# Implementer — F-010 Variants, SKU/EAN and product rich data

done -> work/artifacts/F-010/implementer.md

## Summary
Implemented catalog product variants and rich product data with SKU/EAN uniqueness, nutrition provenance, and manual nutrition overwrite protection.

## Changed files
- `project/src/modules/catalog/domain/variant.ts`
- `project/src/modules/catalog/domain/errors.ts`
- `project/src/modules/catalog/domain/ports.ts`
- `project/src/modules/catalog/application/variant-use-cases.ts`
- `project/src/modules/catalog/infrastructure/pg-variant-repository.ts`
- `project/src/modules/catalog/infrastructure/pg-rich-data-repository.ts`
- `project/src/modules/catalog/api/catalog.routes.ts`
- `project/migrations/008_catalog_variants_rich_data.js`
- `project/src/modules/catalog/tests/rich-data-use-cases.test.ts`
- `project/src/app/tests/catalog.itest.ts`
- `work/artifacts/F-010/architect.md`
- `backlog/features.json`
- `work/current.md`

## Acceptance traceability
1. Duplicate SKU or EAN returns HTTP 409
   - Implemented via unique constraints on `catalog_product_variants.sku` and `catalog_product_variants.ean`.
   - Mapped to `PRODUCT_VARIANT_CODE_EXISTS`.
   - Covered by `project/src/app/tests/catalog.itest.ts`.
2. Manual nutrition source blocks external overwrite
   - Implemented in `protectManualNutrition` inside application use-case logic.
   - Covered by `project/src/modules/catalog/tests/rich-data-use-cases.test.ts` and integration test scenario.
3. Every nutrition payload stores provenance
   - API validation requires `nutritionSource` when `nutrition` is provided.
   - DB check enforces `nutrition IS NULL OR nutrition_source IS NOT NULL`.
   - Covered by integration test scenario.
4. `verify.sh` green
   - Verified after implementation.

## Commands run
- `cd project && npm run typecheck` — PASS
- `cd project && npm run lint` — PASS after Prettier normalization
- `cd project && npm test` — PASS: 61 passed, 33 skipped (DB integration skipped without `TEST_DATABASE_URL`)
- `cd project && npm run build` — PASS
- `cd project && npm run lint:boundaries` — PASS: 84 files checked
- `./scripts/verify.sh` — PASS

## Notes
- No new npm dependencies.
- Variant and rich data mutations are admin-only via existing catalog route auth.
- No OpenFoodFacts sync job, images, stock, or pricing added.
- JSON payloads are bounded through Zod validation.
- Documentation stage should update README/API notes because new variant and rich data endpoints/error codes were added.