@dainamite/cpq 0.2.2

package/src/modules/cpq/api/offering-components/route.ts

@@ -0,0 +1,103 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { cpqOfferingComponentCreateSchema, cpqOfferingComponentUpdateSchema } from '../../data/validators'
+import type { DefaultCpqBundleService } from '../../services/cpqBundleService'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.offerings.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.offerings.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.offerings.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.offerings.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const offeringId = url.searchParams.get('offeringId')
+    if (!offeringId) return NextResponse.json({ error: 'offeringId is required' }, { status: 400 })
+
+    const components = await service.getComponents(offeringId, scope)
+
+    const slotId = url.searchParams.get('slotId')
+    const filtered = slotId ? components.filter((c) => c.slotId === slotId) : components
+
+    return NextResponse.json({ items: filtered })
+  } catch (err) {
+    console.error('[cpq/offering-components.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqOfferingComponentCreateSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const component = await service.addComponent(body, scope)
+    return NextResponse.json(component, { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err instanceof Error && err.message.startsWith('V-')) {
+      return NextResponse.json({ error: err.message }, { status: 400 })
+    }
+    console.error('[cpq/offering-components.POST]', err)
+    return NextResponse.json({ error: err instanceof Error ? err.message : 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqOfferingComponentUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const component = await service.updateComponent(id, updates, scope)
+    if (!component) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    return NextResponse.json(component)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/offering-components.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = ctx.container.resolve('cpqBundleService') as DefaultCpqBundleService
+
+    const deleted = await service.removeComponent(id, scope)
+    if (!deleted) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/offering-components.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/orders/[orderId]/activate/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server'
+import { OptimisticLockError } from '@mikro-orm/core'
+import { resolveCpqRouteContext } from '../../../context'
+import { OrderError } from '../../../../services/cpqOrderService'
+import type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { orderId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService
+    const result = await service.activateOrder(orderId, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof OrderError) {
+      return NextResponse.json({ error: err.message }, { status: err.status })
+    }
+    // XD-250 ARC: optimistic-lock collision on subscription.version when two
+    // ARC orders touching the same sub race to activate. Spec § Risks:
+    // "second activation gets 409, order stays in pending_activation,
+    // retryable". Constructor-name fallback survives Turbopack class drift.
+    if (
+      err instanceof OptimisticLockError ||
+      (err &&
+        typeof err === 'object' &&
+        (err as { constructor?: { name?: string } }).constructor?.name === 'OptimisticLockError')
+    ) {
+      return NextResponse.json(
+        { error: 'Concurrent modification detected', details: (err as Error).message },
+        { status: 409 },
+      )
+    }
+    const errObj = err as Record<string, unknown>
+    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {
+      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })
+    }
+    console.error('[cpq/orders/[orderId]/activate.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/orders/[orderId]/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../context'
+import { OrderError } from '../../../services/cpqOrderService'
+import type { DefaultCpqOrderService } from '../../../services/cpqOrderService'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ orderId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { orderId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService
+    const result = await service.getOrder(orderId, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof OrderError) {
+      return NextResponse.json({ error: err.message }, { status: err.status })
+    }
+    console.error('[cpq/orders/[orderId].GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/orders/[orderId]/status/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqOrderStatusTransitionSchema } from '../../../../data/validators'
+import { OrderError } from '../../../../services/cpqOrderService'
+import type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { orderId } = await params
+    const body = cpqOrderStatusTransitionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService
+    const result = await service.transitionOrderStatus(orderId, body.targetStatus, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    if (err instanceof OrderError) {
+      return NextResponse.json({ error: err.message }, { status: err.status })
+    }
+    const errObj = err as Record<string, unknown>
+    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {
+      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })
+    }
+    console.error('[cpq/orders/[orderId]/status.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/orders/route.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { cpqConvertQuoteToOrderSchema } from '../../data/validators'
+import { OrderError } from '../../services/cpqOrderService'
+import type { DefaultCpqOrderService } from '../../services/cpqOrderService'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },
+  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqConvertQuoteToOrderSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService
+    const result = await service.convertQuoteToOrder(body.quoteId, scope)
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    return handleError(err, 'cpq/orders.POST')
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const url = new URL(req.url)
+    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode'] as const
+    const sortFieldParam = url.searchParams.get('sortField') ?? ''
+    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)
+      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])
+      : undefined
+    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'
+
+    const filters = {
+      customerId: url.searchParams.get('customerId') ?? undefined,
+      sourceQuoteId: url.searchParams.get('sourceQuoteId') ?? undefined,
+      salesOrderId: url.searchParams.get('salesOrderId') ?? undefined,
+      cpqStatus: url.searchParams.get('cpqStatus') ?? undefined,
+      currencyCode: url.searchParams.get('currencyCode') ?? undefined,
+      search: url.searchParams.get('search') ?? undefined,
+      sortField,
+      sortDir,
+      page: url.searchParams.has('page') ? Number(url.searchParams.get('page')) : undefined,
+      pageSize: url.searchParams.has('pageSize') ? Number(url.searchParams.get('pageSize')) : undefined,
+    } as const
+
+    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService
+    const result = await service.listOrders(filters, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleError(err, 'cpq/orders.GET')
+  }
+}
+
+function handleError(err: unknown, context: string) {
+  if (err instanceof z.ZodError) {
+    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+  }
+  if (err instanceof OrderError) {
+    return NextResponse.json({ error: err.message }, { status: err.status })
+  }
+  const errObj = err as Record<string, unknown>
+  if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {
+    return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })
+  }
+  console.error(`[${context}]`, err)
+  return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+}

package/src/modules/cpq/api/price-rules/route.ts

@@ -0,0 +1,210 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { CpqPriceRule, CpqProductOffering } from '../../data/entities'
+import { cpqPriceRuleCreateSchema, cpqPriceRuleUpdateSchema } from '../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.pricing.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+}
+
+function serializeRule(rule: CpqPriceRule) {
+  return {
+    id: rule.id,
+    code: rule.code,
+    name: rule.name,
+    description: rule.description ?? null,
+    productOfferingId: rule.productOfferingId ?? null,
+    ruleType: rule.ruleType,
+    value: Number(rule.value),
+    chargeCodeFilter: rule.chargeCodeFilter ?? null,
+    chargeTypeFilter: rule.chargeTypeFilter ?? null,
+    applicabilityCondition: rule.applicabilityCondition ?? null,
+    sortOrder: rule.sortOrder,
+    isActive: rule.isActive,
+    createdAt: rule.createdAt,
+    updatedAt: rule.updatedAt,
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+
+    const id = url.searchParams.get('id')
+    if (id) {
+      const item = await ctx.em.findOne(CpqPriceRule, { id, ...scope })
+      if (!item) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+      return NextResponse.json(serializeRule(item))
+    }
+
+    const page = Math.max(1, Number(url.searchParams.get('page') ?? '1'))
+    const pageSize = Math.min(100, Math.max(1, Number(url.searchParams.get('pageSize') ?? '50')))
+
+    const filters: Record<string, unknown> = { ...scope }
+
+    const productOfferingId = url.searchParams.get('productOfferingId')
+    if (productOfferingId) {
+      filters.productOfferingId = productOfferingId
+    }
+
+    const globalOnly = url.searchParams.get('globalOnly')
+    if (globalOnly === 'true' && !productOfferingId) {
+      filters.productOfferingId = null
+    }
+
+    const ruleType = url.searchParams.get('ruleType')
+    if (ruleType) filters.ruleType = ruleType
+
+    const chargeTypeFilter = url.searchParams.get('chargeTypeFilter')
+    if (chargeTypeFilter) filters.chargeTypeFilter = chargeTypeFilter
+
+    const isActiveParam = url.searchParams.get('isActive')
+    if (isActiveParam === 'true') filters.isActive = true
+    else if (isActiveParam === 'false') filters.isActive = false
+
+    // Free-text search across code, name, description (case-insensitive)
+    const search = url.searchParams.get('search')?.trim()
+    if (search) {
+      filters.$or = [
+        { code: { $ilike: `%${search}%` } },
+        { name: { $ilike: `%${search}%` } },
+        { description: { $ilike: `%${search}%` } },
+      ]
+    }
+
+    // Configurable sort
+    const ALLOWED_SORT_FIELDS = ['sortOrder', 'createdAt', 'updatedAt', 'code', 'name', 'ruleType'] as const
+    const sortFieldParam = url.searchParams.get('sortField') ?? ''
+    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)
+      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])
+      : 'sortOrder'
+    const sortDir = url.searchParams.get('sortDir') === 'desc' ? 'desc' : 'asc'
+
+    const [items, total] = await ctx.em.findAndCount(CpqPriceRule, filters, {
+      limit: pageSize,
+      offset: (page - 1) * pageSize,
+      orderBy: { [sortField]: sortDir },
+    })
+
+    // Batch-load offering names for the visible rules (single query — avoids N+1)
+    const offeringIds = Array.from(
+      new Set(items.map((r) => r.productOfferingId).filter((id): id is string => !!id)),
+    )
+    const offeringNameById = new Map<string, string>()
+    if (offeringIds.length > 0) {
+      const offerings = await ctx.em.find(
+        CpqProductOffering,
+        { id: { $in: offeringIds }, ...scope },
+      )
+      for (const o of offerings) offeringNameById.set(o.id, o.name)
+    }
+
+    return NextResponse.json({
+      items: items.map((rule) => ({
+        ...serializeRule(rule),
+        productOfferingName: rule.productOfferingId
+          ? offeringNameById.get(rule.productOfferingId) ?? null
+          : null,
+      })),
+      total,
+      page,
+      pageSize,
+      totalPages: Math.ceil(total / pageSize),
+    })
+  } catch (err) {
+    console.error('[cpq/price-rules.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqPriceRuleCreateSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const entity = ctx.em.create(CpqPriceRule, {
+      ...scope,
+      code: body.code,
+      name: body.name,
+      description: body.description ?? undefined,
+      productOfferingId: body.productOfferingId ?? undefined,
+      ruleType: body.ruleType,
+      value: String(body.value),
+      chargeCodeFilter: body.chargeCodeFilter ?? undefined,
+      chargeTypeFilter: body.chargeTypeFilter ?? undefined,
+      applicabilityCondition: body.applicabilityCondition ?? undefined,
+      sortOrder: body.sortOrder,
+      isActive: body.isActive,
+    })
+    await ctx.em.flush()
+
+    return NextResponse.json(serializeRule(entity), { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/price-rules.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqPriceRuleUpdateSchema.parse(await req.json())
+    const { id, ...updates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+
+    const entity = await ctx.em.findOne(CpqPriceRule, { id, ...scope })
+    if (!entity) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    const { value: rawValue, ...rest } = updates
+    const assignData: Record<string, unknown> = { ...rest }
+    if (rawValue !== undefined) assignData.value = String(rawValue)
+    ctx.em.assign(entity, assignData)
+    await ctx.em.flush()
+
+    return NextResponse.json(serializeRule(entity))
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/price-rules.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+    const entity = await ctx.em.findOne(CpqPriceRule, { id, ...scope })
+    if (!entity) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    entity.deletedAt = new Date()
+    await ctx.em.flush()
+
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/price-rules.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/pricing-table-entries/route.ts

@@ -0,0 +1,159 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { CpqPricingTableEntry } from '../../data/entities'
+import { cpqPricingTableEntryCreateSchema, cpqPricingTableEntryUpdateSchema } from '../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.pricing.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.pricing.manage'] },
+}
+
+function serializeEntry(e: CpqPricingTableEntry) {
+  return {
+    id: e.id,
+    pricingTableId: e.pricingTableId,
+    dimensionValues: e.dimensionValues,
+    tierNumber: e.tierNumber,
+    rangeFrom: e.rangeFrom,
+    rangeTo: e.rangeTo,
+    currencyCode: e.currencyCode,
+    prices: e.prices,
+    isActive: e.isActive,
+    createdAt: e.createdAt,
+    updatedAt: e.updatedAt,
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const pricingTableId = url.searchParams.get('pricingTableId')
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+    if (!pricingTableId || !uuidRegex.test(pricingTableId)) {
+      return NextResponse.json({ error: 'pricingTableId is required and must be a valid UUID' }, { status: 400 })
+    }
+
+    const page = Math.max(1, Number(url.searchParams.get('page') ?? '1'))
+    const pageSize = Math.min(100, Math.max(1, Number(url.searchParams.get('pageSize') ?? '50')))
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+
+    const filters: Record<string, unknown> = { ...scope, pricingTableId }
+
+    const [items, total] = await ctx.em.findAndCount(CpqPricingTableEntry, filters, {
+      limit: pageSize,
+      offset: (page - 1) * pageSize,
+      orderBy: { createdAt: 'desc' },
+    })
+
+    return NextResponse.json({
+      items: items.map(serializeEntry),
+      total,
+      page,
+      pageSize,
+      totalPages: Math.ceil(total / pageSize),
+    })
+  } catch (err) {
+    console.error('[cpq/pricing-table-entries.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const rawBody = await req.json()
+
+    const mapEntry = (parsed: ReturnType<typeof cpqPricingTableEntryCreateSchema.parse>) => ({
+      ...scope,
+      pricingTableId: parsed.pricingTableId,
+      dimensionValues: parsed.dimensionValues as Record<string, string>,
+      tierNumber: parsed.tierNumber ?? null,
+      rangeFrom: parsed.rangeFrom != null ? String(parsed.rangeFrom) : null,
+      rangeTo: parsed.rangeTo != null ? String(parsed.rangeTo) : null,
+      currencyCode: parsed.currencyCode,
+      prices: parsed.prices as Record<string, number>,
+      isActive: parsed.isActive,
+    })
+
+    if (Array.isArray(rawBody)) {
+      const entries = rawBody.map((item) => {
+        const parsed = cpqPricingTableEntryCreateSchema.parse(item)
+        return ctx.em.create(CpqPricingTableEntry, mapEntry(parsed) as any)
+      })
+      await ctx.em.flush()
+
+      return NextResponse.json({ items: entries.map(serializeEntry) }, { status: 201 })
+    }
+
+    const body = cpqPricingTableEntryCreateSchema.parse(rawBody)
+    const entity = ctx.em.create(CpqPricingTableEntry, mapEntry(body) as any)
+    await ctx.em.flush()
+
+    return NextResponse.json(serializeEntry(entity), { status: 201 })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/pricing-table-entries.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqPricingTableEntryUpdateSchema.parse(await req.json())
+    const { id, ...rawUpdates } = body
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+
+    const entity = await ctx.em.findOne(CpqPricingTableEntry, { id, ...scope })
+    if (!entity) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    const updates: Record<string, unknown> = { ...rawUpdates }
+    if (rawUpdates.rangeFrom !== undefined) updates.rangeFrom = rawUpdates.rangeFrom != null ? String(rawUpdates.rangeFrom) : null
+    if (rawUpdates.rangeTo !== undefined) updates.rangeTo = rawUpdates.rangeTo != null ? String(rawUpdates.rangeTo) : null
+    ctx.em.assign(entity, updates as any)
+    await ctx.em.flush()
+
+    return NextResponse.json(serializeEntry(entity))
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/pricing-table-entries.PUT]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { id } = (await req.json()) as { id?: string }
+    if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+    const entity = await ctx.em.findOne(CpqPricingTableEntry, { id, ...scope })
+    if (!entity) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    entity.deletedAt = new Date()
+    await ctx.em.flush()
+
+    return NextResponse.json({ success: true })
+  } catch (err) {
+    console.error('[cpq/pricing-table-entries.DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}