@h-ai/serv 1.0.0-beta.15 → 1.0.0-beta.17

package/README.en.md

@@ -485,7 +485,7 @@ await apiClient.init({
 })
 ```
 
-> **Cookie attributes**: `HttpOnly; SameSite=Strict; Secure` in production; `Path` is limited to `{apiPrefix}/auth/refresh`.
+> Refresh cookies use `HttpOnly` and `SameSite=Strict` and are scoped to `{apiPrefix}/auth/refresh`. Production adds `Secure` by default.
 
 ### API overview
 
@@ -638,7 +638,9 @@ const app = serv.createApp({
 })
 ```
 
-In production, empty or `*` `_serv.yml` `cors.origin` fails startup. Web and Capacitor/Tauri origins use exact normalized full-Origin matching to prevent suffix spoofing. Production also enforces Secure refresh cookies and disables OpenAPI/docs; configuration controls nonproduction endpoints.
+Production requires an explicit `_serv.yml` `cors.origin` allowlist and disables OpenAPI and docs. Web and Capacitor/Tauri origins match by their exact normalized values.
+
+For a production HTTP endpoint on a controlled private network or VPN, set `HAI_SERV_REFRESH_COOKIE_SECURE=false` in the backend process environment. After restarting the backend and signing in, login and refresh responses omit `Secure` from the cookie, and HTTP carries the refresh credential in plaintext. `true` forces `Secure`. An empty or unrecognized value uses the environment default. When calling `serv.createApp` directly, an explicit `refreshCookie.secure` takes precedence over this variable, followed by the production check on `NODE_ENV` or `HAI_CORE_ENV`.
 
 ### Configuration driven authentication
 

package/README.ja.md

@@ -485,7 +485,7 @@ await apiClient.init({
 })
 ```
 
-> **Cookie 属性**：本番は `HttpOnly; SameSite=Strict; Secure`。`Path` は `{apiPrefix}/auth/refresh` に限定。
+> リフレッシュ Cookie には `HttpOnly` と `SameSite=Strict` が付き、パスは `{apiPrefix}/auth/refresh` に限定されます。本番では既定で `Secure` も付きます。
 
 ### API 一覧
 
@@ -638,7 +638,9 @@ const app = serv.createApp({
 })
 ```
 
-本番では `_serv.yml` の `cors.origin` が空・`*` なら起動に失敗します。Web・Capacitor/Tauri は正規化済み Origin 全体を厳密照合し、末尾偽装を防ぎます。本番は Secure refresh cookie を強制し OpenAPI/docs を無効化します。非本番の endpoint は設定ファイルで決めます。
+本番では `_serv.yml` の `cors.origin` に許可するオリジンを明示し、OpenAPI と docs は無効になります。Web と Capacitor/Tauri のオリジンは、正規化した値全体で照合します。
+
+管理されたプライベートネットワークや VPN の本番 HTTP 入口では、バックエンドのプロセス環境に `HAI_SERV_REFRESH_COOKIE_SECURE=false` を設定できます。再起動してログインし直すと、ログイン応答と更新応答の Cookie から `Secure` が外れ、HTTP でリフレッシュ認証情報が平文で送信されます。`true` は `Secure` を強制し、空欄や未対応の値では環境の既定値が使われます。`serv.createApp` を直接呼ぶ場合は、明示した `refreshCookie.secure`、この環境変数、`NODE_ENV` または `HAI_CORE_ENV` による本番判定の順に適用されます。
 
 ### 設定による認証画面
 

package/README.md

@@ -485,7 +485,7 @@ await apiClient.init({
 })
 ```
 
-> **Cookie 规格**：`HttpOnly; SameSite=Strict; Secure`（生产）；`Path` 限制为 `{apiPrefix}/auth/refresh`。
+> 刷新 Cookie 带有 `HttpOnly` 和 `SameSite=Strict`，路径限制为 `{apiPrefix}/auth/refresh`。生产默认还会设置 `Secure`。
 
 ### API 概览
 
@@ -638,7 +638,9 @@ const app = serv.createApp({
 })
 ```
 
-生产环境下 `_serv.yml` 的 `cors.origin` 为空或为 `*` 会在启动时失败；Web 与 Capacitor/Tauri Origin 均按规范化后的完整 Origin 精确匹配，避免后缀伪造。生产环境同时强制 Secure refresh cookie 并关闭 OpenAPI/docs，配置文件仍决定非生产环境具体挂载哪些端点。
+生产环境要求 `_serv.yml` 的 `cors.origin` 显式列出允许的来源，并关闭 OpenAPI 和 docs。Web 与 Capacitor/Tauri Origin 按规范化后的完整值精确匹配。
+
+受控内网或 VPN 的生产 HTTP 入口可以在后端进程环境设置 `HAI_SERV_REFRESH_COOKIE_SECURE=false`。重新启动后端并登录后，登录和刷新响应会下发省略 `Secure` 的 Cookie，刷新凭据会经 HTTP 明文传输。设置 `true` 可强制启用 `Secure`，留空或其他值沿用环境默认值。直接调用 `serv.createApp` 时，显式 `refreshCookie.secure` 优先，其次是此变量，再按 `NODE_ENV` 或 `HAI_CORE_ENV` 判断是否为生产。
 
 ### 配置驱动认证页面
 

package/dist/features/ai.d.ts

@@ -2,8 +2,8 @@ import * as _orpc_server from '@orpc/server';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
 import { AIFunctions } from '@h-ai/ai';
-import { S as ServContext } from '../serv-context-DE1JH5bd.js';
-import { A as AuthenticatedServContext } from '../serv-router-BJk04-oS.js';
+import { S as ServContext } from '../serv-context-BsNvQ-bb.js';
+import { A as AuthenticatedServContext } from '../serv-router-BnkxPvS6.js';
 import '@h-ai/core';
 
 /**

package/dist/features/feedback.d.ts

@@ -2,8 +2,8 @@ import * as _orpc_server from '@orpc/server';
 import * as zod from 'zod';
 import * as zod_v4_core from 'zod/v4/core';
 import { FeedbackFunctions, FeedbackContext } from '@h-ai/feedback';
-import { S as ServContext } from '../serv-context-DE1JH5bd.js';
-import { A as AuthenticatedServContext } from '../serv-router-BJk04-oS.js';
+import { S as ServContext } from '../serv-context-BsNvQ-bb.js';
+import { A as AuthenticatedServContext } from '../serv-router-BnkxPvS6.js';
 import '@h-ai/core';
 
 /**

package/dist/features/iam.d.ts

@@ -4,7 +4,7 @@ import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
 import { IamFunctions } from '@h-ai/iam';
 export { TokenPair } from '@h-ai/iam';
-import { S as ServContext } from '../serv-context-DE1JH5bd.js';
+import { S as ServContext } from '../serv-context-BsNvQ-bb.js';
 import '@h-ai/core';
 
 /**

package/dist/features/storage.d.ts

@@ -2,8 +2,8 @@ import * as _orpc_server from '@orpc/server';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
 import { StorageFunctions } from '@h-ai/storage';
-import { S as ServContext } from '../serv-context-DE1JH5bd.js';
-import { A as AuthenticatedServContext } from '../serv-router-BJk04-oS.js';
+import { S as ServContext } from '../serv-context-BsNvQ-bb.js';
+import { A as AuthenticatedServContext } from '../serv-router-BnkxPvS6.js';
 import '@h-ai/core';
 
 /**

package/dist/index.d.ts

@@ -3,15 +3,15 @@ import { HaiResult, TrustedProxies, RequestAccessConfigInput, ValidationFormErro
 import { AIFunctions, AudioWsStartMessage, AudioFormat } from '@h-ai/ai';
 import { AnyContractRouter, OpenAPI } from '@orpc/contract';
 import { ProcedureHandler, ErrorMap, Meta, ProcedureHandlerOptions, ORPCErrorConstructorMap, Router } from '@orpc/server';
-import { a as ServSession, S as ServContext, b as ServIam, R as RefreshCookieConfig, C as CreateServContext, c as ServRequestMetadata, p as parseRequestContext, d as buildAuthContextFactory } from './serv-context-DE1JH5bd.js';
-export { e as CreateServContextInput, N as NativeRefreshTokenTransportConfig, f as RefreshTokenPair } from './serv-context-DE1JH5bd.js';
+import { a as ServSession, S as ServContext, b as ServIam, R as RefreshCookieConfig, C as CreateServContext, c as ServRequestMetadata, p as parseRequestContext, d as buildAuthContextFactory } from './serv-context-BsNvQ-bb.js';
+export { e as CreateServContextInput, N as NativeRefreshTokenTransportConfig, f as RefreshTokenPair } from './serv-context-BsNvQ-bb.js';
 import { MiddlewareHandler } from 'hono';
 import { z, ZodType } from 'zod';
 import { TransportServerKeyRing, CryptoFunctions, TransportKeyStore } from '@h-ai/crypto';
 import { ServerType } from '@hono/node-server';
 import { AddressInfo } from 'node:net';
-import { i as implement } from './serv-router-BJk04-oS.js';
-export { A as AuthenticatedServContext, S as ServImplementer, a as ServRouteHandler, b as ServRoutePath, c as ServRouterBuilder } from './serv-router-BJk04-oS.js';
+import { i as implement } from './serv-router-BnkxPvS6.js';
+export { A as AuthenticatedServContext, S as ServImplementer, a as ServRouteHandler, b as ServRoutePath, c as ServRouterBuilder } from './serv-router-BnkxPvS6.js';
 import { StorageFunctions } from '@h-ai/storage';
 
 /**
@@ -1120,11 +1120,13 @@ interface ServRuntimeSecurityPolicyInput {
 interface ServRuntimeSecurityPolicy {
     readonly allowOrigin: (origin: string) => boolean;
     readonly isNativeOrigin: (origin: string) => boolean;
+    /** 刷新 Cookie 是否启用 Secure，默认在生产开启。 */
     readonly secureRefreshCookie: boolean;
     readonly exposeApiDocs: boolean;
 }
 /**
  * 校验部署 Origin 并生成 Cookie、文档与跨端 CORS 安全策略。
+ * `HAI_SERV_REFRESH_COOKIE_SECURE` 可覆盖刷新 Cookie 的 Secure 默认值。
  *
  * @param input - 部署环境与显式允许的 Web/原生 Origin
  * @returns 可用于 HTTP 装配的策略

package/dist/index.js

@@ -702,6 +702,81 @@ function buildAuthContextFactory(verifyToken) {
     }
   };
 }
+function createRuntimeSecurityPolicy(input) {
+  const production = input.environment?.trim().toLowerCase() === "production";
+  const configuredOrigins = parseOrigins(input.corsOrigin);
+  const configuredNativeOrigins = parseNativeOrigins(input.nativeOrigins);
+  const allowsEveryOrigin = configuredOrigins === "*";
+  if (production && (allowsEveryOrigin || configuredOrigins.length === 0))
+    throw new Error("serv.cors.origin must contain explicit HTTP(S) origins in production");
+  const allowedOrigins = allowsEveryOrigin ? void 0 : new Set(configuredOrigins);
+  const allowedNativeOrigins = new Set(configuredNativeOrigins);
+  return {
+    allowOrigin: (origin) => {
+      const normalizedNativeOrigin = tryNormalizeNativeOrigin(origin);
+      if (normalizedNativeOrigin !== void 0 && allowedNativeOrigins.has(normalizedNativeOrigin))
+        return true;
+      if (allowedOrigins === void 0)
+        return true;
+      const normalizedWebOrigin = tryNormalizeWebOrigin(origin);
+      return normalizedWebOrigin !== void 0 && allowedOrigins.has(normalizedWebOrigin);
+    },
+    isNativeOrigin: (origin) => allowedNativeOrigins.has(tryNormalizeNativeOrigin(origin) ?? ""),
+    secureRefreshCookie: resolveSecureRefreshCookie(production),
+    exposeApiDocs: !production
+  };
+}
+function resolveSecureRefreshCookie(defaultSecure) {
+  const override = process.env.HAI_SERV_REFRESH_COOKIE_SECURE;
+  if (override === "true" || override === "false")
+    return override === "true";
+  return defaultSecure;
+}
+function parseOrigins(value) {
+  const entries = (value ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean);
+  if (entries.includes("*"))
+    return "*";
+  return entries.map(normalizeWebOrigin);
+}
+function parseNativeOrigins(value) {
+  return (value ?? "").split(",").map((origin) => origin.trim()).filter(Boolean).map(normalizeNativeOrigin);
+}
+function normalizeWebOrigin(value) {
+  const normalized = tryNormalizeWebOrigin(value);
+  if (normalized === void 0)
+    throw new Error(`serv.cors.origin contains an invalid origin: ${value}`);
+  return normalized;
+}
+function normalizeNativeOrigin(value) {
+  const normalized = tryNormalizeNativeOrigin(value);
+  if (normalized === void 0)
+    throw new Error(`serv.cors.nativeOrigins contains an invalid origin: ${value}`);
+  return normalized;
+}
+function tryNormalizeWebOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.origin === "null" || url.pathname !== "/" || url.search || url.hash)
+    return void 0;
+  return url.origin;
+}
+function tryNormalizeNativeOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (!["http:", "https:", "capacitor:", "tauri:"].includes(url.protocol) || !url.hostname || url.username || url.password || !["", "/"].includes(url.pathname) || url.search || url.hash)
+    return void 0;
+  return ["capacitor:", "tauri:"].includes(url.protocol) ? `${url.protocol}//${url.host}` : url.origin;
+}
+
+// src/serv-cookie-auth.ts
 var IAM_AUTH_PATHS = {
   login: apiContract.pathOf(apiContract.iam.auth.login),
   loginWithOtp: apiContract.pathOf(apiContract.iam.auth.loginWithOtp),
@@ -721,7 +796,7 @@ function resolveRefreshCookieConfig(apiPrefix, config, iam) {
   return {
     cookieName: config.cookieName ?? "hai_refresh_token",
     maxAge: config.maxAge ?? 30 * 24 * 3600,
-    isSecure: config.secure ?? (process.env.NODE_ENV === "production" || process.env.HAI_CORE_ENV === "production"),
+    isSecure: config.secure ?? resolveSecureRefreshCookie(process.env.NODE_ENV === "production" || process.env.HAI_CORE_ENV === "production"),
     refreshCookiePath: `${apiPrefix}${IAM_AUTH_PATHS.refresh}`,
     onRefresh,
     nativeTokenTransport: config.nativeTokenTransport
@@ -1482,75 +1557,6 @@ function listen(app, options = {}) {
   return handle;
 }
 
-// src/serv-runtime-security.ts
-function createRuntimeSecurityPolicy(input) {
-  const production = input.environment?.trim().toLowerCase() === "production";
-  const configuredOrigins = parseOrigins(input.corsOrigin);
-  const configuredNativeOrigins = parseNativeOrigins(input.nativeOrigins);
-  const allowsEveryOrigin = configuredOrigins === "*";
-  if (production && (allowsEveryOrigin || configuredOrigins.length === 0))
-    throw new Error("serv.cors.origin must contain explicit HTTP(S) origins in production");
-  const allowedOrigins = allowsEveryOrigin ? void 0 : new Set(configuredOrigins);
-  const allowedNativeOrigins = new Set(configuredNativeOrigins);
-  return {
-    allowOrigin: (origin) => {
-      const normalizedNativeOrigin = tryNormalizeNativeOrigin(origin);
-      if (normalizedNativeOrigin !== void 0 && allowedNativeOrigins.has(normalizedNativeOrigin))
-        return true;
-      if (allowedOrigins === void 0)
-        return true;
-      const normalizedWebOrigin = tryNormalizeWebOrigin(origin);
-      return normalizedWebOrigin !== void 0 && allowedOrigins.has(normalizedWebOrigin);
-    },
-    isNativeOrigin: (origin) => allowedNativeOrigins.has(tryNormalizeNativeOrigin(origin) ?? ""),
-    secureRefreshCookie: production,
-    exposeApiDocs: !production
-  };
-}
-function parseOrigins(value) {
-  const entries = (value ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean);
-  if (entries.includes("*"))
-    return "*";
-  return entries.map(normalizeWebOrigin);
-}
-function parseNativeOrigins(value) {
-  return (value ?? "").split(",").map((origin) => origin.trim()).filter(Boolean).map(normalizeNativeOrigin);
-}
-function normalizeWebOrigin(value) {
-  const normalized = tryNormalizeWebOrigin(value);
-  if (normalized === void 0)
-    throw new Error(`serv.cors.origin contains an invalid origin: ${value}`);
-  return normalized;
-}
-function normalizeNativeOrigin(value) {
-  const normalized = tryNormalizeNativeOrigin(value);
-  if (normalized === void 0)
-    throw new Error(`serv.cors.nativeOrigins contains an invalid origin: ${value}`);
-  return normalized;
-}
-function tryNormalizeWebOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return void 0;
-  }
-  if (!["http:", "https:"].includes(url.protocol) || url.origin === "null" || url.pathname !== "/" || url.search || url.hash)
-    return void 0;
-  return url.origin;
-}
-function tryNormalizeNativeOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return void 0;
-  }
-  if (!["http:", "https:", "capacitor:", "tauri:"].includes(url.protocol) || !url.hostname || url.username || url.password || !["", "/"].includes(url.pathname) || url.search || url.hash)
-    return void 0;
-  return ["capacitor:", "tauri:"].includes(url.protocol) ? `${url.protocol}//${url.host}` : url.origin;
-}
-
 // src/serv-storage-assets.ts
 function storageAssets(config) {
   const pathPrefix = config.pathPrefix.endsWith("/") ? config.pathPrefix : `${config.pathPrefix}/`;