@dainamite/cpq 0.2.2

package/src/modules/cpq/api/context.ts

@@ -0,0 +1,39 @@
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import type { OrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+export type CpqRouteContext = {
+  container: AwilixContainer
+  auth: Awaited<ReturnType<typeof getAuthFromRequest>>
+  em: EntityManager
+  organizationId: string
+  tenantId: string
+  organizationScope: OrganizationScope | null
+  translate: (key: string, fallback?: string) => string
+}
+
+export async function resolveCpqRouteContext(req: Request): Promise<CpqRouteContext> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth || !auth.tenantId) {
+    throw new Error('Unauthorized')
+  }
+  const { organizationId: resolvedOrgId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
+  const organizationId = resolvedOrgId ?? ''
+  const tenantId = scope?.tenantId ?? auth.tenantId ?? ''
+  const em = container.resolve('em') as EntityManager
+  return {
+    container,
+    auth,
+    em,
+    organizationId,
+    tenantId,
+    organizationScope: scope ?? null,
+    translate,
+  }
+}

package/src/modules/cpq/api/inventory/assets/route.ts

@@ -0,0 +1,123 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../context'
+import {
+  cpqInventoryAssetCreateSchema,
+  cpqInventoryAssetUpdateSchema,
+} from '../../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const id = url.searchParams.get('id')
+    if (id) {
+      const result = await service.getAsset(id, scope)
+      return NextResponse.json(result)
+    }
+
+    const filters: Record<string, unknown> = {}
+    const customerId = url.searchParams.get('customerId')
+    if (customerId) filters.customerId = customerId
+    const status = url.searchParams.get('status')
+    if (status) filters.status = status
+    const assetType = url.searchParams.get('assetType')
+    if (assetType) filters.assetType = assetType
+    const productId = url.searchParams.get('productId')
+    if (productId) filters.productId = productId
+    const subscriptionId = url.searchParams.get('subscriptionId')
+    if (subscriptionId) filters.subscriptionId = subscriptionId
+    const subscriptionItemId = url.searchParams.get('subscriptionItemId')
+    if (subscriptionItemId) filters.subscriptionItemId = subscriptionItemId
+    const search = url.searchParams.get('search')
+    if (search) filters.search = search
+
+    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'code', 'name', 'status', 'assetType', 'purchasePrice'] as const
+    const sortFieldParam = url.searchParams.get('sortField') ?? ''
+    if ((ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)) {
+      filters.sortField = sortFieldParam
+    }
+    filters.sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'
+
+    filters.page = Math.max(1, Number(url.searchParams.get('page') ?? '1'))
+    filters.pageSize = Math.min(100, Math.max(1, Number(url.searchParams.get('pageSize') ?? '50')))
+
+    const result = await service.listAssets(filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[cpq/inventory/assets.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventoryAssetCreateSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.createAsset(body, scope)
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/assets.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventoryAssetUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.updateAsset(id, updates, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/assets.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    await service.deleteAsset(id, scope)
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/inventory/assets.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/assets/status/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqInventoryStatusTransitionSchema } from '../../../../data/validators'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventoryStatusTransitionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.transitionAssetStatus(body.id, body.targetStatus, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err && typeof err === 'object' && 'status' in err && (err as any).status === 409) {
+      return NextResponse.json(
+        { error: (err as any).error ?? 'Conflict' },
+        { status: 409 },
+      )
+    }
+    console.error('[cpq/inventory/assets/status.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/customer/[customerId]/parent-items/route.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../../context'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.view'] },
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ customerId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { customerId } = await params
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const filters: Record<string, unknown> = {}
+    const productId = url.searchParams.get('productId')
+    if (productId) filters.productId = productId
+    const offeringId = url.searchParams.get('offeringId')
+    if (offeringId) filters.offeringId = offeringId
+
+    const result = await service.getCustomerParentItems(customerId, filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[cpq/inventory/customer/parent-items.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/customer/[customerId]/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../context'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.view'] },
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ customerId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { customerId } = await params
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const filters: Record<string, unknown> = {}
+    const status = url.searchParams.get('status')
+    if (status) filters.status = status
+    const productId = url.searchParams.get('productId')
+    if (productId) filters.productId = productId
+    filters.includeTerminated = url.searchParams.get('includeTerminated') === 'true'
+
+    const result = await service.getCustomerInventory(customerId, filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[cpq/inventory/customer.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/subscription-items/route.ts

@@ -0,0 +1,107 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../context'
+import {
+  cpqInventorySubscriptionItemCreateSchema,
+  cpqInventorySubscriptionItemUpdateSchema,
+} from '../../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const subscriptionId = url.searchParams.get('subscriptionId')
+    const parentItemId = url.searchParams.get('parentItemId')
+    if (!subscriptionId && !parentItemId) {
+      return NextResponse.json(
+        { error: 'At least one of subscriptionId or parentItemId is required' },
+        { status: 400 },
+      )
+    }
+
+    const filters: Record<string, unknown> = {}
+    if (subscriptionId) filters.subscriptionId = subscriptionId
+    if (parentItemId) filters.parentItemId = parentItemId
+    const status = url.searchParams.get('status')
+    if (status) filters.status = status
+
+    const result = await service.listSubscriptionItems(filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[cpq/inventory/subscription-items.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventorySubscriptionItemCreateSchema.parse(await req.json())
+    const { subscriptionId, ...input } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.addSubscriptionItem(subscriptionId, input, scope)
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/subscription-items.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventorySubscriptionItemUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.updateSubscriptionItem(id, updates, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/subscription-items.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    await service.deleteSubscriptionItem(id, scope)
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/inventory/subscription-items.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/subscriptions/[subscriptionId]/change-log/route.ts

@@ -0,0 +1,64 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../../context'
+import { cpqChangeLogQuerySchema } from '../../../../../data/validators'
+import type { DefaultCpqInventoryService } from '../../../../../services/cpqInventoryService'
+import { handleArcError } from '../../../../_helpers/handleArcError'
+
+/**
+ * GET /api/cpq/inventory/subscriptions/[subscriptionId]/change-log
+ *
+ * Paginated CpqSubscriptionChangeLog timeline for a subscription
+ * (most recent first).
+ */
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.arc.changelog.view'] },
+}
+
+export async function GET(
+  req: Request,
+  { params }: { params: Promise<{ subscriptionId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const { subscriptionId } = await params
+    const url = new URL(req.url)
+    const query = cpqChangeLogQuerySchema.parse({
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+    })
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as DefaultCpqInventoryService
+    const result = await service.listChangeLog(
+      subscriptionId,
+      { page: query.page, pageSize: query.pageSize },
+      scope,
+    )
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleArcError(err, 'cpq/inventory/subscriptions/[subscriptionId]/change-log.GET')
+  }
+}
+
+export const openApi = {
+  '/api/cpq/inventory/subscriptions/{subscriptionId}/change-log': {
+    parameters: [
+      {
+        name: 'subscriptionId',
+        in: 'path',
+        required: true,
+        schema: { type: 'string', format: 'uuid' },
+      },
+      { name: 'page', in: 'query', schema: { type: 'integer', minimum: 1, default: 1 } },
+      { name: 'pageSize', in: 'query', schema: { type: 'integer', minimum: 1, maximum: 100 } },
+    ],
+    get: {
+      tags: ['CPQ ARC'],
+      summary: 'List ARC change-log entries for a subscription',
+      responses: {
+        '200': { description: 'Paginated change log' },
+        '401': { description: 'Unauthorized' },
+      },
+    },
+  },
+}

package/src/modules/cpq/api/inventory/subscriptions/expiring/route.ts

@@ -0,0 +1,66 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqExpiringSubscriptionsQuerySchema } from '../../../../data/validators'
+import type { DefaultCpqInventoryService } from '../../../../services/cpqInventoryService'
+import { handleArcError } from '../../../_helpers/handleArcError'
+
+/**
+ * GET /api/cpq/inventory/subscriptions/expiring
+ *
+ * List active subscriptions whose currentTermEnd falls within the next
+ * `withinDays` days. Drives the operator's renewal triage view.
+ */
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.expiring.view'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const url = new URL(req.url)
+    const query = cpqExpiringSubscriptionsQuerySchema.parse({
+      withinDays: url.searchParams.get('withinDays') ?? undefined,
+      customerId: url.searchParams.get('customerId') ?? undefined,
+      billingCycle: url.searchParams.get('billingCycle') ?? undefined,
+      status: url.searchParams.get('status') ?? undefined,
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+    })
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as DefaultCpqInventoryService
+    const result = await service.findExpiringSubscriptions(query, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleArcError(err, 'cpq/inventory/subscriptions/expiring.GET')
+  }
+}
+
+export const openApi = {
+  '/api/cpq/inventory/subscriptions/expiring': {
+    parameters: [
+      {
+        name: 'withinDays',
+        in: 'query',
+        schema: { type: 'integer', minimum: 1, maximum: 365, default: 30 },
+      },
+      { name: 'customerId', in: 'query', schema: { type: 'string', format: 'uuid' } },
+      {
+        name: 'billingCycle',
+        in: 'query',
+        schema: { type: 'string', enum: ['monthly', 'quarterly', 'annually'] },
+      },
+      { name: 'status', in: 'query', schema: { type: 'string', default: 'active' } },
+      { name: 'page', in: 'query', schema: { type: 'integer', minimum: 1, default: 1 } },
+      { name: 'pageSize', in: 'query', schema: { type: 'integer', minimum: 1, maximum: 100 } },
+    ],
+    get: {
+      tags: ['CPQ ARC'],
+      summary: 'List subscriptions expiring within N days',
+      responses: {
+        '200': { description: 'Paginated subscriptions' },
+        '401': { description: 'Unauthorized' },
+      },
+    },
+  },
+}

package/src/modules/cpq/api/inventory/subscriptions/route.ts

@@ -0,0 +1,126 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../context'
+import {
+  cpqInventorySubscriptionCreateSchema,
+  cpqInventorySubscriptionUpdateSchema,
+} from '../../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.inventory.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const id = url.searchParams.get('id')
+    if (id) {
+      const result = await service.getSubscription(id, scope)
+      return NextResponse.json(result)
+    }
+
+    const filters: Record<string, unknown> = {}
+    const customerId = url.searchParams.get('customerId')
+    if (customerId) filters.customerId = customerId
+    const status = url.searchParams.get('status')
+    if (status) filters.status = status.split(',')
+    const productId = url.searchParams.get('productId')
+    if (productId) filters.productId = productId
+    const sourceOrderId = url.searchParams.get('sourceOrderId')
+    if (sourceOrderId) filters.sourceOrderId = sourceOrderId
+    const billingCycle = url.searchParams.get('billingCycle')
+    if (billingCycle) filters.billingCycle = billingCycle
+    const search = url.searchParams.get('search')
+    if (search) filters.search = search
+    const expiringWithinDays = url.searchParams.get('expiringWithinDays')
+    if (expiringWithinDays) {
+      const n = Number(expiringWithinDays)
+      if (Number.isFinite(n) && n > 0) filters.expiringWithinDays = Math.min(365, n)
+    }
+
+    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'code', 'name', 'status', 'startDate', 'currentTermEnd'] as const
+    const sortFieldParam = url.searchParams.get('sortField') ?? ''
+    if ((ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)) {
+      filters.sortField = sortFieldParam
+    }
+    filters.sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'
+
+    filters.page = Math.max(1, Number(url.searchParams.get('page') ?? '1'))
+    filters.pageSize = Math.min(100, Math.max(1, Number(url.searchParams.get('pageSize') ?? '50')))
+
+    const result = await service.listSubscriptions(filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[cpq/inventory/subscriptions.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventorySubscriptionCreateSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.createSubscription(body, scope)
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/subscriptions.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventorySubscriptionUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.updateSubscription(id, updates, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/inventory/subscriptions.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    await service.deleteSubscription(id, scope)
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/inventory/subscriptions.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/inventory/subscriptions/status/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqInventoryStatusTransitionSchema } from '../../../../data/validators'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.inventory.manage'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqInventoryStatusTransitionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqInventoryService') as any
+
+    const result = await service.transitionSubscriptionStatus(body.id, body.targetStatus, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err && typeof err === 'object' && 'status' in err && (err as any).status === 409) {
+      return NextResponse.json(
+        { error: (err as any).error ?? 'Conflict' },
+        { status: 409 },
+      )
+    }
+    console.error('[cpq/inventory/subscriptions/status.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}