Level 3: Senior Developer

Analyze dependency risk across all services:

Repos: [list 20+ microservices]

Identify:
- Outdated dependencies (>6 months behind latest)
- Security vulnerabilities (npm audit / Snyk)
- Breaking changes in major version updates
- Dependencies blocking other upgrades
- Circular dependency issues

Prioritize by: security risk > breaking change complexity > effort
Generate upgrade plan with estimated effort per service.

Generate migration guide for jsonwebtoken 8.5.1 → 9.0.2:

Services affected: @auth-service, @api-gateway, @admin-api, 
@user-service, @payment-service, @notification-service, 
@analytics-service, @reporting-service

For each service:
1. Identify all JWT sign/verify calls
2. Show required code changes
3. Generate migration tests
4. Update CI/CD to use new version
5. Document rollback procedure

Create a checklist PR template for each service.

Plan migration: Express.js → Fastify for API services

Services: @api-gateway, @user-api, @order-api, @payment-api

Analysis needed:
1. Express middleware → Fastify plugins (equivalents?)
2. Request/response API differences
3. Error handling pattern changes
4. Testing approach differences
5. Performance benchmarks (baseline vs migrated)

Generate:
- Side-by-side comparison of common patterns
- Migration checklist per service
- Adapter layer for gradual migration
- Integration test suite

// Adapter: Run Express middleware in Fastify
function expressToFastify(expressMiddleware) {
  return async (request, reply) => {
    // Translate Fastify req/res to Express format
    const req = createExpressRequest(request);
    const res = createExpressResponse(reply);
    
    await new Promise((resolve, reject) => {
      expressMiddleware(req, res, (err) => {
        if (err) reject(err);
        else resolve();
      });
    });
  };
}

// Use existing Express auth middleware in Fastify during migration
fastify.addHook('onRequest', expressToFastify(authMiddleware));

Design service extraction plan:

Current: Monolith @legacy-api (47,000 lines)
Target: Extract user management into @user-service

Analysis:
1. Identify all user-related code (models, routes, business logic)
2. Find dependencies (what else uses user code?)
3. Design API contract for new service
4. Plan data migration strategy (shared DB vs separate?)
5. Identify shared utilities to extract first
6. Generate strangler fig pattern implementation

Create:
- Service boundaries diagram
- API contract (OpenAPI)
- Database migration plan
- Rollout strategy (feature flags, traffic splitting)
- Rollback procedure

// Elegant!
const userEmails = users.map(u => u.profile.email).join(', ');

// Resilient
const userEmails = users
  .filter(u => u.profile?.email)
  .map(u => u.profile.email)
  .join(', ') || 'No emails available';

async function deleteProduct(productId) {
  await db.query('DELETE FROM products WHERE id = ?', [productId]);
  return { success: true };
}

async function verifyToken(token) {
  const decoded = jwt.verify(token, SECRET_KEY);
  return { userId: decoded.userId, valid: true };
}

async function verifyToken(token) {
  try {
    // Verify with current and previous keys (rotation support)
    let decoded;
    for (const key of [CURRENT_KEY, PREVIOUS_KEY]) {
      try {
        decoded = jwt.verify(token, key, {
          algorithms: ['RS256'],
          clockTolerance: 30 // Handle 30s clock skew
        });
        break;
      } catch (e) {
        continue; // Try next key
      }
    }
    
    if (!decoded) {
      throw new InvalidTokenError('Token verification failed');
    }
    
    // Check revocation list
    if (await isTokenRevoked(decoded.jti)) {
      throw new RevokedTokenError('Token has been revoked');
    }
    
    return { userId: decoded.userId, valid: true };
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      throw new ExpiredTokenError('Token has expired');
    }
    throw new InvalidTokenError('Invalid token');
  }
}

Generate property-based tests for this function:
@[function]

Test invariants:
- Function never crashes (returns error instead)
- Output type always matches expected type
- Side effects are idempotent
- Performance stays under 100ms even with large inputs

Use [fast-check / QuickCheck / Hypothesis] to generate
random inputs that stress-test the implementation.

# Deployment strategy
phases:
  - name: canary
    traffic: 5%
    duration: 1 hour
    success_criteria:
      - error_rate < 0.1%
      - p95_latency < 200ms
      - no_critical_alerts
    
  - name: rollout
    traffic: 50%
    duration: 2 hours
    success_criteria: [same as above]
    
  - name: complete
    traffic: 100%
      
rollback_triggers:
  - error_rate > 1%
  - p99_latency > 1000ms
  - critical_alert_fired