@camstack/addon-provider-ecowitt 0.1.11 → 0.1.13

package/dist/addon.js

@@ -4645,7 +4645,7 @@ function preprocess(fn, schema) {
 	});
 }
 //#endregion
-//#region ../types/dist/sleep-C2M2zF7x.mjs
+//#region ../types/dist/sleep-MHm--th-.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5907,6 +5907,7 @@ var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
 	"pull-http",
+	"pull-flv",
 	"pull-rfc4571",
 	"push-annexb",
 	"derived"
@@ -7066,7 +7067,21 @@ var StorageLocationDeclarationSchema = object({
 	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
 	* configure the primary location.
 	*/
-	defaultsTo: string().optional()
+	defaultsTo: string().optional(),
+	/**
+	* Which node root the seeded `<id>:default` instance is placed under on a
+	* FRESH install:
+	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
+	*   the appData volume. Right for small/durable data (backups, logs, models).
+	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
+	*   env is set, else falls back to the data root. Right for bulky, hot media
+	*   (recordings, event media) that should stay off the appData disk.
+	*
+	* Only affects the seeded default's `basePath`; operators can repoint any
+	* location afterwards, and a `defaultsTo` slot inherits its parent's root
+	* regardless of this field. Absent (the common case) is treated as `'data'`.
+	*/
+	defaultRoot: _enum(["data", "media"]).optional()
 });
 var DecoderStatsSchema = object({
 	inputFps: number(),
@@ -8422,6 +8437,10 @@ var RtspRestreamEntrySchema = object({
 var BrokerRtspClientSchema = object({
 	sessionId: string(),
 	remoteAddr: string(),
+	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
+	*  null/absent when the client sent none. Lets the UI label a consumer by
+	*  purpose. Optional so a client built against an older schema stays valid. */
+	userAgent: string().nullish(),
 	playing: boolean(),
 	muted: boolean(),
 	connectedAt: number(),
@@ -16025,7 +16044,7 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema = discriminatedUnion("ok", [object({
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
 	ok: literal(true),
 	latencyMs: number()
 }), object({
@@ -16048,7 +16067,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -16082,23 +16101,198 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: number().optional()
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-method(object({
-	title: string(),
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
 	body: string(),
-	imageUrl: string().optional(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	priority: _enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	]).default("normal"),
 	metadata: record(string(), unknown()).optional()
-}), _void(), { kind: "mutation" }), method(_void(), object({
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
 	success: boolean(),
-	error: string().optional()
-}), { kind: "mutation" });
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -22093,13 +22287,49 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationOutput.deleteTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationOutput.discoverTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargetKinds": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"notificationOutput.sendTest": {
+	"notificationOutput.setTargetEnabled": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.testTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.upsertTarget": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
@@ -30072,22 +30302,23 @@ function slugifyHost(value) {
 }
 /**
 * Extra per-scan inputs for Ecowitt network discovery. Mirrors Gree's scan form. On a flat network,
-* leave blank to sweep the addon node's local subnet. Gateways on ANOTHER subnet usually can't be
-* reached by a directed broadcast (most routers don't forward it) — enter the gateway's IP instead:
-* the `CMD_BROADCAST` probe answers a unicast just as well and returns the gateway's identity.
+* leave blank to sweep the addon node's local subnet. To reach gateways on OTHER subnets, list one or
+* more directed broadcast addresses, gateway IPs, or CIDRs (comma / newline separated) — each is
+* swept independently and the responders are merged. A directed broadcast (e.g. 192.168.20.255) or a
+* unicast gateway IP both work because the `CMD_BROADCAST` probe answers a unicast just as well.
 */
 function buildDiscoveryParamsFormSchema() {
 	return { sections: [{
 		id: "scan",
 		title: "Scan options",
-		description: "Leave empty to scan the local subnet. To find a gateway on a different subnet, enter that subnet’s broadcast address (e.g. 192.168.20.255) or the gateway’s IP directly (e.g. 192.168.20.181).",
+		description: "Leave empty to scan the local subnet. To scan other subnets, list their broadcast addresses (e.g. 192.168.20.255), gateway IPs (e.g. 192.168.20.181), or CIDRs (e.g. 192.168.20.0/24) — comma or newline separated. Each subnet is swept independently and unreachable ones are skipped.",
 		columns: 1,
 		fields: [{
 			type: "text",
 			key: "broadcastAddress",
-			label: "Broadcast address or gateway IP",
+			label: "Broadcast addresses / gateway IPs / CIDRs",
 			required: false,
-			placeholder: "192.168.20.255"
+			placeholder: "192.168.20.255, 192.168.30.0/24"
 		}, {
 			type: "number",
 			key: "timeoutMs",
@@ -30240,6 +30471,111 @@ var EcowittIntegrationManager = class {
 	}
 };
 //#endregion
+//#region src/ecowitt-network-scan.ts
+/** Strict dotted-quad IPv4 octet (0–255), no leading-zero ambiguity beyond what routers accept. */
+function parseOctet(token) {
+	if (!/^\d{1,3}$/.test(token)) return null;
+	const n = Number(token);
+	return n >= 0 && n <= 255 ? n : null;
+}
+/** Parse a dotted-quad into its four octets, or null when malformed. */
+function parseIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return null;
+	const octets = parts.map(parseOctet);
+	if (octets.some((o) => o === null)) return null;
+	return [
+		octets[0],
+		octets[1],
+		octets[2],
+		octets[3]
+	];
+}
+/**
+* Convert an IPv4 CIDR (e.g. `192.168.20.0/24`) into its directed broadcast address
+* (`192.168.20.255`) — the address `Ecowitt.discover` sweeps to reach a foreign subnet. Returns
+* `null` for anything that is not a well-formed IPv4 CIDR (a bare IP, garbage, or an out-of-range
+* prefix), so the caller can treat the input as a literal broadcast/gateway address instead.
+*/
+function cidrToBroadcast(value) {
+	const slash = value.indexOf("/");
+	if (slash < 0) return null;
+	const ip = parseIpv4(value.slice(0, slash));
+	const prefixToken = value.slice(slash + 1);
+	if (ip === null || !/^\d{1,2}$/.test(prefixToken)) return null;
+	const prefix = Number(prefixToken);
+	if (prefix < 0 || prefix > 32) return null;
+	const broadcast = ((ip[0] << 24 | ip[1] << 16 | ip[2] << 8 | ip[3]) >>> 0 | (prefix === 0 ? 4294967295 : 4294967295 >>> prefix >>> 0)) >>> 0;
+	return [
+		broadcast >>> 24 & 255,
+		broadcast >>> 16 & 255,
+		broadcast >>> 8 & 255,
+		broadcast & 255
+	].join(".");
+}
+/**
+* Parse the operator scan input into a de-duplicated, ordered list of directed broadcast targets.
+*
+* Accepts a free-form string of comma / newline / whitespace separated tokens where each token is
+* either a broadcast address (`192.168.20.255`), a bare gateway IP (`192.168.20.181` — the
+* `CMD_BROADCAST` probe answers a unicast too), or a CIDR (`192.168.20.0/24`, expanded to its
+* directed broadcast). Blank input yields an empty list, meaning "sweep the local subnet only".
+* Invalid tokens are dropped rather than throwing — discovery input is best-effort.
+*/
+function parseBroadcastTargets(raw) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const rawToken of raw.split(/[\s,]+/)) {
+		const token = rawToken.trim();
+		if (token.length === 0) continue;
+		const target = token.includes("/") ? cidrToBroadcast(token) : parseIpv4(token) ? token : null;
+		if (target === null || seen.has(target)) continue;
+		seen.add(target);
+		out.push(target);
+	}
+	return out;
+}
+/** Deterministic dedup key for a discovered gateway — MAC is the physical identity. */
+function gatewayKey(gateway) {
+	return gateway.mac.trim().toLowerCase() || gateway.ip;
+}
+/**
+* Cross-subnet Ecowitt discovery: run one {@link EcowittDiscoverFn} sweep per target subnet (or a
+* single local sweep when there are no targets), then merge the responders de-duplicated by MAC.
+*
+* Every sweep runs independently and its failure (an unreachable subnet, a router that drops the
+* directed broadcast, a socket error) is isolated via `onError` — a single bad subnet never fails the
+* whole scan. Sweeps run concurrently; results are flattened in target order so the merged output is
+* stable regardless of which subnet answers first.
+*/
+async function scanEcowittGateways(input) {
+	const { discover, targets, timeoutMs, onError } = input;
+	const timeoutOpt = timeoutMs !== void 0 ? { timeoutMs } : {};
+	if (targets.length === 0) try {
+		return [...await discover({ ...timeoutOpt })];
+	} catch (error) {
+		onError?.("local", error);
+		return [];
+	}
+	const settled = await Promise.all(targets.map(async (broadcastAddr) => {
+		try {
+			return await discover({
+				broadcastAddr,
+				...timeoutOpt
+			});
+		} catch (error) {
+			onError?.(broadcastAddr, error);
+			return [];
+		}
+	}));
+	const merged = /* @__PURE__ */ new Map();
+	for (const batch of settled) for (const gateway of batch) {
+		const key = gatewayKey(gateway);
+		if (!merged.has(key)) merged.set(key, gateway);
+	}
+	return [...merged.values()];
+}
+//#endregion
 //#region src/ecowitt-gateway.ts
 /**
 * Per-gateway registry that device classes use to reach the live {@link Ecowitt}
@@ -31259,15 +31595,23 @@ var EcowittProviderAddon = class extends BaseDeviceProvider {
 		return buildDiscoveryParamsFormSchema();
 	}
 	async discoverDevices(input) {
-		const broadcastAddr = typeof input?.params?.["broadcastAddress"] === "string" ? input.params["broadcastAddress"].trim() : "";
+		const rawTargets = typeof input?.params?.["broadcastAddress"] === "string" ? input.params["broadcastAddress"] : "";
 		const timeoutMs = typeof input?.params?.["timeoutMs"] === "number" ? input.params["timeoutMs"] : void 0;
-		const gateways = await Ecowitt.discover({
-			...broadcastAddr.length > 0 ? { broadcastAddr } : {},
-			...timeoutMs !== void 0 ? { timeoutMs } : {}
+		const targets = parseBroadcastTargets(rawTargets);
+		const gateways = await scanEcowittGateways({
+			discover: (opts) => Ecowitt.discover(opts),
+			targets,
+			...timeoutMs !== void 0 ? { timeoutMs } : {},
+			onError: (target, error) => {
+				this.ctx.logger.warn("Ecowitt subnet sweep failed — skipping", { meta: {
+					target,
+					error: errMsg(error)
+				} });
+			}
 		});
 		this.ctx.logger.info("Ecowitt discovery complete", { meta: {
 			count: gateways.length,
-			broadcastAddr: broadcastAddr.length > 0 ? broadcastAddr : "local"
+			subnets: targets.length > 0 ? targets : "local"
 		} });
 		return gateways.map((g) => {
 			const displayName = g.model ?? g.name;

package/dist/addon.mjs

@@ -4644,7 +4644,7 @@ function preprocess(fn, schema) {
 	});
 }
 //#endregion
-//#region ../types/dist/sleep-C2M2zF7x.mjs
+//#region ../types/dist/sleep-MHm--th-.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5906,6 +5906,7 @@ var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
 	"pull-http",
+	"pull-flv",
 	"pull-rfc4571",
 	"push-annexb",
 	"derived"
@@ -7065,7 +7066,21 @@ var StorageLocationDeclarationSchema = object({
 	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
 	* configure the primary location.
 	*/
-	defaultsTo: string().optional()
+	defaultsTo: string().optional(),
+	/**
+	* Which node root the seeded `<id>:default` instance is placed under on a
+	* FRESH install:
+	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
+	*   the appData volume. Right for small/durable data (backups, logs, models).
+	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
+	*   env is set, else falls back to the data root. Right for bulky, hot media
+	*   (recordings, event media) that should stay off the appData disk.
+	*
+	* Only affects the seeded default's `basePath`; operators can repoint any
+	* location afterwards, and a `defaultsTo` slot inherits its parent's root
+	* regardless of this field. Absent (the common case) is treated as `'data'`.
+	*/
+	defaultRoot: _enum(["data", "media"]).optional()
 });
 var DecoderStatsSchema = object({
 	inputFps: number(),
@@ -8421,6 +8436,10 @@ var RtspRestreamEntrySchema = object({
 var BrokerRtspClientSchema = object({
 	sessionId: string(),
 	remoteAddr: string(),
+	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
+	*  null/absent when the client sent none. Lets the UI label a consumer by
+	*  purpose. Optional so a client built against an older schema stays valid. */
+	userAgent: string().nullish(),
 	playing: boolean(),
 	muted: boolean(),
 	connectedAt: number(),
@@ -16024,7 +16043,7 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema = discriminatedUnion("ok", [object({
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
 	ok: literal(true),
 	latencyMs: number()
 }), object({
@@ -16047,7 +16066,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -16081,23 +16100,198 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: number().optional()
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-method(object({
-	title: string(),
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
 	body: string(),
-	imageUrl: string().optional(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	priority: _enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	]).default("normal"),
 	metadata: record(string(), unknown()).optional()
-}), _void(), { kind: "mutation" }), method(_void(), object({
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
 	success: boolean(),
-	error: string().optional()
-}), { kind: "mutation" });
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -22092,13 +22286,49 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationOutput.deleteTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationOutput.discoverTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargetKinds": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"notificationOutput.sendTest": {
+	"notificationOutput.setTargetEnabled": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.testTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.upsertTarget": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
@@ -30071,22 +30301,23 @@ function slugifyHost(value) {
 }
 /**
 * Extra per-scan inputs for Ecowitt network discovery. Mirrors Gree's scan form. On a flat network,
-* leave blank to sweep the addon node's local subnet. Gateways on ANOTHER subnet usually can't be
-* reached by a directed broadcast (most routers don't forward it) — enter the gateway's IP instead:
-* the `CMD_BROADCAST` probe answers a unicast just as well and returns the gateway's identity.
+* leave blank to sweep the addon node's local subnet. To reach gateways on OTHER subnets, list one or
+* more directed broadcast addresses, gateway IPs, or CIDRs (comma / newline separated) — each is
+* swept independently and the responders are merged. A directed broadcast (e.g. 192.168.20.255) or a
+* unicast gateway IP both work because the `CMD_BROADCAST` probe answers a unicast just as well.
 */
 function buildDiscoveryParamsFormSchema() {
 	return { sections: [{
 		id: "scan",
 		title: "Scan options",
-		description: "Leave empty to scan the local subnet. To find a gateway on a different subnet, enter that subnet’s broadcast address (e.g. 192.168.20.255) or the gateway’s IP directly (e.g. 192.168.20.181).",
+		description: "Leave empty to scan the local subnet. To scan other subnets, list their broadcast addresses (e.g. 192.168.20.255), gateway IPs (e.g. 192.168.20.181), or CIDRs (e.g. 192.168.20.0/24) — comma or newline separated. Each subnet is swept independently and unreachable ones are skipped.",
 		columns: 1,
 		fields: [{
 			type: "text",
 			key: "broadcastAddress",
-			label: "Broadcast address or gateway IP",
+			label: "Broadcast addresses / gateway IPs / CIDRs",
 			required: false,
-			placeholder: "192.168.20.255"
+			placeholder: "192.168.20.255, 192.168.30.0/24"
 		}, {
 			type: "number",
 			key: "timeoutMs",
@@ -30239,6 +30470,111 @@ var EcowittIntegrationManager = class {
 	}
 };
 //#endregion
+//#region src/ecowitt-network-scan.ts
+/** Strict dotted-quad IPv4 octet (0–255), no leading-zero ambiguity beyond what routers accept. */
+function parseOctet(token) {
+	if (!/^\d{1,3}$/.test(token)) return null;
+	const n = Number(token);
+	return n >= 0 && n <= 255 ? n : null;
+}
+/** Parse a dotted-quad into its four octets, or null when malformed. */
+function parseIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return null;
+	const octets = parts.map(parseOctet);
+	if (octets.some((o) => o === null)) return null;
+	return [
+		octets[0],
+		octets[1],
+		octets[2],
+		octets[3]
+	];
+}
+/**
+* Convert an IPv4 CIDR (e.g. `192.168.20.0/24`) into its directed broadcast address
+* (`192.168.20.255`) — the address `Ecowitt.discover` sweeps to reach a foreign subnet. Returns
+* `null` for anything that is not a well-formed IPv4 CIDR (a bare IP, garbage, or an out-of-range
+* prefix), so the caller can treat the input as a literal broadcast/gateway address instead.
+*/
+function cidrToBroadcast(value) {
+	const slash = value.indexOf("/");
+	if (slash < 0) return null;
+	const ip = parseIpv4(value.slice(0, slash));
+	const prefixToken = value.slice(slash + 1);
+	if (ip === null || !/^\d{1,2}$/.test(prefixToken)) return null;
+	const prefix = Number(prefixToken);
+	if (prefix < 0 || prefix > 32) return null;
+	const broadcast = ((ip[0] << 24 | ip[1] << 16 | ip[2] << 8 | ip[3]) >>> 0 | (prefix === 0 ? 4294967295 : 4294967295 >>> prefix >>> 0)) >>> 0;
+	return [
+		broadcast >>> 24 & 255,
+		broadcast >>> 16 & 255,
+		broadcast >>> 8 & 255,
+		broadcast & 255
+	].join(".");
+}
+/**
+* Parse the operator scan input into a de-duplicated, ordered list of directed broadcast targets.
+*
+* Accepts a free-form string of comma / newline / whitespace separated tokens where each token is
+* either a broadcast address (`192.168.20.255`), a bare gateway IP (`192.168.20.181` — the
+* `CMD_BROADCAST` probe answers a unicast too), or a CIDR (`192.168.20.0/24`, expanded to its
+* directed broadcast). Blank input yields an empty list, meaning "sweep the local subnet only".
+* Invalid tokens are dropped rather than throwing — discovery input is best-effort.
+*/
+function parseBroadcastTargets(raw) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const rawToken of raw.split(/[\s,]+/)) {
+		const token = rawToken.trim();
+		if (token.length === 0) continue;
+		const target = token.includes("/") ? cidrToBroadcast(token) : parseIpv4(token) ? token : null;
+		if (target === null || seen.has(target)) continue;
+		seen.add(target);
+		out.push(target);
+	}
+	return out;
+}
+/** Deterministic dedup key for a discovered gateway — MAC is the physical identity. */
+function gatewayKey(gateway) {
+	return gateway.mac.trim().toLowerCase() || gateway.ip;
+}
+/**
+* Cross-subnet Ecowitt discovery: run one {@link EcowittDiscoverFn} sweep per target subnet (or a
+* single local sweep when there are no targets), then merge the responders de-duplicated by MAC.
+*
+* Every sweep runs independently and its failure (an unreachable subnet, a router that drops the
+* directed broadcast, a socket error) is isolated via `onError` — a single bad subnet never fails the
+* whole scan. Sweeps run concurrently; results are flattened in target order so the merged output is
+* stable regardless of which subnet answers first.
+*/
+async function scanEcowittGateways(input) {
+	const { discover, targets, timeoutMs, onError } = input;
+	const timeoutOpt = timeoutMs !== void 0 ? { timeoutMs } : {};
+	if (targets.length === 0) try {
+		return [...await discover({ ...timeoutOpt })];
+	} catch (error) {
+		onError?.("local", error);
+		return [];
+	}
+	const settled = await Promise.all(targets.map(async (broadcastAddr) => {
+		try {
+			return await discover({
+				broadcastAddr,
+				...timeoutOpt
+			});
+		} catch (error) {
+			onError?.(broadcastAddr, error);
+			return [];
+		}
+	}));
+	const merged = /* @__PURE__ */ new Map();
+	for (const batch of settled) for (const gateway of batch) {
+		const key = gatewayKey(gateway);
+		if (!merged.has(key)) merged.set(key, gateway);
+	}
+	return [...merged.values()];
+}
+//#endregion
 //#region src/ecowitt-gateway.ts
 /**
 * Per-gateway registry that device classes use to reach the live {@link Ecowitt}
@@ -31258,15 +31594,23 @@ var EcowittProviderAddon = class extends BaseDeviceProvider {
 		return buildDiscoveryParamsFormSchema();
 	}
 	async discoverDevices(input) {
-		const broadcastAddr = typeof input?.params?.["broadcastAddress"] === "string" ? input.params["broadcastAddress"].trim() : "";
+		const rawTargets = typeof input?.params?.["broadcastAddress"] === "string" ? input.params["broadcastAddress"] : "";
 		const timeoutMs = typeof input?.params?.["timeoutMs"] === "number" ? input.params["timeoutMs"] : void 0;
-		const gateways = await Ecowitt.discover({
-			...broadcastAddr.length > 0 ? { broadcastAddr } : {},
-			...timeoutMs !== void 0 ? { timeoutMs } : {}
+		const targets = parseBroadcastTargets(rawTargets);
+		const gateways = await scanEcowittGateways({
+			discover: (opts) => Ecowitt.discover(opts),
+			targets,
+			...timeoutMs !== void 0 ? { timeoutMs } : {},
+			onError: (target, error) => {
+				this.ctx.logger.warn("Ecowitt subnet sweep failed — skipping", { meta: {
+					target,
+					error: errMsg(error)
+				} });
+			}
 		});
 		this.ctx.logger.info("Ecowitt discovery complete", { meta: {
 			count: gateways.length,
-			broadcastAddr: broadcastAddr.length > 0 ? broadcastAddr : "local"
+			subnets: targets.length > 0 ? targets : "local"
 		} });
 		return gateways.map((g) => {
 			const displayName = g.model ?? g.name;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-ecowitt",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Ecowitt weather-station device-provider addon for CamStack — wraps the @apocaliss92/nodewitt local-poll / push client",
   "keywords": [
     "camstack",