@dainamite/cpq 0.2.2

package/src/modules/cpq/api/quotes/[quoteId]/route.ts

@@ -0,0 +1,109 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../context'
+import { cpqUpdateQuoteSchema } from '../../../data/validators'
+import { QuotingError } from '../../../services/cpqQuotingService'
+import { resolveQuotingService } from '../../resolveQuotingService'
+import { CpqQuoteConfiguration, CpqQuoteLineConfiguration } from '../../../data/entities'
+import { SalesQuote, SalesQuoteLine } from '@open-mercato/core/modules/sales/data/entities'
+import { handleArcError } from '../../_helpers/handleArcError'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+  PATCH: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { quoteId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = resolveQuotingService(ctx)
+    const result = await service.getQuote(quoteId, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    if (err instanceof QuotingError) {
+      return NextResponse.json({ error: err.message }, { status: err.status })
+    }
+    console.error('[cpq/quotes/[quoteId].GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}
+
+export async function PATCH(
+  req: Request,
+  { params }: { params: Promise<{ quoteId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { quoteId } = await params
+    const body = cpqUpdateQuoteSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    if (body.quoteType !== undefined) {
+      // ARC quote-type one-way transition (XD-250 DD-ARC-9). The service
+      // enforces 'new' → 'amend'/'renew'/'cancel' only; subsequent changes
+      // return 409.
+      const service = resolveQuotingService(ctx)
+      const result = await service.setQuoteType(quoteId, body.quoteType, scope)
+      return NextResponse.json(result)
+    }
+
+    return NextResponse.json({ error: 'Nothing to update' }, { status: 400 })
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId].PATCH')
+  }
+}
+
+export async function DELETE(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { quoteId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const em = ctx.em
+    const now = new Date()
+
+    let cpqConfig = await em.findOne(CpqQuoteConfiguration, {
+      id: quoteId, organizationId: scope.organizationId, tenantId: scope.tenantId, deletedAt: null,
+    })
+    if (!cpqConfig) {
+      cpqConfig = await em.findOne(CpqQuoteConfiguration, {
+        quoteId, organizationId: scope.organizationId, tenantId: scope.tenantId, deletedAt: null,
+      })
+    }
+    if (!cpqConfig) return NextResponse.json({ error: 'Quote not found' }, { status: 404 })
+
+    const terminalStatuses = ['accepted', 'rejected', 'cancelled']
+    if (terminalStatuses.includes(cpqConfig.cpqStatus)) {
+      return NextResponse.json({ error: `Cannot delete a quote in '${cpqConfig.cpqStatus}' status` }, { status: 409 })
+    }
+
+    const lineConfigs = await em.find(CpqQuoteLineConfiguration, {
+      quoteConfigurationId: cpqConfig.id, organizationId: scope.organizationId, tenantId: scope.tenantId, deletedAt: null,
+    })
+    for (const lc of lineConfigs) {
+      lc.deletedAt = now
+      const salesLine = await em.findOne(SalesQuoteLine, { id: lc.quoteLineId })
+      if (salesLine) salesLine.deletedAt = now
+    }
+
+    cpqConfig.deletedAt = now
+
+    const salesQuote = await em.findOne(SalesQuote, { id: cpqConfig.quoteId })
+    if (salesQuote) salesQuote.deletedAt = now
+
+    await em.flush()
+
+    return NextResponse.json({ ok: true })
+  } catch (err) {
+    console.error('[cpq/quotes/[quoteId].DELETE]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/quotes/[quoteId]/status/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqTransitionStatusSchema } from '../../../../data/validators'
+import { resolveQuotingService } from '../../../resolveQuotingService'
+import { handleArcError } from '../../../_helpers/handleArcError'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const { quoteId } = await params
+    const body = cpqTransitionStatusSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = resolveQuotingService(ctx)
+    const result = await service.transitionStatus(quoteId, body.targetStatus, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId]/status.POST')
+  }
+}

package/src/modules/cpq/api/quotes/[quoteId]/target-subscriptions/[targetId]/route.ts

@@ -0,0 +1,91 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../../context'
+import { cpqUpdateTargetSubscriptionSchema } from '../../../../../data/validators'
+import { resolveQuotingService } from '../../../../resolveQuotingService'
+import { handleArcError } from '../../../../_helpers/handleArcError'
+
+/**
+ * Manage a single attached ARC target.
+ *
+ *   PATCH  /api/cpq/quotes/[quoteId]/target-subscriptions/[targetId]
+ *     → update mergeAction or term fields (renew only).
+ *
+ *   DELETE /api/cpq/quotes/[quoteId]/target-subscriptions/[targetId]
+ *     → detach the target. Drops associated quote lines.
+ */
+export const metadata = {
+  PATCH: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+}
+
+export async function PATCH(
+  req: Request,
+  { params }: { params: Promise<{ quoteId: string; targetId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const { quoteId, targetId } = await params
+    const body = cpqUpdateTargetSubscriptionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = resolveQuotingService(ctx)
+    const result = await service.updateTargetSubscription(
+      quoteId,
+      targetId,
+      {
+        mergeAction: body.mergeAction,
+        newTermStart: body.newTermStart ?? null,
+        newTermEnd: body.newTermEnd ?? null,
+        newTermMonths: body.newTermMonths ?? null,
+      },
+      scope,
+    )
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId]/target-subscriptions/[targetId].PATCH')
+  }
+}
+
+export async function DELETE(
+  req: Request,
+  { params }: { params: Promise<{ quoteId: string; targetId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const { quoteId, targetId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = resolveQuotingService(ctx)
+    const result = await service.detachTargetSubscription(quoteId, targetId, scope)
+    return NextResponse.json(result)
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId]/target-subscriptions/[targetId].DELETE')
+  }
+}
+
+export const openApi = {
+  '/api/cpq/quotes/{quoteId}/target-subscriptions/{targetId}': {
+    parameters: [
+      { name: 'quoteId', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } },
+      { name: 'targetId', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } },
+    ],
+    patch: {
+      tags: ['CPQ ARC'],
+      summary: 'Update an ARC target (mergeAction / term fields)',
+      responses: {
+        '200': { description: 'Updated' },
+        '404': { description: 'Target not found' },
+        '409': { description: 'Quote no longer editable' },
+      },
+    },
+    delete: {
+      tags: ['CPQ ARC'],
+      summary: 'Detach an ARC target',
+      responses: {
+        '200': { description: 'Detached' },
+        '404': { description: 'Target not found' },
+        '409': { description: 'Quote no longer editable' },
+      },
+    },
+  },
+}

package/src/modules/cpq/api/quotes/[quoteId]/target-subscriptions/route.ts

@@ -0,0 +1,107 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../../context'
+import { cpqAttachTargetSubscriptionSchema } from '../../../../data/validators'
+import { resolveQuotingService } from '../../../resolveQuotingService'
+import { handleArcError } from '../../../_helpers/handleArcError'
+
+/**
+ * Manage ARC target subscriptions on a quote.
+ *
+ *   GET  /api/cpq/quotes/[quoteId]/target-subscriptions
+ *     → list attached targets with per-target context (current items, term).
+ *
+ *   POST /api/cpq/quotes/[quoteId]/target-subscriptions
+ *     → attach a subscription to the quote (multi-target / merge case).
+ */
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+}
+
+export async function GET(
+  req: Request,
+  { params }: { params: Promise<{ quoteId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const { quoteId } = await params
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = resolveQuotingService(ctx)
+    const items = await service.listTargetSubscriptions(quoteId, scope)
+    return NextResponse.json({ items })
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId]/target-subscriptions.GET')
+  }
+}
+
+export async function POST(
+  req: Request,
+  { params }: { params: Promise<{ quoteId: string }> },
+) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    const { quoteId } = await params
+    const body = cpqAttachTargetSubscriptionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const service = resolveQuotingService(ctx)
+    const result = await service.attachTargetSubscription(
+      quoteId,
+      {
+        subscriptionId: body.subscriptionId,
+        quoteType: body.quoteType,
+        mergeAction: body.mergeAction,
+        newTermStart: body.newTermStart ?? null,
+        newTermEnd: body.newTermEnd ?? null,
+        newTermMonths: body.newTermMonths ?? null,
+      },
+      scope,
+    )
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/[quoteId]/target-subscriptions.POST')
+  }
+}
+
+export const openApi = {
+  '/api/cpq/quotes/{quoteId}/target-subscriptions': {
+    parameters: [
+      { name: 'quoteId', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } },
+    ],
+    get: {
+      tags: ['CPQ ARC'],
+      summary: 'List target subscriptions attached to an ARC quote',
+      responses: { '200': { description: 'Targets' }, '401': { description: 'Unauthorized' } },
+    },
+    post: {
+      tags: ['CPQ ARC'],
+      summary: 'Attach a subscription as an ARC target',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            schema: {
+              type: 'object',
+              required: ['subscriptionId', 'quoteType'],
+              properties: {
+                subscriptionId: { type: 'string', format: 'uuid' },
+                quoteType: { type: 'string', enum: ['amend', 'renew', 'cancel'] },
+                mergeAction: { type: 'string', enum: ['standalone', 'absorb'] },
+                newTermStart: { type: 'string' },
+                newTermEnd: { type: 'string' },
+                newTermMonths: { type: 'integer', minimum: 1 },
+              },
+            },
+          },
+        },
+      },
+      responses: {
+        '201': { description: 'Target attached' },
+        '400': { description: 'Validation error / mismatch' },
+        '404': { description: 'Subscription not found' },
+        '409': { description: 'Subscription not eligible / concurrent ARC quote' },
+      },
+    },
+  },
+}

package/src/modules/cpq/api/quotes/attributes/route.ts

@@ -0,0 +1,61 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../context'
+import { DefaultCpqProductService } from '../../../services/cpqProductService'
+import { CpqProductOffering } from '../../../data/entities'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const offeringId = url.searchParams.get('offeringId')
+    const productId = url.searchParams.get('productId')
+    const configParam = url.searchParams.get('configuration')
+
+    if (!offeringId && !productId) {
+      return NextResponse.json({ error: 'Either offeringId or productId is required' }, { status: 400 })
+    }
+
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const currentConfig = configParam ? JSON.parse(configParam) : {}
+
+    // Use ctx.em directly to avoid DI scope issues
+    const productService = new DefaultCpqProductService(ctx.em)
+
+    let specId: string | undefined
+    if (offeringId) {
+      const offering = await ctx.em.findOne(CpqProductOffering, {
+        id: offeringId,
+        ...scope,
+        deletedAt: null,
+      })
+      if (!offering) return NextResponse.json({ error: 'Offering not found' }, { status: 404 })
+      specId = offering.specId
+    }
+
+    if (specId) {
+      const attributes = await productService.getConstrainedAttributes({
+        specId,
+        ...scope,
+        currentConfig,
+        offeringId: offeringId ?? undefined,
+      })
+
+      // Filter to run-time attributes only
+      const runTimeAttrs = attributes.filter((a) => a.resolutionTime === 'run_time')
+
+      return NextResponse.json({ attributes: runTimeAttrs })
+    }
+
+    // v1 fallback: productId-based
+    return NextResponse.json({ attributes: [] })
+  } catch (err) {
+    console.error('[cpq/quotes/attributes.GET]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/quotes/from-subscription/route.ts

@@ -0,0 +1,85 @@
+import { NextResponse } from 'next/server'
+import { resolveCpqRouteContext } from '../../context'
+import { cpqCreateQuoteFromSubscriptionSchema } from '../../../data/validators'
+import { resolveQuotingService } from '../../resolveQuotingService'
+import { handleArcError } from '../../_helpers/handleArcError'
+
+/**
+ * POST /api/cpq/quotes/from-subscription
+ *
+ * Create a fresh ARC quote pre-filled with one subscription's items.
+ *
+ * Body (validated):
+ *   {
+ *     subscriptionId: uuid,
+ *     type: 'amend' | 'renew' | 'cancel',
+ *     renewTerm?: { newTermStart, newTermEnd, newTermMonths? }
+ *   }
+ *
+ * Returns: { quoteId, cpqConfigId }
+ */
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqCreateQuoteFromSubscriptionSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = resolveQuotingService(ctx)
+    const result = await service.createQuoteFromSubscription(
+      {
+        subscriptionId: body.subscriptionId,
+        type: body.type,
+        renewTerm: body.renewTerm,
+      },
+      scope,
+    )
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    return handleArcError(err, 'cpq/quotes/from-subscription.POST')
+  }
+}
+
+export const openApi = {
+  '/api/cpq/quotes/from-subscription': {
+    post: {
+      tags: ['CPQ ARC'],
+      summary: 'Create an ARC quote pre-filled from a subscription',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            schema: {
+              type: 'object',
+              required: ['subscriptionId', 'type'],
+              properties: {
+                subscriptionId: { type: 'string', format: 'uuid' },
+                type: { type: 'string', enum: ['amend', 'renew', 'cancel'] },
+                renewTerm: {
+                  type: 'object',
+                  properties: {
+                    newTermStart: { type: 'string' },
+                    newTermEnd: { type: 'string' },
+                    newTermMonths: { type: 'integer', minimum: 1 },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      responses: {
+        '201': { description: 'Quote created', content: { 'application/json': {} } },
+        '400': { description: 'Validation error' },
+        '401': { description: 'Unauthorized' },
+        '404': { description: 'Subscription not found' },
+        '409': { description: 'Subscription not in eligible status / concurrent ARC quote' },
+      },
+    },
+  },
+}

package/src/modules/cpq/api/quotes/price/route.ts

@@ -0,0 +1,81 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../../context'
+import { cpqPricePreviewSchema } from '../../../data/validators'
+import type { DefaultCpqPricingService } from '../../../services/cpqPricingService'
+import type { ResolvedCharge } from '../../../services/types'
+import { getBaseCurrencyCode } from '../../../services/types'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqPricePreviewSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+    const currencyCode = body.currencyCode ?? await getBaseCurrencyCode(ctx.em, scope)
+
+    const pricingService = ctx.container.resolve('cpqPricingService') as DefaultCpqPricingService
+
+    let primaryCharges: ResolvedCharge[] = []
+    if (body.primaryItem) {
+      primaryCharges = await pricingService.resolveProductCharges({
+        offeringId: body.primaryItem.offeringId ?? undefined,
+        productId: body.primaryItem.productId ?? undefined,
+        configuration: body.primaryItem.configuration,
+        currencyCode,
+        ...scope,
+      })
+    }
+
+    const childItems: Array<{ offeringId: string | null; productId: string | null; charges: ResolvedCharge[] }> = []
+    for (const child of body.childItems) {
+      const charges = await pricingService.resolveProductCharges({
+        offeringId: child.offeringId ?? undefined,
+        productId: child.productId ?? undefined,
+        configuration: child.configuration,
+        currencyCode,
+        ...scope,
+      })
+      childItems.push({
+        offeringId: child.offeringId ?? null,
+        productId: child.productId ?? null,
+        charges,
+      })
+    }
+
+    const allCharges = [...primaryCharges, ...childItems.flatMap((c) => c.charges)]
+
+    const nrcTotal = allCharges
+      .filter((c) => c.chargeType === 'nrc' && c.totalPrice != null)
+      .reduce((s, c) => s + (c.totalPrice ?? 0), 0)
+    const mrcTotal = allCharges
+      .filter((c) => c.chargeType === 'mrc' && c.totalPrice != null)
+      .reduce((s, c) => s + (c.totalPrice ?? 0), 0)
+    const usageCharges = allCharges
+      .filter((c) => c.chargeType === 'usage')
+      .map((c) => ({
+        chargeCode: c.chargeCode,
+        chargeName: c.chargeName,
+        unitPrice: c.unitPrice,
+        note: c.note ?? 'Usage-based charge — billed on actual consumption.',
+      }))
+
+    return NextResponse.json({
+      primaryCharges,
+      childItems,
+      totals: { nrcTotal, mrcTotal, usageCharges },
+      currencyCode,
+    })
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+    }
+    console.error('[cpq/quotes/price.POST]', err)
+    return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+  }
+}

package/src/modules/cpq/api/quotes/route.ts

@@ -0,0 +1,114 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { resolveCpqRouteContext } from '../context'
+import { cpqCreateQuoteSchema } from '../../data/validators'
+import { QuotingError } from '../../services/cpqQuotingService'
+import { resolveQuotingService } from '../resolveQuotingService'
+import { CpqQuoteConfiguration } from '../../data/entities'
+import { SalesQuote } from '@open-mercato/core/modules/sales/data/entities'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },
+  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const body = cpqCreateQuoteSchema.parse(await req.json())
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }
+
+    const service = resolveQuotingService(ctx)
+    const result = await service.createQuote(body, scope)
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    return handleError(err, 'cpq/quotes.POST')
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveCpqRouteContext(req)
+    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const url = new URL(req.url)
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }
+
+    const page = Math.max(1, Number(url.searchParams.get('page') ?? '1'))
+    const pageSize = Math.min(100, Math.max(1, Number(url.searchParams.get('pageSize') ?? '50')))
+
+    const filters: Record<string, unknown> = { ...scope }
+
+    const cpqStatus = url.searchParams.get('cpqStatus')
+    if (cpqStatus) filters.cpqStatus = cpqStatus
+    const currencyCode = url.searchParams.get('currencyCode')
+    if (currencyCode) filters.currencyCode = currencyCode
+    const customerId = url.searchParams.get('customerId')
+    if (customerId) filters.customerId = customerId
+
+    // Free-text search across quoteId, customerId (case-insensitive)
+    const search = url.searchParams.get('search')?.trim()
+    if (search) {
+      filters.$or = [
+        { quoteId: { $ilike: `%${search}%` } },
+        { customerId: { $ilike: `%${search}%` } },
+      ]
+    }
+
+    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'version', 'currencyCode'] as const
+    const sortFieldParam = url.searchParams.get('sortField') ?? ''
+    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)
+      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])
+      : 'createdAt'
+    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'
+
+    const [items, total] = await ctx.em.findAndCount(CpqQuoteConfiguration, filters, {
+      limit: pageSize,
+      offset: (page - 1) * pageSize,
+      orderBy: { [sortField]: sortDir },
+    })
+
+    // Enrich rows with `quoteNumber` (e.g. "QUOTE-20260512-00005") so the
+    // list shows human-meaningful identifiers instead of truncated UUIDs.
+    // Batched lookup keeps the cost flat regardless of page size.
+    const salesQuoteIds = [...new Set(items.map((i) => i.quoteId).filter(Boolean))]
+    const salesQuotes = salesQuoteIds.length > 0
+      ? await ctx.em.find(SalesQuote, {
+          id: { $in: salesQuoteIds },
+          organizationId: ctx.organizationId,
+          tenantId: ctx.tenantId,
+        })
+      : []
+    const quoteNumberById = new Map<string, string | null>(
+      salesQuotes.map((q) => [q.id, q.quoteNumber ?? null]),
+    )
+
+    return NextResponse.json({
+      items: items.map((item) => ({
+        ...item,
+        quoteNumber: quoteNumberById.get(item.quoteId) ?? null,
+      })),
+      total,
+      page,
+      pageSize,
+      totalPages: Math.ceil(total / pageSize),
+    })
+  } catch (err) {
+    return handleError(err, 'cpq/quotes.GET')
+  }
+}
+
+function handleError(err: unknown, context: string) {
+  if (err instanceof z.ZodError) {
+    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })
+  }
+  if (err instanceof QuotingError) {
+    const body: Record<string, unknown> = { error: err.message }
+    if (err.cpqStatus) body.cpqStatus = err.cpqStatus
+    return NextResponse.json(body, { status: err.status })
+  }
+  console.error(`[${context}]`, err)
+  return NextResponse.json({ error: 'Internal error' }, { status: 500 })
+}