BFF Stream — Task Plan (post-implementation)

Compares the planned tasks (see ../task-plan.md) against what shipped in arda-frontend-app PR #832.

Delta from plan

All eight planned tasks landed. The shipped scope was extended during review with proxy/adaptor semantics that weren’t fully spelled out in the original plan:

Area	Plan	Reality	Notes
AmazonImportDto field nullability	unitCount, unit, upc nullable; name, image, price, productUrl required	All four core fields also nullable; mapper passes null through; HTTP 206 added for partial responses	Surfaced in review (B2 / B3). Proxy/adaptor framing tightened from “return the DTO” to “preserve Amazon’s null/present signal”.
JWT-failure envelope	{ ok: false, error } (implicit)	{ ok: false, code: "AUTHENTICATION_REQUIRED", message }	Surfaced in review (B1). New error code added to the matrix.
Affiliate-tag encoding	Not specified	encodeURIComponent(tag) applied	Defensive against future tag values.
ApiClient lifetime	Not specified	Hoisted to module scope (lazy-init)	Restores OAuth2 token caching across requests; major perf delta for steady-state.

Adjacent contract additions

• INVALID_REQUEST (HTTP 400) added to the error matrix for malformed request bodies. Distinguished from UNRECOGNIZED_AMAZON_URL, which applies only after structural validation passes.
• productUrl verbatim pass-through rule (Constraint 3): when non-null, the route returns the upstream detailPageURL byte-for-byte. The route does not rebuild the affiliate URL — the affiliate-tag canonicalisation is upstream Amazon’s responsibility.

Verification

• 100% of unit-test matrix in task-plan.md § Tasks: passed in CI on PR #832 head.
• E2E mock-mode: MSW handler answers from a fixture exercising both complete and sparse upstream responses.
• Production smoke: ASIN B08N5WRWNW returned a complete response (HTTP 200) via dev → stage → demo → prod after amm.sh populated the partition env vars.