@openclaw/nextcloud-talk 2026.3.13 → 2026.5.2-beta.1

package/src/channel.ts

@@ -1,42 +1,34 @@
+import { describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
+import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+import { createLoggedPairingApprovalNotifier } from "openclaw/plugin-sdk/channel-pairing";
+import { createAllowlistProviderRouteAllowlistWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import {
-  buildAccountScopedDmSecurityPolicy,
-  collectAllowlistProviderGroupPolicyWarnings,
-  collectOpenGroupPolicyRouteAllowlistWarnings,
-  createAccountStatusSink,
-  formatAllowFromLowercase,
-  mapAllowFromEntries,
-} from "openclaw/plugin-sdk/compat";
+  buildWebhookChannelStatusSummary,
+  createComputedAccountStatusAdapter,
+  createDefaultChannelRuntimeState,
+} from "openclaw/plugin-sdk/status-helpers";
+import { resolveNextcloudTalkAccount, type ResolvedNextcloudTalkAccount } from "./accounts.js";
+import { nextcloudTalkApprovalAuth } from "./approval-auth.js";
+import { buildChannelConfigSchema, DEFAULT_ACCOUNT_ID, type ChannelPlugin } from "./channel-api.js";
 import {
-  applyAccountNameToChannelSection,
-  buildBaseChannelStatusSummary,
-  buildChannelConfigSchema,
-  buildRuntimeAccountStatusSnapshot,
-  clearAccountEntryFields,
-  DEFAULT_ACCOUNT_ID,
-  deleteAccountFromConfigSection,
-  normalizeAccountId,
-  setAccountEnabledInConfigSection,
-  type ChannelPlugin,
-  type OpenClawConfig,
-  type ChannelSetupInput,
-} from "openclaw/plugin-sdk/nextcloud-talk";
-import { runStoppablePassiveMonitor } from "../../shared/passive-monitor.js";
-import {
-  listNextcloudTalkAccountIds,
-  resolveDefaultNextcloudTalkAccountId,
-  resolveNextcloudTalkAccount,
-  type ResolvedNextcloudTalkAccount,
-} from "./accounts.js";
+  nextcloudTalkConfigAdapter,
+  nextcloudTalkPairingTextAdapter,
+  nextcloudTalkSecurityAdapter,
+} from "./channel.adapters.js";
 import { NextcloudTalkConfigSchema } from "./config-schema.js";
-import { monitorNextcloudTalkProvider } from "./monitor.js";
+import { nextcloudTalkDoctor } from "./doctor.js";
+import { nextcloudTalkGatewayAdapter } from "./gateway.js";
 import {
   looksLikeNextcloudTalkTargetId,
   normalizeNextcloudTalkMessagingTarget,
 } from "./normalize.js";
-import { nextcloudTalkOnboardingAdapter } from "./onboarding.js";
 import { resolveNextcloudTalkGroupToolPolicy } from "./policy.js";
 import { getNextcloudTalkRuntime } from "./runtime.js";
+import { collectRuntimeConfigAssignments, secretTargetRegistryEntries } from "./secret-contract.js";
 import { sendMessageNextcloudTalk } from "./send.js";
+import { resolveNextcloudTalkOutboundSessionRoute } from "./session-route.js";
+import { nextcloudTalkSetupAdapter } from "./setup-core.js";
+import { nextcloudTalkSetupWizard } from "./setup-surface.js";
 import type { CoreConfig } from "./types.js";
 
 const meta = {
@@ -51,372 +43,153 @@ const meta = {
   quickstartAllowFrom: true,
 };
 
-type NextcloudSetupInput = ChannelSetupInput & {
-  baseUrl?: string;
-  secret?: string;
-  secretFile?: string;
-  useEnv?: boolean;
-};
-
-export const nextcloudTalkPlugin: ChannelPlugin<ResolvedNextcloudTalkAccount> = {
-  id: "nextcloud-talk",
-  meta,
-  onboarding: nextcloudTalkOnboardingAdapter,
-  pairing: {
-    idLabel: "nextcloudUserId",
-    normalizeAllowEntry: (entry) =>
-      entry.replace(/^(nextcloud-talk|nc-talk|nc):/i, "").toLowerCase(),
-    notifyApproval: async ({ id }) => {
-      console.log(`[nextcloud-talk] User ${id} approved for pairing`);
+const collectNextcloudTalkSecurityWarnings =
+  createAllowlistProviderRouteAllowlistWarningCollector<ResolvedNextcloudTalkAccount>({
+    providerConfigPresent: (cfg) =>
+      (cfg.channels as Record<string, unknown> | undefined)?.["nextcloud-talk"] !== undefined,
+    resolveGroupPolicy: (account) => account.config.groupPolicy,
+    resolveRouteAllowlistConfigured: (account) =>
+      Boolean(account.config.rooms) && Object.keys(account.config.rooms ?? {}).length > 0,
+    restrictSenders: {
+      surface: "Nextcloud Talk rooms",
+      openScope: "any member in allowed rooms",
+      groupPolicyPath: "channels.nextcloud-talk.groupPolicy",
+      groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom",
     },
-  },
-  capabilities: {
-    chatTypes: ["direct", "group"],
-    reactions: true,
-    threads: false,
-    media: true,
-    nativeCommands: false,
-    blockStreaming: true,
-  },
-  reload: { configPrefixes: ["channels.nextcloud-talk"] },
-  configSchema: buildChannelConfigSchema(NextcloudTalkConfigSchema),
-  config: {
-    listAccountIds: (cfg) => listNextcloudTalkAccountIds(cfg as CoreConfig),
-    resolveAccount: (cfg, accountId) =>
-      resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId }),
-    defaultAccountId: (cfg) => resolveDefaultNextcloudTalkAccountId(cfg as CoreConfig),
-    setAccountEnabled: ({ cfg, accountId, enabled }) =>
-      setAccountEnabledInConfigSection({
-        cfg,
-        sectionKey: "nextcloud-talk",
-        accountId,
-        enabled,
-        allowTopLevel: true,
-      }),
-    deleteAccount: ({ cfg, accountId }) =>
-      deleteAccountFromConfigSection({
-        cfg,
-        sectionKey: "nextcloud-talk",
-        accountId,
-        clearBaseFields: ["botSecret", "botSecretFile", "baseUrl", "name"],
-      }),
-    isConfigured: (account) => Boolean(account.secret?.trim() && account.baseUrl?.trim()),
-    describeAccount: (account) => ({
-      accountId: account.accountId,
-      name: account.name,
-      enabled: account.enabled,
-      configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
-      secretSource: account.secretSource,
-      baseUrl: account.baseUrl ? "[set]" : "[missing]",
-    }),
-    resolveAllowFrom: ({ cfg, accountId }) =>
-      mapAllowFromEntries(
-        resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId }).config.allowFrom,
-      ).map((entry) => entry.toLowerCase()),
-    formatAllowFrom: ({ allowFrom }) =>
-      formatAllowFromLowercase({
-        allowFrom,
-        stripPrefixRe: /^(nextcloud-talk|nc-talk|nc):/i,
-      }),
-  },
-  security: {
-    resolveDmPolicy: ({ cfg, accountId, account }) => {
-      return buildAccountScopedDmSecurityPolicy({
-        cfg,
-        channelKey: "nextcloud-talk",
-        accountId,
-        fallbackAccountId: account.accountId ?? DEFAULT_ACCOUNT_ID,
-        policy: account.config.dmPolicy,
-        allowFrom: account.config.allowFrom ?? [],
-        policyPathSuffix: "dmPolicy",
-        normalizeEntry: (raw) => raw.replace(/^(nextcloud-talk|nc-talk|nc):/i, "").toLowerCase(),
-      });
+    noRouteAllowlist: {
+      surface: "Nextcloud Talk rooms",
+      routeAllowlistPath: "channels.nextcloud-talk.rooms",
+      routeScope: "room",
+      groupPolicyPath: "channels.nextcloud-talk.groupPolicy",
+      groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom",
     },
-    collectWarnings: ({ account, cfg }) => {
-      const roomAllowlistConfigured =
-        account.config.rooms && Object.keys(account.config.rooms).length > 0;
-      return collectAllowlistProviderGroupPolicyWarnings({
-        cfg,
-        providerConfigPresent:
-          (cfg.channels as Record<string, unknown> | undefined)?.["nextcloud-talk"] !== undefined,
-        configuredGroupPolicy: account.config.groupPolicy,
-        collect: (groupPolicy) =>
-          collectOpenGroupPolicyRouteAllowlistWarnings({
-            groupPolicy,
-            routeAllowlistConfigured: Boolean(roomAllowlistConfigured),
-            restrictSenders: {
-              surface: "Nextcloud Talk rooms",
-              openScope: "any member in allowed rooms",
-              groupPolicyPath: "channels.nextcloud-talk.groupPolicy",
-              groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom",
-            },
-            noRouteAllowlist: {
-              surface: "Nextcloud Talk rooms",
-              routeAllowlistPath: "channels.nextcloud-talk.rooms",
-              routeScope: "room",
-              groupPolicyPath: "channels.nextcloud-talk.groupPolicy",
-              groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom",
+  });
+
+export const nextcloudTalkPlugin: ChannelPlugin<ResolvedNextcloudTalkAccount> =
+  createChatChannelPlugin({
+    base: {
+      id: "nextcloud-talk",
+      meta,
+      setupWizard: nextcloudTalkSetupWizard,
+      capabilities: {
+        chatTypes: ["direct", "group"],
+        reactions: true,
+        threads: false,
+        media: true,
+        nativeCommands: false,
+        blockStreaming: true,
+      },
+      reload: { configPrefixes: ["channels.nextcloud-talk"] },
+      configSchema: buildChannelConfigSchema(NextcloudTalkConfigSchema),
+      config: {
+        ...nextcloudTalkConfigAdapter,
+        isConfigured: (account) => Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+        describeAccount: (account) =>
+          describeWebhookAccountSnapshot({
+            account,
+            configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+            extra: {
+              secretSource: account.secretSource,
+              baseUrl: account.baseUrl ? "[set]" : "[missing]",
             },
           }),
-      });
-    },
-  },
-  groups: {
-    resolveRequireMention: ({ cfg, accountId, groupId }) => {
-      const account = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
-      const rooms = account.config.rooms;
-      if (!rooms || !groupId) {
-        return true;
-      }
+      },
+      approvalCapability: nextcloudTalkApprovalAuth,
+      doctor: nextcloudTalkDoctor,
+      groups: {
+        resolveRequireMention: ({ cfg, accountId, groupId }) => {
+          const account = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+          const rooms = account.config.rooms;
+          if (!rooms || !groupId) {
+            return true;
+          }
 
-      const roomConfig = rooms[groupId];
-      if (roomConfig?.requireMention !== undefined) {
-        return roomConfig.requireMention;
-      }
+          const roomConfig = rooms[groupId];
+          if (roomConfig?.requireMention !== undefined) {
+            return roomConfig.requireMention;
+          }
 
-      const wildcardConfig = rooms["*"];
-      if (wildcardConfig?.requireMention !== undefined) {
-        return wildcardConfig.requireMention;
-      }
+          const wildcardConfig = rooms["*"];
+          if (wildcardConfig?.requireMention !== undefined) {
+            return wildcardConfig.requireMention;
+          }
 
-      return true;
-    },
-    resolveToolPolicy: resolveNextcloudTalkGroupToolPolicy,
-  },
-  messaging: {
-    normalizeTarget: normalizeNextcloudTalkMessagingTarget,
-    targetResolver: {
-      looksLikeId: looksLikeNextcloudTalkTargetId,
-      hint: "<roomToken>",
-    },
-  },
-  setup: {
-    resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
-    applyAccountName: ({ cfg, accountId, name }) =>
-      applyAccountNameToChannelSection({
-        cfg: cfg,
-        channelKey: "nextcloud-talk",
-        accountId,
-        name,
-      }),
-    validateInput: ({ accountId, input }) => {
-      const setupInput = input as NextcloudSetupInput;
-      if (setupInput.useEnv && accountId !== DEFAULT_ACCOUNT_ID) {
-        return "NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.";
-      }
-      if (!setupInput.useEnv && !setupInput.secret && !setupInput.secretFile) {
-        return "Nextcloud Talk requires bot secret or --secret-file (or --use-env).";
-      }
-      if (!setupInput.baseUrl) {
-        return "Nextcloud Talk requires --base-url.";
-      }
-      return null;
-    },
-    applyAccountConfig: ({ cfg, accountId, input }) => {
-      const setupInput = input as NextcloudSetupInput;
-      const namedConfig = applyAccountNameToChannelSection({
-        cfg: cfg,
-        channelKey: "nextcloud-talk",
-        accountId,
-        name: setupInput.name,
-      });
-      if (accountId === DEFAULT_ACCOUNT_ID) {
-        return {
-          ...namedConfig,
-          channels: {
-            ...namedConfig.channels,
-            "nextcloud-talk": {
-              ...namedConfig.channels?.["nextcloud-talk"],
-              enabled: true,
-              baseUrl: setupInput.baseUrl,
-              ...(setupInput.useEnv
-                ? {}
-                : setupInput.secretFile
-                  ? { botSecretFile: setupInput.secretFile }
-                  : setupInput.secret
-                    ? { botSecret: setupInput.secret }
-                    : {}),
-            },
-          },
-        } as OpenClawConfig;
-      }
-      return {
-        ...namedConfig,
-        channels: {
-          ...namedConfig.channels,
-          "nextcloud-talk": {
-            ...namedConfig.channels?.["nextcloud-talk"],
-            enabled: true,
-            accounts: {
-              ...namedConfig.channels?.["nextcloud-talk"]?.accounts,
-              [accountId]: {
-                ...namedConfig.channels?.["nextcloud-talk"]?.accounts?.[accountId],
-                enabled: true,
-                baseUrl: setupInput.baseUrl,
-                ...(setupInput.secretFile
-                  ? { botSecretFile: setupInput.secretFile }
-                  : setupInput.secret
-                    ? { botSecret: setupInput.secret }
-                    : {}),
-              },
-            },
-          },
+          return true;
         },
-      } as OpenClawConfig;
-    },
-  },
-  outbound: {
-    deliveryMode: "direct",
-    chunker: (text, limit) => getNextcloudTalkRuntime().channel.text.chunkMarkdownText(text, limit),
-    chunkerMode: "markdown",
-    textChunkLimit: 4000,
-    sendText: async ({ cfg, to, text, accountId, replyToId }) => {
-      const result = await sendMessageNextcloudTalk(to, text, {
-        accountId: accountId ?? undefined,
-        replyTo: replyToId ?? undefined,
-        cfg: cfg as CoreConfig,
-      });
-      return { channel: "nextcloud-talk", ...result };
-    },
-    sendMedia: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => {
-      const messageWithMedia = mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text;
-      const result = await sendMessageNextcloudTalk(to, messageWithMedia, {
-        accountId: accountId ?? undefined,
-        replyTo: replyToId ?? undefined,
-        cfg: cfg as CoreConfig,
-      });
-      return { channel: "nextcloud-talk", ...result };
-    },
-  },
-  status: {
-    defaultRuntime: {
-      accountId: DEFAULT_ACCOUNT_ID,
-      running: false,
-      lastStartAt: null,
-      lastStopAt: null,
-      lastError: null,
+        resolveToolPolicy: resolveNextcloudTalkGroupToolPolicy,
+      },
+      messaging: {
+        targetPrefixes: ["nextcloud-talk", "nc-talk", "nc"],
+        normalizeTarget: normalizeNextcloudTalkMessagingTarget,
+        resolveOutboundSessionRoute: (params) => resolveNextcloudTalkOutboundSessionRoute(params),
+        targetResolver: {
+          looksLikeId: looksLikeNextcloudTalkTargetId,
+          hint: "<roomToken>",
+        },
+      },
+      secrets: {
+        secretTargetRegistryEntries,
+        collectRuntimeConfigAssignments,
+      },
+      setup: nextcloudTalkSetupAdapter,
+      status: createComputedAccountStatusAdapter<ResolvedNextcloudTalkAccount>({
+        defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID),
+        buildChannelSummary: ({ snapshot }) =>
+          buildWebhookChannelStatusSummary(snapshot, {
+            secretSource: snapshot.secretSource ?? "none",
+          }),
+        resolveAccountSnapshot: ({ account }) => ({
+          accountId: account.accountId,
+          name: account.name,
+          enabled: account.enabled,
+          configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+          extra: {
+            secretSource: account.secretSource,
+            baseUrl: account.baseUrl ? "[set]" : "[missing]",
+            mode: "webhook",
+          },
+        }),
+      }),
+      gateway: nextcloudTalkGatewayAdapter,
     },
-    buildChannelSummary: ({ snapshot }) => {
-      const base = buildBaseChannelStatusSummary(snapshot);
-      return {
-        configured: base.configured,
-        secretSource: snapshot.secretSource ?? "none",
-        running: base.running,
-        mode: "webhook",
-        lastStartAt: base.lastStartAt,
-        lastStopAt: base.lastStopAt,
-        lastError: base.lastError,
-      };
+    pairing: {
+      text: {
+        ...nextcloudTalkPairingTextAdapter,
+        notify: createLoggedPairingApprovalNotifier(
+          ({ id }) => `[nextcloud-talk] User ${id} approved for pairing`,
+        ),
+      },
     },
-    buildAccountSnapshot: ({ account, runtime }) => {
-      const configured = Boolean(account.secret?.trim() && account.baseUrl?.trim());
-      const runtimeSnapshot = buildRuntimeAccountStatusSnapshot({ runtime });
-      return {
-        accountId: account.accountId,
-        name: account.name,
-        enabled: account.enabled,
-        configured,
-        secretSource: account.secretSource,
-        baseUrl: account.baseUrl ? "[set]" : "[missing]",
-        running: runtimeSnapshot.running,
-        lastStartAt: runtimeSnapshot.lastStartAt,
-        lastStopAt: runtimeSnapshot.lastStopAt,
-        lastError: runtimeSnapshot.lastError,
-        mode: "webhook",
-        lastInboundAt: runtime?.lastInboundAt ?? null,
-        lastOutboundAt: runtime?.lastOutboundAt ?? null,
-      };
+    security: {
+      ...nextcloudTalkSecurityAdapter,
+      collectWarnings: collectNextcloudTalkSecurityWarnings,
     },
-  },
-  gateway: {
-    startAccount: async (ctx) => {
-      const account = ctx.account;
-      if (!account.secret || !account.baseUrl) {
-        throw new Error(
-          `Nextcloud Talk not configured for account "${account.accountId}" (missing secret or baseUrl)`,
-        );
-      }
-
-      ctx.log?.info(`[${account.accountId}] starting Nextcloud Talk webhook server`);
-
-      const statusSink = createAccountStatusSink({
-        accountId: ctx.accountId,
-        setStatus: ctx.setStatus,
-      });
-
-      await runStoppablePassiveMonitor({
-        abortSignal: ctx.abortSignal,
-        start: async () =>
-          await monitorNextcloudTalkProvider({
-            accountId: account.accountId,
-            config: ctx.cfg as CoreConfig,
-            runtime: ctx.runtime,
-            abortSignal: ctx.abortSignal,
-            statusSink,
+    outbound: {
+      base: {
+        deliveryMode: "direct",
+        chunker: (text, limit) =>
+          getNextcloudTalkRuntime().channel.text.chunkMarkdownText(text, limit),
+        chunkerMode: "markdown",
+        textChunkLimit: 4000,
+      },
+      attachedResults: {
+        channel: "nextcloud-talk",
+        sendText: async ({ cfg, to, text, accountId, replyToId }) =>
+          await sendMessageNextcloudTalk(to, text, {
+            accountId: accountId ?? undefined,
+            replyTo: replyToId ?? undefined,
+            cfg: cfg as CoreConfig,
           }),
-      });
-    },
-    logoutAccount: async ({ accountId, cfg }) => {
-      const nextCfg = { ...cfg } as OpenClawConfig;
-      const nextSection = cfg.channels?.["nextcloud-talk"]
-        ? { ...cfg.channels["nextcloud-talk"] }
-        : undefined;
-      let cleared = false;
-      let changed = false;
-
-      if (nextSection) {
-        if (accountId === DEFAULT_ACCOUNT_ID && nextSection.botSecret) {
-          delete nextSection.botSecret;
-          cleared = true;
-          changed = true;
-        }
-        const accountCleanup = clearAccountEntryFields({
-          accounts: nextSection.accounts,
-          accountId,
-          fields: ["botSecret"],
-        });
-        if (accountCleanup.changed) {
-          changed = true;
-          if (accountCleanup.cleared) {
-            cleared = true;
-          }
-          if (accountCleanup.nextAccounts) {
-            nextSection.accounts = accountCleanup.nextAccounts;
-          } else {
-            delete nextSection.accounts;
-          }
-        }
-      }
-
-      if (changed) {
-        if (nextSection && Object.keys(nextSection).length > 0) {
-          nextCfg.channels = { ...nextCfg.channels, "nextcloud-talk": nextSection };
-        } else {
-          const nextChannels = { ...nextCfg.channels } as Record<string, unknown>;
-          delete nextChannels["nextcloud-talk"];
-          if (Object.keys(nextChannels).length > 0) {
-            nextCfg.channels = nextChannels as OpenClawConfig["channels"];
-          } else {
-            delete nextCfg.channels;
-          }
-        }
-      }
-
-      const resolved = resolveNextcloudTalkAccount({
-        cfg: changed ? (nextCfg as CoreConfig) : (cfg as CoreConfig),
-        accountId,
-      });
-      const loggedOut = resolved.secretSource === "none";
-
-      if (changed) {
-        await getNextcloudTalkRuntime().config.writeConfigFile(nextCfg);
-      }
-
-      return {
-        cleared,
-        envSecret: Boolean(process.env.NEXTCLOUD_TALK_BOT_SECRET?.trim()),
-        loggedOut,
-      };
+        sendMedia: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) =>
+          await sendMessageNextcloudTalk(
+            to,
+            mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text,
+            {
+              accountId: accountId ?? undefined,
+              replyTo: replyToId ?? undefined,
+              cfg: cfg as CoreConfig,
+            },
+          ),
+      },
     },
-  },
-};
+  });

package/src/config-schema.ts

@@ -1,18 +1,16 @@
 import {
-  BlockStreamingCoalesceSchema,
-  DmConfigSchema,
   DmPolicySchema,
   GroupPolicySchema,
   MarkdownConfigSchema,
   ReplyRuntimeConfigSchemaShape,
   ToolPolicySchema,
   requireOpenAllowFrom,
-} from "openclaw/plugin-sdk/nextcloud-talk";
-import { z } from "zod";
-import { requireChannelOpenAllowFrom } from "../../shared/config-schema-helpers.js";
+} from "openclaw/plugin-sdk/channel-config-schema";
+import { requireChannelOpenAllowFrom } from "openclaw/plugin-sdk/extension-shared";
+import { z } from "openclaw/plugin-sdk/zod";
 import { buildSecretInputSchema } from "./secret-input.js";
 
-export const NextcloudTalkRoomSchema = z
+const NextcloudTalkRoomSchema = z
   .object({
     requireMention: z.boolean().optional(),
     tools: ToolPolicySchema,
@@ -23,7 +21,15 @@ export const NextcloudTalkRoomSchema = z
   })
   .strict();
 
-export const NextcloudTalkAccountSchemaBase = z
+const NextcloudTalkNetworkSchema = z
+  .object({
+    /** Dangerous opt-in for self-hosted Nextcloud Talk on trusted private/internal hosts. */
+    dangerouslyAllowPrivateNetwork: z.boolean().optional(),
+  })
+  .strict()
+  .optional();
+
+const NextcloudTalkAccountSchemaBase = z
   .object({
     name: z.string().optional(),
     enabled: z.boolean().optional(),
@@ -43,21 +49,21 @@ export const NextcloudTalkAccountSchemaBase = z
     groupAllowFrom: z.array(z.string()).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     rooms: z.record(z.string(), NextcloudTalkRoomSchema.optional()).optional(),
+    /** Network policy overrides for self-hosted Nextcloud Talk on trusted private/internal hosts. */
+    network: NextcloudTalkNetworkSchema,
     ...ReplyRuntimeConfigSchemaShape,
   })
   .strict();
 
-export const NextcloudTalkAccountSchema = NextcloudTalkAccountSchemaBase.superRefine(
-  (value, ctx) => {
-    requireChannelOpenAllowFrom({
-      channel: "nextcloud-talk",
-      policy: value.dmPolicy,
-      allowFrom: value.allowFrom,
-      ctx,
-      requireOpenAllowFrom,
-    });
-  },
-);
+const NextcloudTalkAccountSchema = NextcloudTalkAccountSchemaBase.superRefine((value, ctx) => {
+  requireChannelOpenAllowFrom({
+    channel: "nextcloud-talk",
+    policy: value.dmPolicy,
+    allowFrom: value.allowFrom,
+    ctx,
+    requireOpenAllowFrom,
+  });
+});
 
 export const NextcloudTalkConfigSchema = NextcloudTalkAccountSchemaBase.extend({
   accounts: z.record(z.string(), NextcloudTalkAccountSchema.optional()).optional(),