@softov/scena 0.1.2

package/dist/i18n/registry.d.ts

@@ -0,0 +1,32 @@
+export type MessageTree = {
+    [segment: string]: string | MessageTree;
+};
+export interface LocaleInfo {
+    locale: string;
+    language?: string;
+    country?: string;
+    emoji?: string;
+    name?: string;
+    dir?: 'ltr' | 'rtl';
+}
+export interface RegisterMessagesExtra extends Omit<LocaleInfo, 'locale'> {
+    namespace?: string;
+}
+export declare function registerLocale(info: LocaleInfo): void;
+export declare function registerMessages(locale: string, messages: Record<string, unknown>, extra?: RegisterMessagesExtra): void;
+export declare function unregisterMessages(locale: string, namespace?: string): void;
+export declare function setLocale(locale: string): void;
+export declare function getLocale(): string;
+export declare function setFallbackLocale(locale: string): void;
+export declare function listLocales(): string[];
+export declare function listLocaleInfo(): LocaleInfo[];
+export declare function getLocaleInfo(locale?: string): LocaleInfo | undefined;
+export declare function resolveMessage(key: string, locale?: string): string | MessageTree | undefined;
+export declare function lookup(key: string, locale?: string): string | undefined;
+export type TranslateOptions = {
+    fallback?: string;
+} & Record<string, unknown>;
+export declare function translate(key: string, fallbackOrOptions?: string | TranslateOptions): string;
+export declare function allKeys(): string[];
+export declare function subscribeI18n(listener: () => void): () => void;
+export declare function clearMessages(): void;

package/dist/i18n/registry.js

@@ -0,0 +1,200 @@
+// i18n message registry — the source of truth for translations + the active
+// locale. A module singleton so synchronous `translate()` works ANYWHERE
+// (React, plain TS error throws, provider field labels) without a store ref.
+//
+// Messages are stored as a TREE per locale (nested objects — exactly the shape
+// of an `en.json`), NOT a flat map: `registerMessages` deep-merges subtrees,
+// keys address into the tree, and a whole namespace/subtree can be dropped.
+// Keys accept `/` or `.` separators (`setup/title` == `setup.title`).
+//
+// The `$/t` ScopeBackend (i18n-backend.ts) projects this into the reactive
+// store so declarative ComponentNodes can bind `{ path: '$/t/setup/title' }`;
+// the useT hook reads it reactively for hand-written React.
+const locales = new Map();
+const localeInfo = new Map();
+const listeners = new Set();
+let currentLocale = 'en';
+let fallbackLocale = 'en';
+function notify() {
+    for (const l of [...listeners])
+        l();
+}
+function splitKey(key) {
+    return key.split(/[./]/).filter(Boolean);
+}
+function setAt(tree, segs, value) {
+    let node = tree;
+    for (let i = 0; i < segs.length - 1; i++) {
+        const s = segs[i];
+        const next = node[s];
+        if (typeof next !== 'object' || next === null)
+            node[s] = {};
+        node = node[s];
+    }
+    node[segs[segs.length - 1]] = value;
+}
+function resolveAt(tree, segs) {
+    let node = tree;
+    for (const s of segs) {
+        if (typeof node !== 'object' || node === null)
+            return undefined;
+        node = node[s];
+    }
+    return node;
+}
+// Deep-merge a (possibly nested, possibly dotted-key) message object into the
+// locale tree, under an optional namespace prefix.
+function merge(tree, src, prefix) {
+    for (const [k, v] of Object.entries(src)) {
+        const segs = [...prefix, ...splitKey(k)];
+        if (v && typeof v === 'object' && !Array.isArray(v)) {
+            merge(tree, v, segs);
+        }
+        else {
+            setAt(tree, segs, String(v));
+        }
+    }
+}
+// `\{` / `\}` render literal braces; `{token}` interpolates from params (left
+// untouched when no params are supplied, so a template can survive round-trips).
+function interpolate(tpl, params) {
+    return tpl.replace(/\\([{}])|\{(\w+)\}/g, (match, esc, token) => {
+        if (esc)
+            return esc;
+        if (!params)
+            return match;
+        const v = params[token];
+        return v == null ? '' : String(v);
+    });
+}
+function collectLeaves(node, prefix, out) {
+    for (const [seg, v] of Object.entries(node)) {
+        if (typeof v === 'object' && v !== null)
+            collectLeaves(v, [...prefix, seg], out);
+        else
+            out.add([...prefix, seg].join('/'));
+    }
+}
+function deriveLocaleParts(locale) {
+    const [language, country] = locale.split('-');
+    return country ? { language, country } : { language };
+}
+// Register a locale's metadata (emoji/name/dir) for pickers — independent of
+// messages, so an inline-fallback locale (e.g. 'en') still appears in a toggle.
+export function registerLocale(info) {
+    const prev = localeInfo.get(info.locale);
+    localeInfo.set(info.locale, { ...deriveLocaleParts(info.locale), ...prev, ...info });
+    notify();
+}
+// Merge a dictionary into a locale's tree. `messages` may be nested or use
+// dotted/slashed keys. `extra.namespace` prefixes every key; the remaining
+// `extra` fields (emoji/name/country/language/dir) are merged into the locale's
+// metadata. Plugins call this on load; the $/t backend + useI18n refresh.
+export function registerMessages(locale, messages, extra) {
+    const tree = locales.get(locale) ?? {};
+    merge(tree, messages, extra?.namespace ? splitKey(extra.namespace) : []);
+    locales.set(locale, tree);
+    if (extra) {
+        const meta = { ...extra };
+        delete meta.namespace;
+        if (Object.keys(meta).length) {
+            const prev = localeInfo.get(locale);
+            localeInfo.set(locale, {
+                ...deriveLocaleParts(locale),
+                ...prev,
+                ...meta,
+                locale,
+            });
+        }
+    }
+    notify();
+}
+// Drop a subtree (namespace) from a locale, or the whole locale when no
+// namespace is given. The tree shape makes this O(subtree).
+export function unregisterMessages(locale, namespace) {
+    if (!namespace) {
+        locales.delete(locale);
+        notify();
+        return;
+    }
+    const segs = splitKey(namespace);
+    const parent = resolveAt(locales.get(locale), segs.slice(0, -1));
+    if (parent && typeof parent === 'object')
+        delete parent[segs[segs.length - 1]];
+    notify();
+}
+export function setLocale(locale) {
+    if (locale === currentLocale)
+        return;
+    currentLocale = locale;
+    notify();
+}
+export function getLocale() {
+    return currentLocale;
+}
+export function setFallbackLocale(locale) {
+    fallbackLocale = locale;
+}
+export function listLocales() {
+    return [...locales.keys()];
+}
+// All known locales (those with registered messages and/or metadata), for
+// language pickers. Locales known only by messages get a derived default.
+export function listLocaleInfo() {
+    const out = new Map();
+    for (const loc of locales.keys())
+        out.set(loc, { locale: loc, ...deriveLocaleParts(loc) });
+    for (const [loc, info] of localeInfo)
+        out.set(loc, info);
+    return [...out.values()];
+}
+// Metadata for one locale (defaults to the active locale). undefined when the
+// locale is entirely unknown.
+export function getLocaleInfo(locale = currentLocale) {
+    return (localeInfo.get(locale) ??
+        (locales.has(locale) ? { locale, ...deriveLocaleParts(locale) } : undefined));
+}
+// Resolve a key to its tree node (leaf string OR subtree object) for the active
+// locale, falling back to fallbackLocale. Used by the $/t backend so a binding
+// can target a leaf or a whole subtree.
+export function resolveMessage(key, locale = currentLocale) {
+    const segs = splitKey(key);
+    return resolveAt(locales.get(locale), segs) ?? resolveAt(locales.get(fallbackLocale), segs);
+}
+// Leaf string for a key (undefined when missing or pointing at a subtree).
+export function lookup(key, locale = currentLocale) {
+    const v = resolveMessage(key, locale);
+    return typeof v === 'string' ? v : undefined;
+}
+// Translate + interpolate. The key is ALWAYS a lookup key (never a template).
+// 2nd arg: a string (shorthand for `{ fallback }`) OR the flat options object:
+//   translate('setup.title', 'Set up doop')                       // shorthand
+//   translate('signedInAs', { name, fallback: 'Signed in as {name}' })
+//   translate('wall.title')                                       // no opts
+// Active locale → fallbackLocale → fallback. A missing key with no fallback
+// yields the `{key}` marker so gaps stay visible.
+export function translate(key, fallbackOrOptions) {
+    const opts = typeof fallbackOrOptions === 'string' ? { fallback: fallbackOrOptions } : fallbackOrOptions;
+    const tpl = lookup(key) ?? opts?.fallback;
+    if (tpl === undefined)
+        return `{${splitKey(key).join('/')}}`;
+    return interpolate(tpl, opts);
+}
+export function allKeys() {
+    const set = new Set();
+    for (const tree of locales.values())
+        collectLeaves(tree, [], set);
+    return [...set];
+}
+export function subscribeI18n(listener) {
+    listeners.add(listener);
+    return () => void listeners.delete(listener);
+}
+// Test helper — clears all messages + resets locale.
+export function clearMessages() {
+    locales.clear();
+    localeInfo.clear();
+    currentLocale = 'en';
+    fallbackLocale = 'en';
+    notify();
+}

package/dist/porta/Limen.css

@@ -0,0 +1,50 @@
+.porta-limen {
+  display: grid;
+  grid-template-rows: auto 1fr auto;
+  grid-template-columns: auto 1fr auto;
+  grid-template-areas:
+    'top    top    top'
+    'left   center right'
+    'bottom bottom bottom';
+  height: 100%;
+  min-height: 0;
+  width: 100%;
+  background: var(--oo-color-canvas);
+  color: var(--oo-color-fg);
+}
+.porta-limen__top    { grid-area: top; }
+.porta-limen__bottom { grid-area: bottom; }
+.porta-limen__left   { grid-area: left; }
+.porta-limen__right  { grid-area: right; }
+
+.porta-limen__center {
+  grid-area: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: var(--oo-spacing-lg);
+  min-height: 0;
+  overflow: auto;
+}
+
+.porta-limen__panel {
+  width: 100%;
+  max-width: 380px;
+  display: flex;
+  flex-direction: column;
+  gap: var(--oo-spacing-md);
+  padding: var(--oo-spacing-lg);
+  border: 1px solid var(--oo-color-border);
+  border-radius: var(--oo-radius-md);
+  background: var(--oo-color-surface);
+  box-shadow: var(--oo-shadow-md);
+}
+
+.porta-limen__title {
+  font-size: var(--oo-font-size-lg);
+  font-weight: 600;
+}
+.porta-limen__subtitle {
+  color: var(--oo-color-muted);
+  font-size: var(--oo-font-size-sm);
+}

package/dist/porta/Limen.d.ts

@@ -0,0 +1,16 @@
+import { type ReactNode } from 'react';
+import './Limen.css';
+export interface LimenProps {
+    permission?: string;
+    /** Replaces the default <LoginForm /> in the center. */
+    fallback?: ReactNode;
+    title?: ReactNode;
+    subtitle?: ReactNode;
+    top?: ReactNode;
+    bottom?: ReactNode;
+    left?: ReactNode;
+    right?: ReactNode;
+    child?: ReactNode;
+    children?: ReactNode;
+}
+export declare function Limen({ permission, fallback, title, subtitle, top, bottom, left, right, child, children, }: LimenProps): ReactNode;

package/dist/porta/Limen.js

@@ -0,0 +1,14 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { lazy, Suspense } from 'react';
+import { useStore } from '../react/hooks/useStore.js';
+import { SIGILLUM_PATHS } from './sigillum.js';
+// import { LoginForm } from './LoginForm.js';
+const LoginForm = lazy(() => import('../ui/forms/LoginForm.js').then(module => ({ default: module.LoginForm })));
+import { hasScope } from './match.js';
+import './Limen.css';
+export function Limen({ permission, fallback, title = 'Welcome', subtitle, top, bottom, left, right, child, children, }) {
+    const session = useStore(SIGILLUM_PATHS.session) ?? null;
+    if (hasScope(session, permission))
+        return child ?? children;
+    return (_jsxs("div", { className: "porta-limen", children: [top ? _jsx("div", { className: "porta-limen__top", children: top }) : null, left ? _jsx("div", { className: "porta-limen__left", children: left }) : null, _jsx("div", { className: "porta-limen__center", children: _jsxs("div", { className: "porta-limen__panel", children: [_jsx("div", { className: "porta-limen__title", children: title }), subtitle ? _jsx("div", { className: "porta-limen__subtitle", children: subtitle }) : null, fallback ?? _jsx(Suspense, { fallback: _jsx("div", { children: "Loading..." }), children: _jsx(LoginForm, {}) })] }) }), right ? _jsx("div", { className: "porta-limen__right", children: right }) : null, bottom ? _jsx("div", { className: "porta-limen__bottom", children: bottom }) : null] }));
+}

package/dist/porta/PortaContext.d.ts

@@ -0,0 +1,10 @@
+import { type ReactNode } from 'react';
+import type { Porta } from './register.js';
+import type { Session } from './provider.js';
+export interface PortaProviderProps {
+    porta: Porta;
+    children: ReactNode;
+}
+export declare function PortaProvider({ porta, children }: PortaProviderProps): ReactNode;
+export declare function usePorta(): Porta;
+export declare function useSession(): Session | null;

package/dist/porta/PortaContext.js

@@ -0,0 +1,20 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext } from 'react';
+import { useStore } from '../react/hooks/useStore.js';
+import { SIGILLUM_PATHS } from './sigillum.js';
+const PortaContext = createContext(null);
+// Wrap the app once (inside <ScenaProvider>). `LoginForm` and other porta
+// blocks read the registered providers + their UI metadata from here.
+export function PortaProvider({ porta, children }) {
+    return _jsx(PortaContext.Provider, { value: porta, children: children });
+}
+export function usePorta() {
+    const ctx = useContext(PortaContext);
+    if (!ctx) {
+        throw new Error('usePorta(): no <PortaProvider> in scope. Wrap your app with <PortaProvider porta={createPorta(scena, …)}>.');
+    }
+    return ctx;
+}
+export function useSession() {
+    return useStore(SIGILLUM_PATHS.session) ?? null;
+}

package/dist/porta/PortaLock.css

@@ -0,0 +1,14 @@
+.porta-locked {
+  display: flex;
+  flex-direction: column;
+  gap: var(--oo-spacing-md);
+  padding: var(--oo-spacing-md);
+  border: 1px dashed var(--oo-color-border);
+  border-radius: var(--oo-radius-sm);
+  background: var(--oo-color-surface);
+}
+.porta-locked__title {
+  font-weight: 600;
+  color: var(--oo-color-muted);
+  font-size: var(--oo-font-size-sm);
+}

package/dist/porta/PortaLock.d.ts

@@ -0,0 +1,10 @@
+import type { ReactNode } from 'react';
+import './PortaLock.css';
+export interface PortaLockProps {
+    permission?: string;
+    fallback?: ReactNode;
+    title?: string;
+    child?: ReactNode;
+    children?: ReactNode;
+}
+export declare function PortaLock({ permission, fallback, title, child, children, }: PortaLockProps): ReactNode;

package/dist/porta/PortaLock.js

@@ -0,0 +1,13 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useStore } from '../react/hooks/useStore.js';
+import { SIGILLUM_PATHS } from './sigillum.js';
+import { LoginForm } from '../ui/forms/LoginForm.js';
+import { hasScope } from './match.js';
+import './PortaLock.css';
+export function PortaLock({ permission, fallback, title, child, children, }) {
+    const session = useStore(SIGILLUM_PATHS.session) ?? null;
+    const ok = hasScope(session, permission);
+    if (ok)
+        return child ?? children;
+    return (_jsxs("div", { className: "porta-locked", children: [_jsx("span", { className: "porta-locked__title", children: title ?? (permission ? `Sign in required (${permission})` : 'Sign in required') }), fallback ?? _jsx(LoginForm, {})] }));
+}

package/dist/porta/SigillumGate.d.ts

@@ -0,0 +1,8 @@
+import type { ReactNode } from 'react';
+export interface SigillumProps {
+    permission?: string;
+    fallback?: ReactNode;
+    child?: ReactNode;
+    children?: ReactNode;
+}
+export declare function Sigillum({ permission, fallback, child, children, }: SigillumProps): ReactNode;

package/dist/porta/SigillumGate.js

@@ -0,0 +1,7 @@
+import { useStore } from '../react/hooks/useStore.js';
+import { SIGILLUM_PATHS } from './sigillum.js';
+import { hasScope } from './match.js';
+export function Sigillum({ permission, fallback = null, child, children, }) {
+    const session = useStore(SIGILLUM_PATHS.session) ?? null;
+    return hasScope(session, permission) ? (child ?? children) : fallback;
+}

package/dist/porta/commands.d.ts

@@ -0,0 +1,3 @@
+import type { Scena } from '../types/scena.js';
+import type { PortaProvider } from './provider.js';
+export declare function registerSigillumCommands(scena: Scena, providers: Map<string, PortaProvider>): void;

package/dist/porta/commands.js

@@ -0,0 +1,125 @@
+import { SIGILLUM_PATHS } from './sigillum.js';
+// Registers the four sigillum.* commands. The composer (`LoginForm`) and the
+// app dispatch these — providers don't talk to commands directly, they're
+// invoked here by id lookup.
+export function registerSigillumCommands(scena, providers) {
+    scena.commands.register({
+        id: 'sigillum.signin',
+        title: 'Sign in',
+        dispatch: 'client',
+        run: async (ctx, args) => {
+            const a = (args ?? {});
+            const provider = providers.get(a.providerId);
+            if (!provider)
+                throw new Error(`Unknown provider "${a.providerId}"`);
+            if (!provider.signin)
+                throw new Error(`Provider "${a.providerId}" has no signin()`);
+            ctx.store.patchMany({
+                [SIGILLUM_PATHS.pending]: true,
+                [SIGILLUM_PATHS.error]: null,
+            });
+            try {
+                const session = await provider.signin(a.credentials);
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.session]: { ...session, _providerId: a.providerId },
+                    [SIGILLUM_PATHS.pending]: false,
+                    [SIGILLUM_PATHS.challenge]: null,
+                });
+            }
+            catch (err) {
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.pending]: false,
+                    [SIGILLUM_PATHS.error]: err instanceof Error ? err.message : 'Sign-in failed',
+                });
+            }
+        },
+    });
+    scena.commands.register({
+        id: 'sigillum.signout',
+        title: 'Sign out',
+        dispatch: 'client',
+        run: async (ctx) => {
+            const session = ctx.store.get(SIGILLUM_PATHS.session);
+            if (session?._providerId) {
+                const provider = providers.get(session._providerId);
+                try {
+                    await provider?.signout?.(session);
+                }
+                catch {
+                    // Best-effort cleanup; never block sign-out on provider failure.
+                }
+            }
+            ctx.store.patchMany({
+                [SIGILLUM_PATHS.session]: null,
+                [SIGILLUM_PATHS.challenge]: null,
+                [SIGILLUM_PATHS.error]: null,
+            });
+        },
+    });
+    scena.commands.register({
+        id: 'sigillum.requestOtp',
+        title: 'Request code',
+        dispatch: 'client',
+        run: async (ctx, args) => {
+            const a = (args ?? {});
+            const provider = providers.get(a.providerId);
+            if (!provider)
+                throw new Error(`Unknown provider "${a.providerId}"`);
+            if (!provider.request)
+                throw new Error(`Provider "${a.providerId}" has no request()`);
+            ctx.store.patchMany({
+                [SIGILLUM_PATHS.pending]: true,
+                [SIGILLUM_PATHS.error]: null,
+            });
+            try {
+                const { challengeId } = await provider.request(a.value);
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.challenge]: { providerId: a.providerId, id: challengeId },
+                    [SIGILLUM_PATHS.pending]: false,
+                });
+            }
+            catch (err) {
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.pending]: false,
+                    [SIGILLUM_PATHS.error]: err instanceof Error ? err.message : 'Request failed',
+                });
+            }
+        },
+    });
+    scena.commands.register({
+        id: 'sigillum.verifyOtp',
+        title: 'Verify code',
+        dispatch: 'client',
+        run: async (ctx, args) => {
+            const a = (args ?? {});
+            const provider = providers.get(a.providerId);
+            if (!provider)
+                throw new Error(`Unknown provider "${a.providerId}"`);
+            if (!provider.verify)
+                throw new Error(`Provider "${a.providerId}" has no verify()`);
+            const challenge = ctx.store.get(SIGILLUM_PATHS.challenge);
+            if (!challenge || challenge.providerId !== a.providerId) {
+                ctx.store.set(SIGILLUM_PATHS.error, 'No active challenge for this provider');
+                return;
+            }
+            ctx.store.patchMany({
+                [SIGILLUM_PATHS.pending]: true,
+                [SIGILLUM_PATHS.error]: null,
+            });
+            try {
+                const session = await provider.verify(challenge.id, a.code);
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.session]: { ...session, _providerId: a.providerId },
+                    [SIGILLUM_PATHS.pending]: false,
+                    [SIGILLUM_PATHS.challenge]: null,
+                });
+            }
+            catch (err) {
+                ctx.store.patchMany({
+                    [SIGILLUM_PATHS.pending]: false,
+                    [SIGILLUM_PATHS.error]: err instanceof Error ? err.message : 'Verify failed',
+                });
+            }
+        },
+    });
+}

package/dist/porta/index.d.ts

@@ -0,0 +1,18 @@
+export { createPorta } from './register.js';
+export type { Porta, CreatePortaOpts } from './register.js';
+export { createSigillum, SIGILLUM_PATHS } from './sigillum.js';
+export type { Sigillum as SigillumRuntime } from './sigillum.js';
+export { registerSigillumCommands } from './commands.js';
+export type { PortaProvider, PortaProviderKind, AuthField, Session, ProviderRenderContext, } from './provider.js';
+export { passwordProvider } from './providers/password.js';
+export type { PasswordProviderOpts, PasswordUser } from './providers/password.js';
+export { PortaProvider as PortaContextProvider, usePorta, useSession } from './PortaContext.js';
+export { Sigillum } from './SigillumGate.js';
+export type { SigillumProps } from './SigillumGate.js';
+export { PortaLock } from './PortaLock.js';
+export type { PortaLockProps } from './PortaLock.js';
+export { Limen } from './Limen.js';
+export type { LimenProps } from './Limen.js';
+export { hasScope } from './match.js';
+export { loginFormBlock } from './login-form.block.js';
+export { registerPortaBlocks } from './register-blocks.js';

package/dist/porta/index.js

@@ -0,0 +1,22 @@
+// Public surface for `@softov/scena/porta`.
+export { createPorta } from './register.js';
+// Runtime sigillum facade — `session()`, `has(scope)`, `isPending()`, …
+// Type is re-exported as `SigillumRuntime` to avoid colliding with the
+// React component `<Sigillum>` below.
+export { createSigillum, SIGILLUM_PATHS } from './sigillum.js';
+export { registerSigillumCommands } from './commands.js';
+export { passwordProvider } from './providers/password.js';
+export { PortaProvider as PortaContextProvider, usePorta, useSession } from './PortaContext.js';
+// Three React gates, distinct intents:
+//   <Sigillum>  — silent gate. Renders children or nothing (or `fallback`).
+//   <PortaLock> — inline gate. Renders a bordered fallback (LoginForm by default).
+//   <Limen>     — full-page wall. Centered Porta + top/bottom/left/right slots.
+// Sigillum.tsx was renamed to SigillumGate.tsx to avoid a case-collision
+// with sigillum.ts on case-insensitive filesystems (Windows). The component
+// is still exported as `Sigillum`.
+export { Sigillum } from './SigillumGate.js';
+export { PortaLock } from './PortaLock.js';
+export { Limen } from './Limen.js';
+export { hasScope } from './match.js';
+export { loginFormBlock } from './login-form.block.js';
+export { registerPortaBlocks } from './register-blocks.js';

package/dist/porta/login-form.block.d.ts

@@ -0,0 +1,2 @@
+import type { ComponentNode } from '../types/component-graph.js';
+export declare const loginFormBlock: ComponentNode;

package/dist/porta/login-form.block.js

@@ -0,0 +1,7 @@
+// Declarative equivalent of <LoginForm />. Reference 'Porta.LoginForm' from
+// agent-sent payloads or any ComponentNode tree.
+export const loginFormBlock = {
+    component: 'Porta.LoginForm',
+    allowSignup: false,
+    allowForgotPassword: false,
+};

package/dist/porta/match.d.ts

@@ -0,0 +1,2 @@
+import type { Session } from './provider.js';
+export declare function hasScope(session: Session | null, scope: string | undefined): boolean;

package/dist/porta/match.js

@@ -0,0 +1,20 @@
+// Permission matcher used by Sigillum (runtime) + the three React gates.
+// v0 rule: equality + trailing `.*` wildcard. See plan doc PENDING note for
+// the broader rule set (RBAC, namespace separator alternatives).
+//
+// hasScope(session, undefined) → "any session exists"
+// hasScope(session, 'agents.write')   matches a granted 'agents.write'
+// hasScope(session, 'agents.write')   matches a granted 'agents.*'
+export function hasScope(session, scope) {
+    if (!scope)
+        return Boolean(session);
+    if (!session?.permissions)
+        return false;
+    return session.permissions.some((p) => {
+        if (p === scope)
+            return true;
+        if (p.endsWith('.*'))
+            return scope.startsWith(p.slice(0, -1));
+        return false;
+    });
+}