@dainamite/cpq 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # @dainamite/cpq
 
+## 0.6.0
+
+### Minor Changes
+
+- adcb50f: Negotiated prices on quotes (manual price adjustments) with a price waterfall.
+
+  - New table `cpq_quote_price_adjustments` and column
+    `cpq_quote_configurations.pricing_revision` (migration
+    `Migration20261110213052`). **Upgrade steps for existing tenants (required):**
+    `yarn mercato db migrate`, then `yarn mercato cpq seed-price-adjustments`
+    (rollout toggle + reason dictionary) and `yarn mercato auth sync-role-acls`
+    (`cpq.quotes.adjust_price` grant). Without them writes return `403` and the
+    UI hides the actions. New tenants get all three at initialization.
+  - Reps with `cpq.quotes.manage` + `cpq.quotes.adjust_price` can override a
+    charge's unit price, take an amount off a charge or give a percentage on a
+    charge or line (`/api/cpq/quotes/{quoteId}/price-adjustments`, plus a
+    no-write `preview`). Adjustments are permanent, never exceed the standard
+    price, never compound, and lock once the quote leaves New / Incomplete /
+    Ready. Rollout toggle `cpq.manual_price_adjustments` (seeded on) and reason
+    dictionary `cpq.price_adjustment_reason`.
+  - Charges gain additive `listUnitPrice`, `listTotalPrice`, `standardUnitPrice`,
+    `standardTotalPrice` and `adjustmentErrors`; adjustment entries gain
+    `origin: 'rule' | 'manual'`. `pricingSummary` gains list / standard totals,
+    rule and manual discount totals, deal value, discount depth and
+    `snapshotHash`; `QuoteResult` gains `pricingRevision`. `discountTotal` is
+    unchanged.
+  - New events `cpq.quote.pricing_changed` and `cpq.quote.status_changed`
+    (after commit, with the pricing snapshot) for project approval workflows.
+  - Order conversion copies stored prices and returns `422 ADJUSTMENT_INVALID`
+    when a stored adjustment is invalid. `POST /api/cpq/quotes/price` accepts
+    `includeWaterfall` and never applies negotiated prices.
+  - Quote, order and subscription pages show List / Offer prices and the
+    waterfall; the quote page adds the adjustment dialog and panel.
+
+- 8d57b1b: Harden quote pricing ahead of manual price adjustments.
+
+  - `POST /api/cpq/quotes/{quoteId}/recalculate` now requires `cpq.quotes.manage`
+    (was `cpq.quotes.view`), and a saved recalculation (`save: true`) on an
+    accepted, rejected or cancelled quote returns `409`. Integrations that
+    recalculate with a view-only API key must be granted `cpq.quotes.manage`.
+  - Amend quotes no longer re-price items the operator does not touch: mirror
+    lines keep the subscription's stored price until their configuration,
+    quantity, term, dates or usage estimates change.
+  - Status transitions, line add / update / remove, saved recalculations and
+    quote-to-order conversion run every registered mutation guard
+    (resource kinds `cpq.quote` and `cpq.quote_line`), so projects can enforce
+    approvals. No behaviour change when no guard is registered.
+
+## 0.5.0
+
+### Minor Changes
+
+- d7ce539: Require Open Mercato `0.9.0`. Peer ranges move from `^0.6.7` to `^0.9.0` for
+  `@open-mercato/core`, `shared`, `ui`, `events` and `queue`, and the MikroORM
+  peers from `^7.1.5` to `^7.1.14`. Consumers on Open Mercato `0.6.x`–`0.8.x`
+  must upgrade before taking these versions.
+
+  `@dainamite/cpq` and `@dainamite/billing` now peer on `@tanstack/react-table`
+  `^9.0.0` (was `^8.0.0 || ^9.0.0`): Open Mercato 0.7 moved its `DataTable` to
+  TanStack Table v9, and list pages now import `LegacyColumnDef` from
+  `@tanstack/react-table/legacy`, which v8 does not have.
+
+  `@dainamite/cpq` also fixes CPQ quote and order API routes answering `500`
+  instead of the service's typed status (e.g. `404 Quote not found`). Next
+  bundles the package once per server layer and the DI container is shared, so
+  the route could catch a `QuotingError` / `OrderError` from the other copy of
+  the class and `instanceof` failed. Both classes now carry a `Symbol.for`
+  brand; new `isQuotingError` / `isOrderError` guards are exported alongside
+  them and should be used instead of `instanceof` in route handlers.
+
 ## 0.4.0
 
 ### Minor Changes

package/MIGRATION.md

@@ -166,6 +166,107 @@ the `@dainamite/cpq` package, per
 
 ## Schema / API changelog (track breaking changes here)
 
+### 2026-11-10 — Manual price adjustments and price waterfall (price adjustments, Phase 1)
+
+Spec: `.ai/specs/2026-11-10-cpq-manual-price-adjustments.md`. Manual:
+`manuals/cpq-price-adjustments.md`.
+
+**Schema (additive).** Migration `Migration20261110213052` adds
+`cpq_quote_price_adjustments` (tenant-scoped, soft-deleted, FK-string ids only)
+and `cpq_quote_configurations.pricing_revision int default 0`. Rollback drops
+both. No data migration: existing quotes keep their stored charges; list /
+standard prices are derived for responses until the next saved recalculation.
+
+**Upgrade steps for existing tenants (required).** The toggle, the reason
+dictionary and the role grant are created by `setup.ts` at tenant
+initialization only. After `yarn mercato db migrate`, run
+`yarn mercato cpq seed-price-adjustments` (idempotent; `--tenant` / `--org`
+to target one) and `yarn mercato auth sync-role-acls`. Skipping them leaves the
+feature fail-closed: writes `403`, actions hidden, and every reason
+`REASON_NOT_FOUND` if the toggle is switched on by hand.
+
+**Write serialization.** Every pricing write (line add / update / remove, ARC
+target detach, saved recalculation, clone, status change, adjustment CRUD,
+order conversion) runs in
+a transaction that locks the quote row (`SELECT … FOR UPDATE`) and bumps
+`pricing_revision`. Adjustment writes accept `expectedRevision` and return
+`409 STALE_REVISION` on mismatch.
+
+**Response shapes (additive).** See the changeset. `discountTotal` keeps its
+old meaning (rule discounts only) for existing consumers; use
+`ruleDiscountTotal` / `manualDiscountTotal` for the split.
+
+**Events.** `cpq.quote.pricing_changed` fires after a committed save whose
+`snapshotHash` changed; `cpq.quote.status_changed` after every committed status
+change (`cause: manual | auto`). Quotes saved before this release have no
+stored hash: their first save records a baseline silently. New and ARC quotes
+start with an empty-quote hash, so their first priced line is a signal.
+`transitionStatus(quoteId, status, scope, actorUserId?)` gained an optional
+actor argument.
+
+**Conversion.** A quote whose stored waterfall contains an invalid manual
+adjustment can no longer be converted (`422 ADJUSTMENT_INVALID` with
+`lineId` / `code`).
+
+### 2026-11-10 — Quote pricing integrity (price adjustments, Phase 1)
+
+Spec: `.ai/specs/2026-11-10-cpq-quote-pricing-integrity.md`. No schema change.
+
+**Recalculate needs `cpq.quotes.manage` (breaking for view-only callers).**
+`POST /api/cpq/quotes/{quoteId}/recalculate` required only `cpq.quotes.view`,
+so a read-only user or API key could persist re-priced quotes. It now requires
+`cpq.quotes.manage`. A saved recalculation (`save: true`) on an `accepted`,
+`rejected` or `cancelled` quote returns `409` — an accepted quote's prices are
+the basis for order conversion. Dry runs (`save: false`) on terminal quotes
+still work for managers.
+
+**Amend mirror lines are frozen (behaviour change).** Engine-priced mirror
+lines on Amend quotes were re-priced at today's catalog price on every
+recalculation, and activation wrote that price back to the subscription item.
+They now carry `_arcPriceFrozen: true` in the line `configuration` and keep the
+source item's stored charges until a pricing input of the line changes
+(configuration — ARC markers and key order ignored — quantity, `termMonths`,
+`startDate`, `endDate`, `usageEstimates`); then the marker is dropped and the
+line is re-priced as before. Renew and Cancel quotes are unchanged. Amend
+quotes created before this release keep the old behaviour. The marker never
+reaches subscription items (stripped at activation) and mirror lines ignore any
+stale `_arc*` keys on an item's configuration.
+
+**Mutation guards on quote writes.** The status, items, recalculate and
+order-conversion routes now call `runRouteMutationGuards`
+(`@open-mercato/shared/lib/crud/route-mutation-guard`) with resource kinds
+`cpq.quote` (actions `transition_status`, `recalculate`, `convert_to_order`)
+and `cpq.quote_line` (create / update / delete). A guard can block the write or
+modify the line payload; after-success hooks run once the write commits.
+These routes now export `openApi`.
+
+### 2026-11-03 — Open Mercato 0.9.0 peers; `isQuotingError` / `isOrderError`
+
+**Peer ranges (breaking for consumers).** `@open-mercato/*` `^0.9.0`,
+MikroORM `^7.1.14`, `@tanstack/react-table` `^9.0.0` (list pages import
+`LegacyColumnDef` from `@tanstack/react-table/legacy`, absent in v8). See
+`.changeset/open-mercato-090-peers.md`.
+
+**Do not use `instanceof QuotingError` / `instanceof OrderError` across the
+DI boundary.** Next bundles this package once per server layer (page SSR vs
+route handler) while the DI container is shared through `globalThis`, so a
+route can catch an error built from the other copy of the class and
+`instanceof` is `false` — a typed 404/409 becomes a 500. This was already
+true before this release; it was just undetected. Both classes now carry a
+`Symbol.for` brand, and two guards are exported next to them:
+
+```ts
+import { isQuotingError } from '@dainamite/cpq/modules/cpq/services/cpqQuotingService'
+import { isOrderError } from '@dainamite/cpq/modules/cpq/services/cpqOrderService'
+
+} catch (err) {
+  if (isQuotingError(err)) return NextResponse.json({ error: err.message }, { status: err.status })
+```
+
+Consumer code that copied CPQ's old route catch blocks should switch to the
+guards. `instanceof` remains fine inside the service layer itself, where the
+thrower and the catcher are the same module copy.
+
 ### 2026-06-02 — XD-297 Charge model / pricing method split
 
 Splits the conflated `cpq_product_charges.pricing_method` into two orthogonal

package/dist/modules/cpq/acl.js

@@ -1,4 +1,5 @@
 const features = [
+  { id: "cpq.quotes.adjust_price", title: "Adjust CPQ quote prices", module: "cpq" },
   { id: "cpq.quotes.view", title: "View CPQ Quotes", module: "cpq" },
   { id: "cpq.quotes.manage", title: "Manage CPQ Quotes", module: "cpq" },
   { id: "cpq.pricing.view", title: "View Pricing", module: "cpq" },

package/dist/modules/cpq/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/cpq/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },\n  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },\n  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },\n  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },\n  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },\n  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },\n  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },\n  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },\n  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },\n  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },\n  // XD-250 ARC (Amend / Renew / Cancel)\n  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },\n  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },\n  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },\n  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },\n  // Expiring-subscriptions feature retired \u2014 the dedicated /expiring page\n  // was replaced by an \"Expiring within (days)\" filter + saved perspective\n  // on the main subscriptions list, which uses `cpq.inventory.view`.\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA,EACrE,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,qBAAqB,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,6BAA6B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,2BAA2B,OAAO,+BAA+B,QAAQ,MAAM;AAAA,EACrF,EAAE,IAAI,6BAA6B,OAAO,iCAAiC,QAAQ,MAAM;AAAA,EACzF,EAAE,IAAI,sBAAsB,OAAO,0BAA0B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,wBAAwB,OAAO,4BAA4B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA;AAAA,EAErE,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,yBAAyB,OAAO,wBAAwB,QAAQ,MAAM;AAAA,EAC5E,EAAE,IAAI,0BAA0B,OAAO,oCAAoC,QAAQ,MAAM;AAAA;AAAA;AAAA;AAI3F;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  { id: 'cpq.quotes.adjust_price', title: 'Adjust CPQ quote prices', module: 'cpq' },\n  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },\n  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },\n  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },\n  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },\n  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },\n  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },\n  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },\n  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },\n  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },\n  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },\n  // XD-250 ARC (Amend / Renew / Cancel)\n  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },\n  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },\n  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },\n  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },\n  // Expiring-subscriptions feature retired \u2014 the dedicated /expiring page\n  // was replaced by an \"Expiring within (days)\" filter + saved perspective\n  // on the main subscriptions list, which uses `cpq.inventory.view`.\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EACjF,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA,EACrE,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,qBAAqB,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,6BAA6B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,2BAA2B,OAAO,+BAA+B,QAAQ,MAAM;AAAA,EACrF,EAAE,IAAI,6BAA6B,OAAO,iCAAiC,QAAQ,MAAM;AAAA,EACzF,EAAE,IAAI,sBAAsB,OAAO,0BAA0B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,wBAAwB,OAAO,4BAA4B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA;AAAA,EAErE,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,yBAAyB,OAAO,wBAAwB,QAAQ,MAAM;AAAA,EAC5E,EAAE,IAAI,0BAA0B,OAAO,oCAAoC,QAAQ,MAAM;AAAA;AAAA;AAAA;AAI3F;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/cpq/api/_helpers/adjustmentCommandRoute.js

@@ -0,0 +1,45 @@
+import { NextResponse } from "next/server";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { runCpqMutationGuards } from "./quoteMutationGuard.js";
+async function adjustmentCommandRoute(req, ctx, quoteId, body, schema, operation, adjustmentId) {
+  const guard = await runCpqMutationGuards(ctx, req, {
+    resourceKind: "cpq.quote_price_adjustment",
+    resourceId: adjustmentId,
+    operation,
+    mutationPayload: { quoteId, ...body }
+  });
+  if (!guard.ok) return guard.response;
+  const modified = Object.fromEntries(Object.entries(guard.modifiedPayload ?? {}).filter(([key]) => key !== "quoteId" && key !== "adjustmentId"));
+  const effective = schema.parse({ ...body, ...modified });
+  const input = operation === "create" ? { quoteId, adjustment: effective } : operation === "update" ? { quoteId, adjustmentId, patch: effective } : { quoteId, adjustmentId, ...effective };
+  const commandCtx = {
+    container: ctx.container,
+    auth: ctx.auth,
+    organizationScope: ctx.organizationScope,
+    selectedOrganizationId: ctx.organizationId,
+    organizationIds: [ctx.organizationId],
+    request: req
+  };
+  const bus = ctx.container.resolve("commandBus");
+  const commandId = `cpq.quote_price_adjustment.${operation}`;
+  const { result, logEntry } = await bus.execute(commandId, { input, ctx: commandCtx });
+  if (!result) throw new Error("Adjustment command did not return a result");
+  await guard.runAfterSuccess();
+  const response = NextResponse.json(operation === "delete" ? { quote: result.quote } : { adjustment: result.adjustment, quote: result.quote }, { status: operation === "create" ? 201 : 200 });
+  if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+    response.headers.set("x-om-operation", serializeOperationMetadata({
+      id: logEntry.id,
+      undoToken: logEntry.undoToken,
+      commandId: logEntry.commandId,
+      actionLabel: logEntry.actionLabel ?? null,
+      resourceKind: "cpq.quote_price_adjustment",
+      resourceId: result.adjustment.id,
+      executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : typeof logEntry.createdAt === "string" ? logEntry.createdAt : (/* @__PURE__ */ new Date()).toISOString()
+    }));
+  }
+  return response;
+}
+export {
+  adjustmentCommandRoute
+};
+//# sourceMappingURL=adjustmentCommandRoute.js.map

package/dist/modules/cpq/api/_helpers/adjustmentCommandRoute.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/adjustmentCommandRoute.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { z } from 'zod'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CpqRouteContext } from '../context'\nimport { runCpqMutationGuards } from './quoteMutationGuard'\nimport type { AdjustmentWriteResult } from '../../services/priceAdjustments/adjustmentService'\n\nexport async function adjustmentCommandRoute<T extends object>(\n  req: Request, ctx: CpqRouteContext, quoteId: string, body: T,\n  schema: z.ZodType<T>, operation: 'create' | 'update' | 'delete', adjustmentId?: string,\n): Promise<NextResponse | Response> {\n  const guard = await runCpqMutationGuards(ctx, req, {\n    resourceKind: 'cpq.quote_price_adjustment', resourceId: adjustmentId,\n    operation, mutationPayload: { quoteId, ...body },\n  })\n  if (!guard.ok) return guard.response\n  // Path identifiers belong to the server, even when a project guard returns\n  // the full payload including the original quoteId metadata.\n  const modified = Object.fromEntries(Object.entries(guard.modifiedPayload ?? {})\n    .filter(([key]) => key !== 'quoteId' && key !== 'adjustmentId'))\n  const effective = schema.parse({ ...body, ...modified })\n  const input = operation === 'create' ? { quoteId, adjustment: effective }\n    : operation === 'update' ? { quoteId, adjustmentId, patch: effective }\n      : { quoteId, adjustmentId, ...effective }\n  const commandCtx: CommandRuntimeContext = {\n    container: ctx.container, auth: ctx.auth, organizationScope: ctx.organizationScope,\n    selectedOrganizationId: ctx.organizationId, organizationIds: [ctx.organizationId], request: req,\n  }\n  const bus = ctx.container.resolve<CommandBus>('commandBus')\n  const commandId = `cpq.quote_price_adjustment.${operation}`\n  const { result, logEntry } = await bus.execute<typeof input, AdjustmentWriteResult>(commandId, { input, ctx: commandCtx })\n  if (!result) throw new Error('Adjustment command did not return a result')\n  await guard.runAfterSuccess()\n  const response = NextResponse.json(operation === 'delete' ? { quote: result.quote }\n    : { adjustment: result.adjustment, quote: result.quote }, { status: operation === 'create' ? 201 : 200 })\n  if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n    response.headers.set('x-om-operation', serializeOperationMetadata({ id: logEntry.id, undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId, actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: 'cpq.quote_price_adjustment', resourceId: result.adjustment.id,\n      executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString()\n        : typeof logEntry.createdAt === 'string' ? logEntry.createdAt : new Date().toISOString() }))\n  }\n  return response\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,kCAAkC;AAE3C,SAAS,4BAA4B;AAGrC,eAAsB,uBACpB,KAAc,KAAsB,SAAiB,MACrD,QAAsB,WAA2C,cAC/B;AAClC,QAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,IACjD,cAAc;AAAA,IAA8B,YAAY;AAAA,IACxD;AAAA,IAAW,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAG5B,QAAM,WAAW,OAAO,YAAY,OAAO,QAAQ,MAAM,mBAAmB,CAAC,CAAC,EAC3E,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,aAAa,QAAQ,cAAc,CAAC;AACjE,QAAM,YAAY,OAAO,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;AACvD,QAAM,QAAQ,cAAc,WAAW,EAAE,SAAS,YAAY,UAAU,IACpE,cAAc,WAAW,EAAE,SAAS,cAAc,OAAO,UAAU,IACjE,EAAE,SAAS,cAAc,GAAG,UAAU;AAC5C,QAAM,aAAoC;AAAA,IACxC,WAAW,IAAI;AAAA,IAAW,MAAM,IAAI;AAAA,IAAM,mBAAmB,IAAI;AAAA,IACjE,wBAAwB,IAAI;AAAA,IAAgB,iBAAiB,CAAC,IAAI,cAAc;AAAA,IAAG,SAAS;AAAA,EAC9F;AACA,QAAM,MAAM,IAAI,UAAU,QAAoB,YAAY;AAC1D,QAAM,YAAY,8BAA8B,SAAS;AACzD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,IAAI,QAA6C,WAAW,EAAE,OAAO,KAAK,WAAW,CAAC;AACzH,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4CAA4C;AACzE,QAAM,MAAM,gBAAgB;AAC5B,QAAM,WAAW,aAAa,KAAK,cAAc,WAAW,EAAE,OAAO,OAAO,MAAM,IAC9E,EAAE,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,cAAc,WAAW,MAAM,IAAI,CAAC;AAC1G,MAAI,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC5D,aAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,MAAE,IAAI,SAAS;AAAA,MAAI,WAAW,SAAS;AAAA,MACvG,WAAW,SAAS;AAAA,MAAW,aAAa,SAAS,eAAe;AAAA,MACpE,cAAc;AAAA,MAA8B,YAAY,OAAO,WAAW;AAAA,MAC1E,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAC5E,OAAO,SAAS,cAAc,WAAW,SAAS,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAE,CAAC,CAAC;AAAA,EACjG;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/cpq/api/_helpers/handleArcError.js

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { OptimisticLockError } from "@mikro-orm/core";
-import { QuotingError } from "../../services/cpqQuotingService.js";
+import { isQuotingError } from "../../services/cpqQuotingService.js";
 function handleArcError(err, ctx) {
   if (err instanceof z.ZodError) {
     return NextResponse.json(
@@ -9,7 +9,7 @@ function handleArcError(err, ctx) {
       { status: 400 }
     );
   }
-  if (err instanceof QuotingError) {
+  if (isQuotingError(err)) {
     const body = { error: err.message };
     if (err.cpqStatus) body.cpqStatus = err.cpqStatus;
     if (err.details) Object.assign(body, err.details);

package/dist/modules/cpq/api/_helpers/handleArcError.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/cpq/api/_helpers/handleArcError.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { OptimisticLockError } from '@mikro-orm/core'\nimport { QuotingError } from '../../services/cpqQuotingService'\n\n/**\n * Shared error \u2192 JSON-response converter for ARC routes (XD-250).\n *\n * Handles three families:\n *   1. Zod validation errors \u2192 400 with `details` array.\n *   2. Service-layer `QuotingError` (matched both via `instanceof` AND via\n *      duck-typing on `name === 'QuotingError'`) \u2192 propagates `err.status`.\n *      The duck-typing fallback exists because Turbopack hot-reload can\n *      produce two distinct class instances for the same source file\n *      across module boundaries, breaking `instanceof` checks at runtime.\n *   3. cpqInventoryService throws plain `{ status, error }` objects \u2192\n *      propagate the embedded status.\n *   4. Anything else \u2192 500 + console.error with the route context.\n *\n * Returning the response keeps route handlers terse:\n *   `} catch (err) { return handleArcError(err, 'cpq/quotes/from-subscription.POST') }`\n */\nexport function handleArcError(err: unknown, ctx: string): NextResponse {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: 'Validation error', details: err.issues },\n      { status: 400 },\n    )\n  }\n\n  if (err instanceof QuotingError) {\n    const body: Record<string, unknown> = { error: err.message }\n    if (err.cpqStatus) body.cpqStatus = err.cpqStatus\n    if (err.details) Object.assign(body, err.details)\n    return NextResponse.json(body, { status: err.status })\n  }\n\n  // MikroORM optimistic-lock collision on subscription.version (XD-250 spec\n  // \u00A7 Risks \"Order activation racing with another mutation\"). Both\n  // `instanceof OptimisticLockError` AND constructor-name fallback to\n  // survive Turbopack class drift.\n  if (\n    err instanceof OptimisticLockError ||\n    (err &&\n      typeof err === 'object' &&\n      typeof (err as { constructor?: { name?: string } }).constructor?.name === 'string' &&\n      (err as { constructor: { name: string } }).constructor.name === 'OptimisticLockError')\n  ) {\n    return NextResponse.json(\n      { error: 'Concurrent modification detected', details: (err as Error).message },\n      { status: 409 },\n    )\n  }\n\n  // Duck-typed QuotingError (Turbopack instanceof drift) and inventory-service\n  // plain throw shape `{ status, error }`. Both surface a numeric `status`.\n  // Also propagates `details` (object) into response body \u2014 preserves the\n  // structured payload (e.g. `existingQuoteId`) that the typed branch above\n  // would have surfaced if instanceof had matched.\n  if (\n    err &&\n    typeof err === 'object' &&\n    'status' in err &&\n    typeof (err as { status: unknown }).status === 'number'\n  ) {\n    const e = err as {\n      status: number\n      message?: string\n      error?: string\n      name?: string\n      details?: Record<string, unknown>\n    }\n    const message = e.message ?? e.error ?? 'Conflict'\n    const body: Record<string, unknown> = { error: message }\n    if (e.details && typeof e.details === 'object') Object.assign(body, e.details)\n    return NextResponse.json(body, { status: e.status })\n  }\n\n  console.error(`[${ctx}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAmBtB,SAAS,eAAe,KAAc,KAA2B;AACtE,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,eAAe,cAAc;AAC/B,UAAM,OAAgC,EAAE,OAAO,IAAI,QAAQ;AAC3D,QAAI,IAAI,UAAW,MAAK,YAAY,IAAI;AACxC,QAAI,IAAI,QAAS,QAAO,OAAO,MAAM,IAAI,OAAO;AAChD,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACvD;AAMA,MACE,eAAe,uBACd,OACC,OAAO,QAAQ,YACf,OAAQ,IAA4C,aAAa,SAAS,YACzE,IAA0C,YAAY,SAAS,uBAClE;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC,SAAU,IAAc,QAAQ;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAOA,MACE,OACA,OAAO,QAAQ,YACf,YAAY,OACZ,OAAQ,IAA4B,WAAW,UAC/C;AACA,UAAM,IAAI;AAOV,UAAM,UAAU,EAAE,WAAW,EAAE,SAAS;AACxC,UAAM,OAAgC,EAAE,OAAO,QAAQ;AACvD,QAAI,EAAE,WAAW,OAAO,EAAE,YAAY,SAAU,QAAO,OAAO,MAAM,EAAE,OAAO;AAC7E,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAAA,EACrD;AAEA,UAAQ,MAAM,IAAI,GAAG,KAAK,GAAG;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { OptimisticLockError } from '@mikro-orm/core'\nimport { isQuotingError } from '../../services/cpqQuotingService'\n\n/**\n * Shared error \u2192 JSON-response converter for ARC routes (XD-250).\n *\n * Handles three families:\n *   1. Zod validation errors \u2192 400 with `details` array.\n *   2. Service-layer `QuotingError` (matched via its cross-realm brand,\n *      `isQuotingError`, with a duck-typed fallback below) \u2192 propagates\n *      `err.status`. `instanceof` is unreliable here: Next bundles this\n *      package once per server layer, so the route and the DI-resolved\n *      service can hold two distinct copies of the class \u2014 in production\n *      too, not only under hot-reload.\n *   3. cpqInventoryService throws plain `{ status, error }` objects \u2192\n *      propagate the embedded status.\n *   4. Anything else \u2192 500 + console.error with the route context.\n *\n * Returning the response keeps route handlers terse:\n *   `} catch (err) { return handleArcError(err, 'cpq/quotes/from-subscription.POST') }`\n */\nexport function handleArcError(err: unknown, ctx: string): NextResponse {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: 'Validation error', details: err.issues },\n      { status: 400 },\n    )\n  }\n\n  if (isQuotingError(err)) {\n    const body: Record<string, unknown> = { error: err.message }\n    if (err.cpqStatus) body.cpqStatus = err.cpqStatus\n    if (err.details) Object.assign(body, err.details)\n    return NextResponse.json(body, { status: err.status })\n  }\n\n  // MikroORM optimistic-lock collision on subscription.version (XD-250 spec\n  // \u00A7 Risks \"Order activation racing with another mutation\"). Both\n  // `instanceof OptimisticLockError` AND constructor-name fallback to\n  // survive Turbopack class drift.\n  if (\n    err instanceof OptimisticLockError ||\n    (err &&\n      typeof err === 'object' &&\n      typeof (err as { constructor?: { name?: string } }).constructor?.name === 'string' &&\n      (err as { constructor: { name: string } }).constructor.name === 'OptimisticLockError')\n  ) {\n    return NextResponse.json(\n      { error: 'Concurrent modification detected', details: (err as Error).message },\n      { status: 409 },\n    )\n  }\n\n  // cpqInventoryService's plain throw shape `{ status, error }` (QuotingError\n  // from any bundle copy is already handled by `isQuotingError` above).\n  // Propagates `details` (object) into the response body so structured\n  // payloads survive here too.\n  if (\n    err &&\n    typeof err === 'object' &&\n    'status' in err &&\n    typeof (err as { status: unknown }).status === 'number'\n  ) {\n    const e = err as {\n      status: number\n      message?: string\n      error?: string\n      name?: string\n      details?: Record<string, unknown>\n    }\n    const message = e.message ?? e.error ?? 'Conflict'\n    const body: Record<string, unknown> = { error: message }\n    if (e.details && typeof e.details === 'object') Object.assign(body, e.details)\n    return NextResponse.json(body, { status: e.status })\n  }\n\n  console.error(`[${ctx}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,sBAAsB;AAoBxB,SAAS,eAAe,KAAc,KAA2B;AACtE,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,eAAe,GAAG,GAAG;AACvB,UAAM,OAAgC,EAAE,OAAO,IAAI,QAAQ;AAC3D,QAAI,IAAI,UAAW,MAAK,YAAY,IAAI;AACxC,QAAI,IAAI,QAAS,QAAO,OAAO,MAAM,IAAI,OAAO;AAChD,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACvD;AAMA,MACE,eAAe,uBACd,OACC,OAAO,QAAQ,YACf,OAAQ,IAA4C,aAAa,SAAS,YACzE,IAA0C,YAAY,SAAS,uBAClE;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,oCAAoC,SAAU,IAAc,QAAQ;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,MACE,OACA,OAAO,QAAQ,YACf,YAAY,OACZ,OAAQ,IAA4B,WAAW,UAC/C;AACA,UAAM,IAAI;AAOV,UAAM,UAAU,EAAE,WAAW,EAAE,SAAS;AACxC,UAAM,OAAgC,EAAE,OAAO,QAAQ;AACvD,QAAI,EAAE,WAAW,OAAO,EAAE,YAAY,SAAU,QAAO,OAAO,MAAM,EAAE,OAAO;AAC7E,WAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAAA,EACrD;AAEA,UAAQ,MAAM,IAAI,GAAG,KAAK,GAAG;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;",
   "names": []
 }

package/dist/modules/cpq/api/_helpers/quoteMutationGuard.js

@@ -0,0 +1,23 @@
+import {
+  runRouteMutationGuards
+} from "@open-mercato/shared/lib/crud/route-mutation-guard";
+const CPQ_QUOTE_RESOURCE_KIND = "cpq.quote";
+const CPQ_QUOTE_LINE_RESOURCE_KIND = "cpq.quote_line";
+function runCpqMutationGuards(ctx, req, input) {
+  return runRouteMutationGuards({
+    container: ctx.container,
+    req,
+    auth: {
+      userId: ctx.auth?.sub ?? "",
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId || null
+    },
+    input
+  });
+}
+export {
+  CPQ_QUOTE_LINE_RESOURCE_KIND,
+  CPQ_QUOTE_RESOURCE_KIND,
+  runCpqMutationGuards
+};
+//# sourceMappingURL=quoteMutationGuard.js.map

package/dist/modules/cpq/api/_helpers/quoteMutationGuard.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/quoteMutationGuard.ts"],
+  "sourcesContent": ["import {\n  runRouteMutationGuards,\n  type RouteMutationGuardInput,\n  type RouteMutationGuardResult,\n} from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport type { CpqRouteContext } from '../context'\n\n/** Mutation-guard resource kinds for CPQ quote writes (`module.entity`). */\nexport const CPQ_QUOTE_RESOURCE_KIND = 'cpq.quote'\nexport const CPQ_QUOTE_LINE_RESOURCE_KIND = 'cpq.quote_line'\n\n/**\n * Run every registered mutation guard for a CPQ custom write route.\n *\n * Quote routes are hand-written (not `makeCrudRoute`), so they wire guards\n * explicitly through the framework's registry-based wrapper. Projects use\n * this hook to enforce rules CPQ does not own \u2014 e.g. blocking\n * `ready \u2192 with_customer` or order conversion until an approval workflow\n * signs a discounted quote off. With no guard registered the call passes.\n *\n * Call `runAfterSuccess()` on the passed result only after the write commits.\n */\nexport function runCpqMutationGuards(\n  ctx: Pick<CpqRouteContext, 'container' | 'auth' | 'tenantId' | 'organizationId'>,\n  req: Request,\n  input: RouteMutationGuardInput,\n): Promise<RouteMutationGuardResult> {\n  return runRouteMutationGuards({\n    container: ctx.container,\n    req,\n    auth: {\n      userId: ctx.auth?.sub ?? '',\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId || null,\n    },\n    input,\n  })\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AAIA,MAAM,0BAA0B;AAChC,MAAM,+BAA+B;AAarC,SAAS,qBACd,KACA,KACA,OACmC;AACnC,SAAO,uBAAuB;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI,kBAAkB;AAAA,IACxC;AAAA,IACA;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/cpq/api/_helpers/quoteRouteOpenApi.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+const cpqErrorResponseSchema = z.object({ error: z.string() }).passthrough();
+function cpqErrorDoc(status, description) {
+  return { status, description, schema: cpqErrorResponseSchema };
+}
+const cpqQuoteIdPathParams = z.object({ quoteId: z.string().uuid() });
+const CPQ_GUARDED_WRITE_ERRORS = [
+  cpqErrorDoc(400, "Validation error"),
+  cpqErrorDoc(404, "Quote or line not found"),
+  cpqErrorDoc(409, "Quote is in a terminal status"),
+  cpqErrorDoc(422, "Blocked by a mutation guard")
+];
+export {
+  CPQ_GUARDED_WRITE_ERRORS,
+  cpqErrorDoc,
+  cpqErrorResponseSchema,
+  cpqQuoteIdPathParams
+};
+//# sourceMappingURL=quoteRouteOpenApi.js.map

package/dist/modules/cpq/api/_helpers/quoteRouteOpenApi.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/quoteRouteOpenApi.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiResponseDoc } from '@open-mercato/shared/lib/openapi'\n\n/** Error body every CPQ quote route returns (`{ error, ... }`). */\nexport const cpqErrorResponseSchema = z.object({ error: z.string() }).passthrough()\n\nexport function cpqErrorDoc(status: number, description: string): OpenApiResponseDoc {\n  return { status, description, schema: cpqErrorResponseSchema }\n}\n\nexport const cpqQuoteIdPathParams = z.object({ quoteId: z.string().uuid() })\n\n/** Shared error docs for quote writes guarded by mutation guards. */\nexport const CPQ_GUARDED_WRITE_ERRORS: OpenApiResponseDoc[] = [\n  cpqErrorDoc(400, 'Validation error'),\n  cpqErrorDoc(404, 'Quote or line not found'),\n  cpqErrorDoc(409, 'Quote is in a terminal status'),\n  cpqErrorDoc(422, 'Blocked by a mutation guard'),\n]\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAIX,MAAM,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY;AAE3E,SAAS,YAAY,QAAgB,aAAyC;AACnF,SAAO,EAAE,QAAQ,aAAa,QAAQ,uBAAuB;AAC/D;AAEO,MAAM,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAGpE,MAAM,2BAAiD;AAAA,EAC5D,YAAY,KAAK,kBAAkB;AAAA,EACnC,YAAY,KAAK,yBAAyB;AAAA,EAC1C,YAAY,KAAK,+BAA+B;AAAA,EAChD,YAAY,KAAK,6BAA6B;AAChD;",
+  "names": []
+}

package/dist/modules/cpq/api/orders/[orderId]/activate/route.js

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
 import { OptimisticLockError } from "@mikro-orm/core";
 import { resolveCpqRouteContext } from "../../../context.js";
-import { OrderError } from "../../../../services/cpqOrderService.js";
+import { isOrderError } from "../../../../services/cpqOrderService.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.orders.manage"] }
 };
@@ -15,7 +15,7 @@ async function POST(req, { params }) {
     const result = await service.activateOrder(orderId, scope);
     return NextResponse.json(result);
   } catch (err) {
-    if (err instanceof OrderError) {
+    if (isOrderError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     if (err instanceof OptimisticLockError || err && typeof err === "object" && err.constructor?.name === "OptimisticLockError") {

package/dist/modules/cpq/api/orders/[orderId]/activate/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/orders/%5BorderId%5D/activate/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { OptimisticLockError } from '@mikro-orm/core'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { OrderError } from '../../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.activateOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof OrderError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    // XD-250 ARC: optimistic-lock collision on subscription.version when two\n    // ARC orders touching the same sub race to activate. Spec \u00A7 Risks:\n    // \"second activation gets 409, order stays in pending_activation,\n    // retryable\". Constructor-name fallback survives Turbopack class drift.\n    if (\n      err instanceof OptimisticLockError ||\n      (err &&\n        typeof err === 'object' &&\n        (err as { constructor?: { name?: string } }).constructor?.name === 'OptimisticLockError')\n    ) {\n      return NextResponse.json(\n        { error: 'Concurrent modification detected', details: (err as Error).message },\n        { status: 409 },\n      )\n    }\n    const errObj = err as Record<string, unknown>\n    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n    }\n    console.error('[cpq/orders/[orderId]/activate.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,cAAc,SAAS,KAAK;AACzD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AAKA,QACE,eAAe,uBACd,OACC,OAAO,QAAQ,YACd,IAA4C,aAAa,SAAS,uBACrE;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,oCAAoC,SAAU,IAAc,QAAQ;AAAA,QAC7E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,SAAS;AACf,QAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,aAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,IACvF;AACA,YAAQ,MAAM,wCAAwC,GAAG;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { OptimisticLockError } from '@mikro-orm/core'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { isOrderError } from '../../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.activateOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isOrderError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    // XD-250 ARC: optimistic-lock collision on subscription.version when two\n    // ARC orders touching the same sub race to activate. Spec \u00A7 Risks:\n    // \"second activation gets 409, order stays in pending_activation,\n    // retryable\". Constructor-name fallback survives Turbopack class drift.\n    if (\n      err instanceof OptimisticLockError ||\n      (err &&\n        typeof err === 'object' &&\n        (err as { constructor?: { name?: string } }).constructor?.name === 'OptimisticLockError')\n    ) {\n      return NextResponse.json(\n        { error: 'Concurrent modification detected', details: (err as Error).message },\n        { status: 409 },\n      )\n    }\n    const errObj = err as Record<string, unknown>\n    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n    }\n    console.error('[cpq/orders/[orderId]/activate.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,cAAc,SAAS,KAAK;AACzD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AAKA,QACE,eAAe,uBACd,OACC,OAAO,QAAQ,YACd,IAA4C,aAAa,SAAS,uBACrE;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,oCAAoC,SAAU,IAAc,QAAQ;AAAA,QAC7E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,SAAS;AACf,QAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,aAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,IACvF;AACA,YAAQ,MAAM,wCAAwC,GAAG;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/orders/[orderId]/route.js

@@ -1,6 +1,8 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
+import { cpqErrorDoc } from "../../_helpers/quoteRouteOpenApi.js";
 import { resolveCpqRouteContext } from "../../context.js";
-import { OrderError } from "../../../services/cpqOrderService.js";
+import { isOrderError } from "../../../services/cpqOrderService.js";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["cpq.orders.view"] }
 };
@@ -14,15 +16,29 @@ async function GET(req, { params }) {
     const result = await service.getOrder(orderId, scope);
     return NextResponse.json(result);
   } catch (err) {
-    if (err instanceof OrderError) {
+    if (isOrderError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     console.error("[cpq/orders/[orderId].GET]", err);
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Orders",
+  summary: "CPQ order",
+  pathParams: z.object({ orderId: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Get a CPQ order with its lines and pricing summary",
+      description: "`pricingSummary` carries NRC / MRC totals plus the source quote's waterfall figures (`listNrcTotal`, `listMrcTotal`, `standard*Total`, `ruleDiscountTotal`, `manualDiscountTotal`, `dealValue`, `discountDepth`), computed from the line charges copied at conversion. ARC lines carry `arcSource` (the subscription item before the change).",
+      responses: [{ status: 200, description: "The order" }],
+      errors: [cpqErrorDoc(401, "Unauthorized"), cpqErrorDoc(404, "Order not found")]
+    }
+  }
+};
 export {
   GET,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/orders/[orderId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/cpq/api/orders/%5BorderId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../context'\nimport { OrderError } from '../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../services/cpqOrderService'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.getOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof OrderError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/orders/[orderId].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6C;AAC5F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK;AACpD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc } from '../../_helpers/quoteRouteOpenApi'\nimport { resolveCpqRouteContext } from '../../context'\nimport { isOrderError } from '../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../services/cpqOrderService'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.getOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isOrderError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/orders/[orderId].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Orders',\n  summary: 'CPQ order',\n  pathParams: z.object({ orderId: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'Get a CPQ order with its lines and pricing summary',\n      description:\n        '`pricingSummary` carries NRC / MRC totals plus the source quote\\'s waterfall figures (`listNrcTotal`, `listMrcTotal`, `standard*Total`, `ruleDiscountTotal`, `manualDiscountTotal`, `dealValue`, `discountDepth`), computed from the line charges copied at conversion. ARC lines carry `arcSource` (the subscription item before the change).',\n      responses: [{ status: 200, description: 'The order' }],\n      errors: [cpqErrorDoc(401, 'Unauthorized'), cpqErrorDoc(404, 'Order not found')],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6C;AAC5F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK;AACpD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACnD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,YAAY,CAAC;AAAA,MACrD,QAAQ,CAAC,YAAY,KAAK,cAAc,GAAG,YAAY,KAAK,iBAAiB,CAAC;AAAA,IAChF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/orders/[orderId]/status/route.js

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { resolveCpqRouteContext } from "../../../context.js";
 import { cpqOrderStatusTransitionSchema } from "../../../../data/validators.js";
-import { OrderError } from "../../../../services/cpqOrderService.js";
+import { isOrderError } from "../../../../services/cpqOrderService.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.orders.manage"] }
 };
@@ -20,7 +20,7 @@ async function POST(req, { params }) {
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: "Validation error", details: err.issues }, { status: 400 });
     }
-    if (err instanceof OrderError) {
+    if (isOrderError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     const errObj = err;

package/dist/modules/cpq/api/orders/[orderId]/status/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/orders/%5BorderId%5D/status/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqOrderStatusTransitionSchema } from '../../../../data/validators'\nimport { OrderError } from '../../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const body = cpqOrderStatusTransitionSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.transitionOrderStatus(orderId, body.targetStatus, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (err instanceof OrderError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    const errObj = err as Record<string, unknown>\n    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n    }\n    console.error('[cpq/orders/[orderId]/status.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,sCAAsC;AAC/C,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,+BAA+B,MAAM,MAAM,IAAI,KAAK,CAAC;AAClE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,sBAAsB,SAAS,KAAK,cAAc,KAAK;AACpF,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,YAAY;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,UAAM,SAAS;AACf,QAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,aAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,IACvF;AACA,YAAQ,MAAM,sCAAsC,GAAG;AACvD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqOrderStatusTransitionSchema } from '../../../../data/validators'\nimport { isOrderError } from '../../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const body = cpqOrderStatusTransitionSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.transitionOrderStatus(orderId, body.targetStatus, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isOrderError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    const errObj = err as Record<string, unknown>\n    if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n      return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n    }\n    console.error('[cpq/orders/[orderId]/status.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,+BAA+B,MAAM,MAAM,IAAI,KAAK,CAAC;AAClE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,sBAAsB,SAAS,KAAK,cAAc,KAAK;AACpF,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,UAAM,SAAS;AACf,QAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,aAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,IACvF;AACA,YAAQ,MAAM,sCAAsC,GAAG;AACvD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
   "names": []
 }