import { getPublicDomainVestibule, type DomainRouteId, type PublicDomainVestibule } from './public-domain-directory.js';
import type { DomainAccessProjection } from './domain-connection.js';

export type DomainNodeType = 'local-terminal' | 'cloud-resident';

export interface DomainEntryTarget {
  domain: PublicDomainVestibule;
  nodeType: DomainNodeType;
}

export function createDomainEntryTarget(routeId: DomainRouteId, nodeType: DomainNodeType = 'local-terminal'): DomainEntryTarget {
  const domain = getPublicDomainVestibule(routeId);
  if (!domain.supportedNodeTypes.includes(nodeType)) throw new Error('DOMAIN_NODE_TYPE_NOT_SUPPORTED');
  return Object.freeze({ domain, nodeType });
}

export function canEnterSelectedDomainRuntime(target: DomainEntryTarget | null, access: DomainAccessProjection): boolean {
  if (!target || !access.runtimeReady) return false;
  if (access.domainId !== target.domain.stableDomainId) return false;
  if (access.nodeType !== target.nodeType) return false;
  // The present desktop bundle contains only the Fifth Domain renderer. The four
  // enterprise domains must provide their own signed runtime package and endpoint.
  if (target.domain.routeId !== 'fifth') return false;
  const policy = access.runtimePolicy;
  return Boolean(policy
    && /^[a-f0-9]{64}$/.test(policy.manifestDigest)
    && policy.themeOwner === 'fifth-domain'
    && policy.themePackageRef.startsWith('theme://origin-domain/')
    && policy.routeRef.startsWith('domain-route://origin-domain/')
    && policy.allowedSessionScopes.includes('domain:enter'));
}

export function projectDomainRuntimeBoundary(target: DomainEntryTarget | null, access: DomainAccessProjection): string {
  if (!target) return '请先选择目标域；系统不会把通用登录请求默认路由到第五域。';
  if (access.domainId && access.domainId !== target.domain.stableDomainId) {
    return '回读证据属于另一个域；当前入口保持关闭。';
  }
  if (access.nodeType && access.nodeType !== target.nodeType) {
    return '回读证据属于另一种节点类型；当前入口保持关闭并重新核验。';
  }
  if (target.domain.routeId !== 'fifth') {
    return `${target.domain.displayName}的独立运行端点与主题包尚未登记；当前只能查看公开门厅。`;
  }
  if (!access.runtimeReady) return '第五域入口保持关闭，直到四项真实接入证据全部匹配。';
  return canEnterSelectedDomainRuntime(target, access)
    ? '第五域运行端点、签名清单、主题策略、会话能力与在线回执已经匹配。'
    : '域接入证据声称已就绪，但可信运行策略缺失或不匹配；第五域入口保持关闭。';
}