@dainamite/cpq 0.2.2

package/src/modules/cpq/__tests__/package-isolation.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Package isolation guard for @dainamite/cpq.
+ *
+ * Proves the package can be loaded and described without any sibling
+ * `src/modules/<x>` modules being present. Catches three classes of leak:
+ *
+ *   1. import paths that escape the package boundary (relative `../../../../<other>`,
+ *      absolute `@/modules/<other>`, deep `src/modules/<other>`)
+ *   2. deep imports into `@open-mercato/core/modules/<x>` for modules that aren't
+ *      declared in `metadata.requires`
+ *   3. side-effect-only imports that pull in non-CPQ entities at module load time
+ *
+ * These checks are static (read package source) — no DI bootstrap is
+ * attempted, so the test is fast and runs in plain Node + jest.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+import { metadata } from '../index'
+
+const PACKAGE_ROOT = path.resolve(__dirname, '..')
+
+// Must mirror peerDependencies in packages/cpq/package.json (plus relatives + node builtins).
+// Adding a prefix here without adding it to peerDependencies = silent runtime failure for
+// consumers that don't happen to have the dep transitively.
+const ALLOWED_IMPORT_PREFIXES = [
+  './',
+  '../',
+  '@open-mercato/',
+  '@mikro-orm/',
+  'awilix',
+  'bcryptjs',
+  'lucide-react',
+  'next',
+  'next/',
+  'react',
+  'react/',
+  'react-dom',
+  'react-dom/',
+  'zod',
+  '@dainamite/',
+  'node:',
+  // UI table primitive — listed across @tanstack so future submodules
+  // (e.g. @tanstack/react-virtual) also pass without revisits.
+  '@tanstack/',
+  // Excel import/export on the pricing-tables detail page.
+  'xlsx',
+]
+
+const NODE_BUILTINS = new Set([
+  'crypto',
+  'fs',
+  'path',
+  'os',
+  'util',
+  'stream',
+  'buffer',
+  'http',
+  'https',
+  'url',
+  'querystring',
+  'child_process',
+  'zlib',
+  'events',
+  'assert',
+])
+
+const FORBIDDEN_PREFIXES = [
+  '@/modules/',
+  'src/modules/',
+  '../../../../catalog/',
+  '../../../../sales/',
+  '../../../../customers/',
+  '../../../../dictionaries/',
+  '../../../../auth/',
+  '../../../../directory/',
+  '../../../../demo_',
+  '../../../../portal/',
+  '../../../../customer_accounts/',
+  '../../../../example/',
+]
+
+async function walk(dir: string, acc: string[] = []): Promise<string[]> {
+  const entries = await fs.readdir(dir, { withFileTypes: true })
+  for (const entry of entries) {
+    if (entry.name === 'node_modules' || entry.name === 'dist') continue
+    if (entry.name === '__tests__' || entry.name === '__integration__') continue
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) {
+      await walk(full, acc)
+    } else if (/\.(ts|tsx|mts|cts)$/.test(entry.name) && !/\.d\.ts$/.test(entry.name)) {
+      acc.push(full)
+    }
+  }
+  return acc
+}
+
+const IMPORT_RE = /(?:^|\n)\s*(?:import\s+(?:[^'"]+\s+from\s+)?|export\s+(?:[^'"]+\s+from\s+)|import\s*\(\s*)["']([^"']+)["']/g
+
+function extractImports(source: string): string[] {
+  const out: string[] = []
+  let m: RegExpExecArray | null
+  while ((m = IMPORT_RE.exec(source)) !== null) {
+    out.push(m[1])
+  }
+  return out
+}
+
+function isAllowedSpecifier(spec: string): boolean {
+  if (NODE_BUILTINS.has(spec)) return true
+  return ALLOWED_IMPORT_PREFIXES.some((p) => spec === p || spec.startsWith(p))
+}
+
+function isForbiddenSpecifier(spec: string): boolean {
+  return FORBIDDEN_PREFIXES.some((p) => spec.startsWith(p))
+}
+
+function extractCoreModuleSubpath(spec: string): string | null {
+  const prefix = '@open-mercato/core/modules/'
+  if (!spec.startsWith(prefix)) return null
+  const rest = spec.slice(prefix.length)
+  const slash = rest.indexOf('/')
+  return slash === -1 ? rest : rest.slice(0, slash)
+}
+
+describe('@dainamite/cpq package isolation', () => {
+  let allFiles: string[] = []
+  let importsByFile = new Map<string, string[]>()
+
+  beforeAll(async () => {
+    allFiles = await walk(PACKAGE_ROOT)
+    importsByFile = new Map()
+    for (const file of allFiles) {
+      const source = await fs.readFile(file, 'utf-8')
+      importsByFile.set(file, extractImports(source))
+    }
+  })
+
+  it('declares all required modules in metadata.requires', () => {
+    expect(metadata.requires).toEqual(
+      expect.arrayContaining(['auth', 'directory', 'catalog', 'sales', 'customers', 'dictionaries']),
+    )
+  })
+
+  it('does not import from sibling app modules', () => {
+    const violations: Array<{ file: string; spec: string }> = []
+    for (const [file, specs] of importsByFile) {
+      for (const spec of specs) {
+        if (isForbiddenSpecifier(spec)) {
+          violations.push({ file: path.relative(PACKAGE_ROOT, file), spec })
+        }
+      }
+    }
+    if (violations.length > 0) {
+      throw new Error(
+        `Forbidden cross-module imports found:\n${violations
+          .map((v) => `  ${v.file} → ${v.spec}`)
+          .join('\n')}`,
+      )
+    }
+  })
+
+  it('only uses allowed import prefixes (no surprise package leaks)', () => {
+    const violations: Array<{ file: string; spec: string }> = []
+    for (const [file, specs] of importsByFile) {
+      for (const spec of specs) {
+        if (!isAllowedSpecifier(spec)) {
+          violations.push({ file: path.relative(PACKAGE_ROOT, file), spec })
+        }
+      }
+    }
+    if (violations.length > 0) {
+      throw new Error(
+        `Imports outside the allowed prefix set:\n${violations
+          .map((v) => `  ${v.file} → ${v.spec}`)
+          .join('\n')}\n` +
+          `If a new prefix is legitimate, add it to ALLOWED_IMPORT_PREFIXES in this test.`,
+      )
+    }
+  })
+
+  it('only deep-imports from core modules declared in metadata.requires', () => {
+    const declared = new Set<string>(metadata.requires ?? [])
+    const violations: Array<{ file: string; spec: string; module: string }> = []
+    for (const [file, specs] of importsByFile) {
+      for (const spec of specs) {
+        const subModule = extractCoreModuleSubpath(spec)
+        if (subModule && !declared.has(subModule)) {
+          violations.push({ file: path.relative(PACKAGE_ROOT, file), spec, module: subModule })
+        }
+      }
+    }
+    if (violations.length > 0) {
+      throw new Error(
+        `Deep imports into @open-mercato/core/modules/<x> for modules not in metadata.requires:\n${violations
+          .map((v) => `  ${v.file} → ${v.spec} (add '${v.module}' to requires)`)
+          .join('\n')}`,
+      )
+    }
+  })
+
+  it('contains no @ManyToOne / @OneToMany / @ManyToMany / @OneToOne ORM relations', async () => {
+    const relRe = /@(ManyToOne|OneToMany|ManyToMany|OneToOne)\s*\(/g
+    const violations: Array<{ file: string; line: number; match: string }> = []
+    for (const file of allFiles) {
+      const source = await fs.readFile(file, 'utf-8')
+      const lines = source.split('\n')
+      lines.forEach((line, idx) => {
+        const m = line.match(relRe)
+        if (m) {
+          violations.push({ file: path.relative(PACKAGE_ROOT, file), line: idx + 1, match: m.join(', ') })
+        }
+      })
+    }
+    if (violations.length > 0) {
+      throw new Error(
+        `Cross-entity ORM relations forbidden in @dainamite/cpq (use FK string columns):\n${violations
+          .map((v) => `  ${v.file}:${v.line} — ${v.match}`)
+          .join('\n')}`,
+      )
+    }
+  })
+
+  it('module index.ts loads without throwing', async () => {
+    const mod = await import('../index')
+    expect(mod.metadata).toBeDefined()
+    expect(mod.metadata.name).toBe('cpq')
+    expect(mod.features).toBeDefined()
+    expect(Array.isArray(mod.features)).toBe(true)
+  })
+})

package/src/modules/cpq/acl.ts

@@ -0,0 +1,26 @@
+export const features = [
+  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },
+  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },
+  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },
+  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },
+  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },
+  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },
+  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },
+  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },
+  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },
+  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },
+  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },
+  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },
+  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },
+  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },
+  // XD-250 ARC (Amend / Renew / Cancel)
+  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },
+  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },
+  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },
+  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },
+  // Expiring-subscriptions feature retired — the dedicated /expiring page
+  // was replaced by an "Expiring within (days)" filter + saved perspective
+  // on the main subscriptions list, which uses `cpq.inventory.view`.
+]
+
+export default features

package/src/modules/cpq/api/_helpers/__tests__/handleArcError.test.ts

@@ -0,0 +1,117 @@
+import { z } from 'zod'
+import { OptimisticLockError } from '@mikro-orm/core'
+import { handleArcError } from '../handleArcError'
+import { QuotingError } from '../../../services/cpqQuotingService'
+
+/**
+ * Unit tests for the shared ARC error handler. Each branch of the matcher
+ * pyramid gets a representative input + asserts on the resulting status code
+ * and body shape.
+ */
+
+async function readBody(res: Response): Promise<Record<string, unknown>> {
+  return (await res.json()) as Record<string, unknown>
+}
+
+describe('handleArcError', () => {
+  it('400 + details on a Zod validation error', async () => {
+    const schema = z.object({ x: z.string() })
+    const parse = schema.safeParse({ x: 1 })
+    expect(parse.success).toBe(false)
+    const err = !parse.success ? parse.error : new Error('unreachable')
+
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(400)
+    const body = await readBody(res)
+    expect(body.error).toBe('Validation error')
+    expect(Array.isArray(body.details)).toBe(true)
+  })
+
+  it('propagates QuotingError status + message + cpqStatus', async () => {
+    const err = new QuotingError(409, 'Type immutable', 'in_approval')
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.error).toBe('Type immutable')
+    expect(body.cpqStatus).toBe('in_approval')
+  })
+
+  it('translates OptimisticLockError to 409 "Concurrent modification detected"', async () => {
+    const err = OptimisticLockError.lockFailedVersionMismatch(
+      { id: 'sub-1' } as never,
+      1,
+      2,
+    )
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.error).toBe('Concurrent modification detected')
+    expect(typeof body.details).toBe('string')
+  })
+
+  it('matches OptimisticLockError via constructor name (Turbopack drift fallback)', async () => {
+    // Synthesize an object whose class is locally-defined but shares the
+    // canonical name. Mirrors what hot-reload produces at runtime.
+    class OptimisticLockError {
+      constructor(public message: string) {}
+    }
+    const err = new OptimisticLockError('synthetic mismatch')
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.error).toBe('Concurrent modification detected')
+  })
+
+  it('propagates inventory-service plain {status, error} throw shape', async () => {
+    const err = { status: 404, error: 'Subscription not found' }
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(404)
+    const body = await readBody(res)
+    expect(body.error).toBe('Subscription not found')
+  })
+
+  it('matches duck-typed QuotingError (Turbopack instanceof drift)', async () => {
+    const err = { name: 'QuotingError', status: 409, message: 'something conflicting' }
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.error).toBe('something conflicting')
+  })
+
+  it('propagates `details` from duck-typed QuotingError into response body', async () => {
+    const err = {
+      name: 'QuotingError',
+      status: 409,
+      message: 'Subscription has another ARC quote in progress',
+      details: { existingQuoteId: 'q-existing-123' },
+    }
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.error).toBe('Subscription has another ARC quote in progress')
+    expect(body.existingQuoteId).toBe('q-existing-123')
+  })
+
+  it('propagates `details` from typed QuotingError into response body', async () => {
+    const err = new QuotingError(409, 'Conflict', undefined)
+    err.details = { existingQuoteId: 'q-existing-typed' }
+    const res = handleArcError(err, 'test')
+    expect(res.status).toBe(409)
+    const body = await readBody(res)
+    expect(body.existingQuoteId).toBe('q-existing-typed')
+  })
+
+  it('falls back to 500 + logs for unexpected errors', async () => {
+    const consoleErr = jest.spyOn(console, 'error').mockImplementation(() => undefined)
+    try {
+      const err = new Error('something internal')
+      const res = handleArcError(err, 'test/ctx')
+      expect(res.status).toBe(500)
+      const body = await readBody(res)
+      expect(body.error).toBe('Internal error')
+      expect(consoleErr).toHaveBeenCalledWith('[test/ctx]', err)
+    } finally {
+      consoleErr.mockRestore()
+    }
+  })
+})

package/src/modules/cpq/api/_helpers/handleArcError.ts

@@ -0,0 +1,81 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { OptimisticLockError } from '@mikro-orm/core'
+import { QuotingError } from '../../services/cpqQuotingService'
+
+/**
+ * Shared error → JSON-response converter for ARC routes (XD-250).
+ *
+ * Handles three families:
+ *   1. Zod validation errors → 400 with `details` array.
+ *   2. Service-layer `QuotingError` (matched both via `instanceof` AND via
+ *      duck-typing on `name === 'QuotingError'`) → propagates `err.status`.
+ *      The duck-typing fallback exists because Turbopack hot-reload can
+ *      produce two distinct class instances for the same source file
+ *      across module boundaries, breaking `instanceof` checks at runtime.
+ *   3. cpqInventoryService throws plain `{ status, error }` objects →
+ *      propagate the embedded status.
+ *   4. Anything else → 500 + console.error with the route context.
+ *
+ * Returning the response keeps route handlers terse:
+ *   `} catch (err) { return handleArcError(err, 'cpq/quotes/from-subscription.POST') }`
+ */
+export function handleArcError(err: unknown, ctx: string): NextResponse {
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: 'Validation error', details: err.issues },
+      { status: 400 },
+    )
+  }
+
+  if (err instanceof QuotingError) {
+    const body: Record<string, unknown> = { error: err.message }
+    if (err.cpqStatus) body.cpqStatus = err.cpqStatus
+    if (err.details) Object.assign(body, err.details)
+    return NextResponse.json(body, { status: err.status })
+  }
+
+  // MikroORM optimistic-lock collision on subscription.version (XD-250 spec
+  // § Risks "Order activation racing with another mutation"). Both
+  // `instanceof OptimisticLockError` AND constructor-name fallback to
+  // survive Turbopack class drift.
+  if (
+    err instanceof OptimisticLockError ||
+    (err &&
+      typeof err === 'object' &&
+      typeof (err as { constructor?: { name?: string } }).constructor?.name === 'string' &&
+      (err as { constructor: { name: string } }).constructor.name === 'OptimisticLockError')
+  ) {
+    return NextResponse.json(
+      { error: 'Concurrent modification detected', details: (err as Error).message },
+      { status: 409 },
+    )
+  }
+
+  // Duck-typed QuotingError (Turbopack instanceof drift) and inventory-service
+  // plain throw shape `{ status, error }`. Both surface a numeric `status`.
+  // Also propagates `details` (object) into response body — preserves the
+  // structured payload (e.g. `existingQuoteId`) that the typed branch above
+  // would have surfaced if instanceof had matched.
+  if (
+    err &&
+    typeof err === 'object' &&
+    'status' in err &&
+    typeof (err as { status: unknown }).status === 'number'
+  ) {
+    const e = err as {
+      status: number
+      message?: string
+      error?: string
+      name?: string
+      details?: Record<string, unknown>
+    }
+    const message = e.message ?? e.error ?? 'Conflict'
+    const body: Record<string, unknown> = { error: message }
+    if (e.details && typeof e.details === 'object') Object.assign(body, e.details)
+    return NextResponse.json(body, { status: e.status })
+  }
+
+  console.error(`[${ctx}]`, err)
+  return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+}

package/src/modules/cpq/api/attribute-options/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../context'
+import { DefaultCpqValidationService } from '../../services/cpqValidationService'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+}
+
+/**
+ * Returns resolved options for an attribute, including dynamic options from
+ * pricing tables (e.g. cloud_region filtered by cloud_provider).
+ * Used by the quoting wizard to render picklists for attributes with
+ * dynamicOptionsSource or dependsOn constraints.
+ */
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const productId = url.searchParams.get('productId')
+    const attributeCode = url.searchParams.get('attributeCode')
+    const configParam = url.searchParams.get('configuration')
+
+    if (!productId || !attributeCode) {
+      return NextResponse.json(
+        { error: 'productId and attributeCode are required' },
+        { status: 400 },
+      )
+    }
+
+    let configuration: Record<string, unknown> = {}
+    if (configParam) {
+      try {
+        configuration = JSON.parse(configParam) as Record<string, unknown>
+      } catch {
+        return NextResponse.json({ error: 'Invalid configuration JSON' }, { status: 400 })
+      }
+    }
+
+    const validationService = new DefaultCpqValidationService(ctx.em)
+    const options = await validationService.getAttributeOptions({
+      productId,
+      attributeCode,
+      currentConfiguration: configuration,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+    })
+
+    return NextResponse.json({ items: options })
+  } catch (err) {
+    console.error('[cpq/attribute-options.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/bundle-slots/route.ts

@@ -0,0 +1,112 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { cpqBundleSlotCreateSchema, cpqBundleSlotUpdateSchema } from '../../data/validators'
+import type { DefaultCpqBundleService } from '../../services/cpqBundleService'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.specifications.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.specifications.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.specifications.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.specifications.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const id = url.searchParams.get('id')
+    if (id) {
+      const slot = await service.getSlot(id, scope)
+      if (!slot) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+      return NextResponse.json(slot)
+    }
+
+    const specId = url.searchParams.get('specId')
+    if (!specId) return NextResponse.json({ error: 'specId is required' }, { status: 400 })
+
+    const slots = await service.getSlots(specId, scope)
+    return NextResponse.json({ items: slots })
+  } catch (err) {
+    console.error('[cpq/bundle-slots.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqBundleSlotCreateSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const slot = await service.createSlot(body, scope)
+    return NextResponse.json(slot, { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err instanceof Error && err.message.startsWith('V-')) {
+      return NextResponse.json({ error: err.message }, { status: 400 })
+    }
+    console.error('[cpq/bundle-slots.POST]', err)
+    return NextResponse.json({ error: err instanceof Error ? err.message : 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqBundleSlotUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const slot = await service.updateSlot(id, updates, scope)
+    if (!slot) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    return NextResponse.json(slot)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err instanceof Error && err.message.startsWith('V-')) {
+      return NextResponse.json({ error: err.message }, { status: 400 })
+    }
+    console.error('[cpq/bundle-slots.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const deleted = await service.deleteSlot(id, scope)
+    if (!deleted) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    if (err instanceof Error && err.message.includes('active offering components')) {
+      return NextResponse.json({ error: err.message }, { status: 400 })
+    }
+    console.error('[cpq/bundle-slots.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/bundle-tree/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../context'
+import type { DefaultCpqBundleService } from '../../services/cpqBundleService'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.offerings.view'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const offeringId = url.searchParams.get('offeringId')
+    if (!offeringId) return NextResponse.json({ error: 'offeringId is required' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const tree = await service.resolveBundleTree(offeringId, scope)
+    if (!tree) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    const validation = await service.validateBundleCompleteness(offeringId, scope)
+
+    return NextResponse.json({ tree, validation })
+  } catch (err) {
+    console.error('[cpq/bundle-tree.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}