feat(domain): project verified runtime policy to desktop

product-source/guanghu-knowledge-base/server/domain-access.ts

@@ -99,12 +99,23 @@ export interface DomainAccessEvidence {
   sessionCapability?: DomainSessionCapability;
 }
 
+export interface DomainRuntimePolicyProjection {
+  allowedSessionScopes: readonly string[];
+  forbiddenDataScopes: readonly string[];
+  manifestDigest: string;
+  permissionPolicyRef: string;
+  routeRef: string;
+  themeOwner: DomainThemeOwner;
+  themePackageRef: string;
+}
+
 export interface DomainAccessStatus {
   blockers: string[];
   domainId: string;
   localWorkspaceAllowed: true;
   nodeId: string;
   nodeType: DomainNodeType;
+  runtimePolicy?: DomainRuntimePolicyProjection;
   runtimeReady: boolean;
   stage: 'login-required' | 'identity-verified' | 'runtime-ready';
 }
@@ -347,12 +358,24 @@ export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.
     blockers.push('matching_connection_receipt_missing');
   }
   const runtimeReady = blockers.length === 0;
+  const runtimePolicy = runtimeReady && manifest
+    ? Object.freeze({
+      allowedSessionScopes: Object.freeze([...manifest.runtimePolicy.allowedSessionScopes]),
+      forbiddenDataScopes: Object.freeze([...manifest.runtimePolicy.forbiddenDataScopes]),
+      manifestDigest: manifest.digest,
+      permissionPolicyRef: manifest.runtimePolicy.permissionPolicyRef,
+      routeRef: manifest.runtimePolicy.routeRef,
+      themeOwner: manifest.runtimePolicy.themeOwner,
+      themePackageRef: manifest.runtimePolicy.themePackageRef,
+    })
+    : undefined;
   return {
     blockers,
     domainId: evidence.domainId,
     localWorkspaceAllowed: true,
     nodeId: evidence.nodeId,
     nodeType: evidence.nodeType,
+    ...(runtimePolicy ? { runtimePolicy } : {}),
     runtimeReady,
     stage: runtimeReady
       ? 'runtime-ready'