@camstack/addon-post-analysis 1.2.23 → 1.2.25

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { A as errMsg, B as number, D as subKindsOf, E as plateGalleryCapability, F as nodePin, H as string, I as _enum, L as array, M as DeviceType, N as createEvent, O as videoclipsCapability, P as hydrateSchema, R as boolean, S as faceGalleryCapability, T as pipelineAnalyticsCapability, U as EventCategory, V as object, _ as buildEventKindDescriptor, a as NC_CONDITION_CATALOG, b as defineCustomActions, c as NcRuleInputSchema, d as NcTaxonomySchema, f as OpsLogEntrySchema, g as audioMetricsCapability, h as addonWidgetsSourceCapability, i as MACRO_LABELS, j as BaseAddon, k as zoneAnalyticsCapability, l as NcRulePatchSchema, m as TimelapseRuleSchema, n as EVENT_KIND_BY_CAP, o as NC_TAXONOMY, p as TimelapseRuleInputSchema, r as EVENT_PAD_MS, s as NcConditionDescriptorSchema, t as DEFAULT_EVENT_COLOR, u as NcRuleSchema, v as cosineSimilarity, w as notificationRulesCapability, y as customAction, z as literal } from "../dist-CRCAv9JV.mjs";
+import { A as subKindsOf, B as array, C as defineCustomActions, D as notificationRulesCapability, F as DeviceType, G as string, H as literal, I as createEvent, K as EventCategory, L as hydrateSchema, M as zoneAnalyticsCapability, N as errMsg, O as pipelineAnalyticsCapability, P as BaseAddon, R as nodePin, S as customAction, T as faceGalleryCapability, U as number, V as boolean, W as object, _ as TimelapseRuleSchema, a as NC_CONDITION_CATALOG, b as buildEventKindDescriptor, c as NcRuleInputSchema, d as NcSnoozeInputSchema, f as NcSnoozeSchema, g as TimelapseRuleInputSchema, h as OpsLogEntrySchema, i as MACRO_LABELS, j as videoclipsCapability, k as plateGalleryCapability, l as NcRulePatchSchema, m as NcTaxonomySchema, n as EVENT_KIND_BY_CAP, o as NC_TAXONOMY, p as NcSnoozeSuppressedSchema, r as EVENT_PAD_MS, s as NcConditionDescriptorSchema, t as DEFAULT_EVENT_COLOR, u as NcRuleSchema, v as addonWidgetsSourceCapability, x as cosineSimilarity, y as audioMetricsCapability, z as _enum } from "../dist-DsCSHZ9N.mjs";
 import { promises } from "node:fs";
 import path from "node:path";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1536,6 +1536,33 @@ function pointInPolygon$1(point, polygon) {
 	}
 	return inside;
 }
+/** Parametric line-segment intersection. Returns intersection point or null. */
+function lineIntersection(a, b) {
+	const dx1 = a.p2.x - a.p1.x;
+	const dy1 = a.p2.y - a.p1.y;
+	const dx2 = b.p2.x - b.p1.x;
+	const dy2 = b.p2.y - b.p1.y;
+	const denom = dx1 * dy2 - dy1 * dx2;
+	if (Math.abs(denom) < 1e-10) return null;
+	const t = ((b.p1.x - a.p1.x) * dy2 - (b.p1.y - a.p1.y) * dx2) / denom;
+	const u = ((b.p1.x - a.p1.x) * dy1 - (b.p1.y - a.p1.y) * dx1) / denom;
+	if (t < 0 || t > 1 || u < 0 || u > 1) return null;
+	return {
+		x: a.p1.x + t * dx1,
+		y: a.p1.y + t * dy1
+	};
+}
+/** Detect tripwire crossing and direction via cross product. */
+function tripwireCrossing(prev, curr, wire) {
+	if (!lineIntersection({
+		p1: prev,
+		p2: curr
+	}, wire)) return null;
+	return {
+		crossed: true,
+		direction: (curr.x - prev.x) * (wire.p2.y - wire.p1.y) - (curr.y - prev.y) * (wire.p2.x - wire.p1.x) > 0 ? "right" : "left"
+	};
+}
 /** Centroid of a bounding box { x, y, w, h } */
 function bboxCentroid(bbox) {
 	return {
@@ -1550,6 +1577,95 @@ function normalizeToPixel(p, width, height) {
 		y: p.y * height
 	};
 }
+var NONE = [];
+/**
+* Which side of the directed line the point is on.
+*
+* Sign of the 2D cross product of the line's own vector with (point − p1):
+* positive is the right-hand side of p1 → p2. Exactly zero means ON the line,
+* which is deliberately its own value: it is neither side, so it can neither
+* confirm nor cancel a crossing.
+*/
+function sideOf(point, wire) {
+	const cross = (wire.p2.x - wire.p1.x) * (point.y - wire.p1.y) - (wire.p2.y - wire.p1.y) * (point.x - wire.p1.x);
+	if (cross > 0) return 1;
+	if (cross < 0) return -1;
+	return 0;
+}
+var TripwireTracker = class {
+	config;
+	/** `trackId` → `wireId` → state. Keyed by track so `forget` is one delete. */
+	tracks = /* @__PURE__ */ new Map();
+	constructor(config = {}) {
+		this.config = {
+			confirmFrames: 2,
+			...config
+		};
+	}
+	/**
+	* Feed one frame's centroid for one track against one wire.
+	*
+	* Returns the crossings CONFIRMED on this frame — usually none. Coordinates
+	* are whatever space the caller uses consistently; the zone geometry is
+	* normalised (0–1), so the frame processor passes normalised centroids.
+	*/
+	observe(trackId, wireId, wire, centroid) {
+		const wires = this.tracks.get(trackId) ?? /* @__PURE__ */ new Map();
+		this.tracks.set(trackId, wires);
+		const side = sideOf(centroid, wire);
+		const state = wires.get(wireId);
+		if (state === void 0) {
+			wires.set(wireId, {
+				last: centroid,
+				confirmedSide: side,
+				pendingSide: side,
+				pendingFrames: 0,
+				sawIntersection: false,
+				pendingDirection: "in"
+			});
+			return NONE;
+		}
+		const crossedNow = tripwireCrossing(state.last, centroid, wire) !== null;
+		state.last = centroid;
+		if (side === 0) return NONE;
+		if (side === state.confirmedSide) {
+			state.pendingSide = side;
+			state.pendingFrames = 0;
+			state.sawIntersection = false;
+			return NONE;
+		}
+		if (side !== state.pendingSide) {
+			state.pendingSide = side;
+			state.pendingFrames = 1;
+			state.sawIntersection = crossedNow;
+			state.pendingDirection = side > 0 ? "in" : "out";
+		} else {
+			state.pendingFrames += 1;
+			state.sawIntersection = state.sawIntersection || crossedNow;
+		}
+		if (state.pendingFrames < this.config.confirmFrames) return NONE;
+		if (!state.sawIntersection) {
+			state.confirmedSide = side;
+			state.pendingFrames = 0;
+			return NONE;
+		}
+		state.confirmedSide = side;
+		state.pendingFrames = 0;
+		state.sawIntersection = false;
+		return [{
+			wireId,
+			direction: state.pendingDirection
+		}];
+	}
+	/** Drop a track. Called when the subject leaves, so state cannot accumulate. */
+	forget(trackId) {
+		this.tracks.delete(trackId);
+	}
+	/** Number of tracks held — a leak check for the caller's tests. */
+	size() {
+		return this.tracks.size;
+	}
+};
 //#endregion
 //#region src/pipeline-analytics/pipeline/tracker/sort-tracker.ts
 var DEFAULT_TRACKER_CONFIG = {
@@ -2238,10 +2354,11 @@ var DetectionEventEmitter = class {
 			const eventType = ZONE_TYPE_TO_EVENT[ze.type];
 			if (!eventType) continue;
 			if (!this.config.enabledTypes.includes(eventType)) continue;
-			const track = trackMap.get(ze.trackId);
+			const present = trackMap.get(ze.trackId);
+			const track = present ?? this.lastKnownTracks.get(ze.trackId);
 			if (!track || track.trackAge < this.config.minTrackAge) continue;
 			const state = stateMap.get(ze.trackId);
-			this.valuedTracks.add(ze.trackId);
+			if (present) this.valuedTracks.add(ze.trackId);
 			events.push({
 				id: `evt-${++eventIdCounter}`,
 				type: eventType,
@@ -2588,6 +2705,19 @@ var FrameProcessor = class {
 	/** Zone crossings per track — the producer of `zone.enter` / `zone.exit`. */
 	zoneTransitions = new ZoneTransitionTracker();
 	/**
+	* Tripwire crossings. Separate from `zoneTransitions` because a tripwire is
+	* a DIRECTED line, not an area: membership is meaningless and the question is
+	* which way the subject went over it.
+	*/
+	tripwires = new TripwireTracker();
+	/**
+	* Last detection seen per track. An edge exit fires for a track that is
+	* ABSENT from the frame, so there is no current detection to attach — this is
+	* the one the subject had when it was last seen. Cleared with the rest of the
+	* per-track caches when the track leaves.
+	*/
+	lastDetectionByTrack = /* @__PURE__ */ new Map();
+	/**
 	* Last zone membership seen per track, so an event for a track that is GONE
 	* this frame still carries the zones it was in. See the use site.
 	*/
@@ -2783,6 +2913,7 @@ var FrameProcessor = class {
 		}
 		this.lastZoneOverlaps = overlapsByTrack;
 		this.lastZoneRejections = rejectedByTrack;
+		for (const td of trackedDetections) this.lastDetectionByTrack.set(td.trackId, td);
 		for (const [trackId, zoneIds] of zonesByTrack) this.lastZonesByTrack.set(trackId, zoneIds);
 		for (const state of objectStates) {
 			if (zonesByTrack.has(state.trackId)) continue;
@@ -2801,16 +2932,58 @@ var FrameProcessor = class {
 				timestamp
 			});
 		};
+		for (const state of objectStates) {
+			if (state.state !== "leaving") continue;
+			const stillInside = this.zoneTransitions.forget(state.trackId);
+			this.tripwires.forget(state.trackId);
+			if (stillInside.length === 0) continue;
+			const last = this.lastDetectionByTrack.get(state.trackId);
+			if (last === void 0) continue;
+			for (const zoneId of stillInside) pushZoneEvent("zone-exit", zoneId, last);
+		}
 		for (const td of trackedDetections) {
 			const crossings = this.zoneTransitions.observe(td.trackId, zonesByTrack.get(td.trackId) ?? []);
 			for (const zoneId of crossings.entered) pushZoneEvent("zone-enter", zoneId, td);
 			for (const zoneId of crossings.exited) pushZoneEvent("zone-exit", zoneId, td);
 		}
+		const wires = this.zones.filter((z) => z.kind === "tripwire" && z.polygon.length >= 2);
+		if (wires.length > 0) for (const td of trackedDetections) {
+			const centroid = bboxCentroid({
+				x: td.bbox.x / frameWidth,
+				y: td.bbox.y / frameHeight,
+				w: td.bbox.w / frameWidth,
+				h: td.bbox.h / frameHeight
+			});
+			for (const zone of wires) {
+				const a = zone.polygon[0];
+				const b = zone.polygon[1];
+				if (a === void 0 || b === void 0) continue;
+				const wire = {
+					p1: {
+						x: a.x,
+						y: a.y
+					},
+					p2: {
+						x: b.x,
+						y: b.y
+					}
+				};
+				for (const cross of this.tripwires.observe(td.trackId, zone.id, wire, centroid)) zoneEvents.push({
+					type: "tripwire-cross",
+					zoneId: zone.id,
+					zoneName: zone.name,
+					trackId: td.trackId,
+					detection: td,
+					direction: cross.direction,
+					timestamp
+				});
+			}
+		}
 		const rawEvents = this.eventEmitter.emit(trackedDetections, objectStates, zoneEvents, [], String(this.deviceId));
 		for (const state of objectStates) {
 			if (state.state !== "leaving") continue;
-			this.zoneTransitions.forget(state.trackId);
 			this.lastZonesByTrack.delete(state.trackId);
+			this.lastDetectionByTrack.delete(state.trackId);
 		}
 		const tracked = trackedDetections.map((td) => {
 			const state = mapObjectStateToTrackState(objectStates.find((o) => o.trackId === td.trackId)?.state);
@@ -2850,9 +3023,9 @@ var FrameProcessor = class {
 			};
 		});
 		const crossingOf = (e) => {
-			const direction = e.type === "zone.enter" ? "enter" : e.type === "zone.exit" ? "exit" : void 0;
-			if (direction === void 0) return void 0;
 			const ze = e.zoneEvents[0];
+			const direction = e.type === "zone.enter" ? "enter" : e.type === "zone.exit" ? "exit" : e.type === "tripwire.cross" ? ze?.direction === "out" ? "exit" : "enter" : void 0;
+			if (direction === void 0) return void 0;
 			if (ze === void 0) return void 0;
 			return {
 				direction,
@@ -4944,6 +5117,29 @@ var NcDispatcher = class {
 			} });
 			return { ok: true };
 		}
+		if (this.deps.snoozeGate !== void 0) {
+			const snoozeId = await this.deps.snoozeGate({
+				ruleId: entry.ruleId,
+				ruleName: entry.payload.ruleName,
+				targetId: target.id,
+				deviceId: entry.deviceId,
+				...target.ownerUserId !== void 0 ? { ownerUserId: target.ownerUserId } : {},
+				at: this.now()
+			});
+			if (snoozeId !== null) {
+				this.deps.logger.info("notification suppressed by snooze", {
+					tags: { deviceId: entry.deviceId },
+					meta: {
+						snoozeId,
+						ruleId: entry.ruleId,
+						targetId: target.id,
+						target: target.name,
+						eventId: entry.recordId
+					}
+				});
+				return { ok: true };
+			}
+		}
 		const notification = await this.buildNotification(entry);
 		try {
 			const result = await this.deps.send({
@@ -4976,6 +5172,81 @@ var NcDispatcher = class {
 			};
 		}
 	}
+	/**
+	* Deliver ONE end-of-window snooze digest to one target.
+	*
+	* Best-effort by design, and the return value says which it was rather than
+	* throwing: the caller marks the window handled either way, because a digest
+	* retried every drain tick for hours is worse than a digest missed once — and
+	* a partially-delivered one must never be re-sent to the targets that already
+	* have it. A failure is logged with the window id, so a missing summary is a
+	* findable line rather than a silence inside a silence.
+	*
+	* The digest carries no media and no `tag`: it is not an event, and tagging
+	* it with a rule id would let a phone collapse it into the very
+	* notifications it is reporting on.
+	*/
+	async deliverDigest(input) {
+		let target;
+		try {
+			target = await this.resolveTarget(input.targetId);
+		} catch (err) {
+			this.deps.logger.warn("snooze digest: target catalog unreachable", { meta: {
+				snoozeId: input.snoozeId,
+				targetId: input.targetId,
+				error: String(err)
+			} });
+			return false;
+		}
+		if (target === null || !target.enabled) {
+			this.deps.logger.warn("snooze digest: target gone or disabled", { meta: {
+				snoozeId: input.snoozeId,
+				targetId: input.targetId
+			} });
+			return false;
+		}
+		try {
+			const result = await this.deps.send({
+				addonId: target.addonId,
+				targetId: target.id,
+				notification: {
+					title: input.title,
+					body: input.body,
+					priority: 2
+				}
+			});
+			if (!result.success) {
+				this.deps.logger.warn("snooze digest send failed", { meta: {
+					snoozeId: input.snoozeId,
+					targetId: target.id,
+					error: result.error
+				} });
+				return false;
+			}
+			this.deps.logger.info("snooze digest delivered", { meta: {
+				snoozeId: input.snoozeId,
+				target: target.name,
+				hidden: input.total
+			} });
+			return true;
+		} catch (err) {
+			this.deps.logger.warn("snooze digest send threw", { meta: {
+				snoozeId: input.snoozeId,
+				targetId: target.id,
+				error: String(err)
+			} });
+			return false;
+		}
+	}
+	/** Device display names for a set of ids, for the digest's lines. */
+	async resolveDeviceNames(deviceIds) {
+		const out = /* @__PURE__ */ new Map();
+		for (const id of new Set(deviceIds)) {
+			const name = await this.deps.getDeviceName(id).catch(() => null);
+			if (name !== null) out.set(id, name);
+		}
+		return out;
+	}
 	async resolveTarget(targetId) {
 		const cached = this.cachedTarget(targetId);
 		if (cached !== null) return cached;
@@ -5094,7 +5365,8 @@ var NcDispatcher = class {
 					format: want.format,
 					...entry.payload.mediaClipPreRollSec !== void 0 ? { preRollSec: entry.payload.mediaClipPreRollSec } : {},
 					...entry.payload.mediaClipPostRollSec !== void 0 ? { postRollSec: entry.payload.mediaClipPostRollSec } : {},
-					...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {}
+					...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {},
+					...entry.payload.mediaClipSpeed !== void 0 ? { speed: entry.payload.mediaClipSpeed } : {}
 				});
 				if (rendered !== null && rendered.byteLength > 0) {
 					const bytes = new Uint8Array(rendered.byteLength);
@@ -6335,6 +6607,474 @@ var NcRuleStore = class {
 	}
 };
 //#endregion
+//#region src/notification-center/snooze-digest.ts
+/** `14:03` in the node's local zone — a digest is read by a person, at home. */
+function clock(ms) {
+	const d = new Date(ms);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+function plural(n, one, many) {
+	return n === 1 ? `1 ${one}` : `${n} ${many}`;
+}
+/**
+* What the window covered, in the words the operator chose it with — the rule's
+* NAME, the camera's name. "a rule was snoozed" tells the reader nothing they
+* could act on.
+*/
+function scopeLabel(snooze, rows, deviceNames) {
+	switch (snooze.scope) {
+		case "all": return "Everything";
+		case "device": {
+			const id = snooze.deviceId;
+			if (id === void 0) return "A camera";
+			return deviceNames.get(id) ?? `Camera ${id}`;
+		}
+		case "rule": {
+			const named = rows.find((r) => r.ruleId === snooze.ruleId);
+			return named !== void 0 ? `“${named.ruleName}”` : "A rule";
+		}
+	}
+}
+/**
+* One digest for ONE target — the counters passed in are already the rows
+* belonging to it, so the message says what THAT destination missed rather
+* than what the household did.
+*
+* Returns null when the window hid nothing: "snooze ended, 0 notifications" is
+* a notification the operator did not need, and sending it for every quiet
+* window is how a summary becomes the noise it was meant to suppress.
+*/
+function buildSnoozeDigest(snooze, rows, deviceNames) {
+	const total = rows.reduce((sum, r) => sum + r.count, 0);
+	if (total === 0) return null;
+	const from = clock(Math.min(...rows.map((r) => r.firstAt)));
+	const to = clock(snooze.expiresAt);
+	const title = `Snooze ended — ${plural(total, "notification", "notifications")} hidden`;
+	const lines = rows.toSorted((a, b) => b.count - a.count || a.ruleName.localeCompare(b.ruleName)).map((r) => {
+		const where = deviceNames.get(r.deviceId) ?? `camera ${r.deviceId}`;
+		return `• ${r.ruleName} on ${where} — ${r.count}`;
+	});
+	return {
+		title,
+		body: [`${scopeLabel(snooze, rows, deviceNames)} was snoozed${snooze.global ? " for everyone" : ""}, ${from}–${to}.`, ...lines].join("\n"),
+		total
+	};
+}
+/** The distinct targets a window owes a digest to. */
+function digestTargets(rows) {
+	return [...new Set(rows.map((r) => r.targetId))];
+}
+//#endregion
+//#region src/notification-center/snooze-policy.ts
+/** How broad a scope is, for choosing between overlapping snoozes. */
+var BREADTH = {
+	rule: 1,
+	device: 2,
+	all: 3
+};
+function covers(entry, q) {
+	if (q.nowMs < entry.startedAt) return false;
+	if (q.nowMs >= entry.expiresAt) return false;
+	if (!entry.global && entry.userId !== q.userId) return false;
+	switch (entry.scope) {
+		case "all": return true;
+		case "rule": return entry.ruleId !== void 0 && entry.ruleId === q.ruleId;
+		case "device": return entry.deviceId !== void 0 && entry.deviceId === q.deviceId;
+	}
+}
+/**
+* The snooze that silences this notification, or null.
+*
+* The BROADEST match wins so one window produces one digest: an "all" snooze
+* overlapping a rule snooze should not leave the recipient two summaries for
+* the same silence.
+*/
+function activeSnoozeFor(entries, q) {
+	let best = null;
+	for (const e of entries) {
+		if (!covers(e, q)) continue;
+		if (best === null || BREADTH[e.scope] > BREADTH[best.scope]) best = e;
+	}
+	return best;
+}
+/**
+* May this caller silence EVERYONE, not just themselves?
+*
+* Global is the only part of a snooze that can affect a person who did not ask
+* for it, so it is never reachable by accident:
+*
+*  - **rule scope** — the rule itself must opt in (`snoozeAllowGlobal`, default
+*    off). That is the gardener case: this rule is known to be noisy for
+*    everybody in a way that is legitimate to silence for everybody.
+*  - **device or whole-feed scope** — there is no rule to carry the opt-in, and
+*    "silence this camera for the household" is an administrative act. Admin
+*    only.
+*
+* A personal snooze needs no permission at all: it silences only its author.
+*/
+function canSetGlobal(req) {
+	if (req.isAdmin) return true;
+	if (req.scope !== "rule") return false;
+	return req.ruleAllowsGlobal === true;
+}
+/** Entries whose window has closed and whose digest has not been sent yet. */
+function dueSummaries(entries, nowMs, alreadySent) {
+	return entries.filter((e) => e.summary && nowMs >= e.expiresAt && !alreadySent.has(e.id));
+}
+//#endregion
+//#region src/notification-center/snooze-store.ts
+/**
+* NcSnoozeStore — the durable half of snooze.
+*
+* Two collections, and the split matters:
+*
+*  - **windows** (`notification-center:snoozes`) — small, mirrored into RAM,
+*    read on the dispatcher's hot path with zero I/O. Refreshed on the drain
+*    tick, so a window opened on the hub takes effect on the evaluating node
+*    within one tick (D8: reconcile, never trust an event to arrive).
+*  - **suppression counters** (`notification-center:snooze-suppressed`) — one
+*    row per (window, target, rule, camera), holding a COUNT and the first/last
+*    instant. Not one row per hidden notification: a snooze exists because
+*    something is noisy, so the row-per-event version of this table is unbounded
+*    exactly when it is used most. The digest reads "42 events, 14:03–17:58",
+*    which is the aggregate anyway.
+*
+* Expiry is never a job here either. Nothing in this file ends a window; the
+* clock does, and {@link NcSnoozeStore.prune} only reclaims rows long after the
+* fact. A prune that never runs delays a digest and wastes a few KB — it can
+* never leave the operator silenced.
+*/
+var NC_SNOOZES_COLLECTION = "notification-center:snoozes";
+var NC_SNOOZE_SUPPRESSED_COLLECTION = "notification-center:snooze-suppressed";
+var NC_SNOOZES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL window (Zod-validated on read); the scalars are projections. */
+	{
+		name: "snooze",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_SNOOZES_INDEXES = [{
+	name: "idx_nc_snoozes_expires",
+	columns: ["expiresAt"]
+}];
+var NC_SNOOZE_SUPPRESSED_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "snoozeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "targetId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ruleId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ruleName",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "count",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "firstAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var NC_SNOOZE_SUPPRESSED_INDEXES = [{
+	name: "idx_nc_snooze_suppressed_snooze",
+	columns: ["snoozeId"]
+}];
+/** How long a closed window's rows survive, for a retried digest and for
+*  "what did I miss" to still answer after a restart. */
+var PRUNE_HORIZON_MS = 6 * 36e5;
+/** Counter key — one row per (window, target, rule, camera). */
+function counterKey(s) {
+	return `${s.snoozeId}|${s.targetId}|${s.ruleId}|${s.deviceId}`;
+}
+var NcSnoozeStore = class {
+	byId = /* @__PURE__ */ new Map();
+	store;
+	logger;
+	now;
+	newId;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.newId = deps.newId ?? (() => randomUUID());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_SNOOZES_COLLECTION,
+			columns: [...NC_SNOOZES_COLUMNS],
+			indexes: [...NC_SNOOZES_INDEXES]
+		});
+		await store.declareCollection.mutate({
+			collection: NC_SNOOZE_SUPPRESSED_COLLECTION,
+			columns: [...NC_SNOOZE_SUPPRESSED_COLUMNS],
+			indexes: [...NC_SNOOZE_SUPPRESSED_INDEXES]
+		});
+	}
+	/**
+	* (Re)hydrate every window. Called at boot and on the drain tick — the table
+	* holds active windows and recently closed ones, so it stays small enough to
+	* read whole. A row whose JSON no longer validates is SKIPPED: a malformed
+	* window must never be able to silence anything.
+	*/
+	async load() {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_SNOOZES_COLLECTION,
+				filter: { limit: 1e3 }
+			});
+			this.byId.clear();
+			let skipped = 0;
+			for (const row of rows) {
+				const parsed = NcSnoozeSchema.safeParse(row.data["snooze"]);
+				if (!parsed.success) {
+					skipped += 1;
+					continue;
+				}
+				this.byId.set(parsed.data.id, parsed.data);
+			}
+			if (skipped > 0) this.logger.warn("snooze rows skipped as malformed — they silence NOTHING", { meta: { skipped } });
+		} catch (err) {
+			this.logger.warn("snooze load failed — keeping the windows already in memory", { meta: { error: String(err) } });
+		}
+	}
+	/** Every known window, newest first. */
+	list() {
+		return [...this.byId.values()].toSorted((a, b) => b.startedAt - a.startedAt);
+	}
+	/** The windows a caller may SEE: their own, plus the global ones that
+	*  silence them. Never another person's private silence. */
+	listVisibleTo(userId, isAdmin) {
+		if (isAdmin) return this.list();
+		return this.list().filter((s) => s.userId === userId || s.global);
+	}
+	get(snoozeId) {
+		return this.byId.get(snoozeId) ?? null;
+	}
+	/** Hot-path read — the window silencing this delivery, or null. */
+	activeFor(query) {
+		return activeSnoozeFor([...this.byId.values()], query);
+	}
+	/**
+	* Open a window. Permission for `global` is the CALLER's problem (see
+	* `canSetGlobal`) — this store persists what it is given, exactly like the
+	* rule store leaves ownership to the bridge action.
+	*/
+	async create(input) {
+		const startedAt = this.now();
+		const snooze = NcSnoozeSchema.parse({
+			id: this.newId(),
+			userId: input.userId,
+			scope: input.scope,
+			...input.ruleId !== void 0 ? { ruleId: input.ruleId } : {},
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			startedAt,
+			expiresAt: startedAt + input.durationMinutes * 6e4,
+			global: input.global,
+			summary: input.summary
+		});
+		await this.persist(snooze);
+		this.byId.set(snooze.id, snooze);
+		return snooze;
+	}
+	/**
+	* End a window NOW by moving its expiry to this instant — never by deleting
+	* it. The digest of what it hid is still owed to whoever opened it, and a
+	* deleted row owes nothing.
+	*/
+	async cancel(snoozeId) {
+		const existing = this.byId.get(snoozeId);
+		if (existing === void 0) return null;
+		const now = this.now();
+		if (existing.expiresAt <= now) return existing;
+		const ended = {
+			...existing,
+			expiresAt: now
+		};
+		await this.persist(ended);
+		this.byId.set(ended.id, ended);
+		return ended;
+	}
+	/**
+	* Record that a window hid one notification. Read-modify-write on the
+	* counter row; best-effort, because losing a line of a SUMMARY must never
+	* cost the suppression decision that produced it.
+	*/
+	async recordSuppressed(s) {
+		const key = counterKey(s);
+		try {
+			const existing = await this.readCounter(key);
+			const next = {
+				snoozeId: s.snoozeId,
+				targetId: s.targetId,
+				ruleId: s.ruleId,
+				ruleName: s.ruleName,
+				deviceId: s.deviceId,
+				count: (existing?.count ?? 0) + 1,
+				firstAt: existing?.firstAt ?? s.at,
+				lastAt: s.at
+			};
+			await this.store.set.mutate({
+				collection: NC_SNOOZE_SUPPRESSED_COLLECTION,
+				key,
+				value: { ...next }
+			});
+		} catch (err) {
+			this.logger.warn("snooze suppression counter write failed (digest will under-report)", {
+				tags: { deviceId: s.deviceId },
+				meta: {
+					snoozeId: s.snoozeId,
+					ruleId: s.ruleId,
+					error: String(err)
+				}
+			});
+		}
+	}
+	/** Windows that have closed and still owe a digest. */
+	dueDigests(nowMs) {
+		const sent = new Set([...this.byId.values()].filter((s) => s.digestSentAt !== void 0).map((s) => s.id));
+		return dueSummaries([...this.byId.values()], nowMs, sent);
+	}
+	/** What one window hid, grouped per target. */
+	async suppressedFor(snoozeId) {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_SNOOZE_SUPPRESSED_COLLECTION,
+				filter: {
+					where: { snoozeId },
+					limit: 1e3
+				}
+			});
+			const out = [];
+			for (const row of rows) {
+				const parsed = NcSnoozeSuppressedSchema.safeParse(row.data);
+				if (parsed.success) out.push(parsed.data);
+			}
+			return out;
+		} catch (err) {
+			this.logger.warn("snooze suppression read failed", { meta: {
+				snoozeId,
+				error: String(err)
+			} });
+			return [];
+		}
+	}
+	/**
+	* Mark a digest as handled.
+	*
+	* Called after the ATTEMPT, not after a success: a digest that cannot be
+	* delivered is not worth retrying every two seconds for six hours, and a
+	* partially-sent one must not be re-sent to the targets that already got it.
+	* The failure is logged with the window id — a missing digest is then a
+	* findable line, not a silence inside a silence.
+	*/
+	async markDigestSent(snoozeId) {
+		const existing = this.byId.get(snoozeId);
+		if (existing === void 0) return;
+		const marked = {
+			...existing,
+			digestSentAt: this.now()
+		};
+		await this.persist(marked);
+		this.byId.set(marked.id, marked);
+	}
+	/**
+	* Drop windows that closed more than {@link PRUNE_HORIZON_MS} ago, and their
+	* counters. Only ever touches CLOSED windows — an active one cannot be
+	* pruned into oblivion by a clock argument.
+	*/
+	async prune(nowMs) {
+		const horizon = nowMs - PRUNE_HORIZON_MS;
+		const stale = [...this.byId.values()].filter((s) => s.expiresAt < horizon);
+		let dropped = 0;
+		for (const s of stale) try {
+			await this.store.deleteWhere.mutate({
+				collection: NC_SNOOZE_SUPPRESSED_COLLECTION,
+				filter: { where: { snoozeId: s.id } }
+			});
+			await this.store.delete.mutate({
+				collection: NC_SNOOZES_COLLECTION,
+				key: s.id
+			});
+			this.byId.delete(s.id);
+			dropped += 1;
+		} catch (err) {
+			this.logger.warn("snooze prune failed", { meta: {
+				snoozeId: s.id,
+				error: String(err)
+			} });
+		}
+		return dropped;
+	}
+	/** `get` returns the stored VALUE, not a `{ id, data }` row. */
+	async readCounter(key) {
+		const value = await this.store.get.query({
+			collection: NC_SNOOZE_SUPPRESSED_COLLECTION,
+			key
+		});
+		const parsed = NcSnoozeSuppressedSchema.safeParse(value);
+		return parsed.success ? parsed.data : null;
+	}
+	async persist(snooze) {
+		await this.store.set.mutate({
+			collection: NC_SNOOZES_COLLECTION,
+			key: snooze.id,
+			value: {
+				userId: snooze.userId,
+				expiresAt: snooze.expiresAt,
+				snooze
+			}
+		});
+	}
+};
+//#endregion
 //#region src/notification-center/timelapse/timelapse-store.ts
 var NC_TIMELAPSE_RULES_COLLECTION = "notification-center:timelapse-rules";
 var NC_TIMELAPSE_RULES_COLUMNS = [
@@ -6696,6 +7436,9 @@ var NotificationCenter = class NotificationCenter {
 	*  snapshots; watched keys are recomputed from the enabled occupancy rules. */
 	occupancyWatcher = new OccupancyWatcher();
 	occupancyStore;
+	/** Snooze windows + what they hid. Mirrored into RAM; the dispatcher's gate
+	*  reads it with no I/O, the drain tick refreshes it. */
+	snoozes;
 	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
 	*  the watcher is idle (zero per-frame cost) otherwise. */
 	occupancyEnabled = false;
@@ -6728,10 +7471,17 @@ var NotificationCenter = class NotificationCenter {
 			store: deps.store,
 			logger: this.logger.child("occupancy")
 		});
+		this.snoozes = new NcSnoozeStore({
+			store: deps.store,
+			logger: this.logger.child("snooze"),
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
 		this.dispatcher = new NcDispatcher({
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
-			isRuleTargetDisabled: (ruleId, targetId) => this.rules.isRuleTargetDisabled(ruleId, targetId)
+			...deps.now !== void 0 ? { now: deps.now } : {},
+			isRuleTargetDisabled: (ruleId, targetId) => this.rules.isRuleTargetDisabled(ruleId, targetId),
+			snoozeGate: (input) => this.snoozeGate(input)
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -6761,6 +7511,7 @@ var NotificationCenter = class NotificationCenter {
 		await NcRuleStore.declare(store);
 		await NcOutbox.declare(store);
 		await OccupancyStore.declare(store);
+		await NcSnoozeStore.declare(store);
 		await TimelapseStore.declare(store);
 	}
 	/**
@@ -6771,6 +7522,7 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	async start(opts) {
 		await this.rules.load();
+		await this.snoozes.load();
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
 		this.evaluationActive = true;
@@ -6999,6 +7751,12 @@ var NotificationCenter = class NotificationCenter {
 					this.logger.debug("getHistory: skipping malformed outbox row", { meta: { id: entry.id } });
 				}
 				return { entries: mapped };
+			},
+			listSnoozes: async ({ caller }) => ({ snoozes: [...this.snoozes.listVisibleTo(caller.userId, caller.isAdmin)] }),
+			createSnooze: async ({ snooze, caller }) => ({ snooze: await this.createSnooze(snooze, caller) }),
+			cancelSnooze: async ({ snoozeId, caller }) => {
+				await this.cancelSnooze(snoozeId, caller);
+				return { success: true };
 			}
 		};
 	}
@@ -7129,6 +7887,7 @@ var NotificationCenter = class NotificationCenter {
 				...rule.media.gif === true ? { mediaGif: true } : {},
 				...rule.media.clip === true ? { mediaClip: true } : {},
 				...rule.media.clipPreRollSec !== void 0 ? { mediaClipPreRollSec: rule.media.clipPreRollSec } : {},
+				...rule.media?.clipSpeed !== void 0 ? { mediaClipSpeed: rule.media.clipSpeed } : {},
 				...rule.media.clipPostRollSec !== void 0 ? { mediaClipPostRollSec: rule.media.clipPostRollSec } : {},
 				...matchedOn !== void 0 && matchedOn.length > 0 ? { matchedOn } : {},
 				...target.params !== void 0 ? { params: target.params } : {},
@@ -7321,9 +8080,127 @@ var NotificationCenter = class NotificationCenter {
 		await this.outbox.setWatermark(now);
 	}
 	async drainTick() {
+		await this.snoozes.load();
 		await this.outbox.drainOnce();
+		await this.deliverDueDigests();
 		this.drainTicks += 1;
-		if (this.drainTicks % WATERMARK_EVERY_TICKS === 0) await this.outbox.setWatermark(this.now());
+		if (this.drainTicks % WATERMARK_EVERY_TICKS === 0) {
+			await this.outbox.setWatermark(this.now());
+			await this.snoozes.prune(this.now());
+		}
+	}
+	/**
+	* The dispatcher's gate: is this delivery silenced, and if so, count it.
+	*
+	* Returns the window's id (the dispatcher logs it) or null. Recording is
+	* awaited rather than fired off so a suppression cannot be lost to a shutdown
+	* between the decision and the row — an under-reported digest is the one
+	* failure of this feature the operator cannot detect.
+	*/
+	async snoozeGate(input) {
+		const active = this.snoozes.activeFor({
+			nowMs: input.at,
+			...input.ownerUserId !== void 0 ? { userId: input.ownerUserId } : {},
+			ruleId: input.ruleId,
+			deviceId: input.deviceId
+		});
+		if (active === null) return null;
+		if (active.summary) await this.snoozes.recordSuppressed({
+			snoozeId: active.id,
+			targetId: input.targetId,
+			ruleId: input.ruleId,
+			ruleName: input.ruleName,
+			deviceId: input.deviceId,
+			at: input.at
+		});
+		return active.id;
+	}
+	/**
+	* Send the summary owed by every window that has closed since the last tick.
+	*
+	* The digest goes exactly where the silenced notifications would have gone —
+	* one per target that was actually suppressed — so it needs no routing of its
+	* own and can never reach someone the snooze never touched.
+	*/
+	async deliverDueDigests() {
+		const due = this.snoozes.dueDigests(this.now());
+		for (const snooze of due) try {
+			const rows = await this.snoozes.suppressedFor(snooze.id);
+			const names = await this.dispatcher.resolveDeviceNames(rows.map((r) => r.deviceId));
+			for (const targetId of digestTargets(rows)) {
+				const digest = buildSnoozeDigest(snooze, rows.filter((r) => r.targetId === targetId), names);
+				if (digest === null) continue;
+				await this.dispatcher.deliverDigest({
+					snoozeId: snooze.id,
+					targetId,
+					title: digest.title,
+					body: digest.body,
+					total: digest.total
+				});
+			}
+			await this.snoozes.markDigestSent(snooze.id);
+		} catch (err) {
+			this.logger.warn("snooze digest tick failed", { meta: {
+				snoozeId: snooze.id,
+				error: String(err)
+			} });
+		}
+	}
+	/** The durable snooze store — the cap provider and the `nc.*` bridge serve
+	*  CRUD from it, the same write-through cache the gate reads. */
+	get snoozeStore() {
+		return this.snoozes;
+	}
+	/**
+	* Open a window on behalf of a caller, with the permission check that makes
+	* `global` safe. Lives here rather than in the store because it needs the
+	* RULE (its `snoozeAllowGlobal` opt-in), and a permission decision that can
+	* silence other people belongs where both halves are visible.
+	*/
+	async createSnooze(input, caller) {
+		if (input.scope === "rule" && input.ruleId === void 0) throw new Error("a rule snooze needs a ruleId");
+		if (input.scope === "device" && input.deviceId === void 0) throw new Error("a camera snooze needs a deviceId");
+		const wantsGlobal = input.global === true;
+		if (wantsGlobal) {
+			const rule = input.ruleId !== void 0 ? this.rules.get(input.ruleId) : null;
+			if (!canSetGlobal({
+				scope: input.scope,
+				...rule !== null ? { ruleAllowsGlobal: rule.snoozeAllowGlobal === true } : {},
+				isAdmin: caller.isAdmin
+			})) throw new Error("forbidden: this snooze may not be made global");
+		}
+		const snooze = await this.snoozes.create({
+			userId: caller.userId,
+			scope: input.scope,
+			...input.ruleId !== void 0 ? { ruleId: input.ruleId } : {},
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			durationMinutes: input.durationMinutes,
+			global: wantsGlobal,
+			summary: input.summary !== false
+		});
+		this.logger.info("snooze opened", {
+			...snooze.deviceId !== void 0 ? { tags: { deviceId: snooze.deviceId } } : {},
+			meta: {
+				snoozeId: snooze.id,
+				scope: snooze.scope,
+				by: caller.userId,
+				global: snooze.global,
+				minutes: input.durationMinutes,
+				...snooze.ruleId !== void 0 ? { ruleId: snooze.ruleId } : {}
+			}
+		});
+		return snooze;
+	}
+	/** End a window early. A user may end their own; an admin may end any. */
+	async cancelSnooze(snoozeId, caller) {
+		const existing = this.snoozes.get(snoozeId);
+		if (existing === null) throw new Error(`snooze not found: ${snoozeId}`);
+		if (!caller.isAdmin && existing.userId !== caller.userId) throw new Error(`forbidden: snooze not owned: ${snoozeId}`);
+		await this.snoozes.cancel(snoozeId);
+		this.logger.info("snooze cancelled", { meta: {
+			snoozeId,
+			by: caller.userId
+		} });
 	}
 	/** The "at least one addressee" invariant lives here, not in Zod: the
 	*  schema allows empty `targets` (a users-only rule) and a cross-field
@@ -7440,6 +8317,21 @@ var ncActions = defineCustomActions({
 	}), object({ success: literal(true) }), {
 		kind: "mutation",
 		caller: "required"
+	}),
+	/**
+	* Snooze, from the phone — the surface that matters most for this feature,
+	* because "silence this until morning" is a thing you press in bed, not at a
+	* desk. Scoped to the caller: their own windows plus the global ones that
+	* silence them.
+	*/
+	"nc.listSnoozes": customAction(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }),
+	"nc.createSnooze": customAction(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	"nc.cancelSnooze": customAction(object({ snoozeId: string() }), object({ success: literal(true) }), {
+		kind: "mutation",
+		caller: "required"
 	})
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
@@ -7532,6 +8424,28 @@ function makeNcActionHandlers(deps) {
 			} });
 			return { success: true };
 		},
+		"nc.listSnoozes": async (_input, caller) => {
+			const c = requireCaller(caller);
+			return { snoozes: [...deps.snooze.list(c.userId, c.isAdmin)] };
+		},
+		"nc.createSnooze": async (input, caller) => {
+			const c = requireCaller(caller);
+			const parsed = NcSnoozeInputSchema.parse(input.snooze);
+			if (parsed.ruleId !== void 0) assertRuleVisible(parsed.ruleId, c);
+			const snooze = await deps.snooze.create(parsed, c);
+			deps.logger.info("nc snooze opened", { meta: {
+				snoozeId: snooze.id,
+				scope: snooze.scope,
+				by: c.userId,
+				global: snooze.global
+			} });
+			return { snooze };
+		},
+		"nc.cancelSnooze": async (input, caller) => {
+			const c = requireCaller(caller);
+			await deps.snooze.cancel(input.snoozeId, c);
+			return { success: true };
+		},
 		"nc.setRuleTargetEnabled": async (input, caller) => {
 			const c = requireCaller(caller);
 			assertRuleVisible(input.ruleId, c);
@@ -11142,6 +12056,54 @@ var EventStore = class {
 			});
 		}
 	}
+	/**
+	* Collect the ids matching `filter`, then delete every matching row in ONE
+	* statement. The shared body of every retention sweep here.
+	*
+	* The ids are still read because the callers delete each event's media in
+	* lockstep and a bulk delete returns only a count. What is gone is the
+	* per-row delete loop: ~7,200 round trips to prune a day of motion events,
+	* each carrying every column of the row it deleted.
+	*
+	* Three properties, each of which cost a red test to learn:
+	*
+	*  - **the filter is used for BOTH halves**, so what is reported and what is
+	*    removed cannot drift apart;
+	*  - **paging carries an explicit offset over ROWS READ.** Deleting each page
+	*    used to advance the cursor implicitly; reading without deleting re-reads
+	*    page one forever. And a row with a non-string id yields no id but still
+	*    occupies a place, so ids collected is the wrong cursor;
+	*  - **only an EMPTY page ends the scan.** The store caps pages on its own
+	*    (~500), so "fewer rows than requested" is normal, not the end — treating
+	*    it as the end silently deletes just the first page while reporting a
+	*    complete sweep;
+	*  - **a delete that removed nothing reports NO ids.** Callers remove media
+	*    against this list; claiming a deletion that did not happen would orphan
+	*    media in the opposite direction.
+	*/
+	async drainMatching(collection, filter) {
+		const ids = [];
+		let offset = 0;
+		for (;;) {
+			const rows = await this.store.query.query({
+				collection,
+				filter: {
+					...filter,
+					limit: 500,
+					offset
+				}
+			});
+			if (rows.length === 0) break;
+			offset += rows.length;
+			for (const row of rows) if (typeof row.id === "string") ids.push(row.id);
+		}
+		if (ids.length === 0) return ids;
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection,
+			filter
+		});
+		return deleted === 0 ? [] : ids;
+	}
 	buildFilter(q) {
 		const filter = {
 			where: { deviceId: q.deviceId },
@@ -11462,35 +12424,10 @@ var EventStore = class {
 	* page at a time (PRUNE_PAGE_SIZE) until no stale rows remain.
 	*/
 	async evictBefore(params) {
-		const batch = async (collection, cutoffMs) => {
-			const ids = [];
-			for (;;) {
-				const rows = await this.store.query.query({
-					collection,
-					filter: {
-						...params.deviceId !== void 0 ? { where: { deviceId: params.deviceId } } : {},
-						whereBetween: { timestamp: [0, cutoffMs] },
-						limit: 500
-					}
-				});
-				if (rows.length === 0) break;
-				let deletedInPage = 0;
-				for (const row of rows) {
-					const id = row.id;
-					if (typeof id !== "string") continue;
-					try {
-						await this.store.delete.mutate({
-							collection,
-							key: id
-						});
-						ids.push(id);
-						deletedInPage++;
-					} catch {}
-				}
-				if (deletedInPage === 0) break;
-			}
-			return ids;
-		};
+		const batch = async (collection, cutoffMs) => this.drainMatching(collection, {
+			...params.deviceId !== void 0 ? { where: { deviceId: params.deviceId } } : {},
+			whereBetween: { timestamp: [0, cutoffMs] }
+		});
 		return {
 			motion: await batch(MOTION_EVENTS_COLLECTION, params.motionCutoffMs),
 			object: await batch(OBJECT_EVENTS_COLLECTION, params.objectCutoffMs),
@@ -11513,35 +12450,16 @@ var EventStore = class {
 	* so ALL matching rows are deleted regardless of total count.
 	*/
 	async pruneBefore(input) {
-		const allForDevice = async (collection) => {
-			const ids = [];
-			for (;;) {
-				const rows = await this.store.query.query({
-					collection,
-					filter: {
-						where: { deviceId: input.deviceId },
-						whereBetween: { timestamp: [0, input.cutoffMs - 1] },
-						limit: 500
-					}
-				});
-				if (rows.length === 0) break;
-				let deletedInPage = 0;
-				for (const row of rows) {
-					const id = row.id;
-					if (typeof id !== "string") continue;
-					try {
-						await this.store.delete.mutate({
-							collection,
-							key: id
-						});
-						ids.push(id);
-						deletedInPage++;
-					} catch {}
-				}
-				if (deletedInPage === 0) break;
-			}
-			return ids;
+		/**
+		* The filter is written ONCE and used for both halves below, so the rows
+		* reported and the rows deleted cannot drift apart. Inclusive `[0, cutoff-1]`
+		* → selects timestamps strictly < `cutoffMs`.
+		*/
+		const staleForDevice = {
+			where: { deviceId: input.deviceId },
+			whereBetween: { timestamp: [0, input.cutoffMs - 1] }
 		};
+		const allForDevice = async (collection) => this.drainMatching(collection, staleForDevice);
 		const [motionIds, objectIds, audioIds] = await Promise.all([
 			allForDevice(MOTION_EVENTS_COLLECTION),
 			allForDevice(OBJECT_EVENTS_COLLECTION),
@@ -11856,6 +12774,37 @@ var OpsLogStore = class {
 		}
 		return out;
 	}
+	/**
+	* Delete audit entries older than `cutoffMs`. Returns how many went.
+	*
+	* The audit log is the one collection that records everyone else's
+	* retention and had none of its own — it grows monotonically for the life of
+	* the node (11,519 rows on the operator's hub before this existed).
+	*
+	* ONE statement, not a select-then-delete drain: `deleteWhere` is exactly
+	* the bulk path that removed the N+1 loops from every other retention path.
+	* `whereBetween` on `at` is inclusive, so `[0, cutoffMs - 1]` selects
+	* strictly-older rows — the same boundary `EventStore.pruneBefore` uses.
+	*
+	* BEST-EFFORT, like `append`: a failed audit trim must never fail the
+	* retention sweep that called it. It warns rather than throwing, because a
+	* trim that silently does nothing is how a table gets to 11,519 rows.
+	*/
+	async pruneBefore(cutoffMs) {
+		try {
+			const { deleted } = await this.store.deleteWhere.mutate({
+				collection: OPS_LOG_COLLECTION,
+				filter: { whereBetween: { at: [0, cutoffMs - 1] } }
+			});
+			return deleted;
+		} catch (err) {
+			this.logger.warn("ops-log: prune failed — the audit log will keep growing", { meta: {
+				cutoffMs,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return 0;
+		}
+	}
 };
 /** SQLite stores nullable columns as `null`; the row schema uses `.nullable()`
 *  for deviceId/detail (accepts null) but drop any stray null on required
@@ -20331,6 +21280,12 @@ var NcArtifactSecretSchema = string();
 var EmbeddingEnabledSchema = boolean();
 var SILENCE_FLOOR_DBFS = -55;
 var RETENTION_SWEEP_INTERVAL_MS = 5 * 6e4;
+/**
+* How long the events ops-log is kept. 30 days: long enough to answer "what
+* deleted my footage last month", short enough that the audit never becomes
+* the largest thing the node stores.
+*/
+var OPS_LOG_RETENTION_MS = 720 * 60 * 6e4;
 /** Throttle for the "overlay synthesis failed" warn — one line / minute / device. */
 var OVERLAY_SYNTHESIS_WARN_THROTTLE_MS = 6e4;
 var AUDIO_EVENT_HEARTBEAT_MS = 5e3;
@@ -20844,6 +21799,11 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		return makeNcActionHandlers({
 			ruleStore: center.ruleStore,
 			logger: this.ctx.logger.child("nc-actions"),
+			snooze: {
+				list: (userId, isAdmin) => center.snoozeStore.listVisibleTo(userId, isAdmin),
+				create: (input, caller) => center.createSnooze(input, caller),
+				cancel: (snoozeId, caller) => center.cancelSnooze(snoozeId, caller)
+			},
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
 			}
@@ -21256,6 +22216,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC,
 						maxWidth: NC_FOOTAGE_MAX_WIDTH,
 						fps: NC_FOOTAGE_FPS,
+						...req.speed !== void 0 ? { speed: req.speed } : {},
 						...req.profile === "high" || req.profile === "mid" || req.profile === "low" ? { profile: req.profile } : {}
 					});
 					const buf = Buffer.from(res.base64, "base64");
@@ -21413,6 +22374,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			this.sweepRetention();
 			this.runTrackRetentionSweep();
 			this.stationaryRegistry?.sweep(Date.now());
+			this.eventsOpsLog?.pruneBefore(Date.now() - OPS_LOG_RETENTION_MS);
 		}, RETENTION_SWEEP_INTERVAL_MS);
 	}
 	/** Cap provider registrations returned from `onInitialize` — the widgets