@dainamite/cpq 0.4.0 → 0.6.0

package/dist/modules/cpq/api/orders/route.js

@@ -2,7 +2,9 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { resolveCpqRouteContext } from "../context.js";
 import { cpqConvertQuoteToOrderSchema } from "../../data/validators.js";
-import { OrderError } from "../../services/cpqOrderService.js";
+import { isOrderError } from "../../services/cpqOrderService.js";
+import { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from "../_helpers/quoteMutationGuard.js";
+import { cpqErrorDoc } from "../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.orders.manage"] },
   GET: { requireAuth: true, requireFeatures: ["cpq.orders.view"] }
@@ -13,8 +15,16 @@ async function POST(req) {
     if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const body = cpqConvertQuoteToOrderSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_RESOURCE_KIND,
+      resourceId: body.quoteId,
+      operation: "custom",
+      mutationPayload: { action: "convert_to_order" }
+    });
+    if (!guard.ok) return guard.response;
     const service = ctx.container.resolve("cpqOrderService");
     const result = await service.convertQuoteToOrder(body.quoteId, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result, { status: 201 });
   } catch (err) {
     return handleError(err, "cpq/orders.POST");
@@ -53,8 +63,8 @@ function handleError(err, context) {
   if (err instanceof z.ZodError) {
     return NextResponse.json({ error: "Validation error", details: err.issues }, { status: 400 });
   }
-  if (err instanceof OrderError) {
-    return NextResponse.json({ error: err.message }, { status: err.status });
+  if (isOrderError(err)) {
+    return NextResponse.json({ error: err.message, ...err.details }, { status: err.status });
   }
   const errObj = err;
   if (typeof errObj?.status === "number" && typeof errObj?.error === "string") {
@@ -63,9 +73,44 @@ function handleError(err, context) {
   console.error(`[${context}]`, err);
   return NextResponse.json({ error: "Internal error" }, { status: 500 });
 }
+const openApi = {
+  tag: "CPQ Orders",
+  summary: "CPQ orders",
+  methods: {
+    POST: {
+      summary: "Convert a CPQ quote into an order",
+      description: "Creates the sales order and CPQ order configuration from the quote. Refused for cancelled or rejected quotes; mutation guards (resource kind `cpq.quote`, action `convert_to_order`) run first.",
+      requestBody: { schema: cpqConvertQuoteToOrderSchema },
+      responses: [{ status: 201, description: "Created order" }],
+      errors: [
+        cpqErrorDoc(400, "Validation error"),
+        cpqErrorDoc(404, "Quote not found"),
+        cpqErrorDoc(409, "Quote cannot be converted in its status or is already converted"),
+        cpqErrorDoc(422, "Quote has no lines or has invalid stored adjustments, or blocked by a mutation guard")
+      ]
+    },
+    GET: {
+      summary: "List CPQ orders",
+      query: z.object({
+        customerId: z.string().uuid().optional(),
+        sourceQuoteId: z.string().uuid().optional(),
+        salesOrderId: z.string().uuid().optional(),
+        cpqStatus: z.string().optional(),
+        currencyCode: z.string().optional(),
+        search: z.string().optional(),
+        sortField: z.enum(["createdAt", "updatedAt", "cpqStatus", "activatedAt", "currencyCode"]).optional(),
+        sortDir: z.enum(["asc", "desc"]).optional(),
+        page: z.coerce.number().int().min(1).optional(),
+        pageSize: z.coerce.number().int().min(1).max(100).optional()
+      }),
+      responses: [{ status: 200, description: "Paged list of CPQ orders" }]
+    }
+  }
+};
 export {
   GET,
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/orders/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/cpq/api/orders/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../context'\nimport { cpqConvertQuoteToOrderSchema } from '../../data/validators'\nimport { OrderError } from '../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const body = cpqConvertQuoteToOrderSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.convertQuoteToOrder(body.quoteId, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleError(err, 'cpq/orders.POST')\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n    const url = new URL(req.url)\n    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode'] as const\n    const sortFieldParam = url.searchParams.get('sortField') ?? ''\n    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)\n      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])\n      : undefined\n    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'\n\n    const filters = {\n      customerId: url.searchParams.get('customerId') ?? undefined,\n      sourceQuoteId: url.searchParams.get('sourceQuoteId') ?? undefined,\n      salesOrderId: url.searchParams.get('salesOrderId') ?? undefined,\n      cpqStatus: url.searchParams.get('cpqStatus') ?? undefined,\n      currencyCode: url.searchParams.get('currencyCode') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sortField,\n      sortDir,\n      page: url.searchParams.has('page') ? Number(url.searchParams.get('page')) : undefined,\n      pageSize: url.searchParams.has('pageSize') ? Number(url.searchParams.get('pageSize')) : undefined,\n    } as const\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.listOrders(filters, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleError(err, 'cpq/orders.GET')\n  }\n}\n\nfunction handleError(err: unknown, context: string) {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n  }\n  if (err instanceof OrderError) {\n    return NextResponse.json({ error: err.message }, { status: err.status })\n  }\n  const errObj = err as Record<string, unknown>\n  if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n    return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n  }\n  console.error(`[${context}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,OAAO,6BAA6B,MAAM,MAAM,IAAI,KAAK,CAAC;AAChE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,oBAAoB,KAAK,SAAS,KAAK;AACpE,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,iBAAiB;AAAA,EAC3C;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAC3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,sBAAsB,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc;AACjG,UAAM,iBAAiB,IAAI,aAAa,IAAI,WAAW,KAAK;AAC5D,UAAM,YAAa,oBAA0C,SAAS,cAAc,IAC/E,iBACD;AACJ,UAAM,UAAU,IAAI,aAAa,IAAI,SAAS,MAAM,QAAQ,QAAQ;AAEpE,UAAM,UAAU;AAAA,MACd,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,MAClD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,MACxD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,MAChD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,MAAM,IAAI,aAAa,IAAI,MAAM,IAAI,OAAO,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI;AAAA,MAC5E,UAAU,IAAI,aAAa,IAAI,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,CAAC,IAAI;AAAA,IAC1F;AAEA,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,gBAAgB;AAAA,EAC1C;AACF;AAEA,SAAS,YAAY,KAAc,SAAiB;AAClD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,eAAe,YAAY;AAC7B,WAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACzE;AACA,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,EACvF;AACA,UAAQ,MAAM,IAAI,OAAO,KAAK,GAAG;AACjC,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../context'\nimport { cpqConvertQuoteToOrderSchema } from '../../data/validators'\nimport { isOrderError } from '../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../services/cpqOrderService'\nimport { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from '../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc } from '../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const body = cpqConvertQuoteToOrderSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    // Conversion turns a quote into an order \u2014 projects can block it (e.g.\n    // until an approval workflow has signed a discounted quote off).\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_RESOURCE_KIND,\n      resourceId: body.quoteId,\n      operation: 'custom',\n      mutationPayload: { action: 'convert_to_order' },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.convertQuoteToOrder(body.quoteId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleError(err, 'cpq/orders.POST')\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n    const url = new URL(req.url)\n    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode'] as const\n    const sortFieldParam = url.searchParams.get('sortField') ?? ''\n    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)\n      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])\n      : undefined\n    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'\n\n    const filters = {\n      customerId: url.searchParams.get('customerId') ?? undefined,\n      sourceQuoteId: url.searchParams.get('sourceQuoteId') ?? undefined,\n      salesOrderId: url.searchParams.get('salesOrderId') ?? undefined,\n      cpqStatus: url.searchParams.get('cpqStatus') ?? undefined,\n      currencyCode: url.searchParams.get('currencyCode') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sortField,\n      sortDir,\n      page: url.searchParams.has('page') ? Number(url.searchParams.get('page')) : undefined,\n      pageSize: url.searchParams.has('pageSize') ? Number(url.searchParams.get('pageSize')) : undefined,\n    } as const\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.listOrders(filters, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleError(err, 'cpq/orders.GET')\n  }\n}\n\nfunction handleError(err: unknown, context: string) {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n  }\n  if (isOrderError(err)) {\n    return NextResponse.json({ error: err.message, ...err.details }, { status: err.status })\n  }\n  const errObj = err as Record<string, unknown>\n  if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n    return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n  }\n  console.error(`[${context}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Orders',\n  summary: 'CPQ orders',\n  methods: {\n    POST: {\n      summary: 'Convert a CPQ quote into an order',\n      description:\n        'Creates the sales order and CPQ order configuration from the quote. Refused for cancelled or rejected quotes; mutation guards (resource kind `cpq.quote`, action `convert_to_order`) run first.',\n      requestBody: { schema: cpqConvertQuoteToOrderSchema },\n      responses: [{ status: 201, description: 'Created order' }],\n      errors: [\n        cpqErrorDoc(400, 'Validation error'),\n        cpqErrorDoc(404, 'Quote not found'),\n        cpqErrorDoc(409, 'Quote cannot be converted in its status or is already converted'),\n        cpqErrorDoc(422, 'Quote has no lines or has invalid stored adjustments, or blocked by a mutation guard'),\n      ],\n    },\n    GET: {\n      summary: 'List CPQ orders',\n      query: z.object({\n        customerId: z.string().uuid().optional(),\n        sourceQuoteId: z.string().uuid().optional(),\n        salesOrderId: z.string().uuid().optional(),\n        cpqStatus: z.string().optional(),\n        currencyCode: z.string().optional(),\n        search: z.string().optional(),\n        sortField: z.enum(['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode']).optional(),\n        sortDir: z.enum(['asc', 'desc']).optional(),\n        page: z.coerce.number().int().min(1).optional(),\n        pageSize: z.coerce.number().int().min(1).max(100).optional(),\n      }),\n      responses: [{ status: 200, description: 'Paged list of CPQ orders' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,SAAS,yBAAyB,4BAA4B;AAE9D,SAAS,mBAAmB;AAErB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,OAAO,6BAA6B,MAAM,MAAM,IAAI,KAAK,CAAC;AAChE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAI3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,IAChD,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,oBAAoB,KAAK,SAAS,KAAK;AACpE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,iBAAiB;AAAA,EAC3C;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAC3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,sBAAsB,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc;AACjG,UAAM,iBAAiB,IAAI,aAAa,IAAI,WAAW,KAAK;AAC5D,UAAM,YAAa,oBAA0C,SAAS,cAAc,IAC/E,iBACD;AACJ,UAAM,UAAU,IAAI,aAAa,IAAI,SAAS,MAAM,QAAQ,QAAQ;AAEpE,UAAM,UAAU;AAAA,MACd,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,MAClD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,MACxD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,MAChD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,MAAM,IAAI,aAAa,IAAI,MAAM,IAAI,OAAO,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI;AAAA,MAC5E,UAAU,IAAI,aAAa,IAAI,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,CAAC,IAAI;AAAA,IAC1F;AAEA,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,gBAAgB;AAAA,EAC1C;AACF;AAEA,SAAS,YAAY,KAAc,SAAiB;AAClD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,aAAa,GAAG,GAAG;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,IAAI,SAAS,GAAG,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACzF;AACA,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,EACvF;AACA,UAAQ,MAAM,IAAI,OAAO,KAAK,GAAG;AACjC,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,6BAA6B;AAAA,MACpD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,CAAC;AAAA,MACzD,QAAQ;AAAA,QACN,YAAY,KAAK,kBAAkB;AAAA,QACnC,YAAY,KAAK,iBAAiB;AAAA,QAClC,YAAY,KAAK,iEAAiE;AAAA,QAClF,YAAY,KAAK,sFAAsF;AAAA,MACzG;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QACvC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QAC1C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QACzC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,QAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,WAAW,EAAE,KAAK,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,QACnG,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,QAC1C,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,QAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC7D,CAAC;AAAA,MACD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/clone/route.js

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveCpqRouteContext } from "../../../context.js";
-import { QuotingError } from "../../../../services/cpqQuotingService.js";
+import { isQuotingError } from "../../../../services/cpqQuotingService.js";
 import { resolveQuotingService } from "../../../resolveQuotingService.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
@@ -15,7 +15,7 @@ async function POST(req, { params }) {
     const result = await service.cloneQuote(quoteId, scope);
     return NextResponse.json(result, { status: 201 });
   } catch (err) {
-    if (err instanceof QuotingError) {
+    if (isQuotingError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     console.error("[cpq/quotes/[quoteId]/clone.POST]", err);

package/dist/modules/cpq/api/quotes/[quoteId]/clone/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/clone/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { QuotingError } from '../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.cloneQuote(quoteId, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    if (err instanceof QuotingError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/clone.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAE/B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,qCAAqC,GAAG;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { isQuotingError } from '../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.cloneQuote(quoteId, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/clone.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AAE/B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,qCAAqC,GAAG;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/restore/route.js

@@ -0,0 +1,54 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../../../context.js";
+import { isQuotingError } from "../../../../../../services/cpqQuotingService.js";
+import { resolveQuotingService } from "../../../../../resolveQuotingService.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS } from "../../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
+};
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, lineId } = await params;
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "update",
+      mutationPayload: { quoteId, restore: true }
+    });
+    if (!guard.ok) return guard.response;
+    const service = resolveQuotingService(ctx);
+    const result = await service.restoreQuoteItem(quoteId, lineId, scope);
+    await guard.runAfterSuccess();
+    return NextResponse.json(result);
+  } catch (err) {
+    if (isQuotingError(err)) {
+      return NextResponse.json({ error: err.message }, { status: err.status });
+    }
+    console.error("[cpq/quotes/[quoteId]/items/[lineId]/restore.POST]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "Restore a subscription item marked for removal",
+  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Restore a removed subscription item on an Amend / Renew quote",
+      description: "Turns a `cancel` line that mirrors a live subscription item back into a `modify` line, rebuilt from the item (configuration, quantity, stored price). Its cancelled mirrored components are restored with it. 409 when the line is not a removed item, its parent is still removed, or the item is no longer active. Mutation guards run first (resource kind `cpq.quote_line`, update).",
+      responses: [{ status: 200, description: "Quote after the restore" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400)
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/restore/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/%5BlineId%5D/restore/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../../context'\nimport { isQuotingError } from '../../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../../resolveQuotingService'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS } from '../../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'update',\n      mutationPayload: { quoteId, restore: true },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.restoreQuoteItem(quoteId, lineId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId]/restore.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'Restore a subscription item marked for removal',\n  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Restore a removed subscription item on an Amend / Renew quote',\n      description:\n        'Turns a `cancel` line that mirrors a live subscription item back into a `modify` line, rebuilt from the item (configuration, quantity, stored price). Its cancelled mirrored components are restored with it. 409 when the line is not a removed item, its parent is still removed, or the item is no longer active. Mutation guards run first (resource kind `cpq.quote_line`, update).',\n      responses: [{ status: 200, description: 'Quote after the restore' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400),\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,gCAAgC;AAElC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6D;AAC7G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,SAAS,KAAK;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,QAAQ,KAAK;AACpE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,sDAAsD,GAAG;AACvE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9E,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,CAAC;AAAA,MACnE,QAAQ,yBAAyB,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG;AAAA,IACrE;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/route.js

@@ -2,8 +2,10 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { resolveCpqRouteContext } from "../../../../context.js";
 import { cpqUpdateQuoteItemSchema } from "../../../../../data/validators.js";
-import { QuotingError } from "../../../../../services/cpqQuotingService.js";
+import { isQuotingError } from "../../../../../services/cpqQuotingService.js";
 import { resolveQuotingService } from "../../../../resolveQuotingService.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS } from "../../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   PUT: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] },
   DELETE: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
@@ -15,14 +17,23 @@ async function PUT(req, { params }) {
     const { quoteId, lineId } = await params;
     const body = cpqUpdateQuoteItemSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "update",
+      mutationPayload: { quoteId, ...body }
+    });
+    if (!guard.ok) return guard.response;
+    const effective = guard.modifiedPayload ? cpqUpdateQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload }) : body;
     const service = resolveQuotingService(ctx);
-    const result = await service.updateQuoteItem(quoteId, lineId, body, scope);
+    const result = await service.updateQuoteItem(quoteId, lineId, effective, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: "Validation error", details: err.issues }, { status: 400 });
     }
-    if (err instanceof QuotingError) {
+    if (isQuotingError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     console.error("[cpq/quotes/[quoteId]/items/[lineId].PUT]", err);
@@ -35,20 +46,49 @@ async function DELETE(req, { params }) {
     if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const { quoteId, lineId } = await params;
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "delete",
+      mutationPayload: { quoteId }
+    });
+    if (!guard.ok) return guard.response;
     const service = resolveQuotingService(ctx);
     const result = await service.removeQuoteItem(quoteId, lineId, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
-    if (err instanceof QuotingError) {
+    if (isQuotingError(err)) {
       return NextResponse.json({ error: err.message }, { status: err.status });
     }
     console.error("[cpq/quotes/[quoteId]/items/[lineId].DELETE]", err);
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote line",
+  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),
+  methods: {
+    PUT: {
+      summary: "Update a quote line (configuration, quantity, term)",
+      description: "Re-prices the line unless it is a frozen Amend mirror line whose pricing inputs are unchanged. Mutation guards run first (resource kind `cpq.quote_line`, update). `_arc*` configuration keys are server-owned and ignored.",
+      requestBody: { schema: cpqUpdateQuoteItemSchema },
+      responses: [{ status: 200, description: "Quote after the update" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS
+    },
+    DELETE: {
+      summary: "Remove a quote line",
+      description: "On an Amend / Renew quote, a line mirroring a live subscription item is not deleted: it (and its mirrored components) becomes a `cancel` line with zero totals, and activation terminates the item; lines this quote added under it are deleted. 409 when the item is already marked for removal \u2014 use `POST .../restore` to undo. Other lines are deleted with their descendants. Mutation guards run first (resource kind `cpq.quote_line`, delete).",
+      responses: [{ status: 200, description: "Quote after the removal" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400)
+    }
+  }
+};
 export {
   DELETE,
   PUT,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/%5BlineId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqUpdateQuoteItemSchema } from '../../../../../data/validators'\nimport { QuotingError } from '../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../resolveQuotingService'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const body = cpqUpdateQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.updateQuoteItem(quoteId, lineId, body, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (err instanceof QuotingError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].PUT]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.removeQuoteItem(quoteId, lineId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof QuotingError) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].DELETE]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAE/B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6D;AAC5G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,yBAAyB,MAAM,MAAM,IAAI,KAAK,CAAC;AAC5D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,MAAM,KAAK;AACzE,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,cAAc;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA6D;AAC/G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,KAAK;AACnE,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqUpdateQuoteItemSchema } from '../../../../../data/validators'\nimport { isQuotingError } from '../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../resolveQuotingService'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const body = cpqUpdateQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'update',\n      mutationPayload: { quoteId, ...body },\n    })\n    if (!guard.ok) return guard.response\n    const effective = guard.modifiedPayload\n      ? cpqUpdateQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload })\n      : body\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.updateQuoteItem(quoteId, lineId, effective, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].PUT]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'delete',\n      mutationPayload: { quoteId },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.removeQuoteItem(quoteId, lineId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].DELETE]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote line',\n  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),\n  methods: {\n    PUT: {\n      summary: 'Update a quote line (configuration, quantity, term)',\n      description:\n        'Re-prices the line unless it is a frozen Amend mirror line whose pricing inputs are unchanged. Mutation guards run first (resource kind `cpq.quote_line`, update). `_arc*` configuration keys are server-owned and ignored.',\n      requestBody: { schema: cpqUpdateQuoteItemSchema },\n      responses: [{ status: 200, description: 'Quote after the update' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS,\n    },\n    DELETE: {\n      summary: 'Remove a quote line',\n      description:\n        'On an Amend / Renew quote, a line mirroring a live subscription item is not deleted: it (and its mirrored components) becomes a `cancel` line with zero totals, and activation terminates the item; lines this quote added under it are deleted. 409 when the item is already marked for removal \u2014 use `POST .../restore` to undo. Other lines are deleted with their descendants. Mutation guards run first (resource kind `cpq.quote_line`, delete).',\n      responses: [{ status: 200, description: 'Quote after the removal' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400),\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,gCAAgC;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6D;AAC5G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,yBAAyB,MAAM,MAAM,IAAI,KAAK,CAAC;AAC5D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,IACtC,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAC5B,UAAM,YAAY,MAAM,kBACpB,yBAAyB,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,gBAAgB,CAAC,IACpE;AAEJ,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,WAAW,KAAK;AAC9E,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA6D;AAC/G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ;AAAA,IAC7B,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,KAAK;AACnE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9E,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,yBAAyB,CAAC;AAAA,MAClE,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,CAAC;AAAA,MACnE,QAAQ,yBAAyB,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG;AAAA,IACrE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/items/route.js

@@ -3,6 +3,8 @@ import { resolveCpqRouteContext } from "../../../context.js";
 import { cpqAddQuoteItemSchema } from "../../../../data/validators.js";
 import { resolveQuotingService } from "../../../resolveQuotingService.js";
 import { handleArcError } from "../../../_helpers/handleArcError.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
 };
@@ -13,15 +15,38 @@ async function POST(req, { params }) {
     const { quoteId } = await params;
     const body = cpqAddQuoteItemSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      operation: "create",
+      mutationPayload: { quoteId, ...body }
+    });
+    if (!guard.ok) return guard.response;
+    const effective = guard.modifiedPayload ? cpqAddQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload }) : body;
     const service = resolveQuotingService(ctx);
-    const result = await service.addQuoteItem(quoteId, body, scope);
+    const result = await service.addQuoteItem(quoteId, effective, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result, { status: 201 });
   } catch (err) {
     return handleArcError(err, "cpq/quotes/[quoteId]/items.POST");
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote lines",
+  pathParams: cpqQuoteIdPathParams,
+  methods: {
+    POST: {
+      summary: "Add a configured line to a CPQ quote",
+      description: "Prices the line and recalculates the quote. Mutation guards run first (resource kind `cpq.quote_line`, create). `_arc*` configuration keys are server-owned and ignored.",
+      requestBody: { schema: cpqAddQuoteItemSchema },
+      responses: [{ status: 201, description: "Quote after the line was added" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS
+    }
+  }
+};
 export {
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqAddQuoteItemSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqAddQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.addQuoteItem(quoteId, body, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/items.POST')\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAExB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI,KAAK,CAAC;AACzD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,aAAa,SAAS,MAAM,KAAK;AAC9D,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,iCAAiC;AAAA,EAC9D;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqAddQuoteItemSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqAddQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      operation: 'create',\n      mutationPayload: { quoteId, ...body },\n    })\n    if (!guard.ok) return guard.response\n    const effective = guard.modifiedPayload\n      ? cpqAddQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload })\n      : body\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.addQuoteItem(quoteId, effective, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/items.POST')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote lines',\n  pathParams: cpqQuoteIdPathParams,\n  methods: {\n    POST: {\n      summary: 'Add a configured line to a CPQ quote',\n      description:\n        'Prices the line and recalculates the quote. Mutation guards run first (resource kind `cpq.quote_line`, create). `_arc*` configuration keys are server-owned and ignored.',\n      requestBody: { schema: cpqAddQuoteItemSchema },\n      responses: [{ status: 201, description: 'Quote after the line was added' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS,\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,0BAA0B,4BAA4B;AAExD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI,KAAK,CAAC;AACzD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,IACtC,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAC5B,UAAM,YAAY,MAAM,kBACpB,sBAAsB,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,gBAAgB,CAAC,IACjE;AAEJ,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,aAAa,SAAS,WAAW,KAAK;AACnE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,iCAAiC;AAAA,EAC9D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,sBAAsB;AAAA,MAC7C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iCAAiC,CAAC;AAAA,MAC1E,QAAQ;AAAA,IACV;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/[adjustmentId]/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../../context.js";
+import { cpqPriceAdjustmentPatchSchema } from "../../../../../data/price-adjustments.js";
+import { adjustmentCommandRoute } from "../../../../_helpers/adjustmentCommandRoute.js";
+import { handleArcError } from "../../../../_helpers/handleArcError.js";
+import { cpqErrorDoc } from "../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  PATCH: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] },
+  DELETE: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] }
+};
+const pathParams = z.object({ quoteId: z.string().uuid(), adjustmentId: z.string().uuid() });
+const deletionSchema = z.object({ expectedRevision: z.coerce.number().int().min(0).optional() }).strict();
+async function PATCH(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, adjustmentId } = pathParams.parse(await params);
+    const body = cpqPriceAdjustmentPatchSchema.parse(await req.json());
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentPatchSchema, "update", adjustmentId);
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.PATCH");
+  }
+}
+async function DELETE(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, adjustmentId } = pathParams.parse(await params);
+    const body = deletionSchema.parse(Object.fromEntries(new URL(req.url).searchParams));
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, deletionSchema, "delete", adjustmentId);
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.DELETE");
+  }
+}
+const errors = [cpqErrorDoc(400, "Invalid input"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote or adjustment not found"), cpqErrorDoc(409, "Adjustment locked, stale revision or changed undo target"), cpqErrorDoc(422, "Invalid adjustment or guard rejection")];
+const openApi = { tag: "CPQ Quotes", pathParams, methods: {
+  PATCH: { summary: "Update a negotiated quote price adjustment", requestBody: { schema: cpqPriceAdjustmentPatchSchema }, responses: [{ status: 200, description: "Adjustment and updated quote" }], errors },
+  DELETE: { summary: "Remove a negotiated quote price adjustment", query: deletionSchema, responses: [{ status: 200, description: "Updated quote" }], errors }
+} };
+export {
+  DELETE,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/[adjustmentId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/%5BadjustmentId%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqPriceAdjustmentPatchSchema } from '../../../../../data/price-adjustments'\nimport { adjustmentCommandRoute } from '../../../../_helpers/adjustmentCommandRoute'\nimport { handleArcError } from '../../../../_helpers/handleArcError'\nimport { cpqErrorDoc } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n}\nconst pathParams = z.object({ quoteId: z.string().uuid(), adjustmentId: z.string().uuid() })\nconst deletionSchema = z.object({ expectedRevision: z.coerce.number().int().min(0).optional() }).strict()\ntype Params = { params: Promise<{ quoteId: string; adjustmentId: string }> }\nexport async function PATCH(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId, adjustmentId } = pathParams.parse(await params)\n    const body = cpqPriceAdjustmentPatchSchema.parse(await req.json())\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentPatchSchema, 'update', adjustmentId)\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.PATCH') }\n}\nexport async function DELETE(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId, adjustmentId } = pathParams.parse(await params)\n    const body = deletionSchema.parse(Object.fromEntries(new URL(req.url).searchParams))\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, deletionSchema, 'delete', adjustmentId)\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.DELETE') }\n}\nconst errors = [cpqErrorDoc(400, 'Invalid input'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote or adjustment not found'), cpqErrorDoc(409, 'Adjustment locked, stale revision or changed undo target'), cpqErrorDoc(422, 'Invalid adjustment or guard rejection')]\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams, methods: {\n  PATCH: { summary: 'Update a negotiated quote price adjustment', requestBody: { schema: cpqPriceAdjustmentPatchSchema }, responses: [{ status: 200, description: 'Adjustment and updated quote' }], errors },\n  DELETE: { summary: 'Remove a negotiated quote price adjustment', query: deletionSchema, responses: [{ status: 200, description: 'Updated quote' }], errors },\n} }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAC9C,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;AAErB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AAAA,EAC9F,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AACjG;AACA,MAAM,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3F,MAAM,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AAExG,eAAsB,MAAM,KAAc,EAAE,OAAO,GAAW;AAC5D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,SAAS,aAAa,IAAI,WAAW,MAAM,MAAM,MAAM;AAC/D,UAAM,OAAO,8BAA8B,MAAM,MAAM,IAAI,KAAK,CAAC;AACjE,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,+BAA+B,UAAU,YAAY;AAAA,EACpH,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,6BAA6B;AAAA,EAAE;AAChF;AACA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAAW;AAC7D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,SAAS,aAAa,IAAI,WAAW,MAAM,MAAM,MAAM;AAC/D,UAAM,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AACnF,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,gBAAgB,UAAU,YAAY;AAAA,EACrG,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,8BAA8B;AAAA,EAAE;AACjF;AACA,MAAM,SAAS,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,+BAA+B,GAAG,YAAY,KAAK,0DAA0D,GAAG,YAAY,KAAK,uCAAuC,CAAC;AAClS,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,SAAS;AAAA,EAChF,OAAO,EAAE,SAAS,8CAA8C,aAAa,EAAE,QAAQ,8BAA8B,GAAG,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,CAAC,GAAG,OAAO;AAAA,EAC1M,QAAQ,EAAE,SAAS,8CAA8C,OAAO,gBAAgB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,CAAC,GAAG,OAAO;AAC7J,EAAE;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/preview/route.js

@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server";
+import { resolveCpqRouteContext } from "../../../../context.js";
+import { cpqPriceAdjustmentPreviewSchema } from "../../../../../data/price-adjustments.js";
+import { handleArcError } from "../../../../_helpers/handleArcError.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = { POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] } };
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const body = cpqPriceAdjustmentPreviewSchema.parse(await req.json());
+    const service = ctx.container.resolve("cpqAdjustmentService");
+    return NextResponse.json(await service.preview(quoteId, body.draft, body.replaceAdjustmentId, { tenantId: ctx.tenantId, organizationId: ctx.organizationId }));
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments/preview.POST");
+  }
+}
+const openApi = { tag: "CPQ Quotes", pathParams: cpqQuoteIdPathParams, methods: { POST: {
+  summary: "Preview a draft adjustment without saving or emitting events",
+  requestBody: { schema: cpqPriceAdjustmentPreviewSchema },
+  responses: [{ status: 200, description: "Draft quote and adjustment errors; nothing persisted" }],
+  errors: [cpqErrorDoc(400, "Invalid draft"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote, line or replaced adjustment not found"), cpqErrorDoc(409, "Adjustment locked or stale revision"), cpqErrorDoc(422, "Ineligible target or invalid reason")]
+} } };
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/preview/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/preview/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqPriceAdjustmentPreviewSchema } from '../../../../../data/price-adjustments'\nimport type { CpqAdjustmentService } from '../../../../../services/priceAdjustments/adjustmentService'\nimport { handleArcError } from '../../../../_helpers/handleArcError'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = { POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] } }\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const body = cpqPriceAdjustmentPreviewSchema.parse(await req.json())\n    const service = ctx.container.resolve<CpqAdjustmentService>('cpqAdjustmentService')\n    return NextResponse.json(await service.preview(quoteId, body.draft, body.replaceAdjustmentId, { tenantId: ctx.tenantId, organizationId: ctx.organizationId }))\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments/preview.POST') }\n}\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams: cpqQuoteIdPathParams, methods: { POST: {\n  summary: 'Preview a draft adjustment without saving or emitting events', requestBody: { schema: cpqPriceAdjustmentPreviewSchema },\n  responses: [{ status: 200, description: 'Draft quote and adjustment errors; nothing persisted' }],\n  errors: [cpqErrorDoc(400, 'Invalid draft'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote, line or replaced adjustment not found'), cpqErrorDoc(409, 'Adjustment locked or stale revision'), cpqErrorDoc(422, 'Ineligible target or invalid reason')],\n} } }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAEhD,SAAS,sBAAsB;AAC/B,SAAS,aAAa,4BAA4B;AAE3C,MAAM,WAAW,EAAE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE,EAAE;AACzH,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,OAAO,gCAAgC,MAAM,MAAM,IAAI,KAAK,CAAC;AACnE,UAAM,UAAU,IAAI,UAAU,QAA8B,sBAAsB;AAClF,WAAO,aAAa,KAAK,MAAM,QAAQ,QAAQ,SAAS,KAAK,OAAO,KAAK,qBAAqB,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/J,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,oCAAoC;AAAA,EAAE;AACvF;AACO,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,sBAAsB,SAAS,EAAE,MAAM;AAAA,EAC9G,SAAS;AAAA,EAAgE,aAAa,EAAE,QAAQ,gCAAgC;AAAA,EAChI,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uDAAuD,CAAC;AAAA,EAChG,QAAQ,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,8CAA8C,GAAG,YAAY,KAAK,qCAAqC,GAAG,YAAY,KAAK,qCAAqC,CAAC;AAC5R,EAAE,EAAE;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../context.js";
+import { cpqPriceAdjustmentInputSchema } from "../../../../data/price-adjustments.js";
+import { adjustmentCommandRoute } from "../../../_helpers/adjustmentCommandRoute.js";
+import { handleArcError } from "../../../_helpers/handleArcError.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["cpq.quotes.view"] },
+  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] }
+};
+const listQuery = z.object({ page: z.coerce.number().int().min(1).default(1), pageSize: z.coerce.number().int().min(1).max(100).default(25) });
+async function GET(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const { page, pageSize } = listQuery.parse(Object.fromEntries(new URL(req.url).searchParams));
+    const service = ctx.container.resolve("cpqAdjustmentService");
+    return NextResponse.json(await service.list(quoteId, { organizationId: ctx.organizationId, tenantId: ctx.tenantId }, page, pageSize));
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.GET");
+  }
+}
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const body = cpqPriceAdjustmentInputSchema.parse(await req.json());
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentInputSchema, "create");
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.POST");
+  }
+}
+const errors = [cpqErrorDoc(400, "Invalid input"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote not found"), cpqErrorDoc(409, "Adjustment locked or stale revision"), cpqErrorDoc(422, "Invalid adjustment or guard rejection")];
+const openApi = { tag: "CPQ Quotes", pathParams: cpqQuoteIdPathParams, methods: {
+  GET: { summary: "List quote price adjustments", query: listQuery, responses: [{ status: 200, description: "Paged adjustments, pricing revision, feature state and the reason options (`reasons: [{ value, label }]`)" }], errors },
+  POST: { summary: "Create a negotiated quote price adjustment", requestBody: { schema: cpqPriceAdjustmentInputSchema }, responses: [{ status: 201, description: "Adjustment and updated quote" }], errors }
+} };
+export {
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqPriceAdjustmentInputSchema } from '../../../../data/price-adjustments'\nimport type { CpqAdjustmentService } from '../../../../services/priceAdjustments/adjustmentService'\nimport { adjustmentCommandRoute } from '../../../_helpers/adjustmentCommandRoute'\nimport { handleArcError } from '../../../_helpers/handleArcError'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n}\nconst listQuery = z.object({ page: z.coerce.number().int().min(1).default(1), pageSize: z.coerce.number().int().min(1).max(100).default(25) })\ntype Params = { params: Promise<{ quoteId: string }> }\nexport async function GET(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const { page, pageSize } = listQuery.parse(Object.fromEntries(new URL(req.url).searchParams))\n    const service = ctx.container.resolve<CpqAdjustmentService>('cpqAdjustmentService')\n    return NextResponse.json(await service.list(quoteId, { organizationId: ctx.organizationId, tenantId: ctx.tenantId }, page, pageSize))\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.GET') }\n}\nexport async function POST(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const body = cpqPriceAdjustmentInputSchema.parse(await req.json())\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentInputSchema, 'create')\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.POST') }\n}\nconst errors = [cpqErrorDoc(400, 'Invalid input'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote not found'), cpqErrorDoc(409, 'Adjustment locked or stale revision'), cpqErrorDoc(422, 'Invalid adjustment or guard rejection')]\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams: cpqQuoteIdPathParams, methods: {\n  GET: { summary: 'List quote price adjustments', query: listQuery, responses: [{ status: 200, description: 'Paged adjustments, pricing revision, feature state and the reason options (`reasons: [{ value, label }]`)' }], errors },\n  POST: { summary: 'Create a negotiated quote price adjustment', requestBody: { schema: cpqPriceAdjustmentInputSchema }, responses: [{ status: 201, description: 'Adjustment and updated quote' }], errors },\n} }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAE9C,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,aAAa,4BAA4B;AAE3C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AAC/F;AACA,MAAM,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;AAE7I,eAAsB,IAAI,KAAc,EAAE,OAAO,GAAW;AAC1D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,EAAE,MAAM,SAAS,IAAI,UAAU,MAAM,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AAC5F,UAAM,UAAU,IAAI,UAAU,QAA8B,sBAAsB;AAClF,WAAO,aAAa,KAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS,GAAG,MAAM,QAAQ,CAAC;AAAA,EACtI,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,2BAA2B;AAAA,EAAE;AAC9E;AACA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAW;AAC3D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,OAAO,8BAA8B,MAAM,MAAM,IAAI,KAAK,CAAC;AACjE,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,+BAA+B,QAAQ;AAAA,EACtG,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,4BAA4B;AAAA,EAAE;AAC/E;AACA,MAAM,SAAS,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,iBAAiB,GAAG,YAAY,KAAK,qCAAqC,GAAG,YAAY,KAAK,uCAAuC,CAAC;AAC/P,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,sBAAsB,SAAS;AAAA,EACtG,KAAK,EAAE,SAAS,gCAAgC,OAAO,WAAW,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,4GAA4G,CAAC,GAAG,OAAO;AAAA,EACjO,MAAM,EAAE,SAAS,8CAA8C,aAAa,EAAE,QAAQ,8BAA8B,GAAG,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,CAAC,GAAG,OAAO;AAC3M,EAAE;",
+  "names": []
+}