@eventra_dev/eventra-cli 1.0.3 → 1.0.5

package/README.md

@@ -8,7 +8,7 @@
   <a href="https://www.npmjs.com/package/@eventra_dev/eventra-cli"><img alt="npm version" src="https://img.shields.io/npm/v/@eventra_dev/eventra-cli.svg?style=flat-square&color=blue"></a>
   <a href="https://www.npmjs.com/package/@eventra_dev/eventra-cli"><img alt="npm downloads" src="https://img.shields.io/npm/dm/@eventra_dev/eventra-cli.svg?style=flat-square&color=blue"></a>
   <a href="https://github.com/and-1991/eventra-cli/actions/workflows/test.yml"><img alt="tests" src="https://img.shields.io/github/actions/workflow/status/and-1991/eventra-cli/test.yml?branch=main&label=tests&style=flat-square&logo=vitest&logoColor=white"></a>
-  <img alt="unit tests" src="https://img.shields.io/badge/unit-59%20passing-brightgreen?style=flat-square&logo=vitest&logoColor=white">
+  <img alt="unit tests" src="https://img.shields.io/badge/unit-74%20passing-brightgreen?style=flat-square&logo=vitest&logoColor=white">
   <img alt="e2e fixtures" src="https://img.shields.io/badge/e2e-12%20fixtures-brightgreen?style=flat-square">
   <img alt="node" src="https://img.shields.io/node/v/@eventra_dev/eventra-cli?style=flat-square&color=darkgreen&logo=node.js&logoColor=white">
   <a href="https://www.typescriptlang.org/"><img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-ready-blue?style=flat-square&logo=typescript&logoColor=white"></a>
@@ -155,7 +155,23 @@ Incremental scan with the same rules as `sync`.
 
 ### `eventra send`
 
-Uploads `events` from config to the Eventra API. Requires `apiKey` (and optionally `endpoint`) in `eventra.json`. Events are POSTed to `POST /api/v1/cli/events` and marked as non-billable on the backend.
+Uploads `events` from config to the Eventra API. Requires an API key and (optionally) an `endpoint`. Events are POSTed to `POST /api/v1/cli/events` and marked as non-billable on the backend.
+
+**API key resolution** (checked in this order, never written to `eventra.json`):
+
+1. `EVENTRA_API_KEY` environment variable — recommended for CI
+2. `eventra.local.json` (created by `eventra init`/`eventra send`, automatically gitignored)
+3. legacy inline `apiKey` in `eventra.json` (deprecated — avoid committing real keys here)
+
+`eventra.json` is meant to be committed so CI can diff it via `eventra check`; keeping the key out of it avoids leaking it into source control. In a non-interactive shell (no TTY), `send` fails fast with a message pointing at `EVENTRA_API_KEY` instead of hanging on a prompt.
+
+**Endpoint trust.** The default production endpoint is always used with no extra step. A *custom* `endpoint` is only trusted without approval when it comes from the `EVENTRA_ENDPOINT` environment variable (setting an env var is already a local/CI action). A custom `endpoint` committed inline in `eventra.json` is trust-on-first-use: `send` refuses to run until it's approved once with:
+
+```bash
+eventra send --trust-endpoint
+```
+
+This records the endpoint in `eventra.local.json` (gitignored). If `eventra.json`'s `endpoint` later changes to a different value — e.g. a PR silently pointing it at another host — `send` blocks again until re-approved, so a committed config change alone can't redirect where your API key and events get sent.
 
 Network resilience:
 
@@ -224,6 +240,8 @@ External plugins export an object (or factory) with:
 
 No dependency on `@eventra_dev/eventra-cli` is required. See [`ARCHITECTURE.md`](./ARCHITECTURE.md#plugin-kernel-phase-15--foundation-shipped) for details.
 
+**Only official `@eventra_dev/cli-plugin-*` packages can be loaded.** `eventra.json` is meant to be committed to git, so its `plugins` array is effectively PR-editable; since the CLI `import()`s whatever is listed there, an arbitrary specifier would be arbitrary code execution on every machine that runs `sync`/`check`/`watch`. Because `@eventra_dev` is an npm scope only the Eventra maintainers can publish to, restricting to `@eventra_dev/cli-plugin-*` means nothing outside that scope can ever be loaded this way. Any other entry in `plugins` is skipped with a console warning instead of being imported — third-party/community plugins aren't supported today.
+
 ---
 
 ## Configuration
@@ -244,10 +262,14 @@ No dependency on `@eventra_dev/eventra-cli` is required. See [`ARCHITECTURE.md`]
 
 | Field | Description |
 |-------|-------------|
-| `plugins` | Module specifiers to `import()` at startup (e.g. `@eventra_dev/cli-plugin-vue`) |
+| `apiKey` | Legacy inline API key — leave empty. Use `EVENTRA_API_KEY` or `eventra.local.json` instead (see [`eventra send`](#eventra-send)) so a real key never ends up in this committed file |
+| `endpoint` | Custom `eventra send` target (e.g. self-hosted). Non-default values from this file need one-time local approval — see [`eventra send`](#eventra-send) |
+| `plugins` | `@eventra_dev/cli-plugin-*` specifiers to `import()` at startup. Anything outside that scope is skipped (see [Plugin contract](#plugin-contract-for-authors)) |
 | `sync.include` | Base glob patterns; plugin `includeGlobs` are merged automatically |
 | `sync.exclude` | Paths skipped during scan |
 
+`eventra init`/`eventra send` never write a real key into this file — they write to `eventra.local.json` instead, which is automatically added to `.gitignore`.
+
 ---
 
 ## How it works
@@ -275,7 +297,7 @@ No runtime execution. No monkey-patching.
 
 ## Test Coverage
 
-Two test layers, **59 unit tests + 12 e2e fixtures + 3 `check` exit-code scenarios**.
+Two test layers, **74 unit tests + 12 e2e fixtures + 3 `check` exit-code scenarios**.
 
 **Unit tests (vitest)** — 13 suites covering core modules:
 
@@ -322,6 +344,8 @@ pnpm --filter @eventra_dev/eventra-cli test:unit  # vitest only
 pnpm --filter @eventra_dev/eventra-cli test:e2e   # fixtures + check exit codes
 ```
 
+> **Node version note:** the CLI itself supports Node 18+ (see `engines`), but `vitest@4` depends on `node:util`'s `styleText`, which requires Node **≥ 20.12** — running the test suite on an older Node 20.x patch (or Node 18) fails to start. CI runs the matrix on Node 20 and 22; locally, use the version pinned in the repo's `.nvmrc`.
+
 ---
 
 ## License

package/dist/analysis/extractor/extractor.js

@@ -9,8 +9,10 @@ const resolver_1 = require("../resolver/resolver");
 const evaluationContext_1 = require("../shared/evaluationContext");
 const propagationExtractor_1 = require("./propagationExtractor");
 const eventValidation_1 = require("../shared/eventValidation");
+const dynamicOccurrence_1 = require("../shared/dynamicOccurrence");
 function extractEvents(index, checker, _config, evaluationCache, exportCache, resolvedCallCache, returnPropagationCache, wrapperRegistry) {
     const events = new Set();
+    const dynamicOccurrences = [];
     // direct track sinks
     for (const call of index.trackCalls) {
         for (const argument of call.trackedArguments) {
@@ -21,12 +23,15 @@ function extractEvents(index, checker, _config, evaluationCache, exportCache, re
                     events.add(normalized);
                 }
             }
+            if (resolved.dynamic) {
+                (0, dynamicOccurrence_1.recordDynamicOccurrence)(call.node, resolved.values, dynamicOccurrences);
+            }
         }
     }
     const propagationVisited = new Set();
     function visit(node) {
         if (typescript_1.default.isCallExpression(node)) {
-            (0, propagationExtractor_1.extractPropagationEvents)(node, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, propagationVisited);
+            (0, propagationExtractor_1.extractPropagationEvents)(node, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, propagationVisited, dynamicOccurrences);
         }
         typescript_1.default.forEachChild(node, visit);
     }
@@ -34,5 +39,6 @@ function extractEvents(index, checker, _config, evaluationCache, exportCache, re
     return {
         events,
         detectedFunctionWrappers: new Set(index.wrappers.map(wrapper => wrapper.symbol.getName())),
+        dynamicOccurrences,
     };
 }

package/dist/analysis/extractor/propagationExtractor.js

@@ -9,6 +9,7 @@ const callResolver_1 = require("../resolver/callResolver");
 const resolver_1 = require("../resolver/resolver");
 const evaluationContext_1 = require("../shared/evaluationContext");
 const eventValidation_1 = require("../shared/eventValidation");
+const dynamicOccurrence_1 = require("../shared/dynamicOccurrence");
 function resolveObjectPath(expression, path) {
     let current = expression;
     for (const segment of path) {
@@ -34,7 +35,7 @@ function resolveObjectPath(expression, path) {
     }
     return current;
 }
-function extractPropagationEvents(call, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, visited) {
+function extractPropagationEvents(call, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, visited, dynamicOccurrences) {
     const resolved = (0, callResolver_1.resolveFunctionFromCall)(call.expression, checker, resolvedCallCache, exportCache);
     if (!resolved) {
         return;
@@ -53,14 +54,14 @@ function extractPropagationEvents(call, checker, wrapperRegistry, resolvedCallCa
     visited.add(signature);
     try {
         for (const propagation of semantic.propagations) {
-            extractPropagation(propagation, call, checker, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache, events);
+            extractPropagation(propagation, call, checker, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache, events, dynamicOccurrences);
         }
     }
     finally {
         visited.delete(signature);
     }
 }
-function extractPropagation(propagation, call, checker, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache, events) {
+function extractPropagation(propagation, call, checker, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache, events, dynamicOccurrences) {
     let argument = call.arguments[propagation.sourceParameterIndex];
     if (!argument) {
         return;
@@ -89,4 +90,7 @@ function extractPropagation(propagation, call, checker, evaluationCache, resolve
             events.add(normalized);
         }
     }
+    if (resolved.dynamic) {
+        (0, dynamicOccurrence_1.recordDynamicOccurrence)(call, resolved.values, dynamicOccurrences);
+    }
 }

package/dist/analysis/scanner/scanner.js

@@ -72,7 +72,8 @@ function scanSource(source, checker, wrapperRegistry, plugins) {
             }
             return false;
         });
-        const wrapper = (0, propagationAnalyzer_1.analyzeWrapperPropagation)(fn, checker, localSinks);
+        const wrapper = plugins.detectWrapper({ fn, checker, sinks: localSinks }) ??
+            (0, propagationAnalyzer_1.analyzeWrapperPropagation)(fn, checker, localSinks);
         if (!wrapper) {
             continue;
         }

package/dist/analysis/shared/dynamicOccurrence.js

@@ -0,0 +1,22 @@
+"use strict";
+// src/analysis/shared/dynamicOccurrence.ts
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordDynamicOccurrence = recordDynamicOccurrence;
+const typescript_1 = __importDefault(require("typescript"));
+const CALL_TEXT_MAX_LENGTH = 120;
+function recordDynamicOccurrence(call, resolvedValues, out) {
+    const sourceFile = call.getSourceFile();
+    const { line, character } = typescript_1.default.getLineAndCharacterOfPosition(sourceFile, call.getStart(sourceFile));
+    const callText = call.getText(sourceFile);
+    out.push({
+        fileName: sourceFile.fileName,
+        line: line + 1,
+        character,
+        calleeText: call.expression.getText(sourceFile),
+        callText: callText.length > CALL_TEXT_MAX_LENGTH ? `${callText.slice(0, CALL_TEXT_MAX_LENGTH)}…` : callText,
+        resolvedValues,
+    });
+}

package/dist/cli/check.js

@@ -21,7 +21,8 @@ async function check({ fix = false }) {
         process.exit(1);
     }
     console.log(chalk_1.default.blue("Checking events and function wrappers..."));
-    const { engine } = await (0, projectScanner_1.scanProject)(config);
+    const { engine, plugins } = await (0, projectScanner_1.scanProject)(config);
+    await plugins.runDynamicEventReporters(engine.getAllDynamicOccurrences());
     const foundEvents = new Set(engine.getAllEvents());
     const knownEvents = new Set(config.events ?? []);
     const eventDiff = diffSets(foundEvents, knownEvents);

package/dist/cli/init.js

@@ -29,7 +29,7 @@ async function init() {
     console.log(chalk_1.default.gray("• cross-file propagation chains"));
     console.log("");
     const config = {
-        apiKey,
+        apiKey: "",
         endpoint,
         events: [],
         functionWrappers: [],
@@ -47,6 +47,12 @@ async function init() {
     };
     await (0, config_1.saveConfig)(config);
     console.log(chalk_1.default.green("eventra.json created"));
+    // Never write the key into eventra.json — that file is meant to be
+    // committed (CI diffs it via `eventra check`). Keep secrets out of git.
+    if (apiKey) {
+        await (0, config_1.saveLocalApiKey)(apiKey);
+        console.log(chalk_1.default.green("API key saved to eventra.local.json (added to .gitignore)"));
+    }
     console.log("");
     console.log(chalk_1.default.gray("Run `eventra sync`"));
 }

package/dist/cli/send.js

@@ -9,6 +9,8 @@ const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("../config/config");
 const package_json_1 = __importDefault(require("../../package.json"));
 const CLI_VERSION = package_json_1.default.version;
+// Always trusted, no local approval needed — matches `eventra init`'s prompt default.
+const DEFAULT_SEND_ENDPOINT = "https://api.eventra.dev/api/v1/cli/events";
 // retry/backoff tuning (mirrors SDK defaults)
 const MAX_ATTEMPTS = 4;
 const BASE_DELAY_MS = 500;
@@ -56,16 +58,40 @@ async function attemptDelivery(endpoint, apiKey, payload) {
         clearTimeout(timeout);
     }
 }
-async function send() {
+async function send(opts = {}) {
     const config = await (0, config_1.loadConfig)();
-    const endpoint = config?.endpoint || process.env.EVENTRA_ENDPOINT;
     if (!config) {
         console.log(chalk_1.default.red("eventra.json not found. Run 'eventra init'"));
         return;
     }
-    let apiKey = config.apiKey;
-    // ask api key
+    const endpoint = config.endpoint || process.env.EVENTRA_ENDPOINT || undefined;
+    // A non-default endpoint sourced from the committed eventra.json (not from
+    // EVENTRA_ENDPOINT, which already requires a local/CI env-var change) needs
+    // one-time local approval — otherwise a PR silently editing `endpoint` could
+    // redirect send (and the API key) to an attacker's server.
+    if (endpoint &&
+        endpoint !== DEFAULT_SEND_ENDPOINT &&
+        endpoint === config.endpoint &&
+        !process.env.EVENTRA_ENDPOINT) {
+        const trusted = await (0, config_1.getTrustedEndpoint)();
+        if (endpoint !== trusted) {
+            if (!opts.trustEndpoint) {
+                console.log(chalk_1.default.red(`Endpoint "${endpoint}" from eventra.json is not locally approved.`));
+                console.log(chalk_1.default.gray("If this is expected (e.g. a self-hosted ingest URL), approve it once with:"));
+                console.log(chalk_1.default.gray("  eventra send --trust-endpoint"));
+                return;
+            }
+            await (0, config_1.trustEndpoint)(endpoint);
+            console.log(chalk_1.default.green(`Endpoint "${endpoint}" approved and saved to eventra.local.json`));
+        }
+    }
+    let apiKey = await (0, config_1.resolveApiKey)(config);
+    // ask for the key only when interactive — never hang a CI/non-TTY run on a prompt
     if (!apiKey) {
+        if (!process.stdin.isTTY) {
+            console.log(chalk_1.default.red("API key required. Set the EVENTRA_API_KEY environment variable (recommended for CI) or run 'eventra init'."));
+            return;
+        }
         const answers = await inquirer_1.default.prompt([
             {
                 type: "input",
@@ -74,11 +100,12 @@ async function send() {
             }
         ]);
         apiKey = answers.apiKey;
-        await (0, config_1.saveConfig)({
-            ...config,
-            apiKey,
-        });
-        console.log(chalk_1.default.green("API key saved"));
+        if (apiKey) {
+            // Saved to the gitignored local secrets file, never to eventra.json —
+            // that file is meant to be committed for `eventra check` drift detection.
+            await (0, config_1.saveLocalApiKey)(apiKey);
+            console.log(chalk_1.default.green("API key saved to eventra.local.json (added to .gitignore)"));
+        }
     }
     // no events
     if (!config.events?.length) {

package/dist/cli/sync.js

@@ -15,9 +15,10 @@ async function sync() {
         return;
     }
     console.log(chalk_1.default.blue("Scanning..."));
-    const { engine } = await (0, projectScanner_1.scanProject)(config);
+    const { engine, plugins } = await (0, projectScanner_1.scanProject)(config);
     await (0, scanResults_1.persistScanResults)(config, engine);
     const events = engine.getAllEvents();
     const wrappers = engine.getAllFunctionWrappers();
     console.log(chalk_1.default.green(`Found ${events.length} events, ${wrappers.length} function wrappers`));
+    await plugins.runDynamicEventReporters(engine.getAllDynamicOccurrences());
 }

package/dist/config/config.js

@@ -3,13 +3,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_NAME = void 0;
+exports.LOCAL_CONFIG_NAME = exports.CONFIG_NAME = void 0;
 exports.normalizeConfig = normalizeConfig;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
+exports.resolveApiKey = resolveApiKey;
+exports.saveLocalApiKey = saveLocalApiKey;
+exports.getTrustedEndpoint = getTrustedEndpoint;
+exports.trustEndpoint = trustEndpoint;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 exports.CONFIG_NAME = "eventra.json";
+/**
+ * Secrets live here instead of `eventra.json`, since the latter is meant to be
+ * committed (CI diffs `events`/`functionWrappers` against it via `eventra check`).
+ */
+exports.LOCAL_CONFIG_NAME = "eventra.local.json";
 const DEFAULT_INCLUDE = ["**/*.{ts,tsx,js,jsx}"];
 const DEFAULT_EXCLUDE = ["node_modules", "dist", ".next", ".git"];
 function normalizeConfig(config) {
@@ -52,3 +61,74 @@ async function saveConfig(config) {
     const configPath = path_1.default.join(process.cwd(), exports.CONFIG_NAME);
     await fs_extra_1.default.writeJSON(configPath, normalizeConfig(config), { spaces: 2 });
 }
+async function readLocalSecrets() {
+    const localPath = path_1.default.join(process.cwd(), exports.LOCAL_CONFIG_NAME);
+    if (!(await fs_extra_1.default.pathExists(localPath)))
+        return {};
+    try {
+        const parsed = await fs_extra_1.default.readJSON(localPath);
+        return {
+            apiKey: typeof parsed?.apiKey === "string" && parsed.apiKey ? parsed.apiKey : undefined,
+            trustedEndpoint: typeof parsed?.trustedEndpoint === "string" && parsed.trustedEndpoint
+                ? parsed.trustedEndpoint
+                : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+async function writeLocalSecrets(patch) {
+    const localPath = path_1.default.join(process.cwd(), exports.LOCAL_CONFIG_NAME);
+    const next = { ...(await readLocalSecrets()), ...patch };
+    const out = {};
+    if (next.apiKey)
+        out.apiKey = next.apiKey;
+    if (next.trustedEndpoint)
+        out.trustedEndpoint = next.trustedEndpoint;
+    await fs_extra_1.default.writeJSON(localPath, out, { spaces: 2 });
+    await ensureGitignored(exports.LOCAL_CONFIG_NAME);
+}
+async function ensureGitignored(entry) {
+    const gitignorePath = path_1.default.join(process.cwd(), ".gitignore");
+    let content = "";
+    if (await fs_extra_1.default.pathExists(gitignorePath)) {
+        content = await fs_extra_1.default.readFile(gitignorePath, "utf8");
+        if (content.split(/\r?\n/).some((line) => line.trim() === entry))
+            return;
+    }
+    const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+    await fs_extra_1.default.appendFile(gitignorePath, `${needsLeadingNewline ? "\n" : ""}${entry}\n`);
+}
+/**
+ * Resolves the API key for outbound requests only — never persisted back onto
+ * the `EventraConfig` object, so it can't leak into `eventra.json` via `saveConfig`.
+ * Priority: `EVENTRA_API_KEY` env var > `eventra.local.json` (gitignored) >
+ * legacy inline `apiKey` in `eventra.json` (kept for backward compatibility only).
+ */
+async function resolveApiKey(config) {
+    if (process.env.EVENTRA_API_KEY)
+        return process.env.EVENTRA_API_KEY;
+    const { apiKey } = await readLocalSecrets();
+    if (apiKey)
+        return apiKey;
+    return config.apiKey || undefined;
+}
+/** Persists an API key to the gitignored local secrets file, never to `eventra.json`. */
+async function saveLocalApiKey(apiKey) {
+    await writeLocalSecrets({ apiKey });
+}
+/**
+ * The `endpoint` a locally-run `eventra send` last approved, trust-on-first-use
+ * style — a non-default `endpoint` sourced from the *committed* `eventra.json`
+ * must match this before it's used, so a PR silently changing it can't redirect
+ * `send` (and the API key with it) without a human approving it locally once.
+ */
+async function getTrustedEndpoint() {
+    const { trustedEndpoint } = await readLocalSecrets();
+    return trustedEndpoint;
+}
+/** Records `endpoint` as locally approved (see `getTrustedEndpoint`). */
+async function trustEndpoint(endpoint) {
+    await writeLocalSecrets({ trustedEndpoint: endpoint });
+}

package/dist/core/EventraEngine.js

@@ -20,6 +20,7 @@ const loadPlugins_1 = require("../plugin/loadPlugins");
 const EMPTY_RESULT = () => ({
     events: new Set(),
     detectedFunctionWrappers: new Set(),
+    dynamicOccurrences: [],
 });
 class EventraEngine {
     compiler;
@@ -253,5 +254,12 @@ class EventraEngine {
     getScanResult(fileName) {
         return this.fileResults.get(this.normalize(fileName)) ?? EMPTY_RESULT();
     }
+    getAllDynamicOccurrences() {
+        const occurrences = [];
+        for (const result of this.fileResults.values()) {
+            occurrences.push(...result.dynamicOccurrences);
+        }
+        return occurrences.sort((a, b) => a.fileName.localeCompare(b.fileName) || a.line - b.line);
+    }
 }
 exports.EventraEngine = EventraEngine;

package/dist/core/projectScanner.js

@@ -76,5 +76,6 @@ async function scanProject(config) {
         engine,
         results,
         files,
+        plugins,
     };
 }

package/dist/index.js

@@ -72,8 +72,9 @@ program
 });
 program
     .command("send")
-    .action(async () => {
+    .option("--trust-endpoint", "approve the current eventra.json endpoint for local use")
+    .action(async (opts) => {
     const { send } = await Promise.resolve().then(() => __importStar(require("./cli/send")));
-    await send();
+    await send({ trustEndpoint: opts.trustEndpoint });
 });
 program.parse();

package/dist/plugin/builtins/consoleDynamicEventReporter.js

@@ -0,0 +1,24 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerConsoleDynamicEventReporterPlugin = registerConsoleDynamicEventReporterPlugin;
+const chalk_1 = __importDefault(require("chalk"));
+const consoleDynamicEventReporter = {
+    name: "console",
+    report({ occurrences }) {
+        if (occurrences.length === 0) {
+            return;
+        }
+        console.log(chalk_1.default.blue("\nDynamic event names:"));
+        for (const occ of occurrences) {
+            const values = occ.resolvedValues.length > 0 ? ` (resolved: ${occ.resolvedValues.join(", ")})` : "";
+            console.log(chalk_1.default.yellow(`~ ${occ.fileName}:${occ.line} ${occ.calleeText}(...)${values}`));
+        }
+    },
+};
+/** Default reporter: prints unresolved/dynamic event-name call sites to the console (always enabled). */
+function registerConsoleDynamicEventReporterPlugin(registry) {
+    registry.registerDynamicEventReporter(consoleDynamicEventReporter);
+}

package/dist/plugin/loadPlugins.js

@@ -33,11 +33,25 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTrustedPluginSpecifier = isTrustedPluginSpecifier;
 exports.createBuiltinPluginRegistry = createBuiltinPluginRegistry;
 exports.createPluginRegistry = createPluginRegistry;
 const external_1 = require("./adapters/external");
 const eventra_sdk_1 = require("./builtins/eventra-sdk");
+const consoleDynamicEventReporter_1 = require("./builtins/consoleDynamicEventReporter");
 const registry_1 = require("./registry");
+/**
+ * Only packages published under the `@eventra_dev` npm scope can ever be
+ * `import()`-ed as a plugin. `eventra.json` (and its `plugins` array) is meant
+ * to be committed to git, so anything else listed there is attacker-editable
+ * via a plain PR — restricting to a scope only the maintainers can publish to
+ * turns "arbitrary code execution via a one-line JSON edit" into "not possible
+ * without also compromising the @eventra_dev npm account."
+ */
+const TRUSTED_PLUGIN_RE = /^@eventra_dev\/cli-plugin-[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isTrustedPluginSpecifier(spec) {
+    return TRUSTED_PLUGIN_RE.test(spec);
+}
 async function resolvePluginExport(mod) {
     let candidate = mod.default ?? mod;
     if (typeof candidate === "function") {
@@ -76,13 +90,21 @@ async function loadExternalPlugin(registry, spec) {
 function createBuiltinPluginRegistry() {
     const registry = new registry_1.PluginRegistry();
     (0, eventra_sdk_1.registerEventraSdkPlugin)(registry);
+    (0, consoleDynamicEventReporter_1.registerConsoleDynamicEventReporterPlugin)(registry);
     return registry;
 }
 /** Built-ins + plugins listed in eventra.json `plugins` array. */
 async function createPluginRegistry(config) {
     const registry = createBuiltinPluginRegistry();
     for (const spec of config.plugins ?? []) {
-        await loadExternalPlugin(registry, spec);
+        const trimmed = spec.trim();
+        if (!trimmed)
+            continue;
+        if (!isTrustedPluginSpecifier(trimmed)) {
+            console.warn(`Eventra: skipping plugin "${trimmed}" — only official @eventra_dev/cli-plugin-* packages can be loaded.${pluginLoadHint(trimmed)}`);
+            continue;
+        }
+        await loadExternalPlugin(registry, trimmed);
     }
     return registry;
 }

package/dist/plugin/registry.js

@@ -8,6 +8,8 @@ const path_1 = __importDefault(require("path"));
 class PluginRegistry {
     preprocessors = [];
     sinkDetectors = [];
+    wrapperDetectors = [];
+    dynamicEventReporters = [];
     includePatterns = [];
     sourceToVirtuals = new Map();
     registerFilePreprocessor(preprocessor) {
@@ -22,6 +24,18 @@ class PluginRegistry {
         }
         this.sinkDetectors.push(detector);
     }
+    registerWrapperDetector(detector) {
+        if (this.wrapperDetectors.some((d) => d.name === detector.name)) {
+            throw new Error(`Wrapper detector already registered: ${detector.name}`);
+        }
+        this.wrapperDetectors.push(detector);
+    }
+    registerDynamicEventReporter(reporter) {
+        if (this.dynamicEventReporters.some((r) => r.name === reporter.name)) {
+            throw new Error(`Dynamic event reporter already registered: ${reporter.name}`);
+        }
+        this.dynamicEventReporters.push(reporter);
+    }
     registerIncludePattern(pattern) {
         const trimmed = pattern.trim();
         if (!trimmed)
@@ -36,6 +50,12 @@ class PluginRegistry {
     getSinkDetectors() {
         return this.sinkDetectors;
     }
+    getWrapperDetectors() {
+        return this.wrapperDetectors;
+    }
+    getDynamicEventReporters() {
+        return this.dynamicEventReporters;
+    }
     getFilePreprocessors() {
         return this.preprocessors;
     }
@@ -71,6 +91,20 @@ class PluginRegistry {
         }
         return null;
     }
+    detectWrapper(context) {
+        for (const detector of this.wrapperDetectors) {
+            const wrapper = detector.detect(context);
+            if (wrapper) {
+                return wrapper;
+            }
+        }
+        return null;
+    }
+    async runDynamicEventReporters(occurrences) {
+        for (const reporter of this.dynamicEventReporters) {
+            await reporter.report({ occurrences });
+        }
+    }
     normalizePath(fileName) {
         return path_1.default.resolve(fileName).replace(/\\/g, "/");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventra_dev/eventra-cli",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Static analytics event extraction CLI powered by the TypeScript compiler API",
   "license": "MIT",
   "type": "commonjs",