@@ -325,9 +325,9 @@ Under the inventory, **Google containers** lists every GTM container (`gtm.js`)
 | An event's `send_to` with no config | The Google tag loaded the destination only because an event was sent to it |
 | A destination of the Google tag | The Google tag loaded it with no command in the page, such as a linked destination |
 
-Each row also gives the dataLayer the container reads (`l=`), whether it came from Google or from the site's own domain (the Google tag gateway or a server container), the GTM environment when the snippet names one, and the pages it loaded on. A container reading a dataLayer of another name has its pushes recorded too, marked with that name. `report.md` has the same table. Over MCP, step results and `get_step` list the containers each step loaded, `get_containers` lists them all while the audit is open, `finish_audit` and `run_audit` end with them, `get_report` returns them with `part: "containers"` and the JSON timeline carries them per step. `capture.json` keeps the loads under `containerLoads`. The environment token (`gtm_auth`) and the page's query string are never kept.
+Each row also gives the container's published version (the number its `gtm.js` or `gtag/js` data opens with, as in GTM's Versions tab), the script's size and how long it took to load, the dataLayer the container reads (`l=`), whether it came from Google or from the site's own domain (the Google tag gateway or a server container), the GTM environment when the snippet names one, and the pages it loaded on. A container reading a dataLayer of another name has its pushes recorded too, marked with that name. `report.md` has the same table. Over MCP, step results and `get_step` list the containers each step loaded, `get_containers` lists them all while the audit is open, `finish_audit` and `run_audit` end with them, `get_report` returns them with `part: "containers"` and the JSON timeline carries them per step. `capture.json` keeps the loads under `containerLoads`. The environment token (`gtm_auth`) and the page's query string are never kept.
 
-Four checks read it: `container_duplicate` (warning) for a container loaded more than once into one page, `container_environment` (warning) for a GTM environment (`gtm_preview`, `gtm_auth`) loaded instead of Live, `datalayer_split` (info) for containers on one page reading different dataLayers, and `container_send_to_only` (info) for a destination that only an event's `send_to` loaded, with no `gtag('config')` for it.
+Five checks read it: `container_failed` (warning) for a container script that failed to load or was answered with an error, so none of its tags ran, `container_duplicate` (warning) for a container loaded more than once into one page, `container_environment` (warning) for a GTM environment (`gtm_preview`, `gtm_auth`) loaded instead of Live, `datalayer_split` (info) for containers on one page reading different dataLayers, and `container_send_to_only` (info) for a destination that only an event's `send_to` loaded, with no `gtag('config')` for it.
 
 ### Embedded widgets and iframes
 

package/README.tr.md

@@ -325,9 +325,9 @@ Envanterin altında **Google container'ları**, sayfaların yüklediği her GTM
 | config olmadan bir olayın `send_to` değeri | Google etiketi hedefi yalnızca ona bir olay gönderildiği için yükledi |
 | Google etiketinin bir hedefi | Google etiketi onu sayfada bir komut olmadan yükledi, örneğin bağlı bir hedef |
 
-Her satır ayrıca container'ın okuduğu dataLayer'ı (`l=`), Google'dan mı yoksa sitenin kendi alan adından mı (Google etiket ağ geçidi ya da bir sunucu container'ı) geldiğini, snippet bir GTM ortamı adlandırıyorsa onu ve yüklendiği sayfaları verir. Başka adlı bir dataLayer okuyan container'ın push'ları da o adla işaretlenerek kaydedilir. `report.md` aynı tabloyu içerir. MCP'de adım sonuçları ve `get_step` her adımın yüklediği container'ları listeler, `get_containers` denetim açıkken hepsini listeler, `finish_audit` ve `run_audit` sonuçları onlarla biter, `get_report` onları `part: "containers"` ile döndürür ve JSON zaman akışı onları adım adım taşır. `capture.json` yüklemeleri `containerLoads` altında saklar. Ortam belirteci (`gtm_auth`) ve sayfanın sorgu dizesi asla saklanmaz.
+Her satır ayrıca container'ın yayımlanmış sürümünü (`gtm.js` ya da `gtag/js` verisinin başladığı numara; GTM'deki Sürümler sekmesindekiyle aynı), betiğin boyutunu ve ne kadar sürede yüklendiğini, container'ın okuduğu dataLayer'ı (`l=`), Google'dan mı yoksa sitenin kendi alan adından mı (Google etiket ağ geçidi ya da bir sunucu container'ı) geldiğini, snippet bir GTM ortamı adlandırıyorsa onu ve yüklendiği sayfaları verir. Başka adlı bir dataLayer okuyan container'ın push'ları da o adla işaretlenerek kaydedilir. `report.md` aynı tabloyu içerir. MCP'de adım sonuçları ve `get_step` her adımın yüklediği container'ları listeler, `get_containers` denetim açıkken hepsini listeler, `finish_audit` ve `run_audit` sonuçları onlarla biter, `get_report` onları `part: "containers"` ile döndürür ve JSON zaman akışı onları adım adım taşır. `capture.json` yüklemeleri `containerLoads` altında saklar. Ortam belirteci (`gtm_auth`) ve sayfanın sorgu dizesi asla saklanmaz.
 
-Dört kontrol bunu okur: aynı sayfaya birden fazla kez yüklenen bir container için `container_duplicate` (uyarı), Live yerine yüklenen bir GTM ortamı (`gtm_preview`, `gtm_auth`) için `container_environment` (uyarı), aynı sayfada farklı dataLayer'ları okuyan container'lar için `datalayer_split` (bilgi) ve kendisi için `gtag('config')` olmadan yalnızca bir olayın `send_to` değeriyle yüklenen bir hedef için `container_send_to_only` (bilgi).
+Beş kontrol bunu okur: yüklenemeyen ya da hatayla yanıtlanan, bu yüzden etiketlerinin hiçbiri çalışmayan bir container betiği için `container_failed` (uyarı), aynı sayfaya birden fazla kez yüklenen bir container için `container_duplicate` (uyarı), Live yerine yüklenen bir GTM ortamı (`gtm_preview`, `gtm_auth`) için `container_environment` (uyarı), aynı sayfada farklı dataLayer'ları okuyan container'lar için `datalayer_split` (bilgi) ve kendisi için `gtag('config')` olmadan yalnızca bir olayın `send_to` değeriyle yüklenen bir hedef için `container_send_to_only` (bilgi).
 
 ### Gömülü widget'lar ve iframe'ler
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.22.1",
+  "version": "0.22.2",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -238,7 +238,7 @@ export const journeyError = (err) => `The journey stopped with an error: ${err?.
 export function failedRun(journey, viewport, err, providers) {
   return {
     journeyId: journey.id, viewport, completed: false, note: journeyError(err), hits: [], steps: [], consentStep: null, rejectStep: null,
-    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], widgetHits: [], widgetDataLayerLog: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
+    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], widgetHits: [], widgetDataLayerLog: [], containerScripts: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
   };
 }
 
@@ -258,6 +258,7 @@ export function collect(session, journey, viewport) {
     // Hits let through to the real accounts (block_hits false, or a live MCP audit): the reports say so.
     ...(session.opts.blockHits === false ? { live: true } : {}),
     containerLoads: session.containerLoads,
+    containerScripts: session.containerScripts,
     network: session.network,
     providers: session.providers,
     skipped: session.skipped,

package/src/browser.js

@@ -10,7 +10,7 @@ import { hostScope, isPrivateAddress, navigationError, privateHostChecker } from
 import { startEgressProxy } from "./egress.js";
 import { campaignParamsIn } from "./campaign.js";
 import { detectCmpInPage } from "./cmp.js";
-import { callersOf, containerOf } from "./containers.js";
+import { callersOf, containerOf, containerVersion } from "./containers.js";
 import { frameInfo } from "./frames.js";
 
 // Consent banners of the common consent platforms (CMPs), by their container. A cover that matches
@@ -36,7 +36,7 @@ export const CMP_BANNER_SELECTORS = `#onetrust-banner-sdk, #onetrust-consent-sdk
 // Efilli draws its banner inside the open shadow root of <efilli-layout-dynamic>, so the checks below also look inside open shadow roots.
 
 // Caps on what one audit records, so a looping page can't grow memory without limit.
-const LOG_LIMITS = { hits: 5000, dataLayerLog: 5000, network: 10000, containerLoads: 500 };
+const LOG_LIMITS = { hits: 5000, dataLayerLog: 5000, network: 10000, containerLoads: 500, containerScripts: 500 };
 
 // Secrets the browser process has no use for. It gets the rest of the environment
 // (PATH, HOME, DISPLAY...) so Chromium still starts normally.
@@ -548,6 +548,7 @@ export class AuditSession {
     this.errors = [];
     this.dataLayerLog = [];
     this.containerLoads = []; // each Google container script the page added, with how (see src/containers.js)
+    this.containerScripts = []; // each container script's answer: status, version, size and load time
     this.network = [];
     this.providers = resolveProviders(this.opts.providers);
     this.landing = null; // the first page: { step, requested, chain, final }
@@ -683,6 +684,11 @@ export class AuditSession {
       const call = calls.get(request);
       // Keepalive requests answered below are still reported as aborted; the page got the 204.
       if (call && call.status === null) call.status = "failed";
+      // A script answered with an error status has a response, but Chromium aborts its body: the status is kept.
+      if (containerOf(request.url())) this.recordScript(request, request.response().catch(() => null)).catch(() => {});
+    });
+    this.context.on("requestfinished", (request) => {
+      if (containerOf(request.url())) this.recordScript(request, request.response()).catch(() => {});
     });
 
     // Hits come from the request event rather than the route below: a request sent while
@@ -843,6 +849,31 @@ export class AuditSession {
     });
   }
 
+  /**
+   * A container script's answer: its HTTP status (or "failed"), the container version its published data opens
+   * with, the size of the script as the page got it (decoded) and over the wire, and how long it took to load.
+   * response resolves to null when no answer came at all. Only the ID and host are kept, not the address.
+   */
+  async recordScript(request, response) {
+    const container = containerOf(request.url());
+    if (!container) return;
+    const step = this.currentStep;
+    const res = await response;
+    const body = res ? await res.body().catch(() => null) : null;
+    const sizes = res ? await request.sizes().catch(() => null) : null;
+    const timing = request.timing();
+    const ms = timing.responseEnd > 0 ? Math.round(timing.responseEnd) : null;
+    const version = body ? containerVersion(body.subarray(0, 4096).toString("utf8")) : null;
+    this.record("containerScripts", {
+      id: container.id, host: container.host, step,
+      status: res ? res.status() : "failed",
+      ...(version ? { version } : {}),
+      ...(body ? { bytes: body.length } : {}),
+      ...(sizes?.responseBodySize > 0 ? { transferBytes: sizes.responseBodySize } : {}),
+      ...(ms !== null ? { ms } : {}),
+    });
+  }
+
   /** The iframe a request came from, as frameInfo gives it; null for the page itself or a worker. */
   frameOf(request) {
     try {

package/src/checks.js

@@ -5,7 +5,7 @@ import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
 import { campaignParamsIn } from "./campaign.js";
 import { CONSENT_SIGNALS } from "./parsers.js";
-import { duplicateLoads, loadSources, splitLayers } from "./containers.js";
+import { duplicateLoads, loadSources, scriptFailed, splitLayers } from "./containers.js";
 import { widgetsOf } from "./frames.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
@@ -389,6 +389,11 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     findings.push({ ...base, severity: "info", check: "container_send_to_only", platform: l.id.startsWith("G-") ? "ga4" : "google_ads", step: stepLabel(l.step), detail: d.sendToOnly(l.id, l.by) });
   }
 
+  // A container script that failed to load: none of its tags ran. Said once per container and host.
+  for (const sc of (run.containerScripts ?? []).filter((x, i, all) => scriptFailed(x) && all.findIndex((y) => scriptFailed(y) && y.id === x.id && y.host === x.host) === i)) {
+    findings.push({ ...base, severity: "warning", check: "container_failed", step: stepLabel(sc.step), detail: d.containerFailed(sc.id, sc.host, String(sc.status)) });
+  }
+
   // Widgets that tracked on their own, left out of the plan checks: said once per widget, so nothing goes missing silently.
   for (const w of widgetsOf(run.widgetHits ?? [])) {
     const first = (run.widgetHits ?? []).find((h) => h.frame.origin === w.origin);

package/src/containers.js

@@ -31,6 +31,40 @@ export function containerOf(url) {
   };
 }
 
+/**
+ * The container version a gtm.js or gtag/js script was published as: its data opens with
+ * `var data = { "resource": { "version": "153", ...`. Null when the script says nothing of the kind.
+ */
+export function containerVersion(text) {
+  return String(text ?? "").match(/"resource"\s*:\s*\{\s*"version"\s*:\s*"(\d+)"/)?.[1] ?? null;
+}
+
+/** Whether a container script's answer means it never ran: the request failed or the server answered with an error. */
+export const scriptFailed = (script) => script.status === "failed" || (typeof script.status === "number" && script.status >= 400);
+
+/**
+ * The answer to a load's script request (see recordScript in browser.js): the first one for the same container and
+ * host from the load's step on, else the last before it. Null for runs saved by older versions.
+ */
+export function scriptOf(run, load) {
+  const same = (run.containerScripts ?? []).filter((s) => s.id === load.id && s.host === load.host);
+  return same.find((s) => s.step >= (load.step ?? 0)) ?? same.at(-1) ?? null;
+}
+
+/** What a row or load shows of its script's answer: { version?, bytes?, transferBytes?, ms?, failed? }. */
+export function scriptFacts(script) {
+  if (!script) return {};
+  // A load that already carries the facts (from loadSources) passes them on as they are.
+  if (!("status" in script)) return Object.fromEntries(["version", "bytes", "transferBytes", "ms", "failed"].filter((k) => script[k] != null).map((k) => [k, script[k]]));
+  return {
+    ...(script.version ? { version: script.version } : {}),
+    ...(script.bytes ? { bytes: script.bytes } : {}),
+    ...(script.transferBytes ? { transferBytes: script.transferBytes } : {}),
+    ...(script.ms != null ? { ms: script.ms } : {}),
+    ...(scriptFailed(script) ? { failed: String(script.status) } : {}),
+  };
+}
+
 /** origin + path, so a caller's query string (which may carry user data) is never kept. */
 export function scriptPath(url) {
   try {
@@ -106,15 +140,16 @@ export function sourceOf(load, pushes = []) {
   return { kind: "inline" };
 }
 
-/** A run's container loads with their sources, in the order they happened. Runs saved by older versions have none. */
+/** A run's container loads with their sources and their scripts' answers (scriptFacts), in the order they happened. Runs saved by older versions have none. */
 export function loadSources(run) {
   const pushes = run.dataLayerLog ?? [];
-  return (run.containerLoads ?? []).map((load) => ({ ...load, ...sourceOf(load, pushes) }));
+  return (run.containerLoads ?? []).map((load) => ({ ...load, ...sourceOf(load, pushes), ...scriptFacts(scriptOf(run, load)) }));
 }
 
 /**
  * One row per container and source across runs, in the order first seen: { id, script, layer, served, host,
- * environment?, kind, by?, frame?, pages, journeys }, where frame is the iframe it loaded in, if any.
+ * environment?, kind, by?, frame?, version?, bytes?, transferBytes?, ms?, failed?, pages, journeys }. frame is the
+ * iframe it loaded in; version to failed are its script's answer (see scriptFacts), from the first load in the row.
  */
 export function containerRows(runs) {
   const rows = new Map();
@@ -125,6 +160,7 @@ export function containerRows(runs) {
         id: l.id, script: l.script, layer: l.layer, served: l.served, host: l.host,
         ...(l.environment ? { environment: l.environment } : {}), kind: l.kind, ...(l.by ? { by: l.by } : {}),
         ...(l.frame ? { frame: { origin: l.frame.origin, party: l.frame.party } } : {}),
+        ...scriptFacts(l),
         pages: new Set(), journeys: new Set(),
       };
       if (l.page) row.pages.add(l.page);

package/src/html/scope.js

@@ -200,7 +200,7 @@ function containersCard(ctx) {
   const rows = containerRows(runs);
   if (!rows.length) return null;
   const c = m.ui.containers;
-  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
+  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.version ? plain(esc(c.version(r.version)), "mono") : ""}${r.bytes ? plain(esc(c.size(r.bytes)), "mono") : ""}${r.ms != null ? plain(esc(c.loadTime(r.ms))) : ""}${r.failed ? badge("broken", c.failed(r.failed)) : ""}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
   const ids = uniq(rows.map((r) => r.id));
   return `<li><details class="card inv" id="inv-containers"><summary><span class="t">${esc(m.ui.containersTitle)}</span>${plain(n(ids.length))}<span class="inv-m">${esc(ids.slice(0, 3).join(", "))}${ids.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.containersIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
 }

package/src/i18n.js

@@ -209,11 +209,16 @@ const en = {
     sourceCol: "Loaded by",
     layerCol: "dataLayer",
     servedCol: "Served from",
+    scriptCol: "Version and size",
     containers: {
       script: { gtm: "GTM container", gtag: "Google tag" },
       served: { google: "Google", site: "The site's own domain" },
       environment: (env) => (env === "unnamed" ? "GTM environment" : `GTM environment ${env}`),
       iframe: (origin, party) => `In an iframe from ${origin} (${party === "site" ? "same site" : "third party"})`,
+      version: (v) => `version ${v}`,
+      size: (bytes) => `${(bytes / 1024).toFixed(1)} KB`,
+      loadTime: (ms) => `loaded in ${ms} ms`,
+      failed: (status) => (status === "failed" ? "failed to load" : `failed to load (HTTP ${status})`),
       kinds: {
         html: () => "A script tag in the page's HTML",
         inline: () => "Inline code in the page (the snippet)",
@@ -354,6 +359,7 @@ const en = {
     fromWidget: (origin, text) => `In an embedded widget from ${origin}: ${text}`,
     widgetTracking: (origin, platforms) => `An embedded widget from ${origin} sent its own tracking: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. It goes to accounts the site's own tags don't use, so it was left out of the plan, coverage and duplicate checks; the consent and personal data checks still include it.`,
     iframeContainer: (id, origin, parent) => `${id} runs in an iframe from ${origin} embedded in ${parent}. The iframe has its own dataLayer: events and consent commands pushed in the page never reach it, so it needs its own.`,
+    containerFailed: (id, host, status) => `The ${id} script from ${host} ${status === "failed" ? "failed to load" : `was answered with HTTP ${status}`}, so none of its tags ran on that page.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     consentDefaultNotApplied: () => "The page pushed a Consent Mode default, but the Google tag never applied it, so its tags ran without one. Tag Assistant shows Consent Mode as not configured.",
@@ -415,6 +421,7 @@ const en = {
     container_send_to_only: "The destination runs without its own config, so the settings a config command would give it are missing.",
     widget_tracking: "Nothing is wrong with the site's tracking: the widget's own hits were kept out of the plan checks so they can't pass for the site's.",
     iframe_container: "Tags in the iframe miss what the page pushes, so conversions completed in it can go untracked or be sent without the visitor's consent.",
+    container_failed: "None of the container's tags ran: page views, conversions and consent signals it sends were all lost on that page.",
     campaign_params: "Campaign parameters survived the landing redirect and reached the hits, so paid clicks are credited to their campaigns.",
     event_id_reused: "Two different events share one event ID, so the platform keeps the first and silently drops the other: a real event is lost.",
     event_id_mismatch: "The browser and server copies of this event carry different IDs, so Meta cannot pair them and counts the conversion twice.",
@@ -463,6 +470,7 @@ const en = {
     container_send_to_only: "Add a gtag('config', ID) for the destination before the events that send to it, or a Google tag for it in GTM.",
     widget_tracking: "Nothing to fix for the plan. If the widget sets cookies or sends data before consent, the consent findings name it; ask its vendor how to hold it back.",
     iframe_container: "Push the events and the consent state inside the iframe as well (or pass them in with postMessage), or track the iframe's steps from the page.",
+    container_failed: "Check the container ID and the address in the snippet; for a server container or the Google tag gateway, check that it serves gtm.js and gtag/js.",
     campaign_params: "Nothing to fix. Check the redirects again when the landing pages change.",
     event_id_reused: "Generate a new event ID for every event, not once per page load.",
     event_id_mismatch: "Use one event ID for the pixel event and the server copy: pass the same value to both tags.",
@@ -511,6 +519,7 @@ const en = {
     container_send_to_only: "hygiene",
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
+    container_failed: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",
@@ -1036,11 +1045,16 @@ const tr = {
     sourceCol: "Yükleyen",
     layerCol: "dataLayer",
     servedCol: "Sunulduğu yer",
+    scriptCol: "Sürüm ve boyut",
     containers: {
       script: { gtm: "GTM container'ı", gtag: "Google etiketi" },
       served: { google: "Google", site: "Sitenin kendi alan adı" },
       environment: (env) => (env === "unnamed" ? "GTM ortamı" : `GTM ortamı ${env}`),
       iframe: (origin, party) => `${origin} kaynaklı bir iframe içinde (${party === "site" ? "aynı site" : "üçüncü taraf"})`,
+      version: (v) => `sürüm ${v}`,
+      size: (bytes) => `${(bytes / 1024).toFixed(1).replace(".", ",")} KB`,
+      loadTime: (ms) => `${ms} ms'de yüklendi`,
+      failed: (status) => (status === "failed" ? "yüklenemedi" : `yüklenemedi (HTTP ${status})`),
       kinds: {
         html: () => "Sayfanın HTML'indeki bir script etiketi",
         inline: () => "Sayfadaki satır içi kod (snippet)",
@@ -1177,6 +1191,7 @@ const tr = {
     fromWidget: (origin, text) => `${origin} kaynaklı gömülü bir widget içinde: ${text}`,
     widgetTracking: (origin, platforms) => `${origin} kaynaklı gömülü bir widget kendi izlemesini gönderdi: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. Bunlar sitenin kendi etiketlerinin kullanmadığı hesaplara gidiyor; bu yüzden plan, kapsam ve tekrar kontrollerinin dışında tutuldu, onay ve kişisel veri kontrolleri ise onları yine içeriyor.`,
     iframeContainer: (id, origin, parent) => `${id}, ${parent} içine gömülü ${origin} kaynaklı bir iframe içinde çalışıyor. iframe'in kendi dataLayer'ı var: sayfada gönderilen olaylar ve onay komutları ona hiç ulaşmaz, bu yüzden kendi olaylarına ve onayına ihtiyacı var.`,
+    containerFailed: (id, host, status) => `${host} adresinden gelen ${id} betiği ${status === "failed" ? "yüklenemedi" : `HTTP ${status} ile yanıtlandı`}; bu yüzden o sayfada etiketlerinin hiçbiri çalışmadı.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     consentDefaultNotApplied: () => "Sayfa bir Consent Mode varsayılanı gönderdi, ancak Google etiketi onu hiç uygulamadı; etiketleri varsayılan olmadan çalıştı. Tag Assistant, Consent Mode'u yapılandırılmamış gösterir.",
@@ -1237,6 +1252,7 @@ const tr = {
     container_send_to_only: "Hedef kendi config'i olmadan çalışıyor; bir config komutunun ona vereceği ayarlar eksik.",
     widget_tracking: "Sitenin izlemesinde bir sorun yok: widget'ın kendi istekleri sitenin isteklerinin yerine geçmesin diye plan kontrollerinin dışında tutuldu.",
     iframe_container: "iframe içindeki etiketler sayfanın gönderdiklerini görmez; içinde tamamlanan dönüşümler izlenmeyebilir ya da ziyaretçinin onayı olmadan gönderilebilir.",
+    container_failed: "Container'ın etiketlerinin hiçbiri çalışmadı: gönderdiği sayfa görüntülemeleri, dönüşümler ve onay sinyalleri o sayfada kayboldu.",
     campaign_params: "Kampanya parametreleri açılış yönlendirmesinden geçip isteklere ulaştı; ücretli tıklamalar kendi kampanyalarına yazılıyor.",
     event_id_reused: "İki farklı olay tek bir olay kimliğini paylaşıyor; platform ilkini tutup diğerini sessizce atıyor, gerçek bir olay kayboluyor.",
     event_id_mismatch: "Bu olayın tarayıcı ve sunucu kopyaları farklı kimlik taşıyor; Meta ikisini eşleştiremiyor ve dönüşümü iki kez sayıyor.",
@@ -1283,6 +1299,7 @@ const tr = {
     container_send_to_only: "Hedefe gönderen olaylardan önce onun için bir gtag('config', ID) ya da GTM'de onun için bir Google etiketi ekleyin.",
     widget_tracking: "Plan için düzeltilecek bir şey yok. Widget onaydan önce çerez yazıyor ya da veri gönderiyorsa onay bulguları onu adlandırır; nasıl durdurulacağını sağlayıcısına sorun.",
     iframe_container: "Olayları ve onay durumunu iframe içinde de gönderin (ya da postMessage ile iletin) veya iframe'deki adımları sayfadan izleyin.",
+    container_failed: "Snippet'teki container kimliğini ve adresi kontrol edin; sunucu container'ı ya da Google etiket ağ geçidi için gtm.js ve gtag/js sunduğunu kontrol edin.",
     campaign_params: "Düzeltilecek bir şey yok. Açılış sayfaları değiştiğinde yönlendirmeleri yeniden kontrol edin.",
     event_id_reused: "Her olay için yeni bir olay kimliği üretin; sayfa yüklemesi başına bir kez değil.",
     event_id_mismatch: "Piksel olayı ve sunucu kopyası için tek bir olay kimliği kullanın: aynı değeri iki etikete de verin.",
@@ -1330,6 +1347,7 @@ const tr = {
     container_send_to_only: "hygiene",
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
+    container_failed: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",

package/src/mcp.js

@@ -23,7 +23,7 @@ import { loadConfig, readJson, runAudit, writeReports } from "./audit.js";
 import { validatePlan } from "./schema.js";
 import { readBaseline } from "./baseline.js";
 import { MAX_CONCURRENCY } from "./pool.js";
-import { scriptCspSource } from "./report.js";
+import { scriptCell, scriptCspSource } from "./report.js";
 import { DEFAULT_DATA_DIR, resolvePlan } from "./workspace.js";
 import { checkTopic, discoverPlan, TOPICS } from "./discover.js";
 import { createProvider } from "./providers.js";
@@ -166,7 +166,8 @@ function cookieLines(session, step) {
 /** One container load in words: its ID, what inserted it, its dataLayer and where it came from. */
 function describeLoad(l) {
   const c = messages("en").ui.containers;
-  const extra = [l.layer !== "dataLayer" && `dataLayer ${l.layer}`, l.served === "site" && `served from ${l.host}`, l.environment && c.environment(l.environment), l.frame && c.iframe(l.frame.origin, l.frame.party)].filter(Boolean);
+  const script = scriptCell(c, l);
+  const extra = [script,l.layer !== "dataLayer" && `dataLayer ${l.layer}`, l.served === "site" && `served from ${l.host}`, l.environment && c.environment(l.environment), l.frame && c.iframe(l.frame.origin, l.frame.party)].filter(Boolean);
   return `  ${l.id} (${c.script[l.script]}): ${c.kinds[l.kind](l.by)}${extra.length ? `; ${extra.join(", ")}` : ""}`;
 }
 
@@ -189,7 +190,7 @@ export function stepCapture(audit, step) {
   if (lateHere.length) lines.push(`Arrived during this step but belong to the step that loaded their page: ${lateHere.map((h) => `${h.platform} ${h.name} (step "${session.steps[h.step]?.label ?? h.step}")`).join(", ")}`);
   if (pings.length) lines.push("Other calls to analytics and ad endpoints, not read as events (Consent Mode pings, resends, remarketing):", ...pings.map(describeCall));
   if (pushes.length) lines.push("dataLayer pushes:", ...pushes.map(describePush));
-  const loads = loadSources({ containerLoads: (session.containerLoads ?? []).filter((l) => l.step === step), dataLayerLog: session.dataLayerLog });
+  const loads = loadSources({ containerLoads: (session.containerLoads ?? []).filter((l) => l.step === step), containerScripts: session.containerScripts, dataLayerLog: session.dataLayerLog });
   if (loads.length) lines.push("Google containers loaded:", ...loads.map(describeLoad));
   lines.push(...cookieLines(session, step));
   const tag = session.steps[step]?.tagConsent;
@@ -245,6 +246,11 @@ function containerJson(l) {
     ...(l.served === "site" ? { served_from: l.host } : {}),
     ...(l.environment ? { gtm_environment: l.environment } : {}),
     ...(l.frame ? { iframe: { origin: l.frame.origin, party: l.frame.party } } : {}),
+    ...(l.version ? { version: l.version } : {}),
+    ...(l.bytes ? { size_bytes: l.bytes } : {}),
+    ...(l.transferBytes ? { transfer_bytes: l.transferBytes } : {}),
+    ...(l.ms != null ? { load_ms: l.ms } : {}),
+    ...(l.failed ? { failed: l.failed } : {}),
     ...(l.pages ? { pages: l.pages } : {}),
   };
 }
@@ -257,7 +263,7 @@ export function containerLines(runs) {
   return [
     "Google containers (how each reached the page):",
     ...rows.map((r) => {
-      const extra = [r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), r.frame && c.iframe(r.frame.origin, r.frame.party), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
+      const extra = [scriptCell(c, r), r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), r.frame && c.iframe(r.frame.origin, r.frame.party), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
       return `  ${r.id} (${c.script[r.script]}): ${c.kinds[r.kind](r.by)}; ${extra.join(", ")}`;
     }),
   ];
@@ -282,7 +288,7 @@ export function timelineOf(run) {
     if (st.tagConsent) entry.tag_consent = Object.fromEntries(Object.entries(st.tagConsent.entries).map(([k, e]) => [k, e.update ?? e.default ?? null]));
     const cookies = Object.fromEntries(["added", "changed", "removed"].map((k) => [k, names(k)]).filter(([, list]) => list.length));
     if (Object.keys(cookies).length) entry.cookies = cookies;
-    const loads = loadSources({ containerLoads: (run.containerLoads ?? []).filter((l) => l.step === st.index), dataLayerLog: run.dataLayerLog });
+    const loads = loadSources({ containerLoads: (run.containerLoads ?? []).filter((l) => l.step === st.index), containerScripts: run.containerScripts, dataLayerLog: run.dataLayerLog });
     if (loads.length) entry.containers = loads.map(containerJson);
     if (st.identity && JSON.stringify(st.identity) !== JSON.stringify(lastIds)) entry.ids = st.identity;
     if (st.identity) lastIds = st.identity;
@@ -531,7 +537,7 @@ export function buildServer(opts) {
     },
     async ({ audit_id }) => {
       const { session } = getAudit(audit_id);
-      const loads = loadSources({ containerLoads: session.containerLoads ?? [], dataLayerLog: session.dataLayerLog });
+      const loads = loadSources({ containerLoads: session.containerLoads ?? [], containerScripts: session.containerScripts, dataLayerLog: session.dataLayerLog });
       if (!loads.length) return text("No GTM container or Google tag script has loaded on this audit's pages yet.");
       const lines = loads.map((l) => `Step ${l.step} ("${session.steps[l.step]?.label ?? ""}"), ${l.page ?? "?"}:\n${describeLoad(l)}`);
       return text(`${loads.length} container ${loads.length === 1 ? "load" : "loads"}:\n${lines.join("\n")}\n\nAs JSON: ${JSON.stringify(loads.map((l) => ({ step: l.step, page: l.page, ...containerJson(l) })))}`);

package/src/report.js

@@ -397,15 +397,21 @@ function mdInventory(m, runs) {
   return lines;
 }
 
+/** A container row's version, size and load time, or that it failed to load, in a few words. */
+export function scriptCell(c, r) {
+  if (r.failed) return c.failed(r.failed);
+  return [r.version && c.version(r.version), r.bytes && c.size(r.bytes), r.ms != null && c.loadTime(r.ms)].filter(Boolean).join(", ");
+}
+
 /** The Google containers and how each reached the page, one row per container and source. Omitted when none loaded. */
 function mdContainers(m, runs) {
   const rows = containerRows(runs);
   if (!rows.length) return [];
   const c = m.ui.containers;
-  const lines = [`## ${m.ui.containersTitle}`, "", `| ${m.ui.containerCol} | ${m.ui.sourceCol} | ${m.ui.layerCol} | ${m.ui.servedCol} | ${m.ui.pagesCol} |`, "|---|---|---|---|---|"];
+  const lines = [`## ${m.ui.containersTitle}`, "", `| ${m.ui.containerCol} | ${m.ui.sourceCol} | ${m.ui.layerCol} | ${m.ui.servedCol} | ${m.ui.scriptCol} | ${m.ui.pagesCol} |`, "|---|---|---|---|---|---|"];
   for (const r of rows.slice(0, MD_INVENTORY_ROWS)) {
     const served = r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`;
-    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.frame ? `, ${mdText(c.iframe(r.frame.origin, r.frame.party))}` : ""}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${r.pages.length} |`);
+    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.frame ? `, ${mdText(c.iframe(r.frame.origin, r.frame.party))}` : ""}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${mdText(scriptCell(c, r)) || "–"} | ${r.pages.length} |`);
   }
   if (rows.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(rows.length - MD_INVENTORY_ROWS, "report.html"));
   lines.push("");