@analitikisler/ai-tag-debugger 0.7.8 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.8.0 (2026-10-14)
+
+- The browser installs itself the first time an audit starts, so connecting the MCP server no longer needs a separate `playwright install` step. Progress goes to stderr.
+- Listed in the official MCP Registry as `io.github.analitikisler/ai-tag-debugger` (`mcpName` in package.json, `server.json`).
+- The README has one-line and one-click setup for Claude Code, Cursor and VS Code.
+- The MCP server reports its real version instead of a fixed 0.6.3.
+
+## 0.7.9 (2026-10-14)
+
+- A planned event is found under the name the site uses: `dl_add_to_cart` (Elevar), `addToCart` and `Add To Cart` all count as `add_to_cart`, and similar variants of the other ecommerce events too. Sites like these no longer get a false "missing add_to_cart". A plan event can list more names in `aliases`.
+- A required parameter is also found under its usual other name (`products` for `items`, `revenue` for `value`, `order_id` for `transaction_id`).
+- The plan coverage table in the report uses the same matching.
+- Server-side tagging is recognised where the browser can see it. A GA4 hit to a server container (server-side GTM, Stape, Elevar) is marked server-side, a hit through Google tag gateway (`/g/c`) is not, and requests to Stape and Elevar hosts show in the timeline. An info finding lists, per platform, which events went server-side and which went from the browser. The report tags server-side events.
+- Meta (`eid`) and TikTok (`event_id`) event IDs are read from the browser hit. The duplicate check no longer flags hits that repeat one event ID, since the platform counts those once.
+- New info finding when a server-side setup is seen and a Meta or TikTok browser event has no event ID, so the platform can't match it to its server copy. Meta Conversions API and TikTok Events API requests themselves are sent server to server and can't be seen from the browser.
+- New parsers for the Pinterest tag, Snap Pixel, Klaviyo onsite events and Hotjar API calls. Pinterest, Snap and Klaviyo hits show their event name, id, value fields and, when present, the hashed or plain user data they send (redacted like Meta's). Hotjar shows the site id.
+- A Meta hit now shows `event_id` (`eid`), the value a Conversions API copy must repeat to be deduplicated, and its advanced matching fields (`ud[...]`).
+- Klaviyo is a selectable provider.
+- Consent Mode v2: the report flags a default that leaves out `ad_user_data` or `ad_personalization`, and an accept whose update does not grant them.
+- New `decline_cookies` journey (also `decline`, `reject`): the AI rejects all cookies, browses on, and the report checks that nothing is sent afterwards. It flags ad pixels and Google hits that claim consent after the reject, a Consent Mode update that grants consent after it, and a banner that is still showing after the reject click. Clicks carry `rejects_consent`, like `accepts_consent` for accepting; replays keep it.
+- Tracking cookies (`_ga`, `_fbp`, `_gcl_*`, `_ttp` and similar) are noted with the step that set them, by name only. Ones set before the visitor chose, or after they rejected, are flagged.
+- More consent platforms are recognized as banners that block a click (Osano, Iubenda, Complianz, CookieFirst, Axeptio, Sourcepoint, TrustArc, Borlabs, Klaro, Termly and others) and as consent requests in the timeline (Didomi, Quantcast, TrustArc, Sourcepoint, Iubenda, Termly and others).
+
 ## 0.7.8 (2026-10-14)
 
 - Unnamed TikTok pings are left out of the duplicate check. TikTok sends them on its own timing, so their count changed between a save and its replay without the site changing.

package/README.md

@@ -41,11 +41,11 @@ Manual tag QA catches this, but it's tedious, so it rarely happens after every r
 | Missing events | `purchase` never fired on the checkout journey |
 | Missing parameters | `purchase` sent without `value` and `currency` on mobile |
 | Duplicates | `add_to_cart` sent twice by one click |
-| Consent | Meta `PageView` fired before the visitor accepted cookies, Consent Mode default missing or set too late |
+| Consent | Meta `PageView` fired before the visitor accepted cookies, Consent Mode default missing or set too late, Consent Mode v2 signals (`ad_user_data`, `ad_personalization`) missing, tracking cookies set before consent, tags or cookies still active after the `decline_cookies` journey rejects the banner, a reject button that does nothing |
 | Personal data | An email address sent to an ad platform in plain text |
 | Unplanned events | Events firing that aren't in your measurement plan |
 
-Platforms: GA4 (including server-side GTM endpoints and Google tag gateway paths on the site's own domain), Google Ads conversions, Meta Pixel, TikTok Pixel, and basic X Pixel events.
+Platforms: GA4 (including server-side GTM endpoints and Google tag gateway paths on the site's own domain; hits to a server container are marked server-side, and Stape and Elevar requests are recognised), Google Ads conversions, Meta Pixel, TikTok Pixel, and basic X Pixel events.
 
 ### Choose the providers to check
 
@@ -235,6 +235,8 @@ The first run's findings become the expected ones. When a change is right, for e
 
 `platform` is `ga4`, `google_ads`, `meta` or `tiktok`. `journeys` limits where an event is expected (default: every journey). Set `allow_multiple: true` for events that may legitimately fire more than once per action.
 
+Event names are matched loosely, so `dl_add_to_cart` (Elevar), `addToCart` and `Add To Cart` count as `add_to_cart`, and `transaction` or `order_completed` as `purchase`. Add your own with `"aliases": ["my_event"]` on a planned event. Required parameters are also found under their usual other names: `products` for `items`, `revenue` for `value`, `order_id` for `transaction_id`.
+
 ## CLI
 
 ```
@@ -301,7 +303,16 @@ Add the server to the app's MCP config. For Claude Desktop that is Settings →
 }
 ```
 
-Install the browser once with `npx -y playwright@1.56.1 install chromium`. Gemini CLI uses the same `mcpServers` block in `~/.gemini/settings.json`. Claude Code: `claude mcp add ai-tag-debugger -- npx -y @analitikisler/ai-tag-debugger mcp`. Restart the app, and the ai-tag-debugger tools appear. If the app can't find `npx`, use its full path (`which npx`, for example `/opt/homebrew/bin/npx` on a Mac with Homebrew). Reports are written to `~/ai-tag-debugger-reports`.
+The browser (Chromium) downloads itself the first time you run an audit, about a minute, one time. To get it ahead of time: `npx -y playwright@1.56.1 install chromium`.
+
+One-click and one-line setup:
+
+- **Claude Code:** `claude mcp add ai-tag-debugger -- npx -y @analitikisler/ai-tag-debugger mcp`
+- **Cursor:** [Add to Cursor](https://cursor.com/en/install-mcp?name=ai-tag-debugger&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBhbmFsaXRpa2lzbGVyL2FpLXRhZy1kZWJ1Z2dlciIsIm1jcCJdfQ==)
+- **VS Code:** [Install in VS Code](https://insiders.vscode.dev/redirect/mcp/install?name=ai-tag-debugger&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40analitikisler%2Fai-tag-debugger%22%2C%22mcp%22%5D%7D), or `code --add-mcp '{"name":"ai-tag-debugger","command":"npx","args":["-y","@analitikisler/ai-tag-debugger","mcp"]}'`
+- **Claude Desktop, Gemini CLI and others:** the JSON block above. Gemini CLI uses the same `mcpServers` block in `~/.gemini/settings.json`.
+
+Restart the app, and the ai-tag-debugger tools appear. If the app can't find `npx`, use its full path (`which npx`, for example `/opt/homebrew/bin/npx` on a Mac with Homebrew). Reports are written to `~/ai-tag-debugger-reports`.
 
 Running from a clone instead? Use `"command": "node"` and `"args": ["/path/to/ai-tag-debugger/src/cli.js", "mcp"]`.
 

package/README.tr.md

@@ -41,7 +41,7 @@ Tag'leri elle test etmek bunu yakalar, ama zahmetli olduğu için her sürümden
 | Eksik event'ler | `purchase`, ödeme senaryosunda hiç gönderilmedi |
 | Eksik parametreler | `purchase`, mobilde `value` ve `currency` olmadan gönderildi |
 | Tekrar eden event'ler | `add_to_cart` tek tıklamada iki kez gönderildi |
-| Çerez onayı | Meta `PageView`, ziyaretçi çerezleri kabul etmeden gönderildi; Consent Mode varsayılanı yok ya da çok geç ayarlanmış |
+| Çerez onayı | Meta `PageView`, ziyaretçi çerezleri kabul etmeden gönderildi; Consent Mode varsayılanı yok ya da çok geç ayarlanmış, Consent Mode v2 sinyalleri (`ad_user_data`, `ad_personalization`) eksik, onaydan önce yazılan izleme çerezleri, `decline_cookies` yolculuğu bandı reddettikten sonra hâlâ çalışan etiketler ya da çerezler, işe yaramayan reddet düğmesi |
 | Kişisel veri | Bir e-posta adresi reklam platformuna açık metin olarak gönderildi |
 | Planda olmayan event'ler | Ölçümleme planınızda bulunmayan event'ler gönderiliyor |
 
@@ -303,7 +303,16 @@ Sunucuyu uygulamanın MCP ayarlarına ekleyin. Claude Desktop'ta bu Settings →
 }
 ```
 
-Tarayıcıyı bir kez `npx -y playwright@1.56.1 install chromium` ile kurun. Gemini CLI, `~/.gemini/settings.json` içinde aynı `mcpServers` bloğunu kullanır. Claude Code için: `claude mcp add ai-tag-debugger -- npx -y @analitikisler/ai-tag-debugger mcp`. Uygulamayı yeniden başlatın, ai-tag-debugger araçları görünür. Uygulama `npx`'i bulamazsa tam yolunu kullanın (`which npx`; örneğin Homebrew kurulu bir Mac'te `/opt/homebrew/bin/npx`). Raporlar `~/ai-tag-debugger-reports` klasörüne yazılır.
+Tarayıcı (Chromium), ilk denetimi çalıştırdığınızda kendiliğinden iner (bir kez, yaklaşık bir dakika). Önceden kurmak için: `npx -y playwright@1.56.1 install chromium`.
+
+Tek tıkla ve tek satırla kurulum:
+
+- **Claude Code:** `claude mcp add ai-tag-debugger -- npx -y @analitikisler/ai-tag-debugger mcp`
+- **Cursor:** [Cursor'a ekle](https://cursor.com/en/install-mcp?name=ai-tag-debugger&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBhbmFsaXRpa2lzbGVyL2FpLXRhZy1kZWJ1Z2dlciIsIm1jcCJdfQ==)
+- **VS Code:** [VS Code'a kur](https://insiders.vscode.dev/redirect/mcp/install?name=ai-tag-debugger&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40analitikisler%2Fai-tag-debugger%22%2C%22mcp%22%5D%7D) veya `code --add-mcp '{"name":"ai-tag-debugger","command":"npx","args":["-y","@analitikisler/ai-tag-debugger","mcp"]}'`
+- **Claude Desktop, Gemini CLI ve diğerleri:** yukarıdaki JSON bloğu. Gemini CLI, `~/.gemini/settings.json` içinde aynı `mcpServers` bloğunu kullanır.
+
+Uygulamayı yeniden başlatın, ai-tag-debugger araçları görünür. Uygulama `npx`'i bulamazsa tam yolunu kullanın (`which npx`; örneğin Homebrew kurulu bir Mac'te `/opt/homebrew/bin/npx`). Raporlar `~/ai-tag-debugger-reports` klasörüne yazılır.
 
 Kaynak koddan mı çalıştırıyorsunuz? `"command": "node"` ve `"args": ["/path/to/ai-tag-debugger/src/cli.js", "mcp"]` kullanın.
 

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
-  "version": "0.7.8",
+  "mcpName": "io.github.analitikisler/ai-tag-debugger",
+  "version": "0.8.0",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -14,7 +14,7 @@ How to work:
 - Do one action per call and read the new page before the next action.
 - Elements on screen are listed first. If what you need isn't listed, scroll, or use text instead of ref to act on an element by its visible text or label (e.g. text "Rezervasyon Yap").
 - Date pickers and custom dropdowns usually need clicks rather than fill: click the field, then click the date or option.
-- If a cookie or consent banner appears, accept all cookies (as most visitors do) and set accepts_consent to true on that click.
+- If a cookie or consent banner appears, accept all cookies (as most visitors do) and set accepts_consent to true on that click. (A journey whose goal says to reject or decline cookies does that instead and sets rejects_consent to true on that click; if the banner has no reject-all button, use the one that declines non-essential cookies, and never accept.)
 - Use obvious test data in forms: name "Test User", email "qa-test@example.com", phone "5550100", address "1 Test Street", city "Testville", postcode "00000".
 - Never enter real payment card details. If the site offers a test or demo payment option, use it. If completing the journey would require a real payment or a real account you don't have, stop and call finish with success false and explain why.
 - If something is broken (an error, a button that does nothing), try a reasonable alternative once, then finish with success false and describe what happened.
@@ -39,6 +39,7 @@ export const TOOLS = [
         url: { type: "string", description: "Destination for goto." },
         reason: { type: "string", description: "Short description of the step, e.g. 'Add the first product to the cart'. Shown in the report." },
         accepts_consent: { type: "boolean", description: "True only when this click accepts the cookie or consent banner." },
+        rejects_consent: { type: "boolean", description: "True only when this click rejects or declines all cookies on the consent banner." },
       },
       required: ["action", "reason"],
     },
@@ -215,6 +216,8 @@ export function collect(session, journey, viewport) {
     hits: session.hits,
     steps: session.steps,
     consentStep: session.consentStep,
+    rejectStep: session.rejectStep,
+    cookieLog: session.cookieLog,
     dataLayerLog: session.dataLayerLog,
     network: session.network,
     providers: session.providers,

package/src/browser.js

@@ -1,10 +1,33 @@
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
 import { readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
 import { chromium, devices } from "playwright";
 import { parseTrackingRequest, isCollectionEndpoint, providerOf, vendorOf, resolveProviders } from "./parsers.js";
 import { redactBody, redactParams, redactPush, redactUrl } from "./redact.js";
 import { hostScope, isPrivateAddress, navigationError, privateHostChecker } from "./guard.js";
 import { startEgressProxy } from "./egress.js";
 
+// Consent banners of the common consent platforms (CMPs), by their container. A cover that matches
+// one of these always blocks the journey, and a reject click is checked against them afterwards.
+let browserInstall = null;
+/** Downloads Chromium with Playwright's own installer. Output goes to stderr, because stdout carries the MCP protocol. */
+export function installBrowser() {
+  browserInstall ??= new Promise((resolve, reject) => {
+    const cli = path.join(path.dirname(createRequire(import.meta.url).resolve("playwright/package.json")), "cli.js");
+    console.error("ai-tag-debugger: installing the Chromium browser (one time, about a minute)...");
+    const child = spawn(process.execPath, [cli, "install", "chromium"], { stdio: ["ignore", 2, 2] });
+    child.on("error", reject);
+    child.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`Installing the browser failed (exit code ${code}). Run: npx -y playwright@1.56.1 install chromium`))));
+  }).finally(() => { browserInstall = null; });
+  return browserInstall;
+}
+
+export const CMP_BANNER_SELECTORS = `#onetrust-banner-sdk, #onetrust-consent-sdk, #CybotCookiebotDialog, #usercentrics-root, #didomi-host, #cookiescript_injected, .cky-consent-container, .cc-window, #cmpbox, .qc-cmp2-container, \
+#truste-consent-track, #consent_blackbar, .osano-cm-window, #iubenda-cs-banner, .iubenda-cs-container, #cmplz-cookiebanner-container, .cmplz-cookiebanner, #cookiefirst-root, .cookiefirst-root, #axeptio_overlay, \
+#sp_message_container, [id^="sp_message_container_"], #cookie-law-info-bar, #BorlabsCookieBox, .klaro, #termly-code-snippet-support, #cookie-information-template-wrapper, #coiOverlay, \
+#cmpwrapper, #cmpbox2, .fc-consent-root, #ppms_cm_popup_overlay, [aria-label*="cookie" i][role=dialog]`;
+
 // Caps on what one audit records, so a looping page can't grow memory without limit.
 const LOG_LIMITS = { hits: 5000, dataLayerLog: 5000, network: 10000 };
 
@@ -341,6 +364,8 @@ export class AuditSession {
     this.hits = [];
     this.steps = [];
     this.consentStep = null;
+    this.rejectStep = null;
+    this.cookieLog = []; // each cookie name and domain with the step it was first seen at (never values)
     this.errors = [];
     this.dataLayerLog = [];
     this.network = [];
@@ -369,7 +394,13 @@ export class AuditSession {
       // flight once they are removed at the end, go to a proxy that isn't there.
       launch.proxy = { server: "http://127.0.0.1:9", bypass: "<-loopback>" };
     }
-    this.browser = await chromium.launch(launch);
+    try {
+      this.browser = await chromium.launch(launch);
+    } catch (err) {
+      if (!/Executable doesn't exist|playwright install/i.test(String(err?.message))) throw err;
+      await installBrowser();
+      this.browser = await chromium.launch(launch);
+    }
     const record = this.opts.recordHar ? { recordHar: { path: this.opts.recordHar, mode: "minimal" } } : {};
     this.context = await this.browser.newContext({ ...device, locale: "en-US", ...record });
     await this.context.exposeBinding("__atdRecord", (_source, entry) => {
@@ -717,7 +748,7 @@ export class AuditSession {
       if (!/intercepts pointer events|not stable|outside of the viewport/.test(err.message)) throw err;
     }
     const cover = await locator
-      .evaluate((el) => {
+      .evaluate((el, selectors) => {
         const r = el.getBoundingClientRect();
         const x = Math.min(Math.max(r.left + r.width / 2, 0), window.innerWidth - 1);
         const y = Math.min(Math.max(r.top + r.height / 2, 0), window.innerHeight - 1);
@@ -742,13 +773,13 @@ export class AuditSession {
           const modal = n.matches("dialog[open], [role=dialog], [role=alertdialog], [aria-modal=true]");
           // Cookie and consent banners block even when they cover only part of the screen.
           const consent =
-            n.matches("#onetrust-banner-sdk, #onetrust-consent-sdk, #CybotCookiebotDialog, #usercentrics-root, #didomi-host, #cookiescript_injected, .cky-consent-container, .cc-window, #cmpbox, .qc-cmp2-container") ||
+            n.matches(selectors) ||
             (/(cookie|consent|gdpr|kvkk)/i.test(`${n.id} ${typeof n.className === "string" ? n.className : ""}`) && ["fixed", "sticky"].includes(getComputedStyle(n).position));
           if (consent) return { blocking: true, what: describe(n) };
           if (modal || b.width * b.height >= screen * 0.5) return { blocking: true, what: describe(n) };
         }
         return { blocking: false, what: describe(hit), free };
-      })
+      }, CMP_BANNER_SELECTORS)
       .catch(() => null);
     if (cover?.blocking) {
       throw new Error(`The element is covered by ${cover.what}. Deal with that first (for example accept or close it), as a visitor would.`);
@@ -770,10 +801,11 @@ export class AuditSession {
   /**
    * Performs one action and records it as a step. Returns an error message
    * instead of throwing, so the agent can recover.
-   * @param {{ action: string, ref?: number, selector?: string, text?: string, value?: string, url?: string, reason?: string, accepts_consent?: boolean }} a
+   * @param {{ action: string, ref?: number, selector?: string, text?: string, value?: string, url?: string, reason?: string, accepts_consent?: boolean, rejects_consent?: boolean }} a
    */
   async act(a) {
     const error = await this.perform(a);
+    await this.trackCookies();
     // A scripted replay of this step may fail the same way, which must not end the journey there.
     if (error) this.steps[this.currentStep].error = error;
     return error;
@@ -781,7 +813,7 @@ export class AuditSession {
 
   async perform(a) {
     const describe = a.reason || `${a.action} ${a.selector ?? (a.ref != null ? `#${a.ref}` : a.text != null ? `"${a.text}"` : a.url ?? "")}`.trim();
-    this.beginStep(describe, { action: a.action, acceptsConsent: !!a.accepts_consent });
+    this.beginStep(describe, { action: a.action, acceptsConsent: !!a.accepts_consent, rejectsConsent: !!a.rejects_consent });
     const step = this.steps[this.currentStep];
     try {
       switch (a.action) {
@@ -843,12 +875,28 @@ export class AuditSession {
       const blocked = await this.enforce();
       if (blocked) return blocked;
       if (a.accepts_consent && this.consentStep === null) this.consentStep = this.currentStep;
+      if (a.rejects_consent && this.rejectStep === null) {
+        this.rejectStep = this.currentStep;
+        // A rejected banner should close; one that is still showing means the button did nothing.
+        step.bannerOpenAfter = await this.page.evaluate((sel) => [...document.querySelectorAll(sel)].some((n) => {
+          const r = n.getBoundingClientRect();
+          return r.width > 0 && r.height > 0 && getComputedStyle(n).visibility !== "hidden";
+        }), CMP_BANNER_SELECTORS).catch(() => false);
+      }
       return null;
     } catch (err) {
       return (await this.enforce().catch(() => null)) ?? err.message.split("\n")[0];
     }
   }
 
+  /** Notes which cookies appeared during the step just taken (names and domains only). */
+  async trackCookies() {
+    const seen = new Set(this.cookieLog.map((c) => `${c.domain}|${c.name}`));
+    for (const c of await this.cookies()) {
+      if (!seen.has(`${c.domain}|${c.name}`) && this.cookieLog.length < 500) this.cookieLog.push({ ...c, step: this.currentStep });
+    }
+  }
+
   async cookies() {
     let timer;
     const tooLong = new Promise((resolve) => (timer = setTimeout(() => resolve([]), 10_000)));

package/src/checks.js

@@ -6,16 +6,63 @@ import { isOwnAddress } from "./redact.js";
 
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
 const EMAIL = /[A-Z0-9._%+-]+(@|%40)[A-Z0-9.-]+\.[A-Z]{2,}/gi;
+// Consent Mode v2 added two signals to ad_storage and analytics_storage. Google requires them for EEA/UK traffic.
+const V2_SIGNALS = ["ad_user_data", "ad_personalization"];
+const TRACKING_COOKIE = /^(_ga(_.+)?|_gid|_gat(_.+)?|_gcl_.+|_fbp|_fbc|_ttp|_tt_.+|_uet(sid|vid)|_clck|_clsk|_hj.+|_pin_unauth|_scid|IDE|test_cookie|fr|li_.+|_dc_gtm_.+)$/;
 const SEVERITY_ORDER = { broken: 0, risk: 1, warning: 2, info: 3, ok: 4 };
 
 /**
- * @typedef {{ platform: string, name: string, required_params?: string[], journeys?: string[], allow_multiple?: boolean }} PlanEvent
+ * @typedef {{ platform: string, name: string, aliases?: string[], required_params?: string[], journeys?: string[], allow_multiple?: boolean }} PlanEvent
  * @typedef {{ consent_mode?: boolean, events: PlanEvent[] }} Plan
  * @typedef {{ severity: "broken"|"risk"|"warning"|"info"|"ok", check: string, journey: string, viewport: string, platform?: string, event?: string, step?: string, detail: string, evidence?: string }} Finding
  */
 
 const key = (platform, name) => `${platform}:${name}`;
 
+// Sites name events in their own way: Elevar's dl_add_to_cart, UA-style addToCart, Add To Cart.
+// Names are compared without case, spaces, dashes, underscores and a leading "dl", then through
+// SYNONYMS to one canonical name. A plan event can add its own names with "aliases".
+const SYNONYMS = {
+  viewitem: ["productview", "productdetail", "productdetails", "detail", "viewproduct", "viewcontent"],
+  viewitemlist: ["productlist", "viewproductlist", "productimpressions", "viewcollection", "viewcategory"],
+  addtocart: ["add", "addtobasket", "addtobag", "cartadd"],
+  removefromcart: ["remove", "removefrombasket", "removefrombag", "cartremove"],
+  viewcart: ["cartview", "viewbasket", "viewbag"],
+  begincheckout: ["checkout", "initiatecheckout", "checkoutstart", "checkoutbegin"],
+  addshippinginfo: ["checkoutshipping", "shippinginfo"],
+  addpaymentinfo: ["checkoutpayment", "paymentinfo", "addpayment"],
+  purchase: ["transaction", "ordercomplete", "ordercompleted", "orderconfirmation", "checkoutcomplete", "checkoutcompleted"],
+};
+const CANONICAL = new Map(Object.entries(SYNONYMS).flatMap(([c, list]) => list.map((a) => [a, c])));
+
+/** One comparable form of an event name. */
+export function canonicalEvent(name) {
+  let n = String(name ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (n.startsWith("dl") && n.length > 2) n = n.slice(2);
+  return CANONICAL.get(n) ?? n;
+}
+
+/** Whether a captured hit is the planned event, by its exact name, an alias or a common variant. */
+export function hitMatchesEvent(ev, hit) {
+  if (hit.platform !== ev.platform) return false;
+  if (hit.name === ev.name) return true;
+  const h = canonicalEvent(hit.name);
+  return h === canonicalEvent(ev.name) || (ev.aliases ?? []).some((a) => canonicalEvent(a) === h);
+}
+
+// Ecommerce parameters sites send under another name (UA-style products/revenue, order ids).
+const PARAM_ALIASES = {
+  items: ["products", "item_list", "contents"],
+  value: ["revenue", "total"],
+  transaction_id: ["order_id", "orderid", "oid"],
+  currency: ["currency_code", "cu"],
+};
+
+/** Whether a hit carries a required parameter, under its own name or a common alias. */
+export function hasParam(hit, name) {
+  return [name, ...(PARAM_ALIASES[name] ?? [])].some((n) => hit.params?.[n] !== undefined && hit.params[n] !== "");
+}
+
 /** The page load a hit came from: GA4's page load id (_p) when it has one, else the page address. */
 function pageOf(hit) {
   try {
@@ -79,7 +126,8 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     if (skipped.length) findings.push({ ...base, severity: "info", check: "planned_out_of_scope", detail: d.plannedOutOfScope(skipped.map((e) => key(e.platform, e.name))) });
   }
   const stepLabel = (i) => run.steps[i]?.label ?? `step ${i}`;
-  const planByKey = new Map(plan.events.map((e) => [key(e.platform, e.name), e]));
+  const planEventFor = (hit) => plan.events.find((e) => hitMatchesEvent(e, hit));
+  const planKeyOf = (hit) => { const e = planEventFor(hit); return e ? key(e.platform, e.name) : key(hit.platform, hit.name); };
 
   if (!run.completed) {
     findings.push({ ...base, severity: "warning", check: "journey_incomplete", detail: d.journeyIncomplete(run.note) });
@@ -88,7 +136,7 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   // Expected events that never fired.
   for (const ev of plan.events) {
     if (!expectedIn(ev, run.journeyId)) continue;
-    const fired = run.hits.some((h) => h.platform === ev.platform && h.name === ev.name);
+    const fired = run.hits.some((h) => hitMatchesEvent(ev, h));
     if (!fired) {
       findings.push({
         ...base,
@@ -104,9 +152,9 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   // Required parameters missing on events that did fire (reported once per event).
   const paramsReported = new Set();
   for (const hit of run.hits) {
-    const ev = planByKey.get(key(hit.platform, hit.name));
+    const ev = planEventFor(hit);
     if (!ev?.required_params?.length) continue;
-    const missing = ev.required_params.filter((p) => hit.params[p] === undefined || hit.params[p] === "");
+    const missing = ev.required_params.filter((p) => !hasParam(hit, p));
     const reportKey = `${key(hit.platform, hit.name)}|${missing.join(",")}`;
     if (missing.length && !paramsReported.has(reportKey)) {
       paramsReported.add(reportKey);
@@ -127,14 +175,18 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   // new page can also carry the previous page's last hits, so the page is part of the key.
   const perStep = new Map();
   for (const hit of run.hits) {
-    const k = `${hit.step}|${key(hit.platform, hit.name)}|${pageOf(hit)}`;
+    const k = `${hit.step}|${planKeyOf(hit)}|${pageOf(hit)}`;
     perStep.set(k, [...(perStep.get(k) ?? []), hit]);
   }
   for (const [, hits] of perStep) {
-    const ev = planByKey.get(key(hits[0].platform, hits[0].name));
+    const ev = planEventFor(hits[0]);
     if (hits.length < 2 || ev?.allow_multiple) continue;
     // TikTok sends unnamed pings (no event name) on its own schedule, so their count varies between runs.
     if (hits[0].platform === "tiktok" && hits[0].name === "(unnamed)") continue;
+    // Hits that repeat an event ID are one event to the platform (it keeps the first), so only
+    // distinct IDs, and hits without an ID, count as separate sends.
+    const sends = new Set(hits.map((h, i) => (h.eventId ? `id:${h.eventId}` : `n:${i}`))).size;
+    if (sends < 2) continue;
     findings.push({
       ...base,
       severity: "warning",
@@ -142,10 +194,32 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
       platform: hits[0].platform,
       event: hits[0].name,
       step: stepLabel(hits[0].step),
-      detail: d.duplicate(hits[0].name, hits.length),
+      detail: d.duplicate(hits[0].name, sends),
     });
   }
 
+  // Server-side tagging. Only what the browser can see: a GA4 hit to a server container, and requests
+  // to Stape or Elevar. Meta's and TikTok's server-side copies never pass through the browser.
+  const serverHits = run.hits.filter((h) => h.delivery === "server");
+  if (serverHits.length) {
+    const names = (list) => [...new Set(list.map((h) => h.name))];
+    const byPlatform = [...new Set(run.hits.map((h) => h.platform))].map((platform) => {
+      const own = run.hits.filter((h) => h.platform === platform);
+      return { platform, server: names(own.filter((h) => h.delivery === "server")), browser: names(own.filter((h) => h.delivery !== "server")) };
+    }).filter((p) => p.server.length);
+    for (const p of byPlatform) findings.push({ ...base, severity: "info", check: "server_side", platform: p.platform, detail: d.serverSide(p.platform, p.server, p.browser) });
+  }
+  const serverVendors = [...new Set((run.network ?? []).map((c) => c.provider).filter((p) => p === "stape" || p === "elevar"))];
+  if (serverVendors.length || serverHits.length) {
+    const noId = new Map();
+    for (const hit of run.hits) {
+      if ((hit.platform === "meta" || hit.platform === "tiktok") && !hit.eventId && !noId.has(key(hit.platform, hit.name))) noId.set(key(hit.platform, hit.name), hit);
+    }
+    for (const [, hit] of noId) {
+      findings.push({ ...base, severity: "info", check: "dedup_id_missing", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: d.dedupIdMissing(hit.platform, hit.name) });
+    }
+  }
+
   // Consent.
   const granted = consentGrantedStep(run);
   const firstHitStep = run.hits.length ? Math.min(...run.hits.map((h) => h.step)) : null;
@@ -157,8 +231,63 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
       findings.push({ ...base, severity: "risk", check: "consent_default_late", detail: d.consentDefaultLate() });
     }
   }
+  const defaults = run.dataLayerLog.filter((e) => isConsentCommand(e, "default"));
+  if (plan.consent_mode && defaults.length) {
+    const declared = new Set(defaults.flatMap((e) => Object.keys(e.value[2] ?? {})));
+    const missing = V2_SIGNALS.filter((k) => !declared.has(k));
+    if (missing.length) findings.push({ ...base, severity: "risk", check: "consent_v2_missing", detail: d.consentV2Missing(missing) });
+  }
+  if (granted !== null) {
+    const updates = run.dataLayerLog.filter((e) => isConsentCommand(e, "update"));
+    if (updates.length) {
+      const grantedKeys = new Set(updates.flatMap((e) => Object.entries(e.value[2] ?? {}).filter(([, v]) => v === "granted").map(([k]) => k)));
+      const missing = V2_SIGNALS.filter((k) => !grantedKeys.has(k));
+      if (missing.length) findings.push({ ...base, severity: "warning", check: "consent_v2_update", detail: d.consentV2Update(missing) });
+    }
+  }
+
+  // Declining: nothing may be sent or stored for ads after the visitor said no.
+  const rejectStep = run.rejectStep ?? null;
+  if (rejectStep !== null) {
+    const reject = run.steps.find((s) => s.index === rejectStep);
+    const regranted = run.dataLayerLog.find(
+      (e) => e.step >= rejectStep && isConsentCommand(e, "update") && Object.values(e.value[2] ?? {}).includes("granted"),
+    );
+    if (regranted) findings.push({ ...base, severity: "broken", check: "reject_ignored", step: stepLabel(regranted.step), detail: d.rejectIgnored() });
+    else if (reject?.bannerOpenAfter) findings.push({ ...base, severity: "broken", check: "reject_button_failed", step: stepLabel(rejectStep), detail: d.rejectButtonFailed() });
+    const afterReject = new Map();
+    for (const hit of run.hits) {
+      if (hit.step < rejectStep) continue;
+      const claimsGranted = hit.consent?.ad_storage === "granted" || hit.consent?.analytics_storage === "granted";
+      if (NON_GOOGLE_AD_PLATFORMS.has(hit.platform) || claimsGranted) {
+        const k = key(hit.platform, hit.name);
+        if (!afterReject.has(k)) afterReject.set(k, hit);
+      }
+    }
+    for (const [, hit] of afterReject) {
+      findings.push({ ...base, severity: "broken", check: "after_reject", platform: hit.platform, event: hit.name, step: stepLabel(hit.step), detail: d.afterReject(hit.platform, hit.name) });
+    }
+  }
+
+  // Cookies set before the visitor chose (or after they said no).
+  const cookieCutoff = rejectStep ?? granted;
+  const earlyCookies = (run.cookieLog ?? []).filter((c) => TRACKING_COOKIE.test(c.name) && (cookieCutoff === null || c.step < cookieCutoff));
+  if (earlyCookies.length) {
+    const names = [...new Set(earlyCookies.map((c) => c.name))];
+    findings.push({ ...base, severity: "risk", check: "cookies_before_consent", step: stepLabel(Math.min(...earlyCookies.map((c) => c.step))), detail: granted === null && rejectStep === null ? d.cookiesNeverConsent(names) : d.cookiesBeforeConsent(names) });
+  }
+  if (rejectStep !== null) {
+    const lateCookies = (run.cookieLog ?? []).filter((c) => TRACKING_COOKIE.test(c.name) && c.step >= rejectStep);
+    if (lateCookies.length) {
+      const names = [...new Set(lateCookies.map((c) => c.name))];
+      findings.push({ ...base, severity: "broken", check: "cookies_after_reject", step: stepLabel(Math.min(...lateCookies.map((c) => c.step))), detail: d.cookiesAfterReject(names) });
+    }
+  }
+
   const beforeConsent = new Map();
   for (const hit of run.hits) {
+    // Hits from the reject click on are covered by the after_reject check.
+    if (rejectStep !== null && hit.step >= rejectStep) continue;
     const early = granted === null || hit.step < granted;
     if (!early) continue;
     const adPlatform = NON_GOOGLE_AD_PLATFORMS.has(hit.platform);
@@ -207,14 +336,14 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   }
 
   // Events that are not in the plan.
-  const unplanned = [...new Set(run.hits.filter((h) => !planByKey.has(key(h.platform, h.name))).map((h) => key(h.platform, h.name)))];
+  const unplanned = [...new Set(run.hits.filter((h) => !planEventFor(h)).map((h) => key(h.platform, h.name)))];
   if (unplanned.length) {
     findings.push({ ...base, severity: "info", check: "unplanned_events", detail: d.unplanned(unplanned) });
   }
 
   // Planned events that fired cleanly.
   const problemKeys = new Set(findings.filter((f) => f.event).map((f) => key(f.platform, f.event)));
-  const okKeys = [...new Set(run.hits.map((h) => key(h.platform, h.name)))].filter((k) => planByKey.has(k) && !problemKeys.has(k));
+  const okKeys = [...new Set(run.hits.filter((h) => planEventFor(h)).map((h) => key(h.platform, h.name)))].filter((k) => !problemKeys.has(k));
   if (okKeys.length) {
     findings.push({ ...base, severity: "ok", check: "matches_plan", detail: d.matches(okKeys) });
   }

package/src/i18n.js

@@ -61,6 +61,7 @@ const en = {
     customItemParams: "Custom item parameters",
     itemsCount: (n) => `${n} ${n === 1 ? "item" : "items"}`,
     noItems: "no items",
+    serverSideTag: "server-side",
     source: "Source",
     request: "Request",
     noRequest: "No matching request",
@@ -120,10 +121,20 @@ const en = {
     missingEventEarly: (name) => `${q(name)} was not seen, but the journey stopped early, so this may not be a tracking bug.`,
     missingParams: (name, params) => `${q(name)} was sent without ${params.map(q).join(", ")}.`,
     duplicate: (name, n) => `${q(name)} was sent ${n} times by one action, which inflates counts and conversions.`,
+    serverSide: (platform, server, browser) => `${platform}: ${server.map(q).join(", ")} ${server.length === 1 ? "was" : "were"} sent to a server container on the site's own domain (server-side tagging)${browser.length ? `; ${browser.map(q).join(", ")} went directly from the browser` : ""}. Server-side copies of Meta and TikTok events never pass through the browser, so they can't be seen here.`,
+    dedupIdMissing: (platform, name) => `${platform} ${q(name)} was sent from the browser without an event ID, while a server-side setup was seen on this site. If the server also sends this event, ${platform} can't match the two and counts it twice.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)} fired although consent was never given in this journey.`,
     beforeConsent: (platform, name) => `${platform} ${q(name)} fired before the visitor accepted cookies.`,
+    consentV2Missing: (keys) => `The Consent Mode default does not set ${keys.map(q).join(" and ")}. Consent Mode v2 needs them for Google ads in the EEA and UK; without them ad personalization and conversion measurement can stop.`,
+    consentV2Update: (keys) => `After the visitor accepted, the Consent Mode update did not grant ${keys.map(q).join(" and ")}. Ad conversions and remarketing may stay off.`,
+    rejectIgnored: () => "A Consent Mode update granted consent after the visitor rejected cookies, so the reject button does not stick.",
+    rejectButtonFailed: () => "The cookie banner was still showing after the reject button was clicked.",
+    afterReject: (platform, name) => `${platform} ${q(name)} was still sent after the visitor rejected cookies.`,
+    cookiesBeforeConsent: (names) => `Tracking cookies were set before the visitor accepted: ${names.join(", ")}.`,
+    cookiesNeverConsent: (names) => `Tracking cookies were set although consent was never given in this journey: ${names.join(", ")}.`,
+    cookiesAfterReject: (names) => `Tracking cookies were set after the visitor rejected cookies: ${names.join(", ")}.`,
     pii: (platform, name) => `An email address was sent in plain text with ${q(name)} to ${platform}.`,
     unplanned: (list) => `Events sent that are not in the measurement plan: ${list.join(", ")}.`,
     piiUnhashed: (platform, name, fields) => `${q(name)} sent user data to ${platform} without hashing it (${fields.join(", ")}). Ad platforms expect these values SHA-256 hashed.`,
@@ -192,6 +203,7 @@ const tr = {
     customItemParams: "Özel ürün parametreleri",
     itemsCount: (n) => `${n} ürün`,
     noItems: "ürün yok",
+    serverSideTag: "sunucu tarafı",
     source: "Kaynak",
     request: "İstek",
     noRequest: "Eşleşen istek yok",
@@ -251,10 +263,20 @@ const tr = {
     missingEventEarly: (name) => `${q(name)} görülmedi, ancak yolculuk erken durduğu için bu bir izleme hatası olmayabilir.`,
     missingParams: (name, params) => `${q(name)} olayı ${params.map(q).join(", ")} ${params.length > 1 ? "parametreleri" : "parametresi"} olmadan gönderildi.`,
     duplicate: (name, n) => `${q(name)} tek bir işlemde ${n} kez gönderildi; bu da sayıları ve dönüşümleri şişirir.`,
+    serverSide: (platform, server, browser) => `${platform}: ${server.map(q).join(", ")} sitenin kendi alan adındaki bir sunucu konteynerine gönderildi (sunucu tarafı etiketleme)${browser.length ? `; ${browser.map(q).join(", ")} doğrudan tarayıcıdan gitti` : ""}. Meta ve TikTok olaylarının sunucu tarafı kopyaları tarayıcıdan geçmez, bu yüzden burada görünmez.`,
+    dedupIdMissing: (platform, name) => `${platform} ${q(name)} tarayıcıdan olay kimliği olmadan gönderildi; sitede sunucu tarafı bir kurulum görüldü. Sunucu da bu olayı gönderiyorsa ${platform} ikisini eşleştiremez ve iki kez sayar.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     beforeConsentNever: (platform, name) => `${platform} ${q(name)}, bu yolculukta hiç onay verilmemesine rağmen tetiklendi.`,
     beforeConsent: (platform, name) => `${platform} ${q(name)}, ziyaretçi çerezleri kabul etmeden önce tetiklendi.`,
+    consentV2Missing: (keys) => `Consent Mode varsayılanı ${keys.map(q).join(" ve ")} değerlerini ayarlamıyor. Consent Mode v2, AEA ve Birleşik Krallık'taki Google reklamları için bunları ister; yoksa reklam kişiselleştirme ve dönüşüm ölçümü durabilir.`,
+    consentV2Update: (keys) => `Ziyaretçi kabul ettikten sonra Consent Mode güncellemesi ${keys.map(q).join(" ve ")} iznini vermedi. Reklam dönüşümleri ve yeniden pazarlama kapalı kalabilir.`,
+    rejectIgnored: () => "Ziyaretçi çerezleri reddettikten sonra bir Consent Mode güncellemesi izin verdi; reddet düğmesi işe yaramıyor.",
+    rejectButtonFailed: () => "Reddet düğmesine tıklandıktan sonra çerez bandı hâlâ görünüyordu.",
+    afterReject: (platform, name) => `${platform} ${q(name)}, ziyaretçi çerezleri reddettikten sonra da gönderildi.`,
+    cookiesBeforeConsent: (names) => `Ziyaretçi kabul etmeden önce izleme çerezleri yazıldı: ${names.join(", ")}.`,
+    cookiesNeverConsent: (names) => `Bu yolculukta hiç onay verilmemesine rağmen izleme çerezleri yazıldı: ${names.join(", ")}.`,
+    cookiesAfterReject: (names) => `Ziyaretçi çerezleri reddettikten sonra izleme çerezleri yazıldı: ${names.join(", ")}.`,
     pii: (platform, name) => `${q(name)} ile birlikte ${platform} platformuna düz metin olarak bir e-posta adresi gönderildi.`,
     unplanned: (list) => `Ölçüm planında olmayan olaylar gönderildi: ${list.join(", ")}.`,
     piiUnhashed: (platform, name, fields) => `${q(name)}, ${platform} platformuna kullanıcı verisini karma (hash) yapmadan gönderdi (${fields.join(", ")}). Reklam platformları bu değerleri SHA-256 ile karma yapılmış bekler.`,

package/src/journeys.js

@@ -46,9 +46,13 @@ export const JOURNEY_PRESETS = {
       { platform: "meta", name: "Search" },
     ],
   },
+  decline_cookies: {
+    goal: "Reject all cookies on the cookie banner (the reject-all or decline button, never accept) and set rejects_consent to true on that click. Then browse the site like a visitor who said no: scroll the home page, open a product or article page, and open a second page. Stop there.",
+    events: [],
+  },
 };
 
-const ALIASES = { checkout: "purchase", order: "purchase", cart: "add_to_cart", signup: "sign_up", register: "sign_up", registration: "sign_up", contact: "lead", form: "lead" };
+const ALIASES = { checkout: "purchase", order: "purchase", cart: "add_to_cart", signup: "sign_up", decline: "decline_cookies", reject: "decline_cookies", reject_cookies: "decline_cookies", consent: "decline_cookies", register: "sign_up", registration: "sign_up", contact: "lead", form: "lead" };
 
 /** The preset for a name like "purchase" or "signup", or null. */
 export function presetFor(name) {

package/src/mcp.js

@@ -9,6 +9,7 @@ import { createServer } from "node:http";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
+import { readFileSync } from "node:fs";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -22,7 +23,7 @@ import { loadConfig, readJson, runAudit, writeReports } from "./audit.js";
 import { DEFAULT_PROVIDERS, PROVIDERS as TRACKING_PROVIDERS } from "./parsers.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
-const VERSION = "0.6.3";
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 const MAX_OPEN_AUDITS = 4;
 const IDLE_MS = 15 * 60 * 1000; // an audit untouched this long is closed
 const MAX_BODY_BYTES = 1024 * 1024;
@@ -174,7 +175,7 @@ export function buildServer(opts) {
     {
       title: "Act in the audit browser",
       description:
-        "Performs one action in the audit's browser and returns the updated page plus the tracking hits that action sent. Actions: goto (url), click (ref or text), fill (ref or text, value), select (ref or text, value), scroll (value = down or up), wait (value = milliseconds). Refs come from the latest page view, which lists on-screen elements first; if an element has no ref, scroll or pass its visible text in text. If a cookie banner appears, accept it and set accepts_consent to true on that click. Use test data in forms and never enter real payment details.",
+        "Performs one action in the audit's browser and returns the updated page plus the tracking hits that action sent. Actions: goto (url), click (ref or text), fill (ref or text, value), select (ref or text, value), scroll (value = down or up), wait (value = milliseconds). Refs come from the latest page view, which lists on-screen elements first; if an element has no ref, scroll or pass its visible text in text. If a cookie banner appears, accept it and set accepts_consent to true on that click (or, on a journey that is about declining cookies, reject it and set rejects_consent to true). Use test data in forms and never enter real payment details.",
       inputSchema: {
         audit_id: z.string(),
         action: z.enum(["goto", "click", "fill", "select", "scroll", "wait"]),
@@ -184,6 +185,7 @@ export function buildServer(opts) {
         url: z.string().optional().describe("Destination for goto, absolute or relative to the current page."),
         reason: z.string().describe("Short description of the step, e.g. 'Add the first product to the cart'. Shown in the report."),
         accepts_consent: z.boolean().optional().describe("True only when this click accepts the cookie or consent banner."),
+        rejects_consent: z.boolean().optional().describe("True only when this click rejects or declines all cookies on the consent banner."),
       },
     },
     async (input) => {

package/src/parsers.js

@@ -36,6 +36,17 @@ const GOOGLE_COMPANION_HOST = /^(www\.)?google\.[a-z]{2,3}(\.[a-z]{2})?$|(^|\.)d
  */
 const isGa4Path = (u) => u.pathname.endsWith("/g/collect") || (/\/g\/c$/.test(u.pathname) && /^G-[A-Z0-9]+$/.test(u.searchParams.get("tid") ?? ""));
 
+const GOOGLE_PRIMARY_HOST = /(^|\.)(google-analytics\.com|analytics\.google\.com|googletagmanager\.com)$/;
+
+/**
+ * Where a GA4 hit goes. "browser": Google's own hosts, or the short /g/c path of Google tag gateway
+ * (which only forwards to Google). "server": /g/collect on any other host, which is a server
+ * container (server-side GTM, Stape, Elevar) answering for the site.
+ */
+function ga4Delivery(u) {
+  return GOOGLE_PRIMARY_HOST.test(u.hostname) || /\/g\/c$/.test(u.pathname) ? "browser" : "server";
+}
+
 /** @returns {Hit[] | null} */
 export function parseGa4(url, postData) {
   const u = new URL(url);
@@ -55,6 +66,7 @@ export function parseGa4(url, postData) {
     const user = [...merged].filter(([k]) => isUserDataKey(k));
     return {
       platform: "ga4",
+      delivery: ga4Delivery(u),
       name: merged.get("en") || "(unnamed)",
       id: merged.get("tid") || undefined,
       params: ga4ParamsFrom(merged),
@@ -75,7 +87,11 @@ export function parseMeta(url) {
     const m = k.match(/^cd\[(.+)\]$/);
     if (m) params[m[1]] = v;
   }
-  return [{ platform: "meta", name: u.searchParams.get("ev") || "(unnamed)", id: u.searchParams.get("id") || undefined, params, url }];
+  // eid is the event ID a server-side (Conversions API) copy of the event must repeat for Meta to count it once.
+  const eventId = u.searchParams.get("eid") || undefined;
+  if (eventId) params.event_id = eventId;
+  const user = [...u.searchParams].filter(([k]) => isUserDataKey(k));
+  return [{ platform: "meta", delivery: "browser", name: u.searchParams.get("ev") || "(unnamed)", id: u.searchParams.get("id") || undefined, ...(eventId ? { eventId } : {}), params, ...(user.length ? { userFields: Object.fromEntries(user) } : {}), url }];
 }
 
 /** @returns {Hit[] | null} */
@@ -105,7 +121,8 @@ export function parseTikTok(url, postData) {
   const props = body.properties || body.context?.properties || {};
   const params = Object.fromEntries(Object.entries(props).map(([k, v]) => [k, String(v)]));
   const user = Object.entries(body.context?.user ?? {}).filter(([k, v]) => isUserDataKey(`context.user.${k}`) && v);
-  return [{ platform: "tiktok", name: body.event || "(unnamed)", id: body.context?.pixel?.code, params, ...(user.length ? { userFields: Object.fromEntries(user.map(([k, v]) => [`context.user.${k}`, String(v)])) } : {}), url }];
+  const eventId = body.event_id ? String(body.event_id) : undefined;
+  return [{ platform: "tiktok", delivery: "browser", name: body.event || "(unnamed)", id: body.context?.pixel?.code, ...(eventId ? { eventId } : {}), params, ...(user.length ? { userFields: Object.fromEntries(user.map(([k, v]) => [`context.user.${k}`, String(v)])) } : {}), url }];
 }
 
 /**
@@ -128,7 +145,67 @@ export function parseX(url) {
   return [{ platform: "x", name: name || "(unnamed)", id: q.get("txn_id") || undefined, params, url }];
 }
 
-const PARSERS = [parseGa4, parseMeta, parseGoogleAds, parseTikTok, parseX];
+const jsonOr = (text, fallback) => { try { return JSON.parse(text); } catch { return fallback; } };
+const scalars = (obj) => Object.fromEntries(Object.entries(obj && typeof obj === "object" ? obj : {}).filter(([, v]) => v !== null && typeof v !== "object").map(([k, v]) => [k, String(v)]));
+
+/** Pinterest tag: ct.pinterest.com/v3/ with event, tid, ed (event data) and pd (hashed user data). @returns {Hit[] | null} */
+export function parsePinterest(url) {
+  const u = new URL(url);
+  const q = u.searchParams;
+  if (u.hostname !== "ct.pinterest.com" || !/^\/v3\/?$/.test(u.pathname) || !q.has("event")) return null;
+  const params = scalars(jsonOr(q.get("ed") ?? "{}", {}));
+  if (q.has("event_id")) params.event_id = q.get("event_id");
+  const user = Object.entries(scalars(jsonOr(q.get("pd") ?? "{}", {}))).filter(([k, v]) => isUserDataKey(k) && v);
+  return [{ platform: "pinterest", name: q.get("event"), id: q.get("tid") || undefined, params, ...(user.length ? { userFields: Object.fromEntries(user.map(([k, v]) => [`pd.${k}`, v])) } : {}), url }];
+}
+
+/** Snap Pixel: tr.snapchat.com/p (query or form body) with pid, ev, and price/currency/transaction fields. @returns {Hit[] | null} */
+export function parseSnapchat(url, postData) {
+  const u = new URL(url);
+  if (u.hostname !== "tr.snapchat.com" || !/^\/(p|tr)\/?$/.test(u.pathname)) return null;
+  const q = new URLSearchParams(u.search);
+  if (postData && !postData.trim().startsWith("{")) for (const [k, v] of new URLSearchParams(postData)) q.set(k, v);
+  else if (postData) for (const [k, v] of Object.entries(scalars(jsonOr(postData, {})))) q.set(k, v);
+  if (!q.has("pid") && !q.has("ev")) return null;
+  const params = {};
+  for (const [from, to] of [["pr", "value"], ["cur", "currency"], ["tid", "transaction_id"], ["ic", "quantity"], ["ci", "content_ids"], ["u", "page_location"]]) {
+    if (q.has(from)) params[to] = q.get(from);
+  }
+  const user = [...q].filter(([k, v]) => isUserDataKey(k) && v);
+  return [{ platform: "snapchat", name: q.get("ev") || "(unnamed)", id: q.get("pid") || undefined, params, ...(user.length ? { userFields: Object.fromEntries(user) } : {}), url }];
+}
+
+/**
+ * Klaviyo onsite tracking: a JSON:API POST to a.klaviyo.com/client/events/ with the metric
+ * name, event properties and the profile it belongs to. Profile fields are user data.
+ * @returns {Hit[] | null}
+ */
+export function parseKlaviyo(url, postData) {
+  const u = new URL(url);
+  if (u.hostname !== "a.klaviyo.com" || !/^\/client\/events\/?$/.test(u.pathname)) return null;
+  const attrs = jsonOr(postData ?? "{}", {})?.data?.attributes ?? {};
+  const profile = scalars(attrs.profile?.data?.attributes ?? attrs.profile);
+  const user = Object.entries(profile).filter(([k, v]) => isUserDataKey(k) && v);
+  return [{
+    platform: "klaviyo",
+    name: attrs.metric?.data?.attributes?.name ?? attrs.metric?.name ?? "(unnamed)",
+    id: u.searchParams.get("company_id") || undefined,
+    params: { ...scalars(attrs.properties), ...(attrs.value !== undefined ? { value: String(attrs.value) } : {}) },
+    ...(user.length ? { userFields: Object.fromEntries(user.map(([k, v]) => [`profile.${k}`, v])) } : {}),
+    url,
+  }];
+}
+
+/** Hotjar: calls to its in.hotjar.com / .hotjar.io API carry the site id in the path. Only the id is read. @returns {Hit[] | null} */
+export function parseHotjar(url) {
+  const u = new URL(url);
+  if (!/(^|\.)hotjar\.(com|io)$/.test(u.hostname)) return null;
+  const m = u.pathname.match(/^\/api\/v\d+\/client\/sites\/(\d+)\/([a-z-]+)/i);
+  if (!m) return null;
+  return [{ platform: "hotjar", name: m[2], id: m[1], params: {}, url }];
+}
+
+const PARSERS = [parseGa4, parseMeta, parseGoogleAds, parseTikTok, parseX, parsePinterest, parseSnapchat, parseKlaviyo, parseHotjar];
 
 /** Returns normalized hits for a request, or null when it is not a tracking request. */
 export function parseTrackingRequest(url, postData) {
@@ -184,6 +261,7 @@ export const PROVIDERS = {
   microsoft_ads: "Microsoft Ads",
   pinterest: "Pinterest",
   snapchat: "Snapchat",
+  klaviyo: "Klaviyo",
   clarity: "Microsoft Clarity",
   hotjar: "Hotjar",
   doubleclick: "DoubleClick",
@@ -191,9 +269,12 @@ export const PROVIDERS = {
 };
 export const DEFAULT_PROVIDERS = ["ga4", "google_ads", "meta", "tiktok"];
 // Tag managers and consent platforms are always shown: they explain how the tags loaded.
-const ALWAYS_SHOWN = { gtm: "Google Tag Manager", consent: "Consent platform" };
+// Server-side tagging providers are too: their requests show where events are sent from.
+const ALWAYS_SHOWN = { gtm: "Google Tag Manager", consent: "Consent platform", stape: "Stape", elevar: "Elevar" };
 
 const HOSTS = [
+  [/(^|\.)stape\.(io|jp)$/, "stape"],
+  [/(^|\.)getelevar\.com$/, "elevar"],
   [/(^|\.)(google-analytics|analytics\.google)\.com$/, "ga4"],
   [/(^|\.)googleadservices\.com$/, "google_ads"],
   [/(^|\.)googlesyndication\.com$/, "adsense"],
@@ -206,7 +287,8 @@ const HOSTS = [
   [/(^|\.)hotjar\.(com|io)$/, "hotjar"],
   [/(^|\.)(pinterest\.com|pinimg\.com)$/, "pinterest"],
   [/(^|\.)(snapchat\.com|sc-static\.net)$/, "snapchat"],
-  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.eu|cookieyes\.com)$/, "consent"],
+  [/(^|\.)klaviyo\.com$/, "klaviyo"],
+  [/(^|\.)(cookiebot\.com|cookielaw\.org|onetrust\.com|usercentrics\.(eu|com)|cookieyes\.com|didomi\.io|privacy-center\.org|trustarc\.com|truste\.com|consensu\.org|quantcast\.com|osano\.com|iubenda\.com|termly\.io|cookiefirst\.com|axeptio\.eu|sourcepoint\.com|sp-prod\.net|consentmanager\.net|cookiescript\.com|cookie-script\.com|cookieinformation\.com|civiccomputing\.com|piwik\.pro|complianz\.io|cdn\.privacy-mgmt\.com)$/, "consent"],
 ];
 
 /**
@@ -226,6 +308,8 @@ export function providerOf(url) {
   }
   if (/(^|\.)(doubleclick\.net|google\.[a-z.]+)$/.test(host) && /^\/(pagead|ccm)\//.test(u.pathname)) return of("google_ads");
   if (/(^|\.)doubleclick\.net$/.test(host)) return of("doubleclick");
+  // Before the vendor hosts: a GA4 hit to a Stape or Elevar endpoint is still a GA4 hit.
+  if (isGa4Path(u) && !GOOGLE_COMPANION_HOST.test(host)) return of("ga4");
   for (const [pattern, key] of HOSTS) if (pattern.test(host)) return of(key);
   if (isGa4Path(u)) return of("ga4");
   if (u.pathname.startsWith("/pagead/") || /\/as\/p\/c\/\d+\/?$/.test(u.pathname)) return of("google_ads");
@@ -258,7 +342,8 @@ export function vendorOf(url) {
   if (p.key === "ga4") {
     const host = new URL(url).hostname;
     if (/(^|\.)(google-analytics|analytics\.google|googletagmanager)\.com$/.test(host)) return "Google Analytics";
-    return GOOGLE_COMPANION_HOST.test(host) ? "Google Analytics (resend)" : "Google Analytics (server-side)";
+    if (GOOGLE_COMPANION_HOST.test(host)) return "Google Analytics (resend)";
+    return ga4Delivery(new URL(url)) === "server" ? "Google Analytics (server-side)" : "Google Analytics (Google tag gateway)";
   }
   return p.label;
 }

package/src/redact.js

@@ -7,7 +7,7 @@
 const USER_KEYS = new Set([
   "em", "ph", "fn", "ln", "ge", "db", "ct", "st", "zp", "country", "external_id", "uid", "user_id", "_uid",
   "email", "phone", "phone_number", "first_name", "last_name", "street", "city", "region", "postal_code", "zip",
-  "sha256_email_address", "sha256_phone_number", "sha256_email", "sha256_phone", "email_address",
+  "sha256_email_address", "sha256_phone_number", "sha256_email", "sha256_phone", "email_address", "u_hem", "u_hpn",
 ]);
 // In dataLayer pushes, short names like "city" or "country" are often page data, so only
 // these names, values under a user data object, and email-like values are redacted there.

package/src/replay.js

@@ -20,7 +20,7 @@ export function replayableJourney(run) {
     ...(run.completed ? {} : { incomplete: run.note }),
     steps: (start ? steps.slice(1) : steps)
       .filter((s) => s.replay)
-      .map((s) => ({ ...s.replay, reason: s.label, ...(s.acceptsConsent ? { accepts_consent: true } : {}), ...(s.error ? { optional: true } : {}) })),
+      .map((s) => ({ ...s.replay, reason: s.label, ...(s.acceptsConsent ? { accepts_consent: true } : {}), ...(s.rejectsConsent ? { rejects_consent: true } : {}), ...(s.error ? { optional: true } : {}) })),
   };
 }
 

package/src/report.js

@@ -1,5 +1,5 @@
 import { createProvider } from "./providers.js";
-import { groupFindings, summarize } from "./checks.js";
+import { groupFindings, hitMatchesEvent, summarize } from "./checks.js";
 import { messages } from "./i18n.js";
 import { parseTrackingRequest, providerOf, PROVIDERS } from "./parsers.js";
 import { decodeGa4Item, isEventParam, paramTip } from "./glossary.js";
@@ -192,7 +192,7 @@ export function renderMarkdown({ title, generatedAt, findings, explained, runs,
   return lines.join("\n");
 }
 
-const PLATFORM_ORDER = ["ga4", "google_ads", "meta", "tiktok", "x"];
+const PLATFORM_ORDER = ["ga4", "google_ads", "meta", "tiktok", "x", "pinterest", "snapchat", "klaviyo", "hotjar"];
 const platformLabel = (p) => PROVIDERS[p] ?? String(p).replace(/[_-]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 const platformRank = (p) => (PLATFORM_ORDER.includes(p) ? PLATFORM_ORDER.indexOf(p) : PLATFORM_ORDER.length);
 
@@ -331,6 +331,7 @@ function eventRow(m, findings, run, step, hit) {
   if (items.length) bits.push(m.ui.itemsCount(items.length));
   if (hit.params?.value) bits.push(`${hit.params.value} ${hit.params.currency ?? ""}`.trim());
   if (!items.length && hit.platform === "ga4" && ECOMMERCE_EVENTS.has(hit.name)) bits.push(m.ui.noItems);
+  if (hit.delivery === "server") bits.push(m.ui.serverSideTag);
   const consent = hit.consent ? `<h5>${m.ui.consent}</h5><div class="consents">${Object.entries(hit.consent).map(([k, v]) => `<span class="consent ${v === "granted" ? "granted" : "denied"}">${escapeHtml(k)}: ${escapeHtml(v)}</span>`).join("")}</div>` : "";
   const pushLine = pushes.length ? pushes.map((e) => `<span class="mono">${escapeHtml(pushEvent(e.value) ?? "")} · ${escapeHtml(seconds(run, e.t))}</span>`).join("") : `<span class="muted">${m.ui.noMatchingPush}</span>`;
   const reqText = calls.length
@@ -618,7 +619,7 @@ function coverageCard(m, plan, runs) {
     .map((e) => {
       const cells = runs.map((r) => {
         if (!checks(r, e) || (e.journeys && !e.journeys.includes(r.journeyId))) return '<td class="c o">–</td>';
-        return r.hits.some((h) => h.platform === e.platform && h.name === e.name) ? '<td class="c y">✓</td>' : '<td class="c x">✗</td>';
+        return r.hits.some((h) => hitMatchesEvent(e, h)) ? '<td class="c y">✓</td>' : '<td class="c x">✗</td>';
       });
       const unchecked = !runs.some((r) => checks(r, e));
       return `<tr><td><span class="ptag p-${safeKey(e.platform)}">${escapeHtml(platformLabel(e.platform))}</span> <code>${escapeHtml(e.name)}</code>${unchecked ? ` ${badge("muted", m.ui.notChecked)}` : ""}</td>${cells.join("")}</tr>`;