@dainamite/cpq 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,70 @@
+# @dainamite/cpq
+
+## 0.2.2
+
+### Patch Changes
+
+- 73650dc: Add MIT license for first public release.
+
+  Switching `packages/cpq/package.json` `license` field from `UNLICENSED` (carry-over from the private era) to `MIT`, and shipping a `packages/cpq/LICENSE` file with the full license text. This matches the `@open-mercato/*` ecosystem and removes the "UNLICENSED" badge that public npm shows on packages without a recognized OSI license.
+
+  No code or API changes — purely a licensing/metadata clarification ahead of the first publish to https://www.npmjs.com/package/@dainamite/cpq.
+
+- 7b09790: Switch publish target from GitHub Packages to public npm.js.
+
+  Initial publish attempts as `@dainamite/cpq` on GitHub Packages failed
+  with `403 Forbidden — installation does not exist`: scope `@dainamite`
+  on GitHub belongs to a different (unrelated) "DAInamite" organization
+  based in Berlin. Switching to public npm.js, where the `@dainamite`
+  scope is free, lets us keep the brand without renaming everything to
+  `@dainamite-technologies/cpq`.
+
+  Open Mercato itself publishes to public npm.js
+  (`@open-mercato/core`, etc.), so this is also more consistent with the
+  upstream ecosystem and matches the L2 model from SPEC-001.
+
+  For consumers: install with plain `yarn add @dainamite/cpq` — no
+  `.npmrc` auth setup needed.
+
+## 0.2.1
+
+### Patch Changes
+
+- e44dfd1: Fix `repository.url` in package.json to point at
+  `dainamite-technologies/dainamite-core` (was `dainamite/dainamite-core`).
+  GitHub Packages requires the URL to match the publishing repo;
+  mismatch returns `403 Forbidden — installation does not exist`.
+  This blocked the inaugural publish of 0.2.0.
+
+## 0.2.0
+
+### Minor Changes
+
+- 41c8b6d: Initial release of `@dainamite/cpq` as a standalone package.
+
+  Configure-Price-Quote engine for Open Mercato: configurable product
+  attributes, multi-charge pricing tables, guided quoting wizards,
+  customer inventory & subscription tracking, ARC (Amend / Renew / Cancel)
+  flows, quote → order → activation pipeline.
+
+  This is the first release shipped from the dainamite-core monorepo as
+  `@dainamite/cpq` on GitHub Packages. Source previously lived in
+  `src/modules/cpq/` (in-tree, `from: '@app'`); now consumed via
+  `peerDependencies` and registered as `{ id: 'cpq', from: '@dainamite/cpq' }`.
+
+  Requires (peerDependencies): `@open-mercato/core ^0.5.0`,
+  `@open-mercato/events ^0.5.0`, `@open-mercato/shared ^0.5.0`,
+  `@open-mercato/ui ^0.5.0`, `@mikro-orm/core ^6.6.0`,
+  `@mikro-orm/postgresql ^6.6.0`, `awilix ^12.0.0`, `next ^16.0.0`,
+  `react ^19.0.0`, `react-dom ^19.0.0`, `zod ^4.0.0`, `bcryptjs ^3.0.0`,
+  `lucide-react ^0.400.0`.
+
+  Required Open Mercato modules (declared in `metadata.requires`):
+  `auth`, `directory`, `catalog`, `sales`, `customers`, `dictionaries`.
+
+### Patch Changes
+
+- 8868606: Refresh README to reflect post-extraction state. Removes outdated
+  "scaffold only" warning, documents install + register flow, lists
+  required Open Mercato modules, and links to the package-isolation
+  guard test.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dainamite Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MIGRATION.md

@@ -0,0 +1,236 @@
+# Migration plan — `src/modules/cpq/` → `@dainamite/cpq`
+
+This document tracks the concrete steps to extract the in-tree CPQ module into
+the `@dainamite/cpq` package, per
+[SPEC-001 — Module Distribution Architecture](../../.ai/specs/SPEC-001-2026-04-23-module-distribution-architecture.md).
+
+## Current state (2026-05-04)
+
+- CPQ source lives at [`src/modules/cpq/`](../../src/modules/cpq/).
+- Registered as `{ id: 'cpq', from: '@app' }` in
+  [`src/modules.ts`](../../src/modules.ts).
+- `packages/cpq/` is a structural placeholder only (this directory).
+- `dainamite-core` repo is the L3 customer demo (Demo Netia) per SPEC-001 Q4.
+- **Customer demo data does NOT live in `cpq/`** (since XD-276). GIX and
+  Puffin Cloud catalog seeds live in `src/modules/demo_gix/` and
+  `src/modules/demo_puffin/`, registered as use cases via
+  `cpq/lib/seeds/api.ts` and orchestrated by `src/modules/demo_tenants/`.
+  When extracting `@dainamite/cpq`, only the registry API ships; the demo
+  modules stay in the customer repo.
+
+## Target state
+
+- CPQ source lives at `packages/cpq/src/modules/cpq/`.
+- `dainamite-core` consumes it via `peerDependencies` and registers
+  `{ id: 'cpq', from: '@dainamite/cpq' }`.
+- Package is published to **GitHub Packages** under `@dainamite/cpq`.
+- Other customer apps install it the same way.
+
+## Phased migration
+
+### Phase 0 — Scaffold (this commit)
+
+- [x] Copy CPQ module from `open-mercato-cpq-v0` to `src/modules/cpq/`.
+- [x] Copy specs (`specs/`), manuals (`manuals/`), and SPEC-001 to `.ai/specs/`.
+- [x] Create `packages/cpq/package.json` placeholder with target `@dainamite/cpq`
+      identity, peer deps, exports.
+- [x] Document plan (this file).
+
+### Phase 1 — Standalone build (XD-270, 2026-05-08)
+
+- [x] Promote root to a Yarn workspace (`workspaces: ["packages/*"]` in root
+      `package.json`).
+- [x] Add `packages/cpq/tsconfig.json` (extends root) and
+      `packages/cpq/tsconfig.build.json`.
+- [x] Add `packages/cpq/build.mjs` (esbuild → `dist/`, mirrors
+      `@open-mercato/core/build.mjs` — only `.js` emit, no `.d.ts`).
+      Per Open Mercato convention, the package ships `src/` for types
+      and `dist/` for runtime — exports map `types → ./src/*.ts`,
+      `default → ./dist/*.js`.
+- [x] Move `src/modules/cpq/` → `packages/cpq/src/modules/cpq/` (single
+      `git mv` — history preserved, all 136 source files renamed).
+- [x] Update `src/modules.ts` entry to `{ id: 'cpq', from: '@dainamite/cpq' }`.
+- [x] Patch `@open-mercato/cli@0.5.0` to allow the `@dainamite/` prefix in
+      `GENERATED_MODULE_SPECIFIER_PREFIXES` (the CLI rejects unknown package
+      scopes when emitting `.mercato/generated/`). Patch lives at
+      `.yarn/patches/@open-mercato-cli-npm-0.5.0-*.patch`. **Will be
+      fixed upstream in the next framework release** — patch can be
+      removed at that point.
+- [x] Rewrite cross-module imports in `demo_gix`, `demo_puffin`,
+      `demo_tenants`: `'../../cpq/...'` → `'@dainamite/cpq/modules/cpq/...'`
+      (26 files). Demo modules now consume CPQ via the public package
+      surface — no in-repo coupling left.
+- [x] Extend root `jest.config.cjs` `testMatch` to discover tests under
+      `packages/*/src/**/__tests__/`. Without this, the 27 CPQ test files
+      moved with `git mv` were silently skipped.
+- [x] `yarn install && yarn workspace @dainamite/cpq build && yarn generate && yarn typecheck && yarn test` — all green (26 suites, 531 tests).
+- [ ] Smoke-test backend: `yarn dev`, list/create offering, run a quote
+      wizard, check ARC subscription detail page. **(manual, blocks merge)**
+
+### Phase 2 — Audit & lint cross-package coupling (XD-270, 2026-05-09)
+
+- [x] Grep for `@ManyToOne`, `@OneToMany`, `@ManyToMany`, `@OneToOne` —
+      zero violations (CPQ already uses FK string columns).
+- [x] Grep for cross-module imports (`@/modules/<x>`, `src/modules/<x>`,
+      relative escapes) — zero violations.
+- [x] Audit deep imports into `@open-mercato/core/modules/<x>` — found
+      `auth` and `directory` usages not declared in `metadata.requires`.
+      Fix: extended [`packages/cpq/src/modules/cpq/index.ts`](src/modules/cpq/index.ts)
+      `requires` to `['auth', 'directory', 'catalog', 'sales', 'customers', 'dictionaries']`.
+- [x] Audit external deps used by package — found `bcryptjs` imported in
+      `lib/seeds/tenant-provisioning.ts` but missing from `peerDependencies`.
+      Fix: added `bcryptjs ^3.0.0` to `peerDependencies`. Also added
+      `lucide-react ^0.400.0` (used by sidebar icons in `backend/**/page.meta.ts`).
+- [x] Add guard test:
+      [`packages/cpq/src/modules/cpq/__tests__/package-isolation.test.ts`](src/modules/cpq/__tests__/package-isolation.test.ts) —
+      static analysis of every `.ts`/`.tsx` in the package, asserting:
+      no forbidden cross-module imports; only allowed import prefixes
+      (mirroring `peerDependencies`); deep core imports declared in
+      `requires`; zero ORM relations; module index loads cleanly. Future
+      regressions caught by CI.
+- [x] Removed `@open-mercato/core` patch (nav sidebar order tweak) — was
+      cosmetic; not worth the upstream-PR cost.
+
+### Phase 3 — Publish (XD-270, 2026-05-09)
+
+- [x] Flip `private: true` → `false` in `packages/cpq/package.json`.
+- [x] Install + init `@changesets/cli` — config in `.changeset/config.json`
+      with `access: restricted` → later switched to `public`,
+      `baseBranch: main`, `dainamite-core` automatically skipped (private workspace).
+- [x] First changeset: `.changeset/initial-release.md` for
+      `@dainamite/cpq` initial release.
+- [x] CI release workflow at `.github/workflows/release.yml` —
+      on push to `main`, runs `changesets/action@v1` which either opens a
+      "Version Packages" PR (when changesets exist) or runs
+      `yarn changeset publish` (when version PR is merged).
+- [x] **Switched publish target from GitHub Packages → public npm.js.**
+      First publish attempts as `@dainamite/cpq` on GitHub Packages failed
+      with `403 Forbidden — installation does not exist`: scope `@dainamite`
+      on GitHub belongs to a different (unrelated) "DAInamite" organization
+      based in Berlin (dainamite.de). Switching to public npm.js, where the
+      `@dainamite` scope is free, lets us keep the brand without renaming
+      everything to `@dainamite-technologies/cpq`. Open Mercato itself
+      publishes to npm.js (`@open-mercato/core` etc.) so this is also more
+      consistent with the upstream ecosystem.
+- [ ] **Manual / first-time setup before merge to main:**
+      - **npm.js account + org** — sign up at https://www.npmjs.com/signup
+        if needed, then create the `dainamite` org at
+        https://www.npmjs.com/org/create (Free plan — public packages only,
+        which is fine since CPQ is public).
+      - **`NPM_TOKEN` secret** — at https://www.npmjs.com/settings/<your-username>/tokens
+        click "Generate New Token" → type `Automation` → Add as repo secret
+        named `NPM_TOKEN`.
+      - **`RELEASE_TOKEN` PAT** — required for "Version Packages" PRs to
+        trigger CI automatically. Without it, you must push an empty
+        commit to `changeset-release/main` each release to trigger CI
+        (the default `GITHUB_TOKEN` cannot trigger workflows on PRs it
+        opens, anti-recursion safety). Setup:
+        1. Settings → Developer settings → Personal access tokens →
+           Tokens (classic) → Generate new (classic)
+        2. Scope: `repo` (full)
+        3. Expiration: 90+ days, set a calendar reminder to rotate
+        4. Repo settings → Secrets and variables → Actions → New
+           repository secret → name `RELEASE_TOKEN`, value the PAT
+      - **License decision** — `packages/cpq/package.json` still has
+        `"license": "UNLICENSED"` from when the package was private.
+        For a public npm package pick a real OSI license (MIT recommended
+        for ecosystem consistency with `@open-mercato/*`) and update
+        before merging.
+- [ ] **First publish flow** (after this branch lands on main):
+      1. Push to main triggers release workflow.
+      2. Workflow sees pending changesets and opens a
+         "Version Packages" PR that bumps `@dainamite/cpq` and writes
+         `packages/cpq/CHANGELOG.md`.
+      3. Merge that PR → release workflow re-runs, this time runs
+         `yarn changeset publish` → `@dainamite/cpq` lands on
+         https://www.npmjs.com/package/@dainamite/cpq.
+- [ ] Update SPEC-001 changelog.
+
+> **Note:** SPEC-001 references a future `dainamite-product/` repo as a
+> Phase 4 destination. **That plan is dropped** — `dainamite-core` IS the
+> Dainamite product monorepo, and `packages/cpq/` (plus any future
+> `@dainamite/*` packages) stay here permanently. Other customer apps
+> install from npm.js with no auth setup needed (public package).
+
+## Risks (carried from SPEC-001)
+
+| Risk | Mitigation |
+|---|---|
+| Cross-package ORM relations leak in | Lint rule + isolation bootstrap test |
+| Two CPQ instances in `node_modules` | `peerDependencies` only, narrow ranges |
+| Breaking schema migration on customer DB | Migrations ship in package, document upgrade in CHANGELOG |
+| Custom @app code drifts from package | Audit every 6 months, promote duplicated features into the package |
+
+## Schema / API changelog (track breaking changes here)
+
+### 2026-05-04 — XD-250 ARC (Amend / Renew / Cancel)
+
+Additive only. Every existing CPQ contract is preserved.
+
+**New entities** (require migration):
+- `cpq_quote_target_subscriptions` — junction quote ↔ subscription target
+- `cpq_subscription_change_logs` — append-only audit per ARC operation
+
+**New columns on existing entities** (additive, default-safe):
+- `cpq_quote_configurations`: `quote_type` (default `'new'`), `arc_reason_*`,
+  `arc_etf_*`, `arc_merge_new_term_*`, `arc_merge_new_sub_*`
+- `cpq_quote_line_configurations`: `target_subscription_id`,
+  `source_subscription_item_id`
+- `cpq_inventory_subscriptions`: `current_term_start`,
+  `merged_into_subscription_id`, `last_change_log_id`,
+  `version` (MikroORM optimistic lock)
+
+**Status enum extensions**:
+- `INVENTORY_SUBSCRIPTION_STATUSES` adds `'superseded'` (terminal,
+  reachable only via merge-renewal — sources transition there).
+- Subscription items mirror parent via the same `'superseded'` status.
+
+**New events** in `cpq.events.ts` (NEW file — first events for the module):
+- `cpq.subscription.amended`
+- `cpq.subscription.renewed`
+- `cpq.subscription.merged`
+- `cpq.subscription.cancelled`
+- `cpq.subscription.superseded`
+
+All five include a `proration` payload + ChangeLog id, persistent +
+`clientBroadcast: true`.
+
+**New API endpoints** (all under `src/modules/cpq/api/`):
+- `POST /api/cpq/quotes/from-subscription`
+- `GET / POST /api/cpq/quotes/[quoteId]/target-subscriptions`
+- `PATCH / DELETE /api/cpq/quotes/[quoteId]/target-subscriptions/[targetId]`
+- `POST /api/cpq/quotes/[quoteId]/cancel-meta`
+- `POST /api/cpq/quotes/[quoteId]/merge-meta`
+- `PATCH /api/cpq/quotes/[quoteId]` — extended to accept `quoteType`
+  (one-way `new → amend|renew|cancel`)
+- `GET /api/cpq/inventory/subscriptions/[subscriptionId]/change-log`
+- `GET /api/cpq/inventory/subscriptions/expiring`
+
+**New ACL features** (in `acl.ts`, granted to admin + employee in `setup.ts`):
+- `cpq.arc.amend.manage`
+- `cpq.arc.renew.manage`
+- `cpq.arc.cancel.manage`
+- `cpq.arc.changelog.view`
+- `cpq.inventory.expiring.view`
+
+**Service surface additions** (no new top-level services — methods on existing):
+- `cpqInventoryService.applyAmendment / applyRenewal / applyMergeRenewal /
+  applyCancel` — idempotent on `(sourceOrderId, subscriptionId)`.
+- `cpqInventoryService.findExpiringSubscriptions / listChangeLog`.
+- `cpqQuotingService.createQuoteFromSubscription / setQuoteType /
+  attachTargetSubscription / detachTargetSubscription /
+  updateTargetSubscription / setCancelMeta / setMergeMeta /
+  validateArcQuote`.
+- `cpqOrderService.activateOrder` — extended to branch on `quoteType` and
+  invoke the right `apply*` per attached target. Events emit AFTER commit.
+
+**Backwards compatibility**: existing `quote_type='new'` quotes flow through
+the unchanged path. `autoRenew` column on subscriptions is preserved but no
+longer consulted (no scheduler).
+
+## Open decisions (per SPEC-001 §Open Questions)
+
+- Q3 — Monorepo tooling: yarn workspaces alone vs Nx/Turborepo. Default to
+  workspaces; revisit at >15 packages.
+- Q5 — Licensing model (per-package vs per-tenant). **Deferred.**
+- Q6 — Customer repo commit access (us only vs customer too). **Deferred.**

package/README.md

@@ -0,0 +1,108 @@
+# @dainamite/cpq
+
+Dainamite **CPQ** (Configure, Price, Quote) module for Open Mercato —
+configurable product attributes, multi-charge pricing tables, guided
+quoting wizards, customer inventory & subscription tracking, ARC
+(Amend / Renew / Cancel) flows, quote → order → activation pipeline.
+
+## Install
+
+Requires access to the `@dainamite` GitHub Packages scope. Configure
+`.npmrc` to point `@dainamite` at `https://npm.pkg.github.com`, then:
+
+```sh
+yarn add @dainamite/cpq
+```
+
+Register the module in your host app's `src/modules.ts`:
+
+```ts
+{ id: 'cpq', from: '@dainamite/cpq' }
+```
+
+Run framework migrations to install CPQ's schema:
+
+```sh
+yarn mercato db migrate
+```
+
+## What's inside
+
+```
+packages/cpq/src/modules/cpq/
+├── index.ts        module metadata + requires
+├── acl.ts          ACL feature definitions
+├── ce.ts           custom entity / field set declarations
+├── di.ts           Awilix DI registrations
+├── setup.ts        tenant init, role features, seed data
+├── data/           entities, validators, enrichers
+├── api/            REST routes (resource-style: api/<resource>/route.ts)
+├── backend/        admin UI pages (auto-discovered)
+├── services/       pricing, quoting, validation, product, wizard, inventory, order, bundle
+├── widgets/        injection: customer-inventory, order-cpq-tab, quote-configurator
+├── workflows/      quote → order step components
+├── lib/seeds/      use-case registry API
+└── migrations/     own MikroORM migrations (never hand-write — `yarn mercato db generate`)
+```
+
+The package ships `src/` (for TypeScript consumers' types) and
+`dist/` (esbuild-built JS for runtime). Following the
+[`@open-mercato/core`](https://www.npmjs.com/package/@open-mercato/core)
+build convention, no `.d.ts` is emitted — `exports.types` resolves
+directly to source.
+
+## Distribution model (per SPEC-001)
+
+- **L1** — Open Mercato core consumed from `@open-mercato/*` (npm).
+- **L2** — Dainamite product modules (this package + sibling
+  `@dainamite/*`), published to **GitHub Packages** under the
+  `@dainamite` scope.
+- **L3** — `dainamite-core` is the first L3 customer app
+  ("Demo Netia"); other customer repos consume `@dainamite/cpq` via
+  `yarn add` and register it the same way.
+
+## Hard rules (carried over from SPEC-001)
+
+- **No ORM relations across packages.** Cross-module references are FK
+  strings only (`productId: string`), never `@ManyToOne`.
+- **`peerDependencies`, never `dependencies`** for sibling
+  `@dainamite/*` and `@open-mercato/*` — guarantees a single shared
+  instance in `node_modules`.
+- **Each major bump ships its own migrations** under
+  `src/modules/cpq/migrations/`; document upgrade path in
+  `CHANGELOG.md`.
+- **No customer-specific logic here.** Tenant-specific overrides live
+  in the consuming app under `src/modules/@app/<feature>/`.
+
+## Required Open Mercato modules
+
+CPQ declares the following in `metadata.requires` and will fail to
+bootstrap if any are missing from the host app's `src/modules.ts`:
+
+`auth`, `directory`, `catalog`, `sales`, `customers`, `dictionaries`.
+
+## Package isolation guard
+
+Static lint test at
+[`src/modules/cpq/__tests__/package-isolation.test.ts`](src/modules/cpq/__tests__/package-isolation.test.ts)
+asserts the package never imports from sibling app modules, never
+deep-imports `@open-mercato/core/modules/<x>` for an undeclared
+dependency, and contains zero cross-entity ORM relations. Runs on
+every CI build — protects future contributors from accidentally
+breaking the package boundary.
+
+## Versioning
+
+Versioned via [changesets](https://github.com/changesets/changesets).
+Add a changeset alongside any change in `packages/cpq/`:
+
+```sh
+yarn changeset
+```
+
+Bumps and the GitHub Packages publish are handled by the release
+workflow on push to `main`.
+
+## License
+
+Proprietary — internal Dainamite use only.

package/dist/modules/cpq/acl.js

@@ -0,0 +1,30 @@
+const features = [
+  { id: "cpq.quotes.view", title: "View CPQ Quotes", module: "cpq" },
+  { id: "cpq.quotes.manage", title: "Manage CPQ Quotes", module: "cpq" },
+  { id: "cpq.pricing.view", title: "View Pricing", module: "cpq" },
+  { id: "cpq.pricing.manage", title: "Manage Pricing", module: "cpq" },
+  { id: "cpq.products.view", title: "View CPQ Product Config", module: "cpq" },
+  { id: "cpq.products.manage", title: "Manage CPQ Product Config", module: "cpq" },
+  { id: "cpq.specifications.view", title: "View Product Specifications", module: "cpq" },
+  { id: "cpq.specifications.manage", title: "Manage Product Specifications", module: "cpq" },
+  { id: "cpq.offerings.view", title: "View Product Offerings", module: "cpq" },
+  { id: "cpq.offerings.manage", title: "Manage Product Offerings", module: "cpq" },
+  { id: "cpq.wizards.view", title: "View Wizards", module: "cpq" },
+  { id: "cpq.wizards.manage", title: "Manage Wizards", module: "cpq" },
+  { id: "cpq.orders.view", title: "View CPQ Orders", module: "cpq" },
+  { id: "cpq.orders.manage", title: "Manage CPQ Orders", module: "cpq" },
+  // XD-250 ARC (Amend / Renew / Cancel)
+  { id: "cpq.arc.amend.manage", title: "Manage Amend Quotes", module: "cpq" },
+  { id: "cpq.arc.renew.manage", title: "Manage Renew Quotes", module: "cpq" },
+  { id: "cpq.arc.cancel.manage", title: "Manage Cancel Quotes", module: "cpq" },
+  { id: "cpq.arc.changelog.view", title: "View Subscription Change History", module: "cpq" }
+  // Expiring-subscriptions feature retired — the dedicated /expiring page
+  // was replaced by an "Expiring within (days)" filter + saved perspective
+  // on the main subscriptions list, which uses `cpq.inventory.view`.
+];
+var acl_default = features;
+export {
+  acl_default as default,
+  features
+};
+//# sourceMappingURL=acl.js.map

package/dist/modules/cpq/acl.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/cpq/acl.ts"],
+  "sourcesContent": ["export const features = [\n  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },\n  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },\n  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },\n  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },\n  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },\n  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },\n  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },\n  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },\n  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },\n  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },\n  // XD-250 ARC (Amend / Renew / Cancel)\n  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },\n  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },\n  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },\n  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },\n  // Expiring-subscriptions feature retired \u2014 the dedicated /expiring page\n  // was replaced by an \"Expiring within (days)\" filter + saved perspective\n  // on the main subscriptions list, which uses `cpq.inventory.view`.\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA,EACrE,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,qBAAqB,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,6BAA6B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,2BAA2B,OAAO,+BAA+B,QAAQ,MAAM;AAAA,EACrF,EAAE,IAAI,6BAA6B,OAAO,iCAAiC,QAAQ,MAAM;AAAA,EACzF,EAAE,IAAI,sBAAsB,OAAO,0BAA0B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,wBAAwB,OAAO,4BAA4B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA;AAAA,EAErE,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,yBAAyB,OAAO,wBAAwB,QAAQ,MAAM;AAAA,EAC5E,EAAE,IAAI,0BAA0B,OAAO,oCAAoC,QAAQ,MAAM;AAAA;AAAA;AAAA;AAI3F;AAEA,IAAO,cAAQ;",
+  "names": []
+}

package/dist/modules/cpq/api/_helpers/handleArcError.js

@@ -0,0 +1,37 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { OptimisticLockError } from "@mikro-orm/core";
+import { QuotingError } from "../../services/cpqQuotingService.js";
+function handleArcError(err, ctx) {
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: "Validation error", details: err.issues },
+      { status: 400 }
+    );
+  }
+  if (err instanceof QuotingError) {
+    const body = { error: err.message };
+    if (err.cpqStatus) body.cpqStatus = err.cpqStatus;
+    if (err.details) Object.assign(body, err.details);
+    return NextResponse.json(body, { status: err.status });
+  }
+  if (err instanceof OptimisticLockError || err && typeof err === "object" && typeof err.constructor?.name === "string" && err.constructor.name === "OptimisticLockError") {
+    return NextResponse.json(
+      { error: "Concurrent modification detected", details: err.message },
+      { status: 409 }
+    );
+  }
+  if (err && typeof err === "object" && "status" in err && typeof err.status === "number") {
+    const e = err;
+    const message = e.message ?? e.error ?? "Conflict";
+    const body = { error: message };
+    if (e.details && typeof e.details === "object") Object.assign(body, e.details);
+    return NextResponse.json(body, { status: e.status });
+  }
+  console.error(`[${ctx}]`, err);
+  return NextResponse.json({ error: "Internal error" }, { status: 500 });
+}
+export {
+  handleArcError
+};
+//# sourceMappingURL=handleArcError.js.map

package/dist/modules/cpq/api/_helpers/handleArcError.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/handleArcError.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { OptimisticLockError } from '@mikro-orm/core'\nimport { QuotingError } from '../../services/cpqQuotingService'\n\n/**\n * Shared error \u2192 JSON-response converter for ARC routes (XD-250).\n *\n * Handles three families:\n *   1. Zod validation errors \u2192 400 with `details` array.\n *   2. Service-layer `QuotingError` (matched both via `instanceof` AND via\n *      duck-typing on `name === 'QuotingError'`) \u2192 propagates `err.status`.\n *      The duck-typing fallback exists because Turbopack hot-reload can\n *      produce two distinct class instances for the same source file\n *      across module boundaries, breaking `instanceof` checks at runtime.\n *   3. cpqInventoryService throws plain `{ status, error }` objects \u2192\n *      propagate the embedded status.\n *   4. Anything else \u2192 500 + console.error with the route context.\n *\n * Returning the response keeps route handlers terse:\n *   `} catch (err) { return handleArcError(err, 'cpq/quotes/from-subscription.POST') }`\n */\nexport function handleArcError(err: unknown, ctx: string): NextResponse {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: 'Validation error', details: err.issues },\n      { status: 400 },\n    )\n  }\n\n  if (err instanceof QuotingError) {\n    const body: Record<string, unknown> = { error: err.message }\n    if (err.cpqStatus) body.cpqStatus = err.cpqStatus\n    if (err.details) Object.assign(body, err.details)\n    return NextResponse.json(body, { status: err.status })\n  }\n\n  // MikroORM optimistic-lock collision on subscription.version (XD-250 spec\n  // \u00A7 Risks \"Order activation racing with another mutation\"). Both\n  // `instanceof OptimisticLockError` AND constructor-name fallback to\n  // survive Turbopack class drift.\n  if (\n    err instanceof OptimisticLockError ||\n    (err &&\n      typeof err === 'object' &&\n      typeof (err as { constructor?: { name?: string } }).constructor?.name === 'string' &&\n      (err as { constructor: { name: string } }).constructor.name === 'OptimisticLockError')\n  ) {\n    return NextResponse.json(\n      { error: 'Concurrent modification detected', details: (err as Error).message },\n      { status: 409 },\n    )\n  }\n\n  // Duck-typed QuotingError (Turbopack instanceof drift) and inventory-service\n  // plain throw shape `{ status, error }`. Both surface a numeric `status`.\n  // Also propagates `details` (object) into response body \u2014 preserves the\n  // structured payload (e.g. `existingQuoteId`) that the typed branch above\n  // would have surfaced if instanceof had matched.\n  if (\n    err &&\n    typeof err === 'object' &&\n    'status' in err &&\n    typeof (err as { status: unknown }).status === 'number'\n  ) {\n    const e = err as {\n      status: number\n      message?: string\n      error?: string\n      name?: string\n      details?: Record<string, unknown>\n    }\n    const message = e.message ?? e.error ?? 'Conflict'\n    const body: Record<string, unknown> = { error: message }\n    if (e.details && typeof e.details === 'object') Object.assign(body, e.details)\n    return NextResponse.json(body, { status: e.status })\n  }\n\n  console.error(`[${ctx}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAmBtB,SAAS,eAAe,KAAc,KAA2B;AACtE,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,eAAe,cAAc;AAC/B,UAAM,OAAgC,EAAE,OAAO,IAAI,QAAQ;AAC3D,QAAI,IAAI,UAAW,MAAK,YAAY,IAAI;AACxC,QAAI,IAAI,QAAS,QAAO,OAAO,MAAM,IAAI,OAAO;AAChD,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACvD;AAMA,MACE,eAAe,uBACd,OACC,OAAO,QAAQ,YACf,OAAQ,IAA4C,aAAa,SAAS,YACzE,IAA0C,YAAY,SAAS,uBAClE;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC,SAAU,IAAc,QAAQ;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAOA,MACE,OACA,OAAO,QAAQ,YACf,YAAY,OACZ,OAAQ,IAA4B,WAAW,UAC/C;AACA,UAAM,IAAI;AAOV,UAAM,UAAU,EAAE,WAAW,EAAE,SAAS;AACxC,UAAM,OAAgC,EAAE,OAAO,QAAQ;AACvD,QAAI,EAAE,WAAW,OAAO,EAAE,YAAY,SAAU,QAAO,OAAO,MAAM,EAAE,OAAO;AAC7E,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAAA,EACrD;AAEA,UAAQ,MAAM,IAAI,GAAG,KAAK,GAAG;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;",
+  "names": []
+}

package/dist/modules/cpq/api/attribute-options/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { resolveCpqRouteContext } from "../context.js";
+import { DefaultCpqValidationService } from "../../services/cpqValidationService.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["cpq.quotes.view"] }
+};
+async function GET(req) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const url = new URL(req.url);
+    const productId = url.searchParams.get("productId");
+    const attributeCode = url.searchParams.get("attributeCode");
+    const configParam = url.searchParams.get("configuration");
+    if (!productId || !attributeCode) {
+      return NextResponse.json(
+        { error: "productId and attributeCode are required" },
+        { status: 400 }
+      );
+    }
+    let configuration = {};
+    if (configParam) {
+      try {
+        configuration = JSON.parse(configParam);
+      } catch {
+        return NextResponse.json({ error: "Invalid configuration JSON" }, { status: 400 });
+      }
+    }
+    const validationService = new DefaultCpqValidationService(ctx.em);
+    const options = await validationService.getAttributeOptions({
+      productId,
+      attributeCode,
+      currentConfiguration: configuration,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId
+    });
+    return NextResponse.json({ items: options });
+  } catch (err) {
+    console.error("[cpq/attribute-options.GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+export {
+  GET,
+  metadata
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/attribute-options/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/attribute-options/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../context'\nimport { DefaultCpqValidationService } from '../../services/cpqValidationService'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },\n}\n\n/**\n * Returns resolved options for an attribute, including dynamic options from\n * pricing tables (e.g. cloud_region filtered by cloud_provider).\n * Used by the quoting wizard to render picklists for attributes with\n * dynamicOptionsSource or dependsOn constraints.\n */\nexport async function GET(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const url = new URL(req.url)\n    const productId = url.searchParams.get('productId')\n    const attributeCode = url.searchParams.get('attributeCode')\n    const configParam = url.searchParams.get('configuration')\n\n    if (!productId || !attributeCode) {\n      return NextResponse.json(\n        { error: 'productId and attributeCode are required' },\n        { status: 400 },\n      )\n    }\n\n    let configuration: Record<string, unknown> = {}\n    if (configParam) {\n      try {\n        configuration = JSON.parse(configParam) as Record<string, unknown>\n      } catch {\n        return NextResponse.json({ error: 'Invalid configuration JSON' }, { status: 400 })\n      }\n    }\n\n    const validationService = new DefaultCpqValidationService(ctx.em)\n    const options = await validationService.getAttributeOptions({\n      productId,\n      attributeCode,\n      currentConfiguration: configuration,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    })\n\n    return NextResponse.json({ items: options })\n  } catch (err) {\n    console.error('[cpq/attribute-options.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,mCAAmC;AAErC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAQA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,YAAY,IAAI,aAAa,IAAI,WAAW;AAClD,UAAM,gBAAgB,IAAI,aAAa,IAAI,eAAe;AAC1D,UAAM,cAAc,IAAI,aAAa,IAAI,eAAe;AAExD,QAAI,CAAC,aAAa,CAAC,eAAe;AAChC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,2CAA2C;AAAA,QACpD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,gBAAyC,CAAC;AAC9C,QAAI,aAAa;AACf,UAAI;AACF,wBAAgB,KAAK,MAAM,WAAW;AAAA,MACxC,QAAQ;AACN,eAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACnF;AAAA,IACF;AAEA,UAAM,oBAAoB,IAAI,4BAA4B,IAAI,EAAE;AAChE,UAAM,UAAU,MAAM,kBAAkB,oBAAoB;AAAA,MAC1D;AAAA,MACA;AAAA,MACA,sBAAsB;AAAA,MACtB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,EAC7C,SAAS,KAAK;AACZ,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "names": []
+}