@zhin.js/adapter-wecom 1.1.25 → 1.1.27

package/lib/webhook.js

@@ -1,18 +1,15 @@
+import { readTextBody } from '@zhin.js/host-http-contract';
 import { formatCompact, getLogger } from '@zhin.js/logger';
-import { decryptMessage, extractEncryptFromXml, normalizeEchostrParam, parseXmlMessage, queryParam, readTextBody, verifySignature, } from './protocol.js';
+import { decryptMessage, extractEncryptFromXml, normalizeEchostrParam, parseXmlMessage, queryParam, verifySignature, } from './protocol.js';
 const logger = getLogger('wecom');
 export function registerWecomWebhookRoutes(http, handler) {
     const path = handler.config.webhookPath;
     return [
-        http.route('GET', path, (request, response, url) => {
-            handleWecomVerificationRequest(request, response, url, handler);
-        }, { summary: 'WeCom URL verification', tags: ['wecom'] }),
-        http.route('POST', path, async (request, response, url) => {
-            await handleWecomWebhookRequest(request, response, url, handler);
-        }, { summary: 'WeCom inbound webhook', tags: ['wecom'] }),
+        http.route('GET', path, (request, { url }) => handleWecomVerificationRequest(request, url, handler), { summary: 'WeCom URL verification', tags: ['wecom'] }),
+        http.route('POST', path, (request, { url }) => handleWecomWebhookRequest(request, url, handler), { summary: 'WeCom inbound webhook', tags: ['wecom'] }),
     ];
 }
-export function handleWecomVerificationRequest(_request, response, url, handler) {
+export function handleWecomVerificationRequest(_request, url, handler) {
     try {
         const msgSignature = queryParam(url.searchParams.get('msg_signature'));
         const timestamp = queryParam(url.searchParams.get('timestamp'));
@@ -20,32 +17,24 @@ export function handleWecomVerificationRequest(_request, response, url, handler)
         const echostr = normalizeEchostrParam(queryParam(url.searchParams.get('echostr')));
         const { token, encodingAESKey, corpId } = handler.config;
         if (!msgSignature || !timestamp || !nonce || !echostr) {
-            response.writeHead(400, { 'Content-Type': 'text/plain' });
-            response.end('Missing required query parameters');
-            return;
+            return new Response('Missing required query parameters', { status: 400, headers: { 'Content-Type': 'text/plain' } });
         }
         if (!verifySignature(token, timestamp, nonce, echostr, msgSignature)) {
             logger.warn(formatCompact({ op: 'verify', ok: false, error: 'invalid signature' }));
-            response.writeHead(403, { 'Content-Type': 'text/plain' });
-            response.end('Forbidden');
-            return;
+            return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
         }
         const decrypted = decryptMessage(echostr, encodingAESKey, corpId);
         if (!decrypted) {
-            response.writeHead(400, { 'Content-Type': 'text/plain' });
-            response.end('Decryption failed');
-            return;
+            return new Response('Decryption failed', { status: 400, headers: { 'Content-Type': 'text/plain' } });
         }
-        response.writeHead(200, { 'Content-Type': 'text/plain' });
-        response.end(decrypted);
+        return new Response(decrypted, { status: 200, headers: { 'Content-Type': 'text/plain' } });
     }
     catch (error) {
         logger.error('URL verification error:', error);
-        response.writeHead(500, { 'Content-Type': 'text/plain' });
-        response.end('Internal Server Error');
+        return new Response('Internal Server Error', { status: 500, headers: { 'Content-Type': 'text/plain' } });
     }
 }
-export async function handleWecomWebhookRequest(request, response, url, handler) {
+export async function handleWecomWebhookRequest(request, url, handler) {
     try {
         const msgSignature = queryParam(url.searchParams.get('msg_signature'));
         const timestamp = queryParam(url.searchParams.get('timestamp'));
@@ -55,32 +44,24 @@ export async function handleWecomWebhookRequest(request, response, url, handler)
         const encrypted = extractEncryptFromXml(rawBody);
         if (!encrypted) {
             logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'no Encrypt field' }));
-            response.writeHead(200, { 'Content-Type': 'text/plain' });
-            response.end('success');
-            return;
+            return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
         }
         if (!verifySignature(token, timestamp, nonce, encrypted, msgSignature)) {
             logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid signature' }));
-            response.writeHead(403, { 'Content-Type': 'text/plain' });
-            response.end('Forbidden');
-            return;
+            return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
         }
         const decryptedXml = decryptMessage(encrypted, encodingAESKey, corpId);
         if (!decryptedXml) {
-            response.writeHead(200, { 'Content-Type': 'text/plain' });
-            response.end('success');
-            return;
+            return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
         }
         const message = parseXmlMessage(decryptedXml);
         if (message && handler.isOpen) {
             handler.admit(message);
         }
-        response.writeHead(200, { 'Content-Type': 'text/plain' });
-        response.end('success');
+        return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
     }
     catch (error) {
         logger.error('Webhook error:', error);
-        response.writeHead(200, { 'Content-Type': 'text/plain' });
-        response.end('success');
+        return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-wecom",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "description": "Zhin.js WeCom (企业微信) adapter for Plugin Runtime (HTTP webhook)",
   "type": "module",
   "main": "./lib/index.js",
@@ -33,26 +33,27 @@
     "directory": "plugins/adapters/wecom"
   },
   "dependencies": {
-    "@zhin.js/adapter": "1.1.31",
-    "@zhin.js/agent-feature": "1.1.16",
-    "@zhin.js/console-contract": "1.1.5",
-    "@zhin.js/core": "1.1.59",
-    "@zhin.js/feature-kit": "1.1.15",
-    "@zhin.js/host-http": "1.1.17",
-    "@zhin.js/im-contract": "1.1.13",
-    "@zhin.js/logger": "1.1.2",
-    "@zhin.js/page": "1.1.17",
-    "@zhin.js/skill": "1.1.16",
-    "@zhin.js/tool": "1.1.18"
+    "zod": "^4.6.7",
+    "@zhin.js/adapter": "1.1.33",
+    "@zhin.js/agent-feature": "1.1.17",
+    "@zhin.js/console-contract": "1.1.6",
+    "@zhin.js/core": "1.2.0",
+    "@zhin.js/feature-kit": "1.1.16",
+    "@zhin.js/host-http": "1.2.0",
+    "@zhin.js/host-http-contract": "1.2.0",
+    "@zhin.js/im-contract": "1.1.14",
+    "@zhin.js/logger": "1.1.3",
+    "@zhin.js/page": "1.1.18",
+    "@zhin.js/skill": "1.1.17",
+    "@zhin.js/tool": "1.1.19"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
-    "@zhin.js/adapter": "^1.1.31",
-    "@zhin.js/command": "^1.1.17",
-    "@zhin.js/core": "^1.1.59",
-    "@zhin.js/host-http": "^1.1.17",
-    "@zhin.js/permission": "^1.1.15",
-    "zhin.js": "^1.1.24"
+    "@zhin.js/adapter": "^1.1.33",
+    "@zhin.js/command": "^1.2.0",
+    "@zhin.js/core": "^1.2.0",
+    "@zhin.js/host-http": "^1.2.0",
+    "@zhin.js/permission": "^1.2.0",
+    "zhin.js": "^1.1.26"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
@@ -60,17 +61,13 @@
     },
     "zhin.js": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "zhin.js": "1.1.24"
+    "zhin.js": "1.1.26"
   },
   "files": [
     "adapters",
@@ -80,7 +77,6 @@
     "schema.json",
     "src",
     "lib",
-    "tools",
     "agents",
     "README.md",
     "CHANGELOG.md",
@@ -130,6 +126,6 @@
   "scripts": {
     "build": "tsc",
     "clean": "rimraf lib",
-    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/adapters/wecom/tests"
+    "test": "vitest run --root ../../.. plugins/adapters/wecom/tests"
   }
 }

package/plugin.js

@@ -1,7 +1,5 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { definePlugin } from 'zhin.js';
-import { permissionHostToken } from '@zhin.js/permission';
-import { checkWecomPlatformPermit } from "./lib/platform-permit.js";
 import { createWecomConsoleRpc } from "./lib/console.js";
 export default definePlugin({
     name: 'wecom',
@@ -10,12 +8,8 @@ export default definePlugin({
         displayName: 'WeCom (企业微信) Adapter',
     },
     setup(context) {
-        const dispose = context.resources.has(permissionHostToken)
-            ? context.resources.use(permissionHostToken).registerPlatform('wecom', checkWecomPlatformPermit)
-            : undefined;
         return {
             consoleRpc: createWecomConsoleRpc(context.resources, () => context.config.get()),
-            ...(dispose ? { dispose } : {}),
         };
     },
 });

package/schema.json

@@ -11,34 +11,6 @@
       "type": "string",
       "default": "https://qyapi.weixin.qq.com"
     },
-    "master": {
-      "type": [
-        "string",
-        "number"
-      ],
-      "description": "框架 master（WeCom userid；AI/工具权限、endpoint 管理）。endpoints[i].master 可逐项覆盖",
-      "x-i18n": {
-        "en": {
-          "description": "Framework masters (WeCom userid; AI/tool permissions and endpoint management). endpoints[i].master can override this value."
-        }
-      }
-    },
-    "trusted": {
-      "type": "array",
-      "items": {
-        "type": [
-          "string",
-          "number"
-        ],
-        "description": "Trusted WeCom userid"
-      },
-      "description": "框架 trusted 用户列表（弱于 master）。endpoints[i].trusted 可逐项追加",
-      "x-i18n": {
-        "en": {
-          "description": "Framework trusted users, below master authority. endpoints[i].trusted can add users."
-        }
-      }
-    },
     "endpoints": {
       "type": "array",
       "minItems": 1,
@@ -47,34 +19,6 @@
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "master": {
-            "type": [
-              "string",
-              "number"
-            ],
-            "description": "本 endpoint 的框架 master（WeCom userid）；覆盖顶层 master",
-            "x-i18n": {
-              "en": {
-                "description": "Framework masters for this endpoint (WeCom userid), overriding the top-level master list."
-              }
-            }
-          },
-          "trusted": {
-            "type": "array",
-            "items": {
-              "type": [
-                "string",
-                "number"
-              ],
-              "description": "Trusted WeCom userid"
-            },
-            "description": "本 endpoint 的 trusted 列表",
-            "x-i18n": {
-              "en": {
-                "description": "Trusted users for this endpoint."
-              }
-            }
-          },
           "corpId": {
             "type": "string",
             "description": "WeCom corp ID"

package/src/adapter.ts

@@ -12,7 +12,7 @@ export class WecomAdapter extends Adapter<WecomEndpoint, WecomEndpointConfig, We
   override get configurationIdentityProbeFields(): readonly string[] { return ['agentSecret', 'apiBaseUrl']; }
   protected override async identifyConfiguration(input: WecomEndpointConfig, signal: AbortSignal, _changed: readonly string[]): Promise<string | undefined> {
     const config = resolveWecomConfig(input);
-    const fetch = async (url: string, init?: Parameters<typeof globalThis.fetch>[1]) => { signal.throwIfAborted(); return globalThis.fetch(url, { ...init, signal }); };
+    const fetch = async (url: string, init?: Parameters<typeof globalThis.fetch>[1]) => { signal.throwIfAborted(); return globalThis.fetch(url, { ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal }); };
     const client = new WecomClient({ id: this.descriptor.id, config, fetch });
     const response = await client.getApplicationInfo();
     if (typeof response.agentid !== 'string' && typeof response.agentid !== 'number') throw new Error('WeCom identity verification returned no agentid');

package/src/client.ts

@@ -226,8 +226,10 @@ export class WecomClient extends EventEmitter {
     await createEndpointOperation({ signal }).prepare(() => this.#ensureAccessToken());
     const binary = await createEndpointOperation({ signal }).prepare(() => resolveMediaBinary(media, { signal }));
     const form = buildMediaUploadForm(binary);
-    const url = `${this.#options.config.apiBaseUrl}/cgi-bin/media/upload?access_token=${this.#accessToken.access_token}&type=image`;
-    const response = await this.#fetch(url, { method: 'POST', body: form, signal });
+    const query = new URLSearchParams({ access_token: this.#accessToken.access_token, type: 'image' });
+    const url = `${this.#options.config.apiBaseUrl}/cgi-bin/media/upload?${query.toString()}`;
+    const response = await this.#fetch(url, { method: 'POST', body: form, signal: requestSignal(signal) });
+    if (!response.ok) throw new Error(`WeCom media upload failed: HTTP ${response.status}`);
     const data = await response.json() as WecomMediaUploadResult;
     if (data.errcode === 0 && data.media_id) return data.media_id;
     throw new Error(`WeCom media upload failed: ${data.errmsg ?? 'unknown'} (${data.errcode ?? '?'})`);
@@ -368,7 +370,7 @@ export class WecomClient extends EventEmitter {
       method,
       headers: { 'Content-Type': 'application/json; charset=utf-8' },
       body: body && method === 'POST' ? JSON.stringify(body) : undefined,
-      signal: options.signal,
+      signal: requestSignal(options.signal),
     });
     if (!response.ok) {
       const text = await response.text().catch(() => '');
@@ -397,8 +399,11 @@ export class WecomClient extends EventEmitter {
 
   async #refreshAccessToken(): Promise<void> {
     const { corpId, agentSecret, apiBaseUrl } = this.#options.config;
-    const url = `${apiBaseUrl}/cgi-bin/gettoken?corpid=${corpId}&corpsecret=${agentSecret}`;
-    const response = await this.#fetch(url);
+    const query = new URLSearchParams({ corpid: corpId, corpsecret: agentSecret });
+    const url = `${apiBaseUrl}/cgi-bin/gettoken?${query.toString()}`;
+    // The refresh promise is shared by every sender, so it must never hang.
+    const response = await this.#fetch(url, { signal: requestSignal() });
+    if (!response.ok) throw new Error(`Failed to get access token: HTTP ${response.status}`);
     const data = await response.json() as WecomApiResponse;
     if (data.errcode === 0 && data.access_token) {
       this.#accessToken = {
@@ -413,6 +418,13 @@ export class WecomClient extends EventEmitter {
   }
 }
 
+const REQUEST_TIMEOUT_MS = 30_000;
+
+function requestSignal(signal?: AbortSignal): AbortSignal {
+  const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+
 export type WecomClientEventMap = Record<string, WecomMessage>;
 
 interface WecomMediaUploadRequest extends EndpointOperationOptions {

package/src/console-spec.ts

@@ -7,11 +7,68 @@ export const wecomConsoleSpec = {
   adapterKey: 'wecom',
   adapterDisplayName: '企业微信',
   fields: [
-    { key: 'corpId', required: true, env: true, description: '企业 corpId', descriptionI18n: { en: 'WeCom corporation ID' } },
-    { key: 'agentId', required: true, description: '应用 AgentId', descriptionI18n: { en: 'WeCom application AgentId' } },
-    { key: 'agentSecret', required: true, env: true, description: '应用 secret', descriptionI18n: { en: 'Application secret' } },
-    { key: 'token', required: true, env: true, description: '回调 token', descriptionI18n: { en: 'Callback token' } },
-    { key: 'encodingAESKey', required: true, env: true, description: '回调加解密 key', descriptionI18n: { en: 'Callback encryption key' } },
+    {
+      key: 'corpId',
+      required: true,
+      env: true,
+      label: '企业 ID (CorpID)',
+      labelI18n: { en: 'CorpID' },
+      group: '企业应用凭证',
+      groupI18n: { en: 'Enterprise App Credentials' },
+      placeholder: 'ww1234567890abcdef',
+      description: '企业微信管理后台「我的企业」中的企业 ID',
+      descriptionI18n: { en: 'WeCom corporation ID' },
+    },
+    {
+      key: 'agentId',
+      required: true,
+      label: '应用 AgentId',
+      labelI18n: { en: 'Application AgentId' },
+      group: '企业应用凭证',
+      groupI18n: { en: 'Enterprise App Credentials' },
+      placeholder: '1000002',
+      description: '自建应用的 AgentId（数字编号）',
+      descriptionI18n: { en: 'WeCom application AgentId' },
+    },
+    {
+      key: 'agentSecret',
+      required: true,
+      env: true,
+      label: '应用 Secret',
+      labelI18n: { en: 'Application Secret' },
+      group: '企业应用凭证',
+      groupI18n: { en: 'Enterprise App Credentials' },
+      placeholder: '自建应用的 Secret 密钥',
+      placeholderI18n: { en: 'WeCom application secret' },
+      description: '自建应用的 Secret 密钥',
+      descriptionI18n: { en: 'Application secret' },
+    },
+    {
+      key: 'token',
+      required: true,
+      env: true,
+      label: '接收消息 Token',
+      labelI18n: { en: 'Callback Token' },
+      group: '事件回调与加解密',
+      groupI18n: { en: 'Event Callback & Encryption' },
+      placeholder: 'API 接收消息配置的 Token',
+      placeholderI18n: { en: 'Callback verification token' },
+      description: '「接收消息 → 设置 API 接收」中的 Token',
+      descriptionI18n: { en: 'Callback token' },
+    },
+    {
+      key: 'encodingAESKey',
+      required: true,
+      env: true,
+      label: 'EncodingAESKey (消息加解密密钥)',
+      labelI18n: { en: 'EncodingAESKey' },
+      group: '事件回调与加解密',
+      groupI18n: { en: 'Event Callback & Encryption' },
+      placeholder: '43 位字符的 EncodingAESKey',
+      placeholderI18n: { en: '43-char EncodingAESKey' },
+      description: '「接收消息 → 设置 API 接收」中的 EncodingAESKey',
+      descriptionI18n: { en: 'Callback encryption key' },
+    },
   ] as readonly AdapterConsoleField[],
   docsUrl: 'https://zhin.js.org/adapters/wecom',
   readPermission: 'wecom:read',

package/src/index.ts

@@ -9,7 +9,6 @@ export {
   normalizeWebhookPath,
   parseXmlMessage,
   queryParam,
-  readTextBody,
   resolveChatType,
   resolveWecomConfig,
   verifySignature,
@@ -24,12 +23,7 @@ export {
 
 export { type WecomClientEventMap } from './client.js';
 
-export {
-  checkWecomPlatformPermit,
-  normalizeWecomSenderForPermit,
-  platformPermit,
-  wecomGroupPermitResolver,
-} from './platform-permit.js';
+export { platformPermit } from './platform-permit.js';
 
 export {
   WecomEndpoint,

package/src/platform-permit.ts

@@ -1,48 +1,10 @@
 /**
- * 企业微信 WeCom platform permit
+ * 企业微信 WeCom platform permit helper（ADR 0056 §5）。
+ *
+ * 平台身份由适配器上报到 `sender.platform`，permit 由内置评估器（`@zhin.js/permission`）判断；
+ * 适配器不再导出自有的 permit 解析器或检查函数。
  */
-import type { PermissionSubject } from '@zhin.js/permission';
-
-const ADAPTER = 'wecom';
 
 export function platformPermit(perm: string): string {
-  return `platform(${ADAPTER},${perm})`;
-}
-
-const FACTORY_PERM_MAP: Record<string, string> = {
-  scene_admin: 'chat_admin',
-  scene_owner: 'chat_owner',
-};
-
-export function wecomGroupPermitResolver(logicalPerm: string): string {
-  return platformPermit(FACTORY_PERM_MAP[logicalPerm] ?? logicalPerm);
-}
-
-export function normalizeWecomSenderForPermit(input: {
-  isOwner?: boolean;
-  isAdmin?: boolean;
-}): { role?: string; permissions?: string[] } {
-  if (input.isOwner) {
-    return { role: 'owner', permissions: ['chat_owner', 'chat_admin'] };
-  }
-  if (input.isAdmin) {
-    return { role: 'admin', permissions: ['chat_admin'] };
-  }
-  return { role: 'member', permissions: [] };
+  return `platform-permission:${perm}`;
 }
-
-export function checkWecomPlatformPermit(perm: string, subject: PermissionSubject): boolean {
-  const role = subject.sender?.role?.[0];
-  const permissions = subject.sender?.permissions ?? [];
-  const has = (t: string) => permissions.includes(t);
-
-  switch (perm) {
-    case 'chat_owner':
-      return role === 'owner' || has('chat_owner');
-    case 'chat_admin':
-      return role === 'owner' || role === 'admin' || has('chat_admin') || has('chat_owner');
-    default:
-      return false;
-  }
-}
-

package/src/protocol.ts

@@ -6,7 +6,6 @@ import { createMessages, type Locale } from 'zhin.js/i18n';
  */
 
 import { createHash, createDecipheriv, timingSafeEqual } from 'node:crypto';
-import type { IncomingMessage } from 'node:http';
 import type { ConversationRef } from '@zhin.js/im-contract';
 
 /** One endpoint config after AdapterIndex expands `plugins.<instanceKey>.endpoints`. */
@@ -368,21 +367,3 @@ export function buildSendRequestBody(
   return body;
 }
 
-export async function readTextBody(
-  request: IncomingMessage,
-  options: { readonly limit?: number } = {},
-): Promise<string> {
-  const limit = options.limit ?? 1_048_576;
-  const chunks: Buffer[] = [];
-  let size = 0;
-  for await (const chunk of request) {
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    size += buffer.length;
-    if (size > limit) {
-      request.destroy();
-      throw new Error(`Request body exceeds ${limit} bytes`);
-    }
-    chunks.push(buffer);
-  }
-  return Buffer.concat(chunks).toString('utf8');
-}

package/src/webhook.ts

@@ -1,8 +1,8 @@
 /**
  * WeCom webhook HTTP: URL verification (GET) + encrypted inbound (POST).
  */
-import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
+import { readTextBody } from '@zhin.js/host-http-contract';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 import {
   decryptMessage,
@@ -10,7 +10,6 @@ import {
   normalizeEchostrParam,
   parseXmlMessage,
   queryParam,
-  readTextBody,
   verifySignature,
   type ResolvedWecomConfig,
   type WecomMessage,
@@ -30,21 +29,18 @@ export function registerWecomWebhookRoutes(
 ): HttpRouteRegistration[] {
   const path = handler.config.webhookPath;
   return [
-    http.route('GET', path, (request, response, url) => {
-      handleWecomVerificationRequest(request, response, url, handler);
-    }, { summary: 'WeCom URL verification', tags: ['wecom'] }),
-    http.route('POST', path, async (request, response, url) => {
-      await handleWecomWebhookRequest(request, response, url, handler);
-    }, { summary: 'WeCom inbound webhook', tags: ['wecom'] }),
+    http.route('GET', path, (request, { url }) => handleWecomVerificationRequest(request, url, handler),
+      { summary: 'WeCom URL verification', tags: ['wecom'] }),
+    http.route('POST', path, (request, { url }) => handleWecomWebhookRequest(request, url, handler),
+      { summary: 'WeCom inbound webhook', tags: ['wecom'] }),
   ];
 }
 
 export function handleWecomVerificationRequest(
-  _request: IncomingMessage,
-  response: ServerResponse,
+  _request: Request,
   url: URL,
   handler: WecomWebhookHandler,
-): void {
+): Response {
   try {
     const msgSignature = queryParam(url.searchParams.get('msg_signature'));
     const timestamp = queryParam(url.searchParams.get('timestamp'));
@@ -53,39 +49,30 @@ export function handleWecomVerificationRequest(
     const { token, encodingAESKey, corpId } = handler.config;
 
     if (!msgSignature || !timestamp || !nonce || !echostr) {
-      response.writeHead(400, { 'Content-Type': 'text/plain' });
-      response.end('Missing required query parameters');
-      return;
+      return new Response('Missing required query parameters', { status: 400, headers: { 'Content-Type': 'text/plain' } });
     }
 
     if (!verifySignature(token, timestamp, nonce, echostr, msgSignature)) {
       logger.warn(formatCompact({ op: 'verify', ok: false, error: 'invalid signature' }));
-      response.writeHead(403, { 'Content-Type': 'text/plain' });
-      response.end('Forbidden');
-      return;
+      return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
     }
 
     const decrypted = decryptMessage(echostr, encodingAESKey, corpId);
     if (!decrypted) {
-      response.writeHead(400, { 'Content-Type': 'text/plain' });
-      response.end('Decryption failed');
-      return;
+      return new Response('Decryption failed', { status: 400, headers: { 'Content-Type': 'text/plain' } });
     }
-    response.writeHead(200, { 'Content-Type': 'text/plain' });
-    response.end(decrypted);
+    return new Response(decrypted, { status: 200, headers: { 'Content-Type': 'text/plain' } });
   } catch (error) {
     logger.error('URL verification error:', error);
-    response.writeHead(500, { 'Content-Type': 'text/plain' });
-    response.end('Internal Server Error');
+    return new Response('Internal Server Error', { status: 500, headers: { 'Content-Type': 'text/plain' } });
   }
 }
 
 export async function handleWecomWebhookRequest(
-  request: IncomingMessage,
-  response: ServerResponse,
+  request: Request,
   url: URL,
   handler: WecomWebhookHandler,
-): Promise<void> {
+): Promise<Response> {
   try {
     const msgSignature = queryParam(url.searchParams.get('msg_signature'));
     const timestamp = queryParam(url.searchParams.get('timestamp'));
@@ -96,23 +83,17 @@ export async function handleWecomWebhookRequest(
     const encrypted = extractEncryptFromXml(rawBody);
     if (!encrypted) {
       logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'no Encrypt field' }));
-      response.writeHead(200, { 'Content-Type': 'text/plain' });
-      response.end('success');
-      return;
+      return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
     }
 
     if (!verifySignature(token, timestamp, nonce, encrypted, msgSignature)) {
       logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid signature' }));
-      response.writeHead(403, { 'Content-Type': 'text/plain' });
-      response.end('Forbidden');
-      return;
+      return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
     }
 
     const decryptedXml = decryptMessage(encrypted, encodingAESKey, corpId);
     if (!decryptedXml) {
-      response.writeHead(200, { 'Content-Type': 'text/plain' });
-      response.end('success');
-      return;
+      return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
     }
 
     const message = parseXmlMessage(decryptedXml);
@@ -120,11 +101,9 @@ export async function handleWecomWebhookRequest(
       handler.admit(message);
     }
 
-    response.writeHead(200, { 'Content-Type': 'text/plain' });
-    response.end('success');
+    return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
   } catch (error) {
     logger.error('Webhook error:', error);
-    response.writeHead(200, { 'Content-Type': 'text/plain' });
-    response.end('success');
+    return new Response('success', { status: 200, headers: { 'Content-Type': 'text/plain' } });
   }
 }