package agentguard

// Notification is an actionable, non-sensitive operator message emitted when
// admission blocks a provider invocation.
type Notification struct {
	Code          BlockerCode
	ProjectID     string
	ProviderID    string
	ProfileID     string
	Message       string
	SetupGuidance string
}

func notificationFor(blocker *Blocker) *Notification {
	if blocker == nil {
		return nil
	}
	guidance := "Revalidate the project registration and retry the blocked task."
	switch blocker.Code {
	case BlockerCodeMissingWorkspaceGrant:
		guidance = "Register this project workspace and create a new canonical workspace grant."
	case BlockerCodeWorkspaceNotCanonical,
		BlockerCodeWorkspaceRootEscape,
		BlockerCodeWorkspaceIdentityMismatch:
		guidance = "Re-register the canonical workspace and recreate the task isolation view."
	case BlockerCodeVCSMetadataNotAllowed:
		guidance = "Add the exact worktree Git metadata roots to the workspace grant or use an isolated full clone."
	case BlockerCodeIsolationRequired,
		BlockerCodeWritableRootEscape,
		BlockerCodeWritableConfinementUnavailable:
		guidance = "Create a fresh task isolation whose writable roots are confined to the task view."
	case BlockerCodeProviderUnattendedUnavailable:
		guidance = "Choose a provider profile that declares unattended execution."
	case BlockerCodeProviderApprovalBypassUnavailable:
		guidance = "Enable the provider's supported approval-bypass mode or choose another eligible profile."
	case BlockerCodeRevisionMismatch,
		BlockerCodePermitInvalid,
		BlockerCodePermitStale:
		guidance = "Run admission again with the current grant, isolation, and provider profile revisions."
	}
	return &Notification{
		Code:          blocker.Code,
		ProjectID:     blocker.ProjectID,
		ProviderID:    blocker.ProviderID,
		ProfileID:     blocker.ProfileID,
		Message:       blocker.Message,
		SetupGuidance: guidance,
	}
}