{
  "repo": "tidbcloud/tidb-management-service",
  "binary": "dedicated-global-service",
  "binary_path": "dedicated-global-service/cmd/dedicated-global-service/main.go",
  "dependencies": {
    "ClusterService.CreateCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load cloud-provider and region records before validating the dedicated cluster request",
              "conditions": [
                "Always"
              ],
              "implementation": "checkCloudProviderAndRegion() -> regionRepo.ListAllCloudProviders() / repo lookups"
            },
            {
              "operation": "SELECT",
              "trigger": "Load region CIDR and eligible CMEK rows before creation proceeds",
              "conditions": [
                "When cluster_id != 0 and AWS/Azure CMEK validation is needed"
              ],
              "implementation": "checkCIDR() -> cidrRepo.LoadByCloudProviderAndRegion(); validateCmek() -> cmekRepo.Query()"
            },
            {
              "operation": "INSERT",
              "trigger": "Persist the new dedicated cluster, encrypted root password, default TiDB group, and component rows",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "clusterRepo.Save(); clusterRepo.SetEncryptedRootPassword(); tidbGroupRepo.Create(); componentRepo.SaveAll()"
            }
          ]
        },
        "aws_kms": {
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "ENCRYPT",
              "trigger": "Encrypt generated or supplied root/cloud-admin passwords before persistence",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "encryptor.EncryptBase64()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "target_repo": "tidbcloud/account",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Resolve project metadata before billing-plan and tenant checks",
              "conditions": [
                "Always"
              ],
              "implementation": "getTenantAndProjectMeta() -> accountCli.GetProject()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrgByID",
          "target_repo": "tidbcloud/account",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Resolve tenant metadata for project ownership and billing/CMEK validation",
              "conditions": [
                "Always"
              ],
              "implementation": "getTenantAndProjectMeta() -> accountCli.GetTenant()"
            }
          ]
        },
        {
          "name": "billing-service",
          "target_interface": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
          "target_repo": "tidbcloud/billing",
          "operation_type": "http_post",
          "conditions": [
            "When cluster_id != 0 and the request is not validate-only"
          ],
          "operations": [
            {
              "operation": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
              "trigger": "Check whether the tenant billing plan allows dedicated-cluster creation in the target region",
              "conditions": [
                "When cluster_id != 0"
              ],
              "implementation": "checkTenantBillingPlan() -> billingCli.BillingActionCheck()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Start the asynchronous dedicated-cluster creation workflow after DB state is committed",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "workflow.RunDagWithBizId(common.CreateCluster, ...)"
            }
          ]
        }
      ]
    },
    "ClusterService.ScaleCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the dedicated cluster, target region, and TiDB-group rows before validating the scale request",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.GetAndLoadComponents(); regionRepo.SelectRegionById(); tidbGroupRepo.Query(); tidbGroupRepo.LoadDefault()"
            },
            {
              "operation": "UPSERT",
              "trigger": "Persist desired component rows and mark the cluster as scaling before the dynamic workflow starts",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "saveDesiredComponents() -> componentRepo.Save(); clusterRepo.Save()"
            },
            {
              "operation": "SELECT",
              "trigger": "Reload the cluster after persisting desired components so the scaled topology can be emitted in the event payload",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "clusterRepo.GetAndLoadComponents()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "workflow-engine",
          "target_interface": "ListRunningDagInstancesByNamePrefix",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_query",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ListRunningDagInstancesByNamePrefix",
              "trigger": "Check whether a scale workflow is already running for the cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "dag.CanRunScaleDag() -> workflow.ListRunningDagInstancesByNamePrefix()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RegisterDynamicDagThenRun",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
          ],
          "operations": [
            {
              "operation": "RegisterDynamicDagThenRun",
              "trigger": "Register and launch the dynamic dedicated-cluster scale DAG after desired components are saved",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "dag.RunScaleDag() -> workflow.RegisterDynamicDagThenRun()"
            }
          ]
        }
      ]
    },
    "ClusterService.PauseCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the dedicated cluster and component rows before pause validation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.GetAndLoadComponents()"
            },
            {
              "operation": "UPSERT",
              "trigger": "Persist the pausing state and optional normal-pause plan before the async workflow starts",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "clusterRepo.Save(); pausePlanRepo.Save()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous pause-cluster reconciliation DAG",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "workflow.RunDagWithBizId(common.PauseCluster, ...)"
            }
          ]
        }
      ]
    },
    "ClusterService.ResumeCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the dedicated cluster and component rows before resume validation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.GetAndLoadComponents()"
            },
            {
              "operation": "UPDATE",
              "trigger": "Persist the resuming or scheduled-resume cluster state before the workflow starts",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "clusterRepo.Save()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "workflow-engine",
          "target_interface": "ListRunningDagInstances",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_query",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ListRunningDagInstances",
              "trigger": "Check whether a resume DAG is already running for the target cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "workflow.ListRunningDagInstances([]string{common.ResumeCluster}, ...)"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "DeleteDagInstancesWithDagId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "When a manual resume replaces an existing scheduled resume DAG"
          ],
          "operations": [
            {
              "operation": "DeleteDagInstancesWithDagId",
              "trigger": "Cancel an existing scheduled resume DAG before launching a manual resume",
              "conditions": [
                "When len(dagIns) > 0 and scheduledTime == nil"
              ],
              "implementation": "workflow.DeleteDagInstancesWithDagId(common.ResumeCluster)"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous resume-cluster reconciliation DAG",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "workflow.RunDagWithBizId(common.ResumeCluster, ...)"
            }
          ]
        }
      ]
    },
    "ClusterService.DeleteCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the target cluster and TiDB-group rows before delete validation and workflow argument assembly",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.GetAndLoadComponents(); tidbGroupRepo.Query()"
            },
            {
              "operation": "DELETE",
              "trigger": "Delete cluster-owned DB rows before handing off to the async delete workflow",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "clusterRepo.Delete(); componentRepo.DeleteByClusterId(); tidbGroupRepo.DeleteByClusterId(); trafficFilterRepo.DeleteByClusterId(); privateLinkEndpointRepo.DeleteByClusterID(); pausePlanRepo.DeleteByClusterId(); auditLogConfigRepo.DeleteByClusterID(); auditLogFilterRuleRepo.DeleteByClusterID()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "workflow-engine",
          "target_interface": "DeleteDagInstances",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "DeleteDagInstances",
              "trigger": "Remove stale TiDB-group/private-link DAG instances before starting cluster deletion",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "workflow.DeleteDagInstances()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous delete-cluster reconciliation DAG",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "workflow.RunDagWithBizId(common.DeleteCluster, ...)"
            }
          ]
        }
      ]
    },
    "ClusterService.GetComponentNodeInfo": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "repositories": [
          "cluster",
          "region"
        ]
      }
    },
    "VpcService.CreateVpcPeering": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "account-provider",
          "regional-server"
        ],
        "infrastructure": [
          "Workflow Engine"
        ],
        "repositories": [
          "region",
          "endpoint",
          "cidr"
        ]
      }
    },
    "VpcService.ListVpcs": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "repositories": [
          "region"
        ]
      }
    },
    "PrivateLinkConnectionService.CreatePrivateLinkService": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "infrastructure": [
          "Workflow Engine"
        ],
        "repositories": [
          "cluster",
          "endpoint",
          "tidbgroup",
          "region"
        ]
      }
    },
    "PrivateLinkConnectionService.CreatePrivateLinkEndpoint": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "infrastructure": [
          "Workflow Engine"
        ],
        "repositories": [
          "cluster",
          "endpoint",
          "tidbgroup",
          "region"
        ]
      }
    },
    "DatabaseAuditLogService.GetAuditLogConfig": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "repositories": [
          "auditlog",
          "cluster",
          "region"
        ]
      }
    },
    "DatabaseAuditLogService.UpdateAuditLogConfig": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server",
          "cluster-proxy"
        ],
        "repositories": [
          "auditlog",
          "cluster",
          "region"
        ]
      }
    },
    "DatabaseAuditLogService.QueryAuditLogFiles": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "infrastructure": [
          "AWS S3"
        ],
        "repositories": [
          "cluster",
          "region"
        ]
      }
    },
    "MeteringService.CalcClusterFee": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "account-provider",
          "regional-server"
        ],
        "repositories": [
          "cluster",
          "spu",
          "region",
          "metering"
        ]
      }
    },
    "CustomerManagedEncryptionService.CreateCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "account-provider",
          "regional-server"
        ],
        "infrastructure": [
          "AWS KMS"
        ],
        "repositories": [
          "cmek",
          "region",
          "cluster"
        ]
      }
    },
    "RegionService.RegisterRegion": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "repositories": [
          "region",
          "cidr",
          "cluster"
        ]
      }
    },
    "RegionService.CheckRegionStatus": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "internal_services": [
          "regional-server"
        ],
        "repositories": [
          "region"
        ]
      }
    },
    "TidbNodeGroupService.CreateTidbNodeGroup": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "infrastructure": [
          "Kafka",
          "Workflow Engine"
        ],
        "repositories": [
          "cluster",
          "component",
          "tidbgroup",
          "endpoint",
          "region"
        ]
      }
    },
    "PrivateLinkServiceMigrationService.CreatePrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": [],
      "legacy_summary": {
        "databases": [
          "MySQL"
        ],
        "internal_services": [
          "regional-server"
        ],
        "infrastructure": [
          "Workflow Engine"
        ],
        "repositories": [
          "privatelinkservicemigration",
          "cluster",
          "tidbgroup",
          "region"
        ]
      }
    },
    "DedicatedGlobalLifecycle.Startup": {
      "infrastructure": {
        "pprof": {
          "conditions": [
            "Always in serve mode"
          ],
          "operations": [
            {
              "operation": "REGISTER",
              "trigger": "Expose pprof handlers on the TiInf Gin engine",
              "conditions": [
                "Always"
              ],
              "implementation": "pprof.Register(inf.GinEngine())"
            },
            {
              "operation": "START",
              "trigger": "Enable autopprof runtime sampling",
              "conditions": [
                "autopprof.Start succeeds or unsupported platform is ignored"
              ],
              "implementation": "autopprof.Start(autopprof.DefaultOption)"
            }
          ]
        }
      },
      "services": []
    },
    "DedicatedGlobalLifecycle.SetupGRPCServer": {
      "infrastructure": {},
      "services": []
    },
    "DedicatedGlobalLifecycle.RunDBMigrate": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Only when --grpc-server-only is false"
          ],
          "operations": [
            {
              "operation": "MIGRATE",
              "trigger": "Apply dedicated-global-service schema migrations before serving background workflows",
              "conditions": [
                "!grpcServerOnlyMode"
              ],
              "implementation": "dbMigrate() -> migrate.RunMigrate()"
            }
          ]
        }
      },
      "services": []
    },
    "DedicatedGlobalLifecycle.StartEventbus": {
      "infrastructure": {
        "kafka": {
          "conditions": [
            "Only when --grpc-server-only is false"
          ],
          "operations": [
            {
              "operation": "RUN EVENTBUS",
              "trigger": "Start the TiInf eventbus client and WAL watcher",
              "conditions": [
                "!grpcServerOnlyMode"
              ],
              "implementation": "startEventbus() -> eb.Run(); watcher.Start()"
            }
          ]
        }
      },
      "services": []
    },
    "DedicatedGlobalLifecycle.RunWorkflow": {
      "infrastructure": {},
      "services": []
    },
    "DedicatedGlobalLifecycle.StartGlobalWorker": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ListClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load dedicated cluster rows plus component records for the incoming filter set",
              "conditions": [
                "Always"
              ],
              "implementation": "List() -> clusterRepo.QueryAndLoadComponents()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load traffic-filter rows for active and creating clusters",
              "conditions": [
                "When active or creating clusters exist"
              ],
              "implementation": "List() -> trafficFilterRepo.LoadByClusterIds()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load pause-plan rows for paused or pausing clusters",
              "conditions": [
                "When paused or pausing clusters exist"
              ],
              "implementation": "List() -> pausePlanRepo.LoadMany()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "regional-server",
          "target_interface": "ListClusters",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Per logical region and organization that has active or creating clusters"
          ],
          "operations": [
            {
              "operation": "gRPC ListClusters",
              "trigger": "Fetch regional cluster runtime state for active and creating dedicated clusters",
              "conditions": [
                "Per logical region and organization that has active or creating clusters"
              ],
              "implementation": "fetchRegionalClusters() -> regionServerCli.ListClusters()"
            }
          ]
        },
        {
          "name": "cluster-service-ng",
          "target_interface": "TiDBClusterService.ListTiDBGroups",
          "target_repo": "tidbcloud/cluster-service-ng",
          "operation_type": "grpc_unary",
          "conditions": [
            "Per region and active cluster when show_details is true"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbGroups",
              "trigger": "Load TiDB-group topology for each active dedicated cluster",
              "conditions": [
                "Per region and active cluster when show_details is true"
              ],
              "implementation": "fetchRegionalTidbGroup() -> regionServerCli.ListTidbGroups()"
            }
          ]
        },
        {
          "name": "regional-server",
          "target_interface": "ListPrivateLinkServices",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Per region and active cluster when show_details is true"
          ],
          "operations": [
            {
              "operation": "gRPC ListPrivateLinkServices",
              "trigger": "Load private-link service inventory for each active dedicated cluster",
              "conditions": [
                "Per region and active cluster when show_details is true"
              ],
              "implementation": "fetchRegionalPrivateLinkServices() -> regionServerCli.ListPrivateLinkServices()"
            }
          ]
        },
        {
          "name": "regional-server",
          "target_interface": "GetComponentNodeInfo",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Per scaling cluster when show_details is true"
          ],
          "operations": [
            {
              "operation": "gRPC GetComponentNodeInfo",
              "trigger": "Load component-node runtime details for scaling clusters",
              "conditions": [
                "Per scaling cluster when show_details is true"
              ],
              "implementation": "fetchRegionalNodeInfos() -> regionServerCli.GetComponentNodeInfo()"
            }
          ]
        }
      ]
    },
    "ClusterService.GetCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the target dedicated cluster and its component rows through the list path",
              "conditions": [
                "Always"
              ],
              "implementation": "Get() -> List() -> clusterRepo.QueryAndLoadComponents()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load traffic filters for the target cluster",
              "conditions": [
                "Cluster exists"
              ],
              "implementation": "Get() -> List() -> trafficFilterRepo.LoadByClusterIds()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load the pause plan when the target cluster is paused or pausing",
              "conditions": [
                "Cluster exists and is paused or pausing"
              ],
              "implementation": "Get() -> List() -> pausePlanRepo.LoadMany()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "regional-server",
          "target_interface": "ListClusters",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Cluster exists"
          ],
          "operations": [
            {
              "operation": "gRPC ListClusters",
              "trigger": "Fetch the target dedicated cluster runtime state through the list path",
              "conditions": [
                "Cluster exists"
              ],
              "implementation": "Get() -> List() -> fetchRegionalClusters() -> regionServerCli.ListClusters()"
            }
          ]
        },
        {
          "name": "cluster-service-ng",
          "target_interface": "TiDBClusterService.ListTiDBGroups",
          "target_repo": "tidbcloud/cluster-service-ng",
          "operation_type": "grpc_unary",
          "conditions": [
            "Cluster exists and show_details is true"
          ],
          "operations": [
            {
              "operation": "gRPC ListTiDBGroups",
              "trigger": "Load TiDB-group topology for the target cluster through the list path",
              "conditions": [
                "Cluster exists and show_details is true"
              ],
              "implementation": "Get() -> List() -> fetchRegionalTidbGroup() -> regionServerCli.ListTidbGroups()"
            }
          ]
        },
        {
          "name": "regional-server",
          "target_interface": "ListPrivateLinkServices",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Cluster exists and show_details is true"
          ],
          "operations": [
            {
              "operation": "gRPC ListPrivateLinkServices",
              "trigger": "Load private-link service inventory for the target cluster through the list path",
              "conditions": [
                "Cluster exists and show_details is true"
              ],
              "implementation": "Get() -> List() -> fetchRegionalPrivateLinkServices() -> regionServerCli.ListPrivateLinkServices()"
            }
          ]
        }
      ]
    },
    "ClusterService.ScaleClusterWithMultiComponent": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the dedicated cluster, target region, and TiDB-group rows before validating the multi-component scale request",
              "conditions": [
                "Always"
              ],
              "implementation": "ScaleClusterWithMultiComponent() -> Scale() -> clusterRepo.GetAndLoadComponents(); regionRepo.SelectRegionById(); tidbGroupRepo.Query(); tidbGroupRepo.LoadDefault()"
            },
            {
              "operation": "UPSERT",
              "trigger": "Persist desired component rows and mark the cluster as scaling before the dynamic workflow starts",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "ScaleClusterWithMultiComponent() -> Scale() -> saveDesiredComponents() -> componentRepo.Save(); clusterRepo.Save()"
            },
            {
              "operation": "SELECT",
              "trigger": "Reload the cluster after persisting desired components so the scaled topology can be emitted in the event payload",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "ScaleClusterWithMultiComponent() -> Scale() -> clusterRepo.GetAndLoadComponents()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "workflow-engine",
          "target_interface": "ListRunningDagInstancesByNamePrefix",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_query",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ListRunningDagInstancesByNamePrefix",
              "trigger": "Check whether a scale workflow is already running for the cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "ScaleClusterWithMultiComponent() -> Scale() -> dag.CanRunScaleDag() -> workflow.ListRunningDagInstancesByNamePrefix()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RegisterDynamicDagThenRun",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
          ],
          "operations": [
            {
              "operation": "RegisterDynamicDagThenRun",
              "trigger": "Register and launch the dynamic dedicated-cluster scale DAG after desired components are saved",
              "conditions": [
                "!request.ValidateOnly && len(cluster.DesiredComponents) > 0"
              ],
              "implementation": "ScaleClusterWithMultiComponent() -> Scale() -> dag.RunScaleDag() -> workflow.RegisterDynamicDagThenRun()"
            }
          ]
        }
      ]
    },
    "ClusterService.SetClientCaCertificate": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetClientCaCertificate": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ApplyCluster": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetBillableClustersCount": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetClusterConfidentialInfo": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.CreateClusterSnapshot": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ListClusterSnapshots": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ListTenantQuota": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.UpdateTenantQuota": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ChangeClusterPasswd": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetDefaultTidbVersion": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetLogRedactionPolicy": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.UpdateLogRedactionPolicy": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.BuildDesiredComponents": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.GetClusterCustomParams": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.SyncSystemVariables": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.SyncPdOnlineConfig": {
      "infrastructure": {},
      "services": []
    },
    "ClusterService.ShutdownUpgradeCluster": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.ListCloudProviders": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load all dedicated cloud-provider rows together with their attached regions",
              "conditions": [
                "Always"
              ],
              "implementation": "repo.ListAllCloudProviders(ctx, req.OrganizationId)"
            }
          ]
        }
      },
      "services": []
    },
    "RegionService.RegisterCloudProvider": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.ListRegions": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.SelectRegionByOrgId": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.OrganizationId != 0"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Resolve the logical region that is visible to the specified organization",
              "conditions": [
                "req.OrganizationId != 0"
              ],
              "implementation": "repo.SelectRegionById(ctx, req.RegionId, req.OrganizationId)"
            }
          ]
        }
      },
      "services": []
    },
    "RegionService.GetRegionByLogicalName": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.UpdateRegion": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.DeleteRegion": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.ListSpus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.GetSpu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.BatchUpsertSpus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.GetInstanceMu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.GetStorageMu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.ListInstanceMus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.ListStorageMus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.BatchUpsertInstanceMus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.BatchUpsertStorageMus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.GetSku": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.ListSkus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.BatchUpsertSkus": {
      "infrastructure": {},
      "services": []
    },
    "TidbNodeGroupService.UpdateTidbNodeGroup": {
      "infrastructure": {},
      "services": []
    },
    "TidbNodeGroupService.DeleteTidbNodeGroup": {
      "infrastructure": {},
      "services": []
    },
    "TidbNodeGroupService.ListTidbNodeGroups": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.DeleteVpc": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.DeleteVpcPeering": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.ListVpcPeerings": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.GetVpcPeering": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.CreateCidr": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.QueryCidrs": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.UpdateCidr": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.DeleteCidr": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.GetDefaultCidr": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.AddSecondaryCidr": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkConnectionService.DeletePrivateLinkService": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkConnectionService.GetPrivateLinkService": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkConnectionService.DeletePrivateLinkEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkConnectionService.ListPrivateLinkEndpoints": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkConnectionService.ListTidbNodeGroupPrivateLinkEndpoints": {
      "infrastructure": {},
      "services": []
    },
    "CustomerManagedEncryptionService.GetCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": []
    },
    "CustomerManagedEncryptionService.ListCustomerManagedEncryptionKeys": {
      "infrastructure": {},
      "services": []
    },
    "CustomerManagedEncryptionService.DeleteCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": []
    },
    "CustomerManagedEncryptionService.GetCmekAccessIamPrincipal": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Validate that the region and cloud provider are active and visible to the organization",
              "conditions": [
                "Always"
              ],
              "implementation": "checkCloudProviderAndRegion() -> regionRepo.SelectRegionById(); regionRepo.GetCloudProviderById()"
            },
            {
              "operation": "SELECT",
              "trigger": "Reload the active region entity before resolving the regional account assignment",
              "conditions": [
                "After CMEK feature-gate and project checks pass"
              ],
              "implementation": "regionRepo.SelectRegionById()"
            },
            {
              "operation": "SELECT",
              "trigger": "Read the Azure CMEK key suffix for the project when returning an Azure principal",
              "conditions": [
                "When CloudProviderId == AZURE"
              ],
              "implementation": "ensureCmekKeySuffix() -> cmekRepo.GetProjectCmekKeySuffix()"
            },
            {
              "operation": "INSERT",
              "trigger": "Persist a newly generated Azure CMEK key suffix when the project does not already have one",
              "conditions": [
                "When CloudProviderId == AZURE and the suffix row does not exist"
              ],
              "implementation": "ensureCmekKeySuffix() -> cmekRepo.SaveProjectCmekKeySuffix()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "target_repo": "tidbcloud/account",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Load project metadata to verify whether CMEK is enabled for the project",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetProject()"
            }
          ]
        },
        {
          "name": "regional-server",
          "target_interface": "GetAccount",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "After region and feature-gate checks pass"
          ],
          "operations": [
            {
              "operation": "gRPC GetAccount",
              "trigger": "Fetch the regional cloud account that owns the CMEK access principal",
              "conditions": [
                "After region and feature-gate checks pass"
              ],
              "implementation": "regionServerCli.GetAccount()"
            }
          ]
        },
        {
          "name": "regional-server",
          "target_interface": "AssignAccount",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "When the regional account is missing"
          ],
          "operations": [
            {
              "operation": "gRPC AssignAccount",
              "trigger": "Assign a regional cloud account so the project can obtain a CMEK access principal",
              "conditions": [
                "When regionServerCli.GetAccount() returns record-not-found"
              ],
              "implementation": "regionServerCli.AssignAccount(CmekEnabled=true)"
            }
          ]
        }
      ]
    },
    "DatabaseAuditLogService.PrecheckAuditLogConfig": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.ListAuditLogFilterRules": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.CreateAuditLogFilterRule": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.DeleteAuditLogFilterRule": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.ReplaceAuditLogFilterRule": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.GetAccount": {
      "infrastructure": {},
      "services": []
    },
    "DatabaseAuditLogService.GenerateAuditLogFileDownloadAddress": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.GetPrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.ListPrivateLinkServiceMigrations": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.CancelPrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": []
    },
    "DataPlatformCompatService.GetCompatCluster": {
      "infrastructure": {},
      "services": []
    },
    "DataPlatformCompatService.GetCompatNetwork": {
      "infrastructure": {},
      "services": []
    },
    "DataPlatformCompatService.GetCompatProvider": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ChangeClusterPasswd": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.SetClusterAuthPubKey": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterConfidentialInfo": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CleanClusters": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ClearCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ScaleCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.PauseCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ResumeCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterCACertificate": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.QueryAccessPoints": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.QueryCidrs": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateClusterJob": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteClusterJob": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.IsClusterJobRegistered": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListClusterJobs": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateClusterSnapshot": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListClusterSnapshots": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetAwsCmek": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CountClusters": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ExecuteCtlCommand": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterTopology": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateDBUser": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpdateDBUser": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListDBUsers": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteDBUser": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetDBUser": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.IsDBUserExisting": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateDBRole": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpdateDBRole": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListDBRoles": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteDBRole": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetDBRole": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListClusters": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetMaintenanceWindowByProjectID": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpdateMaintenanceWindow": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.CreateMaintenanceTask": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetMaintenanceTask": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ListMaintenanceTasks": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteMaintenanceTask": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpdateMaintenanceTask": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpdateCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterJob": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterSnapshot": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.DeleteClusterSnapshot": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.RestoreClusterFromSnapshot": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ImportData": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.ExportData": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetClusterStatus": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.RestartCluster": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.UpgradeCluster": {
      "infrastructure": {},
      "services": []
    }
  },
  "notes": [
    "Flattened the previous approved scan into canonical method keys while retaining old dependency evidence under legacy_summary for methods that still need a deeper per-method source revalidation.",
    "Lifecycle entries are sourced from cmd/dedicated-global-service/main.go and capture startup paths that were missing from the older scan."
  ]
}