@asteby/storefront 0.16.1 → 0.18.0

package/dist/mock.d.cts

@@ -1,4 +1,4 @@
-import { a2 as IdentityRulesV1, ba as RegionFiscalId, a0 as IdentityDocumentSpec, b8 as Region, br as Shop, aX as Product, x as Collection, by as Theme, aC as Page, al as Menu, b as Article, C as Cart, A as Address, ab as InvoiceRequest, z as Customer, X as FiscalProfile, as as Order, aF as PaymentAttemptResult, aU as PendingPayment, ad as InvoiceStage, B as CustomerCapabilities, b2 as PromotionAnnouncement, bq as ShippingRate, aM as PaymentMethod } from './types-C5nEQicj.cjs';
+import { bM as SubjectKind, a6 as IdentityRulesV1, bg as RegionFiscalId, a4 as IdentityDocumentSpec, be as Region, bx as Shop, a$ as Product, y as Collection, bP as Theme, aG as Page, ap as Menu, c as Article, C as Cart, a as Address, af as InvoiceRequest, B as Customer, $ as FiscalProfile, bG as Subject, aw as Order, aJ as PaymentAttemptResult, aY as PendingPayment, ah as InvoiceStage, D as CustomerCapabilities, b6 as PromotionAnnouncement, bw as ShippingRate, aQ as PaymentMethod } from './account-settings-DAzmXHIn.cjs';
 import './geo.cjs';
 
 /**
@@ -16,6 +16,8 @@ declare const MOCK_POSTAL_CENTROIDS: Record<string, {
     lng: number;
 }>;
 
+declare const MOCK_SUBJECT_KINDS: SubjectKind[];
+
 /**
  * Region fixture of the mock: Mexico exactly as `GET /storefront/region` publishes it (see `region-mx.seed.ts`),
  * identity document `MX:csf` included, so a storefront can be built and tested without a server. It lives here,
@@ -89,6 +91,11 @@ type MockStorefrontOptions = {
      * carriers, ETAs and quote deadlines). `expires_at` missing: 24 h from the request. Free shipping still applies.
      */
     shippingRates?: ShippingRate[];
+    /**
+     * `fixed_when_free`: past `policies.free_shipping_min` `delivery-options` serves ONLY the shop's free rate and flags
+     * `free` / `fixed` (what the `storefront_cart` addon does with the setting of the same name). Default: the usual list.
+     */
+    shippingQuoteMode?: 'carriers' | 'fixed_when_free';
     /** Methods served by `payment-methods` (default one builtin `mock`). */
     paymentMethods?: PaymentMethod[];
     /**
@@ -96,6 +103,11 @@ type MockStorefrontOptions = {
      * organization has no region, the route answers `404` and invoice requests are not validated against a region.
      */
     region?: Region | null;
+    /**
+     * The kinds of buyer item («My items») the store declares, served by `GET /subject-kinds` and enforced by
+     * `customer.subjects`. Default none: no such section, as in a store that declares nothing (`MOCK_SUBJECT_KINDS` has two).
+     */
+    subjectKinds?: SubjectKind[];
 };
 type CartRecord = {
     id: string;
@@ -128,6 +140,10 @@ type MockState = {
     addresses: Map<string, Address[]>;
     /** Saved fiscal profiles by customer id (contract 1.9). */
     fiscalProfiles: Map<string, FiscalProfile[]>;
+    /** Saved items by customer id (contract 1.9); `private` holds the values the API only returns masked. */
+    subjects: Map<string, (Subject & {
+        private: Record<string, string>;
+    })[]>;
     orders: (Order & {
         customer_id: string | null;
     })[];
@@ -143,6 +159,21 @@ type MockState = {
     /** Consecutive failed password logins by email. */
     loginFailures: Map<string, number>;
     sessions: Map<string, string>;
+    /** What «Devices» shows for each session token (contract 1.9). */
+    sessionInfo: Map<string, {
+        id: string;
+        customer_id: string;
+        created_at: string;
+        last_used_at: string;
+        login_method: string;
+        reauth_at: number | null;
+    }>;
+    /** Wrong re-authentications per customer (5 and the mock answers 429). */
+    reauthFailures: Map<string, number>;
+    /** Data exports served per customer (3 a day). */
+    exportsServed: Map<string, number>;
+    /** Tokens of accounts that were deleted: deleting again answers 204, as the server does. */
+    deletedTokens: Set<string>;
     idempotency: Map<string, {
         status: number;
         body: unknown;
@@ -176,4 +207,4 @@ declare function createMockStorefront(options?: MockStorefrontOptions): {
 };
 type MockStorefront = ReturnType<typeof createMockStorefront>;
 
-export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, type MockImageUrl, type MockState, type MockStorefront, type MockStorefrontOptions, createMockStorefront };
+export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, MOCK_SUBJECT_KINDS, type MockImageUrl, type MockState, type MockStorefront, type MockStorefrontOptions, createMockStorefront };

package/dist/mock.d.ts

@@ -1,4 +1,4 @@
-import { a2 as IdentityRulesV1, ba as RegionFiscalId, a0 as IdentityDocumentSpec, b8 as Region, br as Shop, aX as Product, x as Collection, by as Theme, aC as Page, al as Menu, b as Article, C as Cart, A as Address, ab as InvoiceRequest, z as Customer, X as FiscalProfile, as as Order, aF as PaymentAttemptResult, aU as PendingPayment, ad as InvoiceStage, B as CustomerCapabilities, b2 as PromotionAnnouncement, bq as ShippingRate, aM as PaymentMethod } from './types-DSHzYSHU.js';
+import { bM as SubjectKind, a6 as IdentityRulesV1, bg as RegionFiscalId, a4 as IdentityDocumentSpec, be as Region, bx as Shop, a$ as Product, y as Collection, bP as Theme, aG as Page, ap as Menu, c as Article, C as Cart, a as Address, af as InvoiceRequest, B as Customer, $ as FiscalProfile, bG as Subject, aw as Order, aJ as PaymentAttemptResult, aY as PendingPayment, ah as InvoiceStage, D as CustomerCapabilities, b6 as PromotionAnnouncement, bw as ShippingRate, aQ as PaymentMethod } from './account-settings-Cw3PamUA.js';
 import './geo.js';
 
 /**
@@ -16,6 +16,8 @@ declare const MOCK_POSTAL_CENTROIDS: Record<string, {
     lng: number;
 }>;
 
+declare const MOCK_SUBJECT_KINDS: SubjectKind[];
+
 /**
  * Region fixture of the mock: Mexico exactly as `GET /storefront/region` publishes it (see `region-mx.seed.ts`),
  * identity document `MX:csf` included, so a storefront can be built and tested without a server. It lives here,
@@ -89,6 +91,11 @@ type MockStorefrontOptions = {
      * carriers, ETAs and quote deadlines). `expires_at` missing: 24 h from the request. Free shipping still applies.
      */
     shippingRates?: ShippingRate[];
+    /**
+     * `fixed_when_free`: past `policies.free_shipping_min` `delivery-options` serves ONLY the shop's free rate and flags
+     * `free` / `fixed` (what the `storefront_cart` addon does with the setting of the same name). Default: the usual list.
+     */
+    shippingQuoteMode?: 'carriers' | 'fixed_when_free';
     /** Methods served by `payment-methods` (default one builtin `mock`). */
     paymentMethods?: PaymentMethod[];
     /**
@@ -96,6 +103,11 @@ type MockStorefrontOptions = {
      * organization has no region, the route answers `404` and invoice requests are not validated against a region.
      */
     region?: Region | null;
+    /**
+     * The kinds of buyer item («My items») the store declares, served by `GET /subject-kinds` and enforced by
+     * `customer.subjects`. Default none: no such section, as in a store that declares nothing (`MOCK_SUBJECT_KINDS` has two).
+     */
+    subjectKinds?: SubjectKind[];
 };
 type CartRecord = {
     id: string;
@@ -128,6 +140,10 @@ type MockState = {
     addresses: Map<string, Address[]>;
     /** Saved fiscal profiles by customer id (contract 1.9). */
     fiscalProfiles: Map<string, FiscalProfile[]>;
+    /** Saved items by customer id (contract 1.9); `private` holds the values the API only returns masked. */
+    subjects: Map<string, (Subject & {
+        private: Record<string, string>;
+    })[]>;
     orders: (Order & {
         customer_id: string | null;
     })[];
@@ -143,6 +159,21 @@ type MockState = {
     /** Consecutive failed password logins by email. */
     loginFailures: Map<string, number>;
     sessions: Map<string, string>;
+    /** What «Devices» shows for each session token (contract 1.9). */
+    sessionInfo: Map<string, {
+        id: string;
+        customer_id: string;
+        created_at: string;
+        last_used_at: string;
+        login_method: string;
+        reauth_at: number | null;
+    }>;
+    /** Wrong re-authentications per customer (5 and the mock answers 429). */
+    reauthFailures: Map<string, number>;
+    /** Data exports served per customer (3 a day). */
+    exportsServed: Map<string, number>;
+    /** Tokens of accounts that were deleted: deleting again answers 204, as the server does. */
+    deletedTokens: Set<string>;
     idempotency: Map<string, {
         status: number;
         body: unknown;
@@ -176,4 +207,4 @@ declare function createMockStorefront(options?: MockStorefrontOptions): {
 };
 type MockStorefront = ReturnType<typeof createMockStorefront>;
 
-export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, type MockImageUrl, type MockState, type MockStorefront, type MockStorefrontOptions, createMockStorefront };
+export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, MOCK_SUBJECT_KINDS, type MockImageUrl, type MockState, type MockStorefront, type MockStorefrontOptions, createMockStorefront };

package/dist/mock.js

@@ -1,4 +1,4 @@
-import { resolveAvailability, isTestShipment, sortTrackingEvents, orderProgress, nextAction, orderShipments, shipmentsStatus } from './chunk-IPUAZ3LQ.js';
+import { resolveAvailability, isMasked, isTestShipment, sortTrackingEvents, orderProgress, nextAction, orderShipments, shipmentsStatus, PRIVATE_MASK, resolveSubject } from './chunk-5BJRZIS3.js';
 import { isValidPoint, rankByDistance } from './chunk-45R47HYO.js';
 
 // src/mock/account-seed.ts
@@ -1511,6 +1511,55 @@ function buildCustomers() {
   ];
 }
 
+// src/mock/subjects.ts
+var MOCK_SUBJECT_KINDS = [
+  {
+    key: "vehicle",
+    label: "Veh\xEDculo",
+    label_plural: "Mi garage",
+    max_per_account: 3,
+    attach_to_order: true,
+    fit_key_template: "{make}/{model}/{year}/{engine}",
+    fields: [
+      { key: "make", label: "Marca", type: "select", source: "catalog", required: true },
+      { key: "model", label: "Modelo", type: "select", source: "catalog", depends_on: "make", required: true },
+      { key: "year", label: "A\xF1o", type: "year", source: "catalog", depends_on: "model", required: true },
+      { key: "engine", label: "Versi\xF3n / motor", type: "select", source: "catalog", depends_on: "year" },
+      { key: "plate", label: "Placas (opcional)", type: "text", max: 12, private: true }
+    ],
+    catalog: {
+      version: "mock-1",
+      tree: {
+        nissan: {
+          label: "Nissan",
+          children: {
+            np300: {
+              label: "NP300 Frontier",
+              from: 2008,
+              to: 2022,
+              children: { "2.5": { label: "2.5 L", ranges: [[2010, 2015]] }, "2.4": { label: "2.4 L" } }
+            },
+            versa: { label: "Versa", from: 2012, to: 2024, children: { "1.6": { label: "1.6 L" } } }
+          }
+        },
+        ford: { label: "Ford", children: { f150: { label: "F-150", from: 2e3, to: 2020, children: { "5.0": { label: "5.0 L" } } } } }
+      }
+    }
+  },
+  {
+    key: "size",
+    label: "Talla",
+    label_plural: "Mis tallas",
+    max_per_account: 5,
+    fit_key_template: "{garment}/{value}",
+    fields: [
+      { key: "garment", label: "Prenda", type: "text", required: true },
+      { key: "value", label: "Talla", type: "text", required: true, max: 8 }
+    ],
+    catalog: null
+  }
+];
+
 // src/mock/index.ts
 var HttpError = class extends Error {
   constructor(status, code, message, field, details, requiredScopes) {
@@ -1585,6 +1634,10 @@ function createMockStorefront(options = {}) {
       online_verify: false
     },
     fiscal_profiles: { max: 10 },
+    notifications: { channels: ["email"] },
+    data_export: true,
+    account_delete: true,
+    ...(options.subjectKinds?.length ?? 0) > 0 ? { subjects: { kinds: options.subjectKinds.map((k) => k.key), share_with_workshop: false } } : {},
     ...options.customerCapabilities
   };
   const missingScopes = options.missingScopes ?? [];
@@ -1616,6 +1669,7 @@ function createMockStorefront(options = {}) {
       customers: buildCustomers(),
       addresses: /* @__PURE__ */ new Map(),
       fiscalProfiles: /* @__PURE__ */ new Map(),
+      subjects: /* @__PURE__ */ new Map(),
       orders: [
         {
           id: "ord_seed_1",
@@ -1636,6 +1690,10 @@ function createMockStorefront(options = {}) {
       pendingRegistrations: /* @__PURE__ */ new Map(),
       loginFailures: /* @__PURE__ */ new Map(),
       sessions: /* @__PURE__ */ new Map(),
+      sessionInfo: /* @__PURE__ */ new Map(),
+      reauthFailures: /* @__PURE__ */ new Map(),
+      exportsServed: /* @__PURE__ */ new Map(),
+      deletedTokens: /* @__PURE__ */ new Set(),
       idempotency: /* @__PURE__ */ new Map(),
       checkouts: /* @__PURE__ */ new Map(),
       payments: /* @__PURE__ */ new Map(),
@@ -1717,6 +1775,9 @@ function createMockStorefront(options = {}) {
       if (list.length > 100) throw new HttpError(400, "validation", "At most 100 handles", "handles");
       items = items.filter((p) => list.includes(p.handle));
     }
+    const tagsAny = (search.get("tags_any") ?? "").split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
+    if (tagsAny.length > 5 || tagsAny.some((t) => t.length > 120)) throw new HttpError(400, "validation", "tags_any takes at most 5 tags of 120 characters", "tags_any");
+    if (tagsAny.length > 0) items = items.filter((p) => p.tags.some((t) => tagsAny.includes(t.toLowerCase())));
     const base = items;
     if (search.get("available") === "true") items = items.filter((p) => p.available_for_sale);
     const priceMin = search.get("price_min");
@@ -1844,6 +1905,7 @@ function createMockStorefront(options = {}) {
       const expires = new Date(Date.now() + 24 * 36e5).toISOString();
       return options.shippingRates.map((r) => ({ ...r, expires_at: r.expires_at ?? expires, cost: free ? fromCents(0, r.cost.currency_code) : r.cost }));
     }
+    if (free && options.shippingQuoteMode === "fixed_when_free") return [{ id: "flat", title: "Env\xEDo gratis", cost: fromCents(0, currency), eta: "2 a 5 d\xEDas h\xE1biles" }];
     return [
       { id: "flat", title: free ? "Env\xEDo est\xE1ndar (gratis)" : "Env\xEDo est\xE1ndar", cost: fromCents(free ? 0 : flatShippingCents, currency), eta: "2 a 5 d\xEDas h\xE1biles" },
       { id: "express", title: "Env\xEDo expr\xE9s", cost: fromCents(flatShippingCents + 1e4, currency), eta: "1 a 2 d\xEDas h\xE1biles" }
@@ -1986,8 +2048,13 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, "password");
     return { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer };
   }
+  function trackSession(token, loginMethod) {
+    const at = now();
+    state.sessionInfo.set(token, { id: nextId("ses"), customer_id: state.sessions.get(token) ?? "", created_at: at, last_used_at: at, login_method: loginMethod, reauth_at: null });
+  }
   function validateAddress(body, partial = false) {
     const required = ["address1", "city", "zip", "country_code"];
     if (!partial) {
@@ -2142,8 +2209,10 @@ function createMockStorefront(options = {}) {
   route("GET", "/carts/:id/delivery-options", "cart:write", ({ params }) => {
     const cart = renderCart(getCartRecord(params[0]));
     const net = toCents(cart.cost.subtotal.amount) - toCents(cart.cost.discount.amount);
+    const rates = shippingRates(net);
+    const free = options.shippingQuoteMode === "fixed_when_free" && rates.length > 0 && rates.every((r) => toCents(r.cost.amount) === 0);
     return {
-      body: { rates: shippingRates(net), pickup: state.shop.branches.filter((b) => b.pickup?.enabled !== false).map((b) => ({ branch_id: b.id, name: b.name, address: b.address, city: b.city })), partial: false, unavailable: [] },
+      body: { rates, free, fixed: free, pickup: state.shop.branches.filter((b) => b.pickup?.enabled !== false).map((b) => ({ branch_id: b.id, name: b.name, address: b.address, city: b.city })), partial: false, unavailable: [] },
       cache: "private"
     };
   });
@@ -2415,6 +2484,7 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, kind);
     return {
       status: 201,
       body: { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer },
@@ -2489,7 +2559,8 @@ function createMockStorefront(options = {}) {
     state.loginFailures.delete(email);
     return { status: 204 };
   });
-  const publicCustomer = (c) => {
+  const publicCustomer = (c0) => {
+    const c = { ...c0, locale: c0.locale ?? null, preferences: c0.preferences ?? { notifications: {} } };
     if (!c.fiscal?.document) return c;
     const { sha256: _sha, ...document } = c.fiscal.document;
     return { ...c, fiscal: { ...c.fiscal, document } };
@@ -2501,6 +2572,8 @@ function createMockStorefront(options = {}) {
     if ("first_name" in body) c.first_name = text(body.first_name);
     if ("last_name" in body) c.last_name = text(body.last_name);
     if ("phone" in body) c.phone = text(body.phone);
+    if ("locale" in body) c.locale = parseLocale(body.locale);
+    if ("preferences" in body) c.preferences = parsePreferences(c.preferences, body.preferences);
     if ("fiscal" in body) {
       if (body.fiscal === null) c.fiscal = null;
       else {
@@ -2520,6 +2593,144 @@ function createMockStorefront(options = {}) {
     }
     return { body: publicCustomer(c), cache: "private" };
   });
+  const OPTIONAL_EVENTS = /* @__PURE__ */ new Set(["order_updates", "shipping", "restock"]);
+  const MANDATORY_EVENTS = /* @__PURE__ */ new Set(["order_confirmation", "payment", "invoice", "security"]);
+  const CHANNELS = /* @__PURE__ */ new Set(["email", "whatsapp"]);
+  const REAUTH_WINDOW_MS = 5 * 6e4;
+  const supportedLocales = () => [state.shop.locale, ...state.shop.locales].filter((l, i, a) => l && a.indexOf(l) === i);
+  function parseLocale(raw) {
+    if (raw === null || typeof raw === "string" && !raw.trim()) return null;
+    if (typeof raw !== "string") throw new HttpError(400, "validation", "locale must be a string", "locale");
+    const tag = raw.trim().replace("_", "-");
+    const [lang = "", ...rest] = tag.split("-");
+    const canonical = [lang.toLowerCase(), ...rest.map((p) => p.toUpperCase())].join("-");
+    const supported = supportedLocales();
+    const hit = supported.find((l) => l.toLowerCase() === canonical.toLowerCase()) ?? (rest.length === 0 ? supported.find((l) => l.split("-")[0].toLowerCase() === canonical) : void 0);
+    if (!hit) throw new HttpError(400, "validation", "this store is not available in that language", "locale");
+    return hit;
+  }
+  function parsePreferences(current, raw) {
+    if (raw === null) return { notifications: {} };
+    if (typeof raw !== "object" || Array.isArray(raw)) throw new HttpError(400, "validation", "preferences must be an object", "preferences");
+    const merged = structuredClone(current?.notifications ?? {});
+    for (const [key, value] of Object.entries(raw)) {
+      if (key !== "notifications") throw new HttpError(400, "validation", "unknown preference", `preferences.${key}`);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new HttpError(400, "validation", "notifications must map each event to its channels", "preferences.notifications");
+      for (const [event, channels] of Object.entries(value)) {
+        const field = `preferences.notifications.${event}`;
+        if (MANDATORY_EVENTS.has(event)) throw new HttpError(400, "validation", "this notification is required and cannot be turned off", field);
+        if (!OPTIONAL_EVENTS.has(event)) throw new HttpError(400, "validation", "unknown notification", field);
+        if (!channels || typeof channels !== "object" || Array.isArray(channels)) throw new HttpError(400, "validation", "each event maps its channels to true or false", field);
+        for (const [channel, on] of Object.entries(channels)) {
+          if (!CHANNELS.has(channel)) throw new HttpError(400, "validation", "unknown channel", `${field}.${channel}`);
+          if (typeof on !== "boolean") throw new HttpError(400, "validation", "each channel must be true or false", `${field}.${channel}`);
+          (merged[event] ??= {})[channel] = on;
+        }
+      }
+    }
+    return { notifications: merged };
+  }
+  function sessionOf(headers) {
+    const c = requireCustomer(headers);
+    const token = headers.get("x-customer-token");
+    if (!state.sessionInfo.has(token)) trackSession(token, "email");
+    return { c, token, info: state.sessionInfo.get(token) };
+  }
+  function requireRecentReauth(info) {
+    if (info.reauth_at === null || Date.now() - info.reauth_at > REAUTH_WINDOW_MS) {
+      throw new HttpError(403, "reauth_required", "confirm your password or a code first (customer.reauth)");
+    }
+  }
+  route("GET", "/customer/sessions", "customer:read", ({ headers }) => {
+    const { c, token } = sessionOf(headers);
+    const nodes = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => ({ t, info: state.sessionInfo.get(t) })).sort((a, b) => b.info.last_used_at.localeCompare(a.info.last_used_at)).map(({ t, info }) => ({
+      id: info.id,
+      current: t === token,
+      device_label: "Mock browser \xB7 Test",
+      login_method: info.login_method,
+      last_used_at: info.last_used_at,
+      created_at: info.created_at
+    }));
+    return { body: { nodes }, cache: "private" };
+  });
+  route("DELETE", "/customer/sessions/:id", "customer:write", ({ headers, params }) => {
+    const { c, token } = sessionOf(headers);
+    const mine = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => t);
+    if (params[0] === "others") {
+      for (const t of mine) if (t !== token) state.sessions.delete(t);
+      return { status: 204 };
+    }
+    const entry = [...state.sessionInfo.entries()].find(([, i]) => i.id === params[0]);
+    if (!entry || entry[1].customer_id !== c.id) throw new HttpError(404, "not_found", "Session not found", "id");
+    state.sessions.delete(entry[0]);
+    return { status: 204 };
+  });
+  route("POST", "/customer/reauth", "customer:write", ({ headers, body }) => {
+    const { c, info } = sessionOf(headers);
+    const hasPassword = typeof body.password === "string" && body.password !== "";
+    const hasCode = typeof body.otp_code === "string" && body.otp_code !== "";
+    if (hasPassword === hasCode) throw new HttpError(400, "validation", "send either password or otp_code", "password");
+    if ((state.reauthFailures.get(c.id) ?? 0) >= 5) throw new HttpError(429, "rate_limited", "Too many attempts, try again later");
+    const field = hasPassword ? "password" : "otp_code";
+    const ok = hasPassword ? c.email !== null && state.passwords.get(c.email) === body.password : [c.email && `email:${c.email}`, c.phone && `phone:${c.phone}`].some((id) => !!id && state.otps.get(id) === body.otp_code);
+    if (!ok) {
+      state.reauthFailures.set(c.id, (state.reauthFailures.get(c.id) ?? 0) + 1);
+      throw new HttpError(400, "validation", "could not verify; check the credential and try again", field);
+    }
+    state.reauthFailures.delete(c.id);
+    info.reauth_at = Date.now();
+    return { body: { reauth_at: new Date(info.reauth_at).toISOString(), valid_for_seconds: REAUTH_WINDOW_MS / 1e3 }, cache: "private" };
+  });
+  route("POST", "/customer/data-export", "customer:write", ({ headers }) => {
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if ((state.exportsServed.get(c.id) ?? 0) >= 3) throw new HttpError(429, "rate_limited", "Three exports a day; try again tomorrow");
+    state.exportsServed.set(c.id, (state.exportsServed.get(c.id) ?? 0) + 1);
+    const doc = {
+      format: "storefront-customer-data/1",
+      exported_at: now(),
+      account: { id: c.id, email: c.email, phone: c.phone, first_name: c.first_name, last_name: c.last_name, locale: c.locale ?? null, created_at: c.created_at },
+      preferences: c.preferences ?? { notifications: {} },
+      addresses: state.addresses.get(c.id) ?? [],
+      fiscal_profiles: state.fiscalProfiles.get(c.id) ?? [],
+      orders: state.orders.filter((o) => o.customer_id === c.id).map((o) => ({ id: o.id, number: o.number, created_at: o.created_at, status: o.status, total: o.total }))
+    };
+    return {
+      body: {
+        filename: `account-data-${now().slice(0, 10)}.json`,
+        content_type: "application/json",
+        content_base64: btoa(unescape(encodeURIComponent(JSON.stringify(doc, null, 2))))
+      },
+      cache: "private"
+    };
+  });
+  route("DELETE", "/customer", "customer:write", ({ headers, body }) => {
+    const token = headers.get("x-customer-token");
+    if (token && state.deletedTokens.has(token)) return { status: 204 };
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if (typeof body.confirm !== "string" || !body.confirm.trim() || body.confirm.length > 100) {
+      throw new HttpError(400, "validation", "confirm is required: the text the buyer typed", "confirm");
+    }
+    const closed = /* @__PURE__ */ new Set(["fulfilled", "delivered", "cancelled"]);
+    if (state.orders.some((o) => o.customer_id === c.id && !closed.has(o.status))) {
+      throw new HttpError(409, "conflict", "you have an order in progress; you can delete the account once it is delivered", "orders");
+    }
+    if (c.id === "cus_1" && state.pendingPayments.some((p) => p.status === "pending_payment")) {
+      throw new HttpError(409, "conflict", "you have a payment waiting to be completed", "pending_payments");
+    }
+    for (const [t, id] of [...state.sessions.entries()]) {
+      if (id === c.id) {
+        state.sessions.delete(t);
+        state.deletedTokens.add(t);
+      }
+    }
+    if (c.email) state.passwords.delete(c.email);
+    state.addresses.delete(c.id);
+    state.fiscalProfiles.delete(c.id);
+    state.customers = state.customers.filter((x) => x.id !== c.id);
+    return { status: 204 };
+  });
   const orderView = ({ customer_id: _c, ...o }, detail) => {
     const order = { ...o, invoice: orderInvoice(o) };
     if (order.shipments) order.shipments = order.shipments.map((s) => isTestShipment(s) ? { ...s, tracking_number: null, tracking_url: null } : { ...s, events: sortTrackingEvents(s.events) });
@@ -2676,6 +2887,89 @@ function createMockStorefront(options = {}) {
     mirrorDefaultProfile(c);
     return { status: 204 };
   });
+  const MAX_SUBJECTS = 50;
+  const subjectsOf = (c) => state.subjects.get(c.id) ?? [];
+  const kinds = () => options.subjectKinds ?? [];
+  const publicSubject = (s) => {
+    const { private: priv, ...rest } = s;
+    return { ...rest, attributes: { ...s.attributes, ...Object.fromEntries(Object.keys(priv).map((k) => [k, PRIVATE_MASK + (priv[k].length > 3 ? priv[k].slice(-2) : "")])) } };
+  };
+  const ownSubject = (c, id) => {
+    const s = subjectsOf(c).find((x) => x.id === id);
+    if (!s) throw new HttpError(404, "not_found", "Item not found", "id");
+    return s;
+  };
+  const setDefaultSubject = (c, id) => {
+    const kind = ownSubject(c, id).kind;
+    state.subjects.set(c.id, subjectsOf(c).map((s) => s.kind !== kind ? s : s.id === id ? { ...s, is_default: true, last_used_at: now() } : { ...s, is_default: false }));
+  };
+  const resolveOrThrow = (kind, values) => {
+    const r = resolveSubject(kind, values);
+    if (!r.ok) {
+      const [field, code] = Object.entries(r.problems)[0];
+      throw new HttpError(422, "validation", `${field}: ${code}`, field === "_" ? "attributes" : `attributes.${field}`);
+    }
+    return r.subject;
+  };
+  const cleanNickname = (v) => {
+    if (v === void 0 || v === null || v === "") return null;
+    if (typeof v !== "string" || [...v.trim()].length > 40) throw new HttpError(422, "validation", "nickname is too long (max 40)", "nickname");
+    return v.trim().split(/\s+/).join(" ");
+  };
+  route("GET", "/subject-kinds", "content:read", () => ({ body: { nodes: kinds() }, cache: "public" }));
+  route("GET", "/customer/subjects", "customer:read", ({ headers, search }) => {
+    const c = requireCustomer(headers);
+    const kind = search.get("kind");
+    const nodes = subjectsOf(c).filter((s) => !kind || s.kind === kind).sort((a, b) => a.kind.localeCompare(b.kind) || Number(b.is_default) - Number(a.is_default) || (b.last_used_at ?? "").localeCompare(a.last_used_at ?? ""));
+    return { body: { nodes: nodes.map(publicSubject) }, cache: "private" };
+  });
+  route("POST", "/customer/subjects", "customer:write", ({ headers, body }) => {
+    const c = requireCustomer(headers);
+    const kind = kinds().find((k) => k.key === body.kind);
+    if (!kind) throw new HttpError(422, "validation", "This store has no such kind", "kind");
+    const attrs = body.attributes;
+    if (!attrs || typeof attrs !== "object" || Array.isArray(attrs)) throw new HttpError(422, "validation", "attributes must be an object", "attributes");
+    const r = resolveOrThrow(kind, attrs);
+    const list = subjectsOf(c);
+    if (list.length >= MAX_SUBJECTS || list.filter((s) => s.kind === kind.key).length >= kind.max_per_account) throw new HttpError(409, "conflict", "Limit reached; delete one first", "kind");
+    if (r.fit_key && list.some((s) => s.kind === kind.key && s.fit_key === r.fit_key)) throw new HttpError(409, "conflict", "You already saved this item", "attributes");
+    const subject = { id: nextId("subj"), kind: kind.key, label: r.label, nickname: cleanNickname(body.nickname), fit_key: r.fit_key, attributes: r.attributes, private: r.private, is_default: false, last_used_at: null, created_at: now() };
+    state.subjects.set(c.id, [...list, subject]);
+    if (!list.some((s) => s.kind === kind.key) || body.is_default === true) setDefaultSubject(c, subject.id);
+    return { status: 201, body: publicSubject(ownSubject(c, subject.id)), cache: "private" };
+  });
+  route("PATCH", "/customer/subjects/:id", "customer:write", ({ headers, params, body }) => {
+    const c = requireCustomer(headers);
+    const cur = ownSubject(c, params[0]);
+    if (body.is_default === false && cur.is_default) throw new HttpError(422, "validation", "Make another item the default instead", "is_default");
+    let next = { ...cur };
+    if ("nickname" in body) next.nickname = cleanNickname(body.nickname);
+    if ("attributes" in body) {
+      const kind = kinds().find((k) => k.key === cur.kind);
+      if (!kind) throw new HttpError(422, "validation", "This store no longer offers this kind", "kind");
+      const sent = body.attributes ?? {};
+      const merged = { ...cur.attributes, ...cur.private };
+      for (const [k, v] of Object.entries(sent)) {
+        if (k in cur.private && isMasked(v)) continue;
+        if (v === null) delete merged[k];
+        else merged[k] = v;
+      }
+      const r = resolveOrThrow(kind, merged);
+      if (r.fit_key && subjectsOf(c).some((s) => s.id !== cur.id && s.kind === cur.kind && s.fit_key === r.fit_key)) throw new HttpError(409, "conflict", "You already saved this item", "attributes");
+      next = { ...next, label: r.label, fit_key: r.fit_key, attributes: r.attributes, private: r.private };
+    }
+    state.subjects.set(c.id, subjectsOf(c).map((s) => s.id === cur.id ? next : s));
+    if (body.is_default === true && !cur.is_default) setDefaultSubject(c, cur.id);
+    return { body: publicSubject(ownSubject(c, cur.id)), cache: "private" };
+  });
+  route("DELETE", "/customer/subjects/:id", "customer:write", ({ headers, params }) => {
+    const c = requireCustomer(headers);
+    const cur = ownSubject(c, params[0]);
+    state.subjects.set(c.id, subjectsOf(c).filter((s) => s.id !== cur.id));
+    const heir = subjectsOf(c).filter((s) => s.kind === cur.kind).sort((a, b) => (b.last_used_at ?? "").localeCompare(a.last_used_at ?? ""))[0];
+    if (cur.is_default && heir) setDefaultSubject(c, heir.id);
+    return { status: 204 };
+  });
   route("GET", "/customer/addresses", "customer:read", ({ headers }) => {
     const c = requireCustomer(headers);
     return { body: { nodes: state.addresses.get(c.id) ?? [] }, cache: "private" };
@@ -2772,7 +3066,7 @@ function createMockStorefront(options = {}) {
       return errorResponse(new HttpError(403, "insufficient_scope", `Token lacks scope ${r.scope}`, void 0, void 0, [r.scope]));
     }
     let body = {};
-    if (method !== "GET" && method !== "DELETE") {
+    if (method !== "GET") {
       const text = await request.text();
       if (text) {
         try {
@@ -2825,6 +3119,6 @@ function createMockStorefront(options = {}) {
   };
 }
 
-export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, createMockStorefront };
+export { MOCK_CSF_RULES, MOCK_CURRENCY, MOCK_CUSTOMER_EMAIL, MOCK_FISCAL_ID_MX, MOCK_IDENTITY_DOCUMENT_MX_CSF, MOCK_IMAGE_URL, MOCK_POSTAL_CENTROIDS, MOCK_REGION_MX, MOCK_SUBJECT_KINDS, createMockStorefront };
 //# sourceMappingURL=mock.js.map
 //# sourceMappingURL=mock.js.map