@pikku/cli 0.12.42 → 0.12.43

package/dist/.pikku/queue/pikku-queue-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Queue-specific type definitions for tree-shaking optimization

package/dist/.pikku/queue/pikku-queue-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Queue-specific type definitions for tree-shaking optimization

package/dist/.pikku/queue/pikku-queue-workers-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { pikkuState } from '@pikku/core/internal';
 import metaData from './pikku-queue-workers-wirings-meta.gen.json' with { type: 'json' };

package/dist/.pikku/queue/pikku-queue-workers-wirings.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import '../../src/scaffold/rpc-remote.gen.js';

package/dist/.pikku/queue/pikku-queue-workers-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /* The files with an addQueueWorkers function call */
 import '../../src/scaffold/rpc-remote.gen.js';

package/dist/.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { pikkuState } from '@pikku/core/internal';
 import metaData from './pikku-rpc-wirings-meta.internal.gen.json' with { type: 'json' };

package/dist/.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.json

@@ -100,11 +100,11 @@
     "pikkuAIAgentTypes": "pikkuAIAgentTypes",
     "pikkuAIAgent": "pikkuAIAgent",
     "pikkuPublicAgent": "pikkuPublicAgent",
-    "pikkuAuth": "pikkuAuth",
     "pikkuChannels": "pikkuChannels",
     "pikkuChannelTypes": "pikkuChannelTypes",
     "pikkuChannelsMap": "pikkuChannelsMap",
     "pikkuCommandChannels": "pikkuCommandChannels",
+    "pikkuAuth": "pikkuAuth",
     "pikkuCLIEntry": "pikkuCLIEntry",
     "pikkuCLI": "pikkuCLI",
     "pikkuConsoleFunctions": "pikkuConsoleFunctions",
@@ -136,12 +136,12 @@
     "pikkuEventsScaffold": "pikkuEventsScaffold",
     "pikkuSchedulerTypes": "pikkuSchedulerTypes",
     "pikkuScheduler": "pikkuScheduler",
+    "pikkuSecrets": "pikkuSecrets",
     "pikkuPublicRPC": "pikkuPublicRPC",
     "pikkuRemoteRPC": "pikkuRemoteRPC",
     "pikkuRPCInternalMap": "pikkuRPCInternalMap",
     "pikkuRPCExposedMap": "pikkuRPCExposedMap",
     "pikkuRPC": "pikkuRPC",
-    "pikkuSecrets": "pikkuSecrets",
     "pikkuTriggerTypes": "pikkuTriggerTypes",
     "pikkuTrigger": "pikkuTrigger",
     "pikkuVariables": "pikkuVariables",

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/schemas/register.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { addSchema } from '@pikku/core/schema';
 import * as PikkuSchemasOutput from './schemas/PikkuSchemasOutput.schema.json' with { type: 'json' };
@@ -202,14 +202,14 @@ import * as PikkuConsoleFunctionsOutput from './schemas/PikkuConsoleFunctionsOut
 addSchema('PikkuConsoleFunctionsOutput', PikkuConsoleFunctionsOutput);
 import * as PikkuNodesMetaOutput from './schemas/PikkuNodesMetaOutput.schema.json' with { type: 'json' };
 addSchema('PikkuNodesMetaOutput', PikkuNodesMetaOutput);
-import * as PikkuGatewayOutput from './schemas/PikkuGatewayOutput.schema.json' with { type: 'json' };
-addSchema('PikkuGatewayOutput', PikkuGatewayOutput);
 import * as PikkuFunctionTypesSplitInput from './schemas/PikkuFunctionTypesSplitInput.schema.json' with { type: 'json' };
 addSchema('PikkuFunctionTypesSplitInput', PikkuFunctionTypesSplitInput);
 import * as PikkuFunctionTypesInput from './schemas/PikkuFunctionTypesInput.schema.json' with { type: 'json' };
 addSchema('PikkuFunctionTypesInput', PikkuFunctionTypesInput);
 import * as PikkuFunctionsOutput from './schemas/PikkuFunctionsOutput.schema.json' with { type: 'json' };
 addSchema('PikkuFunctionsOutput', PikkuFunctionsOutput);
+import * as PikkuGatewayOutput from './schemas/PikkuGatewayOutput.schema.json' with { type: 'json' };
+addSchema('PikkuGatewayOutput', PikkuGatewayOutput);
 import * as PikkuCommandHTTPOutput from './schemas/PikkuCommandHTTPOutput.schema.json' with { type: 'json' };
 addSchema('PikkuCommandHTTPOutput', PikkuCommandHTTPOutput);
 import * as PikkuHTTPOutput from './schemas/PikkuHTTPOutput.schema.json' with { type: 'json' };

package/dist/.pikku/schemas/schemas/DeployApplyInput.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "fromPlan": { "type": "boolean" }, "provider": { "type": "string" }, "resultFile": { "type": "string" } }, "additionalProperties": false, "definitions": {} }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "fromPlan": { "type": "boolean" }, "provider": { "type": "string" }, "resultFile": { "type": "string" }, "debugArtifacts": { "type": "boolean" } }, "additionalProperties": false, "definitions": {} }

package/dist/.pikku/schemas/schemas/DeployPlanInput.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "resultFile": { "type": "string" }, "provider": { "type": "string" } }, "additionalProperties": false, "definitions": {} }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "resultFile": { "type": "string" }, "provider": { "type": "string" }, "debugArtifacts": { "type": "boolean" } }, "additionalProperties": false, "definitions": {} }

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 export { wireSecret } from '@pikku/core/secret';
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 export { wireSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 const CREDENTIALS_META = {};

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 export { wireVariable } from '@pikku/core/variable';
 export type { CoreVariable, VariableDefinitionMeta, VariableDefinitionsMeta } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 export { wireVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 const VARIABLES_META = {};

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { template } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { pikkuState } from '@pikku/core/internal';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.42') {
-      process.stderr.write(`\n  Update available  0.12.42 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.43') {
+      process.stderr.write(`\n  Update available  0.12.43 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/deploy/build-pipeline.d.ts

@@ -38,5 +38,7 @@ export declare function runBuildPipeline(options: {
     getEntryContext: (unitDir: string, pikkuDir: string, unit: DeploymentManifest['units'][0], state: InspectorState) => unknown;
     deployDir?: string;
     outDir?: string;
+    /** Emit sourcemaps + per-unit `metafile.json` (debug-only). Default false. */
+    debugArtifacts?: boolean;
     logger: BuildLogger;
 }): Promise<BuildPipelineResult>;

package/dist/src/deploy/build-pipeline.js

@@ -38,7 +38,7 @@ function findLockfile(projectDir) {
     return null;
 }
 export async function runBuildPipeline(options) {
-    const { projectDir, projectId, provider, inspectorState, getEntryContext, logger, } = options;
+    const { projectDir, projectId, provider, inspectorState, getEntryContext, debugArtifacts, logger, } = options;
     const deployDir = options.deployDir ?? join(projectDir, '.deploy');
     const providerDir = join(deployDir, provider.deployDirName);
     // Step 1: Analyze
@@ -86,6 +86,8 @@ export async function runBuildPipeline(options) {
             platform: provider.getPlatform?.(),
             format: provider.getFormat?.(),
             noRequireShim: provider.getNoRequireShim?.(),
+            sourcemap: debugArtifacts,
+            emitMetafile: debugArtifacts,
         });
         bundled = bundleResult.results;
         bundleErrors = bundleResult.errors;
@@ -209,6 +211,8 @@ export async function runBuildPipeline(options) {
                 platform: provider.getPlatform?.(),
                 format: provider.getFormat?.(),
                 noRequireShim: provider.getNoRequireShim?.(),
+                sourcemap: debugArtifacts,
+                emitMetafile: debugArtifacts,
                 resolveOutputDir: (unit) => join(unitsDir, unit.name),
             });
             aggregated.push(...result.results);
@@ -231,6 +235,8 @@ export async function runBuildPipeline(options) {
                 platform: 'node',
                 format: 'esm',
                 noRequireShim: false,
+                sourcemap: debugArtifacts,
+                emitMetafile: debugArtifacts,
                 resolveOutputDir: () => containerDir,
             });
             aggregated.push(...result.results);

package/dist/src/deploy/bundler/bundler.d.ts

@@ -28,5 +28,7 @@ export declare function bundleUnits(projectDir: string, manifest: DeploymentMani
     platform?: 'node' | 'neutral' | 'browser';
     format?: 'esm' | 'cjs';
     noRequireShim?: boolean;
+    sourcemap?: boolean;
+    emitMetafile?: boolean;
     resolveOutputDir?: (unit: DeploymentUnit, baseOutputDir: string) => string;
 }): Promise<BundleOutput>;

package/dist/src/deploy/bundler/bundler.js

@@ -81,7 +81,7 @@ const EXACT_DEPENDENCIES_FILENAME = 'exact-dependencies.json';
  * - package.json: Minimal manifest with only the external deps this unit needs
  */
 async function bundleUnit(options) {
-    const { unit, entryPath, unitOutputDir, projectDir, externals, aliases, define, platform, format, } = options;
+    const { unit, entryPath, unitOutputDir, projectDir, externals, aliases, define, platform, format, sourcemap, emitMetafile, } = options;
     await mkdir(unitOutputDir, { recursive: true });
     const bundlePath = join(unitOutputDir, BUNDLE_FILENAME);
     const metafilePath = join(unitOutputDir, METAFILE_FILENAME);
@@ -133,7 +133,7 @@ async function bundleUnit(options) {
         target: 'es2022',
         outfile: bundlePath,
         minify: false,
-        sourcemap: true,
+        sourcemap: sourcemap ?? false,
         logLevel: 'warning',
         loader: { '.ts': 'ts' },
         external: externals ?? ['node:*'],
@@ -141,9 +141,12 @@ async function bundleUnit(options) {
         define,
         plugins: [createDeadModuleStubPlugin(deadPatterns)],
     });
-    // Write metafile
-    const metafileJson = JSON.stringify(result.metafile, null, 2);
-    await writeFile(metafilePath, metafileJson, 'utf-8');
+    // Always produced in-memory (drives dependency extraction); only persisted
+    // when requested — it's large (~1.6MB/unit) and never needed at runtime.
+    if (emitMetafile) {
+        const metafileJson = JSON.stringify(result.metafile, null, 2);
+        await writeFile(metafilePath, metafileJson, 'utf-8');
+    }
     // Extract dependencies and generate minimal package.json
     const { exactDependencies, exactOptionalDependencies } = await extractDependencies(result.metafile, projectDir);
     const packageJson = generateMinimalPackageJson(unit.name, exactDependencies, exactOptionalDependencies);

package/dist/src/functions/commands/deploy-apply.d.ts

@@ -11,12 +11,15 @@ export declare const deployApply: import("#pikku").PikkuFunctionConfig<{
     fromPlan?: boolean;
     provider?: string;
     resultFile?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").PikkuFunctionSessionless<{
     fromPlan?: boolean;
     provider?: string;
     resultFile?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").Services> | import("#pikku").PikkuFunction<{
     fromPlan?: boolean;
     provider?: string;
     resultFile?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").Services>, undefined, undefined>;

package/dist/src/functions/commands/deploy-apply.js

@@ -180,6 +180,7 @@ export const deployApply = pikkuSessionlessFunc({
             serverlessIncompatible: config.deploy?.serverlessIncompatible,
             getEntryContext,
             outDir: config.outDir,
+            debugArtifacts: data?.debugArtifacts ?? false,
             logger,
         });
         if (buildResult.manifest.units.length === 0) {

package/dist/src/functions/commands/deploy-plan.d.ts

@@ -1,10 +1,13 @@
 export declare const deployPlan: import("#pikku").PikkuFunctionConfig<{
     resultFile?: string;
     provider?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").PikkuFunctionSessionless<{
     resultFile?: string;
     provider?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").Services> | import("#pikku").PikkuFunction<{
     resultFile?: string;
     provider?: string;
+    debugArtifacts?: boolean;
 }, void, "session" | "rpc", import("#pikku").Services>, undefined, undefined>;

package/dist/src/functions/commands/deploy-plan.js

@@ -56,6 +56,7 @@ export const deployPlan = pikkuSessionlessFunc({
             serverlessIncompatible: config.deploy?.serverlessIncompatible,
             getEntryContext,
             outDir: config.outDir,
+            debugArtifacts: data?.debugArtifacts ?? false,
             logger,
         });
         if (result.manifest.units.length === 0) {

package/dist/src/functions/wirings/auth/pikku-command-auth.js

@@ -16,13 +16,18 @@ export const pikkuAuth = pikkuSessionlessFunc({
         // has no OAuth providers — still generates its /auth/* wiring.
         if (!state.auth.definition)
             return;
-        const { wiring, secrets } = serializeAuthGen(state.auth.definition, state.auth.providers, authFile, typesDeclarationFile, packageMappings ?? {});
+        const { wiring, secrets, middleware } = serializeAuthGen(state.auth.definition, state.auth.providers, authFile, typesDeclarationFile, packageMappings ?? {});
         // The secrets file sits alongside authFile so re-inspection rediscovers it.
         // It is kept separate from the wiring file because the CLI forbids Zod
         // schemas and HTTP wiring (wireHTTPRoutes) in the same file (PKU490).
         const secretsFile = join(dirname(authFile), 'auth-secrets.gen.ts');
         await writeFileInDir(logger, authFile, wiring);
         await writeFileInDir(logger, secretsFile, secrets);
+        // Stateless split: session middleware in its own file (see serializeAuthGen).
+        const middlewareFile = join(dirname(authFile), 'auth-middleware.gen.ts');
+        if (middleware) {
+            await writeFileInDir(logger, middlewareFile, middleware);
+        }
         // Static metadata of the enabled providers/plugins for the console SSO page,
         // following the `*-meta.gen.json` convention. Read at runtime by the console
         // getAuthProviders function instead of a runtime registry.

package/dist/src/functions/wirings/auth/serialize-auth-gen.d.ts

@@ -10,10 +10,13 @@ import type { AuthDefinition } from '@pikku/inspector';
  * separated out.
  */
 export interface AuthGenOutput {
-    /** The HTTP wiring file (authFile): handler + catch-all routes + session middleware. */
+    /** Handler + catch-all routes (+ session middleware, unless split out). */
     wiring: string;
     /** The secrets file: Zod schemas + wireSecret/wireVariable. */
     secrets: string;
+    /** Global session-middleware registration, split into its own file only when
+     * `session.cookieCache` is enabled (stateless path); undefined otherwise. */
+    middleware?: string;
 }
 /**
  * Generates the `auth.gen.ts` (HTTP wiring) and `auth-secrets.gen.ts` (schemas +

package/dist/src/functions/wirings/auth/serialize-auth-gen.js

@@ -111,15 +111,20 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
             secrets.push('');
         }
     }
-    // ─── Wiring file: handler + catch-all routes + session middleware ─────────
-    // Provider/plugin metadata for the console SSO page is emitted separately as
-    // `auth-meta.gen.json` (see serializeAuthMeta) rather than wired into the
-    // runtime, so it is available without evaluating the better-auth factory.
+    // Wiring file: handler + catch-all routes. When cookieCache is enabled the
+    // global session middleware is split into its own file (see below) so this
+    // file's auth.wiring import (the full better-auth server) isn't dragged into
+    // every unit — only the auth unit bundles it.
+    const stateless = definition.cookieCache;
     const wiring = [
         '// AUTO-GENERATED by pikku CLI — do not edit',
         '',
-        `import { pikkuSessionlessFunc, wireHTTPRoutes, addHTTPMiddleware } from '${pikkuTypesImportPath}'`,
-        `import { createAuthHandler, betterAuthSession } from '@pikku/better-auth'`,
+        stateless
+            ? `import { pikkuSessionlessFunc, wireHTTPRoutes } from '${pikkuTypesImportPath}'`
+            : `import { pikkuSessionlessFunc, wireHTTPRoutes, addHTTPMiddleware } from '${pikkuTypesImportPath}'`,
+        stateless
+            ? `import { createAuthHandler } from '@pikku/better-auth'`
+            : `import { createAuthHandler, betterAuthSession } from '@pikku/better-auth'`,
         `import '${configImportPath}'`,
         '',
         // createAuthHandler is called once at module load; the exported handler is a
@@ -132,12 +137,13 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
         `    authConfigHandler.func(services, data, interaction),`,
         `})`,
         '',
-        // Bridge the better-auth session into the Pikku session on every request.
-        `addHTTPMiddleware('*', [betterAuthSession()])`,
-        '',
-        `wireHTTPRoutes({`,
-        `  routes: {`,
     ];
+    if (!stateless) {
+        // Stateful: betterAuthSession calls services.auth(), so it stays here with
+        // the auth.wiring import.
+        wiring.push(`addHTTPMiddleware('*', [betterAuthSession()])`, '');
+    }
+    wiring.push(`wireHTTPRoutes({`, `  routes: {`);
     // One catch-all route per method. `{/*splat}` matches both the bare basePath
     // and every sub-path under it, so better-auth's internal router sees the full
     // request and handles all of its own endpoints.
@@ -147,5 +153,23 @@ export const serializeAuthGen = (definition, providers, authFile, typesDeclarati
     wiring.push(`  },`);
     wiring.push(`})`);
     wiring.push('');
-    return { wiring: wiring.join('\n'), secrets: secrets.join('\n') };
+    const output = {
+        wiring: wiring.join('\n'),
+        secrets: secrets.join('\n'),
+    };
+    if (stateless) {
+        // Stateless session middleware in its own file — imports neither auth.wiring
+        // nor the better-auth server, so every unit's bootstrap stays lean.
+        const middleware = [
+            '// AUTO-GENERATED by pikku CLI — do not edit',
+            '',
+            `import { addHTTPMiddleware } from '${pikkuTypesImportPath}'`,
+            `import { betterAuthStatelessSession } from '@pikku/better-auth'`,
+            '',
+            `addHTTPMiddleware('*', [betterAuthStatelessSession()])`,
+            '',
+        ];
+        output.middleware = middleware.join('\n');
+    }
+    return output;
 };

package/dist/src/functions/wirings/functions/pikku-command-services.js

@@ -34,8 +34,9 @@ export const serializeServicesMap = (allSingletonServices, allWireServices, requ
     defaultServices.forEach((service) => usedServices.add(service));
     // When a pikkuBetterAuth factory is present, the generated `pikkuServices`
     // wrapper always injects a resolved `auth` singleton. Mark it required so
-    // RequiredSingletonServices keeps `auth` non-optional and stays assignable
-    // to a SingletonServices type that types `auth` from the factory's return.
+    // RequiredSingletonServices can mark `auth` as a required property and stay
+    // assignable to a SingletonServices type that types `auth` from the
+    // factory's return.
     if (authInjected) {
         usedServices.add('auth');
     }
@@ -79,11 +80,11 @@ export const serializeServicesMap = (allSingletonServices, allWireServices, requ
         '',
         '// Type exports',
         requiredSingletonServiceNames.length > 0
-            ? `export type RequiredSingletonServices = Pick<SingletonServices, ${requiredSingletonServiceNames.map((key) => `'${key}'`).join(' | ')}> & Partial<Omit<SingletonServices, ${requiredSingletonServiceNames.map((key) => `'${key}'`).join(' | ')}>>`
+            ? `export type RequiredSingletonServices = Required<Pick<SingletonServices, ${requiredSingletonServiceNames.map((key) => `'${key}'`).join(' | ')}>> & Partial<Omit<SingletonServices, ${requiredSingletonServiceNames.map((key) => `'${key}'`).join(' | ')}>>`
             : 'export type RequiredSingletonServices = Partial<SingletonServices>',
         '',
         requiredWireServiceNames.length > 0
-            ? `export type RequiredWireServices = Pick<Services, ${requiredWireServiceNames.map((key) => `'${key}'`).join(' | ')}> & Partial<Omit<Services, ${requiredWireServiceNames.map((key) => `'${key}'`).join(' | ')}>>`
+            ? `export type RequiredWireServices = Required<Pick<Services, ${requiredWireServiceNames.map((key) => `'${key}'`).join(' | ')}>> & Partial<Omit<Services, ${requiredWireServiceNames.map((key) => `'${key}'`).join(' | ')}>>`
             : 'export type RequiredWireServices = Partial<Services>',
         '',
         ...(addonRequiredParentServices.length > 0

package/dist/src/functions/wirings/functions/serialize-function-types.js

@@ -629,10 +629,11 @@ export const pikkuConfig = (
  * \`\`\`
  */
 export const pikkuServices = (
-  func: (config: Config, existingServices: Partial<SingletonServices>) => Promise<Omit<RequiredSingletonServices, 'auth'>>
+  func: (config: Config, existingServices: Partial<SingletonServices>) => Promise<Partial<Omit<RequiredSingletonServices, 'auth'>>>
 ) => {
   return async (config: Config, existingServices: Partial<SingletonServices> = {}) => {
-    const services = await func(config, existingServices)
+    const createdServices = await func(config, existingServices)
+    const services = { ...existingServices, ...createdServices }
     const authFactory = __pikkuState(null, 'package', 'authFactory')
     if (authFactory) {
       let authInstance: Promise<unknown> | undefined

package/dist/src/scaffold/rpc-remote.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.42
+ * This file was generated by @pikku/cli@0.12.43
  */
 /**
  * Auto-generated remote internal RPC queue worker and HTTP endpoint

package/dist/src/services.d.ts

@@ -1,12 +1,17 @@
 import type { Config, Services, SingletonServices, UserSession } from '../types/application-types.js';
 import type { CreateConfig } from '@pikku/core';
 import type { CreateWireServices, CreateSingletonServices } from '@pikku/core/internal';
+import { LogLevel } from '@pikku/core/services';
 import type { PikkuCLIConfig } from '../types/config.js';
 import type { ForwardedLogMessage } from './services/cli-logger-forwarder.service.js';
 /**
  * Default CLI renderer that logs output using the logger
  */
-export declare const defaultCLIRenderer: import("@pikku/core/cli").CorePikkuCLIRender<ForwardedLogMessage, SingletonServices, import("@pikku/core").CoreUserSession>;
+export declare const defaultCLIRenderer: import("@pikku/core/cli").CorePikkuCLIRender<ForwardedLogMessage, import("@pikku/core").CoreSingletonServices<{
+    logLevel?: LogLevel;
+    secrets?: {};
+    workflow?: import("@pikku/core/workflow").WorkflowServiceConfig;
+}>, import("@pikku/core").CoreUserSession>;
 export declare const createConfig: CreateConfig<Config, [PikkuCLIConfig]>;
 /**
  * Singleton services factory for the Pikku CLI

package/dist/src/services.js

@@ -32,7 +32,7 @@ const logger = new CLILogger({ logLogo: false, silent: false });
 /**
  * Default CLI renderer that logs output using the logger
  */
-export const defaultCLIRenderer = pikkuCLIRender(({ logger }, data) => {
+export const defaultCLIRenderer = pikkuCLIRender((_services, data) => {
     if (!data)
         return;
     const validLevels = [
@@ -46,17 +46,6 @@ export const defaultCLIRenderer = pikkuCLIRender(({ logger }, data) => {
         return;
     logger[data.level]({ message: data.message, type: data.type });
 });
-// /**
-//  * Client-safe CLI renderer that outputs to console (no service dependencies)
-//  * This renderer can be used in CLI-over-channel clients
-//  */
-// export const clientCLIRenderer = pikkuCLIRender<ForwardedLogMessage>(
-//   ({ logger }, data) => {
-//     if (data) {
-//       logger[data.level]?.({ message: data.message, type: data.type } as any)
-//     }
-//   }
-// )
 export const createConfig = async (_variablesService, data) => {
     // Determine log level based on CLI flags with precedence:
     // --silent > --loglevel > --verbose > --info > default (info)
@@ -195,6 +184,11 @@ export const createSingletonServices = async (config) => {
                 config.authFile
                     ? path.join(path.dirname(config.authFile), 'auth-secrets.gen.ts')
                     : undefined,
+                // Stateless-session split: middleware-only file nothing imports, so it's
+                // unreachable via the import graph — add it explicitly to get inspected.
+                config.authFile
+                    ? path.join(path.dirname(config.authFile), 'auth-middleware.gen.ts')
+                    : undefined,
             ];
             for (const file of scaffoldFiles) {
                 if (file && !wiringFiles.includes(file) && existsSync(file)) {