@openclaw/nextcloud-talk 2026.7.2-beta.5 → 2026.7.33

package/dist/{channel-D6MTjGj3.js → .setup/channel-DzVvFd6m.mjs}

@@ -1,82 +1,49 @@
-import { a as fetchWithSsrFGuard, c as resolveDefaultGroupPolicy, i as deliverFormattedTextWithAttachments, l as warnMissingProviderGroupPolicyFallbackOnce, o as logInboundDrop, r as createChannelPairingController, s as resolveAllowlistProviderRuntimeGroupPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as getNextcloudTalkRuntime } from "./runtime-api-BKsxTw4J.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-fNhK1wag.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DGgvfVqm.js";
-import { createAccountListHelpers, describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
+import { a as fetchWithSsrFGuard, c as resolveDefaultGroupPolicy, i as deliverFormattedTextWithAttachments, l as warnMissingProviderGroupPolicyFallbackOnce, o as logInboundDrop, r as createChannelPairingController, s as resolveAllowlistProviderRuntimeGroupPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as getNextcloudTalkRuntime } from "./runtime-api-BKsxTw4J.mjs";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BY7I5-v9.mjs";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-CsCJ-vOP.mjs";
+import { describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createLoggedPairingApprovalNotifier, createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
-import { createAllowlistProviderRouteAllowlistWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
+import { createAllowlistProviderRouteAllowlistWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { buildWebhookChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
-import { FormatCapabilityProfile, convertMarkdownTables, renderMarkdownWithMarkers, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
-import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { DEFAULT_ACCOUNT_ID, hasConfiguredAccountValue, normalizeAccountId, resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-core";
+import { convertMarkdownTables, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
+import { DEFAULT_ACCOUNT_ID, createAccountListHelpers, hasConfiguredAccountValue, normalizeAccountId, resolveAccountWithDefaultFallback, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-core";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
-import { buildChannelInboundEventContext, resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
-import { bindIngressLifecycleToReplyOptions, createAccountStatusSink, createChannelIngressMonitor, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveChannelStreamingBlockEnabled, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
+import { createAccountStatusSink, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { readFileSync } from "node:fs";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
-import { createHmac, randomBytes } from "node:crypto";
-import { fileExists, safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { clearAccountEntryFields } from "openclaw/plugin-sdk/channel-plugin-common";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-id";
-import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
-import { formatAllowFromLowercase, resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
+import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, ToolPolicySchema, buildChannelConfigSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
+import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
-import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime } from "openclaw/plugin-sdk/extension-shared";
+import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime, runStoppablePassiveMonitor, safeParseJsonWithSchema } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
+import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { migratePersistentDedupeLegacyJsonFile, resolvePersistentDedupePluginStateNamespace } from "openclaw/plugin-sdk/persistent-dedupe";
+import { createClaimableDedupe, migratePersistentDedupeLegacyJsonFile } from "openclaw/plugin-sdk/persistent-dedupe";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
-import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback } from "openclaw/plugin-sdk/channel-targets";
+import { resolveInboundRouteEnvelopeBuilderWithRuntime } from "openclaw/plugin-sdk/inbound-envelope";
+import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, resolveNestedAllowlistDecision } from "openclaw/plugin-sdk/channel-targets";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createServer } from "node:http";
 import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
-import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
-import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
-import { applyAccountNameToChannelSection, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
+import { applyAccountNameToChannelSection, createSetupTranslator, createStandardChannelSetupStatus, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 import { createSetupInputPresenceValidator, createSetupTranslator as createSetupTranslator$1, mergeAllowFromEntries, promptParsedAllowFromForAccount, resolveSetupAccountId } from "openclaw/plugin-sdk/setup-runtime";
 import { formatDocsLink as formatDocsLink$1 } from "openclaw/plugin-sdk/setup-tools";
-//#region extensions/nextcloud-talk/src/api-credentials.ts
-function resolveNextcloudTalkApiCredentialsResult(params) {
-	const apiUser = params.apiUser?.trim();
-	if (!apiUser) return { status: "missing" };
-	const inlinePassword = normalizeResolvedSecretInputString({
-		value: params.apiPassword,
-		path: "channels.nextcloud-talk.apiPassword"
-	});
-	if (inlinePassword) return {
-		status: "available",
-		value: {
-			apiUser,
-			apiPassword: inlinePassword
-		}
-	};
-	if (!params.apiPasswordFile?.trim()) return { status: "missing" };
-	const result = tryReadSecretFileSync(params.apiPasswordFile, "Nextcloud Talk API password", { rejectHardlinks: false }, { configPath: params.configPath ?? "channels.nextcloud-talk.apiPasswordFile" });
-	if (result.status === "available") return result.value ? {
-		status: "available",
-		value: {
-			apiUser,
-			apiPassword: result.value
-		}
-	} : { status: "missing" };
-	return result;
-}
-function resolveNextcloudTalkApiCredentials(params) {
-	const result = resolveNextcloudTalkApiCredentialsResult(params);
-	return result.status === "available" ? result.value : void 0;
-}
-//#endregion
 //#region extensions/nextcloud-talk/src/accounts.ts
 function isTruthyEnvValue(value) {
 	const normalized = normalizeLowercaseStringOrEmpty(value);
@@ -85,9 +52,8 @@ function isTruthyEnvValue(value) {
 const debugAccounts = (...args) => {
 	if (isTruthyEnvValue(process.env.OPENCLAW_DEBUG_NEXTCLOUD_TALK_ACCOUNTS)) console.warn("[nextcloud-talk:accounts]", ...args);
 };
-const { listAccountIds: listNextcloudTalkAccountIdsInternal, resolveDefaultAccountId: resolveDefaultNextcloudTalkAccountId, resolveAccountConfig: mergeNextcloudTalkAccountConfig } = createAccountListHelpers("nextcloud-talk", {
+const { listAccountIds: listNextcloudTalkAccountIdsInternal, resolveDefaultAccountId: resolveDefaultNextcloudTalkAccountId } = createAccountListHelpers("nextcloud-talk", {
 	normalizeAccountId,
-	omitKeys: ["defaultAccount"],
 	hasImplicitDefaultAccount: (cfg) => {
 		const channel = cfg.channels?.["nextcloud-talk"];
 		return Boolean(channel?.baseUrl?.trim() && (hasConfiguredAccountValue(channel.botSecret) || channel.botSecretFile?.trim() || process.env.NEXTCLOUD_TALK_BOT_SECRET?.trim()));
@@ -98,27 +64,28 @@ function listNextcloudTalkAccountIds(cfg) {
 	debugAccounts("listNextcloudTalkAccountIds", ids);
 	return ids;
 }
+function mergeNextcloudTalkAccountConfig(cfg, accountId) {
+	return resolveMergedAccountConfig({
+		channelConfig: cfg.channels?.["nextcloud-talk"],
+		accounts: cfg.channels?.["nextcloud-talk"]?.accounts,
+		accountId,
+		omitKeys: ["defaultAccount"],
+		normalizeAccountId
+	});
+}
 function resolveNextcloudTalkSecret(cfg, opts) {
 	const resolvedAccountId = opts.accountId ?? resolveDefaultNextcloudTalkAccountId(cfg);
 	const merged = mergeNextcloudTalkAccountConfig(cfg, resolvedAccountId);
 	const envSecret = normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET);
 	if (envSecret && resolvedAccountId === DEFAULT_ACCOUNT_ID) return {
 		secret: envSecret,
-		source: "env",
-		status: "available"
+		source: "env"
 	};
-	const botSecretFile = normalizeOptionalString(merged.botSecretFile);
-	if (botSecretFile) {
-		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecretFile` });
-		return result.status === "available" ? {
-			secret: result.value,
-			source: "secretFile",
-			status: "available"
-		} : {
-			secret: "",
-			source: "secretFile",
-			status: "configured_unavailable",
-			diagnostic: result.diagnostic
+	if (merged.botSecretFile) {
+		const fileSecret = tryReadSecretFileSync(merged.botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true });
+		if (fileSecret) return {
+			secret: fileSecret,
+			source: "secretFile"
 		};
 	}
 	const inlineSecret = normalizeResolvedSecretInputString({
@@ -127,13 +94,11 @@ function resolveNextcloudTalkSecret(cfg, opts) {
 	});
 	if (inlineSecret) return {
 		secret: inlineSecret,
-		source: "config",
-		status: "available"
+		source: "config"
 	};
 	return {
 		secret: "",
-		source: "none",
-		status: "missing"
+		source: "none"
 	};
 }
 function resolveNextcloudTalkAccount(params) {
@@ -144,13 +109,6 @@ function resolveNextcloudTalkAccount(params) {
 		const accountEnabled = merged.enabled !== false;
 		const enabled = baseEnabled && accountEnabled;
 		const secretResolution = resolveNextcloudTalkSecret(params.cfg, { accountId });
-		const apiCredentialResolution = resolveNextcloudTalkApiCredentialsResult({
-			apiUser: merged.apiUser,
-			apiPassword: merged.apiPassword,
-			apiPasswordFile: merged.apiPasswordFile,
-			configPath: `channels.nextcloud-talk.accounts.${accountId}.apiPasswordFile`
-		});
-		const diagnostics = [secretResolution.diagnostic, apiCredentialResolution.status === "configured_unavailable" ? apiCredentialResolution.diagnostic : void 0].filter((diagnostic) => Boolean(diagnostic));
 		const baseUrl = merged.baseUrl?.trim()?.replace(/\/$/, "") ?? "";
 		debugAccounts("resolve", {
 			accountId,
@@ -165,9 +123,6 @@ function resolveNextcloudTalkAccount(params) {
 			baseUrl,
 			secret: secretResolution.secret,
 			secretSource: secretResolution.source,
-			tokenStatus: secretResolution.status,
-			apiCredentialStatus: apiCredentialResolution.status,
-			...diagnostics.length > 0 ? { credentialDiagnostics: diagnostics } : {},
 			config: merged
 		};
 	};
@@ -175,7 +130,7 @@ function resolveNextcloudTalkAccount(params) {
 		accountId: resolvedAccountId,
 		normalizeAccountId,
 		resolvePrimary: resolve,
-		hasCredential: (account) => account.tokenStatus !== "missing",
+		hasCredential: (account) => account.secretSource !== "none",
 		resolveDefaultAccountId: () => resolveDefaultNextcloudTalkAccountId(params.cfg)
 	});
 }
@@ -184,21 +139,43 @@ function resolveNextcloudTalkAccount(params) {
 function normalizeNextcloudTalkApproverId(value) {
 	return normalizeOptionalLowercaseString(String(value).trim().replace(/^(nextcloud-talk|nc-talk|nc):/i, ""));
 }
-const nextcloudTalkApprovalAuth = createChannelApprovalAuth({
+const nextcloudTalkApprovalAuth = createResolvedApproverActionAuthAdapter({
 	channelLabel: "Nextcloud Talk",
-	resolveInputs: ({ cfg, accountId }) => {
-		return { allowFrom: resolveNextcloudTalkAccount({
+	resolveApprovers: ({ cfg, accountId }) => {
+		const account = resolveNextcloudTalkAccount({
 			cfg,
 			accountId
-		}).config.allowFrom };
+		});
+		return resolveApprovalApprovers({
+			allowFrom: account.config.allowFrom,
+			normalizeApprover: normalizeNextcloudTalkApproverId
+		});
 	},
-	normalizeApprover: normalizeNextcloudTalkApproverId
-}).approvalAuth;
+	normalizeSenderId: (value) => normalizeNextcloudTalkApproverId(value)
+});
 //#endregion
-//#region extensions/nextcloud-talk/src/guarded-response.ts
-async function releaseNextcloudTalkGuardedResponse(params) {
-	if (!params.response.bodyUsed) await params.response.body?.cancel().catch(() => void 0);
-	await params.release();
+//#region extensions/nextcloud-talk/src/api-credentials.ts
+function resolveNextcloudTalkApiCredentials(params) {
+	const apiUser = params.apiUser?.trim();
+	if (!apiUser) return;
+	const inlinePassword = normalizeResolvedSecretInputString({
+		value: params.apiPassword,
+		path: "channels.nextcloud-talk.apiPassword"
+	});
+	if (inlinePassword) return {
+		apiUser,
+		apiPassword: inlinePassword
+	};
+	if (!params.apiPasswordFile) return;
+	try {
+		const filePassword = readFileSync(params.apiPasswordFile, "utf-8").trim();
+		return filePassword ? {
+			apiUser,
+			apiPassword: filePassword
+		} : void 0;
+	} catch {
+		return;
+	}
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/signature.ts
@@ -212,7 +189,16 @@ const BACKEND_HEADER = "x-nextcloud-talk-backend";
 function verifyNextcloudTalkSignature(params) {
 	const { signature, random, body, secret } = params;
 	if (!signature || !random || !secret) return false;
-	return safeEqualSecret(signature, createHmac("sha256", secret).update(random + body).digest("hex"));
+	const expected = createHmac("sha256", secret).update(random + body).digest("hex");
+	const expectedBuf = Buffer.from(expected, "utf8");
+	const signatureBuf = Buffer.from(signature, "utf8");
+	const maxLen = Math.max(expectedBuf.length, signatureBuf.length);
+	const paddedExpected = Buffer.alloc(maxLen);
+	const paddedSignature = Buffer.alloc(maxLen);
+	expectedBuf.copy(paddedExpected);
+	signatureBuf.copy(paddedSignature);
+	const timingResult = timingSafeEqual(paddedExpected, paddedSignature);
+	return expectedBuf.length === signatureBuf.length && timingResult;
 }
 /**
 * Extract webhook headers from an incoming request.
@@ -246,7 +232,7 @@ function generateNextcloudTalkSignature(params) {
 //#endregion
 //#region extensions/nextcloud-talk/src/bot-preflight.ts
 const BOT_FEATURE_RESPONSE = 2;
-const BOT_PREFLIGHT_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+const BOT_PREFLIGHT_ERROR_BODY_LIMIT_BYTES = 8192;
 function normalizeUrlForMatch(value) {
 	if (!value?.trim()) return "";
 	try {
@@ -344,10 +330,7 @@ async function probeNextcloudTalkBotResponseFeature(params) {
 				message: `Nextcloud Talk bot "${bot.name ?? bot.id ?? "matching bot"}" has the response feature.`
 			};
 		} finally {
-			await releaseNextcloudTalkGuardedResponse({
-				response,
-				release
-			});
+			await release();
 		}
 	} catch (error) {
 		return {
@@ -390,11 +373,18 @@ const nextcloudTalkPairingTextAdapter = {
 };
 //#endregion
 //#region extensions/nextcloud-talk/src/config-schema.ts
-const NextcloudTalkRoomSchema = buildGroupEntrySchema({ allowFrom: z.array(z.string()).optional() }).omit({ toolsBySender: true });
+const NextcloudTalkRoomSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	skills: z.array(z.string()).optional(),
+	enabled: z.boolean().optional(),
+	allowFrom: z.array(z.string()).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
 const NextcloudTalkNetworkSchema = z.object({ 
 /** Dangerous opt-in for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 dangerouslyAllowPrivateNetwork: z.boolean().optional() }).strict().optional();
-const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
+const NextcloudTalkAccountSchemaBase = z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	markdown: MarkdownConfigSchema,
@@ -416,31 +406,114 @@ const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
 	/** Network policy overrides for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 	network: NextcloudTalkNetworkSchema,
 	...ReplyRuntimeConfigSchemaShape
-}).strict(), {
-	optionalAccount: true,
-	refine: (value, ctx) => {
-		requireChannelOpenAllowFrom({
-			channel: "nextcloud-talk",
-			policy: value.dmPolicy,
-			allowFrom: value.allowFrom,
-			ctx,
-			requireOpenAllowFrom
-		});
-	}
+}).strict();
+const NextcloudTalkAccountSchema = NextcloudTalkAccountSchemaBase.superRefine((value, ctx) => {
+	requireChannelOpenAllowFrom({
+		channel: "nextcloud-talk",
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		requireOpenAllowFrom
+	});
+});
+const NextcloudTalkConfigSchema = NextcloudTalkAccountSchemaBase.extend({
+	accounts: z.record(z.string(), NextcloudTalkAccountSchema.optional()).optional(),
+	defaultAccount: z.string().optional()
+}).superRefine((value, ctx) => {
+	requireChannelOpenAllowFrom({
+		channel: "nextcloud-talk",
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		requireOpenAllowFrom
+	});
 });
 //#endregion
-//#region extensions/nextcloud-talk/src/replay-migration-contract.ts
+//#region extensions/nextcloud-talk/src/replay-guard.ts
 const NEXTCLOUD_TALK_PLUGIN_ID = "nextcloud-talk";
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX = "replay-dedupe";
-const NEXTCLOUD_TALK_REPLAY_DEDUPE_TTL_MS = 1440 * 60 * 1e3;
-const NEXTCLOUD_TALK_REPLAY_DEDUPE_MAX_ENTRIES = 1e4;
+const DEFAULT_REPLAY_TTL_MS = 864e5;
+const DEFAULT_MEMORY_MAX_SIZE = 1e3;
+const DEFAULT_STATE_MAX_ENTRIES = 1e4;
+function buildReplayKey(params) {
+	const roomToken = params.roomToken.trim();
+	const messageId = params.messageId.trim();
+	if (!roomToken || !messageId) return null;
+	return `${roomToken}:${messageId}`;
+}
+function createNextcloudTalkReplayGuard(options) {
+	const stateDir = options.stateDir?.trim();
+	const baseOptions = {
+		ttlMs: options.ttlMs ?? DEFAULT_REPLAY_TTL_MS,
+		memoryMaxSize: options.memoryMaxSize ?? DEFAULT_MEMORY_MAX_SIZE
+	};
+	const dedupe = createClaimableDedupe(stateDir ? {
+		...baseOptions,
+		pluginId: NEXTCLOUD_TALK_PLUGIN_ID,
+		namespacePrefix: NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX,
+		stateMaxEntries: options.stateMaxEntries ?? options.fileMaxEntries ?? DEFAULT_STATE_MAX_ENTRIES,
+		env: {
+			...process.env,
+			OPENCLAW_STATE_DIR: stateDir
+		},
+		onDiskError: options.onDiskError
+	} : baseOptions);
+	return {
+		claimMessage: async ({ accountId, roomToken, messageId }) => {
+			const replayKey = buildReplayKey({
+				roomToken,
+				messageId
+			});
+			if (!replayKey) return "invalid";
+			return (await dedupe.claim(replayKey, { namespace: accountId })).kind;
+		},
+		commitMessage: async ({ accountId, roomToken, messageId }) => {
+			const replayKey = buildReplayKey({
+				roomToken,
+				messageId
+			});
+			if (!replayKey) return true;
+			return await dedupe.commit(replayKey, { namespace: accountId });
+		},
+		releaseMessage: ({ accountId, roomToken, messageId, error }) => {
+			const replayKey = buildReplayKey({
+				roomToken,
+				messageId
+			});
+			if (!replayKey) return;
+			dedupe.release(replayKey, {
+				namespace: accountId,
+				error
+			});
+		},
+		shouldProcessMessage: async ({ accountId, roomToken, messageId }) => {
+			const replayKey = buildReplayKey({
+				roomToken,
+				messageId
+			});
+			if (!replayKey) return true;
+			if ((await dedupe.claim(replayKey, { namespace: accountId })).kind !== "claimed") return false;
+			return await dedupe.commit(replayKey, { namespace: accountId });
+		}
+	};
+}
 //#endregion
 //#region extensions/nextcloud-talk/src/doctor.ts
+const REPLAY_DEDUPE_TTL_MS = 864e5;
+const REPLAY_DEDUPE_MAX_ENTRIES = 1e4;
 function sanitizeLegacyReplaySegment(value) {
 	const trimmed = value.trim();
 	if (!trimmed) return "default";
 	return trimmed.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
+async function fileExists(filePath) {
+	try {
+		await fs.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
 async function collectNextcloudTalkBotResponseWarnings(params) {
 	const warnings = [];
 	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
@@ -465,16 +538,16 @@ async function repairNextcloudTalkReplayDedupeState(params) {
 	const replayDir = path.join(stateDir, "nextcloud-talk", "replay-dedupe");
 	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
 		const legacyPath = path.join(replayDir, `${sanitizeLegacyReplaySegment(accountId)}.json`);
-		if (!fileExists(legacyPath)) continue;
+		if (!await fileExists(legacyPath)) continue;
 		try {
 			const result = await migratePersistentDedupeLegacyJsonFile({
 				filePath: legacyPath,
 				namespace: accountId,
-				ttlMs: NEXTCLOUD_TALK_REPLAY_DEDUPE_TTL_MS,
+				ttlMs: REPLAY_DEDUPE_TTL_MS,
 				memoryMaxSize: 0,
 				pluginId: NEXTCLOUD_TALK_PLUGIN_ID,
 				namespacePrefix: NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX,
-				stateMaxEntries: NEXTCLOUD_TALK_REPLAY_DEDUPE_MAX_ENTRIES,
+				stateMaxEntries: REPLAY_DEDUPE_MAX_ENTRIES,
 				env
 			});
 			changes.push(`Migrated Nextcloud Talk replay dedupe cache for account "${accountId}" to SQLite (${result.imported} imported, ${result.skippedExpired} expired, ${result.skippedExisting} already current).`);
@@ -512,25 +585,38 @@ function normalizeNextcloudTalkAllowlist(values) {
 	return (values ?? []).map((value) => normalizeNextcloudTalkAllowEntry(String(value))).filter(Boolean);
 }
 function resolveNextcloudTalkAllowlistMatch(params) {
-	return resolveAllowlistMatchByCandidates({
-		allowList: normalizeNextcloudTalkAllowlist(params.allowFrom),
-		candidates: [{
-			value: normalizeNextcloudTalkAllowEntry(params.senderId),
-			source: "id"
-		}]
-	});
+	const allowFrom = normalizeNextcloudTalkAllowlist(params.allowFrom);
+	if (allowFrom.length === 0) return { allowed: false };
+	if (allowFrom.includes("*")) return {
+		allowed: true,
+		matchKey: "*",
+		matchSource: "wildcard"
+	};
+	const senderId = normalizeNextcloudTalkAllowEntry(params.senderId);
+	if (allowFrom.includes(senderId)) return {
+		allowed: true,
+		matchKey: senderId,
+		matchSource: "id"
+	};
+	return { allowed: false };
 }
 function resolveNextcloudTalkRoomMatch(params) {
 	const rooms = params.rooms ?? {};
 	const allowlistConfigured = Object.keys(rooms).length > 0;
+	const roomCandidates = buildChannelKeyCandidates(params.roomToken);
 	const match = resolveChannelEntryMatchWithFallback({
 		entries: rooms,
-		keys: buildChannelKeyCandidates(params.roomToken),
+		keys: roomCandidates,
 		wildcardKey: "*",
 		normalizeKey: normalizeChannelSlug
 	});
 	const roomConfig = match.entry;
-	const allowed = !allowlistConfigured || Boolean(roomConfig);
+	const allowed = resolveNestedAllowlistDecision({
+		outerConfigured: allowlistConfigured,
+		outerMatched: Boolean(roomConfig),
+		innerConfigured: false,
+		innerMatched: false
+	});
 	return {
 		roomConfig,
 		wildcardConfig: match.wildcardEntry,
@@ -541,50 +627,24 @@ function resolveNextcloudTalkRoomMatch(params) {
 	};
 }
 function resolveNextcloudTalkGroupToolPolicy(params) {
+	const cfg = params.cfg;
 	const roomToken = params.groupId?.trim();
 	if (!roomToken) return;
-	const { tree, toolsPath } = buildNextcloudTalkRoomScope(resolveNextcloudTalkAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).config.rooms, roomToken);
-	return resolveScopeToolsPolicy({
-		tree,
-		path: toolsPath
-	});
-}
-function buildNextcloudTalkRoomScope(rooms, roomToken) {
-	const { "*": defaults, ...scopes } = rooms ?? {};
-	const tree = {
-		defaults,
-		scopes
-	};
-	const exactPath = Object.hasOwn(scopes, roomToken) ? [roomToken] : [];
-	const toolsMatch = resolveChannelEntryMatchWithFallback({
-		entries: scopes,
-		keys: buildChannelKeyCandidates(roomToken),
-		normalizeKey: normalizeChannelSlug
+	const match = resolveNextcloudTalkRoomMatch({
+		rooms: cfg.channels?.["nextcloud-talk"]?.rooms,
+		roomToken
 	});
-	return {
-		tree,
-		exactPath,
-		toolsPath: toolsMatch.matchKey ? [toolsMatch.matchKey] : []
-	};
+	return match.roomConfig?.tools ?? match.wildcardConfig?.tools;
 }
-function resolveNextcloudTalkGroupRequireMention(params) {
-	if (!params.groupId) return true;
-	const { tree, exactPath } = buildNextcloudTalkRoomScope(resolveNextcloudTalkAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).config.rooms, params.groupId);
-	return resolveScopeRequireMention({
-		tree,
-		path: exactPath
-	});
+function resolveNextcloudTalkRequireMention(params) {
+	if (typeof params.roomConfig?.requireMention === "boolean") return params.roomConfig.requireMention;
+	if (typeof params.wildcardConfig?.requireMention === "boolean") return params.wildcardConfig.requireMention;
+	return true;
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/room-info.ts
-const ROOM_CACHE_TTL_MS = 300 * 1e3;
-const ROOM_CACHE_ERROR_TTL_MS = 30 * 1e3;
+const ROOM_CACHE_TTL_MS = 3e5;
+const ROOM_CACHE_ERROR_TTL_MS = 3e4;
 const ROOM_CACHE_MAX_ENTRIES = 1e3;
 const NEXTCLOUD_TALK_ROOM_INFO_TIMEOUT_MS = 3e4;
 const roomCache = /* @__PURE__ */ new Map();
@@ -657,10 +717,7 @@ async function resolveNextcloudTalkRoomKind(params) {
 			});
 			return kind;
 		} finally {
-			await releaseNextcloudTalkGuardedResponse({
-				response,
-				release
-			});
+			await release();
 		}
 	} catch (err) {
 		cacheRoomInfo(key, {
@@ -677,10 +734,10 @@ function stripNextcloudTalkTargetPrefix(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return;
 	let normalized = trimmed;
-	if (/^nextcloud-talk:/i.test(normalized)) normalized = normalized.slice(15).trim();
-	else if (/^nc-talk:/i.test(normalized)) normalized = normalized.slice(8).trim();
-	else if (/^nc:/i.test(normalized)) normalized = normalized.slice(3).trim();
-	if (/^room:/i.test(normalized)) normalized = normalized.slice(5).trim();
+	if (normalized.startsWith("nextcloud-talk:")) normalized = normalized.slice(15).trim();
+	else if (normalized.startsWith("nc-talk:")) normalized = normalized.slice(8).trim();
+	else if (normalized.startsWith("nc:")) normalized = normalized.slice(3).trim();
+	if (normalized.startsWith("room:")) normalized = normalized.slice(5).trim();
 	if (!normalized) return;
 	return normalized;
 }
@@ -691,36 +748,17 @@ function normalizeNextcloudTalkMessagingTarget(raw) {
 function looksLikeNextcloudTalkTargetId(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return false;
-	if (/^(nextcloud-talk|nc-talk|nc|room):/i.test(trimmed)) return true;
+	if (/^(nextcloud-talk|nc-talk|nc):/i.test(trimmed)) return true;
 	return /^[a-z0-9]{8,}$/i.test(trimmed);
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/send.ts
-const NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_BYTES = 8 * 1024;
+const NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_BYTES = 8192;
 const NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS = 200;
-const NEXTCLOUD_TALK_SEND_TIMEOUT_MS = 3e4;
-const NEXTCLOUD_TALK_FORMAT_PROFILE = FormatCapabilityProfile.define({
-	mechanism: "markdown",
-	chunk: {
-		limit: 4e3,
-		unit: "chars",
-		hardCap: 32e3
-	}
-});
-function renderNextcloudTalkMarkdown(markdown) {
-	return renderMarkdownWithMarkers({
-		text: markdown,
-		styles: [],
-		links: []
-	}, {
-		styleMarkers: {},
-		escapeText: (text) => text
-	}, NEXTCLOUD_TALK_FORMAT_PROFILE);
-}
 /** Collapses whitespace and caps an error-body prefix to a short, log-safe snippet. */
 function collapseErrorSnippet(text) {
 	const collapsed = text.replace(/\s+/g, " ").trim();
-	if (collapsed.length > NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS) return `${truncateUtf16Safe(collapsed, NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS)}…`;
+	if (collapsed.length > NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS) return `${collapsed.slice(0, NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS)}…`;
 	return collapsed;
 }
 /** Reads a bounded, collapsed error-body snippet without buffering hostile responses. */
@@ -795,7 +833,7 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 		channel: "nextcloud-talk",
 		accountId: account.accountId
 	});
-	const message = convertMarkdownTables(renderNextcloudTalkMarkdown(text.trim()), tableMode);
+	const message = convertMarkdownTables(text.trim(), tableMode);
 	const body = { message };
 	if (opts.replyTo) body.replyTo = opts.replyTo;
 	const bodyStr = JSON.stringify(body);
@@ -803,8 +841,9 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 		body: message,
 		secret
 	});
+	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${roomToken}/message`;
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${roomToken}/message`,
+		url,
 		init: {
 			method: "POST",
 			headers: {
@@ -816,8 +855,7 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 			body: bodyStr
 		},
 		auditContext: "nextcloud-talk-send",
-		policy: ssrfPolicyFromPrivateNetworkOptIn$1(account.config),
-		timeoutMs: opts.timeoutMs ?? NEXTCLOUD_TALK_SEND_TIMEOUT_MS
+		policy: ssrfPolicyFromPrivateNetworkOptIn$1(account.config)
 	});
 	try {
 		if (!response.ok) {
@@ -851,10 +889,7 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 			timestamp
 		};
 	} finally {
-		await releaseNextcloudTalkGuardedResponse({
-			response,
-			release
-		});
+		await release();
 	}
 }
 async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
@@ -865,8 +900,9 @@ async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
 		body: reaction,
 		secret
 	});
+	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${normalizedToken}/reaction/${messageId}`;
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${normalizedToken}/reaction/${messageId}`,
+		url,
 		init: {
 			method: "POST",
 			headers: {
@@ -878,8 +914,7 @@ async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
 			body
 		},
 		auditContext: "nextcloud-talk-reaction",
-		policy: ssrfPolicyFromPrivateNetworkOptIn$1(account.config),
-		timeoutMs: opts.timeoutMs ?? NEXTCLOUD_TALK_SEND_TIMEOUT_MS
+		policy: ssrfPolicyFromPrivateNetworkOptIn$1(account.config)
 	});
 	try {
 		if (!response.ok) {
@@ -888,10 +923,7 @@ async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
 		}
 		return { ok: true };
 	} finally {
-		await releaseNextcloudTalkGuardedResponse({
-			response,
-			release
-		});
+		await release();
 	}
 }
 //#endregion
@@ -976,10 +1008,9 @@ async function handleNextcloudTalkInbound(params) {
 		surface: CHANNEL_ID
 	});
 	const hasControlCommand = core.channel.text.hasControlCommand(rawBody, config);
-	const shouldRequireMention = isGroup ? resolveNextcloudTalkGroupRequireMention({
-		cfg: config,
-		accountId: account.accountId,
-		groupId: roomToken
+	const shouldRequireMention = isGroup ? resolveNextcloudTalkRequireMention({
+		roomConfig,
+		wildcardConfig: roomMatch.wildcardConfig
 	}) : false;
 	const { groupPolicy, providerMissingFallbackApplied } = resolveAllowlistProviderRuntimeGroupPolicy({
 		providerConfigPresent: (config.channels?.[CHANNEL_ID] ?? void 0) !== void 0,
@@ -1097,76 +1128,59 @@ async function handleNextcloudTalkInbound(params) {
 		runtime.log?.(`nextcloud-talk: drop room ${roomToken} (no mention)`);
 		return;
 	}
-	const { route, buildEnvelope } = resolveChannelInboundRouteEnvelope({
+	const { route, buildEnvelope } = resolveInboundRouteEnvelopeBuilderWithRuntime({
 		cfg: config,
 		channel: CHANNEL_ID,
 		accountId: account.accountId,
 		peer: {
 			kind: isGroup ? "group" : "direct",
 			id: isGroup ? roomToken : senderId
-		}
+		},
+		runtime: core.channel,
+		sessionStore: config.session?.store
 	});
 	const fromLabel = isGroup ? `room:${roomName || roomToken}` : senderName || `user:${senderId}`;
-	const body = buildEnvelope({
+	const { storePath, body } = buildEnvelope({
 		channel: "Nextcloud Talk",
 		from: fromLabel,
 		timestamp: message.timestamp,
 		body: rawBody
 	});
 	const groupSystemPrompt = normalizeOptionalString(roomConfig?.systemPrompt);
-	const blockStreamingEnabled = resolveChannelStreamingBlockEnabled(account.config);
-	const ctxPayload = buildChannelInboundEventContext({
-		channel: CHANNEL_ID,
-		accountId: route.accountId,
-		messageId: message.messageId,
-		timestamp: message.timestamp,
-		from: isGroup ? `nextcloud-talk:room:${roomToken}` : `nextcloud-talk:${senderId}`,
-		sender: {
-			id: senderId,
-			name: senderName || void 0
-		},
-		conversation: {
-			kind: isGroup ? "group" : "direct",
-			id: roomToken,
-			label: fromLabel
-		},
-		route: {
-			agentId: route.agentId,
-			dmScope: route.dmScope,
-			accountId: route.accountId,
-			routeSessionKey: route.sessionKey
-		},
-		reply: {
-			to: `nextcloud-talk:${roomToken}`,
-			originatingTo: `nextcloud-talk:${roomToken}`
-		},
-		message: {
-			body,
-			bodyForAgent: rawBody,
-			rawBody,
-			commandBody: rawBody
-		},
-		access: {
-			commands: { authorized: commandAuthorized },
-			mentions: {
-				canDetectMention: isGroup,
-				wasMentioned: isGroup && wasMentioned
-			}
-		},
-		extra: {
-			GroupSubject: isGroup ? roomName || roomToken : void 0,
-			GroupSystemPrompt: isGroup ? groupSystemPrompt : void 0
-		}
+	const ctxPayload = core.channel.reply.finalizeInboundContext({
+		Body: body,
+		BodyForAgent: rawBody,
+		RawBody: rawBody,
+		CommandBody: rawBody,
+		From: isGroup ? `nextcloud-talk:room:${roomToken}` : `nextcloud-talk:${senderId}`,
+		To: `nextcloud-talk:${roomToken}`,
+		SessionKey: route.sessionKey,
+		AccountId: route.accountId,
+		ChatType: isGroup ? "group" : "direct",
+		ConversationLabel: fromLabel,
+		SenderName: senderName || void 0,
+		SenderId: senderId,
+		GroupSubject: isGroup ? roomName || roomToken : void 0,
+		GroupSystemPrompt: isGroup ? groupSystemPrompt : void 0,
+		Provider: CHANNEL_ID,
+		Surface: CHANNEL_ID,
+		WasMentioned: isGroup ? wasMentioned : void 0,
+		MessageSid: message.messageId,
+		Timestamp: message.timestamp,
+		OriginatingChannel: CHANNEL_ID,
+		OriginatingTo: `nextcloud-talk:${roomToken}`,
+		CommandAuthorized: commandAuthorized
 	});
-	await core.channel.inbound.dispatch({
+	await core.channel.inbound.dispatchReply({
 		cfg: config,
 		channel: CHANNEL_ID,
 		accountId: account.accountId,
-		route: {
-			agentId: route.agentId,
-			sessionKey: route.sessionKey
-		},
+		agentId: route.agentId,
+		routeSessionKey: route.sessionKey,
+		storePath,
 		ctxPayload,
+		recordInboundSession: core.channel.session.recordInboundSession,
+		dispatchReplyWithBufferedBlockDispatcher: core.channel.reply.dispatchReplyWithBufferedBlockDispatcher,
 		delivery: {
 			preparePayload: (payload) => payload.text === void 0 ? payload : {
 				...payload,
@@ -1187,90 +1201,49 @@ async function handleNextcloudTalkInbound(params) {
 		},
 		replyPipeline: {},
 		replyOptions: {
-			...params.turnAdoptionLifecycle ? bindIngressLifecycleToReplyOptions(params.turnAdoptionLifecycle) : {},
 			skillFilter: roomConfig?.skills,
-			disableBlockStreaming: typeof blockStreamingEnabled === "boolean" ? !blockStreamingEnabled : void 0
+			disableBlockStreaming: typeof account.config.blockStreaming === "boolean" ? !account.config.blockStreaming : void 0
 		},
 		record: { onRecordError: (err) => {
 			runtime.error?.(`nextcloud-talk: failed updating session meta: ${String(err)}`);
 		} }
 	});
 }
-var NextcloudTalkWebhookPayloadError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "NextcloudTalkWebhookPayloadError";
-	}
-};
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function parseRawObject(rawEvent) {
-	let parsed;
-	try {
-		parsed = JSON.parse(rawEvent);
-	} catch (error) {
-		throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook contains invalid JSON.", { cause: error });
-	}
-	if (!isRecord(parsed)) throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook must be a JSON object.");
-	return parsed;
-}
-function requiredString(value, field) {
-	if (typeof value === "string" && value.trim()) return value.trim();
-	throw new NextcloudTalkWebhookPayloadError(`Nextcloud Talk webhook is missing ${field}.`);
-}
-function inspectNextcloudTalkWebhookEnvelope(rawEvent) {
-	const envelope = parseRawObject(rawEvent);
-	if (envelope.type !== "Create") return null;
-	const object = isRecord(envelope.object) ? envelope.object : null;
-	if (object?.type !== void 0 && object.type !== "Note") return null;
-	if (!object) throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook is missing object.");
-	const target = isRecord(envelope.target) ? envelope.target : null;
-	return {
-		eventId: requiredString(object.id, "object.id"),
-		laneKey: `room:${requiredString(target?.id, "target.id")}`
-	};
-}
-function parseLegacyReplayKey(key) {
-	const separator = key.lastIndexOf(":");
-	const roomId = key.slice(0, separator).trim();
-	const messageId = key.slice(separator + 1).trim();
-	return separator > 0 && roomId && messageId ? {
-		messageId,
-		roomId
-	} : null;
-}
-/** Convert the shipped replay guard's live window into durable completion tombstones. */
-async function migrateNextcloudTalkLegacyReplayState(params) {
-	const entries = await params.store.entries();
-	let migrated = 0;
-	for (const entry of entries) {
-		const identity = parseLegacyReplayKey(entry.value.key);
-		if (!identity || !Number.isFinite(entry.value.seenAt)) continue;
-		const marker = {
-			version: 1,
-			receivedAt: entry.value.seenAt,
-			rawEvent: ""
-		};
-		const result = await params.queue.enqueue(identity.messageId, marker, {
-			receivedAt: entry.value.seenAt,
-			laneKey: `room:${identity.roomId}`
-		});
-		if (result.kind === "accepted" || result.kind === "pending" && result.record.payload.rawEvent === "") {
-			if (!await params.queue.complete(identity.messageId, { completedAt: entry.value.seenAt })) throw new Error(`Failed to migrate Nextcloud Talk replay key ${entry.value.key}.`);
-		}
-		migrated += 1;
-	}
-	await params.store.clear();
-	return migrated;
-}
 //#endregion
 //#region extensions/nextcloud-talk/src/monitor.ts
-const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
-const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 64 * 1024;
+const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1048576;
+const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 65536;
 const PREAUTH_WEBHOOK_BODY_TIMEOUT_MS = 5e3;
 const HEALTH_PATH = "/healthz";
 const WEBHOOK_AUTH_RATE_LIMIT_SCOPE = "nextcloud-talk-webhook-auth";
+const NextcloudTalkWebhookPayloadSchema = z.object({
+	type: z.enum([
+		"Create",
+		"Update",
+		"Delete"
+	]),
+	actor: z.object({
+		type: z.literal("Person"),
+		id: z.string().min(1),
+		name: z.string()
+	}),
+	object: z.object({
+		type: z.literal("Note"),
+		id: z.string().min(1),
+		name: z.string(),
+		content: z.string(),
+		mediaType: z.string()
+	}),
+	target: z.object({
+		type: z.literal("Collection"),
+		id: z.string().min(1),
+		name: z.string()
+	})
+});
+const NextcloudTalkWebhookEnvelopeSchema = z.object({
+	type: z.string().min(1),
+	object: z.object({ type: z.string().min(1).optional() }).passthrough().optional()
+});
 const WEBHOOK_ERRORS = {
 	missingSignatureHeaders: "Missing signature headers",
 	invalidBackend: "Invalid backend",
@@ -1279,10 +1252,48 @@ const WEBHOOK_ERRORS = {
 	payloadTooLarge: "Payload too large",
 	internalServerError: "Internal server error"
 };
+var NextcloudTalkRetryableWebhookError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "NextcloudTalkRetryableWebhookError";
+	}
+};
+async function processNextcloudTalkReplayGuardedMessage(params) {
+	if (await params.replayGuard.claimMessage({
+		accountId: params.accountId,
+		roomToken: params.message.roomToken,
+		messageId: params.message.messageId
+	}) !== "claimed") return "duplicate";
+	try {
+		await params.handleMessage();
+		await params.replayGuard.commitMessage({
+			accountId: params.accountId,
+			roomToken: params.message.roomToken,
+			messageId: params.message.messageId
+		});
+		return "processed";
+	} catch (error) {
+		if (error instanceof NextcloudTalkRetryableWebhookError) params.replayGuard.releaseMessage({
+			accountId: params.accountId,
+			roomToken: params.message.roomToken,
+			messageId: params.message.messageId,
+			error
+		});
+		else await params.replayGuard.commitMessage({
+			accountId: params.accountId,
+			roomToken: params.message.roomToken,
+			messageId: params.message.messageId
+		});
+		throw error;
+	}
+}
 function formatError(err) {
 	if (err instanceof Error) return err.message;
 	return typeof err === "string" ? err : JSON.stringify(err);
 }
+function parseWebhookPayload(body) {
+	return safeParseJsonWithSchema(NextcloudTalkWebhookPayloadSchema, body);
+}
 function writeJsonResponse(res, status, body) {
 	if (body) {
 		res.writeHead(status, { "Content-Type": "application/json" });
@@ -1322,6 +1333,37 @@ function verifyWebhookSignature(params) {
 	params.authRateLimiter.reset(params.clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
 	return true;
 }
+function decodeWebhookCreateMessage(params) {
+	const envelope = safeParseJsonWithSchema(NextcloudTalkWebhookEnvelopeSchema, params.body);
+	if (!envelope) {
+		writeWebhookError(params.res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
+		return { kind: "invalid" };
+	}
+	if (envelope.type !== "Create") return { kind: "ignore" };
+	if (envelope.object?.type && envelope.object.type !== "Note") return { kind: "ignore" };
+	const payload = parseWebhookPayload(params.body);
+	if (!payload) {
+		writeWebhookError(params.res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
+		return { kind: "invalid" };
+	}
+	return {
+		kind: "message",
+		message: payloadToInboundMessage(payload)
+	};
+}
+function payloadToInboundMessage(payload) {
+	return {
+		messageId: payload.object.id,
+		roomToken: payload.target.id,
+		roomName: payload.target.name,
+		senderId: payload.actor.id,
+		senderName: payload.actor.name ?? "",
+		text: payload.object.content || payload.object.name || "",
+		mediaType: payload.object.mediaType || "text/plain",
+		timestamp: Date.now(),
+		isGroupChat: true
+	};
+}
 function readNextcloudTalkWebhookBody(req, maxBodyBytes) {
 	return readRequestBodyWithLimit(req, {
 		maxBytes: Math.min(maxBodyBytes, PREAUTH_WEBHOOK_MAX_BODY_BYTES),
@@ -1329,10 +1371,12 @@ function readNextcloudTalkWebhookBody(req, maxBodyBytes) {
 	});
 }
 function createNextcloudTalkWebhookServer(opts) {
-	const { port, host, path, secret, onWebhook, onError, abortSignal } = opts;
+	const { port, host, path, secret, onMessage, onError, abortSignal } = opts;
 	const maxBodyBytes = typeof opts.maxBodyBytes === "number" && Number.isFinite(opts.maxBodyBytes) && opts.maxBodyBytes > 0 ? Math.floor(opts.maxBodyBytes) : DEFAULT_WEBHOOK_MAX_BODY_BYTES;
 	const readBody = opts.readBody ?? readNextcloudTalkWebhookBody;
 	const isBackendAllowed = opts.isBackendAllowed;
+	const shouldProcessMessage = opts.shouldProcessMessage;
+	const processMessage = opts.processMessage;
 	const authRateLimitMaxRequests = typeof opts.authRateLimit?.maxRequests === "number" ? opts.authRateLimit.maxRequests : WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests;
 	const authRateLimitWindowMs = typeof opts.authRateLimit?.windowMs === "number" ? opts.authRateLimit.windowMs : WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs;
 	const webhookAuthRateLimiter = createAuthRateLimiter({
@@ -1376,8 +1420,37 @@ function createNextcloudTalkWebhookServer(opts) {
 					clientIp,
 					authRateLimiter: webhookAuthRateLimiter
 				})) return;
-				await onWebhook(body);
+				const decoded = decodeWebhookCreateMessage({
+					body,
+					res
+				});
+				if (decoded.kind === "invalid") return;
+				if (decoded.kind === "ignore") {
+					writeJsonResponse(res, 200);
+					return;
+				}
+				const message = decoded.message;
+				if (processMessage) {
+					writeJsonResponse(res, 200);
+					try {
+						await processMessage(message);
+					} catch (err) {
+						onError?.(err instanceof Error ? err : new Error(formatError(err)));
+					}
+					return;
+				}
+				if (shouldProcessMessage) {
+					if (!await shouldProcessMessage(message)) {
+						writeJsonResponse(res, 200);
+						return;
+					}
+				}
 				writeJsonResponse(res, 200);
+				try {
+					await onMessage(message);
+				} catch (err) {
+					onError?.(err instanceof Error ? err : new Error(formatError(err)));
+				}
 			} catch (err) {
 				if (isRequestBodyLimitError(err, "PAYLOAD_TOO_LARGE")) {
 					writeWebhookError(res, 413, WEBHOOK_ERRORS.payloadTooLarge);
@@ -1387,48 +1460,29 @@ function createNextcloudTalkWebhookServer(opts) {
 					writeWebhookError(res, 408, requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
 					return;
 				}
-				if (err instanceof NextcloudTalkWebhookPayloadError) {
-					writeWebhookError(res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
-					return;
-				}
 				const error = err instanceof Error ? err : new Error(formatError(err));
 				onError?.(error);
 				writeWebhookError(res, 500, WEBHOOK_ERRORS.internalServerError);
 			}
 		})();
 	});
-	let stopRequested = false;
-	let closePromise;
-	const closeIfListening = () => {
-		if (closePromise) return closePromise;
-		if (!server.listening) return Promise.resolve();
-		closePromise = new Promise((resolve) => {
-			server.close(() => resolve());
-		}).finally(() => {
-			closePromise = void 0;
-		});
-		return closePromise;
-	};
-	const stop = async () => {
-		stopRequested = true;
-		await closeIfListening();
-	};
 	const start = () => {
-		if (stopRequested) return Promise.resolve();
-		return new Promise((resolve, reject) => {
-			const onListenError = (error) => reject(error);
-			server.once("error", onListenError);
-			server.listen(port, host, () => {
-				server.off("error", onListenError);
-				(async () => {
-					if (stopRequested) await closeIfListening();
-					resolve();
-				})().catch(reject);
-			});
+		return new Promise((resolve) => {
+			server.listen(port, host, () => resolve());
 		});
 	};
-	if (abortSignal) if (abortSignal.aborted) stop();
-	else abortSignal.addEventListener("abort", () => void stop(), { once: true });
+	let stopped = false;
+	const stop = () => {
+		if (stopped) return;
+		stopped = true;
+		try {
+			server.close();
+		} catch {}
+	};
+	if (abortSignal) {
+		if (abortSignal.aborted) stop();
+		else abortSignal.addEventListener("abort", stop, { once: true });
+	}
 	return {
 		server,
 		start,
@@ -1436,164 +1490,6 @@ function createNextcloudTalkWebhookServer(opts) {
 	};
 }
 //#endregion
-//#region extensions/nextcloud-talk/src/webhook-spool.ts
-const NEXTCLOUD_TALK_INGRESS_POLL_INTERVAL_MS = 500;
-const NEXTCLOUD_TALK_INGRESS_PRUNE_INTERVAL_MS = 3600 * 1e3;
-const NEXTCLOUD_TALK_INGRESS_COMPLETED_TTL_MS = 720 * 60 * 60 * 1e3;
-const NEXTCLOUD_TALK_INGRESS_COMPLETED_MAX_ENTRIES = 1e4;
-const NEXTCLOUD_TALK_INGRESS_FAILED_TTL_MS = 720 * 60 * 60 * 1e3;
-const NEXTCLOUD_TALK_INGRESS_FAILED_MAX_ENTRIES = 1e4;
-const NextcloudTalkWebhookPayloadSchema = z.object({
-	type: z.enum([
-		"Create",
-		"Update",
-		"Delete"
-	]),
-	actor: z.object({
-		type: z.literal("Person"),
-		id: z.string().min(1),
-		name: z.string()
-	}),
-	object: z.object({
-		type: z.literal("Note"),
-		id: z.string().min(1),
-		name: z.string(),
-		content: z.string(),
-		mediaType: z.string()
-	}),
-	target: z.object({
-		type: z.literal("Collection"),
-		id: z.string().min(1),
-		name: z.string()
-	})
-});
-function parseClaimedMessage(payload, claimedId, claimedLaneKey) {
-	if (payload.version !== 1) throw new NextcloudTalkWebhookPayloadError(`Nextcloud Talk ingress row ${claimedId} has an unsupported version.`);
-	const result = NextcloudTalkWebhookPayloadSchema.safeParse(parseRawObject(payload.rawEvent));
-	if (!result.success || result.data.type !== "Create" || result.data.object.id !== claimedId) throw new NextcloudTalkWebhookPayloadError(`Nextcloud Talk ingress row ${claimedId} has invalid message identity.`);
-	const webhook = result.data;
-	const roomId = requiredString(webhook.target.id, "target.id");
-	if (claimedLaneKey !== `room:${roomId}`) throw new NextcloudTalkWebhookPayloadError(`Nextcloud Talk ingress row ${claimedId} changed room identity.`);
-	return {
-		messageId: webhook.object.id,
-		roomToken: roomId,
-		roomName: webhook.target.name,
-		senderId: webhook.actor.id,
-		senderName: webhook.actor.name,
-		text: webhook.object.content || webhook.object.name,
-		mediaType: webhook.object.mediaType || "text/plain",
-		timestamp: payload.receivedAt,
-		isGroupChat: true
-	};
-}
-function resolveNonRetryableFailure(error) {
-	if (error instanceof NextcloudTalkWebhookPayloadError) return {
-		reason: "invalid-event",
-		message: error.message
-	};
-	const message = formatErrorMessage(error);
-	if (message.includes("Nextcloud Talk: bot send was rejected") || message.includes("Nextcloud Talk: forbidden")) return {
-		reason: "nextcloud-talk-auth",
-		message
-	};
-	return null;
-}
-function createNextcloudTalkWebhookSpool(options) {
-	let queue = options.queue;
-	const getQueue = () => {
-		queue ??= getNextcloudTalkRuntime().state.openChannelIngressQueue({ accountId: options.accountId });
-		return queue;
-	};
-	const legacyReplayStore = options.legacyReplayStore === null ? null : options.legacyReplayStore ?? getNextcloudTalkRuntime().state.openKeyedStore({
-		namespace: resolvePersistentDedupePluginStateNamespace({
-			namespace: options.accountId,
-			namespacePrefix: "replay-dedupe"
-		}),
-		maxEntries: 1e4,
-		defaultTtlMs: 864e5
-	});
-	const legacyMigration = legacyReplayStore ? migrateNextcloudTalkLegacyReplayState({
-		queue: getQueue(),
-		store: legacyReplayStore
-	}) : Promise.resolve();
-	const monitor = createChannelIngressMonitor({
-		queue: getQueue,
-		inspect: (rawEvent) => inspectNextcloudTalkWebhookEnvelope(rawEvent),
-		payload: {
-			version: 1,
-			serialize: (rawEvent, { receivedAt }) => ({
-				receivedAt,
-				rawEvent
-			}),
-			deserialize: (body) => body.rawEvent,
-			encode: ({ body }) => ({
-				version: 1,
-				...body
-			}),
-			decode: (payload) => ({
-				version: payload.version,
-				body: {
-					receivedAt: payload.receivedAt,
-					rawEvent: payload.rawEvent
-				}
-			}),
-			createClaimError: (kind, claim) => new NextcloudTalkWebhookPayloadError(kind === "invalid-version" ? `Nextcloud Talk ingress row ${claim.id} has an unsupported version.` : `Nextcloud Talk ingress row ${claim.id} has invalid message identity.`)
-		},
-		deliver: async (_rawEvent, lifecycle, claim) => {
-			const message = parseClaimedMessage(claim.payload, claim.id, claim.laneKey);
-			await options.deliver(message, lifecycle);
-		},
-		pollIntervalMs: options.pollIntervalMs ?? NEXTCLOUD_TALK_INGRESS_POLL_INTERVAL_MS,
-		waitForDeliveryIdleBeforeRepump: true,
-		retention: {
-			pruneIntervalMs: NEXTCLOUD_TALK_INGRESS_PRUNE_INTERVAL_MS,
-			completedTtlMs: NEXTCLOUD_TALK_INGRESS_COMPLETED_TTL_MS,
-			completedMaxEntries: NEXTCLOUD_TALK_INGRESS_COMPLETED_MAX_ENTRIES,
-			failedTtlMs: NEXTCLOUD_TALK_INGRESS_FAILED_TTL_MS,
-			failedMaxEntries: NEXTCLOUD_TALK_INGRESS_FAILED_MAX_ENTRIES
-		},
-		drain: {
-			resolveNonRetryableFailure,
-			...options.adoptionStallTimeoutMs === void 0 ? {} : { adoptionStallTimeoutMs: options.adoptionStallTimeoutMs },
-			onLog: (message) => options.runtime.log?.(`nextcloud-talk ${message}`)
-		},
-		...options.abortSignal ? { abortSignal: options.abortSignal } : {},
-		createStoppedError: () => /* @__PURE__ */ new Error("Nextcloud Talk ingress stopped"),
-		onError: (error) => options.runtime.error?.(`nextcloud-talk ingress drain failed: ${formatErrorMessage(error)}`)
-	});
-	let stopping = false;
-	const inFlightReceives = /* @__PURE__ */ new Set();
-	const startAfterMigration = legacyMigration.then(() => {
-		if (!stopping) monitor.start();
-	});
-	return {
-		ready: async () => await startAfterMigration,
-		receive: (rawEvent) => {
-			if (stopping) return Promise.reject(/* @__PURE__ */ new Error("Nextcloud Talk ingress stopped"));
-			const receiveTask = (async () => {
-				await startAfterMigration;
-				return (await monitor.admit(rawEvent)).kind === "ignored" ? "ignored" : "accepted";
-			})();
-			inFlightReceives.add(receiveTask);
-			receiveTask.then(() => inFlightReceives.delete(receiveTask), () => inFlightReceives.delete(receiveTask));
-			return receiveTask;
-		},
-		stop: async () => {
-			stopping = true;
-			const pendingReceives = [...inFlightReceives];
-			const pauseTask = monitor.pause();
-			await startAfterMigration.catch(() => void 0);
-			await Promise.allSettled(pendingReceives);
-			await monitor.stop();
-			await pauseTask;
-		},
-		waitForIdle: async () => {
-			await startAfterMigration.catch(() => void 0);
-			await monitor.waitForIdle();
-		}
-	};
-}
-//#endregion
 //#region extensions/nextcloud-talk/src/monitor-runtime.ts
 const DEFAULT_WEBHOOK_PORT = 8788;
 const DEFAULT_WEBHOOK_HOST = "0.0.0.0";
@@ -1622,29 +1518,13 @@ async function monitorNextcloudTalkProvider(opts) {
 		accountId: account.accountId
 	});
 	const expectedBackendOrigin = normalizeOrigin(account.baseUrl);
-	const spool = (opts.createSpool ?? createNextcloudTalkWebhookSpool)({
-		accountId: account.accountId,
-		runtime,
-		abortSignal: opts.abortSignal,
-		deliver: async (message, lifecycle) => {
-			core.channel.activity.record({
-				channel: "nextcloud-talk",
-				accountId: account.accountId,
-				direction: "inbound",
-				at: message.timestamp
-			});
-			if (opts.onMessage) await opts.onMessage(message, lifecycle);
-			else await handleNextcloudTalkInbound({
-				message,
-				account,
-				config: cfg,
-				runtime,
-				statusSink: opts.statusSink,
-				turnAdoptionLifecycle: lifecycle
-			});
+	const replayGuard = createNextcloudTalkReplayGuard({
+		stateDir: core.state.resolveStateDir(process.env, os.homedir),
+		onDiskError: (error) => {
+			logger.warn(`[nextcloud-talk:${account.accountId}] replay guard disk error: ${String(error)}`);
 		}
 	});
-	const server = (opts.createServer ?? createNextcloudTalkWebhookServer)({
+	const { start, stop } = createNextcloudTalkWebhookServer({
 		port,
 		host,
 		path,
@@ -1653,34 +1533,39 @@ async function monitorNextcloudTalkProvider(opts) {
 			if (!expectedBackendOrigin) return true;
 			return normalizeOrigin(backend) === expectedBackendOrigin;
 		},
-		onWebhook: spool.receive,
+		processMessage: async (message) => {
+			if (await processNextcloudTalkReplayGuardedMessage({
+				replayGuard,
+				accountId: account.accountId,
+				message,
+				handleMessage: async () => {
+					core.channel.activity.record({
+						channel: "nextcloud-talk",
+						accountId: account.accountId,
+						direction: "inbound",
+						at: message.timestamp
+					});
+					if (opts.onMessage) await opts.onMessage(message);
+					else await handleNextcloudTalkInbound({
+						message,
+						account,
+						config: cfg,
+						runtime,
+						statusSink: opts.statusSink
+					});
+				}
+			}) === "duplicate") logger.warn(`[nextcloud-talk:${account.accountId}] replayed webhook ignored room=${message.roomToken} messageId=${message.messageId}`);
+		},
+		onMessage: async () => {},
 		onError: (error) => {
 			logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
 		},
 		abortSignal: opts.abortSignal
 	});
-	let stopPromise;
-	const stop = () => {
-		stopPromise ??= (async () => {
-			await server.stop();
-			await spool.stop();
-		})();
-		return stopPromise;
-	};
-	if (opts.abortSignal && !opts.abortSignal.aborted) opts.abortSignal.addEventListener("abort", () => void stop(), { once: true });
-	if (opts.abortSignal?.aborted) {
-		await stop();
-		return { stop };
-	}
-	try {
-		await spool.ready();
-		await server.start();
-	} catch (error) {
-		await stop();
-		throw error;
-	}
+	if (opts.abortSignal?.aborted) return { stop };
+	await start();
 	if (opts.abortSignal?.aborted) {
-		await stop();
+		stop();
 		return { stop };
 	}
 	const publicUrl = account.config.webhookPublicUrl ?? `http://${host === "0.0.0.0" ? "localhost" : host}:${port}${path}`;
@@ -1698,7 +1583,7 @@ const nextcloudTalkGatewayAdapter = {
 			accountId: ctx.accountId,
 			setStatus: ctx.setStatus
 		});
-		await runPassiveAccountLifecycle({
+		await runStoppablePassiveMonitor({
 			abortSignal: ctx.abortSignal,
 			start: async () => await monitorNextcloudTalkProvider({
 				accountId: account.accountId,
@@ -1706,10 +1591,7 @@ const nextcloudTalkGatewayAdapter = {
 				runtime: ctx.runtime,
 				abortSignal: ctx.abortSignal,
 				statusSink
-			}),
-			stop: async (monitor) => {
-				await monitor.stop();
-			}
+			})
 		});
 	},
 	logoutAccount: async ({ accountId, cfg }) => {
@@ -1735,15 +1617,17 @@ const nextcloudTalkGatewayAdapter = {
 				else delete nextSection.accounts;
 			}
 		}
-		if (changed) if (nextSection && Object.keys(nextSection).length > 0) nextCfg.channels = {
-			...nextCfg.channels,
-			"nextcloud-talk": nextSection
-		};
-		else {
-			const nextChannels = { ...nextCfg.channels };
-			delete nextChannels["nextcloud-talk"];
-			if (Object.keys(nextChannels).length > 0) nextCfg.channels = nextChannels;
-			else delete nextCfg.channels;
+		if (changed) {
+			if (nextSection && Object.keys(nextSection).length > 0) nextCfg.channels = {
+				...nextCfg.channels,
+				"nextcloud-talk": nextSection
+			};
+			else {
+				const nextChannels = { ...nextCfg.channels };
+				delete nextChannels["nextcloud-talk"];
+				if (Object.keys(nextChannels).length > 0) nextCfg.channels = nextChannels;
+				else delete nextCfg.channels;
+			}
 		}
 		const loggedOut = resolveNextcloudTalkAccount({
 			cfg: changed ? nextCfg : cfg,
@@ -1781,7 +1665,7 @@ const nextcloudTalkMessageActions = {
 		if (!hasConfiguredAccount(cfg, accountId)) return null;
 		return { actions: ["send", "react"] };
 	},
-	supportsAction: ({ action }) => action === "react",
+	supportsAction: ({ action }) => action !== "send",
 	handleAction: async ({ action, params, cfg, accountId, toolContext }) => {
 		if (action === "send") throw new Error("Send should be handled by outbound, not actions handler.");
 		if (action === "react") {
@@ -1863,8 +1747,8 @@ function resolveNextcloudTalkOutboundSessionRoute(params) {
 //#region extensions/nextcloud-talk/src/setup-core.ts
 const t$1 = createSetupTranslator$1();
 const channel$1 = "nextcloud-talk";
-function readOptionalString(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
+function addWildcardAllowFrom(allowFrom) {
+	return mergeAllowFromEntries(allowFrom, ["*"]);
 }
 function normalizeNextcloudTalkBaseUrl(value) {
 	return value?.trim().replace(/\/+$/, "") ?? "";
@@ -1873,15 +1757,46 @@ function validateNextcloudTalkBaseUrl(value) {
 	if (!value) return "Required";
 	if (!value.startsWith("http://") && !value.startsWith("https://")) return "URL must start with http:// or https://";
 }
-function setNextcloudTalkAccountConfig(cfg, accountId, updates, clearFields) {
+function setNextcloudTalkAccountConfig(cfg, accountId, updates) {
 	return patchScopedAccountConfig({
 		cfg,
 		channelKey: channel$1,
 		accountId,
-		patch: updates,
-		...clearFields ? { clearFields } : {}
+		patch: updates
 	});
 }
+function clearNextcloudTalkAccountFields(cfg, accountId, fields) {
+	const section = cfg.channels?.["nextcloud-talk"];
+	if (!section) return cfg;
+	if (accountId === DEFAULT_ACCOUNT_ID$1) {
+		const nextSection = { ...section };
+		for (const field of fields) delete nextSection[field];
+		return {
+			...cfg,
+			channels: {
+				...cfg.channels,
+				"nextcloud-talk": nextSection
+			}
+		};
+	}
+	const currentAccount = section.accounts?.[accountId];
+	if (!currentAccount) return cfg;
+	const nextAccount = { ...currentAccount };
+	for (const field of fields) delete nextAccount[field];
+	return {
+		...cfg,
+		channels: {
+			...cfg.channels,
+			"nextcloud-talk": {
+				...section,
+				accounts: {
+					...section.accounts,
+					[accountId]: nextAccount
+				}
+			}
+		}
+	};
+}
 async function promptNextcloudTalkAllowFrom(params) {
 	return await promptParsedAllowFromForAccount({
 		cfg: params.cfg,
@@ -1920,28 +1835,37 @@ async function promptNextcloudTalkAllowFromForAccount(params) {
 		accountId
 	});
 }
-const nextcloudTalkDmPolicy = createChannelDmPolicy({
+const nextcloudTalkDmPolicy = {
 	label: "Nextcloud Talk",
 	channel: channel$1,
-	resolveAccount: (cfg, accountId) => resolveNextcloudTalkAccount({
+	policyKey: "channels.nextcloud-talk.dmPolicy",
+	allowFromKey: "channels.nextcloud-talk.allowFrom",
+	resolveConfigKeys: (cfg, accountId) => (accountId ?? resolveDefaultNextcloudTalkAccountId(cfg)) !== DEFAULT_ACCOUNT_ID$1 ? {
+		policyKey: `channels.nextcloud-talk.accounts.${accountId ?? resolveDefaultNextcloudTalkAccountId(cfg)}.dmPolicy`,
+		allowFromKey: `channels.nextcloud-talk.accounts.${accountId ?? resolveDefaultNextcloudTalkAccountId(cfg)}.allowFrom`
+	} : {
+		policyKey: "channels.nextcloud-talk.dmPolicy",
+		allowFromKey: "channels.nextcloud-talk.allowFrom"
+	},
+	getCurrent: (cfg, accountId) => resolveNextcloudTalkAccount({
 		cfg,
 		accountId: accountId ?? resolveDefaultNextcloudTalkAccountId(cfg)
-	}),
-	applyPatch: ({ cfg, account, patch }) => setNextcloudTalkAccountConfig(cfg, account.accountId, patch),
+	}).config.dmPolicy ?? "pairing",
+	setPolicy: (cfg, policy, accountId) => {
+		const resolvedAccountId = accountId ?? resolveDefaultNextcloudTalkAccountId(cfg);
+		const resolved = resolveNextcloudTalkAccount({
+			cfg,
+			accountId: resolvedAccountId
+		});
+		return setNextcloudTalkAccountConfig(cfg, resolvedAccountId, {
+			dmPolicy: policy,
+			...policy === "open" ? { allowFrom: addWildcardAllowFrom(resolved.config.allowFrom) } : {}
+		});
+	},
 	promptAllowFrom: promptNextcloudTalkAllowFromForAccount
-});
+};
 const nextcloudTalkSetupAdapter = {
-	singleAccountKeysToMove: ["rooms"],
 	resolveAccountId: ({ accountId }) => normalizeAccountId$1(accountId),
-	prepareAccountConfigInput: ({ input }) => {
-		const setupInput = input;
-		return {
-			...setupInput,
-			baseUrl: setupInput.baseUrl ?? readOptionalString(setupInput.url),
-			secret: setupInput.secret ?? readOptionalString(setupInput.token) ?? readOptionalString(setupInput.password),
-			secretFile: setupInput.secretFile ?? readOptionalString(setupInput.tokenFile)
-		};
-	},
 	applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
 		cfg,
 		channelKey: channel$1,
@@ -1959,83 +1883,18 @@ const nextcloudTalkSetupAdapter = {
 	}),
 	applyAccountConfig: ({ cfg, accountId, input }) => {
 		const setupInput = input;
-		return setNextcloudTalkAccountConfig(applyAccountNameToChannelSection({
+		const namedConfig = applyAccountNameToChannelSection({
 			cfg,
 			channelKey: channel$1,
 			accountId,
 			name: setupInput.name
-		}), accountId, {
+		});
+		return setNextcloudTalkAccountConfig(setupInput.useEnv ? clearNextcloudTalkAccountFields(namedConfig, accountId, ["botSecret", "botSecretFile"]) : namedConfig, accountId, {
 			baseUrl: normalizeNextcloudTalkBaseUrl(setupInput.baseUrl),
 			...setupInput.useEnv ? {} : setupInput.secretFile ? { botSecretFile: setupInput.secretFile } : setupInput.secret ? { botSecret: setupInput.secret } : {}
-		}, setupInput.useEnv ? ["botSecret", "botSecretFile"] : void 0);
+		});
 	}
 };
-const nextcloudTalkSetupContract = defineChannelSetupContract({
-	fields: {
-		baseUrl: {
-			kind: "string",
-			cli: {
-				flags: "--base-url <url>",
-				description: "Nextcloud base URL"
-			}
-		},
-		url: {
-			kind: "string",
-			cli: {
-				flags: "--url <url>",
-				description: "Legacy Nextcloud base URL alias"
-			}
-		},
-		secret: {
-			kind: "string",
-			sensitive: true,
-			cli: {
-				flags: "--secret <secret>",
-				description: "Nextcloud Talk bot secret"
-			}
-		},
-		token: {
-			kind: "string",
-			sensitive: true,
-			cli: {
-				flags: "--token <secret>",
-				description: "Legacy Nextcloud bot secret alias"
-			}
-		},
-		password: {
-			kind: "string",
-			sensitive: true,
-			cli: {
-				flags: "--password <secret>",
-				description: "Legacy Nextcloud bot secret alias"
-			}
-		},
-		secretFile: {
-			kind: "string",
-			sensitive: true,
-			cli: {
-				flags: "--secret-file <path>",
-				description: "Nextcloud Talk bot secret file"
-			}
-		},
-		tokenFile: {
-			kind: "string",
-			sensitive: true,
-			cli: {
-				flags: "--token-file <path>",
-				description: "Legacy Nextcloud bot secret file alias"
-			}
-		},
-		useEnv: {
-			kind: "boolean",
-			cli: {
-				flags: "--use-env",
-				description: "Use Nextcloud Talk environment credentials"
-			}
-		}
-	},
-	legacyAdapter: nextcloudTalkSetupAdapter
-});
 //#endregion
 //#region extensions/nextcloud-talk/src/setup-surface.ts
 const t = createSetupTranslator();
@@ -2093,10 +1952,8 @@ const nextcloudTalkSetupWizard = {
 			[CONFIGURE_API_FLAG]: "1"
 		} };
 	},
-	credentials: [defineTokenCredential({
+	credentials: [{
 		inputKey: "token",
-		configKey: "botSecret",
-		configuredFields: ["botSecret", "botSecretFile"],
 		providerHint: channel,
 		credentialLabel: t("wizard.nextcloudTalk.botSecret"),
 		preferredEnvVar: "NEXTCLOUD_TALK_BOT_SECRET",
@@ -2104,54 +1961,61 @@ const nextcloudTalkSetupWizard = {
 		keepPrompt: t("wizard.nextcloudTalk.botSecretKeep"),
 		inputPrompt: t("wizard.nextcloudTalk.botSecretInput"),
 		allowEnv: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1,
-		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
-			cfg,
-			accountId
-		}),
-		accountConfigured: (account) => Boolean(account.secret && account.baseUrl),
-		hasConfiguredValue: (account) => Boolean(hasConfiguredSecretInput(account.config.botSecret) || account.config.botSecretFile),
-		resolvedValue: (account) => account.secret || void 0,
-		envValue: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET) : void 0,
-		patchAccount: ({ cfg, accountId, patch, clearFields }) => setNextcloudTalkAccountConfig(cfg, accountId, patch, clearFields),
-		useEnv: {
-			clearFields: ["botSecret", "botSecretFile"],
-			patch: (account) => ({ baseUrl: account.baseUrl })
+		inspect: ({ cfg, accountId }) => {
+			const resolvedAccount = resolveNextcloudTalkAccount({
+				cfg,
+				accountId
+			});
+			return {
+				accountConfigured: Boolean(resolvedAccount.secret && resolvedAccount.baseUrl),
+				hasConfiguredValue: Boolean(hasConfiguredSecretInput(resolvedAccount.config.botSecret) || resolvedAccount.config.botSecretFile),
+				resolvedValue: resolvedAccount.secret || void 0,
+				envValue: accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET) : void 0
+			};
+		},
+		applyUseEnv: async (params) => {
+			const resolvedAccount = resolveNextcloudTalkAccount({
+				cfg: params.cfg,
+				accountId: params.accountId
+			});
+			return setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["botSecret", "botSecretFile"]), params.accountId, { baseUrl: resolvedAccount.baseUrl });
 		},
-		set: { clearFields: ["botSecret", "botSecretFile"] }
-	}), defineTokenCredential({
+		applySet: async (params) => setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["botSecret", "botSecretFile"]), params.accountId, { botSecret: params.value })
+	}, {
 		inputKey: "password",
-		configKey: "apiPassword",
-		configuredFields: ["apiPassword", "apiPasswordFile"],
 		providerHint: "nextcloud-talk-api",
 		credentialLabel: t("wizard.nextcloudTalk.apiPassword"),
 		preferredEnvVar: "NEXTCLOUD_TALK_API_PASSWORD",
 		envPrompt: "",
 		keepPrompt: t("wizard.nextcloudTalk.apiPasswordKeep"),
 		inputPrompt: t("wizard.nextcloudTalk.apiPasswordInput"),
-		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
-			cfg,
-			accountId
-		}),
-		accountConfigured: (account) => Boolean(account.config.apiUser?.trim() && (hasConfiguredSecretInput(account.config.apiPassword) || account.config.apiPasswordFile)),
-		hasConfiguredValue: (account) => Boolean(hasConfiguredSecretInput(account.config.apiPassword) || account.config.apiPasswordFile),
+		inspect: ({ cfg, accountId }) => {
+			const resolvedAccount = resolveNextcloudTalkAccount({
+				cfg,
+				accountId
+			});
+			const apiUser = resolvedAccount.config.apiUser?.trim();
+			const apiPasswordConfigured = Boolean(hasConfiguredSecretInput(resolvedAccount.config.apiPassword) || resolvedAccount.config.apiPasswordFile);
+			return {
+				accountConfigured: Boolean(apiUser && apiPasswordConfigured),
+				hasConfiguredValue: apiPasswordConfigured
+			};
+		},
 		shouldPrompt: ({ credentialValues }) => credentialValues[CONFIGURE_API_FLAG] === "1",
-		patchAccount: ({ cfg, accountId, patch, clearFields }) => setNextcloudTalkAccountConfig(cfg, accountId, patch, clearFields),
-		set: { clearFields: ["apiPassword", "apiPasswordFile"] }
-	})],
-	textInputs: [baseUrlTextInput({
+		applySet: async (params) => setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["apiPassword", "apiPasswordFile"]), params.accountId, { apiPassword: params.value })
+	}],
+	textInputs: [{
 		inputKey: "httpUrl",
-		configKey: "baseUrl",
 		message: t("wizard.nextcloudTalk.instanceUrlPrompt"),
-		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
+		currentValue: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
 			cfg,
 			accountId
-		}),
-		currentValue: (account) => account.baseUrl || void 0,
+		}).baseUrl || void 0,
 		shouldPrompt: ({ currentValue }) => !currentValue,
-		validate: validateNextcloudTalkBaseUrl,
-		normalize: normalizeNextcloudTalkBaseUrl,
-		patchAccount: ({ cfg, accountId, patch }) => setNextcloudTalkAccountConfig(cfg, accountId, patch)
-	}), {
+		validate: ({ value }) => validateNextcloudTalkBaseUrl(value),
+		normalizeValue: ({ value }) => normalizeNextcloudTalkBaseUrl(value),
+		applySet: async (params) => setNextcloudTalkAccountConfig(params.cfg, params.accountId, { baseUrl: params.value })
+	}, {
 		inputKey: "userId",
 		message: t("wizard.nextcloudTalk.apiUserPrompt"),
 		currentValue: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
@@ -2213,14 +2077,12 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		configSchema: buildChannelConfigSchema(NextcloudTalkConfigSchema),
 		config: {
 			...nextcloudTalkConfigAdapter,
-			isConfigured: (account) => Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+			isConfigured: (account) => Boolean(account.secret?.trim() && account.baseUrl?.trim()),
 			describeAccount: (account) => describeWebhookAccountSnapshot({
 				account,
-				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+				configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
 				extra: {
 					secretSource: account.secretSource,
-					tokenStatus: account.tokenStatus,
-					apiCredentialStatus: account.apiCredentialStatus,
 					baseUrl: account.baseUrl ? "[set]" : "[missing]"
 				}
 			})
@@ -2228,7 +2090,18 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		approvalCapability: nextcloudTalkApprovalAuth,
 		doctor: nextcloudTalkDoctor,
 		groups: {
-			resolveRequireMention: resolveNextcloudTalkGroupRequireMention,
+			resolveRequireMention: ({ cfg, accountId, groupId }) => {
+				const rooms = resolveNextcloudTalkAccount({
+					cfg,
+					accountId
+				}).config.rooms;
+				if (!rooms || !groupId) return true;
+				const roomConfig = rooms[groupId];
+				if (roomConfig?.requireMention !== void 0) return roomConfig.requireMention;
+				const wildcardConfig = rooms["*"];
+				if (wildcardConfig?.requireMention !== void 0) return wildcardConfig.requireMention;
+				return true;
+			},
 			resolveToolPolicy: resolveNextcloudTalkGroupToolPolicy
 		},
 		messaging: {
@@ -2249,7 +2122,6 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 			collectRuntimeConfigAssignments
 		},
 		setup: nextcloudTalkSetupAdapter,
-		setupContract: nextcloudTalkSetupContract,
 		status: createComputedAccountStatusAdapter({
 			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID$2),
 			buildChannelSummary: ({ snapshot }) => buildWebhookChannelStatusSummary(snapshot, { secretSource: snapshot.secretSource ?? "none" }),
@@ -2272,11 +2144,9 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 				accountId: account.accountId,
 				name: account.name,
 				enabled: account.enabled,
-				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+				configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
 				extra: {
 					secretSource: account.secretSource,
-					tokenStatus: account.tokenStatus,
-					apiCredentialStatus: account.apiCredentialStatus,
 					baseUrl: account.baseUrl ? "[set]" : "[missing]",
 					mode: "webhook"
 				}