fix(persistence): migrate all pkg/persistence imports to plugins/infra/database and plugins/infra/cache

- Replace db.DB(ctx) with database.DB(ctx) from plugins/infra/database
- Replace db.Redis/db.PrefixedKey/db.GetJSON/db.SetJSON with cachepkg.* from plugins/infra/cache
- Replace pkg/persistence/idgen with pkg/idgen (already exists)
- Replace pkg/persistence/batchwriter with pkg/batchwriter (already exists)
- Replace pkg/persistence/migrator with pkg/migrator (already exists)
- Replace pkg/persistence/logstore with plugins/domain/risk_control/logstore
- Delete defunct pkg/{persistence,cap,message_gateway,push,shared,task}
- Fix vet issues: db alias in domain_test.go, driver_asynq_worker.TaskHandler reference
- Update Makefile architecture guard
- Update docs and skill references
- Update go.mod: gorilla/sessions promotion to direct dependency

plugins/domain/message_gateway/channel.go

@@ -0,0 +1,21 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package message_gateway
+
+import "context"
+
+// Handler processes one inbound message.
+type Handler func(ctx context.Context, msg InboundMessage) error
+
+// Factory constructs a Channel from decrypted config.
+type Factory func(cfg ChannelConfig, onInbound Handler) (Channel, error)
+
+// Channel is one connected messaging adapter.
+type Channel interface {
+	Type() string
+	Connect(ctx context.Context) error
+	Disconnect(ctx context.Context) error
+	Send(ctx context.Context, to Recipient, msg OutboundMessage) error
+	Capabilities() Capability
+}

plugins/domain/message_gateway/channels/qq/adapter.go

@@ -0,0 +1,161 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package qq implements the official QQ Bot C2C adapter.
+package qq
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/pkg/logger"
+	"github.com/Rain-kl/Wavelet/plugins/domain/message_gateway"
+	"github.com/tencent-connect/botgo"
+	"github.com/tencent-connect/botgo/dto"
+	"github.com/tencent-connect/botgo/event"
+	"github.com/tencent-connect/botgo/openapi"
+	"github.com/tencent-connect/botgo/token"
+	"golang.org/x/oauth2"
+)
+
+// qqEvent is a testable inbound envelope.
+type qqEvent struct {
+	Kind      string
+	UserID    string
+	Text      string
+	MessageID string
+}
+
+// Adapter is an official QQ Bot C2C channel.
+type Adapter struct {
+	cfg          message_gateway.ChannelConfig
+	onInbound    message_gateway.Handler
+	api          openapi.OpenAPI
+	tokenSrc     oauth2.TokenSource
+	cancel       context.CancelFunc
+	mu           sync.Mutex
+	disconnected bool
+}
+
+// New constructs a QQ adapter.
+func New(cfg message_gateway.ChannelConfig, onInbound message_gateway.Handler) (message_gateway.Channel, error) {
+	if strings.TrimSpace(cfg.Credentials["app_id"]) == "" || strings.TrimSpace(cfg.Credentials["app_secret"]) == "" {
+		return nil, fmt.Errorf("qq: app_id and app_secret are required")
+	}
+	return &Adapter{cfg: cfg, onInbound: onInbound}, nil
+}
+
+// Type returns qq.
+func (a *Adapter) Type() string { return message_gateway.ChannelTypeQQ }
+
+// Capabilities reports C2C text/media support.
+func (a *Adapter) Capabilities() message_gateway.Capability {
+	return message_gateway.Capability{Text: true, Image: true, File: true, Reply: true}
+}
+
+// Connect starts the official WebSocket session (C2C intent).
+func (a *Adapter) Connect(ctx context.Context) error {
+	credentials := &token.QQBotCredentials{
+		AppID:     a.cfg.Credentials["app_id"],
+		AppSecret: a.cfg.Credentials["app_secret"],
+	}
+	tokSrc := token.NewQQBotTokenSource(credentials)
+	runCtx, cancel := context.WithCancel(ctx)
+	if err := token.StartRefreshAccessToken(runCtx, tokSrc); err != nil {
+		cancel()
+		return fmt.Errorf("qq: refresh token: %w", err)
+	}
+
+	var api openapi.OpenAPI
+	const apiTimeout = 5 * time.Second
+	if strings.EqualFold(strings.TrimSpace(a.cfg.Extra["sandbox"]), "true") {
+		api = botgo.NewSandboxOpenAPI(credentials.AppID, tokSrc).WithTimeout(apiTimeout)
+	} else {
+		api = botgo.NewOpenAPI(credentials.AppID, tokSrc).WithTimeout(apiTimeout)
+	}
+
+	wsAP, err := api.WS(ctx, nil, "")
+	if err != nil {
+		cancel()
+		return fmt.Errorf("qq: websocket ap: %w", err)
+	}
+
+	intent := event.RegisterHandlers(event.C2CMessageEventHandler(func(_ *dto.WSPayload, data *dto.WSC2CMessageData) error {
+		authorID := ""
+		if data != nil && data.Author != nil {
+			authorID = data.Author.ID
+		}
+		text := ""
+		id := ""
+		if data != nil {
+			text = data.Content
+			id = data.ID
+		}
+		a.handleEvent(runCtx, qqEvent{Kind: "c2c", UserID: authorID, Text: text, MessageID: id})
+		return nil
+	}))
+
+	a.mu.Lock()
+	a.api = api
+	a.tokenSrc = tokSrc
+	a.cancel = cancel
+	a.disconnected = false
+	a.mu.Unlock()
+
+	go func() {
+		if err := botgo.NewSessionManager().Start(wsAP, tokSrc, &intent); err != nil {
+			logger.ErrorF(runCtx, "qq session stopped: %v", err)
+		}
+	}()
+	return nil
+}
+
+// Disconnect stops token refresh and drops further inbound events.
+func (a *Adapter) Disconnect(_ context.Context) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.disconnected = true
+	if a.cancel != nil {
+		a.cancel()
+		a.cancel = nil
+	}
+	return nil
+}
+
+// Send posts a C2C text reply.
+func (a *Adapter) Send(ctx context.Context, to message_gateway.Recipient, msg message_gateway.OutboundMessage) error {
+	a.mu.Lock()
+	api := a.api
+	a.mu.Unlock()
+	if api == nil {
+		return fmt.Errorf("qq: not connected")
+	}
+	_, err := api.PostC2CMessage(ctx, to.PlatformUserID, &dto.MessageToCreate{
+		Content: msg.Text,
+		MsgID:   msg.ReplyToID,
+	})
+	return err
+}
+
+func (a *Adapter) handleEvent(ctx context.Context, ev qqEvent) {
+	if ev.Kind != "c2c" {
+		return
+	}
+	a.mu.Lock()
+	disconnected := a.disconnected
+	a.mu.Unlock()
+	if disconnected || a.onInbound == nil {
+		return
+	}
+	_ = a.onInbound(ctx, message_gateway.InboundMessage{
+		ChannelID:      a.cfg.ID,
+		ChannelType:    message_gateway.ChannelTypeQQ,
+		PlatformUserID: ev.UserID,
+		ChatID:         ev.UserID,
+		MessageID:      ev.MessageID,
+		Text:           ev.Text,
+	})
+}

plugins/domain/message_gateway/channels/qq/adapter_test.go

@@ -0,0 +1,42 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package qq
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/plugins/domain/message_gateway"
+)
+
+func TestHandleEvent_DropsNonC2C(t *testing.T) {
+	var got int
+	a := &Adapter{onInbound: func(ctx context.Context, msg message_gateway.InboundMessage) error {
+		got++
+		return nil
+	}}
+	a.handleEvent(context.Background(), qqEvent{Kind: "group", UserID: "u1", Text: "hi"})
+	if got != 0 {
+		t.Fatal("non-C2C must be ignored")
+	}
+}
+
+func TestHandleEvent_C2CText(t *testing.T) {
+	var got message_gateway.InboundMessage
+	a := &Adapter{cfg: message_gateway.ChannelConfig{ID: 3}, onInbound: func(ctx context.Context, msg message_gateway.InboundMessage) error {
+		got = msg
+		return nil
+	}}
+	a.handleEvent(context.Background(), qqEvent{Kind: "c2c", UserID: "openid-1", Text: "hello", MessageID: "m1"})
+	if got.Text != "hello" || got.PlatformUserID != "openid-1" || got.ChannelID != 3 {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestNew_RequiresCreds(t *testing.T) {
+	_, err := New(message_gateway.ChannelConfig{}, nil)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}

plugins/domain/message_gateway/channels/telegram/adapter.go

@@ -0,0 +1,153 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package telegram implements the Telegram private-chat adapter.
+package telegram
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/plugins/domain/message_gateway"
+	tele "gopkg.in/telebot.v4"
+)
+
+// Adapter is a Telegram private-chat channel.
+type Adapter struct {
+	cfg       message_gateway.ChannelConfig
+	onInbound message_gateway.Handler
+	bot       *tele.Bot
+}
+
+// New constructs a Telegram adapter. Call message_gateway.Register from the runner.
+func New(cfg message_gateway.ChannelConfig, onInbound message_gateway.Handler) (message_gateway.Channel, error) {
+	if strings.TrimSpace(cfg.Credentials["bot_token"]) == "" {
+		return nil, fmt.Errorf("telegram: bot_token is required")
+	}
+	return &Adapter{cfg: cfg, onInbound: onInbound}, nil
+}
+
+// Type returns telegram.
+func (a *Adapter) Type() string { return message_gateway.ChannelTypeTelegram }
+
+// Capabilities reports private-chat media support.
+func (a *Adapter) Capabilities() message_gateway.Capability {
+	return message_gateway.Capability{Text: true, Image: true, File: true, Reply: true}
+}
+
+// Connect starts long polling.
+func (a *Adapter) Connect(ctx context.Context) error {
+	pref := tele.Settings{
+		Token:  a.cfg.Credentials["bot_token"],
+		Poller: &tele.LongPoller{Timeout: 10},
+	}
+	if base := strings.TrimSpace(a.cfg.Extra["base_url"]); base != "" {
+		pref.URL = strings.TrimSuffix(base, "/")
+	}
+	bot, err := tele.NewBot(pref)
+	if err != nil {
+		return fmt.Errorf("telegram: new bot: %w", err)
+	}
+	a.bot = bot
+	bot.Handle(tele.OnText, func(c tele.Context) error {
+		a.handleTeleMessage(ctx, c.Message())
+		return nil
+	})
+	bot.Handle(tele.OnPhoto, func(c tele.Context) error {
+		a.handleTeleMessage(ctx, c.Message())
+		return nil
+	})
+	bot.Handle(tele.OnDocument, func(c tele.Context) error {
+		a.handleTeleMessage(ctx, c.Message())
+		return nil
+	})
+	go bot.Start()
+	go func() {
+		<-ctx.Done()
+		bot.Stop()
+	}()
+	return nil
+}
+
+// Disconnect stops the bot.
+func (a *Adapter) Disconnect(_ context.Context) error {
+	if a.bot != nil {
+		a.bot.Stop()
+	}
+	return nil
+}
+
+// Send replies to a private chat.
+func (a *Adapter) Send(_ context.Context, to message_gateway.Recipient, msg message_gateway.OutboundMessage) error {
+	if a.bot == nil {
+		return fmt.Errorf("telegram: not connected")
+	}
+	chatID, err := strconv.ParseInt(to.ChatID, 10, 64)
+	if err != nil {
+		return fmt.Errorf("telegram: chat id: %w", err)
+	}
+	_, err = a.bot.Send(tele.ChatID(chatID), msg.Text)
+	return err
+}
+
+func (a *Adapter) handleTeleMessage(ctx context.Context, m *tele.Message) {
+	if m == nil || m.Chat == nil || m.Chat.Type != tele.ChatPrivate {
+		return
+	}
+	if a.onInbound == nil {
+		return
+	}
+	msg := message_gateway.InboundMessage{
+		ChannelID:      a.cfg.ID,
+		ChannelType:    message_gateway.ChannelTypeTelegram,
+		PlatformUserID: strconv.FormatInt(m.Sender.ID, 10),
+		ChatID:         strconv.FormatInt(m.Chat.ID, 10),
+		MessageID:      strconv.Itoa(m.ID),
+		Text:           m.Text,
+	}
+	if m.Caption != "" && msg.Text == "" {
+		msg.Text = m.Caption
+	}
+	if a.bot != nil {
+		msg.Attachments = a.downloadMedia(m)
+	}
+	_ = a.onInbound(ctx, msg)
+}
+
+func (a *Adapter) downloadMedia(m *tele.Message) []message_gateway.Attachment {
+	var files []*tele.File
+	var names []string
+	if m.Photo != nil {
+		files = append(files, m.Photo.MediaFile())
+		names = append(names, "photo.jpg")
+	}
+	if m.Document != nil {
+		files = append(files, &m.Document.File)
+		name := m.Document.FileName
+		if name == "" {
+			name = "file"
+		}
+		names = append(names, name)
+	}
+	if len(files) == 0 {
+		return nil
+	}
+	dir, err := os.MkdirTemp("", "wg-tg-*")
+	if err != nil {
+		return []message_gateway.Attachment{{Error: err.Error()}}
+	}
+	out := make([]message_gateway.Attachment, 0, len(files))
+	for i, f := range files {
+		path := filepath.Join(dir, names[i])
+		if err := a.bot.Download(f, path); err != nil {
+			out = append(out, message_gateway.Attachment{FileName: names[i], Error: err.Error()})
+			continue
+		}
+		out = append(out, message_gateway.Attachment{Path: path, FileName: names[i]})
+	}
+	return out
+}

plugins/domain/message_gateway/channels/telegram/adapter_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package telegram
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/plugins/domain/message_gateway"
+	tele "gopkg.in/telebot.v4"
+)
+
+func TestHandleUpdate_DropsGroups(t *testing.T) {
+	var got int
+	a := &Adapter{onInbound: func(ctx context.Context, msg message_gateway.InboundMessage) error {
+		got++
+		return nil
+	}}
+	a.handleTeleMessage(context.Background(), &tele.Message{
+		ID:     1,
+		Text:   "hi",
+		Chat:   &tele.Chat{ID: -100, Type: tele.ChatGroup},
+		Sender: &tele.User{ID: 1},
+	})
+	if got != 0 {
+		t.Fatalf("group must be ignored")
+	}
+}
+
+func TestHandleUpdate_PrivateText(t *testing.T) {
+	var got message_gateway.InboundMessage
+	a := &Adapter{
+		cfg: message_gateway.ChannelConfig{ID: 7, Type: "telegram"},
+		onInbound: func(ctx context.Context, msg message_gateway.InboundMessage) error {
+			got = msg
+			return nil
+		},
+	}
+	a.handleTeleMessage(context.Background(), &tele.Message{
+		ID:     9,
+		Text:   "hi",
+		Chat:   &tele.Chat{ID: 42, Type: tele.ChatPrivate},
+		Sender: &tele.User{ID: 42},
+	})
+	if got.Text != "hi" || got.PlatformUserID != "42" || got.ChannelID != 7 {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestNew_RequiresToken(t *testing.T) {
+	_, err := New(message_gateway.ChannelConfig{}, nil)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}

plugins/domain/message_gateway/gateway_types.go

@@ -0,0 +1,62 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package message_gateway defines channel adapters, pairing codes, and inbound types.
+package message_gateway
+
+// ChannelTypeTelegram is the Telegram private-chat adapter type.
+const ChannelTypeTelegram = "telegram"
+
+// ChannelTypeQQ is the official QQ Bot C2C adapter type.
+const ChannelTypeQQ = "qq"
+
+// Capability describes what an adapter can send and receive.
+type Capability struct {
+	Text  bool
+	Image bool
+	File  bool
+	Reply bool
+	Group bool
+}
+
+// ChannelConfig is the decrypted runtime config passed to a factory.
+type ChannelConfig struct {
+	ID          uint64
+	Type        string
+	Name        string
+	Credentials map[string]string
+	Extra       map[string]string
+}
+
+// Recipient is the outbound destination on a platform.
+type Recipient struct {
+	ChatID         string
+	PlatformUserID string
+}
+
+// Attachment is a downloaded inbound file sitting on local disk.
+type Attachment struct {
+	Path     string
+	FileName string
+	MIME     string
+	Error    string
+}
+
+// InboundMessage is a normalized private-chat message.
+type InboundMessage struct {
+	ChannelID      uint64
+	ChannelType    string
+	PlatformUserID string
+	ChatID         string
+	MessageID      string
+	Text           string
+	Attachments    []Attachment
+	BindingUserID  *uint64
+}
+
+// OutboundMessage is a reply or probe send.
+type OutboundMessage struct {
+	Text        string
+	ReplyToID   string
+	Attachments []Attachment
+}

plugins/domain/message_gateway/logics.go

@@ -10,8 +10,6 @@ import (
 	"strings"
 	"time"
 
-	pkgmg "github.com/Rain-kl/Wavelet/pkg/message_gateway"
-
 	"gorm.io/gorm"
 )
 
@@ -37,7 +35,7 @@ func bindChannel(ctx context.Context, userID uint64, req BindRequest) (BindingDT
 	if err != nil || channelID == 0 {
 		return BindingDTO{}, errChannelIDRequired
 	}
-	code := pkgmg.NormalizeCode(req.Code)
+	code := NormalizeCode(req.Code)
 	if code == "" {
 		return BindingDTO{}, errCodeInvalid
 	}

plugins/domain/message_gateway/pairing.go

@@ -0,0 +1,50 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package message_gateway
+
+import (
+	"crypto/rand"
+	"strings"
+	"unicode"
+)
+
+// CodeAlphabet excludes easily confused runes 0/O/1/I.
+const CodeAlphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
+
+// CodeLength is the raw pairing code size.
+const CodeLength = 8
+
+// GenerateCode returns an 8-character pairing code.
+func GenerateCode() (string, error) {
+	buf := make([]byte, CodeLength)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	out := make([]byte, CodeLength)
+	for i, b := range buf {
+		out[i] = CodeAlphabet[int(b)%len(CodeAlphabet)]
+	}
+	return string(out), nil
+}
+
+// NormalizeCode strips separators and uppercases.
+func NormalizeCode(s string) string {
+	var b strings.Builder
+	for _, r := range s {
+		if r == '-' || unicode.IsSpace(r) {
+			continue
+		}
+		b.WriteRune(unicode.ToUpper(r))
+	}
+	return b.String()
+}
+
+// FormatCode renders ABCD-EFGH.
+func FormatCode(s string) string {
+	s = NormalizeCode(s)
+	if len(s) != CodeLength {
+		return s
+	}
+	return s[:4] + "-" + s[4:]
+}

plugins/domain/message_gateway/pairing_test.go

@@ -0,0 +1,33 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package message_gateway
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateCode_AlphabetAndLength(t *testing.T) {
+	code, err := GenerateCode()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(code) != 8 {
+		t.Fatalf("len=%d", len(code))
+	}
+	for _, r := range code {
+		if !strings.ContainsRune(CodeAlphabet, r) {
+			t.Fatalf("bad rune %q", r)
+		}
+	}
+}
+
+func TestNormalizeAndFormat(t *testing.T) {
+	if got := NormalizeCode("ab-cd-ef-gh"); got != "ABCDEFGH" {
+		t.Fatalf("got %q", got)
+	}
+	if got := FormatCode("ABCDEFGH"); got != "ABCD-EFGH" {
+		t.Fatalf("got %q", got)
+	}
+}

plugins/domain/message_gateway/push/custom.go

@@ -0,0 +1,98 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/pkg/httppool"
+)
+
+func init() {
+	Register("custom", &CustomPusher{})
+}
+
+// maxCustomResponseBytes 限制读取 Webhook 响应体的最大字节数，防止无界读取。
+const maxCustomResponseBytes = 4096
+
+// CustomPusher 自定义 Webhook 发送实现
+type CustomPusher struct{}
+
+// Send 发送自定义 webhook
+func (p *CustomPusher) Send(ctx context.Context, cfg Config, _ string, body map[string]any, template string, _ map[string]any) (string, error) {
+	if cfg.URL == "" {
+		return "", errors.New("custom: URL is required")
+	}
+
+	var reqBody []byte
+
+	if template != "" {
+		// 替换模板中的 {{key}} 占位符
+		rendered := ParseTemplate(template, body)
+		reqBody = []byte(rendered)
+	} else {
+		// 兜底：直接把 body 转为 JSON 字符串发送
+		var err error
+		reqBody, err = json.Marshal(body)
+		if err != nil {
+			return "", fmt.Errorf("custom: marshal body failed: %w", err)
+		}
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, cfg.URL, bytes.NewReader(reqBody))
+	if err != nil {
+		return "", fmt.Errorf("custom: create http request failed: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	// 如果配置了 Key 且格式为 "HeaderName:HeaderValue"，我们可以附加测试用 Header
+	if cfg.Key != "" && strings.Contains(cfg.Key, ":") {
+		parts := strings.SplitN(cfg.Key, ":", 2) //nolint:mnd
+		httpReq.Header.Set(strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]))
+	}
+
+	client := httppool.NewClient(defaultHTTPClientTimeout)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("custom: http request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	bodyBytes, _ := io.ReadAll(io.LimitReader(resp.Body, maxCustomResponseBytes))
+	upstreamResp := strings.TrimSpace(string(bodyBytes))
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 { //nolint:mnd
+		return upstreamResp, fmt.Errorf("custom: http status %s", resp.Status)
+	}
+
+	// 部分 Webhook（如企业微信、钉钉）即使业务失败也返回 HTTP 200，
+	// 仅当响应体包含非零 errcode 时才判定为发送失败，避免审计记录误报成功。
+	var apiResp struct {
+		ErrCode int    `json:"errcode"`
+		ErrMsg  string `json:"errmsg"`
+	}
+	if err := json.Unmarshal(bodyBytes, &apiResp); err == nil && apiResp.ErrCode != 0 {
+		return upstreamResp, fmt.Errorf("custom: webhook rejected: errcode=%d errmsg=%q", apiResp.ErrCode, apiResp.ErrMsg)
+	}
+
+	return upstreamResp, nil
+}
+
+// ValidateConfig 校验自定义配置
+func (p *CustomPusher) ValidateConfig(cfg Config) error {
+	if cfg.URL == "" {
+		return errors.New("webhook URL is required")
+	}
+	if !strings.HasPrefix(cfg.URL, "http://") && !strings.HasPrefix(cfg.URL, "https://") {
+		return errors.New("webhook URL must start with http:// or https://")
+	}
+	return nil
+}

plugins/domain/message_gateway/push/custom_test.go

@@ -0,0 +1,91 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomPusherSend_ResponseBodyErrcode(t *testing.T) {
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		wantErr    bool
+		wantErrMsg string
+	}{
+		{
+			name:       "wechat business error returns HTTP 200 with non-zero errcode",
+			statusCode: http.StatusOK,
+			body:       `{"errcode":93000,"errmsg":"invalid request data"}`,
+			wantErr:    true,
+			wantErrMsg: "errcode=93000",
+		},
+		{
+			name:       "wechat success returns errcode 0",
+			statusCode: http.StatusOK,
+			body:       `{"errcode":0,"errmsg":"ok"}`,
+			wantErr:    false,
+		},
+		{
+			name:       "json response without errcode is tolerated",
+			statusCode: http.StatusOK,
+			body:       `{"success":true}`,
+			wantErr:    false,
+		},
+		{
+			name:       "non-json response body is tolerated",
+			statusCode: http.StatusOK,
+			body:       "ok",
+			wantErr:    false,
+		},
+		{
+			name:       "empty response body is tolerated",
+			statusCode: http.StatusNoContent,
+			body:       "",
+			wantErr:    false,
+		},
+		{
+			name:       "http error status still fails",
+			statusCode: http.StatusInternalServerError,
+			body:       `{"errcode":0,"errmsg":"ok"}`,
+			wantErr:    true,
+			wantErrMsg: "http status",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(tt.statusCode)
+				_, _ = w.Write([]byte(tt.body))
+			}))
+			defer srv.Close()
+
+			pusher := &CustomPusher{}
+			upstreamResp, err := pusher.Send(context.Background(),
+				Config{Channel: "custom", URL: srv.URL},
+				"",
+				map[string]any{"title": "t", "content": "c"},
+				`{"title":"$title","content":"$content"}`,
+				nil,
+			)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErrMsg)
+				return
+			}
+			assert.NoError(t, err)
+			if tt.body != "" {
+				assert.Contains(t, upstreamResp, tt.body)
+			}
+		})
+	}
+}

plugins/domain/message_gateway/push/email.go

@@ -0,0 +1,119 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/pkg/util"
+)
+
+func init() {
+	Register("email", &EmailPusher{})
+}
+
+// EmailPusher 极简 SMTP 邮件推送实现 (静态、解耦)
+type EmailPusher struct{}
+
+// sanitizeEmailHeader removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeEmailHeader(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
+// Send 发送邮件
+func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, _ string, ext map[string]any) (string, error) {
+	if cfg.URL == "" || cfg.Key == "" || cfg.Secret == "" {
+		return "", errors.New("email: SMTP configuration (url, key, secret) is incomplete")
+	}
+	if target == "" {
+		return "", errors.New("email: target email address is required")
+	}
+
+	title := defaultTitle
+	if t, ok := body["title"].(string); ok && t != "" {
+		title = t
+	}
+
+	content := ""
+	if c, ok := body["content"].(string); ok && c != "" {
+		content = c
+	} else {
+		// 自动格式化 map
+		var parts []string
+		for k, v := range body {
+			parts = append(parts, fmt.Sprintf("<p><b>%s</b>: %v</p>", k, v))
+		}
+		content = strings.Join(parts, "")
+	}
+
+	// 邮件头和体
+	from := cfg.Key
+	to := target
+
+	// 如果 ext 中指定了 from_name，我们在 From 头部包含它
+	fromName := "System Notification"
+	if ext != nil {
+		if fn, ok := ext["from_name"].(string); ok && fn != "" {
+			fromName = fn
+		}
+	}
+
+	subjectHeader := fmt.Sprintf("Subject: %s\r\n", sanitizeEmailHeader(title))
+	fromHeader := fmt.Sprintf("From: %s <%s>\r\n", sanitizeEmailHeader(fromName), sanitizeEmailHeader(from))
+	toHeader := fmt.Sprintf("To: %s\r\n", sanitizeEmailHeader(to))
+	mimeHeader := "MIME-version: 1.0;\r\nContent-Type: text/html; charset=\"UTF-8\";\r\n\r\n"
+
+	// 拼装完整的邮件报文
+	// 简单的 HTML 正文渲染
+	htmlBody := fmt.Sprintf(`<html><body><h2>%s</h2><div>%s</div></body></html>`, title, content)
+	msg := []byte(fromHeader + toHeader + subjectHeader + mimeHeader + htmlBody + "\r\n")
+
+	// 解析 Host 和 Port
+	host, port, err := net.SplitHostPort(cfg.URL)
+	if err != nil {
+		host = cfg.URL
+		port = "25" // 默认 SMTP 端口
+	}
+
+	auth := smtp.PlainAuth("", cfg.Key, cfg.Secret, host)
+
+	// 异步超时处理
+	errChan := make(chan error, 1)
+	util.Go(func() {
+		errChan <- smtp.SendMail(host+":"+port, auth, from, []string{to}, msg)
+	})
+
+	select {
+	case <-ctx.Done():
+		return "", ctx.Err()
+	case err := <-errChan:
+		if err != nil {
+			return "", fmt.Errorf("email: send smtp mail failed: %w", err)
+		}
+	}
+
+	return "", nil
+}
+
+// ValidateConfig 校验邮件 SMTP 配置
+func (p *EmailPusher) ValidateConfig(cfg Config) error {
+	if cfg.URL == "" {
+		return errors.New("SMTP host:port is required")
+	}
+	if cfg.Key == "" {
+		return errors.New("SMTP username is required")
+	}
+	if cfg.Secret == "" {
+		return errors.New("SMTP password is required")
+	}
+	return nil
+}

plugins/domain/message_gateway/push/email_test.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import "testing"
+
+func TestSanitizeEmailHeader(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"plain", "System Notification", "System Notification"},
+		{"crlf stripped", "alert\r\nBcc: attacker@example.com", "alertBcc: attacker@example.com"},
+		{"cr stripped", "a\rb", "ab"},
+		{"lf stripped", "a\nb", "ab"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeEmailHeader(tt.input); got != tt.want {
+				t.Errorf("sanitizeEmailHeader(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}

plugins/domain/message_gateway/push/lark.go

@@ -0,0 +1,275 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/pkg/httppool"
+)
+
+func init() {
+	Register("lark", &LarkPusher{})
+}
+
+const (
+	msgTypeInteractive = "interactive"
+)
+
+// LarkPusher 飞书 Webhook 机器人推送实现
+type LarkPusher struct{}
+
+type larkTextContent struct {
+	Text string `json:"text"`
+}
+
+type larkCardHeaderTitle struct {
+	Content string `json:"content"`
+	Tag     string `json:"tag"`
+}
+
+type larkCardHeader struct {
+	Template string              `json:"template"` // "blue", "orange", "red" etc.
+	Title    larkCardHeaderTitle `json:"title"`
+}
+
+type larkCardElementText struct {
+	Content string `json:"content"`
+	Tag     string `json:"tag"` // "lark_md"
+}
+
+type larkCardElement struct {
+	Tag  string              `json:"tag"` // "div"
+	Text larkCardElementText `json:"text"`
+}
+
+type larkCardContent struct {
+	Header   larkCardHeader    `json:"header"`
+	Elements []larkCardElement `json:"elements"`
+}
+
+type larkMessageRequest struct {
+	MessageType string           `json:"msg_type"`
+	Timestamp   string           `json:"timestamp,omitempty"`
+	Sign        string           `json:"sign,omitempty"`
+	Content     larkTextContent  `json:"content,omitempty"`
+	Card        *larkCardContent `json:"card,omitempty"`
+}
+
+type larkMessageResponse struct {
+	Code int    `json:"code"`
+	Msg  string `json:"msg"`
+}
+
+// Send 执行飞书消息发送
+//
+//nolint:nestif,cyclop
+func (p *LarkPusher) Send(ctx context.Context, cfg Config, _ string, body map[string]any, template string, _ map[string]any) (string, error) {
+	if cfg.URL == "" {
+		return "", errors.New("lark: URL is required")
+	}
+
+	var req larkMessageRequest
+
+	// 1. 如果有自定义模板，我们尝试进行解析
+	if template != "" {
+		rendered := ParseTemplate(template, body)
+
+		// 尝试解析原生的 Lark Card
+		var customCard larkCardContent
+		var rawMap map[string]any
+		_ = json.Unmarshal([]byte(rendered), &rawMap)
+
+		if rawMap != nil && rawMap["elements"] != nil {
+			// 如果包含 elements 字段，说明是用户定制的原生飞书卡片 JSON
+			if err := json.Unmarshal([]byte(rendered), &customCard); err == nil {
+				req.MessageType = msgTypeInteractive
+				req.Card = &customCard
+			} else {
+				req.MessageType = "text"
+				req.Content.Text = rendered
+			}
+		} else {
+			// 说明配置的是系统统一通知消息 of JSON 模板：{"title": "...", "content": "...", "level": "..."}
+			type larkNotificationMessage struct {
+				Title   string `json:"title"`
+				Content string `json:"content"`
+				Level   string `json:"level"`
+			}
+			var msg larkNotificationMessage
+			if err := json.Unmarshal([]byte(rendered), &msg); err == nil && (msg.Title != "" || msg.Content != "") {
+				title := msg.Title
+				if title == "" {
+					title = defaultTitle
+				}
+				content := msg.Content
+				level := strings.ToUpper(msg.Level)
+				if level == "" {
+					level = levelInfo
+				}
+
+				headerColor := "blue"
+				switch level {
+				case "IMPORTANT":
+					headerColor = "orange"
+				case "CRITICAL":
+					headerColor = "red"
+				}
+
+				req.MessageType = msgTypeInteractive
+				req.Card = &larkCardContent{
+					Header: larkCardHeader{
+						Template: headerColor,
+						Title: larkCardHeaderTitle{
+							Content: title,
+							Tag:     "plain_text",
+						},
+					},
+					Elements: []larkCardElement{
+						{
+							Tag: "div",
+							Text: larkCardElementText{
+								Content: content,
+								Tag:     "lark_md",
+							},
+						},
+					},
+				}
+			} else {
+				// 兜底：如果无法按 JSON 解析出结构化字段，当做普通文本发送
+				req.MessageType = "text"
+				req.Content.Text = rendered
+			}
+		}
+	} else {
+		// 2. 如果无模板，默认生成一个精美的飞书互动卡片
+		title := defaultTitle
+		if t, ok := body["title"].(string); ok && t != "" {
+			title = t
+		}
+
+		content := ""
+		if c, ok := body["content"].(string); ok && c != "" {
+			content = c
+		} else {
+			// 兜底：如果连 content 都没有，把 body 里的所有值拼成 markdown
+			var parts []string
+			for k, v := range body {
+				parts = append(parts, fmt.Sprintf("**%s**: %v", k, v))
+			}
+			content = strings.Join(parts, "\n")
+		}
+
+		level := levelInfo
+		if l, ok := body["level"].(string); ok && l != "" {
+			level = strings.ToUpper(l)
+		}
+
+		// 根据级别确定飞书卡片头部的背景色模板
+		headerColor := "blue"
+		switch level {
+		case "IMPORTANT":
+			headerColor = "orange"
+		case "CRITICAL":
+			headerColor = "red"
+		}
+
+		req.MessageType = msgTypeInteractive
+		req.Card = &larkCardContent{
+			Header: larkCardHeader{
+				Template: headerColor,
+				Title: larkCardHeaderTitle{
+					Content: title,
+					Tag:     "plain_text",
+				},
+			},
+			Elements: []larkCardElement{
+				{
+					Tag: "div",
+					Text: larkCardElementText{
+						Content: content,
+						Tag:     "lark_md",
+					},
+				},
+			},
+		}
+	}
+
+	// 3. 计算签名 (如果配置了 secret)
+	if cfg.Secret != "" {
+		timestamp := time.Now().Unix()
+		sign, err := larkSign(cfg.Secret, timestamp)
+		if err != nil {
+			return "", fmt.Errorf("lark: sign failed: %w", err)
+		}
+		req.Timestamp = strconv.FormatInt(timestamp, 10)
+		req.Sign = sign
+	}
+
+	jsonData, err := json.Marshal(req)
+	if err != nil {
+		return "", fmt.Errorf("lark: marshal request failed: %w", err)
+	}
+
+	// 4. 发送 POST 请求
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, cfg.URL, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return "", fmt.Errorf("lark: create http request failed: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	client := httppool.NewClient(defaultHTTPClientTimeout)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("lark: http request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("lark: http status %s", resp.Status)
+	}
+
+	var res larkMessageResponse
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return "", fmt.Errorf("lark: decode response failed: %w", err)
+	}
+
+	if res.Code != 0 {
+		return "", fmt.Errorf("lark: send message failed, code %d: %s", res.Code, res.Msg)
+	}
+
+	return "", nil
+}
+
+// ValidateConfig 校验飞书配置
+func (p *LarkPusher) ValidateConfig(cfg Config) error {
+	if cfg.URL == "" {
+		return errors.New("webhook URL is required")
+	}
+	if !strings.HasPrefix(cfg.URL, "http://") && !strings.HasPrefix(cfg.URL, "https://") {
+		return errors.New("webhook URL must start with http:// or https://")
+	}
+	return nil
+}
+
+func larkSign(secret string, timestamp int64) (string, error) {
+	stringToSign := fmt.Sprintf("%v", timestamp) + "\n" + secret
+	h := hmac.New(sha256.New, []byte(stringToSign))
+	_, err := h.Write(nil)
+	if err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
+}

plugins/domain/message_gateway/push/push.go

@@ -0,0 +1,67 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package push 提供解耦的、无外部业务依赖 of 通知推送底层实现
+package push
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+)
+
+const (
+	defaultTitle             = "系统通知"
+	levelInfo                = "INFO"
+	defaultHTTPClientTimeout = 10 * time.Second
+)
+
+// Config 基础通知渠道配置
+type Config struct {
+	Channel string         `json:"channel"`          // 渠道名称，例如 "lark", "custom", "email" 等，唯一标识
+	URL     string         `json:"url,omitempty"`    // Webhook 地址或 SMTP 地址
+	Secret  string         `json:"secret,omitempty"` // 签名密钥或 SMTP 密码/Token
+	Key     string         `json:"key,omitempty"`    // AppID 或 SMTP 用户名
+	Ext     map[string]any `json:"ext,omitempty"`    // 预留拓展 JSON 配置
+}
+
+// Pusher 通知推送渠道接口
+type Pusher interface {
+	// Send 发送通知消息
+	// target: 发送目标 (如邮箱地址或特定用户标识；若为 bot 机器人此项为空)
+	// body: 消息体数据 (含默认字段如 title, content, level)
+	// template: 消息卡片/模板 JSON (可选)
+	// ext: 预留的单次发送拓展数据
+	// 返回 upstreamResp: 上游服务返回的响应内容（如 Webhook 响应体），用于任务日志审计；无响应时为空字符串
+	Send(ctx context.Context, cfg Config, target string, body map[string]any, template string, ext map[string]any) (upstreamResp string, err error)
+
+	// ValidateConfig 校验渠道配置合法性
+	ValidateConfig(cfg Config) error
+}
+
+var (
+	pushersMu sync.RWMutex
+	pushers   = make(map[string]Pusher)
+)
+
+// Register 注册一个推送渠道实现
+func Register(channelType string, pusher Pusher) {
+	pushersMu.Lock()
+	defer pushersMu.Unlock()
+	if pusher == nil {
+		panic("push: Register pusher is nil")
+	}
+	pushers[channelType] = pusher
+}
+
+// GetPusher 获取指定类型的推送渠道实现
+func GetPusher(channelType string) (Pusher, error) {
+	pushersMu.RLock()
+	defer pushersMu.RUnlock()
+	pusher, ok := pushers[channelType]
+	if !ok {
+		return nil, fmt.Errorf("push: unknown channel type %q", channelType)
+	}
+	return pusher, nil
+}

plugins/domain/message_gateway/push/telegram.go

@@ -0,0 +1,158 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/pkg/httppool"
+)
+
+func init() {
+	Register("telegram", &TelegramPusher{})
+}
+
+// TelegramPusher Telegram 机器人推送实现
+type TelegramPusher struct{}
+
+type telegramMessageRequest struct {
+	ChatID    string `json:"chat_id"`
+	Text      string `json:"text"`
+	ParseMode string `json:"parse_mode,omitempty"`
+}
+
+type telegramErrorResponse struct {
+	Ok          bool   `json:"ok"`
+	ErrorCode   int    `json:"error_code"`
+	Description string `json:"description"`
+}
+
+// Send 执行 Telegram 消息发送
+//
+//nolint:cyclop
+func (p *TelegramPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, template string, _ map[string]any) (string, error) {
+	if cfg.Secret == "" {
+		return "", errors.New("telegram: Bot Token (Secret) is required")
+	}
+
+	chatID := target
+	if chatID == "" {
+		chatID = cfg.Key // Use default chat ID (Key) if target is blank
+	}
+	if chatID == "" {
+		return "", errors.New("telegram: chat_id (target or default Key) is required")
+	}
+
+	baseURL := cfg.URL
+	if baseURL == "" {
+		baseURL = "https://api.telegram.org"
+	}
+	baseURL = strings.TrimSuffix(baseURL, "/")
+
+	title := defaultTitle
+	if t, ok := body["title"].(string); ok && t != "" {
+		title = t
+	}
+	content := ""
+	if c, ok := body["content"].(string); ok && c != "" {
+		content = c
+	} else {
+		var parts []string
+		for k, v := range body {
+			parts = append(parts, fmt.Sprintf("<b>%s</b>: %v", k, v))
+		}
+		content = strings.Join(parts, "\n")
+	}
+	level := levelInfo
+	if l, ok := body["level"].(string); ok && l != "" {
+		level = strings.ToUpper(l)
+	}
+
+	var text string
+	if template != "" {
+		text = ParseTemplate(template, body)
+	} else {
+		text = fmt.Sprintf("<b>[%s] %s</b>\n\n%s", escapeHTML(level), escapeHTML(title), escapeHTML(content))
+	}
+
+	// Try sending with HTML parse mode
+	err := p.sendMessage(ctx, baseURL, cfg.Secret, chatID, text, "HTML")
+	if err != nil {
+		// Fallback: send as plain text without parse mode
+		plainText := text
+		if template == "" {
+			plainText = fmt.Sprintf("[%s] %s\n\n%s", level, title, content)
+		}
+		fallbackErr := p.sendMessage(ctx, baseURL, cfg.Secret, chatID, plainText, "")
+		if fallbackErr != nil {
+			return "", fmt.Errorf("telegram: send message failed (fallback also failed): %w (original HTML error: %v)", fallbackErr, err)
+		}
+	}
+
+	return "", nil
+}
+
+// ValidateConfig 校验 Telegram 配置
+func (p *TelegramPusher) ValidateConfig(cfg Config) error {
+	if cfg.Secret == "" {
+		return errors.New("bot Token (Secret) is required")
+	}
+	if cfg.URL != "" {
+		if !strings.HasPrefix(cfg.URL, "http://") && !strings.HasPrefix(cfg.URL, "https://") {
+			return errors.New("API base URL must start with http:// or https://")
+		}
+	}
+	return nil
+}
+
+func (p *TelegramPusher) sendMessage(ctx context.Context, baseURL, token, chatID, text, parseMode string) error {
+	apiURL := fmt.Sprintf("%s/bot%s/sendMessage", baseURL, token)
+
+	reqPayload := telegramMessageRequest{
+		ChatID:    chatID,
+		Text:      text,
+		ParseMode: parseMode,
+	}
+
+	jsonData, err := json.Marshal(reqPayload)
+	if err != nil {
+		return fmt.Errorf("marshal request failed: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, apiURL, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("create http request failed: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	client := httppool.NewClient(defaultHTTPClientTimeout)
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("http request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		var errRes telegramErrorResponse
+		if decodeErr := json.NewDecoder(resp.Body).Decode(&errRes); decodeErr == nil {
+			return fmt.Errorf("http status %d: %s", resp.StatusCode, errRes.Description)
+		}
+		return fmt.Errorf("http status %s", resp.Status)
+	}
+
+	return nil
+}
+
+func escapeHTML(s string) string {
+	s = strings.ReplaceAll(s, "&", "&amp;")
+	s = strings.ReplaceAll(s, "<", "&lt;")
+	s = strings.ReplaceAll(s, ">", "&gt;")
+	return s
+}

plugins/domain/message_gateway/push/telegram_test.go

@@ -0,0 +1,116 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTelegramPusher_Send(t *testing.T) {
+	t.Run("successful send with HTML parse mode", func(t *testing.T) {
+		var receivedReq telegramMessageRequest
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "/botmy-token/sendMessage", r.URL.Path)
+			assert.Equal(t, http.MethodPost, r.Method)
+			assert.Equal(t, "application/json", r.Header.Get("Content-Type"))
+
+			err := json.NewDecoder(r.Body).Decode(&receivedReq)
+			require.NoError(t, err)
+
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"ok": true}`))
+		}))
+		defer server.Close()
+
+		pusher := &TelegramPusher{}
+		cfg := Config{
+			Channel: "telegram",
+			URL:     server.URL,
+			Secret:  "my-token",
+		}
+		body := map[string]any{
+			"title":   "Alert",
+			"content": "Host down",
+			"level":   "CRITICAL",
+		}
+		_, err := pusher.Send(context.Background(), cfg, "123456", body, "", nil)
+		require.NoError(t, err)
+
+		assert.Equal(t, "123456", receivedReq.ChatID)
+		assert.Contains(t, receivedReq.Text, "[CRITICAL] Alert")
+		assert.Contains(t, receivedReq.Text, "Host down")
+		assert.Equal(t, "HTML", receivedReq.ParseMode)
+	})
+
+	t.Run("fallback to plain text on HTML error", func(t *testing.T) {
+		var requests []*telegramMessageRequest
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			var req telegramMessageRequest
+			err := json.NewDecoder(r.Body).Decode(&req)
+			require.NoError(t, err)
+			requests = append(requests, &req)
+
+			if len(requests) == 1 {
+				w.WriteHeader(http.StatusBadRequest)
+				_, _ = w.Write([]byte(`{"ok": false, "error_code": 400, "description": "Bad Request: can't parse entities"}`))
+			} else {
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(`{"ok": true}`))
+			}
+		}))
+		defer server.Close()
+
+		pusher := &TelegramPusher{}
+		cfg := Config{
+			Channel: "telegram",
+			URL:     server.URL,
+			Secret:  "my-token",
+		}
+		body := map[string]any{
+			"title":   "Alert & Info",
+			"content": "A < B comparison",
+			"level":   "INFO",
+		}
+		_, err := pusher.Send(context.Background(), cfg, "123456", body, "", nil)
+		require.NoError(t, err)
+
+		require.Len(t, requests, 2)
+		assert.Equal(t, "HTML", requests[0].ParseMode)
+		assert.Equal(t, "", requests[1].ParseMode)
+		assert.Contains(t, requests[1].Text, "[INFO] Alert & Info")
+		assert.Contains(t, requests[1].Text, "A < B comparison")
+	})
+
+	t.Run("validation error", func(t *testing.T) {
+		pusher := &TelegramPusher{}
+		cfg := Config{
+			Channel: "telegram",
+			URL:     "https://api.telegram.org",
+		}
+		err := pusher.ValidateConfig(cfg)
+		assert.Error(t, err)
+
+		cfg = Config{
+			Channel: "telegram",
+			URL:     "ftp://api.telegram.org",
+			Secret:  "token",
+		}
+		err = pusher.ValidateConfig(cfg)
+		assert.Error(t, err)
+
+		cfg = Config{
+			Channel: "telegram",
+			Secret:  "token",
+		}
+		err = pusher.ValidateConfig(cfg)
+		assert.NoError(t, err)
+	})
+}

plugins/domain/message_gateway/push/template.go

@@ -0,0 +1,78 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// ParseTemplate parses template strings by replacing {{placeholder}} structures with values from body.
+// It is a single-pass parser designed for high performance and low allocations.
+func ParseTemplate(template string, body map[string]any) string {
+	var buf strings.Builder
+	buf.Grow(len(template))
+
+	i := 0
+	for {
+		pos := strings.Index(template[i:], "{{")
+		if pos == -1 {
+			buf.WriteString(template[i:])
+			break
+		}
+		// Write prefix
+		buf.WriteString(template[i : i+pos])
+		i += pos + 2 // skip "{{"
+
+		endPos := strings.Index(template[i:], "}}")
+		if endPos == -1 {
+			// Unbalanced "{{"
+			buf.WriteString("{{")
+			buf.WriteString(template[i:])
+			break
+		}
+		key := template[i : i+endPos]
+		if val, ok := body[key]; ok {
+			buf.WriteString(formatValue(val))
+		} else {
+			// Keep the placeholder if key not found
+			buf.WriteString("{{")
+			buf.WriteString(key)
+			buf.WriteString("}}")
+		}
+		i += endPos + 2 // skip "}}"
+	}
+	return buf.String()
+}
+
+func formatValue(v any) string {
+	if v == nil {
+		return ""
+	}
+	switch val := v.(type) {
+	case string:
+		return val
+	case []byte:
+		return string(val)
+	case int:
+		return strconv.Itoa(val)
+	case int32:
+		return strconv.FormatInt(int64(val), 10)
+	case int64:
+		return strconv.FormatInt(val, 10)
+	case float64:
+		return strconv.FormatFloat(val, 'f', -1, 64)
+	case bool:
+		return strconv.FormatBool(val)
+	default:
+		// If it's a map, slice, or struct, marshal it to JSON.
+		b, err := json.Marshal(v)
+		if err == nil {
+			return string(b)
+		}
+		return fmt.Sprintf("%v", v)
+	}
+}

plugins/domain/message_gateway/push/template_test.go

@@ -0,0 +1,75 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseTemplate(t *testing.T) {
+	tests := []struct {
+		name     string
+		template string
+		body     map[string]any
+		expected string
+	}{
+		{
+			name:     "simple replacement",
+			template: "hello {{name}}",
+			body:     map[string]any{"name": "world"},
+			expected: "hello world",
+		},
+		{
+			name:     "multiple replacements",
+			template: "{{greeting}} {{name}}!",
+			body:     map[string]any{"greeting": "Hello", "name": "Alice"},
+			expected: "Hello Alice!",
+		},
+		{
+			name:     "missing key preserves placeholder",
+			template: "hello {{name}} and {{other}}",
+			body:     map[string]any{"name": "world"},
+			expected: "hello world and {{other}}",
+		},
+		{
+			name:     "unbalanced placeholders",
+			template: "hello {{name",
+			body:     map[string]any{"name": "world"},
+			expected: "hello {{name",
+		},
+		{
+			name:     "nil value",
+			template: "val: {{val}}",
+			body:     map[string]any{"val": nil},
+			expected: "val: ",
+		},
+		{
+			name:     "basic types",
+			template: "int: {{i}}, float: {{f}}, bool: {{b}}",
+			body:     map[string]any{"i": 123, "f": 45.67, "b": true},
+			expected: "int: 123, float: 45.67, bool: true",
+		},
+		{
+			name:     "complex type slice",
+			template: "items: {{items}}",
+			body:     map[string]any{"items": []string{"a", "b"}},
+			expected: `items: ["a","b"]`,
+		},
+		{
+			name:     "complex type map",
+			template: "obj: {{obj}}",
+			body:     map[string]any{"obj": map[string]any{"key": "value"}},
+			expected: `obj: {"key":"value"}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := ParseTemplate(tt.template, tt.body)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

plugins/domain/message_gateway/push_channels.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"sync"
 
-	pkgpush "github.com/Rain-kl/Wavelet/pkg/push"
 	"github.com/Rain-kl/Wavelet/pkg/response"
+	pkgpush "github.com/Rain-kl/Wavelet/plugins/domain/message_gateway/push"
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
 )

plugins/domain/message_gateway/push_events.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 
-	pkgpush "github.com/Rain-kl/Wavelet/pkg/push"
+	pkgpush "github.com/Rain-kl/Wavelet/plugins/domain/message_gateway/push"
 
 	"github.com/Rain-kl/Wavelet/pkg/util"
 	"gorm.io/gorm"

plugins/domain/message_gateway/push_handlers.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"strconv"
 
-	pkgpush "github.com/Rain-kl/Wavelet/pkg/push"
+	pkgpush "github.com/Rain-kl/Wavelet/plugins/domain/message_gateway/push"
 
 	"github.com/Rain-kl/Wavelet/pkg/response"
 	"github.com/gin-gonic/gin"

plugins/domain/message_gateway/push_logics.go

@@ -12,9 +12,9 @@ import (
 	"strings"
 
 	"github.com/Rain-kl/Wavelet/core/contracts"
-	db "github.com/Rain-kl/Wavelet/pkg/persistence"
-	pkgpush "github.com/Rain-kl/Wavelet/pkg/push"
-	"github.com/Rain-kl/Wavelet/pkg/task"
+	pkgpush "github.com/Rain-kl/Wavelet/plugins/domain/message_gateway/push"
+	"github.com/Rain-kl/Wavelet/plugins/drivers/driver_asynq_worker"
+	db "github.com/Rain-kl/Wavelet/plugins/infra/database"
 	"gorm.io/gorm"
 )
 
@@ -445,7 +445,7 @@ func findBuiltInEvent(key string) (EventMetadata, bool) {
 
 func getEventInfo(req CreatePushEventRequest) (string, string, []byte, error) {
 	if req.TaskType != "" {
-		meta := task.GetTaskMetaByAsynqTask(req.TaskType)
+		meta := driver_asynq_worker.GetTaskMetaByAsynqTask(req.TaskType)
 		if meta == nil {
 			return "", "", nil, errors.New("unsupported task type")
 		}
@@ -484,7 +484,7 @@ func enqueuePushTask(ctx context.Context, payload SendPayload) error {
 	if err != nil {
 		return err
 	}
-	_, err = task.DispatchTask(ctx, "send_notification", payloadBytes, "system")
+	_, err = driver_asynq_worker.DispatchTask(ctx, "send_notification", payloadBytes, "system")
 	return err
 }
 

plugins/domain/message_gateway/push_task_listener.go

@@ -10,15 +10,15 @@ import (
 	"time"
 
 	"github.com/Rain-kl/Wavelet/pkg/logger"
-	"github.com/Rain-kl/Wavelet/pkg/task"
+	"github.com/Rain-kl/Wavelet/plugins/drivers/driver_asynq_worker"
 )
 
 // RegisterTaskListeners subscribes push notification handlers to task completion events.
 func RegisterTaskListeners() {
-	task.OnTaskCompleted(handleTaskCompleted)
+	driver_asynq_worker.OnTaskCompleted(handleTaskCompleted)
 }
 
-func handleTaskCompleted(ctx context.Context, execution *task.TaskExecution, result *task.TaskResult, execErr error) {
+func handleTaskCompleted(ctx context.Context, execution *driver_asynq_worker.TaskExecution, result *driver_asynq_worker.TaskResult, execErr error) {
 	events, err := listActivePushEventsByTaskType(ctx, execution.TaskType)
 	if err != nil {
 		logger.ErrorF(ctx, "push_task_completed_listener: failed to query push events for task type %s: %v", execution.TaskType, err)

plugins/domain/message_gateway/push_tasks.go

@@ -9,8 +9,8 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/Rain-kl/Wavelet/pkg/push"
-	"github.com/Rain-kl/Wavelet/pkg/task"
+	"github.com/Rain-kl/Wavelet/plugins/domain/message_gateway/push"
+	"github.com/Rain-kl/Wavelet/plugins/drivers/driver_asynq_worker"
 )
 
 const (
@@ -21,16 +21,16 @@ const (
 )
 
 // SendNotificationMeta represents the task metadata.
-var SendNotificationMeta = task.TaskMeta{
+var SendNotificationMeta = driver_asynq_worker.TaskMeta{
 	Type:         TaskTypeSendNotification,
 	AsynqTask:    SendNotificationTask,
 	Name:         "推送通知",
 	Description:  "异步执行系统通知的多渠道派发与推送",
 	SupportsTime: false,
-	MaxRetry:     task.DefaultMaxRetry,
-	Queue:        task.QueueDefault,
+	MaxRetry:     driver_asynq_worker.DefaultMaxRetry,
+	Queue:        driver_asynq_worker.QueueDefault,
 	Retryable:    true,
-	Params: []task.TaskParam{
+	Params: []driver_asynq_worker.TaskParam{
 		{
 			Name:        "event_key",
 			Label:       "事件标识",
@@ -69,20 +69,20 @@ func (h *PushHandler) ValidatePayload(payload []byte) ([]byte, error) {
 }
 
 // Execute performs the push send and logs delivery history audit.
-func (h *PushHandler) Execute(ctx context.Context, payload []byte) (*task.TaskResult, error) {
+func (h *PushHandler) Execute(ctx context.Context, payload []byte) (*driver_asynq_worker.TaskResult, error) {
 	var req SendPayload
 	if err := json.Unmarshal(payload, &req); err != nil {
-		task.AppendLog(ctx, "解析推送参数失败: %v", err)
+		driver_asynq_worker.AppendLog(ctx, "解析推送参数失败: %v", err)
 		return nil, fmt.Errorf("parse payload failed: %w", err)
 	}
 
-	task.AppendLog(ctx, "开始推送通知: 事件 = %s, 渠道 = %s, 接收目标 = %s", req.EventKey, req.Config.Channel, req.Target)
+	driver_asynq_worker.AppendLog(ctx, "开始推送通知: 事件 = %s, 渠道 = %s, 接收目标 = %s", req.EventKey, req.Config.Channel, req.Target)
 
 	pusher, err := push.GetPusher(req.Config.Channel)
 	if err != nil {
 		errWrap := fmt.Errorf("get pusher failed: %w", err)
-		task.AppendLog(ctx, "推送失败: %v", errWrap)
-		if task.IsFinalAttempt(ctx) {
+		driver_asynq_worker.AppendLog(ctx, "推送失败: %v", errWrap)
+		if driver_asynq_worker.IsFinalAttempt(ctx) {
 			h.recordHistory(ctx, req, "failed", errWrap.Error())
 		}
 		return nil, errWrap
@@ -95,29 +95,29 @@ func (h *PushHandler) Execute(ctx context.Context, payload []byte) (*task.TaskRe
 	content := req.Body.Content
 
 	if err != nil {
-		task.AppendLog(ctx, "消息推送失败 (标题: %s): %v", title, err)
+		driver_asynq_worker.AppendLog(ctx, "消息推送失败 (标题: %s): %v", title, err)
 		if upstreamResp != "" {
-			task.AppendLog(ctx, "上游返回: %s", upstreamResp)
+			driver_asynq_worker.AppendLog(ctx, "上游返回: %s", upstreamResp)
 		}
-		if task.IsFinalAttempt(ctx) {
+		if driver_asynq_worker.IsFinalAttempt(ctx) {
 			h.recordHistory(ctx, req, "failed", err.Error())
 		}
 		return nil, fmt.Errorf("pusher.Send failed: %w", err)
 	}
 
-	task.AppendLog(ctx, "消息推送成功 (标题: %s, 内容摘要: %s)", title, content)
+	driver_asynq_worker.AppendLog(ctx, "消息推送成功 (标题: %s, 内容摘要: %s)", title, content)
 	if upstreamResp != "" {
-		task.AppendLog(ctx, "上游返回: %s", upstreamResp)
+		driver_asynq_worker.AppendLog(ctx, "上游返回: %s", upstreamResp)
 	}
 	h.recordHistory(ctx, req, "success", "")
 
-	return &task.TaskResult{
+	return &driver_asynq_worker.TaskResult{
 		Message: fmt.Sprintf("推送成功: [%s] -> %s", req.Config.Channel, req.Target),
 	}, nil
 }
 
 func (h *PushHandler) recordHistory(ctx context.Context, req SendPayload, status string, errMsg string) {
 	if dbErr := recordPushHistory(ctx, req, status, errMsg); dbErr != nil {
-		task.AppendLog(ctx, "写入推送历史审计记录失败: %v", dbErr)
+		driver_asynq_worker.AppendLog(ctx, "写入推送历史审计记录失败: %v", dbErr)
 	}
 }

plugins/domain/message_gateway/registry.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package message_gateway
+
+import "sync"
+
+var (
+	factoriesMu sync.RWMutex
+	factories   = map[string]Factory{}
+)
+
+// Register stores a channel factory under typ.
+func Register(typ string, fn Factory) {
+	factoriesMu.Lock()
+	defer factoriesMu.Unlock()
+	factories[typ] = fn
+}
+
+// Lookup returns a previously registered factory.
+func Lookup(typ string) (Factory, bool) {
+	factoriesMu.RLock()
+	defer factoriesMu.RUnlock()
+	fn, ok := factories[typ]
+	return fn, ok
+}

plugins/domain/message_gateway/registry_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package message_gateway
+
+import (
+	"context"
+	"testing"
+)
+
+type stubChannel struct{}
+
+func (stubChannel) Type() string { return "stub" }
+func (stubChannel) Connect(context.Context) error {
+	return nil
+}
+func (stubChannel) Disconnect(context.Context) error { return nil }
+func (stubChannel) Send(context.Context, Recipient, OutboundMessage) error {
+	return nil
+}
+func (stubChannel) Capabilities() Capability { return Capability{Text: true} }
+
+func TestRegisterLookup(t *testing.T) {
+	Register("stub", func(ChannelConfig, Handler) (Channel, error) {
+		return stubChannel{}, nil
+	})
+	fn, ok := Lookup("stub")
+	if !ok {
+		t.Fatal("expected factory")
+	}
+	ch, err := fn(ChannelConfig{}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ch.Type() != "stub" {
+		t.Fatalf("type=%s", ch.Type())
+	}
+}

plugins/domain/message_gateway/repository.go

@@ -10,8 +10,9 @@ import (
 
 	"gorm.io/gorm"
 
-	db "github.com/Rain-kl/Wavelet/pkg/persistence"
-	"github.com/Rain-kl/Wavelet/pkg/persistence/idgen"
+	"github.com/Rain-kl/Wavelet/pkg/idgen"
+	cachepkg "github.com/Rain-kl/Wavelet/plugins/infra/cache"
+	db "github.com/Rain-kl/Wavelet/plugins/infra/database"
 )
 
 const (
@@ -223,8 +224,8 @@ func DeletePushChannelRecord(ctx context.Context, channel *PushChannel) error {
 func GetActivePushChannelByName(ctx context.Context, name string) (*PushChannel, error) {
 	cacheKey := "push:channel:active:" + name
 	var channel PushChannel
-	if db.Redis != nil {
-		if err := db.GetJSON(ctx, cacheKey, &channel); err == nil {
+	if cachepkg.Redis != nil {
+		if err := cachepkg.GetJSON(ctx, cacheKey, &channel); err == nil {
 			return &channel, nil
 		}
 	}
@@ -233,8 +234,8 @@ func GetActivePushChannelByName(ctx context.Context, name string) (*PushChannel,
 		return nil, err
 	}
 
-	if db.Redis != nil {
-		_ = db.SetJSON(ctx, cacheKey, channel, activePushChannelCacheTTL)
+	if cachepkg.Redis != nil {
+		_ = cachepkg.SetJSON(ctx, cacheKey, channel, activePushChannelCacheTTL)
 	}
 
 	return &channel, nil
@@ -242,8 +243,8 @@ func GetActivePushChannelByName(ctx context.Context, name string) (*PushChannel,
 
 // DeleteActivePushChannelCache 清理启用消息通道的缓存。
 func DeleteActivePushChannelCache(ctx context.Context, name string) {
-	if db.Redis != nil {
-		_ = db.Redis.Del(ctx, db.PrefixedKey("push:channel:active:"+name)).Err()
+	if cachepkg.Redis != nil {
+		_ = cachepkg.Redis.Del(ctx, cachepkg.PrefixedKey("push:channel:active:"+name)).Err()
 	}
 }
 
@@ -333,8 +334,8 @@ func ListActivePushEventsByTaskTypeRecord(ctx context.Context, taskType string)
 func GetActivePushEventByKey(ctx context.Context, key string) (*PushEvent, error) {
 	cacheKey := "push:event:active:" + key
 	var event PushEvent
-	if db.Redis != nil {
-		if err := db.GetJSON(ctx, cacheKey, &event); err == nil {
+	if cachepkg.Redis != nil {
+		if err := cachepkg.GetJSON(ctx, cacheKey, &event); err == nil {
 			return &event, nil
 		}
 	}
@@ -343,8 +344,8 @@ func GetActivePushEventByKey(ctx context.Context, key string) (*PushEvent, error
 		return nil, err
 	}
 
-	if db.Redis != nil {
-		_ = db.SetJSON(ctx, cacheKey, event, activePushEventCacheTTL)
+	if cachepkg.Redis != nil {
+		_ = cachepkg.SetJSON(ctx, cacheKey, event, activePushEventCacheTTL)
 	}
 
 	return &event, nil
@@ -352,8 +353,8 @@ func GetActivePushEventByKey(ctx context.Context, key string) (*PushEvent, error
 
 // DeleteActivePushEventCache 清理启用通知事件的缓存。
 func DeleteActivePushEventCache(ctx context.Context, key string) {
-	if db.Redis != nil {
-		_ = db.Redis.Del(ctx, db.PrefixedKey("push:event:active:"+key)).Err()
+	if cachepkg.Redis != nil {
+		_ = cachepkg.Redis.Del(ctx, cachepkg.PrefixedKey("push:event:active:"+key)).Err()
 	}
 }