@zhin.js/adapter-wechat-mp 1.1.7 → 1.1.9

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @zhin.js/adapter-wechat-mp
 
+## 1.1.9
+
+### Patch Changes
+
+- 75e26a6: Raise the supported Node.js range to `>=22.19.0` (was `^20.19.0 || >=22.12.0`). `@zhin.js/ai` depends on undici 8, whose `engines` require Node >=22.19.0; on Node 20 it crashes at import (`webidl.util.markAsUncloneable is not a function`). CI already tests only Node 22 / 24 / 26. `zhin doctor`, `zhin new`, `zhin migrate` and `create-zhin-app` now check for and write the same range.
+- fdc2148: Unblock external plugin authors.
+
+  - Published manifests no longer expose the source-only `development` export condition (it pointed at `./src/*.ts`, which is not in the tarball, so Vitest 4 and other tools that enable `development` failed to import Zhin packages). Each package now carries `publishConfig.exports` without that condition; `pnpm publish` swaps it in when packing, and the monorepo keeps source-level development.
+  - `zhin new` no longer crashes without arguments (uses inquirer `select` instead of the removed `list` prompt; same fix for `zhin onboard` and `zhin pub`). The generated package.json uses `^x.y.z` ranges derived from installed versions instead of `latest`, declares capability packages as optional peers (plus devDependencies for local tests) instead of dependencies, sets `zhin.entry` to `./plugin.js` and builds sibling JavaScript on `prepack`, fixes the adapter template test, and adds `--package-name`. `--skip-install` now also skips the project-root install.
+
+- Updated dependencies [75e26a6]
+- Updated dependencies [fdc2148]
+  - @zhin.js/adapter@1.1.19
+  - @zhin.js/core@1.1.44
+  - @zhin.js/feature-kit@1.1.5
+  - @zhin.js/host-http@1.1.6
+  - @zhin.js/im-contract@1.1.4
+  - @zhin.js/skill@1.1.6
+  - @zhin.js/logger@1.1.2
+
+## 1.1.8
+
+### Patch Changes
+
+- 2dfe5fa: 修复 ScheduleEngine every/at 任务回调异常未被捕获、超长延时被 Node 截断立即触发、at 回调内同 id 重注册被误删；修复微信公众号 access_token 并发刷新互相顶掉、expires_in 缺失时永不过期。
+- Updated dependencies [9891e66]
+- Updated dependencies [bf52b40]
+- Updated dependencies [bf52b40]
+- Updated dependencies [bf52b40]
+- Updated dependencies [386150d]
+- Updated dependencies [9891e66]
+- Updated dependencies [9891e66]
+- Updated dependencies [4778587]
+- Updated dependencies [40537e3]
+- Updated dependencies [681abf3]
+- Updated dependencies [9891e66]
+- Updated dependencies [9891e66]
+  - @zhin.js/adapter@1.1.18
+  - @zhin.js/core@1.1.43
+  - @zhin.js/host-http@1.1.5
+  - @zhin.js/feature-kit@1.1.4
+  - @zhin.js/skill@1.1.5
+
 ## 1.1.7
 
 ### Patch Changes

package/lib/client.d.ts

@@ -14,6 +14,10 @@ export declare class WeChatMpClient {
     constructor(config: ResolvedWeChatMpConfig, fetch: WeChatMpFetch);
     get accessToken(): string | null;
     get tokenExpired(): boolean;
+    /**
+     * 刷新 access_token。并发调用共享同一次请求：微信每次换取新 token 都会使旧 token
+     * 进入失效倒计时，且有每日调用次数上限，重复刷新会互相顶掉并消耗配额。
+     */
     refreshAccessToken(): Promise<string>;
     request<T = unknown>(path: string, init?: Parameters<WeChatMpFetch>[1]): Promise<T>;
     sendCustomerService(messageData: unknown): Promise<WeChatAPIResponse>;

package/lib/client.js

@@ -1,11 +1,16 @@
 import { defineEndpointClient } from 'zhin.js/adapter';
 const TOKEN_INVALID_ERRCODES = new Set([40001, 40014, 42001]);
+/** 换取 token 请求的超时，防止挂起的请求让 single-flight 永久卡住。 */
+const TOKEN_FETCH_TIMEOUT_MS = 15_000;
+/** 官方 access_token 有效期为 7200s；对异常大的 expires_in 设上限。 */
+const MAX_TOKEN_LIFETIME_SEC = 7200;
 /** Direct WeChat Official Account API client exposed to plugins. */
 export class WeChatMpClient {
     config;
     fetch;
     #accessToken = null;
     #tokenExpireTime = 0;
+    #refreshing = null;
     constructor(config, fetch) {
         this.config = config;
         this.fetch = fetch;
@@ -16,10 +21,28 @@ export class WeChatMpClient {
     get tokenExpired() {
         return !this.#accessToken || Date.now() >= this.#tokenExpireTime;
     }
-    async refreshAccessToken() {
+    /**
+     * 刷新 access_token。并发调用共享同一次请求：微信每次换取新 token 都会使旧 token
+     * 进入失效倒计时，且有每日调用次数上限，重复刷新会互相顶掉并消耗配额。
+     */
+    refreshAccessToken() {
+        if (!this.#refreshing) {
+            this.#refreshing = this.#fetchAccessToken().finally(() => {
+                this.#refreshing = null;
+            });
+        }
+        return this.#refreshing;
+    }
+    async #fetchAccessToken() {
         const { appId, appSecret } = this.config;
-        const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${appId}&secret=${appSecret}`;
-        const response = await this.fetch(url);
+        const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${encodeURIComponent(appId)}&secret=${encodeURIComponent(appSecret)}`;
+        let timeout;
+        const response = await Promise.race([
+            this.fetch(url),
+            new Promise((_, reject) => {
+                timeout = setTimeout(() => reject(new Error('Failed to get access token: request timed out')), TOKEN_FETCH_TIMEOUT_MS);
+            }),
+        ]).finally(() => clearTimeout(timeout));
         const data = response.data;
         if (!data.access_token) {
             throw new Error(data.errmsg
@@ -27,20 +50,32 @@ export class WeChatMpClient {
                 : 'Failed to get access token');
         }
         this.#accessToken = data.access_token;
-        this.#tokenExpireTime = Date.now() + (data.expires_in - 300) * 1000;
+        // expires_in 缺失/非法时 NaN 会让 tokenExpired 永远为 false；按官方默认 7200s 兜底。
+        const expiresIn = Number(data.expires_in);
+        const lifetimeSec = Number.isFinite(expiresIn) && expiresIn > 0
+            ? Math.min(expiresIn, MAX_TOKEN_LIFETIME_SEC)
+            : MAX_TOKEN_LIFETIME_SEC;
+        this.#tokenExpireTime = Date.now() + (lifetimeSec - 300) * 1000;
         return data.access_token;
     }
     async request(path, init) {
+        return (await this.#requestWithToken(path, init)).data;
+    }
+    async #requestWithToken(path, init) {
         if (this.tokenExpired)
             await this.refreshAccessToken();
+        const token = this.#accessToken;
         const separator = path.includes('?') ? '&' : '?';
-        const response = await this.fetch(`https://api.weixin.qq.com${path}${separator}access_token=${this.#accessToken}`, init);
-        return response.data;
+        const response = await this.fetch(`https://api.weixin.qq.com${path}${separator}access_token=${token}`, init);
+        return { data: response.data, token };
     }
     async sendCustomerService(messageData) {
-        let result = await this.request('/cgi-bin/message/custom/send', { method: 'POST', body: messageData });
+        const first = await this.#requestWithToken('/cgi-bin/message/custom/send', { method: 'POST', body: messageData });
+        let result = first.data;
         if (result.errcode && TOKEN_INVALID_ERRCODES.has(Number(result.errcode))) {
-            await this.refreshAccessToken();
+            // 失败请求使用的 token 若已被其他请求换掉，直接用新 token 重试，不再重复刷新。
+            if (this.#accessToken === first.token)
+                await this.refreshAccessToken();
             result = await this.request('/cgi-bin/message/custom/send', { method: 'POST', body: messageData });
         }
         return result;

package/lib/endpoint.js

@@ -243,6 +243,8 @@ export class WeChatMpEndpoint extends Endpoint {
         return this.client.uploadMedia(type, form);
     }
     #startTokenRefreshTimer() {
+        if (this.#tokenRefreshTimer)
+            clearInterval(this.#tokenRefreshTimer);
         this.#tokenRefreshTimer = setInterval(() => {
             if (this.client.tokenExpired) {
                 void this.client.refreshAccessToken().catch((error) => {
@@ -250,6 +252,7 @@ export class WeChatMpEndpoint extends Endpoint {
                 });
             }
         }, 3_600_000);
+        this.#tokenRefreshTimer.unref?.();
     }
 }
 function createWeChatMpEndpointManagement(requireClient) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-wechat-mp",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "type": "module",
   "description": "Zhin.js WeChat Official Account adapter for Plugin Runtime (HTTP webhook)",
   "main": "./lib/index.js",
@@ -8,20 +8,20 @@
   "dependencies": {
     "axios": "^1.19.0",
     "xml2js": "^0.6.2",
-    "@zhin.js/adapter": "1.1.17",
-    "@zhin.js/core": "1.1.42",
-    "@zhin.js/feature-kit": "1.1.3",
-    "@zhin.js/host-http": "1.1.4",
-    "@zhin.js/im-contract": "1.1.3",
-    "@zhin.js/logger": "1.1.1",
-    "@zhin.js/skill": "1.1.4"
+    "@zhin.js/adapter": "1.1.19",
+    "@zhin.js/core": "1.1.44",
+    "@zhin.js/feature-kit": "1.1.5",
+    "@zhin.js/host-http": "1.1.6",
+    "@zhin.js/im-contract": "1.1.4",
+    "@zhin.js/logger": "1.1.2",
+    "@zhin.js/skill": "1.1.6"
   },
   "peerDependencies": {
-    "@zhin.js/adapter": "^1.1.17",
-    "@zhin.js/command": "^1.1.5",
-    "@zhin.js/core": "^1.1.42",
-    "@zhin.js/host-http": "^1.1.4",
-    "zhin.js": "^1.1.7"
+    "@zhin.js/adapter": "^1.1.19",
+    "@zhin.js/command": "^1.1.7",
+    "@zhin.js/core": "^1.1.44",
+    "@zhin.js/host-http": "^1.1.6",
+    "zhin.js": "^1.1.9"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
@@ -36,7 +36,7 @@
     "@types/xml2js": "^0.4.14",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zhin.js": "1.1.7"
+    "zhin.js": "1.1.9"
   },
   "keywords": [
     "zhin",
@@ -79,12 +79,11 @@
   "exports": {
     ".": {
       "types": "./lib/index.d.ts",
-      "development": "./src/index.ts",
       "import": "./lib/index.js"
     }
   },
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": ">=22.19.0"
   },
   "zhin": {
     "protocol": 1,

package/src/client.ts

@@ -7,6 +7,10 @@ import type { WeChatMediaUploadResult } from './media-upload.js';
 import { defineEndpointClient } from 'zhin.js/adapter';
 
 const TOKEN_INVALID_ERRCODES = new Set([40001, 40014, 42001]);
+/** 换取 token 请求的超时，防止挂起的请求让 single-flight 永久卡住。 */
+const TOKEN_FETCH_TIMEOUT_MS = 15_000;
+/** 官方 access_token 有效期为 7200s；对异常大的 expires_in 设上限。 */
+const MAX_TOKEN_LIFETIME_SEC = 7200;
 
 export type WeChatMpFetch = (
   url: string,
@@ -21,6 +25,7 @@ export type WeChatMpFetch = (
 export class WeChatMpClient {
   #accessToken: string | null = null;
   #tokenExpireTime = 0;
+  #refreshing: Promise<string> | null = null;
 
   constructor(
     readonly config: ResolvedWeChatMpConfig,
@@ -35,10 +40,29 @@ export class WeChatMpClient {
     return !this.#accessToken || Date.now() >= this.#tokenExpireTime;
   }
 
-  async refreshAccessToken(): Promise<string> {
+  /**
+   * 刷新 access_token。并发调用共享同一次请求：微信每次换取新 token 都会使旧 token
+   * 进入失效倒计时，且有每日调用次数上限，重复刷新会互相顶掉并消耗配额。
+   */
+  refreshAccessToken(): Promise<string> {
+    if (!this.#refreshing) {
+      this.#refreshing = this.#fetchAccessToken().finally(() => {
+        this.#refreshing = null;
+      });
+    }
+    return this.#refreshing;
+  }
+
+  async #fetchAccessToken(): Promise<string> {
     const { appId, appSecret } = this.config;
-    const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${appId}&secret=${appSecret}`;
-    const response = await this.fetch(url);
+    const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${encodeURIComponent(appId)}&secret=${encodeURIComponent(appSecret)}`;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    const response = await Promise.race([
+      this.fetch(url),
+      new Promise<never>((_, reject) => {
+        timeout = setTimeout(() => reject(new Error('Failed to get access token: request timed out')), TOKEN_FETCH_TIMEOUT_MS);
+      }),
+    ]).finally(() => clearTimeout(timeout));
     const data = response.data as TokenResponse & WeChatAPIResponse;
     if (!data.access_token) {
       throw new Error(data.errmsg
@@ -46,7 +70,12 @@ export class WeChatMpClient {
         : 'Failed to get access token');
     }
     this.#accessToken = data.access_token;
-    this.#tokenExpireTime = Date.now() + (data.expires_in - 300) * 1000;
+    // expires_in 缺失/非法时 NaN 会让 tokenExpired 永远为 false；按官方默认 7200s 兜底。
+    const expiresIn = Number(data.expires_in);
+    const lifetimeSec = Number.isFinite(expiresIn) && expiresIn > 0
+      ? Math.min(expiresIn, MAX_TOKEN_LIFETIME_SEC)
+      : MAX_TOKEN_LIFETIME_SEC;
+    this.#tokenExpireTime = Date.now() + (lifetimeSec - 300) * 1000;
     return data.access_token;
   }
 
@@ -54,22 +83,32 @@ export class WeChatMpClient {
     path: string,
     init?: Parameters<WeChatMpFetch>[1],
   ): Promise<T> {
+    return (await this.#requestWithToken<T>(path, init)).data;
+  }
+
+  async #requestWithToken<T>(
+    path: string,
+    init?: Parameters<WeChatMpFetch>[1],
+  ): Promise<{ readonly data: T; readonly token: string | null }> {
     if (this.tokenExpired) await this.refreshAccessToken();
+    const token = this.#accessToken;
     const separator = path.includes('?') ? '&' : '?';
     const response = await this.fetch(
-      `https://api.weixin.qq.com${path}${separator}access_token=${this.#accessToken}`,
+      `https://api.weixin.qq.com${path}${separator}access_token=${token}`,
       init,
     );
-    return response.data as T;
+    return { data: response.data as T, token };
   }
 
   async sendCustomerService(messageData: unknown): Promise<WeChatAPIResponse> {
-    let result = await this.request<WeChatAPIResponse>(
+    const first = await this.#requestWithToken<WeChatAPIResponse>(
       '/cgi-bin/message/custom/send',
       { method: 'POST', body: messageData },
     );
+    let result = first.data;
     if (result.errcode && TOKEN_INVALID_ERRCODES.has(Number(result.errcode))) {
-      await this.refreshAccessToken();
+      // 失败请求使用的 token 若已被其他请求换掉，直接用新 token 重试，不再重复刷新。
+      if (this.#accessToken === first.token) await this.refreshAccessToken();
       result = await this.request<WeChatAPIResponse>(
         '/cgi-bin/message/custom/send',
         { method: 'POST', body: messageData },

package/src/endpoint.ts

@@ -289,6 +289,7 @@ export class WeChatMpEndpoint extends Endpoint<WeChatMpClient> {
   }
 
   #startTokenRefreshTimer(): void {
+    if (this.#tokenRefreshTimer) clearInterval(this.#tokenRefreshTimer);
     this.#tokenRefreshTimer = setInterval(() => {
       if (this.client.tokenExpired) {
         void this.client.refreshAccessToken().catch((error) => {
@@ -296,6 +297,7 @@ export class WeChatMpEndpoint extends Endpoint<WeChatMpClient> {
         });
       }
     }, 3_600_000);
+    (this.#tokenRefreshTimer as { unref?: () => void }).unref?.();
   }
 }