@eventra_dev/eventra-cli 2.0.9 → 2.1.0

package/LICENSE

@@ -1,9 +1,21 @@
 MIT License
 
-Copyright (c) 2026 Eventra
+Copyright (c) 2026 and-1991
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software.
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -8,8 +8,8 @@
   <a href="https://www.npmjs.com/package/@eventra_dev/eventra-cli"><img alt="npm version" src="https://img.shields.io/npm/v/@eventra_dev/eventra-cli.svg?style=flat-square&color=blue"></a>
   <a href="https://www.npmjs.com/package/@eventra_dev/eventra-cli"><img alt="npm downloads" src="https://img.shields.io/npm/dm/@eventra_dev/eventra-cli.svg?style=flat-square&color=blue"></a>
   <a href="https://github.com/and-1991/eventra-cli/actions/workflows/test.yml"><img alt="tests" src="https://img.shields.io/github/actions/workflow/status/and-1991/eventra-cli/test.yml?branch=main&label=tests&style=flat-square&logo=vitest&logoColor=white"></a>
-  <img alt="unit tests" src="https://img.shields.io/badge/unit-445%20passing-brightgreen?style=flat-square&logo=vitest&logoColor=white">
-  <img alt="e2e fixtures" src="https://img.shields.io/badge/e2e-12%20fixtures-brightgreen?style=flat-square">
+  <img alt="unit tests" src="https://img.shields.io/badge/unit-665%20passing-brightgreen?style=flat-square&logo=vitest&logoColor=white">
+  <img alt="e2e fixtures" src="https://img.shields.io/badge/e2e-14%20fixtures-brightgreen?style=flat-square">
   <img alt="coverage" src="https://img.shields.io/badge/coverage-100%25%20(unit)-brightgreen?style=flat-square&logo=vitest&logoColor=white">
   <img alt="node" src="https://img.shields.io/node/v/@eventra_dev/eventra-cli?style=flat-square&color=darkgreen&logo=node.js&logoColor=white">
   <a href="https://www.typescriptlang.org/"><img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-ready-blue?style=flat-square&logo=typescript&logoColor=white"></a>
@@ -24,7 +24,7 @@ Eventra CLI statically discovers analytics events from [**@eventra_dev/eventra-s
 
 The CLI scans TypeScript and JavaScript with the TypeScript compiler API and extracts **only** calls to `Eventra.prototype.track()` on instances of `Eventra` imported from `@eventra_dev/eventra-sdk`.
 
-It does **not** detect generic `track()`, Segment, Google Analytics, or other libraries out of the box. Framework files (e.g. `.vue`, `.svelte`, `.astro`, Angular's `.html` templates) require an optional [plugin](#plugins).
+It does **not** detect generic `track()`, Segment, Google Analytics, or other libraries out of the box - but you can opt in to a third-party library with [`sinks`](#third-party-analytics-sinks) (PostHog, Segment, Amplitude and Google Analytics 4 have built-in presets). Framework files (e.g. `.vue`, `.svelte`, `.astro`, Angular's `.html` templates) require an optional [plugin](#plugins).
 
 ---
 
@@ -121,12 +121,51 @@ trackFeature("purchase");
 
 ---
 
+## Third-party analytics (`sinks`)
+
+Already have analytics in place? Declare it in `eventra.json` and the CLI treats its calls as event sources too, with no SDK swap. Wrappers, constants, cross-file imports and JSX component props resolve exactly as they do for the Eventra SDK.
+
+```json
+{
+  "sinks": [
+    { "preset": "posthog" },
+    { "preset": "segment" },
+    { "preset": "amplitude" },
+    { "preset": "ga4" },
+    { "callee": "analytics.track" },
+    { "callee": "gtag", "nameArg": 1, "when": { "arg": 0, "equals": "event" } }
+  ]
+}
+```
+
+| Field | Meaning |
+|-------|---------|
+| `preset` | A built-in rule set: `posthog`, `segment`, `amplitude` or `ga4` (see below) |
+| `callee` | Dotted call path, matched as a suffix: `analytics.track` also matches `this.analytics.track`, but not `myanalytics.track` |
+| `nameArg` | Zero-based index of the event-name argument (default `0`) |
+| `nameProperty` | If that argument is an object literal, read the name from this property (e.g. `event`) |
+| `modules` | Only match when the receiver comes from one of these npm packages (imported, re-exported, typed, or built from them) |
+| `when` | Only match when the argument at `arg` is the string literal `equals`, e.g. `{ "arg": 0, "equals": "event" }` for `gtag("event", name)` |
+
+| Preset | Detects |
+|--------|---------|
+| `posthog` | `posthog.capture("x")`, the `usePostHog()` hook (from `posthog-js/react` or `@posthog/react`) under any variable name (also through re-exports like `export { usePostHog as useAnalytics }`), and posthog-node's `client.capture({ distinctId, event: "x" })`, including typed class fields |
+| `segment` | `analytics.track("x", props)` (analytics.js, `window.analytics`), analytics-node's `client.track({ userId, event: "x" })`, and clients from `@segment/analytics-next`, `@segment/analytics-node`, `@segment/analytics-react-native` or `analytics-node` under any variable name, including `const [analytics] = await AnalyticsBrowser.load(...)` |
+| `amplitude` | `amplitude.track("x")`, `amplitude.track({ event_type: "x" })`, `amplitude.logEvent("x")`, `amplitude.getInstance().logEvent("x")`, and clients from the `@amplitude/*` browser, node, react-native and unified packages or `amplitude-js` |
+| `ga4` | `gtag("event", "x", params)` (also `window.gtag` and nuxt-gtag's `const { gtag } = useGtag()`), `sendGAEvent("event", "x", params)` from `@next/third-parties`, nuxt-gtag's `useTrackEvent("x")`, vue-gtag's `this.$gtag.event("x")` and `event("x")` / `const { event } = useGtag()`, and react-ga4's `ReactGA.event("x")` / `ReactGA.event({ category, action: "x" })`. Other gtag commands (`gtag("config", id)`, `gtag("set", ...)`) are not events and are ignored |
+
+Rules are plain data and never run code, so they are safe to commit. A rule with a typo, an invalid `when` or an unknown preset is skipped with a warning. A function with its own name (`trackEvent({ event: "x" })`) is not covered by a preset: add a rule such as `{ "callee": "trackEvent", "nameProperty": "event" }`.
+
+The [name rules](#event-name-rules-aligned-with-sdk) below apply to these events too. Spaces and colons are allowed, so names like `App: User Sign Up` or `Order Completed` are kept as written. Names with other characters, such as PostHog's `$`-prefixed system events (`$pageview`) or a name ending in `!`, are excluded from the scan result.
+
+---
+
 ## Event name rules (aligned with SDK)
 
 | Rule | Limit |
 |------|--------|
 | Max length | **64 characters** (same as SDK) |
-| Allowed characters | `a-zA-Z0-9:_./-` |
+| Allowed characters | `a-zA-Z0-9:_./-` and the space (so `App: User Sign Up` works); tabs, newlines and any other character are rejected |
 | Position | First argument of `.track(name, options?)` |
 
 The second argument (`userId`, `properties`) is **not** used as the event name.
@@ -137,8 +176,10 @@ A literal name that violates either rule (too long, or a character outside the a
 
 ## What is ignored
 
+By default only the Eventra SDK is read. Calls to other analytics are ignored unless you enable them with [`sinks`](#third-party-analytics-sinks).
+
 ```ts
-// Not from @eventra_dev/eventra-sdk
+// Not from @eventra_dev/eventra-sdk (and no matching `sinks` rule)
 track("legacy");
 analytics.track("ga");
 segment.track("x");
@@ -151,6 +192,28 @@ tracker.track({ event: "click" });
 
 ## Commands
 
+### `eventra init`
+
+Creates `eventra.json`. It asks for an API key and an endpoint, then looks through `package.json` (and the `package.json` of every workspace member in a monorepo: `workspaces` or `pnpm-workspace.yaml`) for analytics libraries:
+
+```
+Found analytics in package.json: posthog-js; @segment/analytics-next
+? Also read events from these analytics calls (sinks):
+❯◉ posthog (posthog-js)
+ ◉ segment (@segment/analytics-next)
+```
+
+Everything found is pre-selected; press Enter to accept or untick what you do not want. The chosen presets are written to `sinks` in `eventra.json`. Recognised packages:
+
+| Preset | Packages |
+|--------|----------|
+| `posthog` | `posthog-js`, `@posthog/react`, `posthog-js-lite`, `posthog-node`, `posthog-react-native` |
+| `segment` | `@segment/analytics-next`, `@segment/analytics-node`, `@segment/analytics-react-native`, `@segment/snippet`, and the older `analytics-node`, `@segment/analytics.js-core` |
+| `amplitude` | `@amplitude/analytics-browser`, `@amplitude/analytics-node`, `@amplitude/analytics-react-native`, `@amplitude/unified`, `@amplitude/marketing-analytics-browser`, and the older `amplitude-js` |
+| `ga4` | `react-ga4`, `vue-gtag`, `@next/third-parties`, `nuxt-gtag`, `@types/gtag.js`, and the older `vue-gtag-next` |
+
+Detection reads dependencies only. A tag pasted straight into the HTML (a Segment or `gtag.js` snippet with no package) is not seen: add the preset to `sinks` yourself. In a monorepo only the block-list form of `packages:` in `pnpm-workspace.yaml` is understood (not `packages: [a, b]`), and workspace patterns that are absolute or contain `..` are ignored. Running `init` again rewrites `eventra.json`.
+
 ### `eventra sync`
 
 Full project scan → updates `eventra.json`:
@@ -338,6 +401,7 @@ No dependency on `@eventra_dev/eventra-cli` is required — the host CLI loads t
   "events": [],
   "functionWrappers": [],
   "plugins": [],
+  "sinks": [],
   "sync": {
     "include": ["**/*.{ts,tsx,js,jsx}"],
     "exclude": ["node_modules", "dist", ".next", ".git"]
@@ -350,6 +414,7 @@ No dependency on `@eventra_dev/eventra-cli` is required — the host CLI loads t
 | `apiKey` | Legacy inline API key — leave empty. Use `EVENTRA_API_KEY` or `eventra.local.json` instead (see [`eventra send`](#eventra-send)) so a real key never ends up in this committed file |
 | `endpoint` | Custom `eventra send` target (e.g. self-hosted). Non-default values from this file need one-time local approval — see [`eventra send`](#eventra-send) |
 | `plugins` | `@eventra_dev/cli-plugin-*` specifiers to `import()` at startup. Anything outside that scope is skipped (see [Plugin contract](#plugin-contract-for-authors)) |
+| `sinks` | Third-party analytics calls to treat as event sources, e.g. `[{ "preset": "posthog" }]` (see [Third-party analytics](#third-party-analytics-sinks)) |
 | `sync.include` | Base glob patterns; plugin `includeGlobs` are merged automatically |
 | `sync.exclude` | Paths skipped during scan |
 
@@ -382,11 +447,11 @@ No runtime execution. No monkey-patching.
 
 ## Test Coverage
 
-Two test layers, **445 unit tests + 12 e2e fixtures + 3 `check` exit-code scenarios + 1 `watch` scenario**.
+Two test layers, **665 unit tests + 14 e2e fixtures + 3 `check` exit-code scenarios + 1 `watch` scenario**.
 
 **100% statement/branch/function/line coverage** (v8 provider, `pnpm test:coverage`), enforced via a `coverage.thresholds` block in `vitest.config.ts` so a regression fails the build instead of silently slipping under 100%. This measures the vitest unit layer only; the e2e/`check`/`watch` fixtures run against the compiled `dist/` binary via `tsx tests/run.ts` and aren't coverage-instrumented. A handful of genuinely unreachable defensive branches (TS-internal invariants — e.g. an aliased import symbol is always fully resolved before its own declarations are ever inspected — that don't hold a second outcome in practice) are marked with `/* v8 ignore */`, with an inline comment explaining why, rather than tested.
 
-**Unit tests (vitest)** — 39 suites covering core modules:
+**Unit tests (vitest)** - 47 suites covering core modules:
 
 | Module | Covers |
 |---|---|
@@ -407,12 +472,18 @@ Two test layers, **445 unit tests + 12 e2e fixtures + 3 `check` exit-code scenar
 | `cross-file SDK detection` | Direct `.track()` and wrapper calls resolve across files even when the call-site file never imports the SDK package itself |
 | `dynamic event reporter` | Dynamic vs. static call classification, end-to-end `registerDynamicEventReporter` invocation |
 | `load plugins` | Trusted-specifier allowlist (`^@eventra_dev/cli-plugin-[a-z0-9-]+$`), accepted/rejected plugin shapes |
-| `Nuxt auto-import compatibility` | Ambient `declare const x: typeof import(...)` shape resolution — a hand-written fixture, not a real `nuxt build` |
+| `Nuxt auto-import compatibility` | Ambient `declare const x: typeof import(...)` shape resolution - a hand-written fixture; a real `nuxt prepare` project was also verified manually, but that check is not automated |
 | `property propagation` | Direct/optional/nested property access, destructured/aliased/nested-destructured params, element access, enum member access (same-file and cross-file), wrapper detection surviving a cast/non-null assertion, and direct object-literal payloads to `track()` staying ignored (including when cast) |
 | `send()` | Endpoint trust-on-first-use (TOFU): default-trusted, blocked-until-approved, approve-then-persists, re-block-on-change, env-var-bypasses-approval |
 | `wrapper detector plugin` | A custom `WrapperDetector` (e.g. a template-literal wrapper shape the built-in analyzer can't cover) alongside the built-in fallback |
+| `configured sinks` | `sinks` rules and the PostHog, Segment, Amplitude and GA4 presets: every call shape, receivers traced through imports, re-exports, hooks, typed fields and aliases, the `when` guard, spaced names, wrong-typed config, circular chains |
+| `sink presets` | The package table behind the presets: detection per package, order, legacy and detect-only flags, rules vetted only against their own preset's packages |
+| `project dependencies` | package.json and workspace reading for `eventra init` (`workspaces`, pnpm-workspace.yaml, negations, caps, patterns that leave the project, unreadable files) |
+| `init` | `eventra init` prompts, pre-selected presets, written config, exact console output, API key kept out of `eventra.json` |
+| `preset package check` | The registry verdicts behind `pnpm check:presets` (missing, deprecated, stale, legacy) |
+| `license` | `LICENSE` is the complete MIT text, its holder is the package author, and both match `package.json` |
 
-**End-to-end fixtures** — 12 isolated TS projects scanned via `eventra sync`:
+**End-to-end fixtures** - 14 isolated TS projects scanned via `eventra sync`:
 
 | Fixture | Covers |
 |---|---|
@@ -423,6 +494,8 @@ Two test layers, **445 unit tests + 12 e2e fixtures + 3 `check` exit-code scenar
 | `wrappers/barrel` | `export * from "./tracker"` re-exports |
 | `wrappers/default-export` | `export default function trackFeature` propagation |
 | `wrappers/path-aliases` | `tsconfig.json` `paths` mapping (`@app/*`) |
+| `sinks/presets` | PostHog, Segment, Amplitude and GA4 side by side, including `gtag("config")` that must not count |
+| `sinks/spaced-names` | Names with spaces and colons through the SDK, PostHog (client and server shapes), a custom rule, wrappers and JSX, plus calls that must be ignored |
 | `watch-incremental` | Engine state across sequential file updates (matches `sync` output) |
 
 **`eventra check` exit-code scenarios:**
@@ -447,4 +520,4 @@ pnpm --filter @eventra_dev/eventra-cli test:e2e   # fixtures + check exit codes
 
 ## License
 
-MIT
+MIT, copyright (c) 2026 [and-1991](https://github.com/and-1991). See [LICENSE](LICENSE).

package/dist/analysis/extractor/extractor.js

@@ -30,7 +30,7 @@ function extractEvents(index, checker, _config, evaluationCache, exportCache, re
     }
     const propagationVisited = new Set();
     function visit(node) {
-        if (typescript_1.default.isCallExpression(node)) {
+        if (typescript_1.default.isCallExpression(node) || typescript_1.default.isJsxOpeningElement(node) || typescript_1.default.isJsxSelfClosingElement(node)) {
             (0, propagationExtractor_1.extractPropagationEvents)(node, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, propagationVisited, dynamicOccurrences);
         }
         typescript_1.default.forEachChild(node, visit);

package/dist/analysis/extractor/propagationExtractor.js

@@ -8,6 +8,7 @@ const typescript_1 = __importDefault(require("typescript"));
 const callResolver_1 = require("../resolver/callResolver");
 const resolver_1 = require("../resolver/resolver");
 const evaluationContext_1 = require("../shared/evaluationContext");
+const symbolUtils_1 = require("../symbols/symbolUtils");
 const eventValidation_1 = require("../shared/eventValidation");
 const dynamicOccurrence_1 = require("../shared/dynamicOccurrence");
 function resolveObjectPath(expression, path) {
@@ -35,8 +36,39 @@ function resolveObjectPath(expression, path) {
     }
     return current;
 }
+/**
+ * A JSX element is a call of its component with one argument: the props object. Rebuilt here as an
+ * object literal from the attributes so the existing call-site machinery (`resolveObjectPath`,
+ * parameter bindings) works unchanged. Spread attributes and children are ignored, and each
+ * attribute value is the original AST node, so symbol resolution still sees real code.
+ */
+function jsxPropsAsObjectLiteral(element) {
+    const properties = [];
+    for (const attribute of element.attributes.properties) {
+        if (!typescript_1.default.isJsxAttribute(attribute) || !typescript_1.default.isIdentifier(attribute.name) || !attribute.initializer) {
+            continue;
+        }
+        const value = typescript_1.default.isJsxExpression(attribute.initializer) ? attribute.initializer.expression : attribute.initializer;
+        if (value && !typescript_1.default.isJsxElement(value) && !typescript_1.default.isJsxSelfClosingElement(value) && !typescript_1.default.isJsxFragment(value)) {
+            properties.push(typescript_1.default.factory.createPropertyAssignment(attribute.name, value));
+        }
+    }
+    return typescript_1.default.factory.createObjectLiteralExpression(properties);
+}
+/** The expression naming the called function/component; null for `<ns:tag>`, which is never a component. */
+function callSiteExpression(site) {
+    if (typescript_1.default.isCallExpression(site)) {
+        return site.expression;
+    }
+    return typescript_1.default.isJsxNamespacedName(site.tagName) ? null : site.tagName;
+}
+function callSiteArgument(site, index) {
+    // A JSX site only reaches here for index 0 (the props object): see the guard in extractPropagationEvents.
+    return typescript_1.default.isCallExpression(site) ? site.arguments[index] : jsxPropsAsObjectLiteral(site);
+}
 function extractPropagationEvents(call, checker, wrapperRegistry, resolvedCallCache, returnPropagationCache, evaluationCache, exportCache, events, visited, dynamicOccurrences) {
-    const resolved = (0, callResolver_1.resolveFunctionFromCall)(call.expression, checker, resolvedCallCache, exportCache);
+    const callee = callSiteExpression(call);
+    const resolved = callee && (0, callResolver_1.resolveFunctionFromCall)(callee, checker, resolvedCallCache, exportCache);
     if (!resolved) {
         return;
     }
@@ -60,6 +92,11 @@ function extractPropagationEvents(call, checker, wrapperRegistry, resolvedCallCa
     visited.add(signature);
     try {
         for (const propagation of semantic.propagations) {
+            // A component only ever receives props (an object), so a propagation that reads the
+            // parameter as a whole (`name` rather than `props.name`) can't be satisfied by a JSX site.
+            if (!typescript_1.default.isCallExpression(call) && (propagation.sourceParameterIndex !== 0 || propagation.propertyPath.length === 0)) {
+                continue;
+            }
             extractPropagation(propagation, call, checker, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache, events, dynamicOccurrences);
         }
     }
@@ -71,11 +108,12 @@ function extractPropagation(propagation, call, checker, evaluationCache, resolve
     // Call site can omit the argument and rely on the parameter's own default
     // value (`function f(event = "x") {}` called as `f()`) - that default is a
     // real static literal, so fall back to it instead of dropping the call site.
-    const argument = call.arguments[propagation.sourceParameterIndex] ?? propagation.sourceParameter.initializer;
+    const argument = callSiteArgument(call, propagation.sourceParameterIndex) ?? propagation.sourceParameter.initializer;
     if (!argument) {
         return;
     }
     const context = (0, evaluationContext_1.createEvaluationContext)();
+    let directTarget;
     if (typescript_1.default.isIdentifier(propagation.sourceParameter.name)) {
         // sourceParameter is a plain identifier (`function f(payload)`), so
         // propagation.targetNode — `payload`, `payload.event`, or any expression
@@ -98,20 +136,30 @@ function extractPropagation(propagation, call, checker, evaluationCache, resolve
         // returns nothing. Narrow to the leaf value ourselves via propertyPath,
         // then bind it to the destructured binding's own symbol (targetNode is
         // that binding's reference, e.g. `event` in `sdk.track(event)`).
-        if (propagation.propertyPath.length === 0 || !typescript_1.default.isIdentifier(propagation.targetNode)) {
+        if (propagation.propertyPath.length === 0) {
             return;
         }
         const resolvedPath = resolveObjectPath(argument, propagation.propertyPath);
         if (!resolvedPath) {
             return;
         }
-        const bindingSymbol = checker.getSymbolAtLocation(propagation.targetNode);
-        if (!bindingSymbol) {
+        if (typescript_1.default.isIdentifier(propagation.targetNode)) {
+            const bindingSymbol = (0, symbolUtils_1.getValueSymbol)(propagation.targetNode, checker);
+            if (!bindingSymbol) {
+                return;
+            }
+            context.parameterBindings.set(bindingSymbol, resolvedPath);
+        }
+        else if (typescript_1.default.isPropertyAccessExpression(propagation.targetNode) || typescript_1.default.isElementAccessExpression(propagation.targetNode)) {
+            // `function f({ analytics }) { track(analytics.name) }`: propertyPath already walks the binding
+            // AND the trailing property access (["analytics", "name"]), so resolvedPath is the leaf value.
+            directTarget = resolvedPath;
+        }
+        else {
             return;
         }
-        context.parameterBindings.set(bindingSymbol, resolvedPath);
     }
-    const resolved = (0, resolver_1.resolveNodeValue)(propagation.targetNode, checker, context, new Set(), evaluationCache, resolvedCallCache, returnPropagationCache, exportCache);
+    const resolved = (0, resolver_1.resolveNodeValue)(directTarget ?? propagation.targetNode, checker, context, new Set(), evaluationCache, resolvedCallCache, returnPropagationCache, exportCache);
     for (const value of resolved.values) {
         const normalized = (0, eventValidation_1.normalizeEventName)(value);
         if (normalized) {
@@ -119,6 +167,6 @@ function extractPropagation(propagation, call, checker, evaluationCache, resolve
         }
     }
     if (resolved.dynamic) {
-        (0, dynamicOccurrence_1.recordDynamicOccurrence)(call, call.expression.getText(), resolved.values, dynamicOccurrences);
+        (0, dynamicOccurrence_1.recordDynamicOccurrence)(call, callSiteExpression(call).getText(), resolved.values, dynamicOccurrences);
     }
 }

package/dist/analysis/resolver/resolver.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveNodeValue = resolveNodeValue;
 const typescript_1 = __importDefault(require("typescript"));
+const symbolUtils_1 = require("../symbols/symbolUtils");
 const exportResolver_1 = require("./exportResolver");
 const returnPropagationAnalyzer_1 = require("../scanner/analyzer/returnPropagationAnalyzer");
 const callResolver_1 = require("./callResolver");
@@ -37,7 +38,7 @@ function concat(left, right) {
 function resolveBoundObjectNode(rawNode, checker, context) {
     const node = (0, utils_1.unwrapExpression)(rawNode);
     if (typescript_1.default.isIdentifier(node)) {
-        const symbol = checker.getSymbolAtLocation(node);
+        const symbol = (0, symbolUtils_1.getValueSymbol)(node, checker);
         if (!symbol || !context.parameterBindings.has(symbol)) {
             return null;
         }
@@ -220,10 +221,12 @@ function resolvePropertyAccess(node, checker, context, visited, evaluationCache,
             /* v8 ignore next */
             const declarations = symbol.getDeclarations() ?? [];
             for (const declaration of declarations) {
-                if (!typescript_1.default.isVariableDeclaration(declaration) || !declaration.initializer || !typescript_1.default.isObjectLiteralExpression(declaration.initializer)) {
+                // `{ ... } as const` / `satisfies Record<...>` is still the same object literal.
+                const objectLiteral = typescript_1.default.isVariableDeclaration(declaration) && declaration.initializer ? (0, utils_1.unwrapExpression)(declaration.initializer) : null;
+                if (!objectLiteral || !typescript_1.default.isObjectLiteralExpression(objectLiteral)) {
                     continue;
                 }
-                for (const property of declaration.initializer.properties) {
+                for (const property of objectLiteral.properties) {
                     if (!typescript_1.default.isPropertyAssignment(property) && !typescript_1.default.isShorthandPropertyAssignment(property)) {
                         continue;
                     }
@@ -297,7 +300,7 @@ function collectReassignments(symbol, checker) {
     return { values, hasUnresolvedReassignment };
 }
 function resolveIdentifier(node, checker, context, visited, evaluationCache, resolvedCallCache, returnPropagationCache, exportCache) {
-    const boundSymbol = checker.getSymbolAtLocation(node);
+    const boundSymbol = (0, symbolUtils_1.getValueSymbol)(node, checker);
     if (boundSymbol && context.parameterBindings.has(boundSymbol)) {
         const bound = context.parameterBindings.get(boundSymbol);
         // `has(boundSymbol)` above already guarantees a Map entry, and every

package/dist/analysis/scanner/analyzer/propagationAnalyzer.js

@@ -138,6 +138,11 @@ function collectPropagations(fn, sinks) {
                     if (!typescript_1.default.isPropertyAssignment(property) && !typescript_1.default.isShorthandPropertyAssignment(property)) {
                         continue;
                     }
+                    // The sink only reads one property (e.g. `event`) as the name; `{ distinctId, event }`
+                    // must not propagate `distinctId` as an event name too.
+                    if (tracked.propertyPath.length > 0 && property.name.getText() !== tracked.propertyPath[0]) {
+                        continue;
+                    }
                     const initializer = typescript_1.default.isShorthandPropertyAssignment(property) ? property.name : property.initializer;
                     if (!typescript_1.default.isIdentifier(initializer)) {
                         continue;

package/dist/analysis/scanner/scanner.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanSource = scanSource;
 const typescript_1 = __importDefault(require("typescript"));
+const utils_1 = require("../shared/utils");
 const sinkDetector_1 = require("./sinkDetector");
 const jsxEventAttribute_1 = require("./jsxEventAttribute");
 const propagationAnalyzer_1 = require("./analyzer/propagationAnalyzer");
@@ -35,13 +36,19 @@ function scanSource(source, checker, wrapperRegistry, plugins) {
                     // track({
                     //   event: name
                     // })
-                    if (tracked.propertyPath.length > 0 && typescript_1.default.isObjectLiteralExpression(argument)) {
-                        const property = argument.properties.find(prop => {
-                            return (typescript_1.default.isPropertyAssignment(prop) && prop.name.getText() === tracked.propertyPath[0]);
+                    const argumentLiteral = (0, utils_1.unwrapExpression)(argument);
+                    if (tracked.propertyPath.length > 0 && typescript_1.default.isObjectLiteralExpression(argumentLiteral)) {
+                        const property = argumentLiteral.properties.find(prop => {
+                            return ((typescript_1.default.isPropertyAssignment(prop) || typescript_1.default.isShorthandPropertyAssignment(prop)) &&
+                                prop.name.getText() === tracked.propertyPath[0]);
                         });
                         if (property && typescript_1.default.isPropertyAssignment(property)) {
                             return property.initializer;
                         }
+                        // track({ event })
+                        if (property && typescript_1.default.isShorthandPropertyAssignment(property)) {
+                            return property.name;
+                        }
                     }
                     // track(name)
                     return argument;

package/dist/analysis/sdk/eventraSdk.js

@@ -12,12 +12,17 @@ function isEventraSdkModuleSpecifier(specifier) {
     return (normalized === exports.EVENTRA_SDK_PACKAGE ||
         normalized.startsWith(`${exports.EVENTRA_SDK_PACKAGE}/`));
 }
+/**
+ * Letters, digits and `: _ . / -`, plus the plain space - so third-party names such as
+ * `App: User Sign Up` survive. Tabs, newlines and every other character stay rejected.
+ */
+const EVENT_NAME_PATTERN = /^[a-zA-Z0-9:_./ -]+$/;
 function normalizeEventName(value) {
     const trimmed = value.trim();
     if (!trimmed || trimmed.length > exports.MAX_EVENT_NAME_LENGTH) {
         return null;
     }
-    if (!/^[a-zA-Z0-9:_./-]+$/.test(trimmed)) {
+    if (!EVENT_NAME_PATTERN.test(trimmed)) {
         return null;
     }
     return trimmed;

package/dist/analysis/symbols/symbolUtils.js

@@ -3,8 +3,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getValueSymbol = getValueSymbol;
 exports.getFunctionSymbol = getFunctionSymbol;
 const typescript_1 = __importDefault(require("typescript"));
+/**
+ * Symbol an identifier *refers to*. For the name in a shorthand property (`{ event }`) a plain
+ * `getSymbolAtLocation` yields the property's own symbol, not the variable/parameter it reads.
+ */
+function getValueSymbol(node, checker) {
+    const parent = node.parent;
+    if (parent && typescript_1.default.isShorthandPropertyAssignment(parent) && parent.name === node) {
+        return checker.getShorthandAssignmentValueSymbol(parent);
+    }
+    return checker.getSymbolAtLocation(node);
+}
 function getFunctionSymbol(node, checker) {
     // function foo() {}
     if (typescript_1.default.isFunctionDeclaration(node) && node.name) {

package/dist/cli/init.js

@@ -7,6 +7,31 @@ exports.init = init;
 const chalk_1 = __importDefault(require("chalk"));
 const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("../config/config");
+const sinkPresets_1 = require("../plugin/builtins/sinkPresets");
+const projectDependencies_1 = require("./projectDependencies");
+/**
+ * Looks for analytics libraries in package.json (and workspace members) and, if there are any,
+ * asks which of them Eventra should read events from. Everything detected is pre-selected.
+ */
+async function chooseSinks() {
+    const detected = (0, sinkPresets_1.detectSinkPresets)(await (0, projectDependencies_1.collectDependencyNames)(process.cwd()));
+    if (detected.length === 0)
+        return [];
+    console.log(chalk_1.default.gray(`Found analytics in package.json: ${detected.map((d) => d.packages.join(", ")).join("; ")}`));
+    const { presets } = await inquirer_1.default.prompt([
+        {
+            type: "checkbox",
+            name: "presets",
+            message: "Also read events from these analytics calls (sinks):",
+            choices: detected.map((d) => ({
+                name: `${d.preset} (${d.packages.join(", ")})`,
+                value: d.preset,
+                checked: true,
+            })),
+        },
+    ]);
+    return presets.map((preset) => ({ preset }));
+}
 async function init() {
     console.log(chalk_1.default.blue("Initializing Eventra..."));
     const { apiKey, endpoint, } = await inquirer_1.default.prompt([
@@ -22,6 +47,7 @@ async function init() {
             default: "https://api.eventra.dev/api/v1/cli/events",
         },
     ]);
+    const sinks = await chooseSinks();
     console.log("");
     console.log(chalk_1.default.gray("Eventra detects @eventra_dev/eventra-sdk usage:"));
     console.log(chalk_1.default.gray('• tracker.track("event.name")'));
@@ -33,6 +59,7 @@ async function init() {
         endpoint,
         events: [],
         functionWrappers: [],
+        ...(sinks.length > 0 ? { sinks } : {}),
         sync: {
             include: [
                 "**/*.{ts,tsx,js,jsx}",
@@ -47,6 +74,9 @@ async function init() {
     };
     await (0, config_1.saveConfig)(config);
     console.log(chalk_1.default.green("eventra.json created"));
+    if (sinks.length > 0) {
+        console.log(chalk_1.default.green(`sinks: ${sinks.map((s) => s.preset).join(", ")}`));
+    }
     // Never write the key into eventra.json — that file is meant to be
     // committed (CI diffs it via `eventra check`). Keep secrets out of git.
     if (apiKey) {

package/dist/cli/projectDependencies.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectDependencyNames = collectDependencyNames;
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+/** Upper bound on workspace members read, so a huge monorepo cannot make `init` crawl. */
+const MAX_WORKSPACE_PACKAGES = 300;
+/**
+ * Parsed package.json, or null when it is missing or not JSON. Whatever else the file holds (an
+ * array, a number) is returned as is: every reader below only looks up named properties on it, which
+ * is harmless on any JSON value, so there is no point in a second validation here.
+ */
+async function readPackage(file) {
+    try {
+        return (await fs_extra_1.default.readJSON(file));
+    }
+    catch {
+        return null;
+    }
+}
+function dependencyNames(pkg) {
+    return DEPENDENCY_FIELDS.flatMap((field) => {
+        const deps = pkg[field];
+        return typeof deps === "object" && deps !== null && !Array.isArray(deps) ? Object.keys(deps) : [];
+    });
+}
+function stringList(value) {
+    // Stryker disable next-line ArrayDeclaration: a stray pattern that matches no directory changes nothing
+    return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+/** `packages:` entries of a pnpm-workspace.yaml (only the plain list form, which is all pnpm writes). */
+function pnpmWorkspacePatterns(yaml) {
+    // Stryker disable next-line ArrayDeclaration: a stray pattern that matches no directory changes nothing
+    const patterns = [];
+    let inPackages = false;
+    for (const line of yaml.split(/\r?\n/)) {
+        if (/^packages:\s*(#.*)?$/.test(line)) {
+            inPackages = true;
+            continue;
+        }
+        if (!inPackages)
+            continue;
+        // YAML lets the dashes sit at the key's own indent (`packages:` / `- 'apps/*'`), so no indent is required.
+        const item = /^\s*-\s*['"]?([^'"#]+?)['"]?\s*(#.*)?$/.exec(line);
+        if (item) {
+            patterns.push(item[1]);
+        }
+        else if (/^\S/.test(line)) {
+            // The next top-level key ends the list.
+            inPackages = false;
+        }
+    }
+    return patterns;
+}
+/** A workspace pattern may only point inside the project: no absolute paths, no `..`. */
+function staysInsideProject(pattern) {
+    // Stryker disable next-line StringLiteral: a negated pattern outside the project excludes nothing, so what replaces the "!" cannot show
+    const target = pattern.replace(/^!/, "");
+    return !path_1.default.isAbsolute(target) && !target.split(/[\\/]/).includes("..");
+}
+/** pnpm-workspace.yaml patterns; an unreadable file (a directory, no permission) counts as having none. */
+async function readPnpmPatterns(file) {
+    try {
+        return pnpmWorkspacePatterns(await fs_extra_1.default.readFile(file, "utf8"));
+    }
+    catch {
+        // Stryker disable next-line ArrayDeclaration: a stray pattern that matches no directory changes nothing
+        return [];
+    }
+}
+async function workspacePatterns(rootDir, rootPackage) {
+    const workspaces = rootPackage.workspaces;
+    const fromPackageJson = Array.isArray(workspaces)
+        ? stringList(workspaces)
+        : stringList(workspaces?.packages);
+    const fromPnpm = await readPnpmPatterns(path_1.default.join(rootDir, "pnpm-workspace.yaml"));
+    return [...fromPackageJson, ...fromPnpm].filter(staysInsideProject);
+}
+/**
+ * `apps/*` -> every member's package.json. A negated pattern (`!apps/skipped`) becomes
+ * `!apps/skipped/package.json`, which fast-glob treats as an exclusion of exactly those files.
+ */
+const memberGlob = (pattern) => `${pattern}/package.json`;
+/** Member package.json paths for the patterns; a pattern fast-glob rejects (a NUL byte, say) yields none. */
+async function findMembers(rootDir, patterns) {
+    try {
+        return await (0, fast_glob_1.default)(patterns.map(memberGlob), { cwd: rootDir, ignore: ["**/node_modules/**"] });
+    }
+    catch {
+        // Stryker disable next-line ArrayDeclaration: a stray path that is not a package.json is read as "no package.json"
+        return [];
+    }
+}
+/**
+ * Every dependency name the project declares: the root package.json plus, in a monorepo
+ * (`workspaces` or pnpm-workspace.yaml), each workspace member's package.json.
+ */
+async function collectDependencyNames(rootDir) {
+    const names = new Set();
+    const rootPackage = await readPackage(path_1.default.join(rootDir, "package.json"));
+    if (rootPackage === null)
+        return names;
+    for (const name of dependencyNames(rootPackage))
+        names.add(name);
+    const patterns = await workspacePatterns(rootDir, rootPackage);
+    const members = (await findMembers(rootDir, patterns)).slice(0, MAX_WORKSPACE_PACKAGES);
+    for (const member of members) {
+        const memberPackage = await readPackage(path_1.default.join(rootDir, member));
+        if (memberPackage !== null)
+            for (const name of dependencyNames(memberPackage))
+                names.add(name);
+    }
+    return names;
+}

package/dist/config/config.js

@@ -21,6 +21,11 @@ exports.CONFIG_NAME = "eventra.json";
 exports.LOCAL_CONFIG_NAME = "eventra.local.json";
 const DEFAULT_INCLUDE = ["**/*.{ts,tsx,js,jsx}"];
 const DEFAULT_EXCLUDE = ["node_modules", "dist", ".next", ".git"];
+function normalizeSinks(sinks) {
+    if (!Array.isArray(sinks))
+        return [];
+    return sinks.filter((s) => typeof s === "object" && s !== null && !Array.isArray(s));
+}
 function normalizeConfig(config) {
     const functionWrappers = (config.functionWrappers ?? [])
         .filter((w) => w?.name)
@@ -32,12 +37,14 @@ function normalizeConfig(config) {
         seen.add(w.name);
         return true;
     });
+    const sinks = normalizeSinks(config.sinks);
     return {
         apiKey: config.apiKey ?? "",
         endpoint: config.endpoint ?? "",
         events: [...(config.events ?? [])].sort(),
         functionWrappers: uniqueWrappers.sort((a, b) => a.name.localeCompare(b.name)),
         plugins: [...(config.plugins ?? [])],
+        ...(sinks.length > 0 ? { sinks } : {}),
         sync: {
             include: config.sync?.include ?? DEFAULT_INCLUDE,
             exclude: config.sync?.exclude ?? DEFAULT_EXCLUDE,

package/dist/plugin/builtins/configuredSinks.js

@@ -0,0 +1,253 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSinkRules = resolveSinkRules;
+exports.createConfiguredSinkDetector = createConfiguredSinkDetector;
+exports.registerConfiguredSinks = registerConfiguredSinks;
+const typescript_1 = __importDefault(require("typescript"));
+const utils_1 = require("../../analysis/shared/utils");
+const sinkPresets_1 = require("./sinkPresets");
+/** Expands presets and drops malformed rules. `warn` receives a message per dropped rule. */
+function resolveSinkRules(rules, warn) {
+    const resolved = [];
+    for (const rule of rules) {
+        if (rule.preset !== undefined) {
+            const preset = typeof rule.preset === "string" && Object.hasOwn(sinkPresets_1.SINK_PRESETS, rule.preset) ? sinkPresets_1.SINK_PRESETS[rule.preset] : undefined;
+            if (!preset) {
+                warn(`Eventra: unknown sinks preset "${rule.preset}" (available: ${Object.keys(sinkPresets_1.SINK_PRESETS).join(", ")}) - skipped.`);
+                continue;
+            }
+            resolved.push(...preset);
+            continue;
+        }
+        // eventra.json is hand-edited JSON: every field can hold any type, and a wrong one must be skipped, not crash.
+        const callee = typeof rule.callee === "string" ? rule.callee.trim() : undefined;
+        if (!callee || !/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(callee)) {
+            warn(`Eventra: sinks rule needs a "preset" or a dotted "callee" like "analytics.track" - skipped.`);
+            continue;
+        }
+        const nameArg = rule.nameArg ?? 0;
+        if (!Number.isInteger(nameArg) || nameArg < 0) {
+            warn(`Eventra: sinks rule "${callee}" has an invalid "nameArg" - skipped.`);
+            continue;
+        }
+        if (rule.nameProperty !== undefined && typeof rule.nameProperty !== "string") {
+            warn(`Eventra: sinks rule "${callee}" has an invalid "nameProperty" - skipped.`);
+            continue;
+        }
+        if (rule.modules !== undefined &&
+            (!Array.isArray(rule.modules) || !rule.modules.every((m) => typeof m === "string" && m !== ""))) {
+            warn(`Eventra: sinks rule "${callee}" has an invalid "modules" - skipped.`);
+            continue;
+        }
+        let when;
+        if (rule.when !== undefined) {
+            const candidate = rule.when;
+            if (!candidate ||
+                !Number.isInteger(candidate.arg) ||
+                candidate.arg < 0 ||
+                typeof candidate.equals !== "string" ||
+                candidate.equals === "") {
+                warn(`Eventra: sinks rule "${callee}" has an invalid "when" - skipped.`);
+                continue;
+            }
+            when = { arg: candidate.arg, equals: candidate.equals };
+        }
+        resolved.push({
+            callee,
+            nameArg,
+            ...(rule.nameProperty ? { nameProperty: rule.nameProperty } : {}),
+            ...(rule.modules?.length ? { modules: rule.modules } : {}),
+            ...(when ? { when } : {}),
+        });
+    }
+    return resolved;
+}
+/** `a.b.c` / `this.a.b` / `a?.b` -> "a.b.c"; null for anything that isn't a plain property path. */
+function calleePath(expr) {
+    const e = (0, utils_1.unwrapExpression)(expr);
+    if (typescript_1.default.isIdentifier(e))
+        return e.text;
+    if (e.kind === typescript_1.default.SyntaxKind.ThisKeyword)
+        return "this";
+    if (typescript_1.default.isPropertyAccessExpression(e)) {
+        const head = calleePath(e.expression);
+        return head === null ? null : `${head}.${e.name.text}`;
+    }
+    return null;
+}
+function moduleMatches(specifier, modules) {
+    return modules.some((m) => specifier === m || specifier.startsWith(`${m}/`));
+}
+const MAX_ALIAS_HOPS = 6;
+/** Identifiers naming the types in a type annotation: `PostHog`, `PostHog | null`, `ph.PostHog`. */
+function typeReferenceRoots(type) {
+    if (typescript_1.default.isParenthesizedTypeNode(type))
+        return typeReferenceRoots(type.type);
+    if (typescript_1.default.isUnionTypeNode(type) || typescript_1.default.isIntersectionTypeNode(type))
+        return type.types.flatMap(typeReferenceRoots);
+    if (typescript_1.default.isTypeReferenceNode(type)) {
+        let name = type.typeName;
+        while (typescript_1.default.isQualifiedName(name))
+            name = name.left;
+        return [name];
+    }
+    return [];
+}
+/**
+ * The symbol an identifier refers to, keeping an import as the import binding itself. TS resolves an
+ * import all the way to its target in some positions once something makes the module resolvable
+ * (a wildcard `declare module "*"` does that for every unresolved package), and the trail to the
+ * package's name is gone by then.
+ */
+function symbolAt(id, checker) {
+    const symbol = checker.getSymbolAtLocation(id);
+    // Stryker disable next-line ConditionalExpression: fast path only; the scope lookup below returns the same alias
+    if (symbol && symbol.flags & typescript_1.default.SymbolFlags.Alias)
+        return symbol;
+    return checker.getSymbolsInScope(id, typescript_1.default.SymbolFlags.Alias).find((alias) => alias.name === id.text) ?? symbol;
+}
+/** The symbol `name` exported by the module a specifier points at, when TS can resolve that module. */
+function resolveExport(specifier, name, checker) {
+    const moduleSymbol = checker.getSymbolAtLocation(specifier);
+    return moduleSymbol ? checker.tryGetMemberInModuleExports(name, moduleSymbol) : undefined;
+}
+/**
+ * `usePostHog()`, `new PostHog(k)`, `await init()`, `this.client`, `this.getClient()`,
+ * `AnalyticsBrowser.load()` or a bare alias `usePostHog`: true when the name at the heart of the
+ * expression, or the import its chain hangs off, originates from `modules`.
+ */
+function expressionFromModules(expression, checker, modules, hops) {
+    let expr = (0, utils_1.unwrapExpression)(expression);
+    if (typescript_1.default.isAwaitExpression(expr))
+        expr = (0, utils_1.unwrapExpression)(expr.expression);
+    if (typescript_1.default.isCallExpression(expr) || typescript_1.default.isNewExpression(expr))
+        expr = (0, utils_1.unwrapExpression)(expr.expression);
+    const fromName = (name) => typescript_1.default.isIdentifier(name) && symbolFromModules(symbolAt(name, checker), checker, modules, hops);
+    if (!typescript_1.default.isPropertyAccessExpression(expr))
+        return fromName(expr);
+    // `this.client` is vetted through the property's own declaration; `AnalyticsBrowser.load()` and
+    // `amplitude.getInstance()` hang off an import, so the chain's root decides.
+    let root = expr;
+    while (typescript_1.default.isPropertyAccessExpression(root))
+        root = (0, utils_1.unwrapExpression)(root.expression);
+    return fromName(expr.name) || fromName(root);
+}
+function declarationFromModules(decl, checker, modules, hops) {
+    if (typescript_1.default.isImportSpecifier(decl) || typescript_1.default.isImportClause(decl) || typescript_1.default.isNamespaceImport(decl)) {
+        // Every import binding sits under an ImportDeclaration, whose specifier is a string literal.
+        const importDecl = typescript_1.default.findAncestor(decl, typescript_1.default.isImportDeclaration);
+        if (moduleMatches(importDecl.moduleSpecifier.text, modules))
+            return true;
+        if (typescript_1.default.isNamespaceImport(decl))
+            return false;
+        const exported = typescript_1.default.isImportSpecifier(decl) ? (decl.propertyName ?? decl.name).text : "default";
+        return symbolFromModules(resolveExport(importDecl.moduleSpecifier, exported, checker), checker, modules, hops + 1);
+    }
+    if (typescript_1.default.isExportSpecifier(decl)) {
+        const specifier = decl.parent.parent.moduleSpecifier;
+        if (!specifier) {
+            // export { local as alias }
+            return symbolFromModules(checker.getExportSpecifierLocalTargetSymbol(decl), checker, modules, hops + 1);
+        }
+        // export { name as alias } from "module"
+        if (moduleMatches(specifier.text, modules))
+            return true;
+        const exported = (decl.propertyName ?? decl.name).text;
+        return symbolFromModules(resolveExport(specifier, exported, checker), checker, modules, hops + 1);
+    }
+    // export default client
+    if (typescript_1.default.isExportAssignment(decl)) {
+        return expressionFromModules(decl.expression, checker, modules, hops + 1);
+    }
+    // const { posthog } = usePostHog(): the binding's own declaration is the enclosing variable.
+    const owner = typescript_1.default.isBindingElement(decl) ? decl.parent.parent : decl;
+    // Variables, properties, parameters, functions (return type) and type aliases all keep their
+    // annotation in `type`; variables, properties and parameters keep a default/initial value in
+    // `initializer`. Anything else (classes, interfaces, ...) simply has neither.
+    const { type, initializer } = owner;
+    // let client: PostHog | null / private client: PostHog / (client: PostHog) => ... / type Client = PostHog
+    if (type &&
+        typeReferenceRoots(type).some((id) => symbolFromModules(symbolAt(id, checker), checker, modules, hops + 1))) {
+        return true;
+    }
+    // const ph = usePostHog() / new PostHog(k) / client = new PostHog(k) / const useTrack = usePostHog
+    return initializer !== undefined && expressionFromModules(initializer, checker, modules, hops + 1);
+}
+/**
+ * True when `symbol` originates from one of `modules`, following import/re-export chains
+ * (`import { useAnalytics } from "@/hooks"` -> `export { usePostHog as useAnalytics } from "posthog-js/react"`).
+ * Works without installed dependencies, by reading the specifiers along the chain.
+ */
+function symbolFromModules(symbol, checker, modules, hops = 0) {
+    if (!symbol || hops > MAX_ALIAS_HOPS)
+        return false;
+    // A real ts.Symbol's `declarations` is only undefined for synthetic symbols we never see here.
+    // Stryker disable next-line ArrayDeclaration: unreachable fallback, see above
+    /* v8 ignore next */
+    const declarations = symbol.declarations ?? [];
+    return declarations.some((decl) => declarationFromModules(decl, checker, modules, hops));
+}
+/** `rule.when`: the guard argument must be the exact string literal (`gtag("event", ...)` but not `gtag("config", ...)`). */
+function whenSatisfied(call, rule) {
+    if (!rule.when)
+        return true;
+    const guard = call.arguments[rule.when.arg];
+    const literal = guard && (0, utils_1.unwrapExpression)(guard);
+    return literal !== undefined && typescript_1.default.isStringLiteralLike(literal) && literal.text === rule.when.equals;
+}
+function trackedArgumentFor(call, rule) {
+    const arg = call.arguments[rule.nameArg];
+    if (!arg)
+        return null;
+    const literal = (0, utils_1.unwrapExpression)(arg);
+    if (typescript_1.default.isObjectLiteralExpression(literal)) {
+        // Only `{ event: name }` is a usable shape; the scanner reads this property off the literal.
+        // (`SpreadAssignment` has no name, hence the kind check.)
+        const found = literal.properties.some((p) => (typescript_1.default.isPropertyAssignment(p) || typescript_1.default.isShorthandPropertyAssignment(p)) && p.name.getText() === rule.nameProperty);
+        return found ? { index: rule.nameArg, propertyPath: [rule.nameProperty] } : null;
+    }
+    // Stryker disable next-line ArrayDeclaration: propertyPath is only read for object-literal arguments
+    return { index: rule.nameArg, propertyPath: [] };
+}
+function createConfiguredSinkDetector(rules) {
+    return {
+        name: "configured-sinks",
+        detect({ call, checker }) {
+            const callee = (0, utils_1.unwrapExpression)(call.expression);
+            // `gtag(...)` / `x.capture(...)`: the name actually being called.
+            const last = typescript_1.default.isIdentifier(callee) ? callee.text : typescript_1.default.isPropertyAccessExpression(callee) ? callee.name.text : null;
+            const path = calleePath(callee);
+            for (const rule of rules) {
+                // A dotted rule needs the whole plain path (`foo().analytics.track` has none); a bare name
+                // matches whatever receiver it hangs off, including a call (`usePostHog().capture`).
+                const matched = rule.callee.includes(".")
+                    ? path !== null && (path === rule.callee || path.endsWith(`.${rule.callee}`))
+                    : last === rule.callee;
+                if (!matched || !whenSatisfied(call, rule))
+                    continue;
+                // A bare name is too generic to match alone: a receiver-vetted rule checks where the receiver
+                // (`x` in `x.capture(...)`) or, for a bare call, the called name itself comes from.
+                if (rule.modules &&
+                    !expressionFromModules(typescript_1.default.isPropertyAccessExpression(callee) ? callee.expression : callee, checker, rule.modules, 0)) {
+                    continue;
+                }
+                const tracked = trackedArgumentFor(call, rule);
+                if (tracked)
+                    return { call, trackedArguments: [tracked] };
+            }
+            return null;
+        },
+    };
+}
+/** Registers the `sinks` rules from eventra.json (declarative data only - never code). */
+function registerConfiguredSinks(registry, rules, warn = (m) => console.warn(m)) {
+    if (!rules?.length)
+        return;
+    const resolved = resolveSinkRules(rules, warn);
+    if (resolved.length === 0)
+        return;
+    registry.registerSinkDetector(createConfiguredSinkDetector(resolved));
+}

package/dist/plugin/builtins/sinkPresets.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Built-in `sinks` presets, plus the npm packages each one is recognised by.
+ *
+ * Package names and what they export were checked against the npm registry and the packages' own
+ * type declarations on 2026-10-08 (`pnpm check:presets` re-checks the names against the registry,
+ * so a rename or a deprecation shows up there instead of as a silent detection gap).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SINK_PRESETS = exports.PRESET_PACKAGES = void 0;
+exports.detectSinkPresets = detectSinkPresets;
+const pkg = (name, flags = {}) => ({ name, ...flags });
+exports.PRESET_PACKAGES = {
+    posthog: [
+        pkg("posthog-js"),
+        pkg("@posthog/react"),
+        pkg("posthog-js-lite"),
+        pkg("posthog-node"),
+        pkg("posthog-react-native"),
+    ],
+    segment: [
+        pkg("@segment/analytics-next"),
+        pkg("@segment/analytics-node"),
+        pkg("@segment/analytics-react-native"),
+        pkg("@segment/analytics.js-core", { legacy: true }),
+        pkg("analytics-node", { legacy: true }),
+        pkg("@segment/snippet", { detectOnly: true }),
+    ],
+    amplitude: [
+        pkg("@amplitude/analytics-browser"),
+        pkg("@amplitude/analytics-node"),
+        pkg("@amplitude/analytics-react-native"),
+        pkg("@amplitude/marketing-analytics-browser"),
+        pkg("@amplitude/unified"),
+        pkg("amplitude-js", { legacy: true }),
+    ],
+    ga4: [
+        pkg("react-ga4"),
+        pkg("vue-gtag"),
+        pkg("vue-gtag-next", { legacy: true }),
+        pkg("@next/third-parties", { detectOnly: true }),
+        pkg("nuxt-gtag", { detectOnly: true }),
+        pkg("@types/gtag.js", { detectOnly: true }),
+    ],
+};
+/** Packages a rule can vet a receiver against: everything except the detect-only signals. */
+const modulesOf = (preset, only) => exports.PRESET_PACKAGES[preset]
+    .filter((p) => !p.detectOnly && (only === undefined || only.includes(p.name)))
+    .map((p) => p.name);
+exports.SINK_PRESETS = {
+    posthog: [
+        // posthog.capture("x") - the conventional name, posthog-js and posthog-node alike.
+        { callee: "posthog.capture", nameArg: 0, nameProperty: "event" },
+        // Any other receiver name, e.g. `const ph = usePostHog(); ph.capture("x")` or
+        // `const client = new PostHog(key); client.capture({ distinctId, event: "x" })`.
+        { callee: "capture", nameArg: 0, nameProperty: "event", modules: modulesOf("posthog") },
+    ],
+    segment: [
+        // analytics.track("x", props) from analytics.js / @segment/analytics-next, `window.analytics` included;
+        // analytics-node takes `analytics.track({ userId, event: "x" })`.
+        { callee: "analytics.track", nameArg: 0, nameProperty: "event" },
+        // `const [analytics] = await AnalyticsBrowser.load(...)`, `new Analytics({ writeKey })`, any variable name.
+        { callee: "track", nameArg: 0, nameProperty: "event", modules: modulesOf("segment") },
+    ],
+    amplitude: [
+        // amplitude.track("x") / amplitude.track({ event_type: "x" }) / the legacy amplitude.logEvent("x").
+        { callee: "amplitude.track", nameArg: 0, nameProperty: "event_type" },
+        { callee: "amplitude.logEvent", nameArg: 0, nameProperty: "event_type" },
+        // `amplitude.getInstance().logEvent("x")`, `const client = Amplitude.createInstance()`, any variable name.
+        { callee: "track", nameArg: 0, nameProperty: "event_type", modules: modulesOf("amplitude") },
+        { callee: "logEvent", nameArg: 0, nameProperty: "event_type", modules: modulesOf("amplitude") },
+    ],
+    ga4: [
+        // gtag("event", "x", params): the name is the second argument, and only for the "event" command
+        // (`gtag("config", id)` and `gtag("set", ...)` are not events). `window.gtag` and nuxt-gtag's
+        // `const { gtag } = useGtag()` match too.
+        { callee: "gtag", nameArg: 1, when: { arg: 0, equals: "event" } },
+        // @next/third-parties: sendGAEvent("event", "x", params).
+        { callee: "sendGAEvent", nameArg: 1, when: { arg: 0, equals: "event" } },
+        // nuxt-gtag: useTrackEvent("x", params), auto-imported.
+        { callee: "useTrackEvent", nameArg: 0 },
+        // vue-gtag: this.$gtag.event("x", params).
+        { callee: "$gtag.event", nameArg: 0 },
+        // vue-gtag: `import { event } from "vue-gtag"` or `const { event } = useGtag()`.
+        { callee: "event", nameArg: 0, modules: modulesOf("ga4", ["vue-gtag", "vue-gtag-next"]) },
+        // react-ga4: ReactGA.event("x", params) or ReactGA.event({ category, action: "x" }).
+        { callee: "event", nameArg: 0, nameProperty: "action", modules: modulesOf("ga4", ["react-ga4"]) },
+    ],
+};
+/** Which presets a project's dependency names point at, in preset order. */
+function detectSinkPresets(dependencyNames) {
+    const detected = [];
+    for (const [preset, packages] of Object.entries(exports.PRESET_PACKAGES)) {
+        const present = packages.map((p) => p.name).filter((name) => dependencyNames.has(name));
+        if (present.length > 0)
+            detected.push({ preset, packages: present });
+    }
+    return detected;
+}

package/dist/plugin/loadPlugins.js

@@ -37,6 +37,7 @@ exports.isTrustedPluginSpecifier = isTrustedPluginSpecifier;
 exports.createBuiltinPluginRegistry = createBuiltinPluginRegistry;
 exports.createPluginRegistry = createPluginRegistry;
 const external_1 = require("./adapters/external");
+const configuredSinks_1 = require("./builtins/configuredSinks");
 const eventra_sdk_1 = require("./builtins/eventra-sdk");
 const consoleDynamicEventReporter_1 = require("./builtins/consoleDynamicEventReporter");
 const registry_1 = require("./registry");
@@ -107,6 +108,7 @@ function createBuiltinPluginRegistry() {
 /** Built-ins + plugins listed in eventra.json `plugins` array. */
 async function createPluginRegistry(config) {
     const registry = createBuiltinPluginRegistry();
+    (0, configuredSinks_1.registerConfiguredSinks)(registry, config.sinks);
     for (const spec of config.plugins ?? []) {
         const trimmed = spec.trim();
         if (!trimmed)

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@eventra_dev/eventra-cli",
-  "version": "2.0.9",
+  "version": "2.1.0",
   "description": "Static analytics event extraction CLI powered by the TypeScript compiler API",
   "license": "MIT",
+  "author": {
+    "name": "and-1991",
+    "url": "https://github.com/and-1991"
+  },
   "type": "commonjs",
   "bin": {
     "eventra": "./dist/index.js"
@@ -31,7 +35,9 @@
     "test:unit": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:e2e": "pnpm run clean && pnpm run build && tsx tests/run.ts",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "test:mutation": "stryker run",
+    "check:presets": "tsx scripts/check-preset-packages.ts"
   },
   "dependencies": {
     "chalk": "^4.1.2",
@@ -43,6 +49,8 @@
     "typescript": "^5.3.0"
   },
   "devDependencies": {
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
     "@types/fs-extra": "^11.0.4",
     "@types/inquirer": "^9.0.9",
     "@types/node": "^20.0.0",