@camstack/addon-post-analysis 1.2.16 → 1.2.18

package/dist/pipeline-analytics/index.js

@@ -2,10 +2,351 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BV2hm-VZ.js");
+const require_dist = require("../dist-CjwPOJKc.js");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_dist.__toESM(node_path);
 let node_crypto = require("node:crypto");
 let sharp = require("sharp");
 sharp = require_dist.__toESM(sharp);
+//#region src/notification-center/artifact-url.ts
+/**
+* Signed, externally-reachable URLs for notification artifacts.
+*
+* WHY this exists: the dispatcher only ever produced attachment BYTES, and the
+* degrade engine drops a bytes-only attachment for a `mode:'url'` target
+* (`attachment:noUrl`) — so WhatsApp and gotify received no media at all,
+* silently. A URL also lets an oversized attachment degrade to a link instead
+* of being dropped on `maxBytes`.
+*
+* Two decisions the shape depends on:
+*
+*  - **Signed, not authenticated.** The fetcher is a notifier BACKEND (or the
+*    recipient's phone) — it holds no session and no admin token. The route is
+*    therefore `access:'public'` and the authority is the signature: an
+*    unguessable HMAC over `(id, exp)` with a per-install secret, expiring on
+*    its own. Nothing else about the install is reachable through it.
+*  - **The base URL is CHOSEN, never assumed.** A notification carrying
+*    `http://127.0.0.1:...` is useless (the Alexa `hubUrl` bug, again). The
+*    ranked endpoint list the `local-network` cap already computes — public
+*    tunnel > mesh > LAN, loopback last — is the authority, and loopback is
+*    refused outright rather than shipped as a broken link.
+*/
+/**
+* Pick the base URL an artifact link should use: the LOWEST-priority-number
+* endpoint that is not loopback (the list is already ranked public > mesh >
+* LAN > loopback). `null` when only loopback is available — a link nobody
+* outside the host could open is worse than no link, because the notification
+* would arrive advertising media that 404s.
+*/
+function pickArtifactBaseUrl(endpoints) {
+	return endpoints.filter((e) => e.kind !== "loopback").toSorted((a, b) => a.priority - b.priority)[0]?.baseUrl ?? null;
+}
+/** Sign `(id, exp)` — the exact string the verifier recomputes. */
+function signArtifact(secret, id, expMs) {
+	return (0, node_crypto.createHmac)("sha256", secret).update(`${id}:${expMs}`).digest("hex");
+}
+/**
+* Build the fully-qualified, signed URL for an artifact.
+* `baseUrl` comes from {@link pickArtifactBaseUrl}, `routePrefix` from the
+* data-plane handle (`/addon/<addonId>/nc-artifact`).
+*/
+function buildArtifactUrl(input) {
+	const sig = signArtifact(input.secret, input.id, input.expMs);
+	return `${input.baseUrl.endsWith("/") ? input.baseUrl.slice(0, -1) : input.baseUrl}${input.routePrefix.startsWith("/") ? input.routePrefix : `/${input.routePrefix}`}/${encodeURIComponent(input.id)}?exp=${input.expMs}&sig=${sig}`;
+}
+/**
+* Verify a request's `(id, exp, sig)`. Constant-time on the signature so a
+* public route cannot be probed for it byte by byte, and expiry-checked before
+* the compare so an expired link is rejected even with a valid signature.
+*/
+function verifyArtifactSignature(input) {
+	if (!Number.isFinite(input.exp) || input.exp <= input.nowMs) return false;
+	const expected = signArtifact(input.secret, input.id, input.exp);
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(input.sig, "utf8");
+	if (a.length !== b.length) return false;
+	return (0, node_crypto.timingSafeEqual)(a, b);
+}
+//#endregion
+//#region src/notification-center/artifact-plane.ts
+/**
+* The hub's default HTTPS API port — the same constant `derive-hub-url.ts`
+* documents. Only used for the LAN candidates; an operator who runs the hub on
+* another port sets `CAMSTACK_HUB_PUBLIC_URL`, which wins outright.
+*/
+var HUB_API_PORT = 4443;
+/**
+* Ranking of the public sources. All NEGATIVE: `local-network` gives its
+* preferred LAN interface priority `0`, so a public candidate has to sit below
+* zero to outrank it.
+*/
+var PRIORITY_MARKED = -400;
+var PRIORITY_CONFIGURED = -300;
+var PRIORITY_CONNECTED = -200;
+var PRIORITY_EXTERNAL_LIST = -100;
+/**
+* Build the ranked candidate list, in the operator's own order: an explicitly
+* configured public origin, then the connected external ingress (tunnels),
+* then the LAN addresses. Every source is best-effort — one that throws
+* contributes nothing rather than costing the whole list.
+*/
+async function collectArtifactEndpoints(sources) {
+	const out = [];
+	const marked = sources.markedBaseUrl;
+	if (marked !== void 0 && marked !== "") out.push({
+		baseUrl: marked,
+		kind: "public",
+		priority: PRIORITY_MARKED
+	});
+	const configured = sources.configuredPublicUrl;
+	if (configured !== void 0 && configured !== "" && !/127\.0\.0\.1|localhost/.test(configured)) out.push({
+		baseUrl: configured,
+		kind: "public",
+		priority: PRIORITY_CONFIGURED
+	});
+	try {
+		const connected = await sources.getConnected();
+		if (connected !== null && connected.protocol === "https") out.push({
+			baseUrl: connected.url,
+			kind: "public",
+			priority: PRIORITY_CONNECTED
+		});
+	} catch (err) {
+		sources.logger.debug("connected endpoint lookup failed", { meta: { error: String(err) } });
+	}
+	try {
+		const external = await sources.listExternal();
+		for (const [i, e] of external.entries()) {
+			if (e.protocol !== "https") continue;
+			out.push({
+				baseUrl: e.url,
+				kind: "public",
+				priority: PRIORITY_EXTERNAL_LIST + i
+			});
+		}
+	} catch (err) {
+		sources.logger.debug("external endpoint lookup failed", { meta: { error: String(err) } });
+	}
+	try {
+		out.push(...await sources.listLan(HUB_API_PORT));
+	} catch (err) {
+		sources.logger.debug("LAN endpoint lookup failed", { meta: { error: String(err) } });
+	}
+	return out;
+}
+var DEFAULT_TTL_MS = 24 * 36e5;
+var DEFAULT_ENDPOINT_CACHE_MS = 6e4;
+var NcArtifactPlane = class {
+	deps;
+	now;
+	cachedBaseUrl = null;
+	/** Last base URL announced in the log — so the line appears on CHANGE only. */
+	lastLoggedBaseUrl = null;
+	cachedAt = 0;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	/**
+	* Store bytes and mint a signed, externally-reachable URL for them.
+	* Returns `null` when no usable base URL exists (loopback only) — the caller
+	* then ships bytes alone, exactly as before. Never throws: an artifact URL is
+	* an ENHANCEMENT, and failing to mint one must not cost the notification.
+	*/
+	async publish(bytes, mime) {
+		try {
+			const baseUrl = await this.resolveBaseUrl();
+			if (baseUrl === null) return null;
+			const artifact = await this.deps.store.put(bytes, mime);
+			return buildArtifactUrl({
+				baseUrl,
+				routePrefix: this.deps.routePrefix,
+				id: artifact.id,
+				secret: this.deps.secret,
+				expMs: this.now() + (this.deps.ttlMs ?? DEFAULT_TTL_MS)
+			});
+		} catch (err) {
+			this.deps.logger.debug("artifact publish failed — shipping bytes only", { meta: { error: String(err) } });
+			return null;
+		}
+	}
+	/** The data-plane handler for `<prefix>/<id>?exp=&sig=`. */
+	handler = async (req, res) => {
+		const url = new URL(req.url ?? "/", "http://placeholder");
+		const id = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+		if (!verifyArtifactSignature({
+			secret: this.deps.secret,
+			id,
+			exp: Number(url.searchParams.get("exp")),
+			sig: url.searchParams.get("sig") ?? "",
+			nowMs: this.now()
+		})) {
+			res.writeHead(404, { "content-type": "text/plain" });
+			res.end("not found");
+			return;
+		}
+		const found = await this.deps.store.read(id);
+		if (found === null) {
+			res.writeHead(404, { "content-type": "text/plain" });
+			res.end("not found");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": found.mime,
+			"content-length": String(found.bytes.byteLength),
+			"cache-control": "private, max-age=3600"
+		});
+		res.end(found.bytes);
+	};
+	/** The chosen base URL, cached briefly (the interface list barely moves). */
+	async resolveBaseUrl() {
+		const ttl = this.deps.endpointCacheMs ?? DEFAULT_ENDPOINT_CACHE_MS;
+		if (this.cachedBaseUrl !== null && this.now() - this.cachedAt < ttl) return this.cachedBaseUrl;
+		const picked = pickArtifactBaseUrl(await this.deps.listEndpoints());
+		if (picked === null) {
+			this.deps.logger.debug("no externally-reachable endpoint — artifacts ship as bytes only");
+			return null;
+		}
+		if (picked !== this.lastLoggedBaseUrl) {
+			this.deps.logger.info("artifact links will use", { meta: { baseUrl: picked } });
+			this.lastLoggedBaseUrl = picked;
+		}
+		this.cachedBaseUrl = picked;
+		this.cachedAt = this.now();
+		return picked;
+	}
+};
+//#endregion
+//#region src/notification-center/artifact-store.ts
+/**
+* NcArtifactStore — the bytes behind a signed notification-artifact URL.
+*
+* A notification attachment is transient by nature: it exists to be fetched
+* once, by a notifier backend or the recipient's phone, within minutes of the
+* event. So this is a BOUNDED SCRATCH, not a media library — the durable copy
+* of an event's media already lives in the media store, and duplicating it here
+* permanently would grow without limit for no benefit.
+*
+* Two bounds, both enforced on every write (age first, then count): whichever
+* bites first, the oldest artifacts go. A sweep on boot clears whatever a crash
+* left behind — the directory is disposable by construction, so a lost file is
+* a 404 on one link, never a corrupt state.
+*/
+var DEFAULT_MAX_AGE_MS = 6 * 36e5;
+var DEFAULT_MAX_ENTRIES = 500;
+/** `image/jpeg` → `jpg`, so a fetched link has a name a client will accept. */
+function extensionFor(mime) {
+	if (mime === "image/jpeg") return "jpg";
+	if (mime === "image/gif") return "gif";
+	if (mime === "video/mp4") return "mp4";
+	if (mime === "image/png") return "png";
+	return "bin";
+}
+var NcArtifactStore = class {
+	options;
+	now;
+	maxAgeMs;
+	maxEntries;
+	/** id → mime, so the route can answer with the right content-type without
+	*  re-deriving it from the extension on every request. */
+	mimeById = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		this.now = options.now ?? (() => Date.now());
+		this.maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+		this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+	}
+	/** Create the directory and sweep whatever a previous run left behind. */
+	async start() {
+		await node_fs.promises.mkdir(this.options.dir, { recursive: true });
+		await this.sweep();
+	}
+	/** Persist bytes and return the artifact handle (never throws on sweep). */
+	async put(bytes, mime) {
+		const id = `${this.now()}-${(0, node_crypto.randomUUID)()}`;
+		const file = node_path.default.join(this.options.dir, `${id}.${extensionFor(mime)}`);
+		await node_fs.promises.mkdir(this.options.dir, { recursive: true });
+		await node_fs.promises.writeFile(file, bytes);
+		this.mimeById.set(id, mime);
+		await this.sweep();
+		return {
+			id,
+			mime,
+			bytes: bytes.byteLength
+		};
+	}
+	/** Read an artifact's bytes + mime, or null when it is gone (expired/swept). */
+	async read(id) {
+		if (!/^[0-9]+-[0-9a-f-]{36}$/i.test(id)) return null;
+		const found = (await this.list()).find((e) => e.id === id);
+		if (!found) return null;
+		try {
+			return {
+				bytes: await node_fs.promises.readFile(found.file),
+				mime: this.mimeById.get(id) ?? mimeFromExtension(found.file)
+			};
+		} catch {
+			return null;
+		}
+	}
+	/** Delete every artifact (operator cleanup / shutdown). */
+	async clear() {
+		await node_fs.promises.rm(this.options.dir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+		this.mimeById.clear();
+	}
+	/** Age- then count-bounded prune. Best-effort: a failed unlink is logged once. */
+	async sweep() {
+		const entries = await this.list();
+		const cutoff = this.now() - this.maxAgeMs;
+		const doomed = entries.filter((e) => e.mtimeMs < cutoff);
+		const survivors = entries.filter((e) => e.mtimeMs >= cutoff).toSorted((a, b) => b.mtimeMs - a.mtimeMs);
+		doomed.push(...survivors.slice(this.maxEntries));
+		for (const e of doomed) try {
+			await node_fs.promises.rm(e.file, { force: true });
+			this.mimeById.delete(e.id);
+		} catch (err) {
+			this.options.logger.debug("artifact sweep failed to unlink", { meta: {
+				file: e.file,
+				error: String(err)
+			} });
+		}
+	}
+	async list() {
+		let names;
+		try {
+			names = await node_fs.promises.readdir(this.options.dir);
+		} catch {
+			return [];
+		}
+		const out = [];
+		for (const name of names) {
+			const file = node_path.default.join(this.options.dir, name);
+			try {
+				const st = await node_fs.promises.stat(file);
+				if (!st.isFile()) continue;
+				out.push({
+					id: name.slice(0, name.lastIndexOf(".")),
+					file,
+					mtimeMs: st.mtimeMs
+				});
+			} catch {}
+		}
+		return out;
+	}
+};
+function mimeFromExtension(file) {
+	const ext = file.slice(file.lastIndexOf(".") + 1).toLowerCase();
+	if (ext === "jpg") return "image/jpeg";
+	if (ext === "gif") return "image/gif";
+	if (ext === "mp4") return "video/mp4";
+	if (ext === "png") return "image/png";
+	return "application/octet-stream";
+}
+//#endregion
 //#region src/pipeline-analytics/videoclips-provider.ts
 var SOURCE = "analytics";
 function clipIdFor(eventId, startMs, endMs) {
@@ -4162,6 +4503,42 @@ function attachmentKindPreference(policy, ownerKind) {
 	];
 }
 /**
+* The kind ladder for an EXPLICIT frame choice. Strict by design — each option
+* stays inside its own family, because a rule that asked for the clean scene
+* and received the boxed one (or vice versa) is not "degrading gracefully", it
+* is answering a different question.
+*
+* `boxed` is the one exception: with no annotated frame stored, the CLEAN
+* scene is the honest fallback (same picture, no annotation) — never a subject
+* crop, which shows something else entirely.
+*/
+function framePreference(frame, ownerKind) {
+	if (frame === "cropped") return ownerKind === "track" ? [
+		"thumbnail",
+		"thumbnailSmall",
+		"crop"
+	] : [
+		"crop",
+		"thumbnail",
+		"thumbnailSmall"
+	];
+	if (frame === "boxed") return [
+		"fullFrameBoxed",
+		"keyFrame",
+		"keyFrameSmall",
+		"fullFrame"
+	];
+	return ownerKind === "track" ? [
+		"keyFrame",
+		"keyFrameSmall",
+		"firstFrame"
+	] : [
+		"fullFrame",
+		"keyFrame",
+		"keyFrameSmall"
+	];
+}
+/**
 * Derive the `best-matching` media signal from a matched rule's condition
 * summary ({@link NcEvaluation.matchedOn}). Identity takes priority over plate
 * (D-3 ordering: a face rule that ALSO plate-matched attaches the face crop).
@@ -4190,6 +4567,20 @@ function bestMatchingKindPreference(signal, ownerKind) {
 //#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
+/** GIF and MP4 are the same cut in two containers — one render request each. */
+var FOOTAGE_FORMATS = [{
+	flag: "mediaGif",
+	format: "gif",
+	mediaType: "gif",
+	mime: "image/gif",
+	name: "event.gif"
+}, {
+	flag: "mediaClip",
+	format: "mp4",
+	mediaType: "video",
+	mime: "video/mp4",
+	name: "event.mp4"
+}];
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -4259,14 +4650,19 @@ var NcDispatcher = class {
 	async resolveTarget(targetId) {
 		const cached = this.cachedTarget(targetId);
 		if (cached !== null) return cached;
+		let targets;
 		try {
-			const targets = await this.deps.listTargets();
-			this.targetCache = new Map(targets.map((t) => [t.id, t]));
-			this.targetCacheAt = this.now();
+			targets = await this.deps.listTargets();
 		} catch (err) {
 			this.deps.logger.warn("target catalog refresh failed", { meta: { error: String(err) } });
 			throw err instanceof Error ? err : new Error(String(err));
 		}
+		if (targets.length === 0) {
+			this.deps.logger.warn("target catalog came back EMPTY — treating as transient", { meta: { targetId } });
+			throw new Error(`target catalog empty (transient) while resolving ${targetId}`);
+		}
+		this.targetCache = new Map(targets.map((t) => [t.id, t]));
+		this.targetCacheAt = this.now();
 		return this.targetCache.get(targetId) ?? null;
 	}
 	cachedTarget(targetId) {
@@ -4280,7 +4676,7 @@ var NcDispatcher = class {
 		const vars = buildTemplateVars(entry, deviceName);
 		const title = renderTemplate(entry.payload.template?.title, vars) ?? entry.payload.ruleName;
 		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName);
-		const attachment = await this.resolveAttachment(entry);
+		const attachments = await this.withArtifactUrls(await this.resolveAttachments(entry));
 		const params = pickParams(entry.payload.params);
 		return {
 			body,
@@ -4290,7 +4686,7 @@ var NcDispatcher = class {
 			tag: entry.ruleId,
 			deviceId: subject.deviceId,
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
-			...attachment !== null ? { attachments: [attachment] } : {}
+			...attachments.length > 0 ? { attachments } : {}
 		};
 	}
 	/**
@@ -4302,9 +4698,142 @@ var NcDispatcher = class {
 	* explains the fired condition (`faceCrop`/`plateCrop`, both event-owned)
 	* then degrades to the plain `best` → `keyFrame` ladders.
 	*/
-	async resolveAttachment(entry) {
-		const policy = entry.payload.media;
+	/**
+	* Mint a signed URL for each attachment, alongside the bytes it already
+	* carries. Best-effort per attachment: a failed mint leaves that one
+	* bytes-only rather than costing the notification. Without this a url-mode
+	* target (WhatsApp, gotify) silently received NO media — the degrade engine
+	* drops a bytes-only attachment for them (`attachment:noUrl`).
+	*/
+	/**
+	* A failed footage render is best-effort — ship the still, skip the video.
+	*
+	* There is nothing to wait for: the clip ring only grows FORWARD, so a window
+	* it does not already cover will never be covered by retrying. (An earlier
+	* revision deferred delivery here, when clips were cut from finalized
+	* recording segments; retrying under the pre-buffer would just age the
+	* pre-roll out of the ring.)
+	*/
+	notePendingFootage(entry, err, what) {
+		this.deps.logger.debug(`${what} attachment render failed`, {
+			tags: { deviceId: entry.payload.subject.deviceId },
+			meta: {
+				error: String(err),
+				action: "send-without-video"
+			}
+		});
+	}
+	async withArtifactUrls(attachments) {
+		const publish = this.deps.publishArtifact;
+		if (publish === void 0) return [...attachments];
+		const out = [];
+		for (const att of attachments) {
+			const url = await publish(att.bytes, att.mime).catch(() => null);
+			out.push(url === null ? { ...att } : {
+				...att,
+				url
+			});
+		}
+		return out;
+	}
+	/** The full attachment list: the policy still (zone-cropped when the rule
+	*  froze zone ids) plus the footage cut from the broker's clip ring when
+	*  requested. Each part is best-effort — a failed crop falls back to the
+	*  uncropped still, a failed render just omits the video. */
+	async resolveAttachments(entry) {
+		const out = [];
+		const zoneIdsWanted = entry.payload.mediaZoneIds;
+		const still = await this.resolveAttachment(entry, zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0);
+		if (still !== null) {
+			const zoneIds = zoneIdsWanted;
+			if (zoneIds !== void 0 && zoneIds.length > 0) {
+				const cropped = await this.zoneCrop(entry.payload.subject.deviceId, zoneIds, still.bytes);
+				out.push(cropped !== null ? {
+					...still,
+					bytes: cropped,
+					name: "zone.jpg"
+				} : still);
+			} else out.push(still);
+		}
+		for (const want of FOOTAGE_FORMATS) {
+			if (entry.payload[want.flag] !== true || !this.deps.renderFootage) continue;
+			try {
+				const rendered = await this.deps.renderFootage({
+					deviceId: entry.payload.subject.deviceId,
+					aroundMs: entry.payload.subject.timestamp,
+					format: want.format,
+					...entry.payload.mediaClipPreRollSec !== void 0 ? { preRollSec: entry.payload.mediaClipPreRollSec } : {},
+					...entry.payload.mediaClipPostRollSec !== void 0 ? { postRollSec: entry.payload.mediaClipPostRollSec } : {},
+					...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {}
+				});
+				if (rendered !== null && rendered.byteLength > 0) {
+					const bytes = new Uint8Array(rendered.byteLength);
+					bytes.set(rendered);
+					out.push({
+						mediaType: want.mediaType,
+						bytes,
+						mime: want.mime,
+						name: want.name
+					});
+				}
+			} catch (err) {
+				this.notePendingFootage(entry, err, want.format === "gif" ? "gif" : "clip");
+			}
+		}
+		return out;
+	}
+	/** Crop a JPEG to the padded bbox of the given zones (normalized polygons →
+	*  pixel rect via sharp metadata). Null on any failure — caller falls back
+	*  to the uncropped still. */
+	async zoneCrop(deviceId, zoneIds, jpeg) {
+		try {
+			const points = (await this.deps.getZonePolygons?.(deviceId, zoneIds) ?? []).flat();
+			if (points.length === 0) return null;
+			const { default: sharp$7 } = await import("sharp");
+			const img = sharp$7(Buffer.from(jpeg));
+			const meta = await img.metadata();
+			const W = meta.width ?? 0;
+			const H = meta.height ?? 0;
+			if (W === 0 || H === 0) return null;
+			let minX = 1;
+			let minY = 1;
+			let maxX = 0;
+			let maxY = 0;
+			for (const p of points) {
+				if (p.x < minX) minX = p.x;
+				if (p.y < minY) minY = p.y;
+				if (p.x > maxX) maxX = p.x;
+				if (p.y > maxY) maxY = p.y;
+			}
+			if (maxX <= minX || maxY <= minY) return null;
+			const padX = (maxX - minX) * .1;
+			const padY = (maxY - minY) * .1;
+			const left = Math.max(0, Math.floor((minX - padX) * W));
+			const top = Math.max(0, Math.floor((minY - padY) * H));
+			const width = Math.min(W - left, Math.ceil((maxX - minX + 2 * padX) * W));
+			const height = Math.min(H - top, Math.ceil((maxY - minY + 2 * padY) * H));
+			if (width < 16 || height < 16) return null;
+			const outBuf = await img.extract({
+				left,
+				top,
+				width,
+				height
+			}).jpeg({ quality: 82 }).toBuffer();
+			const bytes = new Uint8Array(outBuf.byteLength);
+			bytes.set(outBuf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.debug("zone crop failed — attaching uncropped still", { meta: {
+				deviceId,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	async resolveAttachment(entry, policyOverride) {
+		const policy = policyOverride ?? entry.payload.media;
 		if (policy === "none") return null;
+		const frame = policyOverride === void 0 ? entry.payload.mediaFrame : void 0;
 		const subject = entry.payload.subject;
 		const signal = policy === "best-matching" ? matchSignal(entry.payload.matchedOn) : null;
 		const owners = [];
@@ -4316,11 +4845,11 @@ var NcDispatcher = class {
 			kind: "track",
 			id: subject.trackId
 		});
-		if (policy === "keyFrame") owners.reverse();
+		if (policy === "keyFrame" || frame === "full" || frame === "boxed") owners.reverse();
 		for (const owner of owners) try {
 			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
-			const preference = policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
+			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
 			for (const kind of preference) {
 				const file = files.find((f) => f.kind === kind);
 				if (file === void 0) continue;
@@ -4642,7 +5171,7 @@ var NC_OCCUPANCY_INDEXES = [{
 }];
 /** Query cap — a per-(device, zone, class) key set is small; this is a
 *  generous ceiling that still bounds a pathological read. */
-var LOAD_LIMIT = 1e5;
+var LOAD_LIMIT$1 = 1e5;
 var OccupancyStore = class {
 	cache = /* @__PURE__ */ new Map();
 	store;
@@ -4669,7 +5198,7 @@ var OccupancyStore = class {
 		try {
 			const records = await this.store.query.query({
 				collection: NC_OCCUPANCY_COLLECTION,
-				filter: { limit: LOAD_LIMIT }
+				filter: { limit: LOAD_LIMIT$1 }
 			});
 			this.cache.clear();
 			let skipped = 0;
@@ -5428,25 +5957,273 @@ var NcRuleStore = class {
 		this.byId.delete(ruleId);
 		try {
 			await this.store.delete.mutate({
-				collection: NC_RULES_COLLECTION,
+				collection: NC_RULES_COLLECTION,
+				key: ruleId
+			});
+		} catch (err) {
+			this.logger.warn("notification rule delete failed", { meta: {
+				ruleId,
+				error: String(err)
+			} });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	async persist(rule) {
+		await this.store.set.mutate({
+			collection: NC_RULES_COLLECTION,
+			key: rule.id,
+			value: {
+				name: rule.name,
+				enabled: rule.enabled,
+				delivery: rule.delivery,
+				updatedAt: rule.updatedAt,
+				rule
+			}
+		});
+	}
+};
+//#endregion
+//#region src/notification-center/timelapse/timelapse-store.ts
+var NC_TIMELAPSE_RULES_COLLECTION = "notification-center:timelapse-rules";
+var NC_TIMELAPSE_RULES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "enabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL rule object (Zod-validated on read) — scalars above are
+	*  indexed projections only. */
+	{
+		name: "rule",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_TIMELAPSE_RULES_INDEXES = [{
+	name: "idx_nc_timelapse_rules_enabled",
+	columns: ["enabled"]
+}];
+/** Query cap — the rule set is operator-authored and tiny; a generous ceiling. */
+var LOAD_LIMIT = 1e4;
+/**
+* Resolve the three-way `template` patch signal onto a merged rule, immutably:
+* `undefined` (key absent) leaves it as-is, `null` DROPS the key, an object
+* replaces it. Keeping `null` out of the persisted rule is what lets
+* `TimelapseRuleSchema` stay a plain `.optional()`.
+*/
+function applyTemplatePatch(merged, template) {
+	if (template === void 0) return merged;
+	if (template !== null) return {
+		...merged,
+		template
+	};
+	const { template: _cleared, ...withoutTemplate } = merged;
+	return withoutTemplate;
+}
+var TimelapseStore = class {
+	byId = /* @__PURE__ */ new Map();
+	store;
+	logger;
+	now;
+	newId;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.newId = deps.newId ?? (() => (0, node_crypto.randomUUID)());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_TIMELAPSE_RULES_COLLECTION,
+			columns: [...NC_TIMELAPSE_RULES_COLUMNS],
+			indexes: [...NC_TIMELAPSE_RULES_INDEXES]
+		});
+	}
+	/**
+	* (Re)hydrate the FULL rule set from the store — called at boot and on the
+	* periodic refresh tick. Replaces the cache wholesale; a row whose JSON no
+	* longer validates is skipped with a warning (a degraded rule must never
+	* crash the scheduler).
+	*/
+	async load() {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_TIMELAPSE_RULES_COLLECTION,
+				filter: { limit: LOAD_LIMIT }
+			});
+			this.byId.clear();
+			let skipped = 0;
+			for (const row of rows) {
+				const parsed = require_dist.TimelapseRuleSchema.safeParse(row.data["rule"]);
+				if (!parsed.success) {
+					skipped += 1;
+					continue;
+				}
+				this.byId.set(parsed.data.id, parsed.data);
+			}
+			this.logger.debug("timelapse rules loaded", { meta: {
+				rules: this.byId.size,
+				...skipped > 0 ? { skippedInvalid: skipped } : {}
+			} });
+		} catch (err) {
+			this.logger.warn("timelapse rules load failed", { meta: { error: String(err) } });
+		}
+	}
+	/** Every rule, newest-first (admin path). */
+	list() {
+		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+	}
+	/** The scheduler's read: only rules that should be ticked. */
+	listEnabled() {
+		return this.list().filter((r) => r.enabled);
+	}
+	get(ruleId) {
+		return this.byId.get(ruleId) ?? null;
+	}
+	/**
+	* Rules visible to `userId`: their OWN personal rules (`ownerUserId ===
+	* userId`) plus every admin/global rule (`ownerUserId` absent). Never another
+	* user's personal rows. Newest-first (inherits {@link list}).
+	*
+	* The caller identity is server-derived; an absent/undefined caller must be
+	* resolved to a fail-closed value by the bridge action BEFORE calling here —
+	* this store never treats a missing caller as admin/global.
+	*/
+	listForOwner(userId) {
+		return this.list().filter((r) => r.ownerUserId === void 0 || r.ownerUserId === userId);
+	}
+	/**
+	* Mutation gate for a NON-admin caller: true only for a PERSONAL rule this
+	* user owns. A global rule (no `ownerUserId`) returns false — global rules
+	* are admin-only, and the bridge action grants admins the mutation without
+	* consulting this check. An unknown rule id is false (fail-closed).
+	*/
+	isOwnedBy(ruleId, userId) {
+		const rule = this.byId.get(ruleId);
+		return rule?.ownerUserId !== void 0 && rule.ownerUserId === userId;
+	}
+	/**
+	* Create a rule. `createdBy` is the SERVER-injected caller userId;
+	* `ownerUserId` is the server-derived owner (omit for an admin/global rule).
+	* Neither is ever read from `input`.
+	*
+	* The input is re-parsed through {@link TimelapseRuleInputSchema} BEFORE the
+	* spread — that schema carries no ownership/provenance keys, so it strips any
+	* that rode in on the blob. Without it, an `ownerUserId` on `input` would
+	* survive whenever the `ownerUserId` ARGUMENT is omitted (the admin/global
+	* path): a `TimelapseRule` is structurally assignable to `TimelapseRuleInput`,
+	* so a future "duplicate rule" action (`create(existingRule, caller)`) would
+	* compile cleanly and silently clone the ORIGINAL owner.
+	*/
+	async create(input, createdBy, ownerUserId) {
+		const now = this.now();
+		const rule = require_dist.TimelapseRuleSchema.parse({
+			...require_dist.TimelapseRuleInputSchema.parse(input),
+			id: this.newId(),
+			...ownerUserId !== void 0 ? { ownerUserId } : {},
+			createdBy,
+			createdAt: now,
+			updatedAt: now
+		});
+		await this.persist(rule);
+		this.byId.set(rule.id, rule);
+		return rule;
+	}
+	/**
+	* Apply a partial patch. Immutable: returns the NEW rule object. Identity,
+	* ownership and generation state are re-pinned from the existing rule AFTER
+	* the spread — the patch schema carries none of them, and this makes a
+	* hand-built (unparsed) patch object equally unable to re-own a rule.
+	*
+	* `template` is the one clearable field: an absent key leaves it unchanged,
+	* an explicit `null` CLEARS it (the persisted rule loses the key — `null`
+	* never reaches {@link TimelapseRuleSchema}). See the patch schema's wire
+	* note.
+	*/
+	async update(ruleId, patch) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
+		const { template, ...rest } = patch;
+		const merged = {
+			...existing,
+			...rest,
+			id: existing.id,
+			ownerUserId: existing.ownerUserId,
+			lastGeneratedAt: existing.lastGeneratedAt,
+			createdBy: existing.createdBy,
+			createdAt: existing.createdAt,
+			updatedAt: this.now()
+		};
+		return this.write(applyTemplatePatch(merged, template));
+	}
+	async setEnabled(ruleId, enabled) {
+		return this.update(ruleId, { enabled });
+	}
+	/**
+	* Record a successful generation. `at` is the generation epoch-ms — the
+	* durable state behind the 1-hour re-generation guard. Does NOT bump
+	* `updatedAt` (generation is not an edit of the rule definition).
+	*/
+	async markGenerated(ruleId, at) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
+		return this.write({
+			...existing,
+			lastGeneratedAt: at
+		});
+	}
+	/** Idempotent delete — unknown ids are a no-op. */
+	async delete(ruleId) {
+		this.byId.delete(ruleId);
+		try {
+			await this.store.delete.mutate({
+				collection: NC_TIMELAPSE_RULES_COLLECTION,
 				key: ruleId
 			});
 		} catch (err) {
-			this.logger.warn("notification rule delete failed", { meta: {
+			this.logger.warn("timelapse rule delete failed", { meta: {
 				ruleId,
 				error: String(err)
 			} });
 			throw err instanceof Error ? err : new Error(String(err));
 		}
 	}
+	/**
+	* Re-validate a merged candidate, persist it, then cache it. Re-validating
+	* means a patch can never persist a rule that would be skipped at the next
+	* `load()`; provenance/ownership survive because they are spread from the
+	* existing rule and never present on a patch.
+	*/
+	async write(candidate) {
+		const rule = require_dist.TimelapseRuleSchema.parse(candidate);
+		await this.persist(rule);
+		this.byId.set(rule.id, rule);
+		return rule;
+	}
 	async persist(rule) {
 		await this.store.set.mutate({
-			collection: NC_RULES_COLLECTION,
+			collection: NC_TIMELAPSE_RULES_COLLECTION,
 			key: rule.id,
 			value: {
 				name: rule.name,
 				enabled: rule.enabled,
-				delivery: rule.delivery,
 				updatedAt: rule.updatedAt,
 				rule
 			}
@@ -5548,7 +6325,7 @@ function outboxEntryToHistory(entry) {
 		}
 	};
 }
-var NotificationCenter = class {
+var NotificationCenter = class NotificationCenter {
 	logger;
 	rules;
 	outbox;
@@ -5610,11 +6387,19 @@ var NotificationCenter = class {
 	get ruleStore() {
 		return this.rules;
 	}
-	/** Declare every Notification Center collection (idempotent, boot-time). */
+	/**
+	* Declare every Notification Center collection (idempotent, boot-time).
+	*
+	* EVERY store the module can touch belongs here, including ones whose
+	* feature is not wired yet: an UNDECLARED collection answers 412 on first
+	* use and takes the whole runner down with it. The timelapse store shipped
+	* without this line and was one enable away from doing exactly that.
+	*/
 	static async declare(store) {
 		await NcRuleStore.declare(store);
 		await NcOutbox.declare(store);
 		await OccupancyStore.declare(store);
+		await TimelapseStore.declare(store);
 	}
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
@@ -5799,6 +6584,7 @@ var NotificationCenter = class {
 			listRules: async () => ({ rules: [...this.rules.list()] }),
 			getRule: async ({ ruleId }) => ({ rule: this.rules.get(ruleId) }),
 			createRule: async ({ rule, caller }) => {
+				NotificationCenter.assertHasAddressee(rule.targets, rule.targetUsers);
 				await this.validateTargetRefs(rule.targets.map((t) => t.targetId));
 				const created = await this.rules.create(rule, caller.userId);
 				this.logger.info("notification rule created", { meta: {
@@ -5810,6 +6596,10 @@ var NotificationCenter = class {
 			},
 			updateRule: async ({ ruleId, patch, caller }) => {
 				if (patch.targets !== void 0) await this.validateTargetRefs(patch.targets.map((t) => t.targetId));
+				if (patch.targets !== void 0 || patch.targetUsers !== void 0) {
+					const existing = this.rules.get(ruleId);
+					NotificationCenter.assertHasAddressee(patch.targets ?? existing?.targets ?? [], patch.targetUsers ?? existing?.targetUsers);
+				}
 				const { disabledTargetIds: _optOut, ...safePatch } = patch;
 				const updated = await this.rules.update(ruleId, safePatch);
 				this.logger.info("notification rule updated", { meta: {
@@ -5827,7 +6617,10 @@ var NotificationCenter = class {
 				return { success: true };
 			},
 			testRule: async ({ rule, lookbackMinutes }) => ({ results: [...await this.dryRun(rule, lookbackMinutes)] }),
-			getConditionCatalog: async () => ({ catalog: [...require_dist.NC_CONDITION_CATALOG] }),
+			getConditionCatalog: async () => ({
+				catalog: [...require_dist.NC_CONDITION_CATALOG],
+				taxonomy: require_dist.NC_TAXONOMY
+			}),
 			getHistory: async ({ filter }) => {
 				const entries = await this.outbox.queryHistory({
 					...filter.ruleId !== void 0 ? { ruleId: filter.ruleId } : {},
@@ -5868,26 +6661,76 @@ var NotificationCenter = class {
 	async evaluateAndEnqueue(subject, kind) {
 		const delivery = kind === "object-event" || kind === "audio-event" ? "immediate" : kind === "occupancy-event" ? "device-event" : kind;
 		const candidates = this.rules.listEnabled(delivery);
-		if (candidates.length === 0) return;
+		if (candidates.length === 0) {
+			this.logger.debug("no enabled rule for this trigger", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					delivery,
+					kind,
+					rulesLoaded: this.rules.list().length
+				}
+			});
+			return;
+		}
 		const now = this.now();
 		for (const rule of candidates) {
 			const evaluation = evaluateRule(rule, subject);
-			if (!evaluation.matched) continue;
+			if (!evaluation.matched) {
+				this.logger.debug("rule did not match", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						ruleId: rule.id,
+						rule: rule.name,
+						kind,
+						failed: evaluation.failedCondition,
+						classes: subject.classNames
+					}
+				});
+				continue;
+			}
 			const key = cooldownKey(rule, subject);
-			if (isCoolingDown(rule, this.lastFiredAt.get(key), now)) continue;
-			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn)) > 0) this.lastFiredAt.set(key, now);
+			if (isCoolingDown(rule, this.lastFiredAt.get(key), now)) {
+				this.logger.debug("rule matched but is cooling down", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						ruleId: rule.id,
+						rule: rule.name,
+						key
+					}
+				});
+				continue;
+			}
+			this.logger.info("rule matched — enqueueing", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					ruleId: rule.id,
+					rule: rule.name,
+					kind,
+					targets: rule.targets.length
+				}
+			});
+			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
+			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets)) > 0) this.lastFiredAt.set(key, now);
 		}
 	}
-	buildEntries(rule, subject, kind, matchedOn) {
+	buildEntries(rule, subject, kind, matchedOn, userTargets = []) {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
-		return rule.targets.filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
+		const direct = new Set(rule.targets.map((t) => t.targetId));
+		return [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))].filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: rule.media.attach,
+				...rule.media.zoneCrop === true && rule.conditions.zones !== void 0 ? { mediaZoneIds: [...rule.conditions.zones.ids] } : {},
+				...rule.media.frame !== void 0 ? { mediaFrame: rule.media.frame } : {},
+				...rule.media.profile !== void 0 ? { mediaProfile: rule.media.profile } : {},
+				...rule.media.gif === true ? { mediaGif: true } : {},
+				...rule.media.clip === true ? { mediaClip: true } : {},
+				...rule.media.clipPreRollSec !== void 0 ? { mediaClipPreRollSec: rule.media.clipPreRollSec } : {},
+				...rule.media.clipPostRollSec !== void 0 ? { mediaClipPostRollSec: rule.media.clipPostRollSec } : {},
 				...matchedOn !== void 0 && matchedOn.length > 0 ? { matchedOn } : {},
 				...target.params !== void 0 ? { params: target.params } : {},
 				subject: {
@@ -5913,6 +6756,63 @@ var NotificationCenter = class {
 			};
 		});
 	}
+	/** rule→user fan-out caches (60 s users/targets; device routes immutable). */
+	userGrantsCache = null;
+	userGrantsAt = 0;
+	ownedTargetsCache = null;
+	ownedTargetsAt = 0;
+	deviceRouteCache = /* @__PURE__ */ new Map();
+	userFanoutUnavailableLogged = false;
+	/**
+	* The personal targets a rule's `targetUsers` resolve to for THIS device:
+	* each addressed user contributes the enabled targets they own — but only
+	* when their `allowedDevices` grant covers the firing camera (admin users
+	* always pass). A user must never be notified about a device they cannot
+	* open.
+	*/
+	async resolveUserTargets(rule, deviceId) {
+		const users = rule.targetUsers;
+		if (users === void 0 || users.length === 0) return [];
+		const { listUsers, getDeviceRoute } = this.deps;
+		if (listUsers === void 0 || getDeviceRoute === void 0) {
+			if (!this.userFanoutUnavailableLogged) {
+				this.userFanoutUnavailableLogged = true;
+				this.logger.warn("rule addresses users but the user fan-out deps are not wired", { meta: { ruleId: rule.id } });
+			}
+			return [];
+		}
+		const now = this.now();
+		if (this.userGrantsCache === null || now - this.userGrantsAt > 6e4) {
+			this.userGrantsCache = await listUsers();
+			this.userGrantsAt = now;
+		}
+		if (this.ownedTargetsCache === null || now - this.ownedTargetsAt > 6e4) {
+			const targets = await this.deps.dispatcher.listTargets();
+			const owned = /* @__PURE__ */ new Map();
+			for (const t of targets) {
+				if (t.ownerUserId === void 0 || !t.enabled) continue;
+				const list = owned.get(t.ownerUserId) ?? [];
+				list.push(t.id);
+				owned.set(t.ownerUserId, list);
+			}
+			this.ownedTargetsCache = owned;
+			this.ownedTargetsAt = now;
+		}
+		if (!this.deviceRouteCache.has(deviceId)) this.deviceRouteCache.set(deviceId, await getDeviceRoute(deviceId));
+		const route = this.deviceRouteCache.get(deviceId) ?? null;
+		const out = [];
+		for (const userId of users) {
+			const user = this.userGrantsCache.find((u) => u.id === userId);
+			if (user === void 0) continue;
+			if (!user.isAdmin) {
+				if (route === null) continue;
+				const grant = user.allowedDevices[route.addonId];
+				if (!(grant === "*" || Array.isArray(grant) && grant.includes(route.stableId))) continue;
+			}
+			for (const targetId of this.ownedTargetsCache.get(userId) ?? []) out.push({ targetId });
+		}
+		return out;
+	}
 	/** Rebuild the cooldown map from persisted outbox rows (restart-proof). */
 	async seedCooldowns() {
 		const entries = await this.outbox.queryRecentPersisted(this.now() - 864e5);
@@ -6026,10 +6926,21 @@ var NotificationCenter = class {
 		this.drainTicks += 1;
 		if (this.drainTicks % WATERMARK_EVERY_TICKS === 0) await this.outbox.setWatermark(this.now());
 	}
+	/** The "at least one addressee" invariant lives here, not in Zod: the
+	*  schema allows empty `targets` (a users-only rule) and a cross-field
+	*  refine would break `NcRulePatchSchema.partial()`. */
+	static assertHasAddressee(targets, targetUsers) {
+		if (targets.length === 0 && (targetUsers?.length ?? 0) === 0) throw new Error("a rule needs at least one delivery target or user");
+	}
 	/** Rule-save referential check: every targetId must resolve in the
 	*  live notification-output catalog (spec §2.3 save-time validation). */
 	async validateTargetRefs(targetIds) {
+		if (targetIds.length === 0) return;
 		const targets = await this.deps.dispatcher.listTargets();
+		if (targets.length === 0) {
+			this.logger.warn("target catalog came back EMPTY at rule save — the notification-output catalog is unreachable or under-reporting (collection fan-out regression?). Skipping the referential check; delivery re-checks with retry semantics.", { meta: { targetIds: [...targetIds] } });
+			return;
+		}
 		const known = new Set(targets.map((t) => t.id));
 		for (const id of targetIds) if (!known.has(id)) throw new Error(`unknown notification target: ${id}`);
 	}
@@ -6144,15 +7055,28 @@ function makeNcActionHandlers(deps) {
 		if (rule === null) throw new Error(`forbidden: rule not found: ${ruleId}`);
 		return rule;
 	};
-	const assertRuleOwned = (ruleId, userId) => {
+	/**
+	* A rule the caller may EDIT. Ownership binds non-admins; an ADMIN
+	* administers every rule — global ones (`ownerUserId: undefined`, what the
+	* admin UI creates) and, for support, a user's personal rule.
+	*
+	* Without the admin bypass the comparison `rule.ownerUserId === userId` is
+	* false for EVERY caller on a global rule, so the viewer refused to let an
+	* admin edit an admin rule (operator report, 2026-07-30). Same bypass shape
+	* as `assertTargetsOwned`.
+	*/
+	const assertRuleEditable = (ruleId, caller) => {
 		const rule = assertOwnsRule(ruleId);
-		if (rule.ownerUserId !== userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
 		return rule;
 	};
-	/** A rule the caller may SEE — his own personal rule OR a global/admin rule. */
-	const assertRuleVisible = (ruleId, userId) => {
+	/** A rule the caller may SEE — his own personal rule, a global/admin rule, or
+	*  (for an admin) any rule at all. */
+	const assertRuleVisible = (ruleId, caller) => {
 		const rule = assertOwnsRule(ruleId);
-		if (rule.ownerUserId !== void 0 && rule.ownerUserId !== userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== void 0 && rule.ownerUserId !== caller.userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
 		return rule;
 	};
 	const assertTargetsOwned = async (targetIds, caller) => {
@@ -6163,9 +7087,9 @@ function makeNcActionHandlers(deps) {
 	return {
 		"nc.listRules": async (_input, caller) => {
 			const c = requireCaller(caller);
-			return { rules: deps.ruleStore.listForOwner(c.userId).map((r) => ({
+			return { rules: (c.isAdmin ? deps.ruleStore.list() : deps.ruleStore.listForOwner(c.userId)).map((r) => ({
 				...r,
-				readOnly: r.ownerUserId !== c.userId
+				readOnly: !c.isAdmin && r.ownerUserId !== c.userId
 			})) };
 		},
 		"nc.getConditionCatalog": async () => ({
@@ -6188,7 +7112,7 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.updateRule": async (input, caller) => {
 			const c = requireCaller(caller);
-			assertRuleOwned(input.ruleId, c.userId);
+			assertRuleEditable(input.ruleId, c);
 			const patch = require_dist.NcRulePatchSchema.parse(input.patch);
 			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
 			const { ownerUserId: _owner, disabledTargetIds: _optOut, ...safe } = patch;
@@ -6201,7 +7125,7 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.deleteRule": async (input, caller) => {
 			const c = requireCaller(caller);
-			assertRuleOwned(input.ruleId, c.userId);
+			assertRuleEditable(input.ruleId, c);
 			await deps.ruleStore.delete(input.ruleId);
 			deps.logger.info("nc rule deleted", { meta: {
 				ruleId: input.ruleId,
@@ -6211,7 +7135,7 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.setRuleTargetEnabled": async (input, caller) => {
 			const c = requireCaller(caller);
-			assertRuleVisible(input.ruleId, c.userId);
+			assertRuleVisible(input.ruleId, c);
 			await assertTargetsOwned([input.targetId], c);
 			await deps.ruleStore.setRuleTargetEnabled(input.ruleId, input.targetId, input.enabled);
 			return { success: true };
@@ -8863,7 +9787,15 @@ var MEDIA_COLUMNS = [
 		name: "sizeBytes",
 		type: "INTEGER",
 		notNull: true
-	}
+	},
+	(
+	/** Storage location holding the blob. NULL = the default `eventMedia`
+	*  location (every pre-Phase-3 row, and every write until multi-location
+	*  events exist) — the relocate mover stamps real ids as it moves blobs. */
+	{
+		name: "locationId",
+		type: "TEXT"
+	})
 ];
 var MEDIA_INDEXES = [{
 	name: "idx_media_owner",
@@ -8872,11 +9804,18 @@ var MEDIA_INDEXES = [{
 	name: "idx_media_device_ts",
 	columns: ["deviceId", "timestamp"]
 }];
+/** The storage location of a media row/record: its stamped `locationId`, or
+*  the default `eventMedia` location for NULL (pre-multi-location) rows. */
+var DEFAULT_MEDIA_LOCATION = "eventMedia";
+function mediaRowLocation(data) {
+	const id = data?.["locationId"];
+	return typeof id === "string" && id.length > 0 ? id : DEFAULT_MEDIA_LOCATION;
+}
 function buildKey(params) {
 	return isSingleInstanceKind(params.kind) ? `${params.ownerKind}:${params.ownerId}:${params.kind}` : `${params.ownerKind}:${params.ownerId}:${params.kind}:${params.timestamp}`;
 }
 function buildPath(params) {
-	const base = `pipeline-analytics/${params.deviceId}/${params.ownerKind}/${params.ownerId}`;
+	const base = `${params.deviceId}/events/${params.ownerKind}/${params.ownerId}`;
 	return isSingleInstanceKind(params.kind) ? `${base}/${params.kind}.jpg` : `${base}/${params.kind}-${params.timestamp}.jpg`;
 }
 var MediaStore = class {
@@ -8907,7 +9846,8 @@ var MediaStore = class {
 			kind: params.kind,
 			timestamp: params.timestamp,
 			path,
-			sizeBytes: params.data.length
+			sizeBytes: params.data.length,
+			locationId: null
 		};
 		try {
 			await this.storage.write({
@@ -8964,10 +9904,11 @@ var MediaStore = class {
 		const newKey = await this.put(params);
 		for (const row of existing) {
 			if (row.id === newKey) continue;
-			const path = String(row.data["path"] ?? "");
+			const rowData = row.data;
+			const path = String(rowData["path"] ?? "");
 			if (path) try {
 				await this.storage.delete({
-					location: "eventMedia",
+					location: mediaRowLocation(rowData),
 					relativePath: path
 				});
 			} catch {}
@@ -9035,7 +9976,7 @@ var MediaStore = class {
 				key,
 				kind,
 				base64: (await this.storage.read({
-					location: "eventMedia",
+					location: mediaRowLocation(data),
 					relativePath: path
 				})).toString("base64"),
 				sizeBytes,
@@ -9055,10 +9996,11 @@ var MediaStore = class {
 			key
 		});
 		if (!row) return;
-		const path = String(row["path"] ?? "");
+		const data = row;
+		const path = String(data["path"] ?? "");
 		if (path) try {
 			await this.storage.delete({
-				location: "eventMedia",
+				location: mediaRowLocation(data),
 				relativePath: path
 			});
 		} catch {}
@@ -9097,7 +10039,7 @@ var MediaStore = class {
 			const kind = String(data["kind"]);
 			try {
 				const buf = await this.storage.read({
-					location: "eventMedia",
+					location: mediaRowLocation(data),
 					relativePath: path
 				});
 				files.push({
@@ -9132,10 +10074,11 @@ var MediaStore = class {
 				} }
 			});
 			for (const row of rows) {
-				const path = String(row.data["path"] ?? "");
+				const rowData = row.data;
+				const path = String(rowData["path"] ?? "");
 				try {
 					if (path) await this.storage.delete({
-						location: "eventMedia",
+						location: mediaRowLocation(rowData),
 						relativePath: path
 					});
 				} catch {}
@@ -9231,14 +10174,14 @@ var MediaStore = class {
 			kind,
 			timestamp,
 			data: await this.storage.read({
-				location: "eventMedia",
+				location: mediaRowLocation(meta),
 				relativePath: oldPath
 			})
 		};
 		const newKey = await this.put(newParams);
 		try {
 			await this.storage.delete({
-				location: "eventMedia",
+				location: mediaRowLocation(meta),
 				relativePath: oldPath
 			});
 		} catch (err) {
@@ -9308,10 +10251,11 @@ var MediaStore = class {
 			if (rows.length === 0) break;
 			let deletedInPage = 0;
 			for (const row of rows) {
-				const path = String(row.data["path"] ?? "");
+				const rowData = row.data;
+				const path = String(rowData["path"] ?? "");
 				try {
 					if (path) await this.storage.delete({
-						location: "eventMedia",
+						location: mediaRowLocation(rowData),
 						relativePath: path
 					});
 				} catch {}
@@ -9867,6 +10811,7 @@ var EventStore = class {
 				const rows = await this.store.query.query({
 					collection,
 					filter: {
+						...params.deviceId !== void 0 ? { where: { deviceId: params.deviceId } } : {},
 						whereBetween: { timestamp: [0, cutoffMs] },
 						limit: 500
 					}
@@ -10267,6 +11212,183 @@ function stripNulls(data) {
 	return out;
 }
 //#endregion
+//#region src/pipeline-analytics/location-aware-media-storage.ts
+/**
+* Location-aware blob storage for event media (entity-routing spec, Phase 3).
+*
+* Media rows may carry a `locationId` (stamped by the relocate mover when a
+* blob is moved off the default location). The write-rate bypass provider
+* only knows the default media root — this wrapper routes any OTHER location
+* id through a resolver (the storage cap's `resolve`, cached forever: a
+* location's root only changes via operator reconfig, which restarts us) and
+* does direct fs I/O against that root, keeping the bypass's
+* no-RPC-per-blob property for every location.
+*/
+function createLocationAwareMediaStorage(deps) {
+	const roots = /* @__PURE__ */ new Map();
+	const rootOf = async (locationId) => {
+		const cached = roots.get(locationId);
+		if (cached !== void 0) return cached;
+		const root = await deps.resolveRoot(locationId);
+		roots.set(locationId, root);
+		return root;
+	};
+	const absOf = async (locationId, relativePath) => node_path.default.join(await rootOf(locationId), relativePath);
+	return {
+		write: async (input) => {
+			if (input.location === deps.defaultLocation) return deps.base.write(input);
+			const abs = await absOf(input.location, input.relativePath);
+			await node_fs.promises.mkdir(node_path.default.dirname(abs), { recursive: true });
+			await node_fs.promises.writeFile(abs, input.data);
+		},
+		read: async (input) => {
+			if (input.location === deps.defaultLocation) return deps.base.read(input);
+			return node_fs.promises.readFile(await absOf(input.location, input.relativePath));
+		},
+		delete: async (input) => {
+			if (input.location === deps.defaultLocation) return deps.base.delete(input);
+			await node_fs.promises.rm(await absOf(input.location, input.relativePath), { force: true });
+		}
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/media-relocate-engine.ts
+var PAGE_SIZE = 200;
+var DEFAULT_THROTTLE_MBPS = 40;
+function snapshot(j) {
+	return {
+		jobId: j.jobId,
+		state: j.state,
+		fromLocationId: j.fromLocationId,
+		toLocationId: j.toLocationId,
+		deviceId: j.deviceId,
+		entities: ["media"],
+		filesMoved: j.filesMoved,
+		bytesMoved: j.bytesMoved,
+		filesTotal: null,
+		startedAt: j.startedAt,
+		finishedAt: j.finishedAt,
+		error: j.error
+	};
+}
+var MediaRelocateEngine = class {
+	deps;
+	jobs = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	list() {
+		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
+	}
+	cancel(jobId) {
+		const job = this.jobs.get(jobId);
+		if (!job || job.state !== "running") return false;
+		job.cancelRequested = true;
+		return true;
+	}
+	start(input) {
+		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);
+		const job = {
+			jobId: this.deps.newId(),
+			state: "running",
+			fromLocationId: "*",
+			toLocationId: input.toLocationId,
+			deviceId: input.deviceId ?? null,
+			filesMoved: 0,
+			bytesMoved: 0,
+			startedAt: this.deps.now(),
+			finishedAt: null,
+			error: null,
+			cancelRequested: false
+		};
+		this.jobs.set(job.jobId, job);
+		this.run(job, input.throttleMbps ?? DEFAULT_THROTTLE_MBPS);
+		return job.jobId;
+	}
+	async run(job, throttleMbps) {
+		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+		const bytesPerMs = throttleMbps * 1024 * 1024 / 1e3;
+		try {
+			await this.deps.resolveTargetRoot(job.toLocationId);
+			let cursor = 0;
+			let seenAtCursor = /* @__PURE__ */ new Set();
+			for (;;) {
+				if (job.cancelRequested) break;
+				const fresh = (await this.deps.store.query.query({
+					collection: MEDIA_COLLECTION,
+					filter: {
+						...job.deviceId !== null ? { where: { deviceId: job.deviceId } } : {},
+						whereBetween: { timestamp: [cursor, Number.MAX_SAFE_INTEGER] },
+						orderBy: {
+							field: "timestamp",
+							direction: "asc"
+						},
+						limit: PAGE_SIZE
+					}
+				})).filter((r) => !seenAtCursor.has(r.id));
+				if (fresh.length === 0) break;
+				for (const row of fresh) {
+					if (job.cancelRequested) break;
+					const data = row.data;
+					const from = mediaRowLocation(data);
+					if (from === job.toLocationId) continue;
+					const relativePath = String(data["path"] ?? "");
+					if (relativePath.length === 0) continue;
+					try {
+						const bytes = await this.deps.storage.read({
+							location: from,
+							relativePath
+						});
+						await this.deps.storage.write({
+							location: job.toLocationId,
+							relativePath,
+							data: bytes
+						});
+						await this.deps.store.set.mutate({
+							collection: MEDIA_COLLECTION,
+							key: row.id,
+							value: {
+								...data,
+								locationId: job.toLocationId
+							}
+						});
+						await this.deps.storage.delete({
+							location: from,
+							relativePath
+						});
+						job.filesMoved++;
+						job.bytesMoved += bytes.length;
+						await sleep(bytes.length / bytesPerMs);
+					} catch (err) {
+						this.deps.logger.debug("media relocate row failed", { meta: {
+							key: row.id,
+							error: String(err)
+						} });
+					}
+				}
+				const last = fresh[fresh.length - 1];
+				const lastTs = Number(last.data["timestamp"] ?? cursor);
+				if (lastTs === cursor) for (const r of fresh) seenAtCursor.add(r.id);
+				else {
+					cursor = lastTs;
+					seenAtCursor = new Set(fresh.filter((r) => Number(r.data["timestamp"]) === lastTs).map((r) => r.id));
+				}
+			}
+			job.state = job.cancelRequested ? "cancelled" : "done";
+		} catch (err) {
+			job.state = "failed";
+			job.error = err instanceof Error ? err.message : String(err);
+			this.deps.logger.warn("media relocate job failed", { meta: {
+				jobId: job.jobId,
+				error: job.error
+			} });
+		} finally {
+			job.finishedAt = this.deps.now();
+			this.deps.onFinished?.(snapshot(job));
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/store/sensor-event-store.ts
 var SENSOR_EVENTS_COLLECTION = "pipeline-analytics:sensor-events";
 var SENSOR_EVENT_COLUMNS = [
@@ -11393,7 +12515,7 @@ var EventMediaDispatcher = class {
 		if (sn.rollingLastFrame && boxed) lastFrameWritten = await this.replaceKind(deviceId, sn.trackId, "lastFrame", sn.timestamp, boxed);
 		let thumbnailWritten = false;
 		if (sn.bestThumbnail) {
-			const variants = await this.cropSubjectVariants(frameHandle, fw, fh, sn.bbox);
+			const variants = await this.cropSubjectVariants(deviceId, frameHandle, fw, fh, sn.bbox);
 			if (variants) {
 				thumbnailWritten = await this.replaceKind(deviceId, sn.trackId, "thumbnail", sn.timestamp, variants.thumbnail);
 				await this.replaceKind(deviceId, sn.trackId, "thumbnailSmall", sn.timestamp, variants.thumbnailSmall);
@@ -11495,12 +12617,15 @@ var EventMediaDispatcher = class {
 	* per-frame retry lands a real native crop later. Never a local resize
 	* upscale of a ≤640 tile (a blurred lie).
 	*/
-	async cropSubjectVariants(frameHandle, fw, fh, bbox) {
+	async cropSubjectVariants(deviceId, frameHandle, fw, fh, bbox) {
 		if (!this.deps.getNativeCropJpeg) {
-			this.deps.logger.warn("native subject crop miss — will retry, no upscale", { meta: {
-				shmId: frameHandle.shmId,
-				reason: "no-native-cap"
-			} });
+			this.deps.logger.warn("native subject crop miss — will retry, no upscale", {
+				tags: { deviceId },
+				meta: {
+					shmId: frameHandle.shmId,
+					reason: "no-native-cap"
+				}
+			});
 			return null;
 		}
 		try {
@@ -11508,12 +12633,19 @@ var EventMediaDispatcher = class {
 				W: fw,
 				H: fh
 			});
+			const askedAt = Date.now();
 			const slab = await this.deps.getNativeCropJpeg(frameHandle, layout.fetch);
 			if (!slab) {
-				this.deps.logger.warn("native subject crop miss — will retry, no upscale", { meta: {
-					shmId: frameHandle.shmId,
-					reason: "native-miss"
-				} });
+				this.deps.logger.warn("native subject crop miss — will retry, no upscale", {
+					tags: { deviceId },
+					meta: {
+						shmId: frameHandle.shmId,
+						handle: `${frameHandle.shmId}#${frameHandle.slot}#${frameHandle.seq}`,
+						handleNodeId: frameHandle.nodeId,
+						roundTripMs: Date.now() - askedAt,
+						reason: "native-miss"
+					}
+				});
 				return null;
 			}
 			const thumbnail = await composeWideCentralSquareThumbnail(slab, layout);
@@ -11522,10 +12654,14 @@ var EventMediaDispatcher = class {
 				thumbnailSmall: await deriveThumbnailSmall(thumbnail)
 			};
 		} catch (err) {
-			this.deps.logger.warn("native subject crop miss — will retry, no upscale", { meta: {
-				shmId: frameHandle.shmId,
-				error: err instanceof Error ? err.message : String(err)
-			} });
+			this.deps.logger.warn("native subject crop miss — will retry, no upscale", {
+				tags: { deviceId },
+				meta: {
+					shmId: frameHandle.shmId,
+					reason: "threw",
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
 			return null;
 		}
 	}
@@ -13586,37 +14722,7 @@ var AnalyticsQueryFacade = class {
 		}));
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/track-retention-sweep.ts
-/**
-* Periodic track retention sweep (design §6) — the piece that makes retention
-* actually BOUNDED. Without it, `pruneTracksBefore` only runs when something
-* calls it; this sweep ages persisted tracks out on the provider's existing
-* retention interval.
-*
-* `retentionMs` is a PER-DEVICE setting (`trackRetentionDays`, default 7 days;
-* `0` = keep forever → the device is skipped). Enrolled gallery is exempt by the
-* cascade store layer (design §4), not here.
-*
-* Kept as a pure, dependency-injected function so the loop is unit-testable
-* without booting the addon.
-*/
-var DAY_MS = 1440 * 60 * 1e3;
-/** Per-device track retention setting. Default 7 days; 0 = keep forever. */
-var TrackRetentionSettingsSchema = require_dist.object({ trackRetentionDays: require_dist.number().min(0).default(7) });
-var TRACK_RETENTION_DEFAULT_DAYS = TrackRetentionSettingsSchema.parse({}).trackRetentionDays;
-/** Resolve `trackRetentionDays` from a raw per-device store blob — an invalid or
-*  missing value falls back to the default (parse never throws). */
-function resolveTrackRetentionDays(raw) {
-	const parsed = TrackRetentionSettingsSchema.shape.trackRetentionDays.safeParse(raw["trackRetentionDays"]);
-	return parsed.success ? parsed.data : TRACK_RETENTION_DEFAULT_DAYS;
-}
-/** Cutoff timestamp for a retention window. `null` when retention is disabled
-*  (`retentionDays <= 0` → keep forever, the sweep skips the device). */
-function trackRetentionCutoff(nowMs, retentionDays) {
-	if (retentionDays <= 0) return null;
-	return nowMs - retentionDays * DAY_MS;
-}
+var TRACK_RETENTION_DEFAULT_DAYS = require_dist.object({ trackRetentionDays: require_dist.number().min(0).default(7) }).parse({}).trackRetentionDays;
 /**
 * Sweep every device with persisted tracks: skip retention-disabled devices,
 * prune the rest at `now − retentionMs`. Per-device ISOLATED — one bad device
@@ -13627,7 +14733,7 @@ async function sweepTrackRetention(deps) {
 	const nowMs = deps.now();
 	let totalTracks = 0;
 	for (const deviceId of devices) try {
-		const cutoffMs = trackRetentionCutoff(nowMs, await deps.resolveRetentionDays(deviceId));
+		const cutoffMs = await deps.resolveCutoffMs(deviceId, nowMs);
 		if (cutoffMs === null) continue;
 		const counts = await deps.pruneTracksBefore(deviceId, cutoffMs);
 		totalTracks += counts.tracks;
@@ -14192,6 +15298,19 @@ function retagDetectionSections(sections) {
 	} : s);
 }
 /**
+* Re-home the analytics `retention` section onto the recorder's `recording`
+* top-tab (operator ask, 2026-07-29): footage and analytics retention are ONE
+* unified policy since the follow-recordings default, so their controls
+* belong on ONE tab. Same pure-retag mechanism as the detection sections —
+* `DeviceDetail` folds matching-tab sections together, no admin-ui change.
+*/
+function retagRetentionSection(sections) {
+	return sections.map((s) => s.id === "retention" ? {
+		...s,
+		tab: "recording"
+	} : s);
+}
+/**
 * Fields that live ONLY on the global settings page and must never surface in a
 * per-device contribution. The face-recognition `enabled` switch is the GLOBAL
 * master kill for the whole subsystem — per-camera face production is governed
@@ -14370,9 +15489,23 @@ function buildGlobalSettingsSchema() {
 		{
 			id: "retention",
 			title: "Retention",
-			description: "How long analytics history is kept in the SQL store. Media files follow the minimum of these.",
+			description: "How long analytics history (tracks, events, media) is kept. Default: as long as the camera's recordings — one policy for footage and events. The day windows below apply in Custom mode, and as the bound when the camera has no footage.",
 			columns: 3,
 			fields: [
+				{
+					type: "select",
+					key: "retentionMode",
+					label: "Mode",
+					description: "Follow recordings: tracks/events live exactly as long as retained footage (age retention AND disk eviction; never prunes the last 7 days). Custom: the day windows below.",
+					default: "follow-recordings",
+					options: [{
+						value: "follow-recordings",
+						label: "Follow recordings (default)"
+					}, {
+						value: "custom",
+						label: "Custom windows"
+					}]
+				},
 				{
 					type: "number",
 					key: "trackRetentionDays",
@@ -14907,6 +16040,86 @@ async function encodeKeyFrameVariants(native) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/retention-policy.ts
+/**
+* Unified analytics retention policy (storage entity-routing spec, Phase 1).
+*
+* Two modes, per device:
+*
+*  - `follow-recordings` (the DEFAULT): tracks and events live exactly as long
+*    as the camera's retained footage — ONE cutoff, the instant of the oldest
+*    segment still on disk. That follows the recorder's age retention AND its
+*    disk-pressure eviction automatically, with no second policy to keep in
+*    sync. A camera with no footage at all (recording off / brand new) falls
+*    back to the custom day windows below, so analytics stay bounded either
+*    way.
+*
+*  - `custom`: the per-kind day windows (tracks / motion / object / audio),
+*    exactly the pre-unification behaviour — except the knobs are now actually
+*    READ (they were exposed in settings and silently ignored by the sweep,
+*    which used hardcoded 14/30/7).
+*
+* Follow-mode floor: events younger than {@link FOLLOW_FLOOR_DAYS} are never
+* pruned, even when footage is younger (a camera that STARTED recording
+* yesterday must not nuke its whole event history back to the first segment).
+*/
+var DAY_MS = 1440 * 60 * 1e3;
+/** Per-device analytics retention settings as stored in the device blob.
+*  `retentionMode` absent = follow-recordings (the new default). The day
+*  windows keep their historical defaults and double as the no-footage
+*  fallback in follow mode. */
+var RetentionSettingsSchema = require_dist.object({
+	retentionMode: require_dist._enum(["follow-recordings", "custom"]).default("follow-recordings"),
+	trackRetentionDays: require_dist.number().min(0).default(7),
+	retentionMotionDays: require_dist.number().min(1).default(14),
+	retentionObjectDays: require_dist.number().min(1).default(30),
+	retentionAudioDays: require_dist.number().min(1).default(7)
+});
+/** Resolve the settings from a raw device-store blob — invalid or missing
+*  fields fall back to defaults, never throw. */
+function resolveRetentionSettings(raw) {
+	const parsed = RetentionSettingsSchema.safeParse(raw);
+	if (parsed.success) return parsed.data;
+	const shape = RetentionSettingsSchema.shape;
+	const field = (k) => shape[k].safeParse(raw[k]).success ? shape[k].parse(raw[k]) : RetentionSettingsSchema.parse({})[k];
+	return {
+		retentionMode: field("retentionMode"),
+		trackRetentionDays: field("trackRetentionDays"),
+		retentionMotionDays: field("retentionMotionDays"),
+		retentionObjectDays: field("retentionObjectDays"),
+		retentionAudioDays: field("retentionAudioDays")
+	};
+}
+/**
+* Follow-mode cutoff: the oldest retained footage instant, floored so
+* anything younger than {@link FOLLOW_FLOOR_DAYS} survives. `null` footage
+* (none on disk) → `null`, the caller falls back to custom windows.
+*/
+function followCutoffMs(nowMs, earliestFootageMs) {
+	if (earliestFootageMs === null) return null;
+	return Math.min(earliestFootageMs, nowMs - 7 * DAY_MS);
+}
+/** Compute the effective cutoffs for one device at `nowMs`. */
+function resolveRetentionCutoffs(settings, nowMs, earliestFootageMs) {
+	if (settings.retentionMode === "follow-recordings") {
+		const cutoff = followCutoffMs(nowMs, earliestFootageMs);
+		if (cutoff !== null) return {
+			trackCutoffMs: cutoff,
+			motionCutoffMs: cutoff,
+			objectCutoffMs: cutoff,
+			audioCutoffMs: cutoff,
+			effectiveMode: "follow-recordings"
+		};
+	}
+	return {
+		trackCutoffMs: settings.trackRetentionDays <= 0 ? null : nowMs - settings.trackRetentionDays * DAY_MS,
+		motionCutoffMs: nowMs - settings.retentionMotionDays * DAY_MS,
+		objectCutoffMs: nowMs - settings.retentionObjectDays * DAY_MS,
+		audioCutoffMs: nowMs - settings.retentionAudioDays * DAY_MS,
+		effectiveMode: "custom"
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/store/identity-store.ts
 /**
 * IdentityStore — per-person identity registry for face recognition.
@@ -18293,6 +19506,17 @@ var KEY_EVENT_DEFAULT_LIMIT = 50;
 *  Absent / empty / non-string all fall back to the hub default — the exact
 *  narrowing the old raw read applied inline. */
 var PostProcessingNodeIdSchema = require_dist.string().min(1);
+/**
+* Footage-attachment window + geometry, used when the rule states none. The
+* window is CENTRED on the event, so the recipient sees the approach and what
+* followed rather than one side of it.
+*/
+var NC_FOOTAGE_PRE_ROLL_SEC = 3;
+var NC_FOOTAGE_POST_ROLL_SEC = 5;
+var NC_FOOTAGE_MAX_WIDTH = 480;
+var NC_FOOTAGE_FPS = 5;
+/** Per-install HMAC secret behind the signed artifact links (minted once). */
+var NcArtifactSecretSchema = require_dist.string();
 var EmbeddingEnabledSchema = require_dist.boolean();
 var SILENCE_FLOOR_DBFS = -55;
 var RETENTION_SWEEP_INTERVAL_MS = 5 * 6e4;
@@ -18364,6 +19588,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	eventStore = null;
 	/** Events-domain ops-log (footprint/prune/manual-delete audit). Null until onInitialize. */
 	eventsOpsLog = null;
+	/** Event-media relocation engine (entity-routing Phase 4). */
+	mediaRelocate = null;
 	/** Per-camera history of LINKED-device sensor state changes (Part B). */
 	sensorEventStore = null;
 	/** Ingest-side reverse index (sensor device → linked camera ids), TTL-cached
@@ -18422,6 +19648,88 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	retentionSweepTimer = null;
 	/** Handle for the event-media data-plane listener (dispose on shutdown). */
 	eventMediaDataPlane = null;
+	/** The NC artifact plane (signed public links for notification media) and its
+	*  data-plane handle. Null until served / when the facility is absent. */
+	ncArtifactPlane = null;
+	ncArtifactDataPlane = null;
+	/** The operator's marked notification endpoint, or null (AUTO / unavailable). */
+	async markedNotificationEndpoint() {
+		try {
+			return (await this.ctx.api.localNetwork.getNotificationEndpoint.query()).baseUrl ?? void 0;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Serve the NC artifact plane: a PUBLIC route whose authority is the HMAC on
+	* each link (see `notification-center/artifact-url.ts`). It exists because
+	* attachments used to carry BYTES only, and the degrade engine drops a
+	* bytes-only attachment for a url-mode backend — WhatsApp and gotify were
+	* receiving no media at all.
+	*
+	* Best-effort at every step: no facility, no secret or no reachable base URL
+	* ⇒ no plane, and the dispatcher keeps shipping bytes exactly as before.
+	*/
+	async serveNcArtifactPlane() {
+		try {
+			const secretState = this.state("ncArtifactSecret", NcArtifactSecretSchema, "");
+			let secret = await secretState.get();
+			if (secret === "") {
+				secret = (0, node_crypto.randomUUID)().replace(/-/g, "");
+				await secretState.set(secret);
+			}
+			const store = new NcArtifactStore({
+				dir: node_path.default.join(this.ctx.dataDir, "nc-artifacts"),
+				logger: this.ctx.logger.child("nc-artifacts")
+			});
+			await store.start();
+			const plane = new NcArtifactPlane({
+				store,
+				secret,
+				logger: this.ctx.logger.child("nc-artifacts"),
+				routePrefix: `/addon/${this.ctx.id}/nc-artifact`,
+				listEndpoints: async () => collectArtifactEndpoints({
+					markedBaseUrl: await this.markedNotificationEndpoint(),
+					configuredPublicUrl: process.env["CAMSTACK_HUB_PUBLIC_URL"],
+					getConnected: async () => {
+						const status = await this.ctx.api.networkAccess.getStatus.query();
+						this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
+							connected: status.connected,
+							url: status.endpoint?.url ?? null,
+							protocol: status.endpoint?.protocol ?? null
+						} });
+						return status.connected && status.endpoint !== null ? {
+							url: status.endpoint.url,
+							protocol: status.endpoint.protocol
+						} : null;
+					},
+					listExternal: async () => {
+						return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
+							url: e.url,
+							protocol: e.protocol
+						}));
+					},
+					listLan: async (port) => {
+						return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.map((e) => ({
+							baseUrl: e.baseUrl,
+							kind: e.kind,
+							priority: e.priority
+						}));
+					},
+					logger: this.ctx.logger
+				})
+			});
+			this.ncArtifactDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: "nc-artifact",
+				access: "public",
+				handler: plane.handler
+			}) ?? null;
+			this.ncArtifactPlane = this.ncArtifactDataPlane !== null ? plane : null;
+			this.ctx.logger.info("nc-artifact data-plane served", { meta: { served: this.ncArtifactPlane !== null } });
+		} catch (err) {
+			this.ctx.logger.warn("nc-artifact data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
 	/** Public base URL for event thumbnails: `/addon/<addonId>/event-media`.
 	*  Set once the data-plane is registered; null until then (e.g. no
 	*  dataPlane facility in the current environment). */
@@ -18725,12 +20033,19 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-BY0XZAen.js"));
-			storage = new FilesystemStorageProvider(mediaRoot);
+			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-Dwh-F2Zf.js"));
+			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
 		if (!storage) throw new Error("pipeline-analytics requires ctx.kernel.storage");
-		return storage;
+		return createLocationAwareMediaStorage({
+			base: storage,
+			defaultLocation: "eventMedia",
+			resolveRoot: (locationId) => this.ctx.api.storage.resolve.query({
+				location: locationId,
+				relativePath: ""
+			})
+		});
 	}
 	/** Constructs every SQLite-backed store plus the stationary/package-drop/
 	*  sensor plumbing, in the exact pre-S7 order. Returns the non-null bundle
@@ -18778,6 +20093,27 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			logger: logger.child("MediaStore")
 		});
 		this.mediaStore = mediaStore;
+		this.mediaRelocate = new MediaRelocateEngine({
+			store: api.settingsStore,
+			storage,
+			logger: logger.child("MediaRelocate"),
+			now: () => Date.now(),
+			newId: () => (0, node_crypto.randomUUID)(),
+			resolveTargetRoot: (locationId) => api.storage.resolve.query({
+				location: locationId,
+				relativePath: ""
+			}),
+			onFinished: (job) => {
+				this.eventsOpsLog?.append({
+					op: "relocate",
+					reason: "operator",
+					deviceId: job.deviceId,
+					itemsAffected: job.filesMoved,
+					bytesReclaimed: 0,
+					detail: `${job.state}: media → ${job.toLocationId} (${job.bytesMoved} bytes${job.error ? `; ${job.error}` : ""})`
+				});
+			}
+		});
 		const eventStore = new EventStore({
 			store: api.settingsStore,
 			logger: logger.child("EventStore"),
@@ -19023,15 +20359,59 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		this.notificationCenter = new NotificationCenter({
 			store: api.settingsStore,
 			logger: logger.child("NotificationCenter"),
+			listUsers: async () => {
+				return (await api.userManagement.listUsers.query()).map((u) => ({
+					id: u.id,
+					isAdmin: u.isAdmin,
+					allowedDevices: u.allowedDevices
+				}));
+			},
+			getDeviceRoute: async (deviceId) => {
+				const device = await api.deviceManager.getDevice.query({ deviceId });
+				return device === null ? null : {
+					stableId: device.stableId,
+					addonId: device.addonId
+				};
+			},
 			dispatcher: {
+				getZonePolygons: async (deviceId, zoneIds) => {
+					const zones = await api.zones.listZones.query({ deviceId });
+					const wanted = new Set(zoneIds);
+					return zones.filter((z) => wanted.has(z.id) && Array.isArray(z.polygon)).map((z) => (z.polygon ?? []).map((pt) => ({
+						x: pt.x,
+						y: pt.y
+					})));
+				},
+				renderFootage: async (req) => {
+					const res = await api.streamBroker.renderPreBufferClip.mutate({
+						deviceId: req.deviceId,
+						aroundMs: req.aroundMs,
+						format: req.format,
+						preRollSec: req.preRollSec ?? NC_FOOTAGE_PRE_ROLL_SEC,
+						postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC,
+						maxWidth: NC_FOOTAGE_MAX_WIDTH,
+						fps: NC_FOOTAGE_FPS,
+						...req.profile === "high" || req.profile === "mid" || req.profile === "low" ? { profile: req.profile } : {}
+					});
+					const buf = Buffer.from(res.base64, "base64");
+					if (buf.byteLength === 0) return null;
+					const bytes = new Uint8Array(buf.byteLength);
+					bytes.set(buf);
+					return bytes;
+				},
+				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
 				listTargets: async () => {
-					return (await api.notificationOutput.listTargets.query({})).map((t) => ({
-						id: t.id,
-						addonId: t.addonId,
-						name: t.name,
-						kind: t.kind,
-						enabled: t.enabled
-					}));
+					return (await api.notificationOutput.listTargets.query({})).map((t) => {
+						const owner = t.config["ownerUserId"];
+						return {
+							id: t.id,
+							addonId: t.addonId,
+							name: t.name,
+							kind: t.kind,
+							enabled: t.enabled,
+							...typeof owner === "string" && owner.length > 0 ? { ownerUserId: owner } : {}
+						};
+					});
 				},
 				send: async (input) => {
 					const { attachments, ...notification } = input.notification;
@@ -19085,6 +20465,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				handler
 			}) ?? null;
 			this.eventMediaBaseUrl = this.eventMediaDataPlane !== null ? `/addon/${this.ctx.id}/event-media` : null;
+			await this.serveNcArtifactPlane();
 			this.ctx.logger.info("event-media data-plane served", { meta: { baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)" } });
 		} catch (err) {
 			this.ctx.logger.warn("event-media data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
@@ -20729,42 +22110,112 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		if (this.shuttingDown || !this.trackStore) return;
 		await this.trackCloser.sweep();
 	}
+	/** Unified retention (Phase 1): earliest retained footage per device — the
+	*  follow-recordings cutoff source. Cached 10 min: availability answers in
+	*  ~70 ms but the sweep asks once per device per pass. `null` = no footage
+	*  (or recorder unreachable) → the policy falls back to the custom windows. */
+	earliestFootageCache = /* @__PURE__ */ new Map();
+	async earliestFootageMs(deviceId) {
+		const cached = this.earliestFootageCache.get(deviceId);
+		if (cached && Date.now() - cached.at < 10 * 6e4) return cached.value;
+		let value = null;
+		try {
+			const res = await this.ctx.api.recording.getAvailability.query({
+				deviceId,
+				fromMs: 0,
+				toMs: Date.now()
+			});
+			let min = Number.POSITIVE_INFINITY;
+			for (const r of res.ranges) if (r.startMs < min) min = r.startMs;
+			value = Number.isFinite(min) ? min : null;
+		} catch {
+			value = null;
+		}
+		this.earliestFootageCache.set(deviceId, {
+			at: Date.now(),
+			value
+		});
+		return value;
+	}
+	/** The per-device effective cutoffs (mode + footage → numbers). */
+	async deviceRetentionCutoffs(deviceId, nowMs) {
+		const settings = resolveRetentionSettings(await this.ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return resolveRetentionCutoffs(settings, nowMs, settings.retentionMode === "follow-recordings" ? await this.earliestFootageMs(deviceId) : null);
+	}
+	/** The devices one retention pass covers: every camera the hub knows plus
+	*  any device that still has persisted tracks (covers deleted cameras whose
+	*  history must keep aging out). */
+	async retentionDeviceIds() {
+		const ids = /* @__PURE__ */ new Set();
+		try {
+			const all = await this.ctx.api.deviceManager.listAll.query({});
+			for (const d of all) ids.add(d.id);
+		} catch {}
+		try {
+			for (const id of await this.trackStore?.listDeviceIds() ?? []) ids.add(id);
+		} catch {}
+		return [...ids];
+	}
 	async sweepRetention() {
 		if (this.shuttingDown || !this.eventStore || !this.mediaStore) return;
 		const now = Date.now();
 		const day = 1440 * 60 * 1e3;
-		const OBJECT_RETENTION_DAYS = 30;
-		const motionCutoffMs = now - 14 * day;
-		const objectCutoffMs = now - OBJECT_RETENTION_DAYS * day;
-		const audioCutoffMs = now - 7 * day;
 		try {
-			const evicted = await this.eventStore.evictBefore({
-				motionCutoffMs,
-				objectCutoffMs,
-				audioCutoffMs
-			});
-			const evictedIds = [
-				...evicted.motion,
-				...evicted.object,
-				...evicted.audio
-			];
-			if (evictedIds.length > 0) {
-				await this.mediaStore.deleteForEvents(evictedIds);
-				this.ctx.logger.info("analytics event eviction (age sweep)", { meta: {
-					motion: evicted.motion.length,
-					object: evicted.object.length,
-					audio: evicted.audio.length,
-					motionCutoffMs,
-					objectCutoffMs,
-					audioCutoffMs
-				} });
+			const deviceIds = await this.retentionDeviceIds();
+			const evictedIds = [];
+			let minObjectCutoffMs = Number.POSITIVE_INFINITY;
+			for (const deviceId of deviceIds) {
+				if (this.shuttingDown) return;
+				try {
+					const cutoffs = await this.deviceRetentionCutoffs(deviceId, now);
+					if (cutoffs.objectCutoffMs !== null && cutoffs.objectCutoffMs < minObjectCutoffMs) minObjectCutoffMs = cutoffs.objectCutoffMs;
+					if (cutoffs.motionCutoffMs === null && cutoffs.objectCutoffMs === null && cutoffs.audioCutoffMs === null) continue;
+					const evicted = await this.eventStore.evictBefore({
+						deviceId,
+						motionCutoffMs: cutoffs.motionCutoffMs ?? 0,
+						objectCutoffMs: cutoffs.objectCutoffMs ?? 0,
+						audioCutoffMs: cutoffs.audioCutoffMs ?? 0
+					});
+					const ids = [
+						...evicted.motion,
+						...evicted.object,
+						...evicted.audio
+					];
+					if (ids.length > 0) {
+						evictedIds.push(...ids);
+						this.eventsOpsLog?.append({
+							op: "prune",
+							reason: "retention",
+							deviceId,
+							itemsAffected: ids.length,
+							bytesReclaimed: 0,
+							detail: `age sweep (${cutoffs.effectiveMode}): ${evicted.motion.length} motion, ${evicted.object.length} object, ${evicted.audio.length} audio`
+						});
+						this.ctx.logger.info("analytics event eviction (age sweep)", {
+							tags: { deviceId },
+							meta: {
+								motion: evicted.motion.length,
+								object: evicted.object.length,
+								audio: evicted.audio.length,
+								mode: cutoffs.effectiveMode,
+								objectCutoffMs: cutoffs.objectCutoffMs
+							}
+						});
+					}
+				} catch (err) {
+					this.ctx.logger.debug("event retention sweep (device) failed", {
+						tags: { deviceId },
+						meta: { error: String(err) }
+					});
+				}
 			}
-			await this.mediaStore.evictBefore(now - 31 * day);
-			if (this.sensorEventStore) try {
-				const sensorDeleted = await this.sensorEventStore.evictBefore(objectCutoffMs);
+			if (evictedIds.length > 0) await this.mediaStore.deleteForEvents(evictedIds);
+			if (Number.isFinite(minObjectCutoffMs)) await this.mediaStore.evictBefore(minObjectCutoffMs - 1 * day);
+			if (this.sensorEventStore && Number.isFinite(minObjectCutoffMs)) try {
+				const sensorDeleted = await this.sensorEventStore.evictBefore(minObjectCutoffMs);
 				if (sensorDeleted > 0) this.ctx.logger.info("sensor-event retention prune", { meta: {
 					deleted: sensorDeleted,
-					cutoffMs: objectCutoffMs
+					cutoffMs: minObjectCutoffMs
 				} });
 			} catch (err) {
 				this.ctx.logger.debug("sensor-event prune failed", { meta: { error: String(err) } });
@@ -20795,8 +22246,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			} catch (err) {
 				this.ctx.logger.debug("plate buffer prune failed", { meta: { error: String(err) } });
 			}
-			if (this.objectEmbeddingStore) try {
-				const deletedEmbIds = await this.objectEmbeddingStore.pruneAll(objectCutoffMs);
+			if (this.objectEmbeddingStore && Number.isFinite(minObjectCutoffMs)) try {
+				const deletedEmbIds = await this.objectEmbeddingStore.pruneAll(minObjectCutoffMs);
 				if (deletedEmbIds.length > 0) this.ctx.logger.info("object embedding retention prune", { meta: { deleted: deletedEmbIds.length } });
 			} catch (err) {
 				this.ctx.logger.debug("object embedding prune failed", { meta: { error: String(err) } });
@@ -21462,6 +22913,16 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		return this.queryFacade.deleteDeviceEvents(input);
 	}
 	/** The events ops-log rows (newest-first), optionally scoped to one camera. */
+	async relocateMedia(input) {
+		if (!this.mediaRelocate) throw new Error("media relocation unavailable");
+		return { jobId: this.mediaRelocate.start(input) };
+	}
+	async getMediaRelocateStatus() {
+		return this.mediaRelocate?.list() ?? [];
+	}
+	async cancelMediaRelocate(input) {
+		return { cancelled: this.mediaRelocate?.cancel(input.jobId) ?? false };
+	}
 	async listOpsLog(input) {
 		return this.queryFacade.listOpsLog(input);
 	}
@@ -21541,13 +23002,22 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		try {
 			const total = await sweepTrackRetention({
 				listDeviceIds: () => trackStore.listDeviceIds(),
-				resolveRetentionDays: async (deviceId) => {
-					return resolveTrackRetentionDays(await this.ctx?.settings?.readDeviceStore(deviceId) ?? {});
+				resolveCutoffMs: async (deviceId, nowMs) => (await this.deviceRetentionCutoffs(deviceId, nowMs)).trackCutoffMs,
+				pruneTracksBefore: async (deviceId, cutoffMs) => {
+					const counts = await this.pruneTracksBefore({
+						deviceId,
+						cutoffMs
+					});
+					if (counts.tracks > 0) this.eventsOpsLog?.append({
+						op: "prune",
+						reason: "retention",
+						deviceId,
+						itemsAffected: counts.tracks,
+						bytesReclaimed: 0,
+						detail: `track retention cascade: ${counts.tracks} tracks, ${counts.events} events, ${counts.media} media`
+					});
+					return counts;
 				},
-				pruneTracksBefore: (deviceId, cutoffMs) => this.pruneTracksBefore({
-					deviceId,
-					cutoffMs
-				}),
 				now: () => Date.now(),
 				onError: (deviceId, err) => {
 					this.ctx.logger.debug("track retention sweep (device) failed", { meta: {
@@ -21641,7 +23111,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		const raw = await this.ctx?.settings?.readDeviceStore(input.deviceId) ?? {};
 		const baseSections = schema ? require_dist.hydrateSchema({
 			...schema,
-			sections: retagDetectionSections(stripGlobalOnlyFields(toAnalyticsDeviceSections(schema.sections)))
+			sections: retagRetentionSection(retagDetectionSections(stripGlobalOnlyFields(toAnalyticsDeviceSections(schema.sections))))
 		}, raw).sections : [];
 		const liveStatsSection = {
 			id: "live-stats",
@@ -21697,5 +23167,6 @@ exports.default = PipelineAnalyticsAddon;
 exports.ncActions = ncActions;
 exports.pickCleanMedia = pickCleanMedia;
 exports.retagDetectionSections = retagDetectionSections;
+exports.retagRetentionSection = retagRetentionSection;
 exports.stripGlobalOnlyFields = stripGlobalOnlyFields;
 exports.toAnalyticsDeviceSections = toAnalyticsDeviceSections;