#pragma once
// Command-path safety policy for the OneControl integration.
//
// POLICY: slides and jacks are operated from the physical control panel ONLY,
// never over CAN. command_blocked() returns true for any node this firmware must
// never send a command to. It is the single source of truth for that rule and is
// checked in two independent places (the command-entry script and the actual
// transmit point), so loosening one does not open the other.
//
// What it blocks:
//   * an explicit denylist of this rig's known slide / jack nodes (6A/7F/9C) —
//     always blocked, even before we've heard their identity broadcast;
//   * any movement/motor-class node (device class 0x21) other than the awning
//     (0x75) — generalizes the rule to "any motor output that isn't the awning".
//
// node_type is the page-2 identity byte (device class) for the node, or 0 if not
// yet observed. The static denylist covers the not-yet-observed window.

#include <cstdint>

namespace onecontrol {

inline bool command_blocked(uint8_t node, uint8_t node_type) {
  // Known slide / jack / movement-class nodes on this rig — always refused.
  if (node == 0x6A || node == 0x7F || node == 0x9C) return true;
  // Any movement-class (0x21) node except the awning (0x75).
  if (node_type == 0x21 && node != 0x75) return true;
  return false;
}

}  // namespace onecontrol