# Implementer — F-008 Catalog core: products domain

done -> work/artifacts/F-008/implementer.md

## Summary
Implemented the catalog core product slice as a hexagonal backend module with product state, unique slugs, active-only public reads/search, SEO metadata, category assignment, migration, tests and composition-root wiring.

## Changed files
- `project/src/modules/catalog/domain/product.ts`
- `project/src/modules/catalog/domain/errors.ts`
- `project/src/modules/catalog/domain/ports.ts`
- `project/src/modules/catalog/application/product-use-cases.ts`
- `project/src/modules/catalog/infrastructure/pg-product-repository.ts`
- `project/src/modules/catalog/api/catalog.routes.ts`
- `project/src/modules/catalog/index.ts`
- `project/migrations/006_catalog_products.js`
- `project/src/app/build-app.ts`
- `project/src/modules/catalog/tests/product-use-cases.test.ts`
- `project/src/modules/catalog/tests/domain-purity.test.ts`
- `project/src/app/tests/catalog.itest.ts`
- `backlog/features.json`
- `work/current.md`
- `work/artifacts/F-008/architect.md`

## Acceptance traceability
1. Domain layer has zero database or HTTP imports
   - Catalog domain files contain only type/model/port/error code.
   - Covered by `src/modules/catalog/tests/domain-purity.test.ts` and boundary lint.
2. Duplicate slug returns HTTP 409
   - Implemented through `catalog_products.slug UNIQUE` and `PRODUCT_SLUG_EXISTS` mapping.
   - Covered by `src/app/tests/catalog.itest.ts`.
3. Only active products appear in public listings
   - `SearchProducts` always passes `activeOnly: true`; repository filters `p.state = 'active'`.
   - Covered by unit and integration tests.
4. Public URL is `/productos/<slug>`, never internal id
   - Implemented `GET /productos/:slug` active-only and serialized `url: /productos/<slug>`.
   - Covered by integration test.
5. `verify.sh` green
   - Verified after implementation.

## Commands run
- `cd project && npm run typecheck` — PASS
- `cd project && npm run lint` — PASS after Prettier normalization
- `cd project && npm test` — PASS: 59 passed, 28 skipped (DB integration skipped without `TEST_DATABASE_URL`)
- `cd project && npm run build` — PASS
- `cd project && npm run lint:boundaries` — PASS: 71 files checked
- `./scripts/verify.sh` — PASS

## Notes
- No new npm dependencies.
- Product mutation routes are admin-only via shared auth injected from the composition root.
- Public reads (`GET /productos/:slug`, `GET /products/search`) are unauthenticated and active-only.
- Category assignment validates category IDs against `categories_categories` without importing categories module internals.
- Documentation stage should update README/API notes because new user-facing endpoints and product error codes were added.