feat: bind public vestibules to domain login gates

product-source/guanghu-knowledge-base/src/domain-entry-state.ts

@@ -0,0 +1,36 @@
+import { getPublicDomainVestibule, type DomainRouteId, type PublicDomainVestibule } from './public-domain-directory.js';
+import type { DomainAccessProjection } from './domain-connection.js';
+
+export type DomainNodeType = 'local-terminal' | 'cloud-resident';
+
+export interface DomainEntryTarget {
+  domain: PublicDomainVestibule;
+  nodeType: DomainNodeType;
+}
+
+export function createDomainEntryTarget(routeId: DomainRouteId, nodeType: DomainNodeType = 'local-terminal'): DomainEntryTarget {
+  const domain = getPublicDomainVestibule(routeId);
+  if (!domain.supportedNodeTypes.includes(nodeType)) throw new Error('DOMAIN_NODE_TYPE_NOT_SUPPORTED');
+  return Object.freeze({ domain, nodeType });
+}
+
+export function canEnterSelectedDomainRuntime(target: DomainEntryTarget | null, access: DomainAccessProjection): boolean {
+  if (!target || !access.runtimeReady) return false;
+  if (access.domainId !== target.domain.stableDomainId) return false;
+  // The present desktop bundle contains only the Fifth Domain renderer. The four
+  // enterprise domains must provide their own signed runtime package and endpoint.
+  return target.domain.routeId === 'fifth';
+}
+
+export function projectDomainRuntimeBoundary(target: DomainEntryTarget | null, access: DomainAccessProjection): string {
+  if (!target) return '请先选择目标域；系统不会把通用登录请求默认路由到第五域。';
+  if (access.domainId && access.domainId !== target.domain.stableDomainId) {
+    return '回读证据属于另一个域；当前入口保持关闭。';
+  }
+  if (target.domain.routeId !== 'fifth') {
+    return `${target.domain.displayName}的独立运行端点与主题包尚未登记；当前只能查看公开门厅。`;
+  }
+  return access.runtimeReady
+    ? '第五域运行端点、签名清单、会话能力与在线回执已经匹配。'
+    : '第五域入口保持关闭，直到四项真实接入证据全部匹配。';
+}