@switchbot/openapi-cli 3.2.0 → 3.2.1

package/dist/policy/load.js

@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { parseDocument, LineCounter } from 'yaml';
+export const DEFAULT_POLICY_PATH = join(homedir(), '.config', 'openclaw', 'switchbot', 'policy.yaml');
+export function resolvePolicyPath(options = {}) {
+    const { flag, env = process.env } = options;
+    if (flag && flag.trim().length > 0)
+        return resolve(flag);
+    const fromEnv = env.SWITCHBOT_POLICY_PATH;
+    if (fromEnv && fromEnv.trim().length > 0)
+        return resolve(fromEnv);
+    return DEFAULT_POLICY_PATH;
+}
+export class PolicyFileNotFoundError extends Error {
+    policyPath;
+    constructor(policyPath) {
+        super(`policy file not found: ${policyPath}`);
+        this.policyPath = policyPath;
+        this.name = 'PolicyFileNotFoundError';
+    }
+}
+export class PolicyYamlParseError extends Error {
+    policyPath;
+    yamlErrors;
+    constructor(message, policyPath, yamlErrors) {
+        super(message);
+        this.policyPath = policyPath;
+        this.yamlErrors = yamlErrors;
+        this.name = 'PolicyYamlParseError';
+    }
+}
+export function loadPolicyFile(policyPath) {
+    let source;
+    try {
+        source = readFileSync(policyPath, 'utf-8');
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === 'ENOENT')
+            throw new PolicyFileNotFoundError(policyPath);
+        throw err;
+    }
+    const lineCounter = new LineCounter();
+    const doc = parseDocument(source, { lineCounter, keepSourceTokens: true });
+    if (doc.errors.length > 0) {
+        const yamlErrors = doc.errors.map((e) => {
+            const pos = e.pos?.[0];
+            const loc = pos !== undefined ? lineCounter.linePos(pos) : undefined;
+            return { line: loc?.line, col: loc?.col, message: e.message };
+        });
+        throw new PolicyYamlParseError(doc.errors[0].message, policyPath, yamlErrors);
+    }
+    return {
+        path: policyPath,
+        source,
+        doc,
+        lineCounter,
+        data: doc.toJS({ maxAliasCount: 100 }),
+    };
+}
+//# sourceMappingURL=load.js.map

package/dist/policy/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/policy/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAiB,MAAM,MAAM,CAAC;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAOtG,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC1C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAUD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QADpB,eAAU,GAAV,UAAU,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IACA;IAHlB,YACE,OAAe,EACC,UAAkB,EAClB,UAA2E;QAE3F,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAQ;QAClB,eAAU,GAAV,UAAU,CAAiE;QAG3F,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3E,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAChF,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM;QACN,GAAG;QACH,WAAW;QACX,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/dist/policy/migrate.d.ts

@@ -0,0 +1,21 @@
+import { type Document } from 'yaml';
+import { type PolicyValidationResult } from './validate.js';
+import type { LoadedPolicy } from './load.js';
+import type { PolicySchemaVersion } from './schema.js';
+export interface MigrationPlan {
+    fromVersion: PolicySchemaVersion;
+    toVersion: PolicySchemaVersion;
+    migrate: (doc: Document.Parsed) => void;
+}
+export declare class PolicyMigrationError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export interface MigrationDryRun {
+    changed: boolean;
+    fromVersion: PolicySchemaVersion;
+    toVersion: PolicySchemaVersion;
+    nextSource: string;
+    precheck: PolicyValidationResult;
+}
+export declare function planMigration(loaded: LoadedPolicy, from: PolicySchemaVersion, to: PolicySchemaVersion): MigrationDryRun;

package/dist/policy/migrate.js

@@ -0,0 +1,68 @@
+import { isMap, isScalar, parseDocument, LineCounter } from 'yaml';
+import { validateLoadedPolicy } from './validate.js';
+export class PolicyMigrationError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'PolicyMigrationError';
+    }
+}
+const MIGRATION_CHAIN = [];
+function bumpVersionScalar(doc, target) {
+    if (!isMap(doc.contents)) {
+        throw new PolicyMigrationError('policy root must be a YAML mapping (got null or an array)', 'invalid-shape');
+    }
+    const pair = doc.contents.items.find((p) => isScalar(p.key) && p.key.value === 'version');
+    if (!pair || !isScalar(pair.value)) {
+        throw new PolicyMigrationError('policy has no `version` scalar to migrate; add `version: "0.2"` (or `"0.1"`) and retry', 'no-version-field');
+    }
+    pair.value.value = target;
+}
+function findPlan(from, to) {
+    const chain = [];
+    let cur = from;
+    while (cur !== to) {
+        const step = MIGRATION_CHAIN.find((p) => p.fromVersion === cur);
+        if (!step) {
+            throw new PolicyMigrationError(`no migration path from v${from} to v${to} (missing step at v${cur})`, 'no-path');
+        }
+        chain.push(step);
+        cur = step.toVersion;
+    }
+    return chain;
+}
+export function planMigration(loaded, from, to) {
+    if (from === to) {
+        const precheck = validateLoadedPolicy(loaded);
+        return { changed: false, fromVersion: from, toVersion: to, nextSource: loaded.source, precheck };
+    }
+    const plan = findPlan(from, to);
+    // Round-trip through source instead of Document.clone(): keeps comments +
+    // anchors intact, works across yaml library versions, and leaves the
+    // caller's `loaded.doc` untouched.
+    const nextLineCounter = new LineCounter();
+    const clone = parseDocument(loaded.source, {
+        lineCounter: nextLineCounter,
+        keepSourceTokens: true,
+    });
+    for (const step of plan)
+        step.migrate(clone);
+    const nextSource = String(clone);
+    // Re-parse after serialization so `doc` and `source` stay in sync for the
+    // validator's line/col mapping.
+    const reLineCounter = new LineCounter();
+    const reDoc = parseDocument(nextSource, {
+        lineCounter: reLineCounter,
+        keepSourceTokens: true,
+    });
+    const precheck = validateLoadedPolicy({
+        path: loaded.path,
+        source: nextSource,
+        doc: reDoc,
+        lineCounter: reLineCounter,
+        data: reDoc.toJS({ maxAliasCount: 100 }),
+    });
+    return { changed: true, fromVersion: from, toVersion: to, nextSource, precheck };
+}
+//# sourceMappingURL=migrate.js.map

package/dist/policy/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/policy/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAiB,MAAM,MAAM,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAA+B,MAAM,eAAe,CAAC;AAUlF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACA;IAA7C,YAAY,OAAe,EAAkB,IAAY;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,SAAI,GAAJ,IAAI,CAAQ;QAEvD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,eAAe,GAAoB,EAAE,CAAC;AAE5C,SAAS,iBAAiB,CAAC,GAAoB,EAAE,MAAc;IAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,2DAA2D,EAC3D,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,oBAAoB,CAC5B,wFAAwF,EACxF,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB,EAAE,EAAuB;IAClE,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,oBAAoB,CAC5B,2BAA2B,IAAI,QAAQ,EAAE,sBAAsB,GAAG,GAAG,EACrE,SAAS,CACV,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,IAAyB,EACzB,EAAuB;IAEvB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,0EAA0E;IAC1E,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE;QACzC,WAAW,EAAE,eAAe;QAC5B,gBAAgB,EAAE,IAAI;KACvB,CAAoB,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE;QACtC,WAAW,EAAE,aAAa;QAC1B,gBAAgB,EAAE,IAAI;KACvB,CAAoB,CAAC;IAEtB,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,KAAK;QACV,WAAW,EAAE,aAAa;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KACzC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACnF,CAAC"}

package/dist/policy/schema.d.ts

@@ -0,0 +1,5 @@
+export type PolicySchemaVersion = '0.2';
+export declare const SUPPORTED_POLICY_SCHEMA_VERSIONS: PolicySchemaVersion[];
+export declare const CURRENT_POLICY_SCHEMA_VERSION: PolicySchemaVersion;
+export declare function loadPolicySchema(version?: PolicySchemaVersion): object;
+export declare function isSupportedPolicySchemaVersion(v: unknown): v is PolicySchemaVersion;

package/dist/policy/schema.js

@@ -0,0 +1,19 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+export const SUPPORTED_POLICY_SCHEMA_VERSIONS = ['0.2'];
+export const CURRENT_POLICY_SCHEMA_VERSION = '0.2';
+const schemaCache = new Map();
+export function loadPolicySchema(version = CURRENT_POLICY_SCHEMA_VERSION) {
+    const cached = schemaCache.get(version);
+    if (cached)
+        return cached;
+    const url = new URL(`./schema/v${version}.json`, import.meta.url);
+    const raw = readFileSync(fileURLToPath(url), 'utf-8');
+    const parsed = JSON.parse(raw);
+    schemaCache.set(version, parsed);
+    return parsed;
+}
+export function isSupportedPolicySchemaVersion(v) {
+    return typeof v === 'string' && SUPPORTED_POLICY_SCHEMA_VERSIONS.includes(v);
+}
+//# sourceMappingURL=schema.js.map

package/dist/policy/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/policy/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,MAAM,CAAC,MAAM,gCAAgC,GAA0B,CAAC,KAAK,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAwB,KAAK,CAAC;AAExE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE3D,MAAM,UAAU,gBAAgB,CAAC,UAA+B,6BAA6B;IAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,OAAO,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACzC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,CAAU;IACvD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,gCAA6C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC"}

package/dist/policy/validate.d.ts

@@ -0,0 +1,19 @@
+import { type LoadedPolicy } from './load.js';
+import { type PolicySchemaVersion } from './schema.js';
+export interface PolicyValidationError {
+    path: string;
+    line?: number;
+    col?: number;
+    keyword: string;
+    message: string;
+    hint?: string;
+    schemaPath: string;
+}
+export interface PolicyValidationResult {
+    policyPath: string;
+    schemaVersion: PolicySchemaVersion;
+    valid: boolean;
+    errors: PolicyValidationError[];
+}
+export declare function validateLoadedPolicy(loaded: LoadedPolicy): PolicyValidationResult;
+export declare function validatePolicyFile(policyPath: string): PolicyValidationResult;

package/dist/policy/validate.js

@@ -0,0 +1,263 @@
+import { createRequire } from 'node:module';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { isMap, isSeq, isScalar } from 'yaml';
+import { loadPolicyFile } from './load.js';
+import { loadPolicySchema, CURRENT_POLICY_SCHEMA_VERSION, SUPPORTED_POLICY_SCHEMA_VERSIONS, isSupportedPolicySchemaVersion, } from './schema.js';
+import { destructiveVerbOf, DESTRUCTIVE_COMMANDS } from '../rules/destructive.js';
+const require = createRequire(import.meta.url);
+const addFormats = require('ajv-formats');
+const validators = new Map();
+function getValidator(version) {
+    const cached = validators.get(version);
+    if (cached)
+        return cached;
+    const ajv = new Ajv2020({ allErrors: true, strict: false, allowUnionTypes: true });
+    addFormats(ajv);
+    const schema = loadPolicySchema(version);
+    const validate = ajv.compile(schema);
+    const compiled = { ajv, validate };
+    validators.set(version, compiled);
+    return compiled;
+}
+function instancePathToSegments(instancePath) {
+    if (!instancePath)
+        return [];
+    return instancePath
+        .slice(1)
+        .split('/')
+        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+}
+function getNodeAt(doc, segments) {
+    let current = doc.contents;
+    for (const seg of segments) {
+        if (isMap(current)) {
+            const pair = current.items.find((p) => {
+                const k = p.key;
+                if (isScalar(k))
+                    return String(k.value) === seg;
+                return false;
+            });
+            if (!pair)
+                return null;
+            current = pair.value;
+        }
+        else if (isSeq(current)) {
+            const idx = Number(seg);
+            if (!Number.isInteger(idx))
+                return null;
+            current = current.items[idx];
+        }
+        else {
+            return null;
+        }
+    }
+    return current ?? null;
+}
+function getKeyNodeAt(doc, parentSegments, key) {
+    const parent = parentSegments.length === 0 ? doc.contents : getNodeAt(doc, parentSegments);
+    if (!parent || !isMap(parent))
+        return null;
+    const pair = parent.items.find((p) => isScalar(p.key) && String(p.key.value) === key);
+    return pair?.key ?? null;
+}
+function locateError(doc, lineCounter, err) {
+    const segments = instancePathToSegments(err.instancePath);
+    if (err.keyword === 'additionalProperties') {
+        const bad = err.params.additionalProperty;
+        if (bad) {
+            const keyNode = getKeyNodeAt(doc, segments, bad);
+            const range = keyNode?.range;
+            if (range) {
+                const pos = lineCounter.linePos(range[0]);
+                return { line: pos.line, col: pos.col };
+            }
+        }
+    }
+    if (err.keyword === 'required' || err.keyword === 'dependentRequired') {
+        const node = getNodeAt(doc, segments);
+        const range = node?.range;
+        if (range) {
+            const pos = lineCounter.linePos(range[0]);
+            return { line: pos.line, col: pos.col };
+        }
+        return { line: 1, col: 1 };
+    }
+    const node = getNodeAt(doc, segments);
+    const range = node?.range;
+    if (!range)
+        return {};
+    const pos = lineCounter.linePos(range[0]);
+    return { line: pos.line, col: pos.col };
+}
+function humanMessage(err) {
+    const path = err.instancePath || '(root)';
+    switch (err.keyword) {
+        case 'required':
+            return `missing required property "${err.params.missingProperty}"`;
+        case 'additionalProperties':
+            return `unknown property "${err.params.additionalProperty}"`;
+        case 'dependentRequired': {
+            const { property, missingProperty } = err.params;
+            const parent = path === '(root)' ? '' : `${path}: `;
+            return `${parent}when "${property}" is set, "${missingProperty}" is also required`;
+        }
+        case 'pattern':
+            return `${path} does not match pattern ${err.params.pattern}`;
+        case 'const':
+            return `${path} must be exactly ${JSON.stringify(err.params.allowedValue)}`;
+        case 'enum':
+            return `${path} must be one of ${JSON.stringify(err.params.allowedValues)}`;
+        case 'type':
+            return `${path} must be ${err.params.type}`;
+        case 'not':
+            return `${path} is not allowed here`;
+        default:
+            return `${path} ${err.message ?? 'is invalid'}`;
+    }
+}
+function hintFor(err) {
+    if (err.keyword === 'pattern' && err.instancePath.startsWith('/aliases/')) {
+        return 'paste the deviceId from `switchbot devices list --format=tsv`, e.g. 01-202407090924-26354212';
+    }
+    if (err.keyword === 'not' && err.instancePath.startsWith('/confirmations/never_confirm/')) {
+        return 'destructive actions (lock/unlock/delete*/factoryReset) cannot be pre-approved in policy.yaml';
+    }
+    if (err.keyword === 'const' && err.instancePath === '/version') {
+        const supported = SUPPORTED_POLICY_SCHEMA_VERSIONS.map((v) => `"${v}"`).join(' / ');
+        return `this CLI supports policy schema versions ${supported}; run \`switchbot policy migrate\` to upgrade an older file`;
+    }
+    if (err.keyword === 'required' && err.instancePath === '') {
+        const missing = err.params.missingProperty;
+        if (missing === 'version')
+            return `add \`version: "${CURRENT_POLICY_SCHEMA_VERSION}"\` at the top of the file`;
+    }
+    return undefined;
+}
+function readDeclaredVersion(data) {
+    if (data && typeof data === 'object' && 'version' in data) {
+        const v = data.version;
+        if (typeof v === 'string')
+            return v;
+    }
+    return undefined;
+}
+function unsupportedVersionResult(loaded, declared) {
+    const supported = SUPPORTED_POLICY_SCHEMA_VERSIONS.map((v) => `"${v}"`).join(' / ');
+    const isLegacy = declared === '0.1';
+    const hint = isLegacy
+        ? `v0.1 policy support was removed in v3.0. Run \`switchbot policy migrate\` with CLI ≤2.15 first, then upgrade.`
+        : `supported versions: ${supported}. upgrade the CLI or downgrade the file.`;
+    return {
+        policyPath: loaded.path,
+        schemaVersion: CURRENT_POLICY_SCHEMA_VERSION,
+        valid: false,
+        errors: [
+            {
+                path: '/version',
+                line: 1,
+                col: 1,
+                keyword: 'unsupported-version',
+                message: `policy schema version "${declared}" is not supported by this CLI`,
+                hint,
+                schemaPath: '#/properties/version',
+            },
+        ],
+    };
+}
+/**
+ * Walk `automation.rules[].then[]` and flag any command string whose verb
+ * appears in DESTRUCTIVE_COMMANDS. Uses the YAML doc (not the data tree) to
+ * get accurate line/col on the offending node.
+ *
+ * This is deliberately a post-ajv pass rather than a schema rule because
+ * JSON Schema cannot parse a command string and compare the verb slot to a
+ * blocklist. Keeping it in JS also lets `src/rules/destructive.ts` be the
+ * single source of truth shared with the runtime executor.
+ */
+function collectDestructiveRuleErrors(loaded) {
+    const data = loaded.data;
+    const rules = data?.automation?.rules;
+    if (!Array.isArray(rules))
+        return [];
+    const out = [];
+    for (let ri = 0; ri < rules.length; ri++) {
+        const rule = rules[ri];
+        const actions = Array.isArray(rule?.then) ? rule.then : [];
+        for (let ai = 0; ai < actions.length; ai++) {
+            const cmd = actions[ai]?.command;
+            if (typeof cmd !== 'string')
+                continue;
+            const verb = destructiveVerbOf(cmd);
+            if (!verb)
+                continue;
+            const instancePath = `/automation/rules/${ri}/then/${ai}/command`;
+            const segments = instancePath.slice(1).split('/');
+            const node = getNodeAt(loaded.doc, segments);
+            const range = node?.range;
+            let line;
+            let col;
+            if (range) {
+                const pos = loaded.lineCounter.linePos(range[0]);
+                line = pos.line;
+                col = pos.col;
+            }
+            const ruleName = typeof rule?.name === 'string' ? rule.name : `#${ri}`;
+            out.push({
+                path: instancePath,
+                line,
+                col,
+                keyword: 'rule-destructive-action',
+                message: `rule "${ruleName}" action #${ai} uses destructive command "${verb}"`,
+                hint: `destructive verbs (${DESTRUCTIVE_COMMANDS.join(', ')}) cannot be pre-approved in automation rules; run them via the interactive CLI so the confirmation gate fires`,
+                schemaPath: '#/properties/automation/properties/rules/items/properties/then/items/properties/command',
+            });
+        }
+    }
+    return out;
+}
+export function validateLoadedPolicy(loaded) {
+    const declared = readDeclaredVersion(loaded.data);
+    if (declared !== undefined && !isSupportedPolicySchemaVersion(declared)) {
+        return unsupportedVersionResult(loaded, declared);
+    }
+    const version = isSupportedPolicySchemaVersion(declared)
+        ? declared
+        : CURRENT_POLICY_SCHEMA_VERSION;
+    const { validate } = getValidator(version);
+    const ok = validate(loaded.data);
+    const errors = [];
+    if (!ok && validate.errors) {
+        for (const err of validate.errors) {
+            const { line, col } = locateError(loaded.doc, loaded.lineCounter, err);
+            errors.push({
+                path: err.instancePath || '',
+                line,
+                col,
+                keyword: err.keyword,
+                message: humanMessage(err),
+                hint: hintFor(err),
+                schemaPath: err.schemaPath,
+            });
+        }
+    }
+    // v0.2-only post-hook: destructive verbs like `unlock` / `factoryReset`
+    // cannot be pre-approved via rules, even if ajv considers the command
+    // string well-formed. Schema can't express this because `command` is a
+    // free-form string; we parse the verb in JS and append errors.
+    if (version === '0.2') {
+        const ruleErrors = collectDestructiveRuleErrors(loaded);
+        errors.push(...ruleErrors);
+    }
+    const valid = ok === true && errors.length === 0;
+    return {
+        policyPath: loaded.path,
+        schemaVersion: version,
+        valid,
+        errors,
+    };
+}
+export function validatePolicyFile(policyPath) {
+    const loaded = loadPolicyFile(policyPath);
+    return validateLoadedPolicy(loaded);
+}
+//# sourceMappingURL=validate.js.map

package/dist/policy/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/policy/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAA8C,MAAM,MAAM,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAqB,MAAM,WAAW,CAAC;AAC9D,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAElF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAiB,CAAC;AA2B1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0C,CAAC;AAErE,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACnC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB;IAClD,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,YAAY;SAChB,KAAK,CAAC,CAAC,CAAC;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB,EAAE,QAAkB;IACzD,IAAI,OAAO,GAAY,GAAG,CAAC,QAAQ,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;gBAChB,IAAI,QAAQ,CAAC,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAQ,OAAgB,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,cAAwB,EAAE,GAAW;IAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAE,CAAC,CAAC,GAA0B,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC9G,OAAQ,IAAI,EAAE,GAAwB,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB,EAAE,WAAwB,EAAE,GAAgB;IACnF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE1D,IAAI,GAAG,CAAC,OAAO,KAAK,sBAAsB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAI,GAAG,CAAC,MAA0C,CAAC,kBAAkB,CAAC;QAC/E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,KAAK,GAAI,OAAuD,EAAE,KAAK,CAAC;YAC9E,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAI,IAAoD,EAAE,KAAK,CAAC;QAC3E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAI,IAAoD,EAAE,KAAK,CAAC;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,GAAgB;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC;IAC1C,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,8BAA+B,GAAG,CAAC,MAAsC,CAAC,eAAe,GAAG,CAAC;QACtG,KAAK,sBAAsB;YACzB,OAAO,qBAAsB,GAAG,CAAC,MAAyC,CAAC,kBAAkB,GAAG,CAAC;QACnG,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,MAAuD,CAAC;YAClG,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YACpD,OAAO,GAAG,MAAM,SAAS,QAAQ,cAAc,eAAe,oBAAoB,CAAC;QACrF,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,2BAA4B,GAAG,CAAC,MAA8B,CAAC,OAAO,EAAE,CAAC;QACzF,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,oBAAoB,IAAI,CAAC,SAAS,CAAE,GAAG,CAAC,MAAoC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7G,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,mBAAmB,IAAI,CAAC,SAAS,CAAE,GAAG,CAAC,MAAuC,CAAC,aAAa,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,YAAa,GAAG,CAAC,MAA2B,CAAC,IAAI,EAAE,CAAC;QACpE,KAAK,KAAK;YACR,OAAO,GAAG,IAAI,sBAAsB,CAAC;QACvC;YACE,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAgB;IAC/B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,8FAA8F,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC1F,OAAO,8FAA8F,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,OAAO,4CAA4C,SAAS,6DAA6D,CAAC;IAC5H,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAI,GAAG,CAAC,MAAsC,CAAC,eAAe,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,mBAAmB,6BAA6B,4BAA4B,CAAC;IACjH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAI,IAA6B,CAAC,OAAO,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB,EAAE,QAAgB;IACtE,MAAM,SAAS,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,QAAQ,KAAK,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,+GAA+G;QACjH,CAAC,CAAC,uBAAuB,SAAS,0CAA0C,CAAC;IAC/E,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,aAAa,EAAE,6BAA6B;QAC5C,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,CAAC;gBACP,GAAG,EAAE,CAAC;gBACN,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,0BAA0B,QAAQ,gCAAgC;gBAC3E,IAAI;gBACJ,UAAU,EAAE,sBAAsB;aACnC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,4BAA4B,CAAC,MAAoB;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAGP,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,YAAY,GAAG,qBAAqB,EAAE,SAAS,EAAE,UAAU,CAAC;YAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAI,IAAoD,EAAE,KAAK,CAAC;YAC3E,IAAI,IAAwB,CAAC;YAC7B,IAAI,GAAuB,CAAC;YAC5B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBAChB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YAChB,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,YAAY;gBAClB,IAAI;gBACJ,GAAG;gBACH,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,SAAS,QAAQ,aAAa,EAAE,8BAA8B,IAAI,GAAG;gBAC9E,IAAI,EAAE,sBAAsB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,+GAA+G;gBAC1K,UAAU,EAAE,yFAAyF;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAElD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,OAAO,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAwB,8BAA8B,CAAC,QAAQ,CAAC;QAC3E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,6BAA6B,CAAC;IAElC,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;gBAC5B,IAAI;gBACJ,GAAG;gBACH,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;gBAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAEjD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,aAAa,EAAE,OAAO;QACtB,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/rules/action.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Rule action executor — the only place that calls into `executeCommand`
+ * from the rules pipeline.
+ *
+ * Responsibilities:
+ *   1. Parse the `command` string into a `{ deviceId, verb, parameter }`
+ *      tuple, rejecting shapes the PoC doesn't understand.
+ *   2. Enforce the destructive-command blocklist as a second line of
+ *      defence (the validator should have caught it at load time — this
+ *      protects against hand-crafted engine inputs).
+ *   3. Resolve `action.device` (alias or deviceId) into the `<id>`
+ *      slot.
+ *   4. Branch on `dry_run`: dry-run writes audit with kind
+ *      `rule-fire-dry` and returns without touching the API.
+ *   5. Live run delegates to `executeCommand`, then re-writes audit
+ *      with the rule-scoped kind + fireId so `rules tail` / `replay`
+ *      can correlate multi-action fires.
+ */
+import type { AxiosInstance } from 'axios';
+import type { Action, Rule } from './types.js';
+export interface RuleActionContext {
+    /** Rule the action belongs to — used for audit correlation. */
+    rule: Rule;
+    /** UUID correlating every audit line of one trigger fire. */
+    fireId: string;
+    /** Policy-level aliases: friendly name → deviceId. */
+    aliases: Record<string, string>;
+    /** Optional axios client (prod path); omit in tests. */
+    httpClient?: AxiosInstance;
+    /** Global dry-run override (from `switchbot rules run --dry-run`). */
+    globalDryRun?: boolean;
+    /** When true, do not actually call `executeCommand` even if live.
+     *  Exposed separately from `globalDryRun` so tests can exercise the
+     *  "would call executeCommand" branch without mocking axios. */
+    skipApiCall?: boolean;
+}
+export interface RuleActionResult {
+    ok: boolean;
+    deviceId?: string;
+    verb?: string;
+    error?: string;
+    /** True when the action was refused for safety (destructive verb). */
+    blocked?: boolean;
+    /** True when the action wrote a dry-run audit instead of calling the API. */
+    dryRun?: boolean;
+}
+interface ParsedCommand {
+    deviceIdSlot: string | null;
+    verb: string;
+    parameterTokens: string[];
+}
+export declare function parseRuleCommand(cmd: string): ParsedCommand | null;
+/** Alias-first resolver — falls back to the raw value (assumed deviceId). */
+export declare function resolveActionDevice(explicit: string | undefined, slot: string | null, aliases: Record<string, string>): string | null;
+export declare function executeRuleAction(action: Action, ctx: RuleActionContext): Promise<RuleActionResult>;
+/**
+ * Extract the raw deviceId from an action object without alias resolution.
+ * Prefers `action.device` over the deviceId embedded in the command string.
+ * Use resolveActionDevice() when alias resolution is needed.
+ */
+export declare function extractDeviceIdFromAction(action: {
+    command: string;
+    device?: string;
+}): string | null;
+export {};