// ❌ Synchronous call chain — three hops, three failure surfaces, one user wait
async function placeOrder(req: PlaceOrderRequest): Promise<Order> {
  const product     = await catalogClient.getProduct(req.productId)   // Hop 1: +40ms
  const reservation = await inventoryClient.reserve(req.productId, req.quantity) // Hop 2: +60ms
  const charge      = await paymentClient.charge(req.userId, product.priceCents) // Hop 3: +200ms
  return createOrder({ product, reservation, charge })
  // Total latency = SUM of all hops = 300ms minimum, before your own logic
  // If payment provider spikes to 10s → user waits 10s → connection held open
}

// ✅ Circuit breaker with fallback — isolates failure without blocking threads
import CircuitBreaker from 'opossum'

const inventoryBreaker = new CircuitBreaker(
  (sku: string, qty: number) => inventoryClient.reserve(sku, qty),
  {
    timeout: 3000,
    errorThresholdPercentage: 50,
    resetTimeout: 30_000,
    volumeThreshold: 5,
  }
)

inventoryBreaker.fallback((sku, qty) => ({
  status: 'queued',
  message: 'Inventory service temporarily unavailable. Your order will be confirmed shortly.'
}))

const reservation = await inventoryBreaker.fire('SKU-001', 2)

// ✅ Total SLA budget: 800ms — split explicitly across hops
const catalog   = await catalogClient.getProduct(productId,  { timeout: 150 })
const inventory = await inventoryClient.reserve(sku, qty,    { timeout: 200 })
const payment   = await paymentClient.charge(userId, amount, { timeout: 400 })
// Remaining 50ms: handler logic + network overhead

// ✅ Idempotency key on all non-idempotent operations
const chargeResult = await paymentClient.charge({
  userId,
  amountCents: 4999,
  idempotencyKey: `order-${orderId}-charge`, // deterministic, stable across retries
})
// First call: processes charge, stores result keyed on idempotencyKey
// Subsequent retries: returns stored result — no double-charge

-- payment-service: idempotency deduplication table
CREATE TABLE idempotency_cache (
  idempotency_key TEXT PRIMARY KEY,
  response_body   JSONB NOT NULL,
  created_at      TIMESTAMPTZ DEFAULT now(),
  expires_at      TIMESTAMPTZ -- 24–48h TTL
);

// ✅ ETag-based conditional updates prevent lost writes under concurrent modification
// GET /inventory/SKU-001 → ETag: "W/\"abc123\""
const response = await inventoryClient.updateStock('SKU-001', { quantityOnHand: 35 }, {
  headers: { 'If-Match': '"W/\\"abc123\\""' }
})
// 412 Precondition Failed if another request modified the resource concurrently

syntax = "proto3";
package inventory.v1;

service InventoryService {
  rpc GetStock (GetStockRequest)  returns (StockResponse);
  rpc Reserve  (ReserveRequest)   returns (ReservationResponse);
  rpc Watch    (WatchRequest)     returns (stream StockEvent);
}

message StockResponse {
  string sku              = 1; // field numbers are permanent — never reuse
  int32  quantity_on_hand = 2;
  int32  reserved_count   = 3;
  // New fields always added at end with new numbers — backward compatible
}

// ❌ Synchronous coupling disguised as an event
await eventBus.publish('SendConfirmationEmail', { orderId, userId })
// This is a command — it demands that the notification service act

// ✅ Fact-based event — notification service decides independently how to react
await eventBus.publish('order.placed', {
  orderId: order.id,
  userId: order.userId,
  totalCents: order.totalCents,
  placedAt: order.createdAt.toISOString(),
})
// Notification failure does NOT affect order placement — domains are isolated

// ✅ Explicit consumer rate limiting — prevents overwhelming downstream dependencies
await consumer.run({
  partitionsConsumedConcurrently: 3,
  eachMessage: async ({ message }) => {
    await rateLimiter.consume(1)  // token bucket: max 100 messages/s
    await emailClient.sendOrderConfirmation(event.userId, event.orderId)
  },
})

// ✅ Kubernetes readiness probe gates traffic — unhealthy pods removed automatically
app.get('/health/ready', async (_, res) => {
  const dbOk = await db.ping().catch(() => false)
  res.status(dbOk ? 200 : 503).json({ db: dbOk })
})
// kubelet calls /health/ready every 10s
// 503 → pod removed from Service endpoints → no traffic routed until recovery