@asteby/storefront 0.16.1 → 0.18.0

package/dist/mock.cjs

@@ -1347,6 +1347,111 @@ function maskTaxId(taxId) {
   return v.length <= 4 ? "*".repeat(v.length) : `${v.slice(0, 2)}${"*".repeat(v.length - 5)}${v.slice(-3)}`;
 }
 
+// src/subjects.ts
+var MIN_SUBJECT_YEAR = 1900;
+var MAX_SUBJECT_YEAR = 2100;
+var MAX_VALUE_LENGTH = 80;
+var MAX_LABEL_LENGTH = 120;
+var MAX_FIT_KEY_LENGTH = 100;
+var isPresent = (v) => v !== null && v !== void 0 && v !== "";
+var asYear = (v) => {
+  const n = typeof v === "number" ? v : typeof v === "string" && /^\s*\d+\s*$/.test(v) ? Number(v) : NaN;
+  return Number.isInteger(n) && n >= MIN_SUBJECT_YEAR && n <= MAX_SUBJECT_YEAR ? n : null;
+};
+var cleanText = (v, max) => {
+  if (typeof v !== "string") return null;
+  const s = v.split(/\s+/).filter(Boolean).join(" ");
+  return [...s].length > max || /[\u0000-\u001f\u007f-\u009f]/.test(s) ? null : s;
+};
+var slug = (s) => s.toLowerCase().replace(/[^a-z0-9._+-]+/g, "-").replace(/^-+|-+$/g, "");
+function coversYear(node, year) {
+  if (node.ranges && node.ranges.length > 0) return node.ranges.some(([a, b]) => year >= a && year <= b);
+  if (node.from !== void 0 && year < node.from) return false;
+  if (node.to !== void 0 && year > node.to) return false;
+  return true;
+}
+function resolveSubject(kind, values) {
+  const problems = {};
+  const known = new Set(kind.fields.map((f) => f.key));
+  for (const key2 of Object.keys(values)) if (isPresent(values[key2]) && !known.has(key2)) problems[key2] = "unknown";
+  const attributes = {};
+  const priv = {};
+  const display = {};
+  const ids = {};
+  const path = [];
+  let tree = kind.catalog?.tree;
+  const years = [];
+  const put = (f, v) => {
+    if (f.private) priv[f.key] = String(v);
+    else attributes[f.key] = v;
+  };
+  for (const f of kind.fields) {
+    const raw = values[f.key];
+    if (!isPresent(raw)) {
+      if (f.required) problems[f.key] = "required";
+      if (f.source === "catalog" && f.type !== "year") tree = void 0;
+      continue;
+    }
+    const max = f.max ?? MAX_VALUE_LENGTH;
+    if (f.type === "year") {
+      const y = asYear(raw);
+      if (y === null) {
+        problems[f.key] = "invalid";
+        continue;
+      }
+      put(f, y);
+      display[f.key] = ids[f.key] = String(y);
+      if (f.source === "catalog") years.push(f.key);
+    } else if (f.source === "catalog") {
+      if (!kind.catalog) {
+        problems[f.key] = "catalog_unavailable";
+        continue;
+      }
+      const s = cleanText(raw, max);
+      if (s === null) {
+        problems[f.key] = "invalid";
+        continue;
+      }
+      const node = tree?.[s] ?? tree?.[s.toLowerCase()];
+      if (!node) {
+        problems[f.key] = "not_in_catalog";
+        continue;
+      }
+      const id = tree?.[s] ? s : s.toLowerCase();
+      path.push(node);
+      tree = node.children;
+      put(f, id);
+      display[f.key] = node.label;
+      ids[f.key] = id;
+    } else {
+      const s = cleanText(raw, max);
+      if (s === null) {
+        problems[f.key] = "invalid";
+        continue;
+      }
+      put(f, s);
+      display[f.key] = s;
+      ids[f.key] = slug(s);
+    }
+  }
+  for (const key2 of years) {
+    const y = attributes[key2];
+    if (y !== void 0 && !problems[key2] && !path.every((n) => coversYear(n, y))) problems[key2] = "year_range";
+  }
+  if (Object.keys(problems).length > 0) return { ok: false, problems };
+  const label = [...kind.fields.filter((f) => !f.private).map((f) => display[f.key]).filter(Boolean).join(" ")].slice(0, MAX_LABEL_LENGTH).join("").trim();
+  if (!label) return { ok: false, problems: { _: "required" } };
+  let complete = true;
+  const key = kind.fit_key_template.replace(/\{([a-z][a-z0-9_]*)\}/g, (_m, name) => {
+    const id = ids[name];
+    if (!id) complete = false;
+    return id ?? "";
+  });
+  return { ok: true, subject: { label, fit_key: complete && key.length <= MAX_FIT_KEY_LENGTH ? key.toLowerCase() : "", attributes, private: priv } };
+}
+var PRIVATE_MASK = "\u2022\u2022";
+var isMasked = (v) => typeof v === "string" && v.startsWith(PRIVATE_MASK);
+
 // src/mock/seed.ts
 var MOCK_IMAGE_URL = (seed, width = 800, height = 800) => `https://picsum.photos/seed/${encodeURIComponent(seed)}/${width}/${height}`;
 var MOCK_CURRENCY = "MXN";
@@ -1683,6 +1788,55 @@ function buildCustomers() {
   ];
 }
 
+// src/mock/subjects.ts
+var MOCK_SUBJECT_KINDS = [
+  {
+    key: "vehicle",
+    label: "Veh\xEDculo",
+    label_plural: "Mi garage",
+    max_per_account: 3,
+    attach_to_order: true,
+    fit_key_template: "{make}/{model}/{year}/{engine}",
+    fields: [
+      { key: "make", label: "Marca", type: "select", source: "catalog", required: true },
+      { key: "model", label: "Modelo", type: "select", source: "catalog", depends_on: "make", required: true },
+      { key: "year", label: "A\xF1o", type: "year", source: "catalog", depends_on: "model", required: true },
+      { key: "engine", label: "Versi\xF3n / motor", type: "select", source: "catalog", depends_on: "year" },
+      { key: "plate", label: "Placas (opcional)", type: "text", max: 12, private: true }
+    ],
+    catalog: {
+      version: "mock-1",
+      tree: {
+        nissan: {
+          label: "Nissan",
+          children: {
+            np300: {
+              label: "NP300 Frontier",
+              from: 2008,
+              to: 2022,
+              children: { "2.5": { label: "2.5 L", ranges: [[2010, 2015]] }, "2.4": { label: "2.4 L" } }
+            },
+            versa: { label: "Versa", from: 2012, to: 2024, children: { "1.6": { label: "1.6 L" } } }
+          }
+        },
+        ford: { label: "Ford", children: { f150: { label: "F-150", from: 2e3, to: 2020, children: { "5.0": { label: "5.0 L" } } } } }
+      }
+    }
+  },
+  {
+    key: "size",
+    label: "Talla",
+    label_plural: "Mis tallas",
+    max_per_account: 5,
+    fit_key_template: "{garment}/{value}",
+    fields: [
+      { key: "garment", label: "Prenda", type: "text", required: true },
+      { key: "value", label: "Talla", type: "text", required: true, max: 8 }
+    ],
+    catalog: null
+  }
+];
+
 // src/mock/index.ts
 var HttpError = class extends Error {
   constructor(status, code, message, field, details, requiredScopes) {
@@ -1757,6 +1911,10 @@ function createMockStorefront(options = {}) {
       online_verify: false
     },
     fiscal_profiles: { max: 10 },
+    notifications: { channels: ["email"] },
+    data_export: true,
+    account_delete: true,
+    ...(options.subjectKinds?.length ?? 0) > 0 ? { subjects: { kinds: options.subjectKinds.map((k) => k.key), share_with_workshop: false } } : {},
     ...options.customerCapabilities
   };
   const missingScopes = options.missingScopes ?? [];
@@ -1788,6 +1946,7 @@ function createMockStorefront(options = {}) {
       customers: buildCustomers(),
       addresses: /* @__PURE__ */ new Map(),
       fiscalProfiles: /* @__PURE__ */ new Map(),
+      subjects: /* @__PURE__ */ new Map(),
       orders: [
         {
           id: "ord_seed_1",
@@ -1808,6 +1967,10 @@ function createMockStorefront(options = {}) {
       pendingRegistrations: /* @__PURE__ */ new Map(),
       loginFailures: /* @__PURE__ */ new Map(),
       sessions: /* @__PURE__ */ new Map(),
+      sessionInfo: /* @__PURE__ */ new Map(),
+      reauthFailures: /* @__PURE__ */ new Map(),
+      exportsServed: /* @__PURE__ */ new Map(),
+      deletedTokens: /* @__PURE__ */ new Set(),
       idempotency: /* @__PURE__ */ new Map(),
       checkouts: /* @__PURE__ */ new Map(),
       payments: /* @__PURE__ */ new Map(),
@@ -1889,6 +2052,9 @@ function createMockStorefront(options = {}) {
       if (list.length > 100) throw new HttpError(400, "validation", "At most 100 handles", "handles");
       items = items.filter((p) => list.includes(p.handle));
     }
+    const tagsAny = (search.get("tags_any") ?? "").split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
+    if (tagsAny.length > 5 || tagsAny.some((t) => t.length > 120)) throw new HttpError(400, "validation", "tags_any takes at most 5 tags of 120 characters", "tags_any");
+    if (tagsAny.length > 0) items = items.filter((p) => p.tags.some((t) => tagsAny.includes(t.toLowerCase())));
     const base = items;
     if (search.get("available") === "true") items = items.filter((p) => p.available_for_sale);
     const priceMin = search.get("price_min");
@@ -2016,6 +2182,7 @@ function createMockStorefront(options = {}) {
       const expires = new Date(Date.now() + 24 * 36e5).toISOString();
       return options.shippingRates.map((r) => ({ ...r, expires_at: r.expires_at ?? expires, cost: free ? fromCents(0, r.cost.currency_code) : r.cost }));
     }
+    if (free && options.shippingQuoteMode === "fixed_when_free") return [{ id: "flat", title: "Env\xEDo gratis", cost: fromCents(0, currency), eta: "2 a 5 d\xEDas h\xE1biles" }];
     return [
       { id: "flat", title: free ? "Env\xEDo est\xE1ndar (gratis)" : "Env\xEDo est\xE1ndar", cost: fromCents(free ? 0 : flatShippingCents, currency), eta: "2 a 5 d\xEDas h\xE1biles" },
       { id: "express", title: "Env\xEDo expr\xE9s", cost: fromCents(flatShippingCents + 1e4, currency), eta: "1 a 2 d\xEDas h\xE1biles" }
@@ -2158,8 +2325,13 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, "password");
     return { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer };
   }
+  function trackSession(token, loginMethod) {
+    const at = now();
+    state.sessionInfo.set(token, { id: nextId("ses"), customer_id: state.sessions.get(token) ?? "", created_at: at, last_used_at: at, login_method: loginMethod, reauth_at: null });
+  }
   function validateAddress(body, partial = false) {
     const required = ["address1", "city", "zip", "country_code"];
     if (!partial) {
@@ -2314,8 +2486,10 @@ function createMockStorefront(options = {}) {
   route("GET", "/carts/:id/delivery-options", "cart:write", ({ params }) => {
     const cart = renderCart(getCartRecord(params[0]));
     const net = toCents(cart.cost.subtotal.amount) - toCents(cart.cost.discount.amount);
+    const rates = shippingRates(net);
+    const free = options.shippingQuoteMode === "fixed_when_free" && rates.length > 0 && rates.every((r) => toCents(r.cost.amount) === 0);
     return {
-      body: { rates: shippingRates(net), pickup: state.shop.branches.filter((b) => b.pickup?.enabled !== false).map((b) => ({ branch_id: b.id, name: b.name, address: b.address, city: b.city })), partial: false, unavailable: [] },
+      body: { rates, free, fixed: free, pickup: state.shop.branches.filter((b) => b.pickup?.enabled !== false).map((b) => ({ branch_id: b.id, name: b.name, address: b.address, city: b.city })), partial: false, unavailable: [] },
       cache: "private"
     };
   });
@@ -2587,6 +2761,7 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, kind);
     return {
       status: 201,
       body: { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer },
@@ -2661,7 +2836,8 @@ function createMockStorefront(options = {}) {
     state.loginFailures.delete(email);
     return { status: 204 };
   });
-  const publicCustomer = (c) => {
+  const publicCustomer = (c0) => {
+    const c = { ...c0, locale: c0.locale ?? null, preferences: c0.preferences ?? { notifications: {} } };
     if (!c.fiscal?.document) return c;
     const { sha256: _sha, ...document } = c.fiscal.document;
     return { ...c, fiscal: { ...c.fiscal, document } };
@@ -2673,6 +2849,8 @@ function createMockStorefront(options = {}) {
     if ("first_name" in body) c.first_name = text(body.first_name);
     if ("last_name" in body) c.last_name = text(body.last_name);
     if ("phone" in body) c.phone = text(body.phone);
+    if ("locale" in body) c.locale = parseLocale(body.locale);
+    if ("preferences" in body) c.preferences = parsePreferences(c.preferences, body.preferences);
     if ("fiscal" in body) {
       if (body.fiscal === null) c.fiscal = null;
       else {
@@ -2692,6 +2870,144 @@ function createMockStorefront(options = {}) {
     }
     return { body: publicCustomer(c), cache: "private" };
   });
+  const OPTIONAL_EVENTS = /* @__PURE__ */ new Set(["order_updates", "shipping", "restock"]);
+  const MANDATORY_EVENTS = /* @__PURE__ */ new Set(["order_confirmation", "payment", "invoice", "security"]);
+  const CHANNELS = /* @__PURE__ */ new Set(["email", "whatsapp"]);
+  const REAUTH_WINDOW_MS = 5 * 6e4;
+  const supportedLocales = () => [state.shop.locale, ...state.shop.locales].filter((l, i, a) => l && a.indexOf(l) === i);
+  function parseLocale(raw) {
+    if (raw === null || typeof raw === "string" && !raw.trim()) return null;
+    if (typeof raw !== "string") throw new HttpError(400, "validation", "locale must be a string", "locale");
+    const tag = raw.trim().replace("_", "-");
+    const [lang = "", ...rest] = tag.split("-");
+    const canonical = [lang.toLowerCase(), ...rest.map((p) => p.toUpperCase())].join("-");
+    const supported = supportedLocales();
+    const hit = supported.find((l) => l.toLowerCase() === canonical.toLowerCase()) ?? (rest.length === 0 ? supported.find((l) => l.split("-")[0].toLowerCase() === canonical) : void 0);
+    if (!hit) throw new HttpError(400, "validation", "this store is not available in that language", "locale");
+    return hit;
+  }
+  function parsePreferences(current, raw) {
+    if (raw === null) return { notifications: {} };
+    if (typeof raw !== "object" || Array.isArray(raw)) throw new HttpError(400, "validation", "preferences must be an object", "preferences");
+    const merged = structuredClone(current?.notifications ?? {});
+    for (const [key, value] of Object.entries(raw)) {
+      if (key !== "notifications") throw new HttpError(400, "validation", "unknown preference", `preferences.${key}`);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new HttpError(400, "validation", "notifications must map each event to its channels", "preferences.notifications");
+      for (const [event, channels] of Object.entries(value)) {
+        const field = `preferences.notifications.${event}`;
+        if (MANDATORY_EVENTS.has(event)) throw new HttpError(400, "validation", "this notification is required and cannot be turned off", field);
+        if (!OPTIONAL_EVENTS.has(event)) throw new HttpError(400, "validation", "unknown notification", field);
+        if (!channels || typeof channels !== "object" || Array.isArray(channels)) throw new HttpError(400, "validation", "each event maps its channels to true or false", field);
+        for (const [channel, on] of Object.entries(channels)) {
+          if (!CHANNELS.has(channel)) throw new HttpError(400, "validation", "unknown channel", `${field}.${channel}`);
+          if (typeof on !== "boolean") throw new HttpError(400, "validation", "each channel must be true or false", `${field}.${channel}`);
+          (merged[event] ??= {})[channel] = on;
+        }
+      }
+    }
+    return { notifications: merged };
+  }
+  function sessionOf(headers) {
+    const c = requireCustomer(headers);
+    const token = headers.get("x-customer-token");
+    if (!state.sessionInfo.has(token)) trackSession(token, "email");
+    return { c, token, info: state.sessionInfo.get(token) };
+  }
+  function requireRecentReauth(info) {
+    if (info.reauth_at === null || Date.now() - info.reauth_at > REAUTH_WINDOW_MS) {
+      throw new HttpError(403, "reauth_required", "confirm your password or a code first (customer.reauth)");
+    }
+  }
+  route("GET", "/customer/sessions", "customer:read", ({ headers }) => {
+    const { c, token } = sessionOf(headers);
+    const nodes = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => ({ t, info: state.sessionInfo.get(t) })).sort((a, b) => b.info.last_used_at.localeCompare(a.info.last_used_at)).map(({ t, info }) => ({
+      id: info.id,
+      current: t === token,
+      device_label: "Mock browser \xB7 Test",
+      login_method: info.login_method,
+      last_used_at: info.last_used_at,
+      created_at: info.created_at
+    }));
+    return { body: { nodes }, cache: "private" };
+  });
+  route("DELETE", "/customer/sessions/:id", "customer:write", ({ headers, params }) => {
+    const { c, token } = sessionOf(headers);
+    const mine = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => t);
+    if (params[0] === "others") {
+      for (const t of mine) if (t !== token) state.sessions.delete(t);
+      return { status: 204 };
+    }
+    const entry = [...state.sessionInfo.entries()].find(([, i]) => i.id === params[0]);
+    if (!entry || entry[1].customer_id !== c.id) throw new HttpError(404, "not_found", "Session not found", "id");
+    state.sessions.delete(entry[0]);
+    return { status: 204 };
+  });
+  route("POST", "/customer/reauth", "customer:write", ({ headers, body }) => {
+    const { c, info } = sessionOf(headers);
+    const hasPassword = typeof body.password === "string" && body.password !== "";
+    const hasCode = typeof body.otp_code === "string" && body.otp_code !== "";
+    if (hasPassword === hasCode) throw new HttpError(400, "validation", "send either password or otp_code", "password");
+    if ((state.reauthFailures.get(c.id) ?? 0) >= 5) throw new HttpError(429, "rate_limited", "Too many attempts, try again later");
+    const field = hasPassword ? "password" : "otp_code";
+    const ok = hasPassword ? c.email !== null && state.passwords.get(c.email) === body.password : [c.email && `email:${c.email}`, c.phone && `phone:${c.phone}`].some((id) => !!id && state.otps.get(id) === body.otp_code);
+    if (!ok) {
+      state.reauthFailures.set(c.id, (state.reauthFailures.get(c.id) ?? 0) + 1);
+      throw new HttpError(400, "validation", "could not verify; check the credential and try again", field);
+    }
+    state.reauthFailures.delete(c.id);
+    info.reauth_at = Date.now();
+    return { body: { reauth_at: new Date(info.reauth_at).toISOString(), valid_for_seconds: REAUTH_WINDOW_MS / 1e3 }, cache: "private" };
+  });
+  route("POST", "/customer/data-export", "customer:write", ({ headers }) => {
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if ((state.exportsServed.get(c.id) ?? 0) >= 3) throw new HttpError(429, "rate_limited", "Three exports a day; try again tomorrow");
+    state.exportsServed.set(c.id, (state.exportsServed.get(c.id) ?? 0) + 1);
+    const doc = {
+      format: "storefront-customer-data/1",
+      exported_at: now(),
+      account: { id: c.id, email: c.email, phone: c.phone, first_name: c.first_name, last_name: c.last_name, locale: c.locale ?? null, created_at: c.created_at },
+      preferences: c.preferences ?? { notifications: {} },
+      addresses: state.addresses.get(c.id) ?? [],
+      fiscal_profiles: state.fiscalProfiles.get(c.id) ?? [],
+      orders: state.orders.filter((o) => o.customer_id === c.id).map((o) => ({ id: o.id, number: o.number, created_at: o.created_at, status: o.status, total: o.total }))
+    };
+    return {
+      body: {
+        filename: `account-data-${now().slice(0, 10)}.json`,
+        content_type: "application/json",
+        content_base64: btoa(unescape(encodeURIComponent(JSON.stringify(doc, null, 2))))
+      },
+      cache: "private"
+    };
+  });
+  route("DELETE", "/customer", "customer:write", ({ headers, body }) => {
+    const token = headers.get("x-customer-token");
+    if (token && state.deletedTokens.has(token)) return { status: 204 };
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if (typeof body.confirm !== "string" || !body.confirm.trim() || body.confirm.length > 100) {
+      throw new HttpError(400, "validation", "confirm is required: the text the buyer typed", "confirm");
+    }
+    const closed = /* @__PURE__ */ new Set(["fulfilled", "delivered", "cancelled"]);
+    if (state.orders.some((o) => o.customer_id === c.id && !closed.has(o.status))) {
+      throw new HttpError(409, "conflict", "you have an order in progress; you can delete the account once it is delivered", "orders");
+    }
+    if (c.id === "cus_1" && state.pendingPayments.some((p) => p.status === "pending_payment")) {
+      throw new HttpError(409, "conflict", "you have a payment waiting to be completed", "pending_payments");
+    }
+    for (const [t, id] of [...state.sessions.entries()]) {
+      if (id === c.id) {
+        state.sessions.delete(t);
+        state.deletedTokens.add(t);
+      }
+    }
+    if (c.email) state.passwords.delete(c.email);
+    state.addresses.delete(c.id);
+    state.fiscalProfiles.delete(c.id);
+    state.customers = state.customers.filter((x) => x.id !== c.id);
+    return { status: 204 };
+  });
   const orderView = ({ customer_id: _c, ...o }, detail) => {
     const order = { ...o, invoice: orderInvoice(o) };
     if (order.shipments) order.shipments = order.shipments.map((s) => isTestShipment(s) ? { ...s, tracking_number: null, tracking_url: null } : { ...s, events: sortTrackingEvents(s.events) });
@@ -2848,6 +3164,89 @@ function createMockStorefront(options = {}) {
     mirrorDefaultProfile(c);
     return { status: 204 };
   });
+  const MAX_SUBJECTS = 50;
+  const subjectsOf = (c) => state.subjects.get(c.id) ?? [];
+  const kinds = () => options.subjectKinds ?? [];
+  const publicSubject = (s) => {
+    const { private: priv, ...rest } = s;
+    return { ...rest, attributes: { ...s.attributes, ...Object.fromEntries(Object.keys(priv).map((k) => [k, PRIVATE_MASK + (priv[k].length > 3 ? priv[k].slice(-2) : "")])) } };
+  };
+  const ownSubject = (c, id) => {
+    const s = subjectsOf(c).find((x) => x.id === id);
+    if (!s) throw new HttpError(404, "not_found", "Item not found", "id");
+    return s;
+  };
+  const setDefaultSubject = (c, id) => {
+    const kind = ownSubject(c, id).kind;
+    state.subjects.set(c.id, subjectsOf(c).map((s) => s.kind !== kind ? s : s.id === id ? { ...s, is_default: true, last_used_at: now() } : { ...s, is_default: false }));
+  };
+  const resolveOrThrow = (kind, values) => {
+    const r = resolveSubject(kind, values);
+    if (!r.ok) {
+      const [field, code] = Object.entries(r.problems)[0];
+      throw new HttpError(422, "validation", `${field}: ${code}`, field === "_" ? "attributes" : `attributes.${field}`);
+    }
+    return r.subject;
+  };
+  const cleanNickname = (v) => {
+    if (v === void 0 || v === null || v === "") return null;
+    if (typeof v !== "string" || [...v.trim()].length > 40) throw new HttpError(422, "validation", "nickname is too long (max 40)", "nickname");
+    return v.trim().split(/\s+/).join(" ");
+  };
+  route("GET", "/subject-kinds", "content:read", () => ({ body: { nodes: kinds() }, cache: "public" }));
+  route("GET", "/customer/subjects", "customer:read", ({ headers, search }) => {
+    const c = requireCustomer(headers);
+    const kind = search.get("kind");
+    const nodes = subjectsOf(c).filter((s) => !kind || s.kind === kind).sort((a, b) => a.kind.localeCompare(b.kind) || Number(b.is_default) - Number(a.is_default) || (b.last_used_at ?? "").localeCompare(a.last_used_at ?? ""));
+    return { body: { nodes: nodes.map(publicSubject) }, cache: "private" };
+  });
+  route("POST", "/customer/subjects", "customer:write", ({ headers, body }) => {
+    const c = requireCustomer(headers);
+    const kind = kinds().find((k) => k.key === body.kind);
+    if (!kind) throw new HttpError(422, "validation", "This store has no such kind", "kind");
+    const attrs = body.attributes;
+    if (!attrs || typeof attrs !== "object" || Array.isArray(attrs)) throw new HttpError(422, "validation", "attributes must be an object", "attributes");
+    const r = resolveOrThrow(kind, attrs);
+    const list = subjectsOf(c);
+    if (list.length >= MAX_SUBJECTS || list.filter((s) => s.kind === kind.key).length >= kind.max_per_account) throw new HttpError(409, "conflict", "Limit reached; delete one first", "kind");
+    if (r.fit_key && list.some((s) => s.kind === kind.key && s.fit_key === r.fit_key)) throw new HttpError(409, "conflict", "You already saved this item", "attributes");
+    const subject = { id: nextId("subj"), kind: kind.key, label: r.label, nickname: cleanNickname(body.nickname), fit_key: r.fit_key, attributes: r.attributes, private: r.private, is_default: false, last_used_at: null, created_at: now() };
+    state.subjects.set(c.id, [...list, subject]);
+    if (!list.some((s) => s.kind === kind.key) || body.is_default === true) setDefaultSubject(c, subject.id);
+    return { status: 201, body: publicSubject(ownSubject(c, subject.id)), cache: "private" };
+  });
+  route("PATCH", "/customer/subjects/:id", "customer:write", ({ headers, params, body }) => {
+    const c = requireCustomer(headers);
+    const cur = ownSubject(c, params[0]);
+    if (body.is_default === false && cur.is_default) throw new HttpError(422, "validation", "Make another item the default instead", "is_default");
+    let next = { ...cur };
+    if ("nickname" in body) next.nickname = cleanNickname(body.nickname);
+    if ("attributes" in body) {
+      const kind = kinds().find((k) => k.key === cur.kind);
+      if (!kind) throw new HttpError(422, "validation", "This store no longer offers this kind", "kind");
+      const sent = body.attributes ?? {};
+      const merged = { ...cur.attributes, ...cur.private };
+      for (const [k, v] of Object.entries(sent)) {
+        if (k in cur.private && isMasked(v)) continue;
+        if (v === null) delete merged[k];
+        else merged[k] = v;
+      }
+      const r = resolveOrThrow(kind, merged);
+      if (r.fit_key && subjectsOf(c).some((s) => s.id !== cur.id && s.kind === cur.kind && s.fit_key === r.fit_key)) throw new HttpError(409, "conflict", "You already saved this item", "attributes");
+      next = { ...next, label: r.label, fit_key: r.fit_key, attributes: r.attributes, private: r.private };
+    }
+    state.subjects.set(c.id, subjectsOf(c).map((s) => s.id === cur.id ? next : s));
+    if (body.is_default === true && !cur.is_default) setDefaultSubject(c, cur.id);
+    return { body: publicSubject(ownSubject(c, cur.id)), cache: "private" };
+  });
+  route("DELETE", "/customer/subjects/:id", "customer:write", ({ headers, params }) => {
+    const c = requireCustomer(headers);
+    const cur = ownSubject(c, params[0]);
+    state.subjects.set(c.id, subjectsOf(c).filter((s) => s.id !== cur.id));
+    const heir = subjectsOf(c).filter((s) => s.kind === cur.kind).sort((a, b) => (b.last_used_at ?? "").localeCompare(a.last_used_at ?? ""))[0];
+    if (cur.is_default && heir) setDefaultSubject(c, heir.id);
+    return { status: 204 };
+  });
   route("GET", "/customer/addresses", "customer:read", ({ headers }) => {
     const c = requireCustomer(headers);
     return { body: { nodes: state.addresses.get(c.id) ?? [] }, cache: "private" };
@@ -2944,7 +3343,7 @@ function createMockStorefront(options = {}) {
       return errorResponse(new HttpError(403, "insufficient_scope", `Token lacks scope ${r.scope}`, void 0, void 0, [r.scope]));
     }
     let body = {};
-    if (method !== "GET" && method !== "DELETE") {
+    if (method !== "GET") {
       const text = await request.text();
       if (text) {
         try {
@@ -3005,6 +3404,7 @@ exports.MOCK_IDENTITY_DOCUMENT_MX_CSF = MOCK_IDENTITY_DOCUMENT_MX_CSF;
 exports.MOCK_IMAGE_URL = MOCK_IMAGE_URL;
 exports.MOCK_POSTAL_CENTROIDS = MOCK_POSTAL_CENTROIDS;
 exports.MOCK_REGION_MX = MOCK_REGION_MX;
+exports.MOCK_SUBJECT_KINDS = MOCK_SUBJECT_KINDS;
 exports.createMockStorefront = createMockStorefront;
 //# sourceMappingURL=mock.cjs.map
 //# sourceMappingURL=mock.cjs.map