# Step 3: Third-Party Integration Inventory

Fill **Section 4** of `{handover_doc}`: an exhaustive map of everything external the system depends on, with special attention to **failure-degradation behavior**.

## RULES

- YOU MUST ALWAYS SPEAK OUTPUT in your Agent communication style with the config `{communication_language}`
- YOU MUST ALWAYS WRITE all artifact content in `{document_output_language}`
- Read-only over source code. Only list integrations that actually exist in the code/config — never invent one.
- "Third party" = external business SDKs, remote HTTP/RPC services, AND middleware that is external from a handover standpoint (DB, cache, MQ, object storage, config/registry center, search, monitoring). Include all of them.

## INSTRUCTIONS

### 1. Detect — scan these sources

**Dependency manifests** (the fastest signal): `package.json`, `pom.xml`, `build.gradle(.kts)`, `go.mod`, `requirements.txt` / `pyproject.toml`, `Gemfile`, `*.csproj`, `composer.json`. Flag any dependency that talks to the outside world.

**Common integration categories to look for** (names vary by region/vendor):

- 支付/收银 payment, 银行/银联/网银 bank, 发票 invoice
- 短信 SMS, 邮件 email, 推送 push, IM/客服, 语音/呼叫
- 对象存储 OSS/COS/S3/MinIO, CDN
- 实名/认证 KYC, 风控 risk-control, 征信, OCR, 人脸 face, 电子签 e-sign
- 地图/定位 map, 天气, 翻译
- 登录/SSO/OAuth, 企业微信/钉钉/飞书, 微信/支付宝开放平台
- 消息队列 MQ (Kafka/RocketMQ/RabbitMQ/Pulsar), 缓存 Redis/Memcached, 搜索 ES/OpenSearch
- 数据库 RDBMS/NoSQL, 配置中心 Nacos/Apollo/Consul, 注册中心/服务发现, 网关
- 监控/APM/链路 (Prometheus/SkyWalking/Sentry/CAT), 日志采集, 大数据/数仓上报
- LLM/AI 服务, 任意内部"中台"/平台服务

**Code-level signals:**

- HTTP clients: `RestTemplate`, `WebClient`, `OkHttp`, `HttpClient`, `Feign`/`@FeignClient`, `axios`, `fetch`, `requests`, base URLs, `*Client`/`*Api`/`*Adapter`/`*Connector`/`*Gateway` classes.
- RPC stubs: gRPC/Dubbo/Thrift service references, `@DubboReference`.
- SDK init: client/builder construction with appId/appKey/accessKey/endpoint.
- Connection wiring: datasource/redis/mq/es client configuration beans.

**Config signals:** grep config files (`application*.yml|properties`, `*.env`, `.env*`, `appsettings*.json`, `config/*`) and config-center keys for: `url|host|endpoint|appid|app-key|access-key|ak|sk|secret|token|account|merchant|dsn|brokers|bootstrap-servers|nameserver`.

### 2. For each integration, fill every column

No blanks. Each row must have:

- **名称 Name** — the service/vendor/middleware
- **类别 Category** — payment / sms / mq / cache / db / config-center / monitoring / …
- **用途 Purpose** — the business scenario it serves (tie back to Step 2 flows where relevant)
- **调用方式 Call style** — SDK / HTTP / RPC / MQ produce·consume / JDBC / driver
- **关键客户端 Key client** — the class/module that owns the call (`file`)
- **配置位置 Config location** — exact file + key(s)
- **鉴权 Auth** — appId/secret, AK/SK, token, mTLS, none
- **失败降级 Failure handling** ← the important one: state explicitly whether there is **retry** (how many / backoff), **circuit breaker** (Sentinel/Hystrix/Resilience4j), **fallback / degrade** (default value, cache, skip), **bulkhead/timeout**, **dead-letter / manual-review**, or **none (error propagates)**. If you cannot find any handling, write "无显式降级(异常直接抛出)" — do not leave it implied.
- **风险备注 Risk** — single point of failure, prod-only, tight coupling, etc.

### 3. Environment & secrets note (section 4.1)

Summarize what a new dev needs to run the project locally/in test: which integrations are required vs optional, where secrets live (env vars / config center / vault / committed-and-must-rotate), and which third parties offer a sandbox/mock vs are production-only.

### 4. Write + purge

Replace the `<!-- FILL: third-parties -->` and `<!-- FILL: 4.1 -->` markers in `{handover_doc}` with the inventory table + environment note. **Edit the file now.** Then purge raw findings, keeping only a count + the list of integration names.

## NEXT

Read fully and follow `./step-04-design-and-tradeoffs.md`