@dainamite/cpq 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @dainamite/cpq
 
+## 0.6.0
+
+### Minor Changes
+
+- adcb50f: Negotiated prices on quotes (manual price adjustments) with a price waterfall.
+
+  - New table `cpq_quote_price_adjustments` and column
+    `cpq_quote_configurations.pricing_revision` (migration
+    `Migration20261110213052`). **Upgrade steps for existing tenants (required):**
+    `yarn mercato db migrate`, then `yarn mercato cpq seed-price-adjustments`
+    (rollout toggle + reason dictionary) and `yarn mercato auth sync-role-acls`
+    (`cpq.quotes.adjust_price` grant). Without them writes return `403` and the
+    UI hides the actions. New tenants get all three at initialization.
+  - Reps with `cpq.quotes.manage` + `cpq.quotes.adjust_price` can override a
+    charge's unit price, take an amount off a charge or give a percentage on a
+    charge or line (`/api/cpq/quotes/{quoteId}/price-adjustments`, plus a
+    no-write `preview`). Adjustments are permanent, never exceed the standard
+    price, never compound, and lock once the quote leaves New / Incomplete /
+    Ready. Rollout toggle `cpq.manual_price_adjustments` (seeded on) and reason
+    dictionary `cpq.price_adjustment_reason`.
+  - Charges gain additive `listUnitPrice`, `listTotalPrice`, `standardUnitPrice`,
+    `standardTotalPrice` and `adjustmentErrors`; adjustment entries gain
+    `origin: 'rule' | 'manual'`. `pricingSummary` gains list / standard totals,
+    rule and manual discount totals, deal value, discount depth and
+    `snapshotHash`; `QuoteResult` gains `pricingRevision`. `discountTotal` is
+    unchanged.
+  - New events `cpq.quote.pricing_changed` and `cpq.quote.status_changed`
+    (after commit, with the pricing snapshot) for project approval workflows.
+  - Order conversion copies stored prices and returns `422 ADJUSTMENT_INVALID`
+    when a stored adjustment is invalid. `POST /api/cpq/quotes/price` accepts
+    `includeWaterfall` and never applies negotiated prices.
+  - Quote, order and subscription pages show List / Offer prices and the
+    waterfall; the quote page adds the adjustment dialog and panel.
+
+- 8d57b1b: Harden quote pricing ahead of manual price adjustments.
+
+  - `POST /api/cpq/quotes/{quoteId}/recalculate` now requires `cpq.quotes.manage`
+    (was `cpq.quotes.view`), and a saved recalculation (`save: true`) on an
+    accepted, rejected or cancelled quote returns `409`. Integrations that
+    recalculate with a view-only API key must be granted `cpq.quotes.manage`.
+  - Amend quotes no longer re-price items the operator does not touch: mirror
+    lines keep the subscription's stored price until their configuration,
+    quantity, term, dates or usage estimates change.
+  - Status transitions, line add / update / remove, saved recalculations and
+    quote-to-order conversion run every registered mutation guard
+    (resource kinds `cpq.quote` and `cpq.quote_line`), so projects can enforce
+    approvals. No behaviour change when no guard is registered.
+
 ## 0.5.0
 
 ### Minor Changes

package/MIGRATION.md

@@ -166,6 +166,80 @@ the `@dainamite/cpq` package, per
 
 ## Schema / API changelog (track breaking changes here)
 
+### 2026-11-10 — Manual price adjustments and price waterfall (price adjustments, Phase 1)
+
+Spec: `.ai/specs/2026-11-10-cpq-manual-price-adjustments.md`. Manual:
+`manuals/cpq-price-adjustments.md`.
+
+**Schema (additive).** Migration `Migration20261110213052` adds
+`cpq_quote_price_adjustments` (tenant-scoped, soft-deleted, FK-string ids only)
+and `cpq_quote_configurations.pricing_revision int default 0`. Rollback drops
+both. No data migration: existing quotes keep their stored charges; list /
+standard prices are derived for responses until the next saved recalculation.
+
+**Upgrade steps for existing tenants (required).** The toggle, the reason
+dictionary and the role grant are created by `setup.ts` at tenant
+initialization only. After `yarn mercato db migrate`, run
+`yarn mercato cpq seed-price-adjustments` (idempotent; `--tenant` / `--org`
+to target one) and `yarn mercato auth sync-role-acls`. Skipping them leaves the
+feature fail-closed: writes `403`, actions hidden, and every reason
+`REASON_NOT_FOUND` if the toggle is switched on by hand.
+
+**Write serialization.** Every pricing write (line add / update / remove, ARC
+target detach, saved recalculation, clone, status change, adjustment CRUD,
+order conversion) runs in
+a transaction that locks the quote row (`SELECT … FOR UPDATE`) and bumps
+`pricing_revision`. Adjustment writes accept `expectedRevision` and return
+`409 STALE_REVISION` on mismatch.
+
+**Response shapes (additive).** See the changeset. `discountTotal` keeps its
+old meaning (rule discounts only) for existing consumers; use
+`ruleDiscountTotal` / `manualDiscountTotal` for the split.
+
+**Events.** `cpq.quote.pricing_changed` fires after a committed save whose
+`snapshotHash` changed; `cpq.quote.status_changed` after every committed status
+change (`cause: manual | auto`). Quotes saved before this release have no
+stored hash: their first save records a baseline silently. New and ARC quotes
+start with an empty-quote hash, so their first priced line is a signal.
+`transitionStatus(quoteId, status, scope, actorUserId?)` gained an optional
+actor argument.
+
+**Conversion.** A quote whose stored waterfall contains an invalid manual
+adjustment can no longer be converted (`422 ADJUSTMENT_INVALID` with
+`lineId` / `code`).
+
+### 2026-11-10 — Quote pricing integrity (price adjustments, Phase 1)
+
+Spec: `.ai/specs/2026-11-10-cpq-quote-pricing-integrity.md`. No schema change.
+
+**Recalculate needs `cpq.quotes.manage` (breaking for view-only callers).**
+`POST /api/cpq/quotes/{quoteId}/recalculate` required only `cpq.quotes.view`,
+so a read-only user or API key could persist re-priced quotes. It now requires
+`cpq.quotes.manage`. A saved recalculation (`save: true`) on an `accepted`,
+`rejected` or `cancelled` quote returns `409` — an accepted quote's prices are
+the basis for order conversion. Dry runs (`save: false`) on terminal quotes
+still work for managers.
+
+**Amend mirror lines are frozen (behaviour change).** Engine-priced mirror
+lines on Amend quotes were re-priced at today's catalog price on every
+recalculation, and activation wrote that price back to the subscription item.
+They now carry `_arcPriceFrozen: true` in the line `configuration` and keep the
+source item's stored charges until a pricing input of the line changes
+(configuration — ARC markers and key order ignored — quantity, `termMonths`,
+`startDate`, `endDate`, `usageEstimates`); then the marker is dropped and the
+line is re-priced as before. Renew and Cancel quotes are unchanged. Amend
+quotes created before this release keep the old behaviour. The marker never
+reaches subscription items (stripped at activation) and mirror lines ignore any
+stale `_arc*` keys on an item's configuration.
+
+**Mutation guards on quote writes.** The status, items, recalculate and
+order-conversion routes now call `runRouteMutationGuards`
+(`@open-mercato/shared/lib/crud/route-mutation-guard`) with resource kinds
+`cpq.quote` (actions `transition_status`, `recalculate`, `convert_to_order`)
+and `cpq.quote_line` (create / update / delete). A guard can block the write or
+modify the line payload; after-success hooks run once the write commits.
+These routes now export `openApi`.
+
 ### 2026-11-03 — Open Mercato 0.9.0 peers; `isQuotingError` / `isOrderError`
 
 **Peer ranges (breaking for consumers).** `@open-mercato/*` `^0.9.0`,

package/dist/modules/cpq/acl.js

@@ -1,4 +1,5 @@
 const features = [
+  { id: "cpq.quotes.adjust_price", title: "Adjust CPQ quote prices", module: "cpq" },
   { id: "cpq.quotes.view", title: "View CPQ Quotes", module: "cpq" },
   { id: "cpq.quotes.manage", title: "Manage CPQ Quotes", module: "cpq" },
   { id: "cpq.pricing.view", title: "View Pricing", module: "cpq" },

package/dist/modules/cpq/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/cpq/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },\n  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },\n  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },\n  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },\n  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },\n  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },\n  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },\n  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },\n  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },\n  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },\n  // XD-250 ARC (Amend / Renew / Cancel)\n  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },\n  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },\n  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },\n  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },\n  // Expiring-subscriptions feature retired \u2014 the dedicated /expiring page\n  // was replaced by an \"Expiring within (days)\" filter + saved perspective\n  // on the main subscriptions list, which uses `cpq.inventory.view`.\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA,EACrE,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,qBAAqB,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,6BAA6B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,2BAA2B,OAAO,+BAA+B,QAAQ,MAAM;AAAA,EACrF,EAAE,IAAI,6BAA6B,OAAO,iCAAiC,QAAQ,MAAM;AAAA,EACzF,EAAE,IAAI,sBAAsB,OAAO,0BAA0B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,wBAAwB,OAAO,4BAA4B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA;AAAA,EAErE,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,yBAAyB,OAAO,wBAAwB,QAAQ,MAAM;AAAA,EAC5E,EAAE,IAAI,0BAA0B,OAAO,oCAAoC,QAAQ,MAAM;AAAA;AAAA;AAAA;AAI3F;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  { id: 'cpq.quotes.adjust_price', title: 'Adjust CPQ quote prices', module: 'cpq' },\n  { id: 'cpq.quotes.view', title: 'View CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.quotes.manage', title: 'Manage CPQ Quotes', module: 'cpq' },\n  { id: 'cpq.pricing.view', title: 'View Pricing', module: 'cpq' },\n  { id: 'cpq.pricing.manage', title: 'Manage Pricing', module: 'cpq' },\n  { id: 'cpq.products.view', title: 'View CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.products.manage', title: 'Manage CPQ Product Config', module: 'cpq' },\n  { id: 'cpq.specifications.view', title: 'View Product Specifications', module: 'cpq' },\n  { id: 'cpq.specifications.manage', title: 'Manage Product Specifications', module: 'cpq' },\n  { id: 'cpq.offerings.view', title: 'View Product Offerings', module: 'cpq' },\n  { id: 'cpq.offerings.manage', title: 'Manage Product Offerings', module: 'cpq' },\n  { id: 'cpq.wizards.view', title: 'View Wizards', module: 'cpq' },\n  { id: 'cpq.wizards.manage', title: 'Manage Wizards', module: 'cpq' },\n  { id: 'cpq.orders.view', title: 'View CPQ Orders', module: 'cpq' },\n  { id: 'cpq.orders.manage', title: 'Manage CPQ Orders', module: 'cpq' },\n  // XD-250 ARC (Amend / Renew / Cancel)\n  { id: 'cpq.arc.amend.manage', title: 'Manage Amend Quotes', module: 'cpq' },\n  { id: 'cpq.arc.renew.manage', title: 'Manage Renew Quotes', module: 'cpq' },\n  { id: 'cpq.arc.cancel.manage', title: 'Manage Cancel Quotes', module: 'cpq' },\n  { id: 'cpq.arc.changelog.view', title: 'View Subscription Change History', module: 'cpq' },\n  // Expiring-subscriptions feature retired \u2014 the dedicated /expiring page\n  // was replaced by an \"Expiring within (days)\" filter + saved perspective\n  // on the main subscriptions list, which uses `cpq.inventory.view`.\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EACjF,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA,EACrE,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,qBAAqB,OAAO,2BAA2B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,6BAA6B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,2BAA2B,OAAO,+BAA+B,QAAQ,MAAM;AAAA,EACrF,EAAE,IAAI,6BAA6B,OAAO,iCAAiC,QAAQ,MAAM;AAAA,EACzF,EAAE,IAAI,sBAAsB,OAAO,0BAA0B,QAAQ,MAAM;AAAA,EAC3E,EAAE,IAAI,wBAAwB,OAAO,4BAA4B,QAAQ,MAAM;AAAA,EAC/E,EAAE,IAAI,oBAAoB,OAAO,gBAAgB,QAAQ,MAAM;AAAA,EAC/D,EAAE,IAAI,sBAAsB,OAAO,kBAAkB,QAAQ,MAAM;AAAA,EACnE,EAAE,IAAI,mBAAmB,OAAO,mBAAmB,QAAQ,MAAM;AAAA,EACjE,EAAE,IAAI,qBAAqB,OAAO,qBAAqB,QAAQ,MAAM;AAAA;AAAA,EAErE,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,uBAAuB,QAAQ,MAAM;AAAA,EAC1E,EAAE,IAAI,yBAAyB,OAAO,wBAAwB,QAAQ,MAAM;AAAA,EAC5E,EAAE,IAAI,0BAA0B,OAAO,oCAAoC,QAAQ,MAAM;AAAA;AAAA;AAAA;AAI3F;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/cpq/api/_helpers/adjustmentCommandRoute.js

@@ -0,0 +1,45 @@
+import { NextResponse } from "next/server";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { runCpqMutationGuards } from "./quoteMutationGuard.js";
+async function adjustmentCommandRoute(req, ctx, quoteId, body, schema, operation, adjustmentId) {
+  const guard = await runCpqMutationGuards(ctx, req, {
+    resourceKind: "cpq.quote_price_adjustment",
+    resourceId: adjustmentId,
+    operation,
+    mutationPayload: { quoteId, ...body }
+  });
+  if (!guard.ok) return guard.response;
+  const modified = Object.fromEntries(Object.entries(guard.modifiedPayload ?? {}).filter(([key]) => key !== "quoteId" && key !== "adjustmentId"));
+  const effective = schema.parse({ ...body, ...modified });
+  const input = operation === "create" ? { quoteId, adjustment: effective } : operation === "update" ? { quoteId, adjustmentId, patch: effective } : { quoteId, adjustmentId, ...effective };
+  const commandCtx = {
+    container: ctx.container,
+    auth: ctx.auth,
+    organizationScope: ctx.organizationScope,
+    selectedOrganizationId: ctx.organizationId,
+    organizationIds: [ctx.organizationId],
+    request: req
+  };
+  const bus = ctx.container.resolve("commandBus");
+  const commandId = `cpq.quote_price_adjustment.${operation}`;
+  const { result, logEntry } = await bus.execute(commandId, { input, ctx: commandCtx });
+  if (!result) throw new Error("Adjustment command did not return a result");
+  await guard.runAfterSuccess();
+  const response = NextResponse.json(operation === "delete" ? { quote: result.quote } : { adjustment: result.adjustment, quote: result.quote }, { status: operation === "create" ? 201 : 200 });
+  if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+    response.headers.set("x-om-operation", serializeOperationMetadata({
+      id: logEntry.id,
+      undoToken: logEntry.undoToken,
+      commandId: logEntry.commandId,
+      actionLabel: logEntry.actionLabel ?? null,
+      resourceKind: "cpq.quote_price_adjustment",
+      resourceId: result.adjustment.id,
+      executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : typeof logEntry.createdAt === "string" ? logEntry.createdAt : (/* @__PURE__ */ new Date()).toISOString()
+    }));
+  }
+  return response;
+}
+export {
+  adjustmentCommandRoute
+};
+//# sourceMappingURL=adjustmentCommandRoute.js.map

package/dist/modules/cpq/api/_helpers/adjustmentCommandRoute.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/adjustmentCommandRoute.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { z } from 'zod'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CpqRouteContext } from '../context'\nimport { runCpqMutationGuards } from './quoteMutationGuard'\nimport type { AdjustmentWriteResult } from '../../services/priceAdjustments/adjustmentService'\n\nexport async function adjustmentCommandRoute<T extends object>(\n  req: Request, ctx: CpqRouteContext, quoteId: string, body: T,\n  schema: z.ZodType<T>, operation: 'create' | 'update' | 'delete', adjustmentId?: string,\n): Promise<NextResponse | Response> {\n  const guard = await runCpqMutationGuards(ctx, req, {\n    resourceKind: 'cpq.quote_price_adjustment', resourceId: adjustmentId,\n    operation, mutationPayload: { quoteId, ...body },\n  })\n  if (!guard.ok) return guard.response\n  // Path identifiers belong to the server, even when a project guard returns\n  // the full payload including the original quoteId metadata.\n  const modified = Object.fromEntries(Object.entries(guard.modifiedPayload ?? {})\n    .filter(([key]) => key !== 'quoteId' && key !== 'adjustmentId'))\n  const effective = schema.parse({ ...body, ...modified })\n  const input = operation === 'create' ? { quoteId, adjustment: effective }\n    : operation === 'update' ? { quoteId, adjustmentId, patch: effective }\n      : { quoteId, adjustmentId, ...effective }\n  const commandCtx: CommandRuntimeContext = {\n    container: ctx.container, auth: ctx.auth, organizationScope: ctx.organizationScope,\n    selectedOrganizationId: ctx.organizationId, organizationIds: [ctx.organizationId], request: req,\n  }\n  const bus = ctx.container.resolve<CommandBus>('commandBus')\n  const commandId = `cpq.quote_price_adjustment.${operation}`\n  const { result, logEntry } = await bus.execute<typeof input, AdjustmentWriteResult>(commandId, { input, ctx: commandCtx })\n  if (!result) throw new Error('Adjustment command did not return a result')\n  await guard.runAfterSuccess()\n  const response = NextResponse.json(operation === 'delete' ? { quote: result.quote }\n    : { adjustment: result.adjustment, quote: result.quote }, { status: operation === 'create' ? 201 : 200 })\n  if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n    response.headers.set('x-om-operation', serializeOperationMetadata({ id: logEntry.id, undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId, actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: 'cpq.quote_price_adjustment', resourceId: result.adjustment.id,\n      executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString()\n        : typeof logEntry.createdAt === 'string' ? logEntry.createdAt : new Date().toISOString() }))\n  }\n  return response\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,kCAAkC;AAE3C,SAAS,4BAA4B;AAGrC,eAAsB,uBACpB,KAAc,KAAsB,SAAiB,MACrD,QAAsB,WAA2C,cAC/B;AAClC,QAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,IACjD,cAAc;AAAA,IAA8B,YAAY;AAAA,IACxD;AAAA,IAAW,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAG5B,QAAM,WAAW,OAAO,YAAY,OAAO,QAAQ,MAAM,mBAAmB,CAAC,CAAC,EAC3E,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,aAAa,QAAQ,cAAc,CAAC;AACjE,QAAM,YAAY,OAAO,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;AACvD,QAAM,QAAQ,cAAc,WAAW,EAAE,SAAS,YAAY,UAAU,IACpE,cAAc,WAAW,EAAE,SAAS,cAAc,OAAO,UAAU,IACjE,EAAE,SAAS,cAAc,GAAG,UAAU;AAC5C,QAAM,aAAoC;AAAA,IACxC,WAAW,IAAI;AAAA,IAAW,MAAM,IAAI;AAAA,IAAM,mBAAmB,IAAI;AAAA,IACjE,wBAAwB,IAAI;AAAA,IAAgB,iBAAiB,CAAC,IAAI,cAAc;AAAA,IAAG,SAAS;AAAA,EAC9F;AACA,QAAM,MAAM,IAAI,UAAU,QAAoB,YAAY;AAC1D,QAAM,YAAY,8BAA8B,SAAS;AACzD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,IAAI,QAA6C,WAAW,EAAE,OAAO,KAAK,WAAW,CAAC;AACzH,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4CAA4C;AACzE,QAAM,MAAM,gBAAgB;AAC5B,QAAM,WAAW,aAAa,KAAK,cAAc,WAAW,EAAE,OAAO,OAAO,MAAM,IAC9E,EAAE,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,cAAc,WAAW,MAAM,IAAI,CAAC;AAC1G,MAAI,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC5D,aAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,MAAE,IAAI,SAAS;AAAA,MAAI,WAAW,SAAS;AAAA,MACvG,WAAW,SAAS;AAAA,MAAW,aAAa,SAAS,eAAe;AAAA,MACpE,cAAc;AAAA,MAA8B,YAAY,OAAO,WAAW;AAAA,MAC1E,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAC5E,OAAO,SAAS,cAAc,WAAW,SAAS,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAE,CAAC,CAAC;AAAA,EACjG;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/cpq/api/_helpers/quoteMutationGuard.js

@@ -0,0 +1,23 @@
+import {
+  runRouteMutationGuards
+} from "@open-mercato/shared/lib/crud/route-mutation-guard";
+const CPQ_QUOTE_RESOURCE_KIND = "cpq.quote";
+const CPQ_QUOTE_LINE_RESOURCE_KIND = "cpq.quote_line";
+function runCpqMutationGuards(ctx, req, input) {
+  return runRouteMutationGuards({
+    container: ctx.container,
+    req,
+    auth: {
+      userId: ctx.auth?.sub ?? "",
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId || null
+    },
+    input
+  });
+}
+export {
+  CPQ_QUOTE_LINE_RESOURCE_KIND,
+  CPQ_QUOTE_RESOURCE_KIND,
+  runCpqMutationGuards
+};
+//# sourceMappingURL=quoteMutationGuard.js.map

package/dist/modules/cpq/api/_helpers/quoteMutationGuard.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/quoteMutationGuard.ts"],
+  "sourcesContent": ["import {\n  runRouteMutationGuards,\n  type RouteMutationGuardInput,\n  type RouteMutationGuardResult,\n} from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport type { CpqRouteContext } from '../context'\n\n/** Mutation-guard resource kinds for CPQ quote writes (`module.entity`). */\nexport const CPQ_QUOTE_RESOURCE_KIND = 'cpq.quote'\nexport const CPQ_QUOTE_LINE_RESOURCE_KIND = 'cpq.quote_line'\n\n/**\n * Run every registered mutation guard for a CPQ custom write route.\n *\n * Quote routes are hand-written (not `makeCrudRoute`), so they wire guards\n * explicitly through the framework's registry-based wrapper. Projects use\n * this hook to enforce rules CPQ does not own \u2014 e.g. blocking\n * `ready \u2192 with_customer` or order conversion until an approval workflow\n * signs a discounted quote off. With no guard registered the call passes.\n *\n * Call `runAfterSuccess()` on the passed result only after the write commits.\n */\nexport function runCpqMutationGuards(\n  ctx: Pick<CpqRouteContext, 'container' | 'auth' | 'tenantId' | 'organizationId'>,\n  req: Request,\n  input: RouteMutationGuardInput,\n): Promise<RouteMutationGuardResult> {\n  return runRouteMutationGuards({\n    container: ctx.container,\n    req,\n    auth: {\n      userId: ctx.auth?.sub ?? '',\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId || null,\n    },\n    input,\n  })\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AAIA,MAAM,0BAA0B;AAChC,MAAM,+BAA+B;AAarC,SAAS,qBACd,KACA,KACA,OACmC;AACnC,SAAO,uBAAuB;AAAA,IAC5B,WAAW,IAAI;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI,kBAAkB;AAAA,IACxC;AAAA,IACA;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/cpq/api/_helpers/quoteRouteOpenApi.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+const cpqErrorResponseSchema = z.object({ error: z.string() }).passthrough();
+function cpqErrorDoc(status, description) {
+  return { status, description, schema: cpqErrorResponseSchema };
+}
+const cpqQuoteIdPathParams = z.object({ quoteId: z.string().uuid() });
+const CPQ_GUARDED_WRITE_ERRORS = [
+  cpqErrorDoc(400, "Validation error"),
+  cpqErrorDoc(404, "Quote or line not found"),
+  cpqErrorDoc(409, "Quote is in a terminal status"),
+  cpqErrorDoc(422, "Blocked by a mutation guard")
+];
+export {
+  CPQ_GUARDED_WRITE_ERRORS,
+  cpqErrorDoc,
+  cpqErrorResponseSchema,
+  cpqQuoteIdPathParams
+};
+//# sourceMappingURL=quoteRouteOpenApi.js.map

package/dist/modules/cpq/api/_helpers/quoteRouteOpenApi.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/cpq/api/_helpers/quoteRouteOpenApi.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiResponseDoc } from '@open-mercato/shared/lib/openapi'\n\n/** Error body every CPQ quote route returns (`{ error, ... }`). */\nexport const cpqErrorResponseSchema = z.object({ error: z.string() }).passthrough()\n\nexport function cpqErrorDoc(status: number, description: string): OpenApiResponseDoc {\n  return { status, description, schema: cpqErrorResponseSchema }\n}\n\nexport const cpqQuoteIdPathParams = z.object({ quoteId: z.string().uuid() })\n\n/** Shared error docs for quote writes guarded by mutation guards. */\nexport const CPQ_GUARDED_WRITE_ERRORS: OpenApiResponseDoc[] = [\n  cpqErrorDoc(400, 'Validation error'),\n  cpqErrorDoc(404, 'Quote or line not found'),\n  cpqErrorDoc(409, 'Quote is in a terminal status'),\n  cpqErrorDoc(422, 'Blocked by a mutation guard'),\n]\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAIX,MAAM,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY;AAE3E,SAAS,YAAY,QAAgB,aAAyC;AACnF,SAAO,EAAE,QAAQ,aAAa,QAAQ,uBAAuB;AAC/D;AAEO,MAAM,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAGpE,MAAM,2BAAiD;AAAA,EAC5D,YAAY,KAAK,kBAAkB;AAAA,EACnC,YAAY,KAAK,yBAAyB;AAAA,EAC1C,YAAY,KAAK,+BAA+B;AAAA,EAChD,YAAY,KAAK,6BAA6B;AAChD;",
+  "names": []
+}

package/dist/modules/cpq/api/orders/[orderId]/route.js

@@ -1,4 +1,6 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
+import { cpqErrorDoc } from "../../_helpers/quoteRouteOpenApi.js";
 import { resolveCpqRouteContext } from "../../context.js";
 import { isOrderError } from "../../../services/cpqOrderService.js";
 const metadata = {
@@ -21,8 +23,22 @@ async function GET(req, { params }) {
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Orders",
+  summary: "CPQ order",
+  pathParams: z.object({ orderId: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Get a CPQ order with its lines and pricing summary",
+      description: "`pricingSummary` carries NRC / MRC totals plus the source quote's waterfall figures (`listNrcTotal`, `listMrcTotal`, `standard*Total`, `ruleDiscountTotal`, `manualDiscountTotal`, `dealValue`, `discountDepth`), computed from the line charges copied at conversion. ARC lines carry `arcSource` (the subscription item before the change).",
+      responses: [{ status: 200, description: "The order" }],
+      errors: [cpqErrorDoc(401, "Unauthorized"), cpqErrorDoc(404, "Order not found")]
+    }
+  }
+};
 export {
   GET,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/orders/[orderId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/cpq/api/orders/%5BorderId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../context'\nimport { isOrderError } from '../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../services/cpqOrderService'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.getOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isOrderError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/orders/[orderId].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6C;AAC5F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK;AACpD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc } from '../../_helpers/quoteRouteOpenApi'\nimport { resolveCpqRouteContext } from '../../context'\nimport { isOrderError } from '../../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../../services/cpqOrderService'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ orderId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { orderId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.getOrder(orderId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isOrderError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/orders/[orderId].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Orders',\n  summary: 'CPQ order',\n  pathParams: z.object({ orderId: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'Get a CPQ order with its lines and pricing summary',\n      description:\n        '`pricingSummary` carries NRC / MRC totals plus the source quote\\'s waterfall figures (`listNrcTotal`, `listMrcTotal`, `standard*Total`, `ruleDiscountTotal`, `manualDiscountTotal`, `dealValue`, `discountDepth`), computed from the line charges copied at conversion. ARC lines carry `arcSource` (the subscription item before the change).',\n      responses: [{ status: 200, description: 'The order' }],\n      errors: [cpqErrorDoc(401, 'Unauthorized'), cpqErrorDoc(404, 'Order not found')],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6C;AAC5F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK;AACpD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACnD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,YAAY,CAAC;AAAA,MACrD,QAAQ,CAAC,YAAY,KAAK,cAAc,GAAG,YAAY,KAAK,iBAAiB,CAAC;AAAA,IAChF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/orders/route.js

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { resolveCpqRouteContext } from "../context.js";
 import { cpqConvertQuoteToOrderSchema } from "../../data/validators.js";
 import { isOrderError } from "../../services/cpqOrderService.js";
+import { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from "../_helpers/quoteMutationGuard.js";
+import { cpqErrorDoc } from "../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.orders.manage"] },
   GET: { requireAuth: true, requireFeatures: ["cpq.orders.view"] }
@@ -13,8 +15,16 @@ async function POST(req) {
     if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const body = cpqConvertQuoteToOrderSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_RESOURCE_KIND,
+      resourceId: body.quoteId,
+      operation: "custom",
+      mutationPayload: { action: "convert_to_order" }
+    });
+    if (!guard.ok) return guard.response;
     const service = ctx.container.resolve("cpqOrderService");
     const result = await service.convertQuoteToOrder(body.quoteId, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result, { status: 201 });
   } catch (err) {
     return handleError(err, "cpq/orders.POST");
@@ -54,7 +64,7 @@ function handleError(err, context) {
     return NextResponse.json({ error: "Validation error", details: err.issues }, { status: 400 });
   }
   if (isOrderError(err)) {
-    return NextResponse.json({ error: err.message }, { status: err.status });
+    return NextResponse.json({ error: err.message, ...err.details }, { status: err.status });
   }
   const errObj = err;
   if (typeof errObj?.status === "number" && typeof errObj?.error === "string") {
@@ -63,9 +73,44 @@ function handleError(err, context) {
   console.error(`[${context}]`, err);
   return NextResponse.json({ error: "Internal error" }, { status: 500 });
 }
+const openApi = {
+  tag: "CPQ Orders",
+  summary: "CPQ orders",
+  methods: {
+    POST: {
+      summary: "Convert a CPQ quote into an order",
+      description: "Creates the sales order and CPQ order configuration from the quote. Refused for cancelled or rejected quotes; mutation guards (resource kind `cpq.quote`, action `convert_to_order`) run first.",
+      requestBody: { schema: cpqConvertQuoteToOrderSchema },
+      responses: [{ status: 201, description: "Created order" }],
+      errors: [
+        cpqErrorDoc(400, "Validation error"),
+        cpqErrorDoc(404, "Quote not found"),
+        cpqErrorDoc(409, "Quote cannot be converted in its status or is already converted"),
+        cpqErrorDoc(422, "Quote has no lines or has invalid stored adjustments, or blocked by a mutation guard")
+      ]
+    },
+    GET: {
+      summary: "List CPQ orders",
+      query: z.object({
+        customerId: z.string().uuid().optional(),
+        sourceQuoteId: z.string().uuid().optional(),
+        salesOrderId: z.string().uuid().optional(),
+        cpqStatus: z.string().optional(),
+        currencyCode: z.string().optional(),
+        search: z.string().optional(),
+        sortField: z.enum(["createdAt", "updatedAt", "cpqStatus", "activatedAt", "currencyCode"]).optional(),
+        sortDir: z.enum(["asc", "desc"]).optional(),
+        page: z.coerce.number().int().min(1).optional(),
+        pageSize: z.coerce.number().int().min(1).max(100).optional()
+      }),
+      responses: [{ status: 200, description: "Paged list of CPQ orders" }]
+    }
+  }
+};
 export {
   GET,
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/orders/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/cpq/api/orders/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../context'\nimport { cpqConvertQuoteToOrderSchema } from '../../data/validators'\nimport { isOrderError } from '../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../services/cpqOrderService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const body = cpqConvertQuoteToOrderSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.convertQuoteToOrder(body.quoteId, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleError(err, 'cpq/orders.POST')\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n    const url = new URL(req.url)\n    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode'] as const\n    const sortFieldParam = url.searchParams.get('sortField') ?? ''\n    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)\n      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])\n      : undefined\n    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'\n\n    const filters = {\n      customerId: url.searchParams.get('customerId') ?? undefined,\n      sourceQuoteId: url.searchParams.get('sourceQuoteId') ?? undefined,\n      salesOrderId: url.searchParams.get('salesOrderId') ?? undefined,\n      cpqStatus: url.searchParams.get('cpqStatus') ?? undefined,\n      currencyCode: url.searchParams.get('currencyCode') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sortField,\n      sortDir,\n      page: url.searchParams.has('page') ? Number(url.searchParams.get('page')) : undefined,\n      pageSize: url.searchParams.has('pageSize') ? Number(url.searchParams.get('pageSize')) : undefined,\n    } as const\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.listOrders(filters, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleError(err, 'cpq/orders.GET')\n  }\n}\n\nfunction handleError(err: unknown, context: string) {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n  }\n  if (isOrderError(err)) {\n    return NextResponse.json({ error: err.message }, { status: err.status })\n  }\n  const errObj = err as Record<string, unknown>\n  if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n    return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n  }\n  console.error(`[${context}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,OAAO,6BAA6B,MAAM,MAAM,IAAI,KAAK,CAAC;AAChE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,oBAAoB,KAAK,SAAS,KAAK;AACpE,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,iBAAiB;AAAA,EAC3C;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAC3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,sBAAsB,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc;AACjG,UAAM,iBAAiB,IAAI,aAAa,IAAI,WAAW,KAAK;AAC5D,UAAM,YAAa,oBAA0C,SAAS,cAAc,IAC/E,iBACD;AACJ,UAAM,UAAU,IAAI,aAAa,IAAI,SAAS,MAAM,QAAQ,QAAQ;AAEpE,UAAM,UAAU;AAAA,MACd,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,MAClD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,MACxD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,MAChD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,MAAM,IAAI,aAAa,IAAI,MAAM,IAAI,OAAO,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI;AAAA,MAC5E,UAAU,IAAI,aAAa,IAAI,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,CAAC,IAAI;AAAA,IAC1F;AAEA,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,gBAAgB;AAAA,EAC1C;AACF;AAEA,SAAS,YAAY,KAAc,SAAiB;AAClD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,aAAa,GAAG,GAAG;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACzE;AACA,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,EACvF;AACA,UAAQ,MAAM,IAAI,OAAO,KAAK,GAAG;AACjC,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../context'\nimport { cpqConvertQuoteToOrderSchema } from '../../data/validators'\nimport { isOrderError } from '../../services/cpqOrderService'\nimport type { DefaultCpqOrderService } from '../../services/cpqOrderService'\nimport { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from '../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc } from '../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.orders.manage'] },\n  GET: { requireAuth: true, requireFeatures: ['cpq.orders.view'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const body = cpqConvertQuoteToOrderSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    // Conversion turns a quote into an order \u2014 projects can block it (e.g.\n    // until an approval workflow has signed a discounted quote off).\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_RESOURCE_KIND,\n      resourceId: body.quoteId,\n      operation: 'custom',\n      mutationPayload: { action: 'convert_to_order' },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.convertQuoteToOrder(body.quoteId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleError(err, 'cpq/orders.POST')\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n    const url = new URL(req.url)\n    const ALLOWED_SORT_FIELDS = ['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode'] as const\n    const sortFieldParam = url.searchParams.get('sortField') ?? ''\n    const sortField = (ALLOWED_SORT_FIELDS as readonly string[]).includes(sortFieldParam)\n      ? (sortFieldParam as (typeof ALLOWED_SORT_FIELDS)[number])\n      : undefined\n    const sortDir = url.searchParams.get('sortDir') === 'asc' ? 'asc' : 'desc'\n\n    const filters = {\n      customerId: url.searchParams.get('customerId') ?? undefined,\n      sourceQuoteId: url.searchParams.get('sourceQuoteId') ?? undefined,\n      salesOrderId: url.searchParams.get('salesOrderId') ?? undefined,\n      cpqStatus: url.searchParams.get('cpqStatus') ?? undefined,\n      currencyCode: url.searchParams.get('currencyCode') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sortField,\n      sortDir,\n      page: url.searchParams.has('page') ? Number(url.searchParams.get('page')) : undefined,\n      pageSize: url.searchParams.has('pageSize') ? Number(url.searchParams.get('pageSize')) : undefined,\n    } as const\n\n    const service = ctx.container.resolve('cpqOrderService') as DefaultCpqOrderService\n    const result = await service.listOrders(filters, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleError(err, 'cpq/orders.GET')\n  }\n}\n\nfunction handleError(err: unknown, context: string) {\n  if (err instanceof z.ZodError) {\n    return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n  }\n  if (isOrderError(err)) {\n    return NextResponse.json({ error: err.message, ...err.details }, { status: err.status })\n  }\n  const errObj = err as Record<string, unknown>\n  if (typeof errObj?.status === 'number' && typeof errObj?.error === 'string') {\n    return NextResponse.json({ error: errObj.error }, { status: errObj.status as number })\n  }\n  console.error(`[${context}]`, err)\n  return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Orders',\n  summary: 'CPQ orders',\n  methods: {\n    POST: {\n      summary: 'Convert a CPQ quote into an order',\n      description:\n        'Creates the sales order and CPQ order configuration from the quote. Refused for cancelled or rejected quotes; mutation guards (resource kind `cpq.quote`, action `convert_to_order`) run first.',\n      requestBody: { schema: cpqConvertQuoteToOrderSchema },\n      responses: [{ status: 201, description: 'Created order' }],\n      errors: [\n        cpqErrorDoc(400, 'Validation error'),\n        cpqErrorDoc(404, 'Quote not found'),\n        cpqErrorDoc(409, 'Quote cannot be converted in its status or is already converted'),\n        cpqErrorDoc(422, 'Quote has no lines or has invalid stored adjustments, or blocked by a mutation guard'),\n      ],\n    },\n    GET: {\n      summary: 'List CPQ orders',\n      query: z.object({\n        customerId: z.string().uuid().optional(),\n        sourceQuoteId: z.string().uuid().optional(),\n        salesOrderId: z.string().uuid().optional(),\n        cpqStatus: z.string().optional(),\n        currencyCode: z.string().optional(),\n        search: z.string().optional(),\n        sortField: z.enum(['createdAt', 'updatedAt', 'cpqStatus', 'activatedAt', 'currencyCode']).optional(),\n        sortDir: z.enum(['asc', 'desc']).optional(),\n        page: z.coerce.number().int().min(1).optional(),\n        pageSize: z.coerce.number().int().min(1).max(100).optional(),\n      }),\n      responses: [{ status: 200, description: 'Paged list of CPQ orders' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,SAAS,yBAAyB,4BAA4B;AAE9D,SAAS,mBAAmB;AAErB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,OAAO,6BAA6B,MAAM,MAAM,IAAI,KAAK,CAAC;AAChE,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAI3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,IAChD,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,oBAAoB,KAAK,SAAS,KAAK;AACpE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,iBAAiB;AAAA,EAC3C;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAC3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,sBAAsB,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc;AACjG,UAAM,iBAAiB,IAAI,aAAa,IAAI,WAAW,KAAK;AAC5D,UAAM,YAAa,oBAA0C,SAAS,cAAc,IAC/E,iBACD;AACJ,UAAM,UAAU,IAAI,aAAa,IAAI,SAAS,MAAM,QAAQ,QAAQ;AAEpE,UAAM,UAAU;AAAA,MACd,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,MAClD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,MACxD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,MAChD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,MACtD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,MAAM,IAAI,aAAa,IAAI,MAAM,IAAI,OAAO,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI;AAAA,MAC5E,UAAU,IAAI,aAAa,IAAI,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,UAAU,CAAC,IAAI;AAAA,IAC1F;AAEA,UAAM,UAAU,IAAI,UAAU,QAAQ,iBAAiB;AACvD,UAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,KAAK;AACtD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,YAAY,KAAK,gBAAgB;AAAA,EAC1C;AACF;AAEA,SAAS,YAAY,KAAc,SAAiB;AAClD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,aAAa,GAAG,GAAG;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,IAAI,SAAS,GAAG,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EACzF;AACA,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAU;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAiB,CAAC;AAAA,EACvF;AACA,UAAQ,MAAM,IAAI,OAAO,KAAK,GAAG;AACjC,SAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,6BAA6B;AAAA,MACpD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,CAAC;AAAA,MACzD,QAAQ;AAAA,QACN,YAAY,KAAK,kBAAkB;AAAA,QACnC,YAAY,KAAK,iBAAiB;AAAA,QAClC,YAAY,KAAK,iEAAiE;AAAA,QAClF,YAAY,KAAK,sFAAsF;AAAA,MACzG;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QACvC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QAC1C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QACzC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,QAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,QAC5B,WAAW,EAAE,KAAK,CAAC,aAAa,aAAa,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,QACnG,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,QAC1C,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,QAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC7D,CAAC;AAAA,MACD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/restore/route.js

@@ -0,0 +1,54 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../../../context.js";
+import { isQuotingError } from "../../../../../../services/cpqQuotingService.js";
+import { resolveQuotingService } from "../../../../../resolveQuotingService.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS } from "../../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
+};
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, lineId } = await params;
+    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "update",
+      mutationPayload: { quoteId, restore: true }
+    });
+    if (!guard.ok) return guard.response;
+    const service = resolveQuotingService(ctx);
+    const result = await service.restoreQuoteItem(quoteId, lineId, scope);
+    await guard.runAfterSuccess();
+    return NextResponse.json(result);
+  } catch (err) {
+    if (isQuotingError(err)) {
+      return NextResponse.json({ error: err.message }, { status: err.status });
+    }
+    console.error("[cpq/quotes/[quoteId]/items/[lineId]/restore.POST]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "Restore a subscription item marked for removal",
+  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Restore a removed subscription item on an Amend / Renew quote",
+      description: "Turns a `cancel` line that mirrors a live subscription item back into a `modify` line, rebuilt from the item (configuration, quantity, stored price). Its cancelled mirrored components are restored with it. 409 when the line is not a removed item, its parent is still removed, or the item is no longer active. Mutation guards run first (resource kind `cpq.quote_line`, update).",
+      responses: [{ status: 200, description: "Quote after the restore" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400)
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/restore/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/%5BlineId%5D/restore/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../../context'\nimport { isQuotingError } from '../../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../../resolveQuotingService'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS } from '../../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'update',\n      mutationPayload: { quoteId, restore: true },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.restoreQuoteItem(quoteId, lineId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId]/restore.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'Restore a subscription item marked for removal',\n  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Restore a removed subscription item on an Amend / Renew quote',\n      description:\n        'Turns a `cancel` line that mirrors a live subscription item back into a `modify` line, rebuilt from the item (configuration, quantity, stored price). Its cancelled mirrored components are restored with it. 409 when the line is not a removed item, its parent is still removed, or the item is no longer active. Mutation guards run first (resource kind `cpq.quote_line`, update).',\n      responses: [{ status: 200, description: 'Quote after the restore' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400),\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,gCAAgC;AAElC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6D;AAC7G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,SAAS,KAAK;AAAA,IAC5C,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,QAAQ,KAAK;AACpE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,sDAAsD,GAAG;AACvE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9E,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,CAAC;AAAA,MACnE,QAAQ,yBAAyB,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG;AAAA,IACrE;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/route.js

@@ -4,6 +4,8 @@ import { resolveCpqRouteContext } from "../../../../context.js";
 import { cpqUpdateQuoteItemSchema } from "../../../../../data/validators.js";
 import { isQuotingError } from "../../../../../services/cpqQuotingService.js";
 import { resolveQuotingService } from "../../../../resolveQuotingService.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS } from "../../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   PUT: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] },
   DELETE: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
@@ -15,8 +17,17 @@ async function PUT(req, { params }) {
     const { quoteId, lineId } = await params;
     const body = cpqUpdateQuoteItemSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "update",
+      mutationPayload: { quoteId, ...body }
+    });
+    if (!guard.ok) return guard.response;
+    const effective = guard.modifiedPayload ? cpqUpdateQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload }) : body;
     const service = resolveQuotingService(ctx);
-    const result = await service.updateQuoteItem(quoteId, lineId, body, scope);
+    const result = await service.updateQuoteItem(quoteId, lineId, effective, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (err instanceof z.ZodError) {
@@ -35,8 +46,16 @@ async function DELETE(req, { params }) {
     if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const { quoteId, lineId } = await params;
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "delete",
+      mutationPayload: { quoteId }
+    });
+    if (!guard.ok) return guard.response;
     const service = resolveQuotingService(ctx);
     const result = await service.removeQuoteItem(quoteId, lineId, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (isQuotingError(err)) {
@@ -46,9 +65,30 @@ async function DELETE(req, { params }) {
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote line",
+  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),
+  methods: {
+    PUT: {
+      summary: "Update a quote line (configuration, quantity, term)",
+      description: "Re-prices the line unless it is a frozen Amend mirror line whose pricing inputs are unchanged. Mutation guards run first (resource kind `cpq.quote_line`, update). `_arc*` configuration keys are server-owned and ignored.",
+      requestBody: { schema: cpqUpdateQuoteItemSchema },
+      responses: [{ status: 200, description: "Quote after the update" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS
+    },
+    DELETE: {
+      summary: "Remove a quote line",
+      description: "On an Amend / Renew quote, a line mirroring a live subscription item is not deleted: it (and its mirrored components) becomes a `cancel` line with zero totals, and activation terminates the item; lines this quote added under it are deleted. 409 when the item is already marked for removal \u2014 use `POST .../restore` to undo. Other lines are deleted with their descendants. Mutation guards run first (resource kind `cpq.quote_line`, delete).",
+      responses: [{ status: 200, description: "Quote after the removal" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400)
+    }
+  }
+};
 export {
   DELETE,
   PUT,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map