{
  "repo": "tidbcloud/tidb-management-service",
  "binary": "serverless-global-service",
  "binary_path": "serverless-global-service/cmd/serverless-global-service/main.go",
  "dependencies": {
    "ServerlessService.Create": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load all serverless cloud-provider rows before building the cluster entity",
              "conditions": [
                "Always"
              ],
              "implementation": "cloudProviderRepo.LoadAll()"
            },
            {
              "operation": "INSERT",
              "trigger": "Persist the new serverless cluster metadata before the async workflow starts",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "clusterRepo.Save()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "billing-service",
          "target_interface": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
          "target_repo": "tidbcloud/billing",
          "operation_type": "http_post",
          "conditions": [
            "When spend_limit.monthly > 0 or auto_scaling.max_rcu > 0"
          ],
          "operations": [
            {
              "operation": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
              "trigger": "Verify that the tenant may create a scalable serverless cluster in the target region/provider",
              "conditions": [
                "When the request is not the free-cluster path"
              ],
              "implementation": "billingFacade.CanCreateScalableCluster()"
            }
          ]
        },
        {
          "name": "serverless-service",
          "target_interface": "ServerlessServerlessBillingService.SetSpendLimit",
          "target_repo": "tidbcloud/serverless-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "!req.ValidateOnly && req.AutoScaling.MaxRcu == 0 && req.SpendLimit.Monthly == 0"
          ],
          "operations": [
            {
              "operation": "gRPC SetSpendLimit",
              "trigger": "Initialize free-plan spend limit after the cluster row is committed",
              "conditions": [
                "Starter-plan creation with zero monthly spend limit"
              ],
              "implementation": "serverlessFacade.SetSpendLimit()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous serverless-cluster creation DAG",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "flow.RunDagWithBizId(common.CreateCluster, ...)"
            }
          ]
        }
      ],
      "description": "Creates a serverless cluster by validating billing, persisting global metadata, optionally initializing spend limit, and then launching the async create workflow"
    },
    "ServerlessService.Update": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the serverless cluster row before reconciling spend-limit and autoscaling changes",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.Get()"
            },
            {
              "operation": "UPDATE",
              "trigger": "Persist ru_version changes before the async update workflow starts",
              "conditions": [
                "When req.Cluster.RuVersion > 0 and !req.ValidateOnly"
              ],
              "implementation": "clusterRepo.UpdateRuVersion()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ListCluster",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCluster",
              "trigger": "Load the current regional runtime cluster before applying update semantics",
              "conditions": [
                "Always"
              ],
              "implementation": "regionalService.ListCluster()"
            }
          ]
        },
        {
          "name": "billing-service",
          "target_interface": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
          "target_repo": "tidbcloud/billing",
          "operation_type": "http_post",
          "conditions": [
            "When spend-limit or autoscaling fields request scalable-cluster semantics"
          ],
          "operations": [
            {
              "operation": "POST /api/v1/billing/tenants/{tenant_id}/billing_action_check",
              "trigger": "Verify that the tenant may enable or keep scalable-cluster capacity semantics",
              "conditions": [
                "When spend-limit or autoscaling changes are requested"
              ],
              "implementation": "billingFacade.CanCreateScalableCluster()"
            }
          ]
        },
        {
          "name": "serverless-service",
          "target_interface": "ServerlessServerlessBillingService.GetSpendLimit",
          "target_repo": "tidbcloud/serverless-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "When req.Cluster.SpendLimit != nil"
          ],
          "operations": [
            {
              "operation": "gRPC GetSpendLimit",
              "trigger": "Read the current spend-limit state before validating a spend-limit update",
              "conditions": [
                "When req.Cluster.SpendLimit != nil"
              ],
              "implementation": "serverlessFacade.GetSpendLimit()"
            }
          ]
        },
        {
          "name": "serverless-service",
          "target_interface": "ServerlessServerlessBillingService.SetSpendLimit",
          "target_repo": "tidbcloud/serverless-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "When req.Cluster.SpendLimit != nil"
          ],
          "operations": [
            {
              "operation": "gRPC SetSpendLimit",
              "trigger": "Write the new spend-limit state before the async update workflow starts",
              "conditions": [
                "When req.Cluster.SpendLimit != nil"
              ],
              "implementation": "serverlessFacade.SetSpendLimit()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!req.ValidateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous serverless-cluster update DAG",
              "conditions": [
                "!req.ValidateOnly"
              ],
              "implementation": "flow.RunDagWithBizId(common.UpdateCluster, ...)"
            }
          ]
        }
      ],
      "description": "Updates serverless cluster metadata by reconciling regional runtime state, spend-limit changes, billing gates, and the async update workflow"
    },
    "ServerlessService.Delete": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the serverless cluster row before delete validation and service-plan derivation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterRepo.Get()"
            },
            {
              "operation": "DELETE",
              "trigger": "Delete the global cluster metadata row before the async delete workflow starts",
              "conditions": [
                "!validateOnly"
              ],
              "implementation": "clusterRepo.Delete()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ListCluster",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Best-effort before deletion"
          ],
          "operations": [
            {
              "operation": "gRPC ListCluster",
              "trigger": "Inspect the regional cluster to infer whether the deleted cluster was starter or essential plan",
              "conditions": [
                "Best-effort before deletion"
              ],
              "implementation": "regionalService.ListCluster()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "DeleteDagInstances",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!validateOnly"
          ],
          "operations": [
            {
              "operation": "DeleteDagInstances",
              "trigger": "Remove stale delete DAG instances before launching a fresh delete workflow",
              "conditions": [
                "!validateOnly"
              ],
              "implementation": "flow.DeleteDagInstances(common.DeleteCluster)"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "RunDagWithBizId",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_command",
          "conditions": [
            "!validateOnly"
          ],
          "operations": [
            {
              "operation": "RunDagWithBizId",
              "trigger": "Launch the asynchronous serverless-cluster delete DAG",
              "conditions": [
                "!validateOnly"
              ],
              "implementation": "flow.RunDagWithBizId(common.DeleteCluster, ...)"
            }
          ]
        }
      ],
      "description": "Deletes a serverless cluster by removing global metadata and then launching the async delete workflow after a best-effort regional inspection"
    },
    "ServerlessService.List": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "req.Filter != nil"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load serverless cluster rows that match cluster/project/tenant/cloud-provider filters",
              "conditions": [
                "Request carries any non-zero ClusterQueryParameter field"
              ],
              "implementation": "loadClustersAndRegionsFromRepo() -> clusterRepo.Query()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load all visible regions when the request has no effective cluster filter",
              "conditions": [
                "ClusterQueryParameter is zero after filter translation"
              ],
              "implementation": "loadAllRegions() -> regionRepo.LoadRegions()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ListCluster",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Per active region returned by the repo filter"
          ],
          "operations": [
            {
              "operation": "gRPC ListCluster",
              "trigger": "Fetch regional runtime cluster details for the active clusters that belong to each region",
              "conditions": [
                "Per region with at least one active cluster"
              ],
              "implementation": "clusterService.List() -> regionalService.ListCluster()"
            }
          ]
        },
        {
          "name": "workflow-engine",
          "target_interface": "ListRunningDagInstances",
          "target_repo": "tidbcloud/fastflow",
          "operation_type": "workflow_query",
          "conditions": [
            "For creating clusters or when show_details is true"
          ],
          "operations": [
            {
              "operation": "ListRunningDagInstances",
              "trigger": "Merge create/update workflow state into returned cluster objects",
              "conditions": [
                "For creating clusters and for detail enrichment"
              ],
              "implementation": "mergeCreatingCluster() / appendClusterDetailField() -> flow.ListRunningDagInstances()"
            }
          ]
        },
        {
          "name": "serverless-service",
          "target_interface": "ServerlessServerlessBillingService.GetSpendLimit",
          "target_repo": "tidbcloud/serverless-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "show_details == true && cluster.auto_scaling.max_rcu == 0"
          ],
          "operations": [
            {
              "operation": "gRPC GetSpendLimit",
              "trigger": "Hydrate spend-limit details for returned clusters that are not RCU-based",
              "conditions": [
                "Only during detail enrichment for non-RCU clusters"
              ],
              "implementation": "appendClusterDetailField() -> serverlessFacade.GetSpendLimit()"
            }
          ]
        },
        {
          "name": "dataflow-service",
          "target_interface": "GetAutoBackupPolicy",
          "target_repo": "tidbcloud/dataflow-service",
          "operation_type": "internal_client",
          "conditions": [
            "show_details == true"
          ],
          "operations": [
            {
              "operation": "GetAutoBackupPolicy",
              "trigger": "Hydrate auto-backup policy details for returned clusters",
              "conditions": [
                "Only during detail enrichment"
              ],
              "implementation": "appendClusterDetailField() -> brFacade.GetAutoBackupPolicy()"
            }
          ]
        }
      ],
      "description": "Lists serverless clusters by combining global metadata, regional runtime state, and optional detail enrichment"
    },
    "ServerlessService.CheckCloudStoragePermission": {
      "infrastructure": {},
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessService.CheckCloudStoragePermission",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CheckCloudStoragePermission",
              "trigger": "Check cloud storage access in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.CheckCloudStoragePermission()"
            }
          ]
        }
      ],
      "description": "Checks cloud storage access for auditlog/export/changefeed"
    },
    "ServerlessImportService.CheckImportPermission": {
      "infrastructure": {},
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessImportService.CheckImportPermission",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CheckImportPermission",
              "trigger": "Check import permission in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.CheckImportPermission()"
            }
          ]
        }
      ],
      "description": "Checks import permission for cloud storage"
    },
    "ServerlessImportService.Precheck": {
      "infrastructure": {},
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessImportService.Precheck",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC Precheck",
              "trigger": "Run import precheck in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.Precheck()"
            }
          ]
        }
      ],
      "description": "Prechecks data import"
    },
    "ServerlessDMService.Precheck": {
      "infrastructure": {},
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessDMService.Precheck",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC Precheck",
              "trigger": "Run DM precheck in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.DMPrecheck()"
            }
          ]
        }
      ],
      "description": "DM precheck"
    },
    "ServerlessDMService.CreateVpcEndpoint": {
      "infrastructure": {},
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessDMService.CreateVpcEndpoint",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateVpcEndpoint",
              "trigger": "Create DM VPC endpoint in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.CreateVpcEndpoint()"
            }
          ]
        }
      ],
      "description": "Creates VPC endpoint for DM"
    },
    "ServerlessPrivateLinkConnectionService.CreateAWSVpcEndpoint": {
      "infrastructure": {
        "aws_vpc_endpoint": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "CREATE",
              "trigger": "Create AWS VPC endpoint for serverless private link",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.CreateAWSVpcEndpoint()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ServerlessPrivateLinkConnectionService.CreateAWSVpcEndpoint",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAWSVpcEndpoint",
              "trigger": "Create AWS VPC endpoint in serverless regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessRegionalCli.CreateAWSVpcEndpoint()"
            }
          ]
        }
      ]
    },
    "ServerlessPrivateLinkConnectionService.CreateAWSRoute53Records": {
      "infrastructure": {
        "aws_route53": {
          "conditions": [
            "When creating AWS private-link DNS records"
          ],
          "operations": [
            {
              "operation": "CREATE_RECORDS",
              "trigger": "Create Route53 records for serverless private-link access",
              "implementation": "Delegated to the regional private-link service"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "CreateAWSRoute53Records",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAWSRoute53Records",
              "trigger": "Forward Route53 record creation to the regional service",
              "implementation": "serverless-regional-service CreateAWSRoute53Records"
            }
          ]
        }
      ]
    },
    "ServerlessPrivateLinkConnectionService.CreateAliCloudVpcEndpoint": {
      "infrastructure": {
        "alicloud_vpc_endpoint": {
          "conditions": [
            "When creating AliCloud private-link endpoints"
          ],
          "operations": [
            {
              "operation": "CREATE_ENDPOINT",
              "trigger": "Create AliCloud VPC endpoint resources for private-link access",
              "implementation": "Delegated to the regional private-link service"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "CreateAliCloudVpcEndpoint",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAliCloudVpcEndpoint",
              "trigger": "Forward AliCloud VPC endpoint creation to the regional service",
              "implementation": "serverless-regional-service CreateAliCloudVpcEndpoint"
            }
          ]
        }
      ]
    },
    "ServerlessPrivateLinkConnectionService.CreateAliCloudDNSRecord": {
      "infrastructure": {
        "alicloud_dns": {
          "conditions": [
            "When creating AliCloud private-link DNS records"
          ],
          "operations": [
            {
              "operation": "CREATE_RECORDS",
              "trigger": "Create AliCloud DNS records for private-link access",
              "implementation": "Delegated to the regional private-link service"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "CreateAliCloudDNSRecord",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAliCloudDNSRecord",
              "trigger": "Forward AliCloud DNS record creation to the regional service",
              "implementation": "serverless-regional-service CreateAliCloudDNSRecord"
            }
          ]
        }
      ]
    },
    "ServerlessPrivateLinkConnectionService.CreateMSKVPCConnection": {
      "infrastructure": {
        "aws_msk": {
          "conditions": [
            "When creating MSK private connectivity"
          ],
          "operations": [
            {
              "operation": "CREATE_CONNECTION",
              "trigger": "Create MSK VPC connection resources",
              "implementation": "Delegated to the regional private-link service"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "CreateMSKVPCConnection",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateMSKVPCConnection",
              "trigger": "Forward MSK VPC connection creation to the regional service",
              "implementation": "serverless-regional-service CreateMSKVPCConnection"
            }
          ]
        }
      ]
    },
    "SqlUserService.CreateSqlUser": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "When loading cluster metadata before SQL user creation"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load cluster metadata needed for SQL user creation",
              "implementation": "Cluster metadata lookup before proxy execution"
            }
          ]
        },
        "aws_kms": {
          "conditions": [
            "When password material needs encryption"
          ],
          "operations": [
            {
              "operation": "ENCRYPT",
              "trigger": "Encrypt SQL user password material before proxy submission",
              "implementation": "AWS KMS password encryption"
            }
          ]
        }
      },
      "services": [
        {
          "name": "cluster-proxy",
          "target_interface": "SQL execution endpoint",
          "target_repo": "tidbcloud/cluster-proxy",
          "operation_type": "sql_proxy_call",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "EXECUTE SQL",
              "trigger": "Create the SQL user on the target cluster",
              "implementation": "Cluster proxy executes the SQL statement against the cluster"
            }
          ]
        }
      ],
      "description": "Creates SQL user via cluster proxy"
    },
    "SqlUserService.ListSqlUsers": {
      "infrastructure": {},
      "services": [
        {
          "name": "cluster-proxy",
          "target_interface": "SQL query endpoint",
          "target_repo": "tidbcloud/cluster-proxy",
          "operation_type": "sql_proxy_call",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "QUERY SQL",
              "trigger": "List SQL users from the target cluster",
              "implementation": "Cluster proxy executes the SQL query against the cluster"
            }
          ]
        }
      ],
      "description": "Lists SQL users via cluster proxy"
    },
    "ServerlessGlobalLifecycle.Startup": {
      "infrastructure": {
        "pprof": {
          "conditions": [
            "Always in serve mode"
          ],
          "operations": [
            {
              "operation": "REGISTER",
              "trigger": "Expose pprof handlers on the TiInf Gin engine",
              "conditions": [
                "Always"
              ],
              "implementation": "pprof.Register(inf.GinEngine())"
            },
            {
              "operation": "START",
              "trigger": "Enable autopprof runtime sampling",
              "conditions": [
                "autopprof.Start succeeds or unsupported platform is ignored"
              ],
              "implementation": "autopprof.Start(autopprof.DefaultOption)"
            }
          ]
        }
      },
      "services": []
    },
    "ServerlessGlobalLifecycle.SetupGRPCServer": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessGlobalLifecycle.RunDBMigrate": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always during setup()"
          ],
          "operations": [
            {
              "operation": "MIGRATE",
              "trigger": "Apply DB migrations before workflow/eventbus startup",
              "conditions": [
                "Always"
              ],
              "implementation": "setup() -> register.DiCall(migrate.RunDBMigrate)"
            }
          ]
        }
      },
      "services": []
    },
    "ServerlessGlobalLifecycle.StartEventbus": {
      "infrastructure": {
        "kafka": {
          "conditions": [
            "Always during setup()"
          ],
          "operations": [
            {
              "operation": "RUN EVENTBUS",
              "trigger": "Start eventbus and WAL watcher",
              "conditions": [
                "Always"
              ],
              "implementation": "setup() -> eventWatcher.Start(); eventbus.Run()"
            }
          ]
        }
      },
      "services": []
    },
    "ServerlessGlobalLifecycle.StartWorkflow": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessService.GetEncryptedCloudAdminPwd": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessService.CountClusters": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessService.UpdateAuditLogConfig": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.ChangeSqlUserPasswd": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load the serverless cluster metadata before password rotation",
              "conditions": [
                "Always"
              ],
              "implementation": "getCluster() -> clusterRepo.Get()"
            },
            {
              "operation": "UPDATE",
              "trigger": "Persist HasSetPwd after the root password is changed successfully",
              "conditions": [
                "req.UserName has suffix root"
              ],
              "implementation": "UpdateSqlUserPassword() -> clusterRepo.Save()"
            }
          ]
        },
        "aws_kms": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DECRYPT",
              "trigger": "Decrypt the stored cloud-admin password before building the cluster operator",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateSqlUserPassword() -> encryptor.DecryptBase64()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-regional-service",
          "target_interface": "ListCluster",
          "target_repo": "tidbcloud/tidb-management-service",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCluster",
              "trigger": "Resolve the regional cluster proxy endpoint and version before changing the password",
              "conditions": [
                "Always"
              ],
              "implementation": "getCluster() -> regionalSvc.ListCluster()"
            }
          ]
        },
        {
          "name": "cluster-proxy",
          "target_interface": "CentralService.ChangePasswordByClusterID",
          "target_repo": "tidbcloud/clusterproxy",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP POST /change_password",
              "trigger": "Execute the SQL-user password rotation against the target TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateSqlUserPassword() -> clusterProxyProvider.GetClusterProxy() -> proxy.ChangePassword()"
            }
          ]
        }
      ]
    },
    "SqlUserService.UpdateSqlUser": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.DeleteSqlUser": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.GetSqlUser": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.IsSqlUserExisting": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.CreateSqlRole": {
      "infrastructure": {},
      "services": []
    },
    "SqlUserService.UpdateSqlRole": {
      "infrastructure": {},
      "services": []
    },
    "CloudProviderService.Register": {
      "infrastructure": {},
      "services": []
    },
    "CloudProviderService.List": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "trigger": "Load candidate cloud-provider rows for the requested service plan and optional state/provider filter",
              "conditions": [
                "Always"
              ],
              "implementation": "regionRepo.ListCloudProviders() -> ReadDB(Model Provider).Find()"
            },
            {
              "operation": "SELECT",
              "trigger": "Load matching region rows and tenant visibility bindings for each returned provider",
              "conditions": [
                "Once per returned cloud provider"
              ],
              "implementation": "regionRepo.ListCloudProviders() -> ListRegions() -> ReadDB(Model Region).InnerJoins(Provider).Preload(RegionTenants).Find()"
            }
          ]
        }
      },
      "services": []
    },
    "RegionService.Register": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.List": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.Update": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.Get": {
      "infrastructure": {},
      "services": []
    },
    "RegionService.Delete": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessDMService.DescribeVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessDMService.DeleteVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessDMService.ListVpcEndpointZones": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessDMService.RemoveZoneFromVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DescribeAWSVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAWSVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DescribeAliCloudVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAliCloudVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.GetZoneIds": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.ListAliCloudVpcEndpointZones": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.RemoveAliCloudZoneFromVpcEndpoint": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAliCloudDNSRecord": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAWSRoute53Records": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.GetAWSRoute53Change": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.CreateAWSRoute53PrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAWSRoute53PrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.CreateAliCloudDNSPrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteAliCloudDNSPrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.AttachVpcToAliCloudDNSPrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DetachVpcFromAliCloudDNSPrivateHostedZone": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.DeleteMSKVPCConnection": {
      "infrastructure": {},
      "services": []
    },
    "ServerlessPrivateLinkConnectionService.GetMSKVPCConnection": {
      "infrastructure": {},
      "services": []
    }
  },
  "notes": [
    "Preserved the previous scan output as reference while normalizing the file into canonical top-level fields and adding lifecycle methods.",
    "Methods with no explicit dependency entry after normalization remain coverage placeholders and should be revisited if future source review finds hidden branches or helper-driven calls."
  ]
}