@zhin.js/adapter-line 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @zhin.js/adapter-line
 
+## 3.0.2
+
+### Patch Changes
+
+- d5cd4aa: Publish Plugin Runtime entry points and convention modules as JavaScript so
+  installed npm plugins load on Node without TypeScript stripping. Workspace
+  development continues to prefer TypeScript sources for local HMR.
+
+  Remove the unconsumed legacy game hub APIs from game-kit; game navigation and
+  records now use ordinary convention commands owned by the game hub plugin.
+
+- Updated dependencies [d5cd4aa]
+  - @zhin.js/command@1.0.4
+  - zhin.js@5.0.2
+  - @zhin.js/adapter@1.1.2
+  - @zhin.js/core@1.4.2
+  - @zhin.js/agent@1.0.7
+
+## 3.0.1
+
+### Patch Changes
+
+- 5691aba: 第二轮全量审计修复批（8 面 ~60 bug）：
+
+  - **安全**：email 附件路径穿越修复（basename + downloadPath 约束）；lark/telegram/satori webhook 鉴权（缺密钥告警、timingSafeEqual、±5min 时效窗、chat_type 修正）；onebot wss/webhook 缺 token 告警；qq webhook 改原始字节验签；renderJsx/JSX 转义注入修复；console runtime token 401 死循环。
+  - **P0 功能**：sandbox 多 endpoint 解析 + WS 路径隔离；short-url expand（undici opaqueredirect）改 follow；AI 压缩摘要失败不再静默丢历史（熔断恢复生效）；console-ui 实时推送事件名归一化 + IndexedDB schema 对齐；process-monitor 热重载不再误判崩溃。
+  - **生命周期**：email IMAP 断线重连 + 在飞锁；onebot11/12 start 失败清理；line replyToken TTL + push 兜底；wechat-mp token 过期重试 + MsgId 去重；weixin-ilink buf 推进/防抖写盘/媒体 TTL/QR abort；satori PONG 看门狗；退避自毁修复。
+  - **游戏**：text-adventure 终局 restart 复活 + requires 服务端校验；tic-tac-toe PvP 占用/restart/队列清理/TTL；idiom-chain/word-riddle 闲聊不扣失误；别名中间件不劫持普通聊天。
+  - **共享库**：schema falsy 默认值/date/tuple/union 修复；database parseCondition Date/未知操作符、sqlite TEXT 往返、query 分派、belongsToMany 方言、migration dry-run；schedule DST 回拨死循环、重复 id 去重、flush 串行化；game-kit fallback 编号/onboarding 提示/尾缀边界/活引用拷贝。
+  - **渲染语音**：fetch 全部超时 + 渲染并发闸；sanitizeHtml form 保文本；STT 扩展名映射 + 删临时文件；TTS 未知 provider 报错；emojiCache LRU 负缓存/fontCache style/clearFonts 恢复；register 错误分类收窄。
+
+- 74b035c: endpoint 管理命令扩展至 18/20 适配器：kook / discord / github（private_key 支持内联文件路径）/ icqq（bindFlow 登记式 add + `icqq login` 引导）/ dingtalk / lark / line / satori / wechat-mp / wecom / weixin-ilink 接入 `endpoint list/add/remove`（字段对齐各自 schema，凭据写 `.env`）。email（smtp/imap 嵌套对象）与 sandbox（无凭据）暂不接。
+- 09d4f25: Console 社交读取面（management 语义端口）多平台落地：napcat/onebot11/onebot12/milky（好友+群+群成员，OneBot 标准动作）；discord/kook/satori（guild+频道+成员，分页聚合，id 保精度留字符串）；slack（workspace 成员+public channels+conversations.members）；line（群/room 成员分页+profile 回退）；wechat-mp（followers openid）；weixin-ilink（context_token 对端推导）；lark（chats+members 全分页）。`EndpointFriend.user_id`/`EndpointGroup.group_id` 放宽为 `number | string`（雪花 id 不丢精度）。telegram/wecom/dingtalk/github/email/sandbox 注明平台无列表面暂不接。
+- Updated dependencies [cdf64e7]
+- Updated dependencies [2d0a159]
+- Updated dependencies [5691aba]
+- Updated dependencies [078e3f7]
+- Updated dependencies [50497a5]
+- Updated dependencies [9c997b2]
+- Updated dependencies [09d4f25]
+- Updated dependencies [43485a9]
+- Updated dependencies [f0ec5ab]
+- Updated dependencies [3e925d0]
+- Updated dependencies [fa66c4c]
+- Updated dependencies [fa66c4c]
+- Updated dependencies [6cb6152]
+  - @zhin.js/command@1.0.3
+  - @zhin.js/agent@1.0.6
+  - @zhin.js/plugin-runtime@1.1.1
+  - @zhin.js/host-http@1.0.3
+  - zhin.js@5.0.1
+  - @zhin.js/adapter@1.1.1
+  - @zhin.js/core@1.4.1
+
 ## 3.0.0
 
 ### Patch Changes

package/adapters/line.js

@@ -0,0 +1,33 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+/**
+ * Convention entry: discover `adapters/line.ts` → defineAdapter.
+ */
+import { defineAdapter } from '@zhin.js/adapter';
+import { messageGatewayToken } from '@zhin.js/core/runtime';
+import { httpHostToken } from '@zhin.js/host-http';
+import { LineEndpoint } from "../lib/endpoint.js";
+import { resolveLineConfig, } from "../lib/protocol.js";
+import { lineRuntimeStateToken } from "../lib/line-runtime-state.js";
+export { LineEndpoint } from "../lib/endpoint.js";
+export default defineAdapter({
+    capabilities: ['inbound', 'outbound'],
+    // LINE Messaging API 媒体消息仅消费远程 URL；无按钮交互面，交互段降级纯文本。
+    segments: {
+        outboundMedia: ['url'],
+        interactive: 'text',
+    },
+    create(context) {
+        const config = resolveLineConfig(context.config);
+        // 注册到插件运行时状态（line endpoint list 的"运行中"数据源）
+        context.use(lineRuntimeStateToken).endpoints.set(config.name, {
+            name: config.name,
+            mode: 'webhook',
+        });
+        return new LineEndpoint({
+            id: context.id,
+            gateway: context.use(messageGatewayToken),
+            http: context.use(httpHostToken),
+            config,
+        });
+    },
+});

package/adapters/line.ts

@@ -9,18 +9,30 @@ import {
   resolveLineConfig,
   type LineAdapterConfig,
 } from '../src/protocol.js';
+import { lineRuntimeStateToken } from '../src/line-runtime-state.js';
 
 export { LineEndpoint } from '../src/endpoint.js';
 export type { LineEndpointOptions, LineFetch } from '../src/endpoint.js';
 
 export default defineAdapter<LineAdapterConfig>({
   capabilities: ['inbound', 'outbound'],
+  // LINE Messaging API 媒体消息仅消费远程 URL；无按钮交互面，交互段降级纯文本。
+  segments: {
+    outboundMedia: ['url'],
+    interactive: 'text',
+  },
   create(context) {
+    const config = resolveLineConfig(context.config);
+    // 注册到插件运行时状态（line endpoint list 的"运行中"数据源）
+    context.use(lineRuntimeStateToken).endpoints.set(config.name, {
+      name: config.name,
+      mode: 'webhook',
+    });
     return new LineEndpoint({
       id: context.id,
       gateway: context.use(messageGatewayToken),
       http: context.use(httpHostToken),
-      config: resolveLineConfig(context.config),
+      config,
     });
   },
 });

package/commands/endpoint/add/[name:string].js

@@ -0,0 +1,3 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { lineEndpointCommands } from "../../../lib/line-endpoint-commands.js";
+export default lineEndpointCommands.add;

package/commands/endpoint/add/[name:string].ts

@@ -0,0 +1,3 @@
+import { lineEndpointCommands } from '../../../src/line-endpoint-commands.js';
+
+export default lineEndpointCommands.add;

package/commands/endpoint/list.js

@@ -0,0 +1,3 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { lineEndpointCommands } from "../../lib/line-endpoint-commands.js";
+export default lineEndpointCommands.list;

package/commands/endpoint/list.ts

@@ -0,0 +1,3 @@
+import { lineEndpointCommands } from '../../src/line-endpoint-commands.js';
+
+export default lineEndpointCommands.list;

package/commands/endpoint/remove/[name:string].js

@@ -0,0 +1,3 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { lineEndpointCommands } from "../../../lib/line-endpoint-commands.js";
+export default lineEndpointCommands.remove;

package/commands/endpoint/remove/[name:string].ts

@@ -0,0 +1,3 @@
+import { lineEndpointCommands } from '../../../src/line-endpoint-commands.js';
+
+export default lineEndpointCommands.remove;

package/lib/endpoint.d.ts

@@ -1,7 +1,7 @@
 /**
  * LineEndpoint — lifecycle, outbound, admit, OpenAPI helpers for agent tools.
  */
-import type { EndpointInstance } from '@zhin.js/adapter';
+import type { EndpointInstance, EndpointManagement } from '@zhin.js/adapter';
 import type { MessageGateway } from '@zhin.js/core/runtime';
 import type { HttpHost } from '@zhin.js/host-http';
 import type { CapabilityId } from '@zhin.js/plugin-runtime';
@@ -10,6 +10,7 @@ export type LineFetch = (url: string, init?: {
     readonly method?: string;
     readonly headers?: Record<string, string>;
     readonly body?: string;
+    readonly signal?: AbortSignal;
 }) => Promise<{
     readonly ok: boolean;
     readonly status: number;
@@ -25,6 +26,7 @@ export interface LineEndpointOptions {
 }
 export declare class LineEndpoint implements EndpointInstance {
     #private;
+    readonly management: EndpointManagement;
     constructor(options: LineEndpointOptions);
     /** Used by webhook handler. */
     get isOpen(): boolean;
@@ -43,4 +45,14 @@ export declare class LineEndpoint implements EndpointInstance {
     }): Promise<string>;
     /** Test / internal: admit a parsed event when open (non-webhook path). */
     admit(event: LineEvent): void;
+    /**
+     * group/room 成员列表：Bot API 无群列表，只能按已知 groupId/roomId 拉成员。
+     * members/ids 分页（next continuation token）后逐个取 profile 归一 nickname；
+     * 单个 profile 失败（用户已退群等）时回退 userId 占位，不拖垮整批。
+     */
+    getGroupMembers(groupId: string): Promise<LineGroupMember[]>;
+}
+export interface LineGroupMember {
+    readonly user_id: string;
+    readonly nickname: string;
 }

package/lib/endpoint.js

@@ -3,6 +3,10 @@ import { registerLineAgentEndpoint } from './line-agent-deps.js';
 import { formatInboundContent, formatOutboundMessages, generateMessageId, isMessageEvent, isValidLineRecipientId, resolveChannel, } from './protocol.js';
 import { registerLineWebhookRoutes } from './webhook.js';
 const logger = getLogger('line');
+/** LINE replyToken 有效期短，过期后 reply 必 400；缓存带时间戳，超时弃用改走 push。 */
+const REPLY_TOKEN_TTL_MS = 60_000;
+/** 出站 HTTP 调用统一 30s 超时。 */
+const OUTBOUND_TIMEOUT_MS = 30_000;
 export class LineEndpoint {
     #options;
     #fetch;
@@ -11,6 +15,7 @@ export class LineEndpoint {
     #open = false;
     #started = false;
     #unregisterAgent;
+    management = createLineEndpointManagement(this);
     constructor(options) {
         this.#options = options;
         this.#fetch = options.fetch ?? globalThis.fetch;
@@ -68,10 +73,24 @@ export class LineEndpoint {
         if (messages.length === 0) {
             throw new Error('No valid LINE messages to send');
         }
-        const replyToken = this.#replyTokenCache.get(target);
-        if (replyToken) {
+        const cached = this.#replyTokenCache.get(target);
+        if (cached) {
             this.#replyTokenCache.delete(target);
-            return this.#replyMessage(replyToken, messages);
+            if (Date.now() - cached.timestamp <= REPLY_TOKEN_TTL_MS) {
+                try {
+                    return await this.#replyMessage(cached.token, messages);
+                }
+                catch (error) {
+                    // replyToken 过期/失效时 LINE 返回 400，回退 push 保证消息不丢
+                    if (error.status !== 400)
+                        throw error;
+                    logger.warn(formatCompact({
+                        op: 'line_reply_fallback_push',
+                        endpoint: this.#options.config.name,
+                        target,
+                    }));
+                }
+            }
         }
         if (!isValidLineRecipientId(target)) {
             throw new Error(`Invalid LINE recipient ID "${target}": must start with U (user), G (group), or R (room)`);
@@ -84,7 +103,7 @@ export class LineEndpoint {
             return;
         const { channelId } = resolveChannel(event.source);
         if ('replyToken' in event && typeof event.replyToken === 'string') {
-            this.#replyTokenCache.set(channelId, event.replyToken);
+            this.#replyTokenCache.set(channelId, { token: event.replyToken, timestamp: Date.now() });
         }
         void this.#options.gateway.receive({
             adapter: this.#options.id,
@@ -116,10 +135,13 @@ export class LineEndpoint {
                 Authorization: `Bearer ${this.#options.config.channelAccessToken}`,
             },
             body: JSON.stringify({ replyToken, messages }),
+            signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new Error(`LINE Reply API error ${response.status}: ${errorText}`);
+            const error = new Error(`LINE Reply API error ${response.status}: ${errorText}`);
+            error.status = response.status;
+            throw error;
         }
         const result = await response.json();
         return result.sentMessages?.[0]?.id || `reply-${Date.now()}`;
@@ -133,6 +155,7 @@ export class LineEndpoint {
                 Authorization: `Bearer ${this.#options.config.channelAccessToken}`,
             },
             body: JSON.stringify({ to, messages }),
+            signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
         });
         if (!response.ok) {
             const errorText = await response.text();
@@ -141,4 +164,50 @@ export class LineEndpoint {
         const result = await response.json();
         return result.sentMessages?.[0]?.id || `push-${Date.now()}`;
     }
+    /**
+     * group/room 成员列表：Bot API 无群列表，只能按已知 groupId/roomId 拉成员。
+     * members/ids 分页（next continuation token）后逐个取 profile 归一 nickname；
+     * 单个 profile 失败（用户已退群等）时回退 userId 占位，不拖垮整批。
+     */
+    async getGroupMembers(groupId) {
+        const kind = groupId.startsWith('R') ? 'room' : 'group';
+        const memberIds = [];
+        let start;
+        do {
+            const query = start ? `?start=${encodeURIComponent(start)}` : '';
+            const data = await this.#get(`${this.#options.config.apiBaseUrl}/v2/bot/${kind}/${encodeURIComponent(groupId)}/members/ids${query}`);
+            for (const id of data.memberIds ?? []) {
+                if (typeof id === 'string' && id)
+                    memberIds.push(id);
+            }
+            start = data.next || undefined;
+        } while (start);
+        return Promise.all(memberIds.map(async (userId) => {
+            try {
+                const profile = await this.#get(`${this.#options.config.apiBaseUrl}/v2/bot/${kind}/${encodeURIComponent(groupId)}/member/${encodeURIComponent(userId)}`);
+                return { user_id: userId, nickname: String(profile.displayName ?? userId) };
+            }
+            catch {
+                return { user_id: userId, nickname: userId };
+            }
+        }));
+    }
+    async #get(url) {
+        const response = await this.#fetch(url, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${this.#options.config.channelAccessToken}` },
+            signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`LINE API error ${response.status}: ${errorText}`);
+        }
+        return response.json();
+    }
+}
+function createLineEndpointManagement(endpoint) {
+    return Object.freeze({
+        // listGroups 不接：LINE Bot API 没有"我加入了哪些群"的接口，群 id 只能来自入站事件。
+        listGroupMembers: (groupId) => endpoint.getGroupMembers(groupId),
+    });
 }

package/lib/line-endpoint-commands.d.ts

@@ -0,0 +1 @@
+export declare const lineEndpointCommands: import("@zhin.js/adapter").EndpointCommands<Readonly<import("@zhin.js/command").CommandDefinition<unknown, unknown, import("@zhin.js/command").CommandMessage>>>;

package/lib/line-endpoint-commands.js

@@ -0,0 +1,17 @@
+/**
+ * `line endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ */
+import { createEndpointCommands } from '@zhin.js/adapter';
+import { defineCommand } from '@zhin.js/command';
+import { lineRuntimeStateToken } from './line-runtime-state.js';
+export const lineEndpointCommands = createEndpointCommands({
+    adapterKey: 'line',
+    adapterDisplayName: 'LINE',
+    fields: [
+        { key: 'channelSecret', required: true, env: true, description: 'LINE channel secret' },
+        { key: 'channelAccessToken', required: true, env: true, description: 'LINE channel access token' },
+    ],
+    running: (use) => use(lineRuntimeStateToken).endpoints.values(),
+    describeEntry: (entry) => `channelAccessToken: ${String(entry.channelAccessToken)}`,
+}, defineCommand);

package/lib/line-runtime-state.d.ts

@@ -0,0 +1 @@
+export declare const lineRuntimeStateToken: import("@zhin.js/plugin-runtime").Token<import("@zhin.js/adapter").EndpointRuntimeState>;

package/lib/line-runtime-state.js

@@ -0,0 +1,6 @@
+/**
+ * LINE 插件实例的运行时状态：adapter create() 注册的 endpoint 列表。
+ * 由 plugin.ts setup() provide，adapter create 与 `line endpoint` 命令共享（同一 owner generation）。
+ */
+import { defineEndpointRuntimeStateToken } from '@zhin.js/adapter';
+export const lineRuntimeStateToken = defineEndpointRuntimeStateToken('line');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-line",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Zhin.js LINE Messaging API adapter for Plugin Runtime (HTTP webhook)",
   "type": "module",
   "main": "./lib/index.js",
@@ -32,20 +32,21 @@
     "directory": "plugins/adapters/line"
   },
   "dependencies": {
-    "@zhin.js/adapter": "1.1.0",
-    "@zhin.js/core": "1.4.0",
-    "@zhin.js/host-http": "1.0.2",
+    "@zhin.js/adapter": "1.1.2",
+    "@zhin.js/command": "1.0.4",
+    "@zhin.js/core": "1.4.2",
+    "@zhin.js/host-http": "1.0.3",
     "@zhin.js/logger": "1.0.75",
-    "@zhin.js/plugin-runtime": "1.1.0"
+    "@zhin.js/plugin-runtime": "1.1.1"
   },
   "peerDependencies": {
     "zod": "^4.0.0",
-    "@zhin.js/adapter": "1.1.0",
-    "@zhin.js/agent": "1.0.5",
-    "@zhin.js/core": "1.4.0",
-    "@zhin.js/host-http": "1.0.2",
-    "@zhin.js/plugin-runtime": "1.1.0",
-    "zhin.js": "5.0.0"
+    "@zhin.js/adapter": "1.1.2",
+    "@zhin.js/agent": "1.0.7",
+    "@zhin.js/core": "1.4.2",
+    "@zhin.js/host-http": "1.0.3",
+    "@zhin.js/plugin-runtime": "1.1.1",
+    "zhin.js": "5.0.2"
   },
   "peerDependenciesMeta": {
     "zhin.js": {
@@ -63,11 +64,12 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "zod": "^4.4.3",
-    "@zhin.js/agent": "1.0.5"
+    "@zhin.js/agent": "1.0.7"
   },
   "files": [
     "adapters",
-    "plugin.ts",
+    "commands",
+    "plugin.js",
     "schema.json",
     "src",
     "lib",
@@ -85,13 +87,17 @@
   "zhin": {
     "protocol": 1,
     "type": "plugin",
-    "entry": "./plugin.ts",
+    "entry": "./plugin.js",
     "engine": "^1.0.0",
     "runtime": "trusted",
     "features": [
       {
         "package": "@zhin.js/adapter",
         "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/command",
+        "api": "^1.0.0"
       }
     ],
     "plugins": []

package/plugin.js

@@ -0,0 +1,14 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { createEndpointRuntimeState } from '@zhin.js/adapter';
+import { definePlugin } from '@zhin.js/plugin-runtime';
+import { lineRuntimeStateToken } from "./lib/line-runtime-state.js";
+export default definePlugin({
+    name: 'line',
+    metadata: {
+        displayName: 'LINE Messaging API Adapter',
+    },
+    setup(context) {
+        // 运行中 endpoint 注册表（line endpoint list 的"运行中"数据源）
+        context.resources.provide(lineRuntimeStateToken, createEndpointRuntimeState());
+    },
+});

package/src/endpoint.ts

@@ -1,7 +1,7 @@
 /**
  * LineEndpoint — lifecycle, outbound, admit, OpenAPI helpers for agent tools.
  */
-import type { EndpointInstance } from '@zhin.js/adapter';
+import type { EndpointInstance, EndpointManagement } from '@zhin.js/adapter';
 import type { MessageGateway } from '@zhin.js/core/runtime';
 import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
 import { formatCompact, getLogger } from '@zhin.js/logger';
@@ -22,12 +22,18 @@ import { registerLineWebhookRoutes } from './webhook.js';
 
 const logger = getLogger('line');
 
+/** LINE replyToken 有效期短，过期后 reply 必 400；缓存带时间戳，超时弃用改走 push。 */
+const REPLY_TOKEN_TTL_MS = 60_000;
+/** 出站 HTTP 调用统一 30s 超时。 */
+const OUTBOUND_TIMEOUT_MS = 30_000;
+
 export type LineFetch = (
   url: string,
   init?: {
     readonly method?: string;
     readonly headers?: Record<string, string>;
     readonly body?: string;
+    readonly signal?: AbortSignal;
   },
 ) => Promise<{
   readonly ok: boolean;
@@ -48,10 +54,11 @@ export class LineEndpoint implements EndpointInstance {
   readonly #options: LineEndpointOptions;
   readonly #fetch: LineFetch;
   #routeReleases: HttpRouteRegistration[] = [];
-  #replyTokenCache = new Map<string, string>();
+  #replyTokenCache = new Map<string, { token: string; timestamp: number }>();
   #open = false;
   #started = false;
   #unregisterAgent?: () => void;
+  readonly management: EndpointManagement = createLineEndpointManagement(this);
 
   constructor(options: LineEndpointOptions) {
     this.#options = options;
@@ -116,10 +123,22 @@ export class LineEndpoint implements EndpointInstance {
       throw new Error('No valid LINE messages to send');
     }
 
-    const replyToken = this.#replyTokenCache.get(target);
-    if (replyToken) {
+    const cached = this.#replyTokenCache.get(target);
+    if (cached) {
       this.#replyTokenCache.delete(target);
-      return this.#replyMessage(replyToken, messages);
+      if (Date.now() - cached.timestamp <= REPLY_TOKEN_TTL_MS) {
+        try {
+          return await this.#replyMessage(cached.token, messages);
+        } catch (error) {
+          // replyToken 过期/失效时 LINE 返回 400，回退 push 保证消息不丢
+          if ((error as { status?: number }).status !== 400) throw error;
+          logger.warn(formatCompact({
+            op: 'line_reply_fallback_push',
+            endpoint: this.#options.config.name,
+            target,
+          }));
+        }
+      }
     }
 
     if (!isValidLineRecipientId(target)) {
@@ -135,7 +154,7 @@ export class LineEndpoint implements EndpointInstance {
     if (!this.#open) return;
     const { channelId } = resolveChannel(event.source);
     if ('replyToken' in event && typeof event.replyToken === 'string') {
-      this.#replyTokenCache.set(channelId, event.replyToken);
+      this.#replyTokenCache.set(channelId, { token: event.replyToken, timestamp: Date.now() });
     }
     void this.#options.gateway.receive({
       adapter: this.#options.id,
@@ -171,10 +190,13 @@ export class LineEndpoint implements EndpointInstance {
         Authorization: `Bearer ${this.#options.config.channelAccessToken}`,
       },
       body: JSON.stringify({ replyToken, messages }),
+      signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
     });
     if (!response.ok) {
       const errorText = await response.text();
-      throw new Error(`LINE Reply API error ${response.status}: ${errorText}`);
+      const error = new Error(`LINE Reply API error ${response.status}: ${errorText}`) as Error & { status?: number };
+      error.status = response.status;
+      throw error;
     }
     const result = await response.json() as LineApiResponse;
     return result.sentMessages?.[0]?.id || `reply-${Date.now()}`;
@@ -192,6 +214,7 @@ export class LineEndpoint implements EndpointInstance {
         Authorization: `Bearer ${this.#options.config.channelAccessToken}`,
       },
       body: JSON.stringify({ to, messages }),
+      signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
     });
     if (!response.ok) {
       const errorText = await response.text();
@@ -200,4 +223,61 @@ export class LineEndpoint implements EndpointInstance {
     const result = await response.json() as LineApiResponse;
     return result.sentMessages?.[0]?.id || `push-${Date.now()}`;
   }
+
+  /**
+   * group/room 成员列表：Bot API 无群列表，只能按已知 groupId/roomId 拉成员。
+   * members/ids 分页（next continuation token）后逐个取 profile 归一 nickname；
+   * 单个 profile 失败（用户已退群等）时回退 userId 占位，不拖垮整批。
+   */
+  async getGroupMembers(groupId: string): Promise<LineGroupMember[]> {
+    const kind = groupId.startsWith('R') ? 'room' : 'group';
+    const memberIds: string[] = [];
+    let start: string | undefined;
+    do {
+      const query = start ? `?start=${encodeURIComponent(start)}` : '';
+      const data = await this.#get(
+        `${this.#options.config.apiBaseUrl}/v2/bot/${kind}/${encodeURIComponent(groupId)}/members/ids${query}`,
+      ) as { memberIds?: string[]; next?: string };
+      for (const id of data.memberIds ?? []) {
+        if (typeof id === 'string' && id) memberIds.push(id);
+      }
+      start = data.next || undefined;
+    } while (start);
+
+    return Promise.all(memberIds.map(async (userId) => {
+      try {
+        const profile = await this.#get(
+          `${this.#options.config.apiBaseUrl}/v2/bot/${kind}/${encodeURIComponent(groupId)}/member/${encodeURIComponent(userId)}`,
+        ) as { displayName?: string };
+        return { user_id: userId, nickname: String(profile.displayName ?? userId) };
+      } catch {
+        return { user_id: userId, nickname: userId };
+      }
+    }));
+  }
+
+  async #get(url: string): Promise<unknown> {
+    const response = await this.#fetch(url, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${this.#options.config.channelAccessToken}` },
+      signal: AbortSignal.timeout(OUTBOUND_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`LINE API error ${response.status}: ${errorText}`);
+    }
+    return response.json();
+  }
+}
+
+export interface LineGroupMember {
+  readonly user_id: string;
+  readonly nickname: string;
+}
+
+function createLineEndpointManagement(endpoint: LineEndpoint): EndpointManagement {
+  return Object.freeze<EndpointManagement>({
+    // listGroups 不接：LINE Bot API 没有"我加入了哪些群"的接口，群 id 只能来自入站事件。
+    listGroupMembers: (groupId) => endpoint.getGroupMembers(groupId),
+  });
 }

package/src/line-endpoint-commands.ts

@@ -0,0 +1,18 @@
+/**
+ * `line endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ */
+import { createEndpointCommands } from '@zhin.js/adapter';
+import { defineCommand } from '@zhin.js/command';
+import { lineRuntimeStateToken } from './line-runtime-state.js';
+
+export const lineEndpointCommands = createEndpointCommands({
+  adapterKey: 'line',
+  adapterDisplayName: 'LINE',
+  fields: [
+    { key: 'channelSecret', required: true, env: true, description: 'LINE channel secret' },
+    { key: 'channelAccessToken', required: true, env: true, description: 'LINE channel access token' },
+  ],
+  running: (use) => use(lineRuntimeStateToken).endpoints.values(),
+  describeEntry: (entry) => `channelAccessToken: ${String(entry.channelAccessToken)}`,
+}, defineCommand);

package/src/line-runtime-state.ts

@@ -0,0 +1,7 @@
+/**
+ * LINE 插件实例的运行时状态：adapter create() 注册的 endpoint 列表。
+ * 由 plugin.ts setup() provide，adapter create 与 `line endpoint` 命令共享（同一 owner generation）。
+ */
+import { defineEndpointRuntimeStateToken } from '@zhin.js/adapter';
+
+export const lineRuntimeStateToken = defineEndpointRuntimeStateToken('line');

package/plugin.ts

@@ -1,8 +0,0 @@
-import { definePlugin } from '@zhin.js/plugin-runtime';
-
-export default definePlugin({
-  name: 'line',
-  metadata: {
-    displayName: 'LINE Messaging API Adapter',
-  },
-});