Roadmap

What we're building, in order

This is a working plan, not a promise — phases are sequenced by dependency (a stable, secure backend before more surface area, more surface area before enterprise commitments), and dates aren't fixed. Status reflects what's actually shipped and verified in production today.

32 of 54 items shipped59%

Phase 0

Foundation

Done

6 items

Core ingest, rollup, billing, and analytics pipeline, plus the CLI and SDK clients that feed it — all audited end to end.

CLI 2.3.1

Finds events in monorepos (each app's own TypeScript settings, packages of the same repository without installing), through helpers that call other helpers, analytics loaded on demand and helpers returned from hooks (also a hook that returns a plain function, and a tracker created on first use), and names such as `$pageview`; leaves tests and build output out of a scan by default and asks for more memory by itself on large repositories; `init` now enables the plugin for the framework it finds. Earlier: Semantic analysis, wrapper propagation, watch mode; LICENSE now the complete MIT text; reads PostHog, Segment, Amplitude and Google Analytics 4 calls (`sinks`, set up by `eventra init`) and event names may contain spaces; README's own Plugins section now documents the Angular plugin (was missing since the plugin shipped) and its stale test-count numbers are corrected; README's Nuxt auto-import note now reflects a real end-to-end check; folders such as `node_modules` and `dist` are now excluded at any depth, `watch` no longer re-runs on its own output, files that could not be read are summarised once (`--strict` fails on them) without dropping known events, plugins are found from your project, and `init` asks before overwriting an existing config; messages for events with computed names point at the real file and line (and `template of <file>` for Vue, Svelte and Astro templates), and `sync` and `watch` rebuild the project once per change batch (50 changed files at once: 17-44 s down to 0.5 s); a single-file `watch` update is about 2.5x faster, and `eventra send` now also tells the server whether the scan was complete, so removed features can be told apart

Done

SDK 2.0.6

Circuit breaker, leader election, idempotency; README test counts corrected; LICENSE now the complete MIT text; far cheaper `track()` in browsers when the endpoint is down, no longer keeps a Node process alive, flushes the remaining queue on shutdown and honours `Retry-After`, and reports how many events it dropped or failed to deliver (and why) so the dashboard can show delivery problems

Done

Backend

Ingest, rollup, billing, auth guards

Done

Dashboard

Dead feature detection, ops dashboard

Done

Backend audit

7 critical bugs found and fixed

Done

Dashboard audit

13 findings fixed and verified in production

Done

Phase 1

Stability & Security

Done

13 items

Hardening the ingest and auth surface before scaling traffic — most of this phase is already live.

Bind API keys to a host

Origin/Referer allowlist per key, opt-in via ENFORCE_API_KEY_HOST_BINDING

Done

X-Forwarded-For spoofing fix

Done

Soft-deleted sessions invalidated

Done

Rolling session refresh

Done

Proxy body-size limit & timeout

Done

CI/CD gates

Lint + build required before deploy

Done

Backend-driven filters

Search/date-range filters on events, features, dead features

Done

Overview widget layout

Free drag-and-drop grid, per-project: move, resize and hide any widget

Done

Per-feature settings

Each feature can have its own dead threshold, be muted (never reported dead) and carry a description; owners and admins edit them on the feature page, and the features that follow their own rule are marked in the lists

Done

Account page

First name, last name and a short description, the user's role in each workspace (read-only), and sign-in methods (set a password, disconnect Google or GitHub while another way in is left); names show in the header and the members list; no birth date by design (not needed, and personal data)

Done

Social sign-in

Continue with Google or GitHub on the login and register pages (an authorization code flow with PKCE); a provider appears only when its credentials are configured

Done

Guided first-run setup

A new account is taken through naming its workspace, creating its first project and sending its first event, with a progress bar and no flashing between the steps

Done

Phase 2

Plugins & Framework Support

Done

11 items

Extending static analysis beyond a single parser so the CLI understands how features are actually used across frameworks.

Plugin kernel

Preprocessor/sink-detector registry, external plugin contract, trusted-scope plugin loading

Done

Vue plugin 1.1.0

Reads calls anywhere in the template (handlers, interpolations, bindings, conditions). Earlier: Real compiler-based parsing (script setup, dynamic bindings, Nuxt auto-import compatible, now verified on a real Nuxt project); the plugin's own reported `version` was hardcoded and stale (`0.1.0`), now derived from `package.json` so it can't drift again; README test count updated; a file that fails to parse is now reported and skipped instead of counting as having no events

Done

Svelte plugin 1.1.0

Reads calls in interpolations, blocks, directives and attribute values as well. Earlier: Real compiler-based parsing (script + context=module, dynamic bindings); its reported `version` is now derived from `package.json` instead of a separately-hardcoded literal; inline event handlers in the markup (`on:click={...}`, `onclick={...}`) are now detected, which CLI 2.2.0 no longer picked up on its own; README test count updated

Done

Astro plugin 1.1.0

Reads calls in template expressions and in the page's script tags. Earlier: Real compiler-based parsing (frontmatter, dynamic bindings, JSX-expression templates); its reported `version` is now derived from `package.json` instead of a separately-hardcoded literal; README test count updated

Done

Angular plugin 1.1.0

Reads calls in event handlers, bindings, interpolations and control flow, and no longer reports errors for generated docs. Earlier: Real compiler-based parsing (templateUrl components, dynamic bindings resolved against the component class, including getters); docs now recommend `[attr.event]` over `[event]` on native elements to avoid a real `ng build` failure (NG8002); README test count updated

Done

Configurable template-tracking attribute name

the `event="..."`/`[event]="..."` convention (Vue/Svelte/Astro/Angular plugins + the core JSX detector) is hardcoded to the literal name `event` everywhere, with no per-project override. Real collision risk is highest in JSX (`event` is a common, unrelated prop/variable name there) but hasn't actually been reported anywhere yet - not worth the plugin-contract-breaking work (a config value would need to reach 4 independently-published external plugins, not just the core detector) until it is. Revisit if a real false-positive collision surfaces.

Future

Demo account

Seeded, read-only account for product demonstrations

Done

New feature detection

features are flagged "new" for the first 7 days after their first event, alongside the existing dead-feature detection

Done

Never-seen feature detection

features the CLI finds in code that have never sent an event get their own page and overview card, instead of being counted as used

Done

Dashboard redesign

Every overview widget drills down, Features can be filtered and sorted, unique users and custom date ranges on every usage chart, new Users, Declining and Never seen pages, and dead features grouped by how long they have been inactive

Done

Code vs data

a page that compares the features found in your code with the events that actually arrive: healthy, never seen, gone quiet, not in your code (typos, computed names, old clients) and removed from code, with the time of the last code scan, plus a delivery health section built from what the SDK reports it dropped or could not send

Done

Phase 3

Product Analytics

Planned

Moving from "is this feature used" to "how is it used" — funnels, retention, alerting, and richer segmentation.

Funnels

Planned

Alerts

Planned

Retention

Cohort analysis

Planned

Custom metrics

Companies, custom fields

Planned

Integrations

Slack, Jira, Linear

Planned

Phase 4

Validate Demand

Planned

Everything through Phase 3 is what makes the product functionally comparable to existing usage-analytics tools. Before spending more engineering time on Phase 5's enterprise surface, the actual open question - will anyone pay for this - needs a real answer instead of another feature.

Work alongside existing analytics

The CLI (2.1.0) reads PostHog, Segment, Amplitude and Google Analytics 4 calls (and your own tracking function) to build the feature catalog, and `eventra init` sets it up. Usage data still comes from the SDK, reading it from those tools is the next step

Done

Customer discovery

Structured conversations with engineering leads/PMs who'd plausibly use dead-feature detection, run before any further build-out

Planned

Design partner

One real (non-demo) codebase running the full pipeline end to end, with an actual team retiring dead code because of it

Planned

Priced pilot

Someone paying real money, even a small amount, as the actual signal - interest and "cool idea" feedback don't count

Planned

Phase 5

Enterprise & Growth

Future

The scale and compliance surface for larger customers - further out, and dependent on real demand.

Multi-instance rate limiting

Redis-backed rate limiter and email-verification attempt limiter

Done

Multi-instance queues

Redis-backed billing queue, and rollup's property-stat carry-over moved from an in-process field to a durable table

Done

SSO / SAML / OIDC

Future

Self-hosted / on-premise

Future

SLA

Uptime guarantees

Future

Read replicas for analytics

Future

Phase 6

Feature Management

Future

The SDK already sits inside customer code and observes every tracked feature; this phase turns that one-way observation channel into a two-way one, so the dashboard can act on what it sees - not just report it. This is a bigger step than a typical toggle service: it puts the SDK in a position to change production behavior in real time, so it's gated on Phase 3's analytics/alerting maturity (to know reliably what's actually dead or erroring) and on Phase 5's trust surface (SSO, audit, SLA) before customers should extend that much control to a vendor. Speculative and demand-dependent - no committed timeline.

Bi-directional SDK channel

SDK can receive signed commands from the backend, not just emit events

Future

Feature flag API

`isEnabled()`-style gate in the SDK, with manual on/off control from the dashboard

Future

Auto-kill on dead/error detection

closes the loop with Phase 3 alerting: a feature flagged dead or erroring past a threshold can be disabled at runtime without a deploy

Future

Safe-mode guarantees

fail open to the last-known-good state on network loss, staged/percentage rollout, full audit log of every remote toggle

Future

Human-in-the-loop override

approval/rollback workflow for auto-kill decisions, since a server-driven runtime kill-switch is a new class of risk, not just a new feature

Future

Phase 7

Multi-Language Support

Future

The SDK and CLI are JS/TS-only today. Shipping an SDK in another language is the easy half — a thin client for batching, retries, and delivery, same shape as the existing SDK. The CLI's static detection is the hard half: it's built directly on the TypeScript compiler API (semantic AST walking, wrapper propagation, type-aware resolution), which doesn't carry over to another language's compiler or parser — each one is effectively a new analysis engine, not a port. The two are tracked separately below so a language can ship SDK-only (manual tracking, no auto-detection) well before it gets CLI parity. Speculative and demand-dependent — no committed timeline.

Python SDK

Future

Go SDK

Future

Java / Kotlin SDK

JVM backends and Android

Future

Static analysis parity

a dedicated static analyzer per language (not the SDK) for auto dead-feature detection outside JS/TS; a materially larger effort than any single SDK port

Future

Have input?

This roadmap is shaped by real usage

If a phase above is blocking you from adopting Eventra, or you need something that isn't listed, tell us - sequencing can change.

hello@eventra.dev