@dainamite/cpq 0.5.0 → 0.7.0

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/route.js

@@ -4,6 +4,8 @@ import { resolveCpqRouteContext } from "../../../../context.js";
 import { cpqUpdateQuoteItemSchema } from "../../../../../data/validators.js";
 import { isQuotingError } from "../../../../../services/cpqQuotingService.js";
 import { resolveQuotingService } from "../../../../resolveQuotingService.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS } from "../../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   PUT: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] },
   DELETE: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
@@ -15,8 +17,17 @@ async function PUT(req, { params }) {
     const { quoteId, lineId } = await params;
     const body = cpqUpdateQuoteItemSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "update",
+      mutationPayload: { quoteId, ...body }
+    });
+    if (!guard.ok) return guard.response;
+    const effective = guard.modifiedPayload ? cpqUpdateQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload }) : body;
     const service = resolveQuotingService(ctx);
-    const result = await service.updateQuoteItem(quoteId, lineId, body, scope);
+    const result = await service.updateQuoteItem(quoteId, lineId, effective, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (err instanceof z.ZodError) {
@@ -35,8 +46,16 @@ async function DELETE(req, { params }) {
     if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     const { quoteId, lineId } = await params;
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      resourceId: lineId,
+      operation: "delete",
+      mutationPayload: { quoteId }
+    });
+    if (!guard.ok) return guard.response;
     const service = resolveQuotingService(ctx);
     const result = await service.removeQuoteItem(quoteId, lineId, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (isQuotingError(err)) {
@@ -46,9 +65,30 @@ async function DELETE(req, { params }) {
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote line",
+  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),
+  methods: {
+    PUT: {
+      summary: "Update a quote line (configuration, quantity, term)",
+      description: "Re-prices the line unless it is a frozen Amend mirror line whose pricing inputs are unchanged. Mutation guards run first (resource kind `cpq.quote_line`, update). `_arc*` configuration keys are server-owned and ignored.",
+      requestBody: { schema: cpqUpdateQuoteItemSchema },
+      responses: [{ status: 200, description: "Quote after the update" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS
+    },
+    DELETE: {
+      summary: "Remove a quote line",
+      description: "On an Amend / Renew quote, a line mirroring a live subscription item is not deleted: it (and its mirrored components) becomes a `cancel` line with zero totals, and activation terminates the item; lines this quote added under it are deleted. 409 when the item is already marked for removal \u2014 use `POST .../restore` to undo. Other lines are deleted with their descendants. Mutation guards run first (resource kind `cpq.quote_line`, delete).",
+      responses: [{ status: 200, description: "Quote after the removal" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400)
+    }
+  }
+};
 export {
   DELETE,
   PUT,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/[lineId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/%5BlineId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqUpdateQuoteItemSchema } from '../../../../../data/validators'\nimport { isQuotingError } from '../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../resolveQuotingService'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const body = cpqUpdateQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.updateQuoteItem(quoteId, lineId, body, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].PUT]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.removeQuoteItem(quoteId, lineId, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].DELETE]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AAE/B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6D;AAC5G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,yBAAyB,MAAM,MAAM,IAAI,KAAK,CAAC;AAC5D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,MAAM,KAAK;AACzE,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA6D;AAC/G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,KAAK;AACnE,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqUpdateQuoteItemSchema } from '../../../../../data/validators'\nimport { isQuotingError } from '../../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../../resolveQuotingService'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const body = cpqUpdateQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'update',\n      mutationPayload: { quoteId, ...body },\n    })\n    if (!guard.ok) return guard.response\n    const effective = guard.modifiedPayload\n      ? cpqUpdateQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload })\n      : body\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.updateQuoteItem(quoteId, lineId, effective, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].PUT]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: Promise<{ quoteId: string; lineId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId, lineId } = await params\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      resourceId: lineId,\n      operation: 'delete',\n      mutationPayload: { quoteId },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.removeQuoteItem(quoteId, lineId, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/items/[lineId].DELETE]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote line',\n  pathParams: z.object({ quoteId: z.string().uuid(), lineId: z.string().uuid() }),\n  methods: {\n    PUT: {\n      summary: 'Update a quote line (configuration, quantity, term)',\n      description:\n        'Re-prices the line unless it is a frozen Amend mirror line whose pricing inputs are unchanged. Mutation guards run first (resource kind `cpq.quote_line`, update). `_arc*` configuration keys are server-owned and ignored.',\n      requestBody: { schema: cpqUpdateQuoteItemSchema },\n      responses: [{ status: 200, description: 'Quote after the update' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS,\n    },\n    DELETE: {\n      summary: 'Remove a quote line',\n      description:\n        'On an Amend / Renew quote, a line mirroring a live subscription item is not deleted: it (and its mirrored components) becomes a `cancel` line with zero totals, and activation terminates the item; lines this quote added under it are deleted. 409 when the item is already marked for removal \u2014 use `POST .../restore` to undo. Other lines are deleted with their descendants. Mutation guards run first (resource kind `cpq.quote_line`, delete).',\n      responses: [{ status: 200, description: 'Quote after the removal' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS.filter((doc) => doc.status !== 400),\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,gCAAgC;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA6D;AAC5G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,yBAAyB,MAAM,MAAM,IAAI,KAAK,CAAC;AAC5D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,IACtC,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAC5B,UAAM,YAAY,MAAM,kBACpB,yBAAyB,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,gBAAgB,CAAC,IACpE;AAEJ,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,WAAW,KAAK;AAC9E,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA6D;AAC/G,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ;AAAA,IAC7B,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,QAAQ,KAAK;AACnE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9E,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,yBAAyB,CAAC;AAAA,MAClE,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,CAAC;AAAA,MACnE,QAAQ,yBAAyB,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG;AAAA,IACrE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/items/route.js

@@ -3,6 +3,8 @@ import { resolveCpqRouteContext } from "../../../context.js";
 import { cpqAddQuoteItemSchema } from "../../../../data/validators.js";
 import { resolveQuotingService } from "../../../resolveQuotingService.js";
 import { handleArcError } from "../../../_helpers/handleArcError.js";
+import { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from "../../../_helpers/quoteMutationGuard.js";
+import { CPQ_GUARDED_WRITE_ERRORS, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
 };
@@ -13,15 +15,38 @@ async function POST(req, { params }) {
     const { quoteId } = await params;
     const body = cpqAddQuoteItemSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,
+      operation: "create",
+      mutationPayload: { quoteId, ...body }
+    });
+    if (!guard.ok) return guard.response;
+    const effective = guard.modifiedPayload ? cpqAddQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload }) : body;
     const service = resolveQuotingService(ctx);
-    const result = await service.addQuoteItem(quoteId, body, scope);
+    const result = await service.addQuoteItem(quoteId, effective, scope);
+    await guard.runAfterSuccess();
     return NextResponse.json(result, { status: 201 });
   } catch (err) {
     return handleArcError(err, "cpq/quotes/[quoteId]/items.POST");
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote lines",
+  pathParams: cpqQuoteIdPathParams,
+  methods: {
+    POST: {
+      summary: "Add a configured line to a CPQ quote",
+      description: "Prices the line and recalculates the quote. Mutation guards run first (resource kind `cpq.quote_line`, create). `_arc*` configuration keys are server-owned and ignored.",
+      requestBody: { schema: cpqAddQuoteItemSchema },
+      responses: [{ status: 201, description: "Quote after the line was added" }],
+      errors: CPQ_GUARDED_WRITE_ERRORS
+    }
+  }
+};
 export {
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/items/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/items/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqAddQuoteItemSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqAddQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.addQuoteItem(quoteId, body, scope)\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/items.POST')\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAExB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI,KAAK,CAAC;AACzD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,aAAa,SAAS,MAAM,KAAK;AAC9D,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,iCAAiC;AAAA,EAC9D;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqAddQuoteItemSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\nimport { CPQ_QUOTE_LINE_RESOURCE_KIND, runCpqMutationGuards } from '../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CPQ_GUARDED_WRITE_ERRORS, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqAddQuoteItemSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_LINE_RESOURCE_KIND,\n      operation: 'create',\n      mutationPayload: { quoteId, ...body },\n    })\n    if (!guard.ok) return guard.response\n    const effective = guard.modifiedPayload\n      ? cpqAddQuoteItemSchema.parse({ ...body, ...guard.modifiedPayload })\n      : body\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.addQuoteItem(quoteId, effective, scope)\n    await guard.runAfterSuccess()\n    return NextResponse.json(result, { status: 201 })\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/items.POST')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote lines',\n  pathParams: cpqQuoteIdPathParams,\n  methods: {\n    POST: {\n      summary: 'Add a configured line to a CPQ quote',\n      description:\n        'Prices the line and recalculates the quote. Mutation guards run first (resource kind `cpq.quote_line`, create). `_arc*` configuration keys are server-owned and ignored.',\n      requestBody: { schema: cpqAddQuoteItemSchema },\n      responses: [{ status: 201, description: 'Quote after the line was added' }],\n      errors: CPQ_GUARDED_WRITE_ERRORS,\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,8BAA8B,4BAA4B;AAEnE,SAAS,0BAA0B,4BAA4B;AAExD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI,KAAK,CAAC;AACzD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,WAAW;AAAA,MACX,iBAAiB,EAAE,SAAS,GAAG,KAAK;AAAA,IACtC,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAC5B,UAAM,YAAY,MAAM,kBACpB,sBAAsB,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,gBAAgB,CAAC,IACjE;AAEJ,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,aAAa,SAAS,WAAW,KAAK;AACnE,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,iCAAiC;AAAA,EAC9D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,sBAAsB;AAAA,MAC7C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iCAAiC,CAAC;AAAA,MAC1E,QAAQ;AAAA,IACV;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/[adjustmentId]/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../../context.js";
+import { cpqPriceAdjustmentPatchSchema } from "../../../../../data/price-adjustments.js";
+import { adjustmentCommandRoute } from "../../../../_helpers/adjustmentCommandRoute.js";
+import { handleArcError } from "../../../../_helpers/handleArcError.js";
+import { cpqErrorDoc } from "../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  PATCH: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] },
+  DELETE: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] }
+};
+const pathParams = z.object({ quoteId: z.string().uuid(), adjustmentId: z.string().uuid() });
+const deletionSchema = z.object({ expectedRevision: z.coerce.number().int().min(0).optional() }).strict();
+async function PATCH(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, adjustmentId } = pathParams.parse(await params);
+    const body = cpqPriceAdjustmentPatchSchema.parse(await req.json());
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentPatchSchema, "update", adjustmentId);
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.PATCH");
+  }
+}
+async function DELETE(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId, adjustmentId } = pathParams.parse(await params);
+    const body = deletionSchema.parse(Object.fromEntries(new URL(req.url).searchParams));
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, deletionSchema, "delete", adjustmentId);
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.DELETE");
+  }
+}
+const errors = [cpqErrorDoc(400, "Invalid input"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote or adjustment not found"), cpqErrorDoc(409, "Adjustment locked, stale revision or changed undo target"), cpqErrorDoc(422, "Invalid adjustment or guard rejection")];
+const openApi = { tag: "CPQ Quotes", pathParams, methods: {
+  PATCH: { summary: "Update a negotiated quote price adjustment", requestBody: { schema: cpqPriceAdjustmentPatchSchema }, responses: [{ status: 200, description: "Adjustment and updated quote" }], errors },
+  DELETE: { summary: "Remove a negotiated quote price adjustment", query: deletionSchema, responses: [{ status: 200, description: "Updated quote" }], errors }
+} };
+export {
+  DELETE,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/[adjustmentId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/%5BadjustmentId%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqPriceAdjustmentPatchSchema } from '../../../../../data/price-adjustments'\nimport { adjustmentCommandRoute } from '../../../../_helpers/adjustmentCommandRoute'\nimport { handleArcError } from '../../../../_helpers/handleArcError'\nimport { cpqErrorDoc } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n  DELETE: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n}\nconst pathParams = z.object({ quoteId: z.string().uuid(), adjustmentId: z.string().uuid() })\nconst deletionSchema = z.object({ expectedRevision: z.coerce.number().int().min(0).optional() }).strict()\ntype Params = { params: Promise<{ quoteId: string; adjustmentId: string }> }\nexport async function PATCH(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId, adjustmentId } = pathParams.parse(await params)\n    const body = cpqPriceAdjustmentPatchSchema.parse(await req.json())\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentPatchSchema, 'update', adjustmentId)\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.PATCH') }\n}\nexport async function DELETE(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId, adjustmentId } = pathParams.parse(await params)\n    const body = deletionSchema.parse(Object.fromEntries(new URL(req.url).searchParams))\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, deletionSchema, 'delete', adjustmentId)\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.DELETE') }\n}\nconst errors = [cpqErrorDoc(400, 'Invalid input'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote or adjustment not found'), cpqErrorDoc(409, 'Adjustment locked, stale revision or changed undo target'), cpqErrorDoc(422, 'Invalid adjustment or guard rejection')]\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams, methods: {\n  PATCH: { summary: 'Update a negotiated quote price adjustment', requestBody: { schema: cpqPriceAdjustmentPatchSchema }, responses: [{ status: 200, description: 'Adjustment and updated quote' }], errors },\n  DELETE: { summary: 'Remove a negotiated quote price adjustment', query: deletionSchema, responses: [{ status: 200, description: 'Updated quote' }], errors },\n} }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAC9C,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,mBAAmB;AAErB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AAAA,EAC9F,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AACjG;AACA,MAAM,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3F,MAAM,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AAExG,eAAsB,MAAM,KAAc,EAAE,OAAO,GAAW;AAC5D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,SAAS,aAAa,IAAI,WAAW,MAAM,MAAM,MAAM;AAC/D,UAAM,OAAO,8BAA8B,MAAM,MAAM,IAAI,KAAK,CAAC;AACjE,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,+BAA+B,UAAU,YAAY;AAAA,EACpH,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,6BAA6B;AAAA,EAAE;AAChF;AACA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAAW;AAC7D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,SAAS,aAAa,IAAI,WAAW,MAAM,MAAM,MAAM;AAC/D,UAAM,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AACnF,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,gBAAgB,UAAU,YAAY;AAAA,EACrG,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,8BAA8B;AAAA,EAAE;AACjF;AACA,MAAM,SAAS,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,+BAA+B,GAAG,YAAY,KAAK,0DAA0D,GAAG,YAAY,KAAK,uCAAuC,CAAC;AAClS,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,SAAS;AAAA,EAChF,OAAO,EAAE,SAAS,8CAA8C,aAAa,EAAE,QAAQ,8BAA8B,GAAG,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,CAAC,GAAG,OAAO;AAAA,EAC1M,QAAQ,EAAE,SAAS,8CAA8C,OAAO,gBAAgB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,CAAC,GAAG,OAAO;AAC7J,EAAE;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/preview/route.js

@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server";
+import { resolveCpqRouteContext } from "../../../../context.js";
+import { cpqPriceAdjustmentPreviewSchema } from "../../../../../data/price-adjustments.js";
+import { handleArcError } from "../../../../_helpers/handleArcError.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../../_helpers/quoteRouteOpenApi.js";
+const metadata = { POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] } };
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const body = cpqPriceAdjustmentPreviewSchema.parse(await req.json());
+    const service = ctx.container.resolve("cpqAdjustmentService");
+    return NextResponse.json(await service.preview(quoteId, body.draft, body.replaceAdjustmentId, { tenantId: ctx.tenantId, organizationId: ctx.organizationId }));
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments/preview.POST");
+  }
+}
+const openApi = { tag: "CPQ Quotes", pathParams: cpqQuoteIdPathParams, methods: { POST: {
+  summary: "Preview a draft adjustment without saving or emitting events",
+  requestBody: { schema: cpqPriceAdjustmentPreviewSchema },
+  responses: [{ status: 200, description: "Draft quote and adjustment errors; nothing persisted" }],
+  errors: [cpqErrorDoc(400, "Invalid draft"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote, line or replaced adjustment not found"), cpqErrorDoc(409, "Adjustment locked or stale revision"), cpqErrorDoc(422, "Ineligible target or invalid reason")]
+} } };
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/preview/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/preview/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../../context'\nimport { cpqPriceAdjustmentPreviewSchema } from '../../../../../data/price-adjustments'\nimport type { CpqAdjustmentService } from '../../../../../services/priceAdjustments/adjustmentService'\nimport { handleArcError } from '../../../../_helpers/handleArcError'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = { POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] } }\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const body = cpqPriceAdjustmentPreviewSchema.parse(await req.json())\n    const service = ctx.container.resolve<CpqAdjustmentService>('cpqAdjustmentService')\n    return NextResponse.json(await service.preview(quoteId, body.draft, body.replaceAdjustmentId, { tenantId: ctx.tenantId, organizationId: ctx.organizationId }))\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments/preview.POST') }\n}\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams: cpqQuoteIdPathParams, methods: { POST: {\n  summary: 'Preview a draft adjustment without saving or emitting events', requestBody: { schema: cpqPriceAdjustmentPreviewSchema },\n  responses: [{ status: 200, description: 'Draft quote and adjustment errors; nothing persisted' }],\n  errors: [cpqErrorDoc(400, 'Invalid draft'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote, line or replaced adjustment not found'), cpqErrorDoc(409, 'Adjustment locked or stale revision'), cpqErrorDoc(422, 'Ineligible target or invalid reason')],\n} } }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAEhD,SAAS,sBAAsB;AAC/B,SAAS,aAAa,4BAA4B;AAE3C,MAAM,WAAW,EAAE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE,EAAE;AACzH,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,OAAO,gCAAgC,MAAM,MAAM,IAAI,KAAK,CAAC;AACnE,UAAM,UAAU,IAAI,UAAU,QAA8B,sBAAsB;AAClF,WAAO,aAAa,KAAK,MAAM,QAAQ,QAAQ,SAAS,KAAK,OAAO,KAAK,qBAAqB,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/J,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,oCAAoC;AAAA,EAAE;AACvF;AACO,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,sBAAsB,SAAS,EAAE,MAAM;AAAA,EAC9G,SAAS;AAAA,EAAgE,aAAa,EAAE,QAAQ,gCAAgC;AAAA,EAChI,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uDAAuD,CAAC;AAAA,EAChG,QAAQ,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,8CAA8C,GAAG,YAAY,KAAK,qCAAqC,GAAG,YAAY,KAAK,qCAAqC,CAAC;AAC5R,EAAE,EAAE;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveCpqRouteContext } from "../../../context.js";
+import { cpqPriceAdjustmentInputSchema } from "../../../../data/price-adjustments.js";
+import { adjustmentCommandRoute } from "../../../_helpers/adjustmentCommandRoute.js";
+import { handleArcError } from "../../../_helpers/handleArcError.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["cpq.quotes.view"] },
+  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage", "cpq.quotes.adjust_price"] }
+};
+const listQuery = z.object({ page: z.coerce.number().int().min(1).default(1), pageSize: z.coerce.number().int().min(1).max(100).default(25) });
+async function GET(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const { page, pageSize } = listQuery.parse(Object.fromEntries(new URL(req.url).searchParams));
+    const service = ctx.container.resolve("cpqAdjustmentService");
+    return NextResponse.json(await service.list(quoteId, { organizationId: ctx.organizationId, tenantId: ctx.tenantId }, page, pageSize));
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.GET");
+  }
+}
+async function POST(req, { params }) {
+  try {
+    const ctx = await resolveCpqRouteContext(req);
+    if (!ctx.auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const { quoteId } = cpqQuoteIdPathParams.parse(await params);
+    const body = cpqPriceAdjustmentInputSchema.parse(await req.json());
+    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentInputSchema, "create");
+  } catch (error) {
+    return handleArcError(error, "cpq/price-adjustments.POST");
+  }
+}
+const errors = [cpqErrorDoc(400, "Invalid input"), cpqErrorDoc(403, "Missing permission or disabled feature"), cpqErrorDoc(404, "Quote not found"), cpqErrorDoc(409, "Adjustment locked or stale revision"), cpqErrorDoc(422, "Invalid adjustment or guard rejection")];
+const openApi = { tag: "CPQ Quotes", pathParams: cpqQuoteIdPathParams, methods: {
+  GET: { summary: "List quote price adjustments", query: listQuery, responses: [{ status: 200, description: "Paged adjustments, pricing revision, feature state and the reason options (`reasons: [{ value, label }]`)" }], errors },
+  POST: { summary: "Create a negotiated quote price adjustment", requestBody: { schema: cpqPriceAdjustmentInputSchema }, responses: [{ status: 201, description: "Adjustment and updated quote" }], errors }
+} };
+export {
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/price-adjustments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/price-adjustments/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqPriceAdjustmentInputSchema } from '../../../../data/price-adjustments'\nimport type { CpqAdjustmentService } from '../../../../services/priceAdjustments/adjustmentService'\nimport { adjustmentCommandRoute } from '../../../_helpers/adjustmentCommandRoute'\nimport { handleArcError } from '../../../_helpers/handleArcError'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage', 'cpq.quotes.adjust_price'] },\n}\nconst listQuery = z.object({ page: z.coerce.number().int().min(1).default(1), pageSize: z.coerce.number().int().min(1).max(100).default(25) })\ntype Params = { params: Promise<{ quoteId: string }> }\nexport async function GET(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const { page, pageSize } = listQuery.parse(Object.fromEntries(new URL(req.url).searchParams))\n    const service = ctx.container.resolve<CpqAdjustmentService>('cpqAdjustmentService')\n    return NextResponse.json(await service.list(quoteId, { organizationId: ctx.organizationId, tenantId: ctx.tenantId }, page, pageSize))\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.GET') }\n}\nexport async function POST(req: Request, { params }: Params) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const { quoteId } = cpqQuoteIdPathParams.parse(await params)\n    const body = cpqPriceAdjustmentInputSchema.parse(await req.json())\n    return await adjustmentCommandRoute(req, ctx, quoteId, body, cpqPriceAdjustmentInputSchema, 'create')\n  } catch (error) { return handleArcError(error, 'cpq/price-adjustments.POST') }\n}\nconst errors = [cpqErrorDoc(400, 'Invalid input'), cpqErrorDoc(403, 'Missing permission or disabled feature'), cpqErrorDoc(404, 'Quote not found'), cpqErrorDoc(409, 'Adjustment locked or stale revision'), cpqErrorDoc(422, 'Invalid adjustment or guard rejection')]\nexport const openApi: OpenApiRouteDoc = { tag: 'CPQ Quotes', pathParams: cpqQuoteIdPathParams, methods: {\n  GET: { summary: 'List quote price adjustments', query: listQuery, responses: [{ status: 200, description: 'Paged adjustments, pricing revision, feature state and the reason options (`reasons: [{ value, label }]`)' }], errors },\n  POST: { summary: 'Create a negotiated quote price adjustment', requestBody: { schema: cpqPriceAdjustmentInputSchema }, responses: [{ status: 201, description: 'Adjustment and updated quote' }], errors },\n} }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAE9C,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,aAAa,4BAA4B;AAE3C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,yBAAyB,EAAE;AAC/F;AACA,MAAM,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;AAE7I,eAAsB,IAAI,KAAc,EAAE,OAAO,GAAW;AAC1D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,EAAE,MAAM,SAAS,IAAI,UAAU,MAAM,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AAC5F,UAAM,UAAU,IAAI,UAAU,QAA8B,sBAAsB;AAClF,WAAO,aAAa,KAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS,GAAG,MAAM,QAAQ,CAAC;AAAA,EACtI,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,2BAA2B;AAAA,EAAE;AAC9E;AACA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAW;AAC3D,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClF,UAAM,EAAE,QAAQ,IAAI,qBAAqB,MAAM,MAAM,MAAM;AAC3D,UAAM,OAAO,8BAA8B,MAAM,MAAM,IAAI,KAAK,CAAC;AACjE,WAAO,MAAM,uBAAuB,KAAK,KAAK,SAAS,MAAM,+BAA+B,QAAQ;AAAA,EACtG,SAAS,OAAO;AAAE,WAAO,eAAe,OAAO,4BAA4B;AAAA,EAAE;AAC/E;AACA,MAAM,SAAS,CAAC,YAAY,KAAK,eAAe,GAAG,YAAY,KAAK,wCAAwC,GAAG,YAAY,KAAK,iBAAiB,GAAG,YAAY,KAAK,qCAAqC,GAAG,YAAY,KAAK,uCAAuC,CAAC;AAC/P,MAAM,UAA2B,EAAE,KAAK,cAAc,YAAY,sBAAsB,SAAS;AAAA,EACtG,KAAK,EAAE,SAAS,gCAAgC,OAAO,WAAW,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,4GAA4G,CAAC,GAAG,OAAO;AAAA,EACjO,MAAM,EAAE,SAAS,8CAA8C,aAAa,EAAE,QAAQ,8BAA8B,GAAG,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,CAAC,GAAG,OAAO;AAC3M,EAAE;",
+  "names": []
+}

package/dist/modules/cpq/api/quotes/[quoteId]/recalculate/route.js

@@ -4,8 +4,10 @@ import { resolveCpqRouteContext } from "../../../context.js";
 import { cpqRecalculateSchema } from "../../../../data/validators.js";
 import { isQuotingError } from "../../../../services/cpqQuotingService.js";
 import { resolveQuotingService } from "../../../resolveQuotingService.js";
+import { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from "../../../_helpers/quoteMutationGuard.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
-  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.view"] }
+  POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
 };
 async function POST(req, { params }) {
   try {
@@ -14,8 +16,16 @@ async function POST(req, { params }) {
     const { quoteId } = await params;
     const body = cpqRecalculateSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = body.save ? await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_RESOURCE_KIND,
+      resourceId: quoteId,
+      operation: "custom",
+      mutationPayload: { action: "recalculate" }
+    }) : null;
+    if (guard && !guard.ok) return guard.response;
     const service = resolveQuotingService(ctx);
     const result = await service.recalculate(quoteId, body, scope);
+    if (guard) await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     if (err instanceof z.ZodError) {
@@ -28,8 +38,28 @@ async function POST(req, { params }) {
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote recalculation",
+  pathParams: cpqQuoteIdPathParams,
+  methods: {
+    POST: {
+      summary: "Re-price every line of a CPQ quote",
+      description: "Re-resolves charges and price rules. With `save: true` the result is persisted (refused on accepted, rejected and cancelled quotes) and mutation guards (resource kind `cpq.quote`, action `recalculate`) run first. Frozen Amend mirror lines keep their stored price.",
+      requestBody: { schema: cpqRecalculateSchema },
+      responses: [{ status: 200, description: "Recalculated quote" }],
+      errors: [
+        cpqErrorDoc(400, "Validation error"),
+        cpqErrorDoc(404, "Quote not found"),
+        cpqErrorDoc(409, "Saved recalculation on a terminal quote"),
+        cpqErrorDoc(422, "Blocked by a mutation guard")
+      ]
+    }
+  }
+};
 export {
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/recalculate/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/recalculate/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqRecalculateSchema } from '../../../../data/validators'\nimport { isQuotingError } from '../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.view'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqRecalculateSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.recalculate(quoteId, body, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/recalculate.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AAE/B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAClE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,qBAAqB,MAAM,MAAM,IAAI,KAAK,CAAC;AACxD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,YAAY,SAAS,MAAM,KAAK;AAC7D,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,2CAA2C,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqRecalculateSchema } from '../../../../data/validators'\nimport { isQuotingError } from '../../../../services/cpqQuotingService'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from '../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\n// Recalculation re-resolves and (with `save: true`) persists prices, so it\n// needs the same feature as any other quote write. The quote page always\n// saves; viewers read stored prices through GET /api/cpq/quotes/{quoteId}.\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqRecalculateSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    // Only a saved recalculation writes; a dry run needs no guard.\n    const guard = body.save\n      ? await runCpqMutationGuards(ctx, req, {\n          resourceKind: CPQ_QUOTE_RESOURCE_KIND,\n          resourceId: quoteId,\n          operation: 'custom',\n          mutationPayload: { action: 'recalculate' },\n        })\n      : null\n    if (guard && !guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.recalculate(quoteId, body, scope)\n    if (guard) await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation error', details: err.issues }, { status: 400 })\n    }\n    if (isQuotingError(err)) {\n      return NextResponse.json({ error: err.message }, { status: err.status })\n    }\n    console.error('[cpq/quotes/[quoteId]/recalculate.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote recalculation',\n  pathParams: cpqQuoteIdPathParams,\n  methods: {\n    POST: {\n      summary: 'Re-price every line of a CPQ quote',\n      description:\n        'Re-resolves charges and price rules. With `save: true` the result is persisted (refused on accepted, rejected and cancelled quotes) and mutation guards (resource kind `cpq.quote`, action `recalculate`) run first. Frozen Amend mirror lines keep their stored price.',\n      requestBody: { schema: cpqRecalculateSchema },\n      responses: [{ status: 200, description: 'Recalculated quote' }],\n      errors: [\n        cpqErrorDoc(400, 'Validation error'),\n        cpqErrorDoc(404, 'Quote not found'),\n        cpqErrorDoc(409, 'Saved recalculation on a terminal quote'),\n        cpqErrorDoc(422, 'Blocked by a mutation guard'),\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB,4BAA4B;AAE9D,SAAS,aAAa,4BAA4B;AAK3C,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,qBAAqB,MAAM,MAAM,IAAI,KAAK,CAAC;AACxD,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAG3E,UAAM,QAAQ,KAAK,OACf,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACnC,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ,cAAc;AAAA,IAC3C,CAAC,IACD;AACJ,QAAI,SAAS,CAAC,MAAM,GAAI,QAAO,MAAM;AAErC,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,YAAY,SAAS,MAAM,KAAK;AAC7D,QAAI,MAAO,OAAM,MAAM,gBAAgB;AACvC,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACzE;AACA,YAAQ,MAAM,2CAA2C,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,qBAAqB;AAAA,MAC5C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,CAAC;AAAA,MAC9D,QAAQ;AAAA,QACN,YAAY,KAAK,kBAAkB;AAAA,QACnC,YAAY,KAAK,iBAAiB;AAAA,QAClC,YAAY,KAAK,yCAAyC;AAAA,QAC1D,YAAY,KAAK,6BAA6B;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/[quoteId]/status/route.js

@@ -1,8 +1,11 @@
 import { NextResponse } from "next/server";
 import { resolveCpqRouteContext } from "../../../context.js";
+import { resolveAuditActor } from "../../../../lib/auditActor.js";
 import { cpqTransitionStatusSchema } from "../../../../data/validators.js";
 import { resolveQuotingService } from "../../../resolveQuotingService.js";
 import { handleArcError } from "../../../_helpers/handleArcError.js";
+import { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from "../../../_helpers/quoteMutationGuard.js";
+import { cpqErrorDoc, cpqQuoteIdPathParams } from "../../../_helpers/quoteRouteOpenApi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.quotes.manage"] }
 };
@@ -13,15 +16,43 @@ async function POST(req, { params }) {
     const { quoteId } = await params;
     const body = cpqTransitionStatusSchema.parse(await req.json());
     const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId };
+    const guard = await runCpqMutationGuards(ctx, req, {
+      resourceKind: CPQ_QUOTE_RESOURCE_KIND,
+      resourceId: quoteId,
+      operation: "custom",
+      mutationPayload: { action: "transition_status", targetStatus: body.targetStatus }
+    });
+    if (!guard.ok) return guard.response;
     const service = resolveQuotingService(ctx);
-    const result = await service.transitionStatus(quoteId, body.targetStatus, scope);
+    const result = await service.transitionStatus(quoteId, body.targetStatus, scope, resolveAuditActor(ctx.auth));
+    await guard.runAfterSuccess();
     return NextResponse.json(result);
   } catch (err) {
     return handleArcError(err, "cpq/quotes/[quoteId]/status.POST");
   }
 }
+const openApi = {
+  tag: "CPQ Quotes",
+  summary: "CPQ quote status",
+  pathParams: cpqQuoteIdPathParams,
+  methods: {
+    POST: {
+      summary: "Transition a CPQ quote to another status",
+      description: "Operator-driven status change. Registered mutation guards (resource kind `cpq.quote`, action `transition_status`) run first \u2014 projects use them to enforce approvals.",
+      requestBody: { schema: cpqTransitionStatusSchema },
+      responses: [{ status: 200, description: "Quote with its new status" }],
+      errors: [
+        cpqErrorDoc(400, "Validation error"),
+        cpqErrorDoc(404, "Quote not found"),
+        cpqErrorDoc(409, "Transition not allowed"),
+        cpqErrorDoc(422, "ARC validation failed or blocked by a mutation guard")
+      ]
+    }
+  }
+};
 export {
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/cpq/api/quotes/[quoteId]/status/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/cpq/api/quotes/%5BquoteId%5D/status/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { cpqTransitionStatusSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqTransitionStatusSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.transitionStatus(quoteId, body.targetStatus, scope)\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/status.POST')\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAExB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,0BAA0B,MAAM,MAAM,IAAI,KAAK,CAAC;AAC7D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAE3E,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,KAAK,cAAc,KAAK;AAC/E,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,kCAAkC;AAAA,EAC/D;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveCpqRouteContext } from '../../../context'\nimport { resolveAuditActor } from '../../../../lib/auditActor'\nimport { cpqTransitionStatusSchema } from '../../../../data/validators'\nimport { resolveQuotingService } from '../../../resolveQuotingService'\nimport { handleArcError } from '../../../_helpers/handleArcError'\nimport { CPQ_QUOTE_RESOURCE_KIND, runCpqMutationGuards } from '../../../_helpers/quoteMutationGuard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { cpqErrorDoc, cpqQuoteIdPathParams } from '../../../_helpers/quoteRouteOpenApi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['cpq.quotes.manage'] },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ quoteId: string }> }) {\n  try {\n    const ctx = await resolveCpqRouteContext(req)\n    if (!ctx.auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n    const { quoteId } = await params\n    const body = cpqTransitionStatusSchema.parse(await req.json())\n    const scope = { organizationId: ctx.organizationId, tenantId: ctx.tenantId }\n\n    // Projects enforce approval rules here (e.g. block `ready \u2192 with_customer`\n    // until a discounted quote is approved).\n    const guard = await runCpqMutationGuards(ctx, req, {\n      resourceKind: CPQ_QUOTE_RESOURCE_KIND,\n      resourceId: quoteId,\n      operation: 'custom',\n      mutationPayload: { action: 'transition_status', targetStatus: body.targetStatus },\n    })\n    if (!guard.ok) return guard.response\n\n    const service = resolveQuotingService(ctx)\n    const result = await service.transitionStatus(quoteId, body.targetStatus, scope, resolveAuditActor(ctx.auth))\n    await guard.runAfterSuccess()\n    return NextResponse.json(result)\n  } catch (err) {\n    return handleArcError(err, 'cpq/quotes/[quoteId]/status.POST')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CPQ Quotes',\n  summary: 'CPQ quote status',\n  pathParams: cpqQuoteIdPathParams,\n  methods: {\n    POST: {\n      summary: 'Transition a CPQ quote to another status',\n      description:\n        'Operator-driven status change. Registered mutation guards (resource kind `cpq.quote`, action `transition_status`) run first \u2014 projects use them to enforce approvals.',\n      requestBody: { schema: cpqTransitionStatusSchema },\n      responses: [{ status: 200, description: 'Quote with its new status' }],\n      errors: [\n        cpqErrorDoc(400, 'Validation error'),\n        cpqErrorDoc(404, 'Quote not found'),\n        cpqErrorDoc(409, 'Transition not allowed'),\n        cpqErrorDoc(422, 'ARC validation failed or blocked by a mutation guard'),\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB,4BAA4B;AAE9D,SAAS,aAAa,4BAA4B;AAE3C,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA6C;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,uBAAuB,GAAG;AAC5C,QAAI,CAAC,IAAI,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElF,UAAM,EAAE,QAAQ,IAAI,MAAM;AAC1B,UAAM,OAAO,0BAA0B,MAAM,MAAM,IAAI,KAAK,CAAC;AAC7D,UAAM,QAAQ,EAAE,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS;AAI3E,UAAM,QAAQ,MAAM,qBAAqB,KAAK,KAAK;AAAA,MACjD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,QAAQ,qBAAqB,cAAc,KAAK,aAAa;AAAA,IAClF,CAAC;AACD,QAAI,CAAC,MAAM,GAAI,QAAO,MAAM;AAE5B,UAAM,UAAU,sBAAsB,GAAG;AACzC,UAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,KAAK,cAAc,OAAO,kBAAkB,IAAI,IAAI,CAAC;AAC5G,UAAM,MAAM,gBAAgB;AAC5B,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,eAAe,KAAK,kCAAkC;AAAA,EAC/D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,0BAA0B;AAAA,MACjD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,4BAA4B,CAAC;AAAA,MACrE,QAAQ;AAAA,QACN,YAAY,KAAK,kBAAkB;AAAA,QACnC,YAAY,KAAK,iBAAiB;AAAA,QAClC,YAAY,KAAK,wBAAwB;AAAA,QACzC,YAAY,KAAK,sDAAsD;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/cpq/api/quotes/price/route.js

@@ -1,8 +1,10 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { cpqErrorDoc } from "../../_helpers/quoteRouteOpenApi.js";
 import { resolveCpqRouteContext } from "../../context.js";
 import { cpqPricePreviewSchema } from "../../../data/validators.js";
 import { getBaseCurrencyCode } from "../../../services/types.js";
+import { withChargeWaterfall, withoutChargeWaterfall } from "../../../services/priceAdjustments/chargeWaterfall.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["cpq.quotes.view"] }
 };
@@ -48,9 +50,10 @@ async function POST(req) {
       unitPrice: c.unitPrice,
       note: c.note ?? "Usage-based charge \u2014 billed on actual consumption."
     }));
+    const presentCharge = body.includeWaterfall ? withChargeWaterfall : withoutChargeWaterfall;
     return NextResponse.json({
-      primaryCharges,
-      childItems,
+      primaryCharges: primaryCharges.map(presentCharge),
+      childItems: childItems.map((item) => ({ ...item, charges: item.charges.map(presentCharge) })),
       totals: { nrcTotal, mrcTotal, usageCharges },
       currencyCode
     });
@@ -62,8 +65,45 @@ async function POST(req) {
     return NextResponse.json({ error: "Internal error" }, { status: 500 });
   }
 }
+const chargeDoc = z.object({
+  chargeCode: z.string(),
+  chargeName: z.string(),
+  chargeType: z.enum(["nrc", "mrc", "usage"]),
+  pricingMethod: z.enum(["flat", "per_unit", "volume", "tiered"]),
+  currencyCode: z.string(),
+  unitPrice: z.number(),
+  quantity: z.number().nullable(),
+  totalPrice: z.number().nullable(),
+  listUnitPrice: z.number().optional(),
+  listTotalPrice: z.number().nullable().optional(),
+  standardUnitPrice: z.number().optional(),
+  standardTotalPrice: z.number().nullable().optional(),
+  adjustments: z.array(z.object({
+    origin: z.literal("rule"),
+    ruleCode: z.string(),
+    ruleName: z.string(),
+    ruleType: z.string(),
+    value: z.number(),
+    unitPriceBefore: z.number(),
+    unitPriceAfter: z.number(),
+    delta: z.number()
+  }).passthrough()).nullish()
+}).passthrough();
+const openApi = { tag: "CPQ Pricing", methods: { POST: {
+  summary: "Calculate catalog prices and price rules without saving",
+  description: "Manual quote adjustments are never applied. Set includeWaterfall=true to return list and standard prices; these fields are omitted by default.",
+  requestBody: { schema: cpqPricePreviewSchema },
+  responses: [{ status: 200, description: "Resolved rule prices and optional waterfall", schema: z.object({
+    primaryCharges: z.array(chargeDoc),
+    childItems: z.array(z.object({ offeringId: z.string().nullable(), productId: z.string().nullable(), charges: z.array(chargeDoc) })),
+    totals: z.object({ nrcTotal: z.number(), mrcTotal: z.number(), usageCharges: z.array(z.unknown()) }),
+    currencyCode: z.string()
+  }) }],
+  errors: [cpqErrorDoc(400, "Invalid pricing request"), cpqErrorDoc(500, "Price calculation failed")]
+} } };
 export {
   POST,
-  metadata
+  metadata,
+  openApi
 };
 //# sourceMappingURL=route.js.map