@gurulu/cli 0.4.5 → 0.4.7

package/dist/api-client.d.ts

@@ -12,6 +12,12 @@ export interface CliApiOptions extends RequestInit {
     preloadedProfile?: ActiveProfile;
     /** Disable process.exit for tests. */
     noExitOnError?: boolean;
+    /**
+     * Surface raw error bodies on 5xx instead of the generic "temporarily
+     * unavailable" message. Caller should pass true when --json / --show-sql
+     * / any verbose flag is set. GURULU_DEBUG=1 also forces verbose globally.
+     */
+    verbose?: boolean;
 }
 export declare class CliApiError extends Error {
     status: number;

package/dist/api-client.js

@@ -129,6 +129,31 @@ async function cliApi(path, init = {}) {
         fatal(`Rate limited by Gurulu${retry ? ` — try again in ${retry}s` : ''}. Try again shortly.`, init);
     }
     if (res.status >= 500) {
+        const verbose = init.verbose === true || process.env.GURULU_DEBUG === '1';
+        if (verbose) {
+            let detail = '';
+            try {
+                const body = await res.clone().json();
+                const msg = body?.error || body?.message;
+                if (msg) {
+                    detail = ` ${typeof msg === 'string' ? msg : JSON.stringify(msg)}`;
+                }
+                else {
+                    detail = ` ${JSON.stringify(body)}`;
+                }
+            }
+            catch {
+                try {
+                    const txt = await res.clone().text();
+                    if (txt)
+                        detail = ` ${txt.slice(0, 500)}`;
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            fatal(`Gurulu is temporarily unavailable (HTTP ${res.status}).${detail}`, init);
+        }
         fatal(`Gurulu is temporarily unavailable (HTTP ${res.status}).`, init);
     }
     return res;

package/dist/commands/auth.js

@@ -54,22 +54,38 @@ const login_1 = require("./login");
 const config_1 = require("../config");
 const api_client_1 = require("../api-client");
 const ui_1 = require("../utils/ui");
+function isHeadless() {
+    if (!process.stdout.isTTY)
+        return true;
+    if (process.env.SSH_CLIENT || process.env.SSH_TTY || process.env.SSH_CONNECTION)
+        return true;
+    if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
 function tryOpenBrowser(url) {
     const platform = process.platform;
     const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open';
+    // On Windows the URL goes as a positional after an empty title arg to `start`.
+    const args = platform === 'win32' ? ['', url] : [url];
     try {
-        const child = (0, child_process_1.spawn)(cmd, [url], {
+        const child = (0, child_process_1.spawn)(cmd, args, {
             detached: true,
             stdio: 'ignore',
             shell: platform === 'win32',
         });
+        let errored = false;
         child.on('error', () => {
-            /* ignore — fall back to manual */
+            errored = true;
         });
         child.unref();
+        // spawn() returns synchronously; if the binary is missing on PATH we'll
+        // catch the synchronous throw below. The async 'error' handler covers
+        // post-fork failures but we can't await it here without blocking the flow.
+        return !errored;
     }
     catch {
-        /* ignore — we printed the URL already */
+        return false;
     }
 }
 function sleep(ms) {
@@ -121,8 +137,17 @@ async function authCommand(args) {
     console.log(`  ${(0, ui_1.dim)('Visit:')}         ${verifyUrl}`);
     console.log(`  ${(0, ui_1.dim)('Device:')}        CLI — ${deviceLabel}`);
     console.log('');
-    if (!args.noBrowser) {
-        tryOpenBrowser(verifyUrl);
+    if (args.noBrowser) {
+        (0, ui_1.info)(`Open this URL manually: ${verifyUrl}`);
+    }
+    else if (isHeadless()) {
+        (0, ui_1.info)(`Headless/SSH session detected — open this URL on another device: ${verifyUrl}`);
+    }
+    else {
+        const opened = tryOpenBrowser(verifyUrl);
+        if (!opened) {
+            (0, ui_1.info)(`Could not auto-open the browser. Open this URL manually: ${verifyUrl}`);
+        }
     }
     const expiresAtMs = new Date(expiresAt).getTime();
     const interval = Math.max(1000, pollIntervalMs || 2000);
@@ -195,16 +220,26 @@ async function authCommand(args) {
         process.exit(1);
     }
     const fullKey = approved.secretKey.fullKey;
+    const userRequestedKeychain = args.useKeychain === true;
+    const keychainAvailable = (0, config_1.isKeychainAvailable)();
+    if (userRequestedKeychain && !keychainAvailable) {
+        (0, ui_1.warn)('Keychain requested via --keychain but the optional `keytar` module is not installed. ' +
+            'Falling back to plaintext storage in ~/.gurulu/config.json. ' +
+            'Install `keytar` (`npm i -g keytar`) or unset --keychain to silence this warning.');
+    }
     const { storedInKeychain } = await (0, config_1.saveProfile)(profileName, {
         email: `cli-${deviceLabel}@gurulu.local`,
         secret_key: fullKey,
         api_base: apiBase,
-    }, { useKeychain: args.useKeychain ?? (0, config_1.isKeychainAvailable)() });
+    }, { useKeychain: args.useKeychain ?? keychainAvailable });
     const tail = fullKey.slice(-6);
     (0, ui_1.success)(`Device paired. Key …${tail} saved to profile "${profileName}".`);
     if (storedInKeychain) {
         (0, ui_1.info)(`  Stored in macOS Keychain (${(0, ui_1.dim)('io.gurulu.cli')})`);
     }
+    else if (userRequestedKeychain) {
+        (0, ui_1.info)(`  Stored in plaintext at ~/.gurulu/config.json (keychain unavailable).`);
+    }
     if (approved.secretKey.expiresAt) {
         (0, ui_1.info)(`  Expires: ${approved.secretKey.expiresAt}`);
     }

package/dist/commands/chat.d.ts

@@ -14,5 +14,6 @@ export interface ChatArgs {
     showSql?: boolean;
     profile?: string;
     context?: string;
+    site?: string;
 }
 export declare function chatCommand(args: ChatArgs): Promise<void>;

package/dist/commands/chat.js

@@ -54,6 +54,7 @@ async function askQuestion(question, args) {
         json: {
             question,
             context: args.context,
+            ...(args.site ? { siteId: args.site } : {}),
         },
     });
 }

package/dist/commands/doctor.js

@@ -23,6 +23,9 @@ async function doctorCommand(args) {
     const checks = [];
     // 1. Framework detection
     const framework = (0, detect_1.detectFramework)(projectDir);
+    // If the user explicitly passed --site, the cwd-derived checks should not
+    // imply that the *production site* is broken — they're informational only.
+    const isLocalProjectDetected = framework !== 'unknown';
     checks.push({
         name: 'Framework Detection',
         status: framework !== 'unknown' ? 'pass' : 'warn',
@@ -30,6 +33,7 @@ async function doctorCommand(args) {
             ? `Detected ${(0, detect_1.getFrameworkDisplayName)(framework)}`
             : 'Could not detect framework',
         fix: framework === 'unknown' ? 'Run "gurulu init --framework <name>" to specify manually' : undefined,
+        section: 'local',
     });
     // 2. SDK installed
     const pkgPath = path_1.default.join(projectDir, 'package.json');
@@ -78,18 +82,35 @@ async function doctorCommand(args) {
                     : hasAndroidSDK ? 'Android SDK found in build.gradle'
                         : setupFiles.length > 0 ? `Setup file found: ${setupFiles[0]}`
                             : 'No client SDK detected';
+    // When --site was passed but cwd is not a Gurulu project, downgrade local
+    // SDK failures to "skip" so they don't masquerade as production-site issues.
+    const localChecksAreInformational = !!siteId && !isLocalProjectDetected;
     checks.push({
         name: 'Client SDK',
-        status: hasSetup ? 'pass' : 'fail',
-        message: sdkLabel,
-        fix: !hasSetup ? 'Run "gurulu init" to set up analytics' : undefined,
+        status: hasSetup ? 'pass' : localChecksAreInformational ? 'skip' : 'fail',
+        message: hasSetup
+            ? sdkLabel
+            : localChecksAreInformational
+                ? 'No client SDK detected in this directory (informational — site checks below)'
+                : sdkLabel,
+        fix: !hasSetup && !localChecksAreInformational
+            ? 'Run "gurulu init" to set up analytics'
+            : undefined,
+        section: 'local',
     });
     // 3. Server SDK
     checks.push({
         name: 'Server SDK',
-        status: hasNodeSDK ? 'pass' : 'warn',
-        message: hasNodeSDK ? '@gurulu/node installed' : 'Server SDK not installed (optional)',
-        fix: !hasNodeSDK ? 'Run "gurulu add-server" for server-side tracking' : undefined,
+        status: hasNodeSDK ? 'pass' : localChecksAreInformational ? 'skip' : 'warn',
+        message: hasNodeSDK
+            ? '@gurulu/node installed'
+            : localChecksAreInformational
+                ? 'Server SDK check skipped (no local project detected)'
+                : 'Server SDK not installed (optional)',
+        fix: !hasNodeSDK && !localChecksAreInformational
+            ? 'Run "gurulu add-server" for server-side tracking'
+            : undefined,
+        section: 'local',
     });
     // 4. Site ID configured
     checks.push({
@@ -263,6 +284,7 @@ async function doctorCommand(args) {
             status: envHasSiteId ? 'pass' : 'warn',
             message: envHasSiteId ? 'Site ID found in env file' : 'No GURULU_SITE_ID in env files',
             fix: !envHasSiteId ? 'Run "gurulu init" to auto-configure .env.local' : undefined,
+            section: 'local',
         });
     }
     // Output
@@ -281,16 +303,36 @@ async function doctorCommand(args) {
     };
     let failCount = 0;
     let warnCount = 0;
-    for (const check of checks) {
-        const icon = icons[check.status];
-        console.log(`  ${icon} ${(0, ui_1.bold)(check.name)}: ${check.message}`);
-        if (check.fix) {
-            console.log(`    ${(0, ui_1.dim)('\u2192')} ${(0, ui_1.dim)(check.fix)}`);
+    const localChecks = checks.filter((c) => c.section === 'local');
+    const siteChecks = checks.filter((c) => c.section !== 'local');
+    const printGroup = (title, items, note) => {
+        if (items.length === 0)
+            return;
+        console.log(`  ${(0, ui_1.bold)(title)}`);
+        if (note)
+            console.log(`  ${(0, ui_1.dim)(note)}`);
+        for (const check of items) {
+            const icon = icons[check.status];
+            console.log(`    ${icon} ${(0, ui_1.bold)(check.name)}: ${check.message}`);
+            if (check.fix) {
+                console.log(`      ${(0, ui_1.dim)('\u2192')} ${(0, ui_1.dim)(check.fix)}`);
+            }
+            if (check.status === 'fail')
+                failCount++;
+            if (check.status === 'warn')
+                warnCount++;
         }
-        if (check.status === 'fail')
-            failCount++;
-        if (check.status === 'warn')
-            warnCount++;
+        console.log('');
+    };
+    if (localChecks.length > 0) {
+        const localNote = siteId && !isLocalProjectDetected
+            ? `(Local project not detected \u2014 running site-only checks for ${siteId}.)`
+            : undefined;
+        printGroup('Local Project', localChecks, localNote);
+    }
+    if (siteChecks.length > 0) {
+        const siteTitle = siteId ? `Site (${siteId})` : 'Site';
+        printGroup(siteTitle, siteChecks);
     }
     console.log('');
     if (failCount === 0 && warnCount === 0) {

package/dist/commands/events.js

@@ -76,10 +76,10 @@ async function listCmd(args) {
     process.stdout.write(['TS', 'EVENT', 'SITE', 'URL'].join('\t') + '\n');
     for (const e of events) {
         process.stdout.write([
-            String(e.event_ts || '-'),
+            String(e.timestamp || e.event_ts || '-'),
             String(e.event_name || '-'),
             String(e.site_id || '-'),
-            String(e.url || '-').slice(0, 60),
+            String(e.page_url || e.url || '-').slice(0, 60),
         ].join('\t') + '\n');
     }
 }
@@ -248,11 +248,33 @@ async function verifyCmd(args) {
         console.log(`Unique event types: ${data.unique_types ?? 'N/A'}`);
     }
     else {
-        // Empty: no telemetry yet for the requested filter / definition. Without
-        // this branch the report printed only its header — users couldn't tell
-        // success from "no data found".
+        // Phase 33 P33-WA — three-state empty output instead of one generic
+        // "no telemetry yet" message. Helps the user tell apart "definition
+        // exists but never matched" vs "definition missing entirely" vs "no
+        // events at all on this site". Definition lookup is best-effort
+        // (extra HTTP call) so a 4xx falls through to the legacy message.
         if (filterEvent) {
-            (0, ui_1.info)(`No telemetry yet for "${filterEvent}". Track it from your app and run verify again.`);
+            let definitionExists = null;
+            try {
+                const defs = await (0, api_client_1.cliApiJson)(`/api/cli/events/definitions?siteId=${encodeURIComponent(args.site)}`, { profile: args.profile });
+                definitionExists = Array.isArray(defs.definitions)
+                    && defs.definitions.some((d) => d.eventName === filterEvent);
+            }
+            catch {
+                // best-effort — fall through to legacy message
+            }
+            if (definitionExists === true) {
+                (0, ui_1.info)(`✓ "${filterEvent}" is registered (catalog has it) but no telemetry has matched in the last 24h.`);
+                (0, ui_1.info)(`  Likely cause: SDK hasn't fired this event yet. Check your client code and run verify again.`);
+            }
+            else if (definitionExists === false) {
+                (0, ui_1.info)(`⚠ "${filterEvent}" is NOT registered yet (no CustomEventDefinition row).`);
+                (0, ui_1.info)(`  Phase 32 auto-registers on first sight, but you can also run:`);
+                (0, ui_1.info)(`  gurulu events define --site ${args.site} --event-name ${filterEvent} --display-name "..."`);
+            }
+            else {
+                (0, ui_1.info)(`No telemetry yet for "${filterEvent}". Track it from your app and run verify again.`);
+            }
         }
         else {
             (0, ui_1.info)('No telemetry data found for this site in the last 24h.');

package/dist/commands/insights.js

@@ -20,6 +20,18 @@ async function insightsCommand(args) {
             process.exit(1);
     }
 }
+function formatHighlight(h) {
+    if (typeof h === 'string')
+        return h;
+    if (h && typeof h === 'object') {
+        const o = h;
+        const arrow = o.trend === 'up' ? '↑' : o.trend === 'down' ? '↓' : '→';
+        const value = typeof o.value === 'number' ? o.value.toLocaleString() : String(o.value ?? '');
+        const delta = typeof o.delta === 'number' ? ` (${o.delta >= 0 ? '+' : ''}${o.delta.toFixed(1)}% ${arrow})` : '';
+        return `${o.label ?? 'metric'}: ${value}${delta}`;
+    }
+    return String(h);
+}
 async function todayCmd(args) {
     try {
         const body = await (0, api_client_1.cliApiJson)('/api/cli/insights', {
@@ -35,7 +47,7 @@ async function todayCmd(args) {
         if (Array.isArray(i.highlights)) {
             process.stdout.write(`Highlights:\n`);
             for (const h of i.highlights)
-                process.stdout.write(`  - ${h}\n`);
+                process.stdout.write(`  - ${formatHighlight(h)}\n`);
         }
     }
     catch (err) {

package/dist/commands/setup.d.ts

@@ -0,0 +1,21 @@
+/**
+ * 2026-05-05 DF-5 — `gurulu setup --vertical saas` zero-friction lifecycle.
+ *
+ * Tek komutta:
+ *   - vertical event taxonomy'sini define et (idempotent)
+ *   - default funnel'ları kur
+ *   - acquisition + revenue + retention event'lerine goal bağla
+ *
+ * 23 ayrı komut yerine 1.
+ */
+export interface SetupArgs {
+    vertical?: string;
+    site?: string;
+    includeFunnels?: boolean;
+    includeGoals?: boolean;
+    dryRun?: boolean;
+    json?: boolean;
+    yes?: boolean;
+    profile?: string;
+}
+export declare function setupCommand(args: SetupArgs): Promise<void>;

package/dist/commands/setup.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * 2026-05-05 DF-5 — `gurulu setup --vertical saas` zero-friction lifecycle.
+ *
+ * Tek komutta:
+ *   - vertical event taxonomy'sini define et (idempotent)
+ *   - default funnel'ları kur
+ *   - acquisition + revenue + retention event'lerine goal bağla
+ *
+ * 23 ayrı komut yerine 1.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCommand = setupCommand;
+const api_client_1 = require("../api-client");
+const ui_1 = require("../utils/ui");
+async function setupCommand(args) {
+    const vertical = (args.vertical || '').toLowerCase().trim();
+    if (!vertical) {
+        (0, ui_1.error)('--vertical required (e.g. saas, ecommerce, marketplace, fintech, healthcare, education, media, igaming, generic)');
+        process.exitCode = 1;
+        return;
+    }
+    if (!args.site) {
+        (0, ui_1.error)('--site required');
+        process.exitCode = 1;
+        return;
+    }
+    const path = '/api/cli/setup/apply-template' + (args.dryRun ? '?dry_run=1' : '');
+    const body = {
+        siteId: args.site,
+        vertical,
+        includeFunnels: args.includeFunnels !== false,
+        includeGoals: args.includeGoals !== false,
+    };
+    try {
+        const res = await (0, api_client_1.cliApiJson)(path, {
+            profile: args.profile,
+            method: 'POST',
+            json: body,
+        });
+        if (args.json) {
+            process.stdout.write(JSON.stringify(res, null, 2) + '\n');
+            return;
+        }
+        if ('dryRun' in res && res.dryRun) {
+            const a = res.after;
+            (0, ui_1.info)(`Dry-run preview — ${a.vertical} lifecycle taxonomy:`);
+            process.stdout.write(`\n  Events  (${a.events.length}): ${a.events.join(', ')}\n`);
+            process.stdout.write(`  Funnels (${a.funnels.length}): ${a.funnels.join(', ')}\n`);
+            process.stdout.write(`  Goals   (${a.goals.length}): ${a.goals.join(', ')}\n\n`);
+            (0, ui_1.info)('Re-run without --dry-run to apply.');
+            return;
+        }
+        const r = res;
+        (0, ui_1.success)(`Applied ${r.vertical} lifecycle taxonomy to site ${args.site}`);
+        process.stdout.write(`  Events:  ${r.events.created.length} created, ${r.events.skipped.length} skipped\n`);
+        process.stdout.write(`  Funnels: ${r.funnels.created.length} created, ${r.funnels.skipped.length} skipped\n`);
+        process.stdout.write(`  Goals:   ${r.goals.created.length} created, ${r.goals.skipped.length} skipped\n`);
+        if (r.events.created.length) {
+            process.stdout.write(`\n  New events: ${r.events.created.join(', ')}\n`);
+        }
+    }
+    catch (err) {
+        (0, ui_1.error)(`Setup failed: ${err?.message ?? String(err)}`);
+        process.exitCode = 1;
+    }
+}

package/dist/commands/whoami.js

@@ -31,7 +31,10 @@ async function whoamiCommand(args) {
         const sites = (me.sites || []).length;
         const keys = (me.apiKeys || []).length;
         const installs = me.quota?.installsThisMonth ?? 0;
-        const limit = me.quota?.installsLimit ?? '∞';
+        const rawLimit = me.quota?.installsLimit;
+        const limit = rawLimit === -1 || rawLimit === null || rawLimit === undefined
+            ? 'unlimited'
+            : rawLimit;
         process.stdout.write(`${me.user?.email} · ${me.tenant?.name} · ${me.tenant?.plan} plan · ${me.tenant?.id}\n`);
         process.stdout.write(`Sites: ${sites} | API keys: ${keys} | Installs this month: ${installs}/${limit}\n`);
     }

package/dist/frameworks/detect.js

@@ -232,26 +232,33 @@ export function initGurulu() {
         case 'express':
             return {
                 file: 'src/gurulu.ts',
-                code: `// Gurulu.io Server Analytics
+                code: `// Gurulu.io Server Analytics — Phase 32 P32-A2 fix
+// Use the @gurulu/node SDK so retry, identity propagation, and the
+// correct ingest endpoint (/api/ingest/v1/server) are handled for you.
+//   npm install @gurulu/node
+import { Gurulu } from '@gurulu/node';
 import type { Request, Response, NextFunction } from 'express';
 
-const SITE_ID = '${siteId}';
-const TOKEN = '${token}';
+export const gurulu = new Gurulu({
+  siteId: '${siteId}',
+  token: '${token}',
+  endpoint: 'https://gurulu.io',
+});
 
 export function guruluMiddleware(req: Request, res: Response, next: NextFunction) {
-  // Track server-side pageview
-  fetch('https://ingest.gurulu.io/api/events', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + TOKEN },
-    body: JSON.stringify({
-      site_id: SITE_ID,
-      event: 'pageview',
+  // Identity propagation: read the anonymous_id the browser SDK set in a
+  // cookie / header so server-side events stitch onto the same user.
+  const anonymousId = (req.headers['x-gurulu-anonymous-id'] as string)
+    || (req.cookies?._gurulu_id as string)
+    || undefined;
+  gurulu.track({
+    eventName: 'pageview',
+    anonymousId,
+    properties: {
       url: req.originalUrl,
       referrer: req.headers.referer || '',
       user_agent: req.headers['user-agent'] || '',
-      ip: req.ip,
-      timestamp: new Date().toISOString(),
-    }),
+    },
   }).catch(() => {});
   next();
 }`,
@@ -260,26 +267,28 @@ export function guruluMiddleware(req: Request, res: Response, next: NextFunction
         case 'fastify':
             return {
                 file: 'src/gurulu.ts',
-                code: `// Gurulu.io Server Analytics — Fastify plugin
+                code: `// Gurulu.io Server Analytics — Fastify plugin (Phase 32 P32-A2 fix)
+//   npm install @gurulu/node
+import { Gurulu } from '@gurulu/node';
 import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 
-const SITE_ID = '${siteId}';
-const TOKEN = '${token}';
+export const gurulu = new Gurulu({
+  siteId: '${siteId}',
+  token: '${token}',
+  endpoint: 'https://gurulu.io',
+});
 
 export async function guruluPlugin(fastify: FastifyInstance) {
   fastify.addHook('onRequest', async (req: FastifyRequest, _reply: FastifyReply) => {
-    fetch('https://ingest.gurulu.io/api/events', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + TOKEN },
-      body: JSON.stringify({
-        site_id: SITE_ID,
-        event: 'pageview',
+    const anonymousId = (req.headers['x-gurulu-anonymous-id'] as string) || undefined;
+    gurulu.track({
+      eventName: 'pageview',
+      anonymousId,
+      properties: {
         url: req.url,
         referrer: (req.headers.referer as string) || '',
         user_agent: (req.headers['user-agent'] as string) || '',
-        ip: req.ip,
-        timestamp: new Date().toISOString(),
-      }),
+      },
     }).catch(() => {});
   });
 }`,
@@ -288,24 +297,27 @@ export async function guruluPlugin(fastify: FastifyInstance) {
         case 'hono':
             return {
                 file: 'src/gurulu.ts',
-                code: `// Gurulu.io Server Analytics — Hono middleware
+                code: `// Gurulu.io Server Analytics — Hono middleware (Phase 32 P32-A2 fix)
+//   npm install @gurulu/node
+import { Gurulu } from '@gurulu/node';
 import type { MiddlewareHandler } from 'hono';
 
-const SITE_ID = '${siteId}';
-const TOKEN = '${token}';
+export const gurulu = new Gurulu({
+  siteId: '${siteId}',
+  token: '${token}',
+  endpoint: 'https://gurulu.io',
+});
 
 export const guruluMiddleware: MiddlewareHandler = async (c, next) => {
-  fetch('https://ingest.gurulu.io/api/events', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + TOKEN },
-    body: JSON.stringify({
-      site_id: SITE_ID,
-      event: 'pageview',
+  const anonymousId = c.req.header('x-gurulu-anonymous-id') || undefined;
+  gurulu.track({
+    eventName: 'pageview',
+    anonymousId,
+    properties: {
       url: c.req.url,
       referrer: c.req.header('referer') || '',
       user_agent: c.req.header('user-agent') || '',
-      timestamp: new Date().toISOString(),
-    }),
+    },
   }).catch(() => {});
   await next();
 };`,
@@ -314,28 +326,30 @@ export const guruluMiddleware: MiddlewareHandler = async (c, next) => {
         case 'nestjs':
             return {
                 file: 'src/gurulu.middleware.ts',
-                code: `// Gurulu.io Server Analytics Middleware
+                code: `// Gurulu.io Server Analytics Middleware (Phase 32 P32-A2 fix)
+//   npm install @gurulu/node
 import { Injectable, NestMiddleware } from '@nestjs/common';
 import { Request, Response, NextFunction } from 'express';
+import { Gurulu } from '@gurulu/node';
 
-const SITE_ID = '${siteId}';
-const TOKEN = '${token}';
+const gurulu = new Gurulu({
+  siteId: '${siteId}',
+  token: '${token}',
+  endpoint: 'https://gurulu.io',
+});
 
 @Injectable()
 export class GuruluMiddleware implements NestMiddleware {
   use(req: Request, res: Response, next: NextFunction) {
-    fetch('https://ingest.gurulu.io/api/events', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + TOKEN },
-      body: JSON.stringify({
-        site_id: SITE_ID,
-        event: 'pageview',
+    const anonymousId = (req.headers['x-gurulu-anonymous-id'] as string) || undefined;
+    gurulu.track({
+      eventName: 'pageview',
+      anonymousId,
+      properties: {
         url: req.originalUrl,
         referrer: req.headers.referer || '',
         user_agent: req.headers['user-agent'] || '',
-        ip: req.ip,
-        timestamp: new Date().toISOString(),
-      }),
+      },
     }).catch(() => {});
     next();
   }

package/dist/index.js

@@ -38,6 +38,8 @@ const funnels_1 = require("./commands/funnels");
 const heatmap_1 = require("./commands/heatmap");
 // Gurulu Chat — NL → SQL analytics
 const chat_1 = require("./commands/chat");
+// 2026-05-05 DF-5 — zero-friction lifecycle setup
+const setup_1 = require("./commands/setup");
 // Error tracking — source map upload
 const sourcemap_1 = require("./commands/sourcemap");
 // Phase 21 — database connect
@@ -99,7 +101,7 @@ const secrets_1 = require("./commands/secrets");
     .option('key', { type: 'string', describe: 'Secret key (gsk_live_... or gsk_test_...) — legacy manual flow' })
     .option('email', { type: 'string', describe: 'Email address (legacy flow)' })
     .option('secret-key', { type: 'string', describe: 'Secret key (legacy flow alias for --key)' })
-    .option('no-browser', { type: 'boolean', describe: 'Do not auto-open the browser' })
+    .option('browser', { type: 'boolean', default: true, describe: 'Auto-open the browser (use --no-browser to disable)' })
     .option('no-interactive', { type: 'boolean', describe: 'Non-interactive mode (legacy flow)' })
     .option('keychain', { type: 'boolean', describe: 'Store secret in macOS Keychain if available' })
     .option('api-base', { type: 'string', describe: 'Override API base URL' }), (args) => (0, auth_1.authCommand)({
@@ -110,7 +112,7 @@ const secrets_1 = require("./commands/secrets");
     noInteractive: args['no-interactive'],
     useKeychain: args.keychain,
     apiBase: args['api-base'],
-    noBrowser: args['no-browser'],
+    noBrowser: args.browser === false ? true : undefined,
 }))
     .command('logout', 'Remove a stored profile', (y) => y
     .option('all', { type: 'boolean', describe: 'Remove all profiles' })
@@ -619,24 +621,45 @@ const secrets_1 = require("./commands/secrets");
     format: args.format,
     json: args.json,
     profile: args.profile,
+}))
+    // ── 2026-05-05 DF-5 — zero-friction lifecycle setup ──────────────────
+    .command('setup', 'Apply a vertical lifecycle taxonomy (events + funnels + goals) in one shot', (y) => y
+    .option('vertical', {
+    type: 'string',
+    describe: 'saas | ecommerce | marketplace | fintech | healthcare | education | media | igaming | generic',
+})
+    .option('site', { type: 'string', describe: 'Site ID' })
+    .option('include-funnels', { type: 'boolean', default: true, describe: 'Also create funnels' })
+    .option('include-goals', { type: 'boolean', default: true, describe: 'Also create goals' })
+    .option('dry-run', { type: 'boolean', describe: 'Preview without writing' })
+    .option('json', { type: 'boolean', describe: 'JSON output' }), (args) => (0, setup_1.setupCommand)({
+    vertical: args.vertical,
+    site: args.site,
+    includeFunnels: args['include-funnels'],
+    includeGoals: args['include-goals'],
+    dryRun: args['dry-run'],
+    json: args.json,
+    profile: args.profile,
 }))
     // ── Gurulu Chat — NL → SQL analytics ─────────────────────────────────
     .command('chat [question]', 'Ask analytics questions in natural language (NL → SQL)', (y) => y
     .positional('question', { type: 'string', describe: 'Question to ask (omit for REPL mode)' })
     .option('json', { type: 'boolean', describe: 'Machine-readable JSON output' })
     .option('show-sql', { type: 'boolean', describe: 'Also print the generated SQL' })
-    .option('context', { type: 'string', describe: 'Additional context for the query' }), (args) => (0, chat_1.chatCommand)({
+    .option('context', { type: 'string', describe: 'Additional context for the query' })
+    .option('site', { type: 'string', describe: 'Site ID (overrides profile default)' }), (args) => (0, chat_1.chatCommand)({
     question: args.question,
     json: args.json,
     showSql: args['show-sql'],
     context: args.context,
     profile: args.profile,
+    site: args.site,
 }))
     // ── Error tracking — source map upload ────────────────────────────────
     .command('sourcemap <action>', 'Upload source maps for error deobfuscation (upload). Supports web/server JS .map and native dSYM/ProGuard.', (y) => y
     .positional('action', { type: 'string', describe: 'upload' })
-    .option('release', { type: 'string', describe: 'Release version (e.g. v1.0.0). Web/server only — alias of --version.' })
-    .option('version', { type: 'string', describe: 'App version (e.g. 1.4.2). Required for native uploads.' })
+    .option('release', { type: 'string', describe: 'Release version (e.g. v1.0.0). Web/server only — alias of --app-version.' })
+    .option('app-version', { type: 'string', describe: 'App version (e.g. 1.4.2). Required for native uploads.' })
     .option('dir', { type: 'string', describe: 'Directory containing .map files (web/server)' })
     .option('file', { type: 'string', describe: 'Path to dSYM zip (iOS) or mapping.txt (Android)' })
     .option('bundle-id', { type: 'string', describe: 'iOS bundleId or Android applicationId (native only)' })
@@ -645,7 +668,7 @@ const secrets_1 = require("./commands/secrets");
     .option('json', { type: 'boolean', describe: 'JSON output' }), (args) => (0, sourcemap_1.sourcemapCommand)({
     action: args.action,
     release: args.release,
-    version: args.version,
+    version: args['app-version'],
     dir: args.dir,
     file: args.file,
     bundleId: args['bundle-id'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gurulu/cli",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Gurulu.io CLI — setup analytics in seconds",
   "bin": {
     "gurulu": "bin/gurulu.js"