@opencode/server 0.0.0-dev-20113 → 0.0.0-dev-20115

package/dist/api.js

@@ -1,10 +1,10 @@
 import {
   Api2
-} from "./chunks/options-v573ws0d.js";
-import"./chunks/options-5rwqcaw2.js";
-import"./chunks/options-3kzx88w9.js";
-import"./chunks/options-6gkz39ey.js";
-import"./chunks/options-smaf4a18.js";
+} from "./chunks/fetch-cb0457h1.js";
+import"./chunks/fetch-27edjygf.js";
+import"./chunks/fetch-kb9735wh.js";
+import"./chunks/fetch-8j6eh3dh.js";
+import"./chunks/fetch-smaf4a18.js";
 export {
   Api2 as Api
 };

package/dist/auth.d.ts

@@ -8,6 +8,7 @@ export type Info = {
     readonly password: Option.Option<string>;
     readonly username: string;
 };
+export declare const SESSION_TTL_SECONDS: number;
 declare const Config_base: Context.ServiceClass<Config, "@opencode/ServerAuthConfig", Info>;
 export declare class Config extends Config_base {
     static configLayer(input: Pick<Info, "password">): Layer.Layer<Config, never, never>;
@@ -15,3 +16,6 @@ export declare class Config extends Config_base {
 }
 export declare function required(config: Info): boolean;
 export declare function authorized(credentials: DecodedCredentials, config: Info): boolean;
+export declare function issueSession(config: Info, now?: number): string | undefined;
+export declare function verifySession(token: string, config: Info, now?: number): boolean;
+export declare function sessionCookieName(host: string | undefined): string;

package/dist/auth.js

@@ -1,12 +1,20 @@
 import {
+  SESSION_TTL_SECONDS2,
   Config2,
   required2,
   authorized2,
+  issueSession2,
+  verifySession2,
+  sessionCookieName2,
   exports_auth
-} from "./chunks/options-zyv89x5n.js";
+} from "./chunks/fetch-anm12x33.js";
 export {
   Config2 as Config,
+  SESSION_TTL_SECONDS2 as SESSION_TTL_SECONDS,
   exports_auth as ServerAuth,
   authorized2 as authorized,
-  required2 as required
+  issueSession2 as issueSession,
+  required2 as required,
+  sessionCookieName2 as sessionCookieName,
+  verifySession2 as verifySession
 };

package/dist/chunks/{options-5bwq5cz2.js → fetch-1g0h49bb.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/reference.ts
 import { Reference } from "@opencode/core/reference";

package/dist/chunks/{options-xewf68xm.js → fetch-1y0kev0a.js}

@@ -1,36 +1,39 @@
 import {
-  layer4
-} from "./options-6gkz39ey.js";
+  layer2
+} from "./fetch-8j6eh3dh.js";
 import {
   formLocationLayer2
-} from "./options-5rwqcaw2.js";
+} from "./fetch-27edjygf.js";
 import {
   sessionLocationLayer2
-} from "./options-3kzx88w9.js";
+} from "./fetch-kb9735wh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 import {
   Config2
-} from "./options-zyv89x5n.js";
+} from "./fetch-anm12x33.js";
 import {
   CorsConfig2
-} from "./options-q4bn6dy8.js";
+} from "./fetch-q4bn6dy8.js";
+import {
+  layer4
+} from "./fetch-3jweah5a.js";
 import {
-  layer5
-} from "./options-18k6g42r.js";
+  node3
+} from "./fetch-sstsrjtg.js";
 import {
   node2
-} from "./options-bkk2wfbz.js";
+} from "./fetch-t7k3q1ah.js";
 import {
   handlers2
-} from "./options-f1xg0r1h.js";
+} from "./fetch-kwec6m6e.js";
 import {
   authorizationLayer2
-} from "./options-m6wvgbfq.js";
+} from "./fetch-gtkdacvk.js";
 import {
   schemaErrorLayer2
-} from "./options-t8yzmczr.js";
+} from "./fetch-t8yzmczr.js";
 
 // src/routes.ts
 import { Database } from "@opencode/core/database/database";
@@ -89,6 +92,7 @@ var applicationServiceNodes = [
   Credential.node,
   WellKnown.node,
   node2,
+  node3,
   LocationServiceMap.node,
   LocationActivity.node,
   SessionRestart.node,
@@ -140,8 +144,8 @@ function makeRoutes(auth, options, serviceURLs, overrides, instances) {
   })) : build(overrides);
   return serviceLayer.pipe(Layer.flatMap((context) => {
     const services = Layer.succeedContext(context);
-    const requestServices = Layer.merge(Layer.succeedContext(Context.pick(Database.Service, Credential.Service, PermissionSaved.Service, PluginUpdate.Service, Project.Service, WellKnown.Service)(context)), layer5(serviceURLs, Context.get(context, Global.Service).tmp, options.app));
-    const api = HttpApiBuilder.layer(Api2, { openapiPath: "/openapi.json" }).pipe(Layer.provide(handlers2.pipe(Layer.provide(services), Layer.provide(Layer.succeed(CorsConfig2, options)))), Layer.provide(formLocationLayer2), Layer.provide(sessionLocationLayer2), Layer.provide(layer4), Layer.provide(authorizationLayer2), Layer.provide(schemaErrorLayer2), Layer.provide(auth), HttpRouter.provideRequest(requestServices), Layer.provideMerge(services), Layer.provideMerge(HttpRouter.layer));
+    const requestServices = Layer.merge(Layer.succeedContext(Context.pick(Database.Service, Credential.Service, PermissionSaved.Service, PluginUpdate.Service, Project.Service, WellKnown.Service)(context)), layer4(serviceURLs, Context.get(context, Global.Service).tmp, options.app));
+    const api = HttpApiBuilder.layer(Api2, { openapiPath: "/openapi.json" }).pipe(Layer.provide(handlers2.pipe(Layer.provide(services), Layer.provide(Layer.succeed(CorsConfig2, options)))), Layer.provide(formLocationLayer2), Layer.provide(sessionLocationLayer2), Layer.provide(layer2), Layer.provide(authorizationLayer2), Layer.provide(schemaErrorLayer2), Layer.provide(auth), HttpRouter.provideRequest(requestServices), Layer.provideMerge(services), Layer.provideMerge(HttpRouter.layer));
     return Layer.merge(api, V1Migration.layer.pipe(Layer.provide(services)));
   }));
 }

package/dist/chunks/{options-5rwqcaw2.js → fetch-27edjygf.js}

@@ -1,7 +1,7 @@
 import {
   sessionInfo2,
   requestRef2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 
 // src/middleware/form-location.ts
 import { Instance } from "@opencode/core/instance/service";

package/dist/chunks/{options-wz0qz28j.js → fetch-2nqgjchx.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/mcp.ts
 import { Mcp } from "@opencode/core/mcp/index";

package/dist/chunks/{options-18k6g42r.js → fetch-3jweah5a.js}

@@ -1,22 +1,22 @@
 import {
   __export
-} from "./options-9rqn6x4v.js";
+} from "./fetch-9rqn6x4v.js";
 
 // src/server-info.ts
 var exports_server_info = {};
 __export(exports_server_info, {
   ServerInfo: () => exports_server_info,
-  Service: () => Service4,
+  Service: () => Service3,
   connectionURLs: () => connectionURLs2,
-  layer: () => layer5
+  layer: () => layer4
 });
 import { Context, Layer } from "effect";
 import { networkInterfaces } from "node:os";
 
-class Service4 extends Context.Service()("@opencode/server/ServerInfo") {
+class Service3 extends Context.Service()("@opencode/server/ServerInfo") {
 }
-function layer5(urls, tmp, app = {}) {
-  return Layer.succeed(Service4, Service4.of({ urls, app, paths: { tmp } }));
+function layer4(urls, tmp, app = {}) {
+  return Layer.succeed(Service3, Service3.of({ urls, app, paths: { tmp } }));
 }
 function connectionURLs2(value, requestedHostname) {
   const url = new URL(value);
@@ -33,4 +33,4 @@ function connectionURLs2(value, requestedHostname) {
   ];
 }
 
-export { Service4, layer5, connectionURLs2, exports_server_info };
+export { Service3, layer4, connectionURLs2, exports_server_info };

package/dist/chunks/{options-b1rdg9nf.js → fetch-42hredtt.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/model.ts
 import { Model } from "@opencode/core/model";

package/dist/chunks/{options-6qwktr1g.js → fetch-436zj0s2.js}

@@ -1,6 +1,6 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/config.ts
 import { Config } from "@opencode/core/config";

package/dist/chunks/{options-hp5sxeae.js → fetch-4zhj4tp6.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/skill.ts
 import { Skill } from "@opencode/core/skill";

package/dist/chunks/{options-5jh9m3wx.js → fetch-5xpvxbxg.js}

@@ -1,19 +1,19 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 import {
   CorsConfig2,
   isAllowedRequestOrigin2
-} from "./options-q4bn6dy8.js";
+} from "./fetch-q4bn6dy8.js";
 import {
   Service2
-} from "./options-bkk2wfbz.js";
+} from "./fetch-t7k3q1ah.js";
 import {
   runPtySocket2
-} from "./options-hezj1jdf.js";
+} from "./fetch-hezj1jdf.js";
 
 // src/handlers/pty.ts
 import { Pty } from "@opencode/core/pty";

package/dist/chunks/{options-g1cbdcxy.js → fetch-70rdrjmf.js}

@@ -1,10 +1,10 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 import {
-  Service3,
+  Service4,
   frame2
-} from "./options-tjpn0s1b.js";
+} from "./fetch-99sfd1j8.js";
 
 // src/handlers/event.ts
 import { Event } from "@opencode/schema/event";
@@ -12,7 +12,7 @@ import { Effect, Stream } from "effect";
 import { HttpServerResponse } from "effect/unstable/http";
 import { HttpApiBuilder } from "effect/unstable/httpapi";
 var EventHandler2 = HttpApiBuilder.group(Api2, "server.event", (handlers) => Effect.gen(function* () {
-  const feed = yield* Service3;
+  const feed = yield* Service4;
   return handlers.handleRaw("event.subscribe", () => Effect.gen(function* () {
     const connected = {
       id: Event.ID.create(),

package/dist/chunks/{options-v1emgcvb.js → fetch-77mkgw7d.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/websearch.ts
 import { WebSearch } from "@opencode/core/websearch";

package/dist/chunks/{options-x5ncpjy3.js → fetch-830yc5sa.js}

@@ -1,6 +1,6 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/location.ts
 import { Location } from "@opencode/core/location";

package/dist/chunks/{options-6gkz39ey.js → fetch-8j6eh3dh.js}

@@ -1,6 +1,6 @@
 import {
   missingSession2
-} from "./options-smaf4a18.js";
+} from "./fetch-smaf4a18.js";
 
 // src/location.ts
 import { Location } from "@opencode/core/location";
@@ -44,7 +44,7 @@ function decode(input) {
     return input;
   }
 }
-var layer4 = Layer.effect(LocationMiddleware2, Effect.gen(function* () {
+var layer2 = Layer.effect(LocationMiddleware2, Effect.gen(function* () {
   const locations = yield* LocationServiceMap.Service;
   return LocationMiddleware2.of((effect) => Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
@@ -52,4 +52,4 @@ var layer4 = Layer.effect(LocationMiddleware2, Effect.gen(function* () {
   }));
 }));
 
-export { LocationMiddleware2, response2, sessionInfo2, requestRef2, layer4 };
+export { LocationMiddleware2, response2, sessionInfo2, requestRef2, layer2 };

package/dist/chunks/{options-haswyr8z.js → fetch-8tzsm9rr.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/provider.ts
 import { Provider } from "@opencode/core/provider";

package/dist/chunks/{options-tjpn0s1b.js → fetch-99sfd1j8.js}

@@ -1,18 +1,18 @@
 import {
   __export
-} from "./options-9rqn6x4v.js";
+} from "./fetch-9rqn6x4v.js";
 
 // src/event-feed.ts
 var exports_event_feed = {};
 __export(exports_event_feed, {
   EncodingError: () => EncodingError2,
   EventFeed: () => exports_event_feed,
-  Service: () => Service3,
+  Service: () => Service4,
   SubscriberCapacity: () => SubscriberCapacity2,
   SubscriberOverflowError: () => SubscriberOverflowError2,
   frame: () => frame2,
-  layer: () => layer3,
-  make: () => make3
+  layer: () => layer5,
+  make: () => make4
 });
 import { Bus } from "@opencode/core/bus";
 import { Event } from "@opencode/schema/event";
@@ -30,14 +30,14 @@ class EncodingError2 extends Schema.TaggedError()("EventFeed.EncodingError", {
 }) {
 }
 
-class Service3 extends Context.Service()("@opencode/server/EventFeed") {
+class Service4 extends Context.Service()("@opencode/server/EventFeed") {
 }
 function frame2(event) {
   return `data: ${JSON.stringify(event)}
 
 `;
 }
-var make3 = Effect.fn("EventFeed.make")(function* (observe, options) {
+var make4 = Effect.fn("EventFeed.make")(function* (observe, options) {
   const capacity = options?.capacity ?? SubscriberCapacity2;
   const render = options?.encode ?? frame2;
   const subscribers = new Set;
@@ -71,13 +71,13 @@ var make3 = Effect.fn("EventFeed.make")(function* (observe, options) {
   });
   const unsubscribe = yield* observe(publish);
   yield* Effect.addFinalizer(() => unsubscribe);
-  return Service3.of({
+  return Service4.of({
     subscribe: Effect.acquireRelease(Queue.dropping(capacity).pipe(Effect.tap((queue) => Effect.sync(() => subscribers.add(queue)))), (queue) => Effect.sync(() => subscribers.delete(queue)).pipe(Effect.andThen(Queue.shutdown(queue)), Effect.asVoid)).pipe(Effect.map(Stream.fromQueue))
   });
 });
-var layer3 = Layer.effect(Service3, Effect.gen(function* () {
+var layer5 = Layer.effect(Service4, Effect.gen(function* () {
   const bus = yield* Bus.Service;
-  return yield* make3(bus.listen);
+  return yield* make4(bus.listen);
 }));
 
-export { SubscriberCapacity2, SubscriberOverflowError2, EncodingError2, Service3, frame2, make3, layer3, exports_event_feed };
+export { SubscriberCapacity2, SubscriberOverflowError2, EncodingError2, Service4, frame2, make4, layer5, exports_event_feed };

package/dist/chunks/{options-qj9kjxn3.js → fetch-9gjx5y7a.js}

@@ -1,6 +1,6 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/project.ts
 import { Project } from "@opencode/core/project";

package/dist/chunks/{options-s0padj6k.js → fetch-9qna85w8.js}

@@ -1,13 +1,13 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 import {
   CorsConfig2,
   isAllowedRequestOrigin2
-} from "./options-q4bn6dy8.js";
+} from "./fetch-q4bn6dy8.js";
 import {
   runPtySocket2
-} from "./options-hezj1jdf.js";
+} from "./fetch-hezj1jdf.js";
 
 // src/handlers/persistent-pty.ts
 import { PersistentPty } from "@opencode/core/persistent-pty";

package/dist/chunks/fetch-anm12x33.js

@@ -0,0 +1,66 @@
+import {
+  __export
+} from "./fetch-9rqn6x4v.js";
+
+// src/auth.ts
+var exports_auth = {};
+__export(exports_auth, {
+  Config: () => Config2,
+  SESSION_TTL_SECONDS: () => SESSION_TTL_SECONDS2,
+  ServerAuth: () => exports_auth,
+  authorized: () => authorized2,
+  issueSession: () => issueSession2,
+  required: () => required2,
+  sessionCookieName: () => sessionCookieName2,
+  verifySession: () => verifySession2
+});
+import { Context, Layer, Option, Redacted } from "effect";
+import { createHmac, timingSafeEqual } from "node:crypto";
+var SESSION_TTL_SECONDS2 = 30 * 24 * 60 * 60;
+
+class Config2 extends Context.Service()("@opencode/ServerAuthConfig") {
+  static configLayer(input) {
+    return Layer.succeed(this, this.of({ ...input, username: "opencode" }));
+  }
+  static get layer() {
+    return this.configLayer({ password: Option.none() });
+  }
+}
+function required2(config) {
+  return Option.isSome(config.password) && config.password.value !== "";
+}
+function authorized2(credentials, config) {
+  if (Option.isNone(config.password) || credentials.username !== config.username)
+    return false;
+  const password = Redacted.value(credentials.password);
+  return password === config.password.value || verifySession2(password, config);
+}
+function issueSession2(config, now = Date.now()) {
+  if (Option.isNone(config.password))
+    return;
+  const expires = String(Math.floor(now / 1000) + SESSION_TTL_SECONDS2);
+  return `${expires}.${sign(config.password.value, expires)}`;
+}
+function verifySession2(token, config, now = Date.now()) {
+  if (Option.isNone(config.password))
+    return false;
+  const parts = token.split(".");
+  if (parts.length !== 2)
+    return false;
+  const expires = Number(parts[0]);
+  if (!Number.isSafeInteger(expires) || expires * 1000 <= now)
+    return false;
+  const expected = Buffer.from(sign(config.password.value, parts[0]));
+  const actual = Buffer.from(parts[1]);
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function sessionCookieName2(host) {
+  const port = URL.parse(`http://${host ?? ""}`)?.port;
+  return port ? `opencode_session_${port}` : "opencode_session";
+}
+function sign(password, payload) {
+  const key = createHmac("sha256", password).update("opencode-session-v1").digest();
+  return createHmac("sha256", key).update(payload).digest("base64url");
+}
+
+export { SESSION_TTL_SECONDS2, Config2, required2, authorized2, issueSession2, verifySession2, sessionCookieName2, exports_auth };

package/dist/chunks/{options-v573ws0d.js → fetch-cb0457h1.js}

@@ -1,12 +1,12 @@
 import {
   LocationMiddleware2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   FormLocationMiddleware2
-} from "./options-5rwqcaw2.js";
+} from "./fetch-27edjygf.js";
 import {
   SessionLocationMiddleware2
-} from "./options-3kzx88w9.js";
+} from "./fetch-kb9735wh.js";
 
 // src/api.ts
 import { makeDefaultApi } from "@opencode/protocol/api";

package/dist/chunks/{options-hr75rahr.js → fetch-fbrf1xh2.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/plugin.ts
 import { Plugin } from "@opencode/core/plugin";

package/dist/chunks/{options-m6wvgbfq.js → fetch-gtkdacvk.js}

@@ -1,8 +1,10 @@
 import {
   Config2,
   required2,
-  authorized2
-} from "./options-zyv89x5n.js";
+  authorized2,
+  verifySession2,
+  sessionCookieName2
+} from "./fetch-anm12x33.js";
 
 // src/middleware/authorization.ts
 import { UnauthorizedError } from "@opencode/protocol/errors";
@@ -10,6 +12,7 @@ import { Authorization } from "@opencode/protocol/middleware/authorization";
 import { Authorization as Authorization2 } from "@opencode/protocol/middleware/authorization";
 import { hasPtyConnectTicketURL } from "@opencode/protocol/groups/pty";
 import { hasPersistentPtyConnectTicketURL } from "@opencode/protocol/groups/persistent-pty";
+import { isPairingConnectURL } from "@opencode/protocol/groups/server";
 import { Effect, Encoding, Layer, Redacted } from "effect";
 import { HttpEffect, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 var AUTH_TOKEN_QUERY = "auth_token";
@@ -38,8 +41,25 @@ function credentialFromRequest(request) {
     return decodeCredential(match[1]);
   return Effect.succeed(emptyCredential());
 }
+var UNAUTHORIZED_MESSAGE = "Authentication required";
+function challengeRequest(request) {
+  const mode = request.headers["sec-fetch-mode"];
+  return mode === undefined || mode === "navigate";
+}
+function unauthorizedResponse2(request) {
+  return HttpServerResponse.jsonUnsafe({ _tag: "UnauthorizedError", message: UNAUTHORIZED_MESSAGE }, { status: 401, headers: challengeRequest(request) ? { "www-authenticate": WWW_AUTHENTICATE } : undefined });
+}
 function authorizedRequest2(request, config) {
-  return credentialFromRequest(request).pipe(Effect.map((credential) => authorized2(credential, config)));
+  return credentialFromRequest(request).pipe(Effect.map((credential) => authorized2(credential, config) || authorizedSessionCookie(request, config)));
+}
+function authorizedSessionCookie(request, config) {
+  const token = request.cookies[sessionCookieName2(request.headers.host)];
+  if (!token)
+    return false;
+  const origin = request.headers.origin;
+  if (origin !== undefined && URL.parse(origin)?.host !== request.headers.host)
+    return false;
+  return verifySession2(token, config);
 }
 var authorizationLayer2 = Layer.effect(Authorization, Effect.gen(function* () {
   const config = yield* Config2;
@@ -48,13 +68,14 @@ var authorizationLayer2 = Layer.effect(Authorization, Effect.gen(function* () {
   return Authorization.of((effect) => Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
     const url = new URL(request.url, "http://localhost");
-    if (hasPtyConnectTicketURL(url) || hasPersistentPtyConnectTicketURL(url))
+    if (hasPtyConnectTicketURL(url) || hasPersistentPtyConnectTicketURL(url) || isPairingConnectURL(url))
       return yield* effect;
     if (yield* authorizedRequest2(request, config))
       return yield* effect;
-    yield* HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)));
-    return yield* new UnauthorizedError({ message: "Authentication required" });
+    if (challengeRequest(request))
+      yield* HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)));
+    return yield* new UnauthorizedError({ message: UNAUTHORIZED_MESSAGE });
   }));
 }));
 
-export { authorizedRequest2, authorizationLayer2, Authorization2 };
+export { unauthorizedResponse2, authorizedRequest2, authorizationLayer2, Authorization2 };

package/dist/chunks/{options-ees77nh9.js → fetch-h7dczx71.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/form.ts
 import { Form } from "@opencode/core/form";

package/dist/chunks/{options-3kzx88w9.js → fetch-kb9735wh.js}

@@ -1,6 +1,6 @@
 import {
   sessionInfo2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 
 // src/middleware/session-location.ts
 import { Instance } from "@opencode/core/instance/service";

package/dist/chunks/{options-44xy5pnk.js → fetch-kbnh7vq7.js}

@@ -1,6 +1,6 @@
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/credential.ts
 import { Credential } from "@opencode/core/credential";

package/dist/chunks/{options-zpz5afwq.js → fetch-kpeb8xpg.js}

@@ -1,9 +1,9 @@
 import {
   response2
-} from "./options-6gkz39ey.js";
+} from "./fetch-8j6eh3dh.js";
 import {
   Api2
-} from "./options-v573ws0d.js";
+} from "./fetch-cb0457h1.js";
 
 // src/handlers/vcs.ts
 import { Vcs } from "@opencode/core/vcs";