@forgecart/cli 2.202610141948.0 → 2.202610142335.0

package/templates/storefront-shadcn/src/components/account/AccountPanel.tsx

@@ -0,0 +1,290 @@
+'use client';
+
+import type { NativeAuthInput } from '@forgecart/sdk/shop';
+import { useEffect, useState } from 'react';
+
+import { AccountMessage, type AccountMessageTone } from './AccountMessage';
+import { VerificationResend } from './VerificationResend';
+import { LocaleLink } from '../LocaleLink';
+import { Button, buttonVariants } from '../ui/button';
+import { Card, CardContent } from '../ui/card';
+import { Input } from '../ui/input';
+import { Label } from '../ui/label';
+import { Skeleton } from '../ui/skeleton';
+import { findSignedInCustomer, loginCustomer, logoutCustomer } from '../../lib/account-session';
+import {
+  LOADING_VIEW,
+  greetingView,
+  offersVerificationResend,
+  signInRefusedView,
+  signInView,
+  signedOutView,
+  type AccountRefusal,
+  type AccountStep,
+  type AccountView,
+  type SignedInCustomer,
+} from '../../lib/account/account-state';
+import { useCart } from '../../lib/cart-context';
+import { shopperMessage } from '../../lib/error-messages';
+import type { LocaleBinding } from '../../lib/locale/localized-path';
+
+/**
+ * The account page's client island (#1093): the sign-in form, the greeting, and
+ * the way out.
+ *
+ * Everything here runs on the shopper's OWN socket, never on the server: the
+ * page around it is a static shell, because a session read on the server path
+ * threw `EmptyError: no elements in sequence` and 500'd the render. Signing in
+ * and out goes through `lib/account-session.ts`, whose helpers own the socket's
+ * rotation — a panel cannot get it wrong, because it never touches the socket.
+ *
+ * The island waits for the cart provider's `hydrated` before it asks anything.
+ * The provider is what arms the session singleton, and a parent's effects run
+ * AFTER its children's: an island that asked on its own mount would find no
+ * socket. Until then it renders the skeleton the server painted, so a returning
+ * customer lands on their greeting without a flash of the sign-in form first.
+ *
+ * Which view an answer IS is decided in `lib/account/account-state.ts`, and
+ * every refusal renders through `shopperMessage` — this component renders.
+ */
+
+/** How each call's refusal is introduced; the body is `shopperMessage`'s copy. */
+const REFUSAL_HEADINGS: Readonly<Record<AccountStep, { tone: AccountMessageTone; title: string }>> =
+  {
+    greeting: { tone: 'error', title: 'We could not check your account' },
+    'sign-in': { tone: 'error', title: 'We could not sign you in' },
+    'sign-out': { tone: 'warning', title: 'You are signed out on this device' },
+  };
+
+/** The message a refusal renders as, or nothing when the form has nothing to report. */
+function refusalNotice(
+  refusal: AccountRefusal | null,
+): { tone: AccountMessageTone; title: string; body: string } | null {
+  if (refusal === null) return null;
+  return { ...REFUSAL_HEADINGS[refusal.step], body: shopperMessage(refusal) };
+}
+
+export function AccountPanel({ locale }: { locale: LocaleBinding }) {
+  const { hydrated, refresh } = useCart();
+  const [view, setView] = useState<AccountView>(LOADING_VIEW);
+  const [refusedAddress, setRefusedAddress] = useState('');
+  const [pending, setPending] = useState(false);
+
+  useEffect(() => {
+    if (!hydrated) return;
+    let cancelled = false;
+    void (async () => {
+      const outcome = await findSignedInCustomer();
+      if (!cancelled) setView(greetingView(outcome));
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [hydrated]);
+
+  /**
+   * `pending` refuses a re-entrant call: a keyboard Enter can fire while a click
+   * is already in flight, before `disabled` has painted. A sign-in that lands
+   * re-reads the cart, because the session it belongs to is now the shopper's.
+   * An accepted sign-in whose greeting fails is signed out again before the
+   * refusal renders: the tab never stays signed in behind a failed sign-in.
+   */
+  async function signIn(credentials: NativeAuthInput): Promise<void> {
+    if (pending) return;
+    setPending(true);
+    const outcome = await loginCustomer(credentials);
+    if (outcome.kind === 'error') {
+      setRefusedAddress(credentials.emailAddress);
+      setView(signInRefusedView(outcome.code));
+      setPending(false);
+      return;
+    }
+    const next = signInView(await findSignedInCustomer());
+    if (next.state !== 'signed-in') await logoutCustomer();
+    refresh();
+    setView(next);
+    setPending(false);
+  }
+
+  /** Same guard. The cart is re-read: this tab no longer carries the session it belonged to. */
+  async function signOut(): Promise<void> {
+    if (pending) return;
+    setPending(true);
+    const outcome = await logoutCustomer();
+    refresh();
+    setView(signedOutView(outcome));
+    setPending(false);
+  }
+
+  if (view.state === 'loading') return <AccountSkeleton />;
+
+  if (view.state === 'signed-in') {
+    return (
+      <Greeting
+        customer={view.customer}
+        locale={locale}
+        pending={pending}
+        onSignOut={() => void signOut()}
+      />
+    );
+  }
+
+  return (
+    <SignInForm
+      locale={locale}
+      refusal={view.refusal}
+      resendTo={offersVerificationResend(view) ? refusedAddress : null}
+      pending={pending}
+      onSignIn={signIn}
+    />
+  );
+}
+
+function Greeting({
+  customer,
+  locale,
+  pending,
+  onSignOut,
+}: {
+  customer: SignedInCustomer;
+  locale: LocaleBinding;
+  pending: boolean;
+  onSignOut: () => void;
+}) {
+  return (
+    <div className="space-y-6" data-fc-account-mode="account" data-fc-account-state="signed-in">
+      <Card>
+        <CardContent className="space-y-2">
+          <h2 className="text-lg font-semibold">Hello, {customer.firstName}</h2>
+          <p className="text-sm text-muted-foreground">
+            You are signed in as {customer.emailAddress}.
+          </p>
+        </CardContent>
+      </Card>
+
+      <div className="flex flex-wrap gap-3">
+        <LocaleLink href="/products" locale={locale} className={buttonVariants()}>
+          Continue shopping
+        </LocaleLink>
+        <Button type="button" variant="ghost" disabled={pending} onClick={onSignOut}>
+          {pending ? 'Signing out…' : 'Sign out'}
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+function SignInForm({
+  locale,
+  refusal,
+  resendTo,
+  pending,
+  onSignIn,
+}: {
+  locale: LocaleBinding;
+  /** The refusal that put the form here, if any. */
+  refusal: AccountRefusal | null;
+  /** The address to offer the confirmation mail to, when the refusal calls for one. */
+  resendTo: string | null;
+  pending: boolean;
+  onSignIn: (credentials: NativeAuthInput) => Promise<void>;
+}) {
+  const [emailAddress, setEmailAddress] = useState('');
+  const [password, setPassword] = useState('');
+
+  async function submit(): Promise<void> {
+    await onSignIn({ emailAddress, password });
+    // The password only ever lived in this component's state; drop it as soon
+    // as the answer is in, whatever the answer was.
+    setPassword('');
+  }
+
+  const notice = refusalNotice(refusal);
+  return (
+    <form
+      className="space-y-4"
+      data-fc-account-mode="account"
+      data-fc-account-state="signed-out"
+      onSubmit={(event) => {
+        event.preventDefault();
+        void submit();
+      }}
+    >
+      <p className="text-sm text-muted-foreground">
+        Sign in with the e-mail address and password you registered with.
+      </p>
+
+      {notice && (
+        <AccountMessage tone={notice.tone} title={notice.title}>
+          {notice.body}
+        </AccountMessage>
+      )}
+
+      {resendTo !== null && <VerificationResend key={resendTo} emailAddress={resendTo} />}
+
+      <div className="grid gap-2">
+        <Label htmlFor="sign-in-email">E-mail address</Label>
+        <Input
+          id="sign-in-email"
+          type="email"
+          required
+          autoComplete="email"
+          value={emailAddress}
+          onChange={(event) => setEmailAddress(event.target.value)}
+        />
+      </div>
+
+      <div className="grid gap-2">
+        <Label htmlFor="sign-in-password">Password</Label>
+        <Input
+          id="sign-in-password"
+          type="password"
+          required
+          autoComplete="current-password"
+          value={password}
+          onChange={(event) => setPassword(event.target.value)}
+        />
+      </div>
+
+      <div className="flex flex-wrap items-center gap-4">
+        <Button type="submit" disabled={pending}>
+          {pending ? 'Signing in…' : 'Sign in'}
+        </Button>
+        <LocaleLink
+          href="/reset-password"
+          locale={locale}
+          className="text-sm underline-offset-4 hover:text-foreground hover:underline"
+        >
+          Forgot your password?
+        </LocaleLink>
+      </div>
+
+      <p className="text-sm text-muted-foreground">
+        New here?{' '}
+        <LocaleLink
+          href="/register"
+          locale={locale}
+          className="font-medium text-primary underline-offset-4 hover:underline"
+        >
+          Create an account
+        </LocaleLink>
+      </p>
+    </form>
+  );
+}
+
+function AccountSkeleton() {
+  return (
+    <div
+      className="space-y-4"
+      aria-busy="true"
+      aria-label="Loading your account"
+      data-fc-account-mode="account"
+      data-fc-account-state="loading"
+    >
+      <Skeleton className="h-10 w-full" />
+      <Skeleton className="h-10 w-full" />
+      <Skeleton className="h-10 w-32" />
+    </div>
+  );
+}

package/templates/storefront-shadcn/src/components/account/RegisterForm.tsx

@@ -3,17 +3,13 @@
 import { useState } from 'react';
 
 import { AccountMessage, type AccountMessageTone } from './AccountMessage';
+import { VerificationResend } from './VerificationResend';
 import { LocaleLink } from '../LocaleLink';
 import { Button, buttonVariants } from '../ui/button';
 import { Input } from '../ui/input';
 import { Label } from '../ui/label';
-import { submitVerificationRequest } from '../../lib/account-actions';
 import { registerCustomerAccount } from '../../lib/account-session';
-import {
-  registerState,
-  type RegisterState,
-  type VerificationResendState,
-} from '../../lib/account/register-state';
+import { registerState, type RegisterState } from '../../lib/account/register-state';
 import type { LocaleBinding } from '../../lib/locale/localized-path';
 
 /**
@@ -29,8 +25,8 @@ import type { LocaleBinding } from '../../lib/locale/localized-path';
  * The submit runs on the shopper's OWN websocket rather than through a Server
  * Action, because the API's protection against a double-clicked submit is
  * scoped to their session — `lib/account-session.ts` carries the full
- * argument. The RESEND below is a Server Action, because it needs nothing but
- * an address.
+ * argument. The RESEND (`VerificationResend`) is a Server Action, because it
+ * needs nothing but an address.
  *
  * Which screen an outcome produces is decided in
  * `lib/account/register-state.ts`; this component renders it.
@@ -59,39 +55,13 @@ const PROMPTS: Readonly<
   },
 };
 
-/**
- * What a SUBMITTED resend says. `idle` has no entry because it is the
- * pre-submit state and renders nothing.
- *
- * `sent` is worded so it is true for every address a shopper can type — one
- * with a pending account, one with none, and one the platform's throttle
- * silently swallowed. That is the same neutrality the reset-request form
- * carries, and `verificationResendState` is where it is decided.
- */
-const RESEND_MESSAGES: Readonly<
-  Record<'sent' | 'failed', { tone: AccountMessageTone; title: string; body: string }>
-> = {
-  sent: {
-    tone: 'success',
-    title: 'On its way',
-    body: 'If that address is waiting to be confirmed, a link is on its way to it. A mail we sent a moment ago still works, so it is worth checking for that one too.',
-  },
-  failed: {
-    tone: 'error',
-    title: 'We could not send that e-mail',
-    body: 'Something went wrong on our side and nothing has been sent. Please try again in a few minutes.',
-  },
-};
-
 export function RegisterForm({ locale }: { locale: LocaleBinding }) {
   const [firstName, setFirstName] = useState('');
   const [lastName, setLastName] = useState('');
   const [emailAddress, setEmailAddress] = useState('');
   const [password, setPassword] = useState('');
   const [state, setState] = useState<RegisterState>('form');
-  const [resend, setResend] = useState<VerificationResendState>('idle');
   const [pending, setPending] = useState(false);
-  const [resendPending, setResendPending] = useState(false);
 
   /**
    * The guard is the FIRST half of #1471's double-submit fix: the button is
@@ -118,19 +88,6 @@ export function RegisterForm({ locale }: { locale: LocaleBinding }) {
     setState(registerState(outcome));
   }
 
-  /**
-   * Same guard, and it matters more here: this button triggers a MAIL, so a
-   * re-entrant click is a mail a shopper did not ask for. The platform throttles
-   * it too — silently, which is why a refused resend still renders as sent.
-   */
-  async function requestAnotherMail(): Promise<void> {
-    if (resendPending) return;
-    setResendPending(true);
-    const next = await submitVerificationRequest(emailAddress);
-    setResendPending(false);
-    setResend(next);
-  }
-
   if (state === 'signed-in-already') {
     return (
       <div className="space-y-6" data-fc-account-mode="register" data-fc-account-state={state}>
@@ -138,8 +95,8 @@ export function RegisterForm({ locale }: { locale: LocaleBinding }) {
           This address is already confirmed, so there is nothing left to do here — you can sign in
           with it whenever you like.
         </AccountMessage>
-        <LocaleLink href="/" locale={locale} className={buttonVariants()}>
-          Continue shopping
+        <LocaleLink href="/account" locale={locale} className={buttonVariants()}>
+          Sign in
         </LocaleLink>
       </div>
     );
@@ -147,27 +104,17 @@ export function RegisterForm({ locale }: { locale: LocaleBinding }) {
 
   if (state === 'verify-your-email' || state === 'already-registered') {
     const prompt = PROMPTS[state];
-    const resendMessage = resend === 'idle' ? null : RESEND_MESSAGES[resend];
     return (
       <div className="space-y-6" data-fc-account-mode="register" data-fc-account-state={state}>
         <AccountMessage tone={prompt.tone} title={prompt.title}>
           {prompt.body}
         </AccountMessage>
 
-        {resendMessage && (
-          <AccountMessage tone={resendMessage.tone} title={resendMessage.title}>
-            {resendMessage.body}
-          </AccountMessage>
-        )}
-
-        <div className="flex flex-wrap gap-3">
-          <Button type="button" disabled={resendPending} onClick={() => void requestAnotherMail()}>
-            {resendPending ? 'Sending…' : 'Send the confirmation e-mail again'}
-          </Button>
+        <VerificationResend emailAddress={emailAddress}>
           <LocaleLink href="/" locale={locale} className={buttonVariants({ variant: 'ghost' })}>
             Continue shopping
           </LocaleLink>
-        </div>
+        </VerificationResend>
       </div>
     );
   }
@@ -252,6 +199,17 @@ export function RegisterForm({ locale }: { locale: LocaleBinding }) {
       <Button type="submit" disabled={pending}>
         {pending ? 'Creating your account…' : 'Create account'}
       </Button>
+
+      <p className="text-sm text-muted-foreground">
+        Already have an account?{' '}
+        <LocaleLink
+          href="/account"
+          locale={locale}
+          className="font-medium text-primary underline-offset-4 hover:underline"
+        >
+          Sign in
+        </LocaleLink>
+      </p>
     </form>
   );
 }

package/templates/storefront-shadcn/src/components/account/ResetPasswordForm.tsx

@@ -80,8 +80,8 @@ export function ResetPasswordForm({ token, locale }: { token: string; locale: Lo
         <AccountMessage tone="success" title="Your password has been changed">
           You can sign in with your new password from now on.
         </AccountMessage>
-        <LocaleLink href="/" locale={locale} className={buttonVariants()}>
-          Continue shopping
+        <LocaleLink href="/account" locale={locale} className={buttonVariants()}>
+          Sign in
         </LocaleLink>
       </div>
     );

package/templates/storefront-shadcn/src/components/account/VerificationResend.tsx

@@ -0,0 +1,92 @@
+'use client';
+
+import { useState, type ReactNode } from 'react';
+
+import { AccountMessage, type AccountMessageTone } from './AccountMessage';
+import { Button } from '../ui/button';
+import { submitVerificationRequest } from '../../lib/account-actions';
+import type { VerificationResendState } from '../../lib/account/register-state';
+
+/**
+ * Send the confirmation e-mail again (#1471, #1093) — the one key an UNCONFIRMED
+ * account's owner has. Rendered wherever such an account stops a shopper: the
+ * register prompt, for the address they just registered, and the sign-in form,
+ * after the API refused a sign-in NOT_VERIFIED. Without it that shopper has
+ * nowhere to go: the mail they lost is the only way to confirm the account.
+ *
+ * A Server Action rather than the shopper's socket: the resend needs nothing but
+ * an address, so it runs on the anonymous channel singleton like the reset
+ * request (`lib/account-actions.ts`).
+ *
+ * Renders the resend's answer, then a row holding the button and whatever the
+ * caller passes as `children` — its own next step beside it.
+ */
+
+/**
+ * What a SUBMITTED resend says. `idle` has no entry because it is the
+ * pre-submit state and renders nothing.
+ *
+ * `sent` is worded so it is true for every address a shopper can type — one
+ * with a pending account, one with none, and one the platform's throttle
+ * silently swallowed. That is the same neutrality the reset-request form
+ * carries, and `verificationResendState` is where it is decided.
+ */
+const RESEND_MESSAGES: Readonly<
+  Record<'sent' | 'failed', { tone: AccountMessageTone; title: string; body: string }>
+> = {
+  sent: {
+    tone: 'success',
+    title: 'On its way',
+    body: 'If that address is waiting to be confirmed, a link is on its way to it. A mail we sent a moment ago still works, so it is worth checking for that one too.',
+  },
+  failed: {
+    tone: 'error',
+    title: 'We could not send that e-mail',
+    body: 'Something went wrong on our side and nothing has been sent. Please try again in a few minutes.',
+  },
+};
+
+export function VerificationResend({
+  emailAddress,
+  children,
+}: {
+  /** The address the confirmation mail goes to. */
+  emailAddress: string;
+  /** The caller's own next step, rendered beside the button. */
+  children?: ReactNode;
+}) {
+  const [resend, setResend] = useState<VerificationResendState>('idle');
+  const [pending, setPending] = useState(false);
+
+  /**
+   * This button triggers a MAIL, so a re-entrant click is a mail a shopper did
+   * not ask for: `pending` refuses one even before `disabled` has painted. The
+   * platform throttles it too — silently, which is why a refused resend still
+   * renders as sent.
+   */
+  async function requestAnotherMail(): Promise<void> {
+    if (pending) return;
+    setPending(true);
+    const next = await submitVerificationRequest(emailAddress);
+    setPending(false);
+    setResend(next);
+  }
+
+  const message = resend === 'idle' ? null : RESEND_MESSAGES[resend];
+  return (
+    <>
+      {message && (
+        <AccountMessage tone={message.tone} title={message.title}>
+          {message.body}
+        </AccountMessage>
+      )}
+
+      <div className="flex flex-wrap gap-3">
+        <Button type="button" disabled={pending} onClick={() => void requestAnotherMail()}>
+          {pending ? 'Sending…' : 'Send the confirmation e-mail again'}
+        </Button>
+        {children}
+      </div>
+    </>
+  );
+}

package/templates/storefront-shadcn/src/lib/account/account-state.ts

@@ -0,0 +1,152 @@
+import type { AccountCallOutcome } from './account-link';
+
+/**
+ * What `/account` renders, as a value (#1093).
+ *
+ * PURE BY CONTRACT, for the reasons `account-link.ts` states. The panel owns the
+ * COPY; this module owns which view a given answer of the shop API IS, so every
+ * decision the sign-in surface makes is a table of vectors and the panel is a
+ * render.
+ *
+ * The page is a static shell and the session lives on the shopper's own socket,
+ * so nothing here is known at render time: the server paints `loading`, and the
+ * panel asks the socket who is signed in once the cart provider has armed it.
+ */
+
+/** The shopper a signed-in session belongs to, as the account page greets them. */
+export interface SignedInCustomer {
+  readonly firstName: string;
+  readonly lastName: string;
+  readonly emailAddress: string;
+}
+
+/**
+ * What the shop API answered when asked who this socket's session belongs to.
+ *
+ * `customer: null` is an ordinary answer, not an error: a socket carrying no
+ * session, and an anonymous cart session, both belong to nobody.
+ */
+export type ActiveCustomerOutcome =
+  | { kind: 'ok'; customer: SignedInCustomer | null }
+  | { kind: 'error'; code: string };
+
+/** The call a refusal answered — what the panel says went wrong. */
+export type AccountStep = 'greeting' | 'sign-in' | 'sign-out';
+
+/** A refusal the panel renders, with the call it answered. */
+export interface AccountRefusal {
+  readonly step: AccountStep;
+  readonly code: string;
+}
+
+/**
+ * The views of the account page — each `state` is the `data-fc-account-state`
+ * the panel stamps.
+ *
+ *  - `loading`    — the server render, and every client render until the
+ *                   socket has been asked. A skeleton, never the form: a
+ *                   returning customer must land on their greeting without a
+ *                   flash of the sign-in form first.
+ *  - `signed-out` — the sign-in form, with the refusal that put it there, if
+ *                   any.
+ *  - `signed-in`  — the greeting and the way out.
+ */
+export type AccountView =
+  | { readonly state: 'loading' }
+  | { readonly state: 'signed-out'; readonly refusal: AccountRefusal | null }
+  | { readonly state: 'signed-in'; readonly customer: SignedInCustomer };
+
+/** The view the server renders. */
+export const LOADING_VIEW: AccountView = { state: 'loading' };
+
+/**
+ * The codes that mean the session the socket presented is OVER: the API holds
+ * no session for the token (`SESSION_NOT_FOUND`), or the request carried none
+ * it could use (`UNAUTHORIZED` — the guard's answer for a token that resolves
+ * to no session).
+ *
+ * A session that is over is a shopper who is signed out, not a fault: the
+ * greeting renders the form without a message, and a sign-out that finds the
+ * session already gone has done what it was asked.
+ */
+const SESSION_GONE_CODES: ReadonlySet<string> = new Set(['UNAUTHORIZED', 'SESSION_NOT_FOUND']);
+
+/**
+ * The refusal of a sign-in whose session greets nobody: the credentials were
+ * accepted, but the session belongs to no customer of THIS store — the code
+ * `/verify`'s `wrong-store` state reads for the same situation.
+ */
+const NO_CUSTOMER_CODE = 'CUSTOMER_NOT_FOUND';
+
+/** The refusal that a confirmation mail answers. */
+const NOT_VERIFIED_CODE = 'NOT_VERIFIED';
+
+/** Whether a refusal says the session it was asked about no longer exists. */
+export function isSessionGone(code: string): boolean {
+  return SESSION_GONE_CODES.has(code);
+}
+
+/**
+ * The view the page lands in when it asks who is signed in on arrival.
+ *
+ * A session that greets nobody — none on the socket, an anonymous cart session,
+ * or one that is over — is the sign-in form with nothing to apologise for. Any
+ * other refusal is shown: the form still renders, because a shopper who cannot
+ * be greeted can still try to sign in.
+ */
+export function greetingView(outcome: ActiveCustomerOutcome): AccountView {
+  if (outcome.kind === 'ok' && outcome.customer !== null) {
+    return { state: 'signed-in', customer: outcome.customer };
+  }
+  if (outcome.kind === 'ok' || isSessionGone(outcome.code)) {
+    return { state: 'signed-out', refusal: null };
+  }
+  return { state: 'signed-out', refusal: { step: 'greeting', code: outcome.code } };
+}
+
+/**
+ * The view an ACCEPTED sign-in lands in, from the greeting asked right after it.
+ *
+ * Unlike {@link greetingView}, "nobody is signed in" is never a silent answer
+ * here: the shopper has just been told yes, so a session that greets nobody is
+ * a failed sign-in and is rendered as one. A session that is gone the moment it
+ * was minted is the #1089 signature — a socket still speaking for the session
+ * it opened with — and is shown with its code rather than folded away.
+ */
+export function signInView(outcome: ActiveCustomerOutcome): AccountView {
+  if (outcome.kind === 'error') {
+    return { state: 'signed-out', refusal: { step: 'sign-in', code: outcome.code } };
+  }
+  if (outcome.customer === null) {
+    return { state: 'signed-out', refusal: { step: 'sign-in', code: NO_CUSTOMER_CODE } };
+  }
+  return { state: 'signed-in', customer: outcome.customer };
+}
+
+/** The view a REFUSED sign-in lands in. */
+export function signInRefusedView(code: string): AccountView {
+  return { state: 'signed-out', refusal: { step: 'sign-in', code } };
+}
+
+/**
+ * The view a sign-out lands in. Always `signed-out` — the session helper has
+ * left this tab without a session whatever the API answered — and a refusal is
+ * shown only when the API could not confirm the session ended.
+ */
+export function signedOutView(outcome: AccountCallOutcome): AccountView {
+  if (outcome.kind === 'ok') return { state: 'signed-out', refusal: null };
+  return { state: 'signed-out', refusal: { step: 'sign-out', code: outcome.code } };
+}
+
+/**
+ * Whether the view offers to send the confirmation mail again: only after a
+ * sign-in the API refused because the account was never confirmed. Without it
+ * that shopper has nowhere to go — the mail they lost is the only key.
+ */
+export function offersVerificationResend(view: AccountView): boolean {
+  return (
+    view.state === 'signed-out' &&
+    view.refusal?.step === 'sign-in' &&
+    view.refusal.code === NOT_VERIFIED_CODE
+  );
+}