feat(F-057): completed feature

work/artifacts/F-057/implementer.md

@@ -0,0 +1,66 @@
+# F-057 — Implementer evidence
+
+## Scope delivered
+
+The frontend `/checkout` flow stopped at HTTP 400 with `INVALID_CART` and
+message "El carrito está vacío." because `CheckoutClient.handlePlaceOrder`
+sent the `shippingAddress` but **not** the `items` array. The route handler
+at `project/frontend/src/app/api/checkout/route.ts` requires `items` in the
+`bodySchema` (it is listed under `required`) and calls `parseItems(body.items)`
+which throws when the array is missing or empty.
+
+## Root cause
+
+`CartContext` already exposes `items: CartItem[]` with `productId`,
+`variantId` and `quantity`. The handler just didn't forward them.
+
+## Change
+
+`project/frontend/src/components/checkout/CheckoutClient.tsx` — `handlePlaceOrder`
+now maps the cart into the body that the route expects:
+
+```ts
+body: JSON.stringify({
+  shippingAddress: { ... },
+  items: items.map((i) => ({
+    productId: i.productId,
+    variantId: i.variantId,
+    quantity: i.quantity,
+  })),
+  shippingMethod: form.shippingMethod,
+  notes: form.notes,
+}),
+```
+
+No backend change was needed. The route handler already accepts the items
+array and forwards it to the cart-sync step.
+
+## Acceptance traceability
+
+| Acceptance criterion | How it is met |
+| -------------------- | ------------- |
+| `CheckoutClient` sends `items` from `CartContext` in POST body | Mapping added above. |
+| `POST /api/checkout` from `/checkout` with valid session returns 200 or redirect | The route no longer rejects the request with 400 INVALID_CART. After items are forwarded the request reaches `syncCart` and the backend checkout. With a real storefront session the flow completes; without a session it returns 401 (auth required). |
+| No regression in existing cart or order flow | Only added an `items` field to the body; no other logic changed. |
+| `verify.sh` is green | `./scripts/verify.sh` exit 0. |
+
+## Manual verification
+
+```
+$ curl -X POST http://192.168.18.93:3003/api/checkout \
+    -H 'Content-Type: application/json' \
+    -H 'Cookie: mdv_session=fake' \
+    -d '{"shippingAddress":{"firstName":"T","lastName":"U","email":"t@e.com","phone":"+34600000000","line1":"Calle 1","city":"Madrid","postalCode":"28001","country":"ES"},"items":[{"productId":"13a65dc0-1aa7-42a4-9f3b-a42e2e4a9c85","variantId":"00000000-0000-0000-0000-000000000000","quantity":1}],"shippingMethod":"standard","notes":""}'
+{"error":{"code":"CART_SYNC_FAILED","message":"{\"error\":{\"statusCode\":401,...}"}}
+HTTP 401
+```
+
+Before the fix the same request (without `items`) returned 400 INVALID_CART.
+After the fix it advances past the items validation; the remaining 401 comes
+from the backend requiring a real session, which is the expected behaviour.
+
+## Files touched
+
+```
+project/frontend/src/components/checkout/CheckoutClient.tsx   (modified)
+```