@zhin.js/adapter-wecom 1.1.0 → 1.1.3

package/CHANGELOG.md

@@ -1,5 +1,112 @@
 # @zhin.js/adapter-wecom
 
+## 1.1.3
+
+### Patch Changes
+
+- Updated dependencies [5b5d270]
+- Updated dependencies [36c2eb9]
+  - @zhin.js/im-contract@1.1.2
+  - @zhin.js/core@1.1.38
+  - @zhin.js/adapter@1.1.15
+  - @zhin.js/host-http@1.1.2
+  - @zhin.js/agent-feature@1.1.2
+  - @zhin.js/feature-kit@1.1.2
+  - @zhin.js/skill@1.1.2
+  - @zhin.js/tool@1.1.2
+
+## 1.1.2
+
+### Patch Changes
+
+- a9e4a40: Derive Command user routes only from explicit `commands/**/*/index.ts(x)` entry paths instead of prepending the plugin owner. Child plugins can now publish top-level static or dynamic commands, while duplicate routes across owners fail during generation construction. Adapter endpoint commands move to explicit paths such as `commands/qq/endpoint/list/index.ts` and are invoked as `qq endpoint list`.
+- 8740059: Standardize TypeScript capabilities on named module directories such as `commands/foo/index.ts`, `middlewares/audit/index.ts`, `handlers/message-receive/index.ts`, `pages/workroom/index.tsx`, and `mcps/filesystem/index.ts`. Only the fixed `index` entry is discovered; sibling files remain private helpers.
+
+  Command route segments come from directories, while `[name]`, `[[name]]`, `[...name]`, and `[[...name]]` directories declare dynamic parameters. Plugin owners do not enter the route unless their config explicitly sets `commandNamespace`; Endpoint `commandPrefix` remains platform-owned and defaults to an empty string.
+
+  Migrate the built-in adapters, plugins, examples, generators, migration tooling, hot reload classification, Agent authoring surfaces, documentation, and release artifacts to the explicit entry convention.
+
+  Make Tool ownership and progressive disclosure explicit across all four supported locations: plugin-public `tools/`, Agent-private `agents/<name>/tools/`, Skill-private `skills/<name>/tools/`, and Agent-Skill-private `agents/<name>/skills/<name>/tools/`. Move adapter and group-suite operations that require domain instructions into their owning Skills so `load_skill` is the only path that unlocks their schemas.
+
+  Remove the package-root `agent/` convention. Public capabilities now use named package-root directories, schedules use `schedules/<name>/index.ts` or `plugin.ts` injection, MCP connections use `mcps/<name>/index.ts`, Prompt Sections use `prompt-sections/<name>/index.ts`, Agent definitions use `agents/<name>/`, and permission vocabulary is published as `PERMITS.md`.
+
+- 25a845a: Unify Skills on `skills/<name>/SKILL.md`, support Agent-private Skills and nested Skill-private Tools, publish and mount existing plugin Skills, add governed Skill metadata and Turn access filtering, unlock only already-admitted same-owner Tools, and make `on-risk` and `once` approval behavior precise.
+- ddbb92e: Isolate adapter Skills under platform-specific Agents and automatically select the matching platform Agent for IM ingress, preventing unrelated adapter Skills from entering another platform's prompt surface.
+- 4380cf9: Colocate adapter command definitions and Agent Skill handlers with their owning capabilities, and provide a shared validated platform permission constructor.
+- b74e131: Require one canonical expanded WeCom endpoint configuration. The protocol no longer reinterprets nested `endpoints` or reads endpoint identity and credentials from `process.env`.
+- 5c3858e: Make `@zhin.js/im-contract` the explicit zero-dependency owner of transport identities, canonical segments, media guards, conversation facts, stores, and delivery contracts. Platform adapters now read media contracts from that foundation instead of reaching through Core.
+- 33ea736: Use `tools/<name>/index.ts` and `defineAgentTool` from `@zhin.js/tool` as the sole Agent Tool authoring model. Remove the duplicate `@zhin.js/tools` definition, context, bridge, export, and discovery path; migrate plugin manifests, examples, scaffolding, HMR, and prepack compilation to the generation-owned Tool Feature.
+- Updated dependencies [c861789]
+- Updated dependencies [1414ccb]
+- Updated dependencies [743d470]
+- Updated dependencies [62dee52]
+- Updated dependencies [cd54131]
+- Updated dependencies [244e475]
+- Updated dependencies [a9e4a40]
+- Updated dependencies [5855db7]
+- Updated dependencies [ec921d2]
+- Updated dependencies [8740059]
+- Updated dependencies [63d1f7a]
+- Updated dependencies [25a845a]
+- Updated dependencies [103f2c3]
+- Updated dependencies [9110ab8]
+- Updated dependencies [cd2a888]
+- Updated dependencies [eb3227a]
+- Updated dependencies [b853dba]
+- Updated dependencies [e561309]
+- Updated dependencies [d4c6175]
+- Updated dependencies [7a0e1ca]
+- Updated dependencies [103b5d3]
+- Updated dependencies [5a7a7f7]
+- Updated dependencies [b076eae]
+- Updated dependencies [535fed1]
+- Updated dependencies [73a24b7]
+- Updated dependencies [2dbbc15]
+- Updated dependencies [1cb1163]
+- Updated dependencies [be3061e]
+- Updated dependencies [75f8332]
+- Updated dependencies [81935e2]
+- Updated dependencies [f9ed01b]
+- Updated dependencies [ac0ab50]
+- Updated dependencies [5140ce1]
+- Updated dependencies [522d75f]
+- Updated dependencies [a7611b3]
+- Updated dependencies [8823044]
+- Updated dependencies [379439b]
+- Updated dependencies [11c9352]
+- Updated dependencies [6b70e46]
+- Updated dependencies [135ac91]
+- Updated dependencies [140cf0f]
+- Updated dependencies [251e4d2]
+- Updated dependencies [203ad34]
+- Updated dependencies [e6c5113]
+- Updated dependencies [e0f6478]
+- Updated dependencies [baef56b]
+- Updated dependencies [698f16f]
+- Updated dependencies [da0a8e3]
+- Updated dependencies [2fd8017]
+- Updated dependencies [5c3858e]
+- Updated dependencies [33ea736]
+- Updated dependencies [507d602]
+- Updated dependencies [df9f76b]
+  - @zhin.js/core@1.1.37
+  - @zhin.js/tool@1.1.1
+  - @zhin.js/host-http@1.1.1
+  - @zhin.js/adapter@1.1.14
+  - @zhin.js/feature-kit@1.1.1
+  - @zhin.js/agent-feature@1.1.1
+  - @zhin.js/skill@1.1.1
+  - @zhin.js/logger@1.1.1
+  - @zhin.js/im-contract@1.1.1
+
+## 1.1.1
+
+### Patch Changes
+
+- Updated dependencies [769e67f]
+  - @zhin.js/adapter@1.1.13
+  - @zhin.js/core@1.1.36
+
 ## 1.1.0
 
 ### Minor Changes

package/README.md

@@ -17,7 +17,7 @@ pnpm add @zhin.js/adapter-wecom
 
 ## Plugin Runtime
 
-- `@zhin.js/adapter` — 约定式 `adapters/wecom.ts`（`defineAdapter`）
+- `@zhin.js/adapter` — 约定式 `adapters/wecom/index.ts`（`defineAdapter`）
 - `@zhin.js/core` — `Endpoint.emit(...)` 入站、`outboundMessageToken` 出站
 - `@zhin.js/host-http` — `httpHostToken` 注册 Webhook 路由（**非** legacy host-router/Koa）
 - `zhin.js` — `plugin.ts`（`definePlugin`）
@@ -39,7 +39,9 @@ pnpm add @zhin.js/adapter-wecom
    - **Token** / **EncodingAESKey** 与配置一致
 4. Runtime Host（`http`）须已 listen，Webhook 才可达
 
-必填字段（`endpoints[i]`）：`name`、`corpId`、`agentSecret`、`token`、`encodingAESKey`。
+必填字段（`endpoints[i]`）：`id`、`corpId`、`agentSecret`、`token`、`encodingAESKey`。
+运行时由 AdapterIndex 把实例级默认值与每个 endpoint 合并；协议实现只接收一份展开后的
+endpoint 配置。
 
 ## 最小配置
 
@@ -50,7 +52,7 @@ plugins:
     webhookPath: /wecom/callback       # 可选，默认 /wecom/callback
     apiBaseUrl: https://qyapi.weixin.qq.com  # 可选
     endpoints:
-      - name: wecom-bot
+      - id: wecom-bot
         corpId: ${WECOM_CORP_ID}
         agentSecret: ${WECOM_AGENT_SECRET}
         token: ${WECOM_TOKEN}
@@ -61,6 +63,8 @@ plugins:
 
 ## 环境变量
 
+环境变量通过 `zhin.config.yml` 的 `${...}` 引用解析；适配器协议层不会直接读取它们。
+
 | 变量 | 说明 |
 |------|------|
 | `WECOM_CORP_ID` | 企业 ID |
@@ -108,9 +112,9 @@ Access Token 在过期前 5 分钟自动刷新。
 
 | 类别 | 路径 |
 |------|------|
-| Permit 词汇 | `agent/PERMITS.md` |
-| 平台工具（4 个） | `agent/tools/` |
-| 技能说明 | `agent/skills/wecom.md` |
+| Permit 词汇 | `PERMITS.md` |
+| 平台工具（4 个） | `tools/` |
+| 技能说明 | `agents/wecom/skills/wecom/SKILL.md` |
 
 ## 平台权限（platform permit）
 

package/adapters/{wecom.js → wecom/index.js}

@@ -1,14 +1,14 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 /**
- * Convention entry: discover `adapters/wecom.ts` → defineAdapter.
+ * Convention entry: discover `adapters/wecom/index.ts` → defineAdapter.
  * Implementation lives under `src/` (endpoint / webhook / protocol).
  */
 import { defineAdapter } from 'zhin.js/adapter';
 import { httpHostToken } from '@zhin.js/host-http';
-import { WecomEndpoint } from "../lib/endpoint.js";
-import { resolveWecomConfig, } from "../lib/protocol.js";
-import { wecomRuntimeStateToken } from "../lib/wecom-runtime-state.js";
-export { WecomEndpoint } from "../lib/endpoint.js";
+import { WecomEndpoint } from "../../lib/endpoint.js";
+import { resolveWecomConfig, } from "../../lib/protocol.js";
+import { wecomRuntimeStateToken } from "../../lib/wecom-runtime-state.js";
+export { WecomEndpoint } from "../../lib/endpoint.js";
 export default defineAdapter({
     capabilities: ['inbound', 'outbound'],
     operations: ['recall'],
@@ -20,7 +20,7 @@ export default defineAdapter({
     },
     create(context) {
         const config = resolveWecomConfig(context.config);
-        // 注册到插件运行时状态（wecom.endpoint list 的"运行中"数据源）
+        // 注册到插件运行时状态（wecom endpoint list 的"运行中"数据源）
         context.use(wecomRuntimeStateToken).endpoints.set(config.id, {
             id: config.id,
             mode: 'webhook',

package/adapters/{wecom.ts → wecom/index.ts}

@@ -1,20 +1,20 @@
 /**
- * Convention entry: discover `adapters/wecom.ts` → defineAdapter.
+ * Convention entry: discover `adapters/wecom/index.ts` → defineAdapter.
  * Implementation lives under `src/` (endpoint / webhook / protocol).
  */
 import { defineAdapter } from 'zhin.js/adapter';
 import { httpHostToken } from '@zhin.js/host-http';
-import { WecomEndpoint } from '../src/endpoint.js';
+import { WecomEndpoint } from '../../src/endpoint.js';
 import {
   resolveWecomConfig,
-  type WecomAdapterConfig,
-} from '../src/protocol.js';
-import { wecomRuntimeStateToken } from '../src/wecom-runtime-state.js';
+  type WecomEndpointConfig,
+} from '../../src/protocol.js';
+import { wecomRuntimeStateToken } from '../../src/wecom-runtime-state.js';
 
-export { WecomEndpoint } from '../src/endpoint.js';
-export type { WecomEndpointOptions, WecomFetch } from '../src/endpoint.js';
+export { WecomEndpoint } from '../../src/endpoint.js';
+export type { WecomEndpointOptions, WecomFetch } from '../../src/endpoint.js';
 
-export default defineAdapter<WecomAdapterConfig>({
+export default defineAdapter<WecomEndpointConfig>({
   capabilities: ['inbound', 'outbound'],
   operations: ['recall'],
   // image 段全部经 /cgi-bin/media/upload 物化为 media_id（url 下载后上传、
@@ -25,7 +25,7 @@ export default defineAdapter<WecomAdapterConfig>({
   },
   create(context) {
     const config = resolveWecomConfig(context.config);
-    // 注册到插件运行时状态（wecom.endpoint list 的"运行中"数据源）
+    // 注册到插件运行时状态（wecom endpoint list 的"运行中"数据源）
     context.use(wecomRuntimeStateToken).endpoints.set(config.id, {
       id: config.id,
       mode: 'webhook',

package/agents/wecom/agent.json

@@ -0,0 +1,20 @@
+{
+  "name": "WECOM Platform Agent",
+  "version": "1.0.0",
+  "description": "Handles wecom platform-specific operations and progressively loads only the required platform Skill.",
+  "trigger_rules": {
+    "file_patterns": [],
+    "keywords": [
+      "wecom",
+      "adapter:wecom"
+    ]
+  },
+  "entry_points": [
+    "system.md",
+    "boundaries.md",
+    "conventions.md"
+  ],
+  "platforms": [
+    "wecom"
+  ]
+}

package/agents/wecom/boundaries.md

@@ -0,0 +1,3 @@
+# Boundaries
+
+Operate only on the active wecom endpoint and authenticated conversation context. Respect every Tool permission and approval policy. Do not infer identifiers, roles, or authorization from display names.

package/agents/wecom/conventions.md

@@ -0,0 +1,3 @@
+# Conventions
+
+Use stable platform identifiers from the current turn or directory queries. Load one task-specific Skill at a time, and use the unified reply and outbound message path.

package/{agent/skills/wecom.md → agents/wecom/skills/wecom/SKILL.md}

@@ -18,10 +18,10 @@ tags:
   - im
   - enterprise
 tools:
-  - wecom_get_user
-  - wecom_get_dept_users
-  - wecom_list_departments
-  - wecom_send_text
+  - get_user
+  - get_dept_users
+  - list_departments
+  - send_text
 ---
 
 # 企业微信技能

package/agents/wecom/skills/wecom/tools/get_dept_users/index.js

@@ -0,0 +1,16 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { defineAgentTool } from '@zhin.js/tool';
+import { z } from 'zod';
+export default defineAgentTool({
+    description: '获取企业微信部门用户列表',
+    inputSchema: z.object({
+        dept_id: z.string().describe('部门 ID'),
+    }),
+    adapter: 'wecom',
+    tags: ['wecom'],
+    async execute({ dept_id }, context) {
+        const endpoint = context.$client;
+        const users = await endpoint.getDepartmentUsers(Number(dept_id));
+        return { users, count: users.length };
+    },
+});

package/{agent/tools/get_dept_users.ts → agents/wecom/skills/wecom/tools/get_dept_users/index.ts}

@@ -1,4 +1,4 @@
-import { defineAgentTool } from '@zhin.js/agent/tools';
+import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
 export default defineAgentTool<{ dept_id: string }>({
   description: '获取企业微信部门用户列表',

package/agents/wecom/skills/wecom/tools/get_user/index.js

@@ -0,0 +1,15 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { defineAgentTool } from '@zhin.js/tool';
+import { z } from 'zod';
+export default defineAgentTool({
+    description: '获取企业微信用户信息',
+    inputSchema: z.object({
+        user_id: z.string().describe('用户 ID'),
+    }),
+    adapter: 'wecom',
+    tags: ['wecom'],
+    async execute({ user_id }, context) {
+        const endpoint = context.$client;
+        return await endpoint.getUserInfo(user_id);
+    },
+});

package/{agent/tools/get_user.ts → agents/wecom/skills/wecom/tools/get_user/index.ts}

@@ -1,4 +1,4 @@
-import { defineAgentTool } from '@zhin.js/agent/tools';
+import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
 export default defineAgentTool<{ user_id: string }>({
   description: '获取企业微信用户信息',

package/agents/wecom/skills/wecom/tools/list_departments/index.js

@@ -0,0 +1,16 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { defineAgentTool } from '@zhin.js/tool';
+import { z } from 'zod';
+export default defineAgentTool({
+    description: '获取企业微信部门列表',
+    inputSchema: z.object({
+        dept_id: z.string().optional().describe('父部门 ID，默认 1（根部门）'),
+    }),
+    adapter: 'wecom',
+    tags: ['wecom'],
+    async execute({ dept_id }, context) {
+        const endpoint = context.$client;
+        const departments = await endpoint.getDepartmentList(Number(dept_id) || 1);
+        return { departments, count: departments.length };
+    },
+});

package/{agent/tools/list_departments.ts → agents/wecom/skills/wecom/tools/list_departments/index.ts}

@@ -1,4 +1,4 @@
-import { defineAgentTool } from '@zhin.js/agent/tools';
+import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
 export default defineAgentTool<{ dept_id?: string }>({
   description: '获取企业微信部门列表',

package/agents/wecom/skills/wecom/tools/send_text/index.js

@@ -0,0 +1,17 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { defineAgentTool } from '@zhin.js/tool';
+import { z } from 'zod';
+export default defineAgentTool({
+    description: '向指定企业微信用户发送文本消息',
+    inputSchema: z.object({
+        user_id: z.string().describe('用户 ID'),
+        content: z.string().describe('消息内容'),
+    }),
+    adapter: 'wecom',
+    tags: ['wecom'],
+    async execute({ user_id, content }, context) {
+        const endpoint = context.$client;
+        const success = await endpoint.sendTextMessage(user_id, content);
+        return { success, message: success ? '消息已发送' : '发送失败' };
+    },
+});

package/{agent/tools/send_text.ts → agents/wecom/skills/wecom/tools/send_text/index.ts}

@@ -1,4 +1,4 @@
-import { defineAgentTool } from '@zhin.js/agent/tools';
+import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
 export default defineAgentTool<{ user_id: string; content: string }>({
   description: '向指定企业微信用户发送文本消息',

package/agents/wecom/system.md

@@ -0,0 +1,3 @@
+# WECOM Platform Agent
+
+You are the wecom platform specialist. Interpret requests in the current wecom conversation and load only the narrowest private Skill needed for the task.

package/commands/{endpoint/add/[id].js → wecom/endpoint/add/[id]/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { wecomEndpointCommands } from "../../../lib/wecom-endpoint-commands.js";
+import { wecomEndpointCommands } from '../../definition.js';
 export default wecomEndpointCommands.add;

package/commands/wecom/endpoint/add/[id]/index.ts

@@ -0,0 +1,3 @@
+import { wecomEndpointCommands } from '../../definition.js';
+
+export default wecomEndpointCommands.add;

package/{lib/wecom-endpoint-commands.js → commands/wecom/endpoint/definition.js}

@@ -1,10 +1,11 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
 /**
- * `wecom.endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
- * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ * `wecom endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/wecom/endpoint/ 下的 list / add / remove 直接默认导出这三项。
  */
 import { createEndpointCommands } from 'zhin.js/adapter';
 import { defineCommand } from 'zhin.js/command';
-import { wecomRuntimeStateToken } from './wecom-runtime-state.js';
+import { wecomRuntimeStateToken } from "../../../lib/wecom-runtime-state.js";
 export const wecomEndpointCommands = createEndpointCommands({
     adapterKey: 'wecom',
     adapterDisplayName: 'WeCom',

package/{src/wecom-endpoint-commands.ts → commands/wecom/endpoint/definition.ts}

@@ -1,10 +1,10 @@
 /**
- * `wecom.endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
- * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ * `wecom endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/wecom/endpoint/ 下的 list / add / remove 直接默认导出这三项。
  */
 import { createEndpointCommands } from 'zhin.js/adapter';
 import { defineCommand } from 'zhin.js/command';
-import { wecomRuntimeStateToken } from './wecom-runtime-state.js';
+import { wecomRuntimeStateToken } from '../../../src/wecom-runtime-state.js';
 
 export const wecomEndpointCommands = createEndpointCommands({
   adapterKey: 'wecom',

package/commands/{endpoint/list.js → wecom/endpoint/list/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { wecomEndpointCommands } from "../../lib/wecom-endpoint-commands.js";
+import { wecomEndpointCommands } from '../definition.js';
 export default wecomEndpointCommands.list;

package/commands/wecom/endpoint/list/index.ts

@@ -0,0 +1,3 @@
+import { wecomEndpointCommands } from '../definition.js';
+
+export default wecomEndpointCommands.list;

package/commands/{endpoint/remove/[id].js → wecom/endpoint/remove/[id]/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { wecomEndpointCommands } from "../../../lib/wecom-endpoint-commands.js";
+import { wecomEndpointCommands } from '../../definition.js';
 export default wecomEndpointCommands.remove;

package/commands/wecom/endpoint/remove/[id]/index.ts

@@ -0,0 +1,3 @@
+import { wecomEndpointCommands } from '../../definition.js';
+
+export default wecomEndpointCommands.remove;

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-export { buildSendRequestBody, decryptMessage, extractEncryptFromXml, formatInboundContent, formatOutboundBody, getAesKey, normalizeEchostrParam, normalizeWebhookPath, parseXmlMessage, queryParam, readTextBody, resolveChatType, resolveWecomConfig, verifySignature, type AccessToken, type ResolvedWecomConfig, type WecomAdapterConfig, type WecomApiResponse, type WecomMessage, type WecomSendBody, type WecomWireSegment, } from './protocol.js';
+export { buildSendRequestBody, decryptMessage, extractEncryptFromXml, formatInboundContent, formatOutboundBody, getAesKey, normalizeEchostrParam, normalizeWebhookPath, parseXmlMessage, queryParam, readTextBody, resolveChatType, resolveWecomConfig, verifySignature, type AccessToken, type ResolvedWecomConfig, type WecomEndpointConfig, type WecomApiResponse, type WecomMessage, type WecomSendBody, type WecomWireSegment, } from './protocol.js';
 export { wecomClient, type WecomClientEventMap } from './client.js';
 export { checkWecomPlatformPermit, normalizeWecomSenderForPermit, platformPermit, wecomGroupPermitResolver, } from './platform-permit.js';
 export { WecomClient, WecomEndpoint, type WecomClientApi, type WecomEndpointOptions, type WecomFetch, } from './endpoint.js';

package/lib/media-upload.d.ts

@@ -1,4 +1,4 @@
-import { type MediaRef } from '@zhin.js/core';
+import { type MediaRef } from '@zhin.js/im-contract';
 export interface MediaBinary {
     readonly data: Buffer;
     readonly mimeType: string;

package/lib/media-upload.js

@@ -5,7 +5,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { basename } from 'node:path';
-import { isMediaRef } from '@zhin.js/core';
+import { isMediaRef } from '@zhin.js/im-contract';
 const MIME_EXT = {
     'image/jpeg': 'jpg',
     'image/png': 'png',

package/lib/protocol.d.ts

@@ -4,19 +4,15 @@
  */
 import type { IncomingMessage } from 'node:http';
 import type { ConversationRef } from '@zhin.js/im-contract';
-/** Plugin Runtime owner config (`plugins.<instanceKey>` / schema.json). */
-export interface WecomAdapterConfig {
-    readonly id?: string;
-    readonly corpId?: string;
-    readonly agentSecret?: string;
-    readonly token?: string;
-    readonly encodingAESKey?: string;
+/** One endpoint config after AdapterIndex expands `plugins.<instanceKey>.endpoints`. */
+export interface WecomEndpointConfig {
+    readonly id: string;
+    readonly corpId: string;
+    readonly agentSecret: string;
+    readonly token: string;
+    readonly encodingAESKey: string;
     readonly webhookPath?: string;
     readonly apiBaseUrl?: string;
-    /** Transitional: legacy root `endpoints[]` with `context: wecom`. */
-    readonly endpoints?: ReadonlyArray<Partial<ResolvedWecomConfig> & {
-        readonly context?: string;
-    }>;
 }
 export interface ResolvedWecomConfig {
     readonly context: 'wecom';
@@ -74,7 +70,7 @@ export interface WecomSendBody {
     readonly msgtype: string;
     readonly data: Record<string, unknown>;
 }
-export declare function resolveWecomConfig(config?: WecomAdapterConfig): ResolvedWecomConfig;
+export declare function resolveWecomConfig(config: WecomEndpointConfig): ResolvedWecomConfig;
 export declare function normalizeWebhookPath(path: string): string;
 export declare function queryParam(value: string | null | undefined): string;
 /** URL 查询里的 Base64 可能把 `+` 解码成空格 */

package/lib/protocol.js

@@ -3,21 +3,12 @@
  * Canonicalization is owned by gateway/core before endpoint.send.
  */
 import { createHash, createDecipheriv, timingSafeEqual } from 'node:crypto';
-export function resolveWecomConfig(config = {}) {
-    const entry = config.endpoints?.find((item) => item.context === 'wecom');
-    const corpId = config.corpId ?? entry?.corpId ?? process.env.WECOM_CORP_ID;
-    const agentSecret = config.agentSecret ?? entry?.agentSecret ?? process.env.WECOM_AGENT_SECRET;
-    const token = config.token ?? entry?.token ?? process.env.WECOM_TOKEN;
-    const encodingAESKey = config.encodingAESKey
-        ?? entry?.encodingAESKey
-        ?? process.env.WECOM_AES_KEY;
-    if (!corpId || !agentSecret || !token || !encodingAESKey) {
-        throw new TypeError('WeCom adapter requires corpId + agentSecret + token + encodingAESKey (plugins.<key> or endpoints with context: wecom)');
-    }
-    const id = (typeof config.id === 'string' && config.id)
-        || (typeof entry?.id === 'string' && entry.id)
-        || process.env.WECOM_BOT_NAME
-        || 'wecom-bot';
+export function resolveWecomConfig(config) {
+    const id = requiredEndpointField(config.id, 'id');
+    const corpId = requiredEndpointField(config.corpId, 'corpId');
+    const agentSecret = requiredEndpointField(config.agentSecret, 'agentSecret');
+    const token = requiredEndpointField(config.token, 'token');
+    const encodingAESKey = requiredEndpointField(config.encodingAESKey, 'encodingAESKey');
     return {
         context: 'wecom',
         id,
@@ -25,12 +16,20 @@ export function resolveWecomConfig(config = {}) {
         agentSecret,
         token,
         encodingAESKey,
-        webhookPath: normalizeWebhookPath(config.webhookPath ?? entry?.webhookPath ?? '/wecom/callback'),
-        apiBaseUrl: config.apiBaseUrl
-            ?? entry?.apiBaseUrl
-            ?? 'https://qyapi.weixin.qq.com',
+        webhookPath: normalizeWebhookPath(optionalEndpointField(config.webhookPath) ?? '/wecom/callback'),
+        apiBaseUrl: optionalEndpointField(config.apiBaseUrl) ?? 'https://qyapi.weixin.qq.com',
     };
 }
+function requiredEndpointField(value, field) {
+    const resolved = optionalEndpointField(value);
+    if (!resolved) {
+        throw new TypeError(`WeCom endpoint requires a non-empty ${field}`);
+    }
+    return resolved;
+}
+function optionalEndpointField(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
 export function normalizeWebhookPath(path) {
     const trimmed = path.trim() || '/wecom/callback';
     return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;

package/lib/wecom-runtime-state.js

@@ -1,6 +1,6 @@
 /**
  * WeCom 插件实例的运行时状态：adapter create() 注册的 endpoint 列表。
- * 由 plugin.ts setup() provide，adapter create 与 `wecom.endpoint` 命令共享（同一 owner generation）。
+ * 由 plugin.ts setup() provide，adapter create 与 `wecom endpoint` 命令共享（同一 owner generation）。
  */
 import { defineEndpointRuntimeStateToken } from 'zhin.js/adapter';
 export const wecomRuntimeStateToken = defineEndpointRuntimeStateToken('wecom');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-wecom",
-  "version": "1.1.0",
+  "version": "1.1.3",
   "description": "Zhin.js WeCom (企业微信) adapter for Plugin Runtime (HTTP webhook)",
   "type": "module",
   "main": "./lib/index.js",
@@ -34,27 +34,26 @@
     "directory": "plugins/adapters/wecom"
   },
   "dependencies": {
-    "@zhin.js/adapter": "1.1.12",
-    "@zhin.js/core": "1.1.35",
-    "@zhin.js/feature-kit": "1.1.0",
-    "@zhin.js/host-http": "1.1.0",
-    "@zhin.js/im-contract": "1.1.0",
-    "@zhin.js/logger": "1.1.0"
+    "@zhin.js/adapter": "1.1.15",
+    "@zhin.js/agent-feature": "1.1.2",
+    "@zhin.js/core": "1.1.38",
+    "@zhin.js/feature-kit": "1.1.2",
+    "@zhin.js/host-http": "1.1.2",
+    "@zhin.js/im-contract": "1.1.2",
+    "@zhin.js/logger": "1.1.1",
+    "@zhin.js/skill": "1.1.2",
+    "@zhin.js/tool": "1.1.2"
   },
   "peerDependencies": {
     "zod": "^4.0.0",
-    "@zhin.js/adapter": "^1.1.12",
-    "@zhin.js/agent": "^1.1.23",
-    "@zhin.js/command": "^1.1.0",
-    "@zhin.js/core": "^1.1.35",
-    "@zhin.js/host-http": "^1.1.0",
-    "@zhin.js/permission": "^1.1.0",
-    "zhin.js": "^1.1.0"
+    "@zhin.js/adapter": "^1.1.15",
+    "@zhin.js/command": "^1.1.2",
+    "@zhin.js/core": "^1.1.38",
+    "@zhin.js/host-http": "^1.1.2",
+    "@zhin.js/permission": "^1.1.2",
+    "zhin.js": "^1.1.3"
   },
   "peerDependenciesMeta": {
-    "@zhin.js/agent": {
-      "optional": true
-    },
     "@zhin.js/command": {
       "optional": true
     },
@@ -70,8 +69,7 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "zod": "^4.4.3",
-    "@zhin.js/agent": "1.1.23",
-    "zhin.js": "1.1.0"
+    "zhin.js": "1.1.3"
   },
   "files": [
     "adapters",
@@ -80,9 +78,11 @@
     "schema.json",
     "src",
     "lib",
-    "agent",
+    "tools",
+    "agents",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "PERMITS.md"
   ],
   "publishConfig": {
     "access": "public",
@@ -105,6 +105,18 @@
       {
         "package": "@zhin.js/command",
         "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/tool",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/skill",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/agent-feature",
+        "api": "^1.0.0"
       }
     ],
     "plugins": []

package/schema.json

@@ -31,10 +31,11 @@
     },
     "endpoints": {
       "type": "array",
+      "minItems": 1,
       "description": "多账号：一个插件实例挂多个 endpoint。每项与顶层字段同构（id 必填，其余覆盖顶层）",
       "items": {
         "type": "object",
-        "additionalProperties": true,
+        "additionalProperties": false,
         "properties": {
           "master": {
             "type": [
@@ -70,6 +71,15 @@
             "type": "string",
             "description": "WeCom encoding AES key"
           },
+          "webhookPath": {
+            "type": "string"
+          },
+          "apiBaseUrl": {
+            "type": "string"
+          },
+          "commandPrefix": {
+            "type": "string"
+          },
           "id": {
             "type": "string",
             "description": "WeCom bot name"

package/src/index.ts

@@ -15,7 +15,7 @@ export {
   verifySignature,
   type AccessToken,
   type ResolvedWecomConfig,
-  type WecomAdapterConfig,
+  type WecomEndpointConfig,
   type WecomApiResponse,
   type WecomMessage,
   type WecomSendBody,

package/src/media-upload.ts

@@ -5,7 +5,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { basename } from 'node:path';
-import { isMediaRef, type MediaRef } from '@zhin.js/core';
+import { isMediaRef, type MediaRef } from '@zhin.js/im-contract';
 
 export interface MediaBinary {
   readonly data: Buffer;

package/src/protocol.ts

@@ -7,19 +7,15 @@ import { createHash, createDecipheriv, timingSafeEqual } from 'node:crypto';
 import type { IncomingMessage } from 'node:http';
 import type { ConversationRef } from '@zhin.js/im-contract';
 
-/** Plugin Runtime owner config (`plugins.<instanceKey>` / schema.json). */
-export interface WecomAdapterConfig {
-  readonly id?: string;
-  readonly corpId?: string;
-  readonly agentSecret?: string;
-  readonly token?: string;
-  readonly encodingAESKey?: string;
+/** One endpoint config after AdapterIndex expands `plugins.<instanceKey>.endpoints`. */
+export interface WecomEndpointConfig {
+  readonly id: string;
+  readonly corpId: string;
+  readonly agentSecret: string;
+  readonly token: string;
+  readonly encodingAESKey: string;
   readonly webhookPath?: string;
   readonly apiBaseUrl?: string;
-  /** Transitional: legacy root `endpoints[]` with `context: wecom`. */
-  readonly endpoints?: ReadonlyArray<Partial<ResolvedWecomConfig> & {
-    readonly context?: string;
-  }>;
 }
 
 export interface ResolvedWecomConfig {
@@ -84,23 +80,12 @@ export interface WecomSendBody {
   readonly data: Record<string, unknown>;
 }
 
-export function resolveWecomConfig(config: WecomAdapterConfig = {}): ResolvedWecomConfig {
-  const entry = config.endpoints?.find((item) => item.context === 'wecom');
-  const corpId = config.corpId ?? entry?.corpId ?? process.env.WECOM_CORP_ID;
-  const agentSecret = config.agentSecret ?? entry?.agentSecret ?? process.env.WECOM_AGENT_SECRET;
-  const token = config.token ?? entry?.token ?? process.env.WECOM_TOKEN;
-  const encodingAESKey = config.encodingAESKey
-    ?? entry?.encodingAESKey
-    ?? process.env.WECOM_AES_KEY;
-  if (!corpId || !agentSecret || !token || !encodingAESKey) {
-    throw new TypeError(
-      'WeCom adapter requires corpId + agentSecret + token + encodingAESKey (plugins.<key> or endpoints with context: wecom)',
-    );
-  }
-  const id = (typeof config.id === 'string' && config.id)
-    || (typeof entry?.id === 'string' && entry.id)
-    || process.env.WECOM_BOT_NAME
-    || 'wecom-bot';
+export function resolveWecomConfig(config: WecomEndpointConfig): ResolvedWecomConfig {
+  const id = requiredEndpointField(config.id, 'id');
+  const corpId = requiredEndpointField(config.corpId, 'corpId');
+  const agentSecret = requiredEndpointField(config.agentSecret, 'agentSecret');
+  const token = requiredEndpointField(config.token, 'token');
+  const encodingAESKey = requiredEndpointField(config.encodingAESKey, 'encodingAESKey');
   return {
     context: 'wecom',
     id,
@@ -109,14 +94,27 @@ export function resolveWecomConfig(config: WecomAdapterConfig = {}): ResolvedWec
     token,
     encodingAESKey,
     webhookPath: normalizeWebhookPath(
-      config.webhookPath ?? entry?.webhookPath ?? '/wecom/callback',
+      optionalEndpointField(config.webhookPath) ?? '/wecom/callback',
     ),
-    apiBaseUrl: config.apiBaseUrl
-      ?? entry?.apiBaseUrl
-      ?? 'https://qyapi.weixin.qq.com',
+    apiBaseUrl: optionalEndpointField(config.apiBaseUrl) ?? 'https://qyapi.weixin.qq.com',
   };
 }
 
+function requiredEndpointField(
+  value: unknown,
+  field: 'id' | 'corpId' | 'agentSecret' | 'token' | 'encodingAESKey',
+): string {
+  const resolved = optionalEndpointField(value);
+  if (!resolved) {
+    throw new TypeError(`WeCom endpoint requires a non-empty ${field}`);
+  }
+  return resolved;
+}
+
+function optionalEndpointField(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
 export function normalizeWebhookPath(path: string): string {
   const trimmed = path.trim() || '/wecom/callback';
   return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;

package/src/wecom-runtime-state.ts

@@ -1,6 +1,6 @@
 /**
  * WeCom 插件实例的运行时状态：adapter create() 注册的 endpoint 列表。
- * 由 plugin.ts setup() provide，adapter create 与 `wecom.endpoint` 命令共享（同一 owner generation）。
+ * 由 plugin.ts setup() provide，adapter create 与 `wecom endpoint` 命令共享（同一 owner generation）。
  */
 import { defineEndpointRuntimeStateToken } from 'zhin.js/adapter';
 

package/commands/endpoint/add/[id].ts

@@ -1,3 +0,0 @@
-import { wecomEndpointCommands } from '../../../src/wecom-endpoint-commands.js';
-
-export default wecomEndpointCommands.add;

package/commands/endpoint/list.ts

@@ -1,3 +0,0 @@
-import { wecomEndpointCommands } from '../../src/wecom-endpoint-commands.js';
-
-export default wecomEndpointCommands.list;

package/commands/endpoint/remove/[id].ts

@@ -1,3 +0,0 @@
-import { wecomEndpointCommands } from '../../../src/wecom-endpoint-commands.js';
-
-export default wecomEndpointCommands.remove;

package/lib/wecom-endpoint-commands.d.ts

@@ -1 +0,0 @@
-export declare const wecomEndpointCommands: import("@zhin.js/adapter").EndpointCommands<Readonly<import("@zhin.js/command").CommandDefinition<unknown, unknown, import("@zhin.js/command").CommandMessage, string | undefined>>>;