fix: harden native addon lifecycle, shutdown semantics, and error propagation

- Eliminate Producer double-free by switching from AutoDeleteSendCallback to SendCallback
- Replace ineffective set_shutdown_on_destroy with explicit shutdown in PushConsumer
- Add shutdown_worker_active_ reentrancy guard to PushConsumer shutdown
- Propagate consumer native errors to JS instead of silent RECONSUME_LATER nacks
- Harden TSFN reference counting and lifecycle management
- Fix race conditions between send/shutdown/finalize paths

Author: noodanee

.github/workflows/build.yml

@@ -16,7 +16,40 @@ on:
         default: false
 
 jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+          run_install: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Typecheck
+        run: pnpm run typecheck
+
+      - name: Lint
+        run: pnpm run lint:check
+
+      - name: Build test binary
+        run: pnpm run build:test
+
+      - name: Test
+        run: npx vitest run --reporter=verbose
+
   linux-gnu-x64:
+    needs: validate
     runs-on: ubuntu-24.04
     container:
       image: alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:latest
@@ -31,8 +64,9 @@ jobs:
 
       - name: Install Node.js
         run: |
-          curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -
+          curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
           yum install -y nodejs
+          npm install -g pnpm@11
 
       - name: Setup Zig
         uses: mlugg/setup-zig@v2
@@ -53,14 +87,14 @@ jobs:
           echo "CXXFLAGS=-fPIC -fno-sanitize=undefined" >> "$GITHUB_ENV"
           echo "LDFLAGS=-static-libstdc++ -static-libgcc -fno-sanitize=undefined" >> "$GITHUB_ENV"
 
-      - name: Cache npm dependencies
+      - name: Cache pnpm dependencies
         id: cache-npm
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('package-lock.json') }}
+          key: pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-
+            pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-
 
       - name: Cache RocketMQ native deps
         uses: actions/cache@v4
@@ -82,9 +116,9 @@ jobs:
           restore-keys: |
             addon-${{ runner.os }}-${{ env.ZIG_TARGET }}-
 
-      - name: Install npm dependencies
+      - name: Install dependencies
         if: steps.cache-npm.outputs.cache-hit != 'true'
-        run: npm install --no-audit --prefer-offline
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Build RocketMQ native deps
         if: steps.cache-addon.outputs.cache-hit != 'true'
@@ -107,6 +141,7 @@ jobs:
           path: Release/linux-x86_64-gnu-rocketmq.node
 
   linux-gnu-arm64:
+    needs: validate
     runs-on: ubuntu-24.04-arm
     container:
       image: alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3:latest
@@ -121,8 +156,9 @@ jobs:
 
       - name: Install Node.js
         run: |
-          curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -
+          curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
           yum install -y nodejs
+          npm install -g pnpm@11
 
       - name: Setup Zig
         uses: mlugg/setup-zig@v2
@@ -143,14 +179,14 @@ jobs:
           echo "CXXFLAGS=-fPIC -fno-sanitize=undefined" >> "$GITHUB_ENV"
           echo "LDFLAGS=-static-libstdc++ -static-libgcc -fno-sanitize=undefined" >> "$GITHUB_ENV"
 
-      - name: Cache npm dependencies
+      - name: Cache pnpm dependencies
         id: cache-npm
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('package-lock.json') }}
+          key: pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-
+            pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-
 
       - name: Cache RocketMQ native deps
         uses: actions/cache@v4
@@ -172,9 +208,9 @@ jobs:
           restore-keys: |
             addon-${{ runner.os }}-${{ env.ZIG_TARGET }}-
 
-      - name: Install npm dependencies
+      - name: Install dependencies
         if: steps.cache-npm.outputs.cache-hit != 'true'
-        run: npm install --no-audit --prefer-offline
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Build RocketMQ native deps
         if: steps.cache-addon.outputs.cache-hit != 'true'
@@ -197,9 +233,10 @@ jobs:
           path: Release/linux-aarch64-gnu-rocketmq.node
 
   linux-musl-x64:
+    needs: validate
     runs-on: ubuntu-24.04
     container:
-      image: node:20-alpine
+      image: node:22-alpine
     env:
       ZIG_TARGET: x86_64-linux-musl
     steps:
@@ -209,6 +246,9 @@ jobs:
       - name: Install system dependencies
         run: apk add --no-cache bash build-base cmake ninja python3 curl unzip git autoconf automake libtool pkgconfig
 
+      - name: Install pnpm
+        run: npm install -g pnpm@11
+
       - name: Setup Zig
         uses: mlugg/setup-zig@v2
         with:
@@ -228,14 +268,14 @@ jobs:
           echo "CXXFLAGS=-fPIC -fno-sanitize=undefined" >> "$GITHUB_ENV"
           echo "LDFLAGS=-static-libstdc++ -static-libgcc -fno-sanitize=undefined" >> "$GITHUB_ENV"
 
-      - name: Cache npm dependencies
+      - name: Cache pnpm dependencies
         id: cache-npm
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('package-lock.json') }}
+          key: pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            npm-${{ runner.os }}-
+            pnpm-${{ runner.os }}-
 
       - name: Cache RocketMQ native deps
         uses: actions/cache@v4
@@ -257,9 +297,9 @@ jobs:
           restore-keys: |
             addon-${{ runner.os }}-
 
-      - name: Install npm dependencies
+      - name: Install dependencies
         if: steps.cache-npm.outputs.cache-hit != 'true'
-        run: npm install --no-audit --prefer-offline
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Build RocketMQ native deps
         if: steps.cache-addon.outputs.cache-hit != 'true'
@@ -282,6 +322,7 @@ jobs:
           path: Release/linux-x86_64-musl-rocketmq.node
 
   linux-musl-arm64:
+    needs: validate
     runs-on: ubuntu-24.04-arm
     env:
       ZIG_TARGET: aarch64-linux-musl
@@ -292,7 +333,13 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+          run_install: false
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y build-essential cmake ninja-build python3 curl unzip git autoconf automake libtool pkg-config
@@ -316,14 +363,14 @@ jobs:
           echo "CXXFLAGS=-fPIC -fno-sanitize=undefined" >> "$GITHUB_ENV"
           echo "LDFLAGS=-static-libstdc++ -static-libgcc -fno-sanitize=undefined" >> "$GITHUB_ENV"
 
-      - name: Cache npm dependencies
+      - name: Cache pnpm dependencies
         id: cache-npm
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: npm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('package-lock.json') }}
+          key: pnpm-${{ runner.os }}-${{ env.ZIG_TARGET }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            npm-${{ runner.os }}-
+            pnpm-${{ runner.os }}-
 
       - name: Cache RocketMQ native deps
         uses: actions/cache@v4
@@ -345,9 +392,9 @@ jobs:
           restore-keys: |
             addon-${{ runner.os }}-
 
-      - name: Install npm dependencies
+      - name: Install dependencies
         if: steps.cache-npm.outputs.cache-hit != 'true'
-        run: npm install --no-audit --prefer-offline
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Build RocketMQ native deps
         if: steps.cache-addon.outputs.cache-hit != 'true'
@@ -370,6 +417,7 @@ jobs:
           path: Release/linux-aarch64-musl-rocketmq.node
 
   macos-universal:
+    needs: validate
     runs-on: macos-latest
     steps:
       - name: Checkout
@@ -378,19 +426,25 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+          run_install: false
 
       - name: Install build tools
         run: brew install cmake ninja xz autoconf automake libtool pkg-config
 
-      - name: Cache npm dependencies
+      - name: Cache pnpm dependencies
         id: cache-npm
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: npm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}
+          key: pnpm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            npm-${{ runner.os }}-
+            pnpm-${{ runner.os }}-
 
       - name: Cache RocketMQ native deps
         uses: actions/cache@v4
@@ -412,9 +466,9 @@ jobs:
           restore-keys: |
             addon-${{ runner.os }}-
 
-      - name: Install npm dependencies
+      - name: Install dependencies
         if: steps.cache-npm.outputs.cache-hit != 'true'
-        run: npm install --no-audit --prefer-offline
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Build RocketMQ native deps
         if: steps.cache-addon.outputs.cache-hit != 'true'
@@ -483,10 +537,14 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           registry-url: 'https://registry.npmjs.org'
-          cache: 'npm'
-          cache-dependency-path: package-lock.json
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+          run_install: false
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -511,7 +569,7 @@ jobs:
           echo "✅ Version consistent: $PKG_VERSION"
 
       - name: Install dependencies (skip native build)
-        run: npm ci --include=dev --ignore-scripts
+        run: pnpm install --frozen-lockfile --ignore-scripts
         env:
           NODE_ENV: development
           NPM_CONFIG_PRODUCTION: "false"
@@ -520,11 +578,11 @@ jobs:
         run: |
           if [ ! -f "node_modules/@types/node/index.d.ts" ]; then
             NODE_TYPES_VERSION=$(node -p "require('./package.json').devDependencies['@types/node']")
-            npm install --no-save --no-package-lock --ignore-scripts "@types/node@${NODE_TYPES_VERSION}"
+            pnpm add --no-save "@types/node@${NODE_TYPES_VERSION}"
           fi
 
       - name: Build TypeScript
-        run: npm run build:ts
+        run: pnpm run build:ts
 
       - name: Validate build output
         run: |
@@ -557,6 +615,6 @@ jobs:
           ls -lh Release/
 
       - name: Publish to npm
-        run: npm publish --ignore-scripts
+        run: pnpm publish --no-git-checks --ignore-scripts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -220,3 +220,11 @@ coverage.*.html
 dist/
 *.tsbuildinfo
 *.test.js.map
+test/*.js
+coverage_output.txt
+
+# Claude Code local session/config
+.claude/
+
+# pnpm
+pnpm-debug.log