{
  "repo": "tidbcloud/tidb-management-service",
  "binary": "tidb-mgmt-service",
  "binary_path": "tidb-mgmt-service/cmd/tidb-mgmt-service/main.go",
  "dependencies": {
    "TidbMgmtLifecycle.Startup": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "CONNECT",
              "trigger": "Initialize gorm database and repositories before service registration",
              "conditions": [
                "Always"
              ],
              "implementation": "db.InitDB(cfg.DB, migration.Records); db.NewProvider(gormdb)"
            }
          ]
        },
        "pprof": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "START",
              "trigger": "Enable autopprof runtime sampling",
              "conditions": [
                "autopprof.Start succeeds or unsupported platform is ignored"
              ],
              "implementation": "autopprof.Start(autopprof.DefaultOption)"
            }
          ]
        }
      },
      "services": []
    },
    "TidbMgmtLifecycle.RegisterBusinessHandlers": {
      "infrastructure": {},
      "services": []
    },
    "TidbMgmtLifecycle.SetupRegionalReverseProxy": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "HTTP /proxy/clusters/*, /proxy/regions/*",
          "operation_type": "http_proxy",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always for /proxy/clusters/* and /proxy/regions/*; bearer token must match cfg.ServerRuntimeConfig.APIKey except readonly routes"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward dedicated control-plane traffic to the correct regional endpoint",
              "conditions": [
                "Route matched"
              ],
              "implementation": "proxy.SetUpReverseProxy -> NewReverseProxy(regionalEndpointByCluster / regionalEndpoint)"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_interface": "HTTP /proxy/nextgen/* and readonly dataplane/controlPlane routes",
          "operation_type": "http_proxy",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always for matched nextgen routes; readonly GET routes intentionally bypass bearer auth"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward nextgen control-plane, dataplane, and resource pool requests to the correct regional endpoint",
              "conditions": [
                "Route matched"
              ],
              "implementation": "proxy.SetUpReverseProxy -> NewReverseProxy(nextgenRegionalEndpointByCluster / nextgenRegionalEndpointByResourcePool / nextRegionalEndpoint)"
            }
          ]
        }
      ]
    },
    "TidbMgmtLifecycle.StartShadowPoolWorker": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CreateServerlessCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Create cluster record",
              "implementation": "clusterRepo.Create()"
            },
            {
              "operation": "INSERT",
              "table": "custom_statuses",
              "purpose": "Initialize cluster status",
              "implementation": "customStatusRepo.Set()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_interface": "ServerlessService.Create",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCluster",
              "trigger": "Create serverless cluster in regional service",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessCli.CreateCluster()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetUserByEmail",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when created_by is an email address"
          ],
          "operations": [
            {
              "operation": "gRPC GetUserByEmail",
              "trigger": "Resolve the request user ID and email before building request metadata for the internal create path",
              "conditions": [
                "created_by is an email address"
              ],
              "implementation": "fillUserInfo() -> accountCli.GetUserByEmail(ctx, createdBy)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOpenAPIAccess",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when created_by starts with apikey-"
          ],
          "operations": [
            {
              "operation": "gRPC GetOpenAPIAccess",
              "trigger": "Resolve the OpenAPI key owner org before creating the internal request user context",
              "conditions": [
                "created_by starts with apikey-"
              ],
              "implementation": "fillUserInfo() -> accountCli.GetOpenAPIAccess(ctx, publicKey)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrCreateSystemUser",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when created_by starts with apikey- and OpenAPI access lookup succeeds"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrCreateSystemUser",
              "trigger": "Materialize the system user used as the effective creator for API-key initiated cluster creation",
              "conditions": [
                "created_by starts with apikey-",
                "GetOpenAPIAccess succeeded"
              ],
              "implementation": "fillUserInfo() -> accountCli.GetOrCreateSystemUser(ctx, oaAccess.Org.Id)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetUserByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when created_by is parsed as a numeric user ID"
          ],
          "operations": [
            {
              "operation": "gRPC GetUserByID",
              "trigger": "Resolve the explicit user ID into the email-backed request metadata used by the internal create path",
              "conditions": [
                "created_by is neither an email address nor an apikey-* value"
              ],
              "implementation": "fillUserInfo() -> accountCli.GetUserById(ctx, userId)"
            }
          ]
        }
      ]
    },
    "InternalClusterService.RestoreDedicatedCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Create restored cluster record",
              "implementation": "clusterRepo.Create()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "CoreService.CreateCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == DEDICATED"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCluster (restore)",
              "trigger": "Restore dedicated cluster from backup",
              "conditions": [
                "Always"
              ],
              "implementation": "dedicatedCli.CreateCluster()"
            }
          ]
        },
        {
          "name": "dataflow-service",
          "target_interface": "BackupInternalService.GetBackup",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/dataflow-service",
          "conditions": [
            "RestoreId != 0"
          ],
          "operations": [
            {
              "operation": "gRPC GetBackup",
              "trigger": "Get backup metadata for restore",
              "conditions": [
                "RestoreId provided"
              ],
              "implementation": "dataflowCli.GetBackup()"
            }
          ]
        }
      ]
    },
    "InternalClusterService.ScaleClusterComponents": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Get current cluster state",
              "implementation": "clusterRepo.Get()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Update cluster configuration",
              "implementation": "clusterRepo.Update()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "ClusterService.ScaleCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == DEDICATED"
          ],
          "operations": [
            {
              "operation": "gRPC ScaleCluster",
              "trigger": "Scale dedicated cluster components",
              "conditions": [
                "DeployType == DEDICATED"
              ],
              "implementation": "dedicatedCli.ScaleCluster()"
            }
          ]
        }
      ]
    },
    "InternalClusterService.ApplyCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Get cluster current state",
              "implementation": "clusterRepo.Get()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Apply cluster changes",
              "implementation": "clusterRepo.Update()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "InternalClusterService.ApplyCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ApplyCluster",
              "trigger": "Apply cluster configuration in dedicated-global",
              "conditions": [
                "Always"
              ],
              "implementation": "dedicatedCli.ApplyCluster()"
            }
          ]
        }
      ]
    },
    "InternalClusterService.CleanClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "List clusters to clean",
              "implementation": "clusterRepo.ListByOrganization()"
            },
            {
              "operation": "DELETE",
              "table": "clusters",
              "purpose": "Delete cluster records",
              "implementation": "clusterRepo.DeleteByOrganization()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_interface": "ServerlessService.Delete",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == SERVERLESS"
          ],
          "operations": [
            {
              "operation": "gRPC Delete (batch)",
              "trigger": "Delete all serverless clusters",
              "conditions": [
                "DeployType == SERVERLESS"
              ],
              "implementation": "serverlessCli.DeleteCluster() (loop)"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_interface": "ClusterService.DeleteCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == DEDICATED"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCluster (batch)",
              "trigger": "Delete all dedicated clusters",
              "conditions": [
                "DeployType == DEDICATED"
              ],
              "implementation": "dedicatedCli.DeleteCluster() (loop)"
            }
          ]
        }
      ]
    },
    "ClusterCustomStatusService.SetClusterCustomStatus": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT/UPDATE",
              "table": "custom_statuses",
              "purpose": "Set cluster custom status",
              "implementation": "customStatusRepo.Set()"
            }
          ]
        }
      },
      "services": []
    },
    "ClusterCustomStatusService.GetClusterCustomStatusByID": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Get cluster custom status by ID",
              "implementation": "customStatusRepo.GetByID()"
            }
          ]
        }
      },
      "services": []
    },
    "ClusterCustomStatusService.ListClusterCustomStatus": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "List cluster custom statuses",
              "implementation": "customStatusRepo.List()"
            }
          ]
        }
      },
      "services": []
    },
    "VpcPeeringService.CreateVpcPeering": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Get cluster network info",
              "implementation": "clusterRepo.Get()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "VpcService.CreateVpcPeering",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateVpcPeering",
              "trigger": "Create VPC peering connection",
              "conditions": [
                "Always"
              ],
              "implementation": "dedicatedCli.CreateVpcPeering()"
            }
          ]
        }
      ]
    },
    "VpcPeeringService.ListVpcPeerings": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_interface": "VpcService.ListVpcPeerings",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListVpcPeerings",
              "trigger": "List VPC peerings",
              "conditions": [
                "Always"
              ],
              "implementation": "dedicatedCli.ListVpcPeerings()"
            }
          ]
        }
      ]
    },
    "DataPlaneService.GetCompatCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Get cluster metadata",
              "implementation": "clusterRepo.Get()"
            }
          ]
        }
      },
      "services": []
    },
    "OrganizationConfigService.UpdateOrganizationDefaultRuVersion": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT/UPDATE",
              "table": "organization_ru_configs",
              "purpose": "Update organization RU version config",
              "implementation": "orgRuConfigRepo.Set()"
            }
          ]
        }
      },
      "services": []
    },
    "OrganizationConfigService.GetOrganizationDefaultRuVersion": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "organization_ru_configs",
              "purpose": "Get organization RU version config",
              "implementation": "orgRuConfigRepo.Get()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalMaintenanceService.CreateMaintenanceTask": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters, maintenance_windows",
              "purpose": "Validate that all requested cluster IDs still map to active dedicated clusters and load any existing maintenance window for the project",
              "implementation": "clusterRepo.QueryClusterByFilterAndPage(); mwRepo.LoadByProjectID()"
            },
            {
              "operation": "INSERT",
              "table": "maintenance_tasks, maintenance_task_executions",
              "purpose": "Create the maintenance task plus one execution row per referenced cluster",
              "implementation": "mtRepo.Save(); mteRepo.Save()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when the project does not yet have a persisted maintenance window"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Resolve the project before deriving tenant timezone for the default maintenance window",
              "conditions": [
                "When mwRepo.LoadByProjectID() returns record-not-found"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetProjectByID()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Only when the project does not yet have a persisted maintenance window"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Resolve the tenant timezone used to synthesize the default maintenance window",
              "conditions": [
                "When mwRepo.LoadByProjectID() returns record-not-found"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.CreateTidb": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Persist nextgen cluster record before create DAG submission",
              "implementation": "clusterRepo.InsertNewCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "project label provided"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Validate labeled project belongs to org and is a valid TiDB X project",
              "conditions": [
                "Project label present"
              ],
              "implementation": "accountCli.GetProject()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.CreateCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCluster (validate only)",
              "trigger": "Validate nextgen cluster create request against global control plane before persistence and DAG launch",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.CreateCluster() -> nextGenCli.CreateCluster(validateOnly=true)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.AddClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "validateOnly == false"
          ],
          "operations": [
            {
              "operation": "gRPC AddClusterRelations",
              "trigger": "Initialize cluster relation bindings after nextgen create DAG submission",
              "conditions": [
                "Create is not validate-only"
              ],
              "implementation": "accountCli.UpsertClusterRelations()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.UpdateTidb": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Update nextgen display name, labels, and touch timestamp in management DB",
              "implementation": "clusterRepo.UpdateDisplayName() + clusterRepo.UpdateLabels() + clusterRepo.TouchCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch custom status for response override",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load current nextgen cluster state before rebuilding update request",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.GetCluster() -> nextGenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "MaxRcu/MinRcu or other mutable global fields are changed"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateCluster",
              "trigger": "Apply nextgen cluster update to global control plane",
              "conditions": [
                "Update request contains mutable global fields"
              ],
              "implementation": "clusterSvc.UpdateCluster() -> nextGenCli.UpdateCluster()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.RestoreTidb": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Create restored cluster record",
              "implementation": "clusterRepo.Create()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_interface": "ClusterService.RestoreCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC RestoreCluster",
              "trigger": "Restore nextgen cluster from backup",
              "conditions": [
                "Always"
              ],
              "implementation": "nextgenCli.RestoreCluster()"
            }
          ]
        },
        {
          "name": "dataflow-service",
          "target_interface": "BackupInternalService.GetBackup",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/dataflow-service",
          "conditions": [
            "BackupId provided"
          ],
          "operations": [
            {
              "operation": "gRPC GetBackup",
              "trigger": "Get backup metadata",
              "conditions": [
                "BackupId provided"
              ],
              "implementation": "dataflowCli.GetBackup()"
            }
          ]
        }
      ]
    },
    "ZeroInstanceService.AllocateZeroInstance": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "shadow_pools",
              "purpose": "Find available zero instance",
              "implementation": "shadowPoolRepo.GetAvailable()"
            },
            {
              "operation": "UPDATE",
              "table": "shadow_pools",
              "purpose": "Mark zero instance as allocated",
              "implementation": "shadowPoolRepo.Allocate()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "SqlUserService.ChangeSqlUserPasswd",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ChangeSqlUserPasswd",
              "trigger": "Reset the root password on the rented zero-instance cluster through the serverless cluster service",
              "conditions": [
                "Always"
              ],
              "implementation": "AllocateZeroInstance() -> serverlessClusterSvc.RentCluster() -> serverlessCli.ChangeSqlUserPasswd()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Reload the rented zero-instance cluster through the standard GetCluster/List path before building the connection payload",
              "conditions": [
                "Always"
              ],
              "implementation": "AllocateZeroInstance() -> serverlessClusterSvc.RentCluster() -> GetCluster() -> ListClusters() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "ZeroInstanceService.GetZeroInstance": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "shadow_pools",
              "purpose": "Get zero instance info",
              "implementation": "shadowPoolRepo.Get()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Resolve the zero id back to a full serverless cluster through GetClusterByZeroID -> GetCluster -> ListClusters",
              "conditions": [
                "Always"
              ],
              "implementation": "GetZeroInstance() -> serverlessClusterSvc.GetClusterByZeroID() -> GetCluster() -> ListClusters() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.ListTidbs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Count and page nextgen cluster base records before remote enrichment",
              "implementation": "clusterSvc.CountClusters() + clusterRepo.QueryClusterByFilterAndPage()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch cluster custom status for response enrichment",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListClusters",
          "operation_type": "grpc_unary",
          "conditions": [
            "CountClusters > 0",
            "clusterFilter.View != Local"
          ],
          "operations": [
            {
              "operation": "gRPC ListClusters",
              "trigger": "Enrich nextgen cluster records with global runtime state",
              "conditions": [
                "Base cluster ids found in MySQL",
                "View != Local"
              ],
              "implementation": "clusterSvc.ListClusters() -> nextGenCli.ListClusters()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.CheckOperatorHasClusterRole",
          "operation_type": "grpc_unary",
          "conditions": [
            "checkIfCanListAllTidbs() == false"
          ],
          "operations": [
            {
              "operation": "gRPC CheckOperatorHasClusterRole",
              "trigger": "Post-filter visible clusters when caller cannot list all org TiDBs",
              "conditions": [
                "Caller lacks org-wide list permission"
              ],
              "implementation": "accountCli.CheckOperatorHasClusterRole()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetTidb": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load nextgen cluster record before global lookup",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch custom status for response override",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "view != Local"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Enrich nextgen cluster with global control-plane state",
              "conditions": [
                "View != Local"
              ],
              "implementation": "clusterSvc.GetCluster() -> nextGenCli.GetCluster()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.DeleteTidb": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "table": "clusters",
              "purpose": "Delete nextgen cluster record before delete DAG submission",
              "implementation": "clusterRepo.DeleteCluster()"
            },
            {
              "operation": "DELETE",
              "table": "custom_statuses",
              "purpose": "Delete cluster custom status records",
              "implementation": "customStatusRepo.DeleteClusterCustomStatusByCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.DeleteCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCluster (validate only)",
              "trigger": "Validate nextgen cluster deletion before DAG submission",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.DeleteCluster() -> nextGenCli.DeleteCluster(validateOnly=true)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.DeleteClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "validateOnly == false"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteClusterRelations",
              "trigger": "Remove cluster relation bindings after nextgen delete DAG submission",
              "conditions": [
                "Delete is not validate-only"
              ],
              "implementation": "accountCli.DeleteClusterRelations()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.ResetRootPassword": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load the nextgen cluster record before root password reset",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check mutex custom status before changing the nextgen root password",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Touch the local cluster row before refreshing the post-change state from nextgen-global-service",
              "implementation": "clusterRepo.TouchCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ChangeClusterPasswd",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ChangeClusterPasswd",
              "trigger": "Reset the nextgen cluster root password in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.SetRootPassword() -> nextGenCli.ChangeClusterPasswd()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Refresh nextgen cluster state after the root password change completes",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.SetRootPassword() -> nextGenCli.GetCluster()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetCloudProviderInfo": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetProviderRole",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProviderRole",
              "trigger": "Load the cloud IAM identity and external id for the target nextgen cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCloudProviderInfo() -> clusterSvc.GetProviderRole() -> nextgenCli.GetProviderRole()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.EstimatePrice": {
      "infrastructure": {},
      "services": []
    },
    "NextgenTidbService.ListBackupPolicies": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "BackupService.ListBackupPolicies",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListBackupPolicies",
              "trigger": "List backup policy tiers that are available for the selected TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "ListBackupPolicies() -> nextGenCli.ListBackupPolicies()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetBackupSetting": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Ensure the target TiDB cluster exists locally before reading backup settings",
              "implementation": "clusterRepo.GetCluster() / clusterSvc.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetBackupSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetBackupSetting",
              "trigger": "Fetch the current backup setting for the target TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetBackupSetting() -> nextGenCli.GetBackupSetting()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.UpdateBackupSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateBackupSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateBackupSetting",
              "trigger": "Update the target TiDB backup setting in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateBackupSetting() -> nextGenCli.UpdateBackupSetting()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.ListTidbBackups": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListClusterBackups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListClusterBackups",
              "trigger": "List backups that belong to the selected TiDB cluster from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListTidbBackups() -> nextGenCli.ListClusterBackups()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.DeleteTidbBackup": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Validate that the target TiDB cluster exists and belongs to the caller organization before deleting a cluster backup",
              "implementation": "clusterRepo.List() / clusterSvc.ListClusters()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenBackupService.ListBackups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListBackups",
              "trigger": "Load the requested backup under the target TiDB cluster before deleting it",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteTidbBackup() -> validateDeleteTidbBackupRequest() -> nextGenCli.ListBackups()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.DeleteClusterBackup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteClusterBackup",
              "trigger": "Delete the selected backup for the target TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteTidbBackup() -> nextGenCli.DeleteClusterBackup()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.CreateTidbBackup": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Validate that the target TiDB cluster exists and belongs to the caller organization before creating a manual backup",
              "implementation": "clusterRepo.List() / clusterSvc.ListClusters()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "BackupService.CreateManualBackup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateManualBackup",
              "trigger": "Submit a manual backup creation request for the selected TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateTidbBackup() -> nextGenCli.CreateManualBackup()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.RestoreStatus": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Load restore custom status by restore-name to determine whether the workflow is still pending locally",
              "implementation": "customStatusRepo.GetRestoreStatusByName()"
            },
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Check whether the cluster was deleted before restore became visible in nextgen-global-service",
              "implementation": "clusterRepo.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.RestoreStatus",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC RestoreStatus",
              "trigger": "Query nextgen global restore progress once the restore request has reached the control plane",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.RestoreStatus() -> nextGenCli.RestoreStatus()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetRestoreStatus": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Load restore custom status by restore-name to determine whether the workflow is still pending locally",
              "implementation": "customStatusRepo.GetRestoreStatusByName()"
            },
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Check whether the cluster was deleted before restore became visible in nextgen-global-service",
              "implementation": "clusterRepo.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.RestoreStatus",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC RestoreStatus",
              "trigger": "Reuse the shared nextgen restore-status lookup path behind the GetRestoreStatus OpenAPI method",
              "conditions": [
                "Always"
              ],
              "implementation": "GetRestoreStatus() -> clusterSvc.RestoreStatus() -> nextGenCli.RestoreStatus()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.ValidateClassicBackup": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.TestClassicBackupAccess",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC TestClassicBackupAccess",
              "trigger": "Validate external classic-backup storage access and metadata in the nextgen global control plane",
              "conditions": [
                "Always"
              ],
              "implementation": "ValidateClassicBackup() -> validateClassicBackupStorage() -> nextGenCli.TestClassicBackupAccess()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetCaCertificateDownloadUrl": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCaCertificateDownloadUrl",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCaCertificateDownloadUrl",
              "trigger": "Fetch the CA certificate download URL for the selected TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCaCertificateDownloadUrl() -> nextGenCli.GetCaCertificateDownloadUrl()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.UpdateTidbDualLayerEncryption": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateClusterDualLayerEncryption",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateClusterDualLayerEncryption",
              "trigger": "Update the target nextgen TiDB dual-layer encryption configuration",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateTidbDualLayerEncryption() -> nextGenCli.UpdateClusterDualLayerEncryption()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetClusterEncryptionStatus",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetClusterEncryptionStatus",
              "trigger": "Reload the cluster encryption status after the dual-layer encryption update",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateTidbDualLayerEncryption() -> nextGenCli.GetClusterEncryptionStatus()"
            }
          ]
        }
      ]
    },
    "NextgenTidbService.GetTidbDualLayerEncryption": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetClusterEncryptionStatus",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetClusterEncryptionStatus",
              "trigger": "Read the current dual-layer encryption status for the target nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetTidbDualLayerEncryption() -> nextGenCli.GetClusterEncryptionStatus()"
            }
          ]
        }
      ]
    },
    "NextgenBackupService.ListBackups": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Validate that requested TiDB IDs belong to the caller organization before listing backups",
              "implementation": "clusterRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenBackupService.ListBackups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListBackups",
              "trigger": "List nextgen backups after request-level region and cluster validation",
              "conditions": [
                "Always"
              ],
              "implementation": "ListBackups() -> nextGenCli.ListBackups()"
            }
          ]
        }
      ]
    },
    "NextgenBackupService.DeleteBackup": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenBackupService.ListBackups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListBackups",
              "trigger": "Load the backup metadata first to confirm that the backup exists under the caller organization",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteBackup() -> validateDeleteBackupRequest() -> nextGenCli.ListBackups()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenBackupService.DeleteBackup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteBackup",
              "trigger": "Delete the selected nextgen backup after validation succeeds",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteBackup() -> nextGenCli.DeleteBackup()"
            }
          ]
        }
      ]
    },
    "NextgenBackupService.ListDeletedTidbs": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load deleted nextgen clusters that correspond to retained backup settings",
              "implementation": "clusterRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "BackupService.ListNotCleanupBackupSettings",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListNotCleanupBackupSettings",
              "trigger": "List retained backup settings for deleted TiDB clusters before joining local cluster metadata",
              "conditions": [
                "Always"
              ],
              "implementation": "ListDeletedTidbs() -> nextGenCli.ListNotCleanupBackupSettings()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "include_encryption_info == true"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Fetch deleted nextgen cluster encryption settings when include_encryption_info is requested",
              "conditions": [
                "include_encryption_info == true"
              ],
              "implementation": "ListDeletedTidbs() -> nextGenCli.GetCluster()"
            }
          ]
        }
      ]
    },
    "NextgenExportService.ListExports": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenExportService.ListExports",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListExports",
              "trigger": "List export jobs for the requested TiDB cluster from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListExports() -> nextGenCli.ListExports()"
            }
          ]
        }
      ]
    },
    "NextgenExportService.GetExport": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenExportService.GetExport",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetExport",
              "trigger": "Fetch a single export job for the requested TiDB cluster from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetExport() -> nextGenCli.GetExport()"
            }
          ]
        }
      ]
    },
    "NextgenExportService.CreateExport": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenExportService.CreateExport",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateExport",
              "trigger": "Create a new export job in nextgen-global-service after request metadata is normalized",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateExport() -> nextGenCli.CreateExport()"
            }
          ]
        }
      ]
    },
    "NextgenExportService.DeleteExport": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenExportService.DeleteExport",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteExport",
              "trigger": "Delete an export job in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteExport() -> nextGenCli.DeleteExport()"
            }
          ]
        }
      ]
    },
    "NextgenExportService.CancelExport": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenExportService.CancelExport",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CancelExport",
              "trigger": "Cancel an export job in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CancelExport() -> nextGenCli.CancelExport()"
            }
          ]
        }
      ]
    },
    "NextgenRegionService.ListOpsAuditLogSettings": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListRegions",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListRegions",
              "trigger": "List nextgen regions before projecting ops audit log settings",
              "conditions": [
                "Always"
              ],
              "implementation": "ListOpsAuditLogSettings() -> nextgenCli.ListRegions()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter ops audit log settings by tenant third-party provider availability",
              "conditions": [
                "Always"
              ],
              "implementation": "ListOpsAuditLogSettings() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "NextgenRegionService.ListRegionCapacities": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenRegionService.ListRegionCapacities",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.service_plan == BYOC"
          ],
          "operations": [
            {
              "operation": "gRPC ListRegionCapacities",
              "trigger": "List nextgen BYOC region capacities from nextgen-global-service",
              "conditions": [
                "req.service_plan == BYOC"
              ],
              "implementation": "ListRegionCapacities() -> nextgenCli.ListRegionCapacities()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.service_plan == BYOC"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter BYOC region capacities by tenant third-party provider availability",
              "conditions": [
                "req.service_plan == BYOC"
              ],
              "implementation": "ListRegionCapacities() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "NextgenPrivateLinkConnectionService.ListPrivateLinkServices": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata needed to build the OpenAPI private-link service response",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> nextgenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenPrivateLinkConnectionService.ListPrivateLinkServices",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListPrivateLinkServices",
              "trigger": "List private-link services that belong to the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> nextgenCli.ListPrivateLinkServices()"
            }
          ]
        }
      ]
    },
    "NextgenPrivateLinkConnectionService.CreatePrivateLinkConnection": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check create-private-link mutex custom status before invoking nextgen-global-service",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata needed to decorate the created private-endpoint connection response",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> nextgenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenPrivateLinkConnectionService.CreatePrivateLinkConnection",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreatePrivateLinkConnection",
              "trigger": "Create a private-endpoint connection for the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> nextgenCli.CreatePrivateLinkConnection()"
            }
          ]
        }
      ]
    },
    "NextgenPrivateLinkConnectionService.DeletePrivateLinkConnection": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata before converting the deleted private-endpoint connection back to OpenAPI shape",
              "conditions": [
                "Always"
              ],
              "implementation": "DeletePrivateEndpointConnection() -> nextgenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenPrivateLinkConnectionService.DeletePrivateLinkConnection",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeletePrivateLinkConnection",
              "trigger": "Delete the selected private-endpoint connection in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeletePrivateEndpointConnection() -> nextgenCli.DeletePrivateLinkConnection()"
            }
          ]
        }
      ]
    },
    "NextgenPrivateLinkConnectionService.GetPrivateLinkConnection": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata needed to decorate the private-endpoint connection response",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateEndpointConnection() -> nextgenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenPrivateLinkConnectionService.GetPrivateLinkConnection",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetPrivateLinkConnection",
              "trigger": "Fetch a single private-endpoint connection for the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateEndpointConnection() -> nextgenCli.GetPrivateLinkConnection()"
            }
          ]
        }
      ]
    },
    "NextgenPrivateLinkConnectionService.ListPrivateLinkConnections": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata needed to decorate private-endpoint connection responses",
              "conditions": [
                "Always"
              ],
              "implementation": "ListPrivateEndpointConnections() -> nextgenCli.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "NextgenPrivateLinkConnectionService.ListPrivateLinkConnections",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListPrivateLinkConnections",
              "trigger": "List private-endpoint connections for the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "ListPrivateEndpointConnections() -> nextgenCli.ListPrivateLinkConnections()"
            }
          ]
        }
      ]
    },
    "RcuQuotaService.GetRcuQuota": {
      "infrastructure": {},
      "services": []
    },
    "RcuQuotaService.ListOrgRcuQuotas": {
      "infrastructure": {},
      "services": []
    },
    "RcuQuotaService.UpdateRcuQuota": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CountClusters": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CleanProjectResource": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CleanOrganizationResource": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.RestoreServerlessCluster": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.UpdateServerlessRegionalClusterAnnotations": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.ModifyClusterVolume": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.ScaleClusterPdComponent": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.ScaleClusterTiProxyComponent": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CreateClusterWithClusterConfiguration": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.ShowComponentNodeInfo": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.CountBillableClusters": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.BuildComponentSpecDiffReports": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.GetCloudIamInfo": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.UpdateClusterRuVersion": {
      "infrastructure": {},
      "services": []
    },
    "ClusterCustomStatusService.GetClusterCustomStatusByName": {
      "infrastructure": {},
      "services": []
    },
    "ClusterCustomStatusService.DeleteClusterCustomStatus": {
      "infrastructure": {},
      "services": []
    },
    "ClusterCustomStatusService.IsClusterCustomStatusExisted": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.RegisterCloudProvider": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.SelectRegionByOrganizationId": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.UpdateRegion": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.CheckRegionStatus": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.DeleteRegion": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.UpdateRegionOpsAuditLogSetting": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.RegisterRegionProviderIdentity": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.ListRegionProviderIdentities": {
      "infrastructure": {},
      "services": []
    },
    "VpcPeeringService.GetVpcPeering": {
      "infrastructure": {},
      "services": []
    },
    "VpcPeeringService.DeleteVpcPeering": {
      "infrastructure": {},
      "services": []
    },
    "DataPlaneService.GetCompatNetwork": {
      "infrastructure": {},
      "services": []
    },
    "DataPlaneService.GetCompatProvider": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.CreateSpu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.GetSpu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.ListSpus": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.UpdateSpu": {
      "infrastructure": {},
      "services": []
    },
    "SpuService.DeleteSpu": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.SyncMaintenanceWindow": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.QueryMaintenanceTasks": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.CountMaintenanceTasks": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.ListMaintenanceTaskExecutions": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.UpdateMaintenanceTaskExecution": {
      "infrastructure": {},
      "services": []
    },
    "InternalMaintenanceService.QueryMaintenanceTaskExecutions": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.ListVpcs": {
      "infrastructure": {},
      "services": []
    },
    "VpcService.AddSecondaryCidr": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.CreateCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.GetCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.GetCustomerManagedEncryptionKeyByClusterId": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.ListCustomerManagedEncryptionKeys": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.DeleteCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": []
    },
    "CmekService.ShowCmekAccessIamPrincipal": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.CreatePrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.GetPrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.ListPrivateLinkServiceMigrations": {
      "infrastructure": {},
      "services": []
    },
    "PrivateLinkServiceMigrationService.CancelPrivateLinkServiceMigration": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.CreateResourcePool": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.GetResourcePool": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.ListResourcePools": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.ListOrgResourcePools": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.ListOwnerResourcePools": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.UpdateResourcePoolName": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.UpdateResourcePoolInstanceLimit": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.UpdateOrgDefaultResourcePool": {
      "infrastructure": {},
      "services": []
    },
    "ResourcePoolService.DeleteResourcePool": {
      "infrastructure": {},
      "services": []
    },
    "MigrationClusterService.CreateMigrationCluster": {
      "infrastructure": {},
      "services": []
    },
    "MigrationClusterService.GetMigrationCluster": {
      "infrastructure": {},
      "services": []
    },
    "MigrationClusterService.ListMigrationClusters": {
      "infrastructure": {},
      "services": []
    },
    "MigrationClusterService.DeleteMigrationCluster": {
      "infrastructure": {},
      "services": []
    },
    "RcuQuotaService.ListTenantQuota": {
      "infrastructure": {},
      "services": []
    },
    "RcuQuotaService.UpdateTenantQuota": {
      "infrastructure": {},
      "services": []
    },
    "DataSynchronizationService.CreateDataSynchronization": {
      "infrastructure": {},
      "services": []
    },
    "DataSynchronizationService.GetDataSynchronization": {
      "infrastructure": {},
      "services": []
    },
    "DataSynchronizationService.DeleteDataSynchronization": {
      "infrastructure": {},
      "services": []
    },
    "PublicShadowPoolService.BatchSet": {
      "infrastructure": {},
      "services": []
    },
    "PublicShadowPoolService.GetDataByIds": {
      "infrastructure": {},
      "services": []
    },
    "BffClusterService.AdvancedModifyDedicatedCluster": {
      "infrastructure": {},
      "services": []
    },
    "BffClusterService.CheckModificationRisks": {
      "infrastructure": {},
      "services": []
    },
    "BffClusterService.EstimatePrice": {
      "infrastructure": {},
      "services": []
    },
    "BffTiDBService.MoveTiDB": {
      "infrastructure": {},
      "services": []
    },
    "BffTiDBService.BatchMoveTiDBs": {
      "infrastructure": {},
      "services": []
    },
    "BffTiDBService.UpdateClusterProject": {
      "infrastructure": {},
      "services": []
    },
    "BffRegionService.GetRegionByClusterId": {
      "infrastructure": {},
      "services": []
    },
    "BffRegionService.GetRegionByLogicalName": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.GetAccount": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.SyncSystemVariables": {
      "infrastructure": {},
      "services": []
    },
    "CoreService.SyncPdOnlineConfig": {
      "infrastructure": {},
      "services": []
    },
    "DedicatedClusterService.CreateCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Persist dedicated cluster record before DAG submission",
              "implementation": "clusterRepo.InsertNewCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "oneConsoleConfig.CheckXProjectType == true"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Validate target project belongs to org and is not an x-project when required",
              "conditions": [
                "CheckXProjectType enabled",
                "project label provided or default project resolved"
              ],
              "implementation": "accountCli.GetProject()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetDefaultTidbVersion",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetDefaultTidbVersion",
              "trigger": "Resolve default TiDB version for provider and region before request assembly",
              "conditions": [
                "Always"
              ],
              "implementation": "dedicatedCli.GetDefaultTidbVersion()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.CreateCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCluster (validate only)",
              "trigger": "Validate dedicated cluster create request against global control plane before persistence and DAG launch",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.CreateCluster() -> dedicatedCli.CreateCluster(validateOnly=true)"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.ListClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Count and page dedicated cluster base records before remote enrichment",
              "implementation": "clusterSvc.CountClusters() + clusterRepo.QueryClusterByFilterAndPage()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch cluster custom status for response enrichment",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListClusters",
          "operation_type": "grpc_unary",
          "conditions": [
            "CountClusters > 0",
            "clusterFilter.View != Local"
          ],
          "operations": [
            {
              "operation": "gRPC ListClusters",
              "trigger": "Enrich dedicated cluster records with global runtime state",
              "conditions": [
                "Base cluster ids found in MySQL",
                "View != Local"
              ],
              "implementation": "clusterSvc.ListClusters() -> dedicatedCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.GetCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load dedicated cluster record before remote enrichment",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch custom status for response override",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "view != Local"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Enrich dedicated cluster with global control-plane state",
              "conditions": [
                "View != Local"
              ],
              "implementation": "clusterSvc.GetCluster() -> dedicatedCli.GetCluster()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.DeleteCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "table": "clusters",
              "purpose": "Delete dedicated cluster record before DAG submission",
              "implementation": "clusterRepo.DeleteCluster()"
            },
            {
              "operation": "DELETE",
              "table": "custom_statuses",
              "purpose": "Delete cluster custom status records",
              "implementation": "customStatusRepo.DeleteClusterCustomStatusByCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.DeleteCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCluster (validate only)",
              "trigger": "Validate dedicated cluster deletion against global control plane before DAG launch",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.DeleteCluster() -> dedicatedCli.DeleteCluster(validateOnly=true)"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.UpdateCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Update dedicated display name, labels, and touch timestamp in management DB",
              "implementation": "clusterRepo.UpdateDisplayName() + clusterRepo.UpdateLabels() + clusterRepo.TouchCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "len(clusterComponents) > 0"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load current dedicated topology before validating scale/update component changes",
              "conditions": [
                "Scaling or component mutation requested"
              ],
              "implementation": "dedicatedCli.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ScaleClusterWithMultiComponent",
          "operation_type": "grpc_unary",
          "conditions": [
            "len(clusterComponents) > 0"
          ],
          "operations": [
            {
              "operation": "gRPC ScaleClusterWithMultiComponent",
              "trigger": "Apply dedicated component updates through global control plane",
              "conditions": [
                "Scaling or component mutation requested"
              ],
              "implementation": "clusterSvc.UpdateCluster() -> dedicatedCli.ScaleClusterWithMultiComponent()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.PauseCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load dedicated cluster before pause validation",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check mutex custom status before pause",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Touch cluster row after pause request is accepted",
              "implementation": "clusterRepo.TouchCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.PauseCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC PauseCluster",
              "trigger": "Submit dedicated cluster pause request to global control plane after local validation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.PauseCluster() -> dedicatedCli.PauseCluster()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.ResumeCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load dedicated cluster before resume validation",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check mutex custom status before resume",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Touch cluster row after resume request is accepted",
              "implementation": "clusterRepo.TouchCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ResumeCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ResumeCluster",
              "trigger": "Submit dedicated cluster resume request to global control plane after local validation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.ResumeCluster() -> dedicatedCli.ResumeCluster()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.ResetRootPassword": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load dedicated cluster before root password reset",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check mutex custom status before root password reset",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Touch cluster row before refreshing post-reset state",
              "implementation": "clusterRepo.TouchCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ChangeClusterPasswd",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ChangeClusterPasswd",
              "trigger": "Reset the dedicated cluster root password in the global control plane",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.SetRootPassword() -> dedicatedCli.ChangeClusterPasswd()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Refresh cluster state after the dedicated root password reset completes",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.SetRootPassword() -> dedicatedCli.GetCluster()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.ListNodeInstances": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetComponentNodeInfo",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetComponentNodeInfo",
              "trigger": "Load detailed component node information before enumerating dedicated node instances",
              "conditions": [
                "Always"
              ],
              "implementation": "ListNodeInstances() -> clusterSvc.GetComponentNodeInfo()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.GetNodeInstance": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetComponentNodeInfo",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetComponentNodeInfo",
              "trigger": "Load detailed component node information before locating the requested dedicated instance",
              "conditions": [
                "Always"
              ],
              "implementation": "GetNodeInstance() -> clusterSvc.GetComponentNodeInfo()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.ShowNodeQuota": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListTenantQuota",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTenantQuota",
              "trigger": "Load dedicated tenant node quota from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ShowNodeQuota() -> dedicatedCli.ListTenantQuota()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.GetLogRedactionPolicy": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetLogRedactionPolicy",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetLogRedactionPolicy",
              "trigger": "Read dedicated cluster log-redaction policy from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetLogRedactionPolicy() -> clusterSvc.GetLogRedactionPolicy() -> dedicatedCli.GetLogRedactionPolicy()"
            }
          ]
        }
      ]
    },
    "DedicatedClusterService.UpdateLogRedactionPolicy": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateLogRedactionPolicy",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateLogRedactionPolicy",
              "trigger": "Update dedicated cluster log-redaction policy in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateLogRedactionPolicy() -> clusterSvc.UpdateLogRedactionPolicy() -> dedicatedCli.UpdateLogRedactionPolicy()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.CreateNetworkContainer": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.CreateCidr",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCidr",
              "trigger": "Create the dedicated network container CIDR in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateNetworkContainer() -> dedicatedCli.CreateCidr()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.QueryCidrs",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.validate_only == false"
          ],
          "operations": [
            {
              "operation": "gRPC QueryCidrs",
              "trigger": "Read back the newly created CIDR after validate-only is false",
              "conditions": [
                "req.validate_only == false"
              ],
              "implementation": "CreateNetworkContainer() -> dedicatedCli.QueryCidrs()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.GetNetworkContainer": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.QueryCidrs",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC QueryCidrs",
              "trigger": "Load the requested dedicated network container by CIDR id",
              "conditions": [
                "Always"
              ],
              "implementation": "GetNetworkContainer() -> dedicatedCli.QueryCidrs()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.ListNetworkContainers": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.QueryCidrs",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC QueryCidrs",
              "trigger": "List dedicated network containers for the resolved project and optional cloud provider",
              "conditions": [
                "Always"
              ],
              "implementation": "ListNetworkContainers() -> dedicatedCli.QueryCidrs()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.DeleteNetworkContainer": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.QueryCidrs",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC QueryCidrs",
              "trigger": "Load the target dedicated network container before deletion",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteNetworkContainer() -> dedicatedCli.QueryCidrs()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.DeleteCidr",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCidr",
              "trigger": "Delete the dedicated network container CIDR after it is loaded",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteNetworkContainer() -> dedicatedCli.DeleteCidr()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.CreateVpcPeering": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.CreateVpcPeering",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateVpcPeering",
              "trigger": "Create the VPC peering in dedicated-global-service after mutex checks pass",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateVpcPeering() -> dedicatedCli.CreateVpcPeering()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.GetVpcPeering",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetVpcPeering",
              "trigger": "Read back the newly created VPC peering to build the OpenAPI response",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateVpcPeering() -> dedicatedCli.GetVpcPeering()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.DeleteVpcPeering": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.DeleteVpcPeering",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteVpcPeering",
              "trigger": "Delete the VPC peering in dedicated-global-service after mutex checks pass",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteVpcPeering() -> dedicatedCli.DeleteVpcPeering()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.ListVpcPeerings": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.ListVpcPeerings",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListVpcPeerings",
              "trigger": "List VPC peerings for the requested dedicated project and optional filters",
              "conditions": [
                "Always"
              ],
              "implementation": "ListVpcPeerings() -> dedicatedCli.ListVpcPeerings()"
            }
          ]
        }
      ]
    },
    "DedicatedNetworkContainerService.GetVpcPeering": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "VpcService.GetVpcPeering",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetVpcPeering",
              "trigger": "Fetch the requested VPC peering from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetVpcPeering() -> dedicatedCli.GetVpcPeering()"
            }
          ]
        }
      ]
    },
    "DedicatedRegionService.ListRegions": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "regions",
              "purpose": "Query available regions",
              "implementation": "regionRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListCloudProviders",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCloudProviders",
              "trigger": "Load dedicated cloud providers before projecting regions or provider options",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> dedicatedCli.ListCloudProviders()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter cloud providers by tenant third-party account availability",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "DedicatedRegionService.GetRegion": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListCloudProviders",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCloudProviders",
              "trigger": "Load dedicated cloud providers before projecting regions or provider options",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> dedicatedCli.ListCloudProviders()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter cloud providers by tenant third-party account availability",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "DedicatedRegionService.ShowCloudProviders": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListCloudProviders",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCloudProviders",
              "trigger": "Load dedicated cloud providers before projecting regions or provider options",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> dedicatedCli.ListCloudProviders()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter cloud providers by tenant third-party account availability",
              "conditions": [
                "Always"
              ],
              "implementation": "listProviders() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "DedicatedRegionService.ListNodeSpecs": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Validate tenant third-party provider restrictions before listing dedicated node specs",
              "conditions": [
                "Always"
              ],
              "implementation": "ListNodeSpecs() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetDefaultTidbVersion",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.cluster_id is empty && req.tidb_version is empty"
          ],
          "operations": [
            {
              "operation": "gRPC GetDefaultTidbVersion",
              "trigger": "Resolve the default TiDB version when the request omits cluster id and tidb_version",
              "conditions": [
                "req.cluster_id is empty && req.tidb_version is empty"
              ],
              "implementation": "ListNodeSpecs() -> getVersionAndClusterFromGlobal() -> dedicatedCli.GetDefaultTidbVersion()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.cluster_id is not empty"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load the existing dedicated cluster when listing node specs for an existing cluster",
              "conditions": [
                "req.cluster_id is not empty"
              ],
              "implementation": "ListNodeSpecs() -> getVersionAndClusterFromGlobal() -> dedicatedCli.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListSpus",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListSpus",
              "trigger": "List dedicated SPUs for the resolved project, region, and optional cluster context",
              "conditions": [
                "Always"
              ],
              "implementation": "ListNodeSpecs() -> dedicatedCli.ListSpus()"
            }
          ]
        }
      ]
    },
    "DedicatedRegionService.GetNodeSpec": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Validate tenant third-party provider restrictions before reading a dedicated node spec",
              "conditions": [
                "Always"
              ],
              "implementation": "GetNodeSpec() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetDefaultTidbVersion",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.cluster_id is empty && req.tidb_version is empty"
          ],
          "operations": [
            {
              "operation": "gRPC GetDefaultTidbVersion",
              "trigger": "Resolve the default TiDB version when the request omits cluster id and tidb_version",
              "conditions": [
                "req.cluster_id is empty && req.tidb_version is empty"
              ],
              "implementation": "GetNodeSpec() -> getVersionAndClusterFromGlobal() -> dedicatedCli.GetDefaultTidbVersion()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "req.cluster_id is not empty"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load the existing dedicated cluster when reading a node spec for an existing cluster",
              "conditions": [
                "req.cluster_id is not empty"
              ],
              "implementation": "GetNodeSpec() -> getVersionAndClusterFromGlobal() -> dedicatedCli.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.GetSpu",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetSpu",
              "trigger": "Fetch the requested dedicated SPU after resolving region, version, and provider constraints",
              "conditions": [
                "Always"
              ],
              "implementation": "GetNodeSpec() -> dedicatedCli.GetSpu()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.GetMaintenanceWindow": {
      "infrastructure": {},
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.GetMaintenanceWindow",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetMaintenanceWindow",
              "trigger": "Resolve the maintenance window through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetMaintenanceWindow() -> maintenanceSvc.GetMaintenanceWindow()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.ListMaintenanceWindows": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_windows",
              "purpose": "List maintenance windows",
              "implementation": "maintenanceWindowRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.ListMaintenanceWindows",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListMaintenanceWindows",
              "trigger": "List maintenance windows through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListMaintenanceWindows() -> maintenanceSvc.ListMaintenanceWindows()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.UpdateMaintenanceWindow": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "table": "maintenance_windows",
              "purpose": "Update maintenance window",
              "implementation": "maintenanceWindowRepo.Update()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.UpdateMaintenanceWindow",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateMaintenanceWindow",
              "trigger": "Update the maintenance window through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateMaintenanceWindow() -> maintenanceSvc.UpdateMaintenanceWindow()"
            }
          ]
        },
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.ListMaintenanceTasks",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListMaintenanceTasks",
              "trigger": "Reload unchanged maintenance tasks after the maintenance window is updated",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateMaintenanceWindow() -> maintenanceSvc.ListMaintenanceTasks()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.ListMaintenanceTasks": {
      "infrastructure": {},
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.ListMaintenanceTasks",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListMaintenanceTasks",
              "trigger": "List maintenance tasks through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListMaintenanceTasks() -> maintenanceSvc.ListMaintenanceTasks()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.GetMaintenanceTask": {
      "infrastructure": {},
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.GetMaintenanceTask",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetMaintenanceTask",
              "trigger": "Fetch a maintenance task through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetMaintenanceTask() -> maintenanceSvc.GetMaintenanceTask()"
            }
          ]
        }
      ]
    },
    "DedicatedMaintenanceService.UpdateMaintenanceTask": {
      "infrastructure": {},
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "MaintenanceService.UpdateMaintenanceTask",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateMaintenanceTask",
              "trigger": "Update a maintenance task through the local maintenance service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateMaintenanceTask() -> maintenanceSvc.UpdateMaintenanceTask()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.CreateTidbNodeGroup": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.CreateTidbNodeGroup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateTidbNodeGroup",
              "trigger": "Create the TiDB node group in dedicated-global-service after mutex validation",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateTidbNodeGroup() -> dedicatedCli.CreateTidbNodeGroup()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.ListTidbNodeGroups": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "List dedicated TiDB node groups from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListTidbNodeGroups() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.GetTidbNodeGroup": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the requested dedicated TiDB node group by filtering the list response",
              "conditions": [
                "Always"
              ],
              "implementation": "GetTidbNodeGroup() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.DeleteTidbNodeGroup": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.DeleteTidbNodeGroup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteTidbNodeGroup",
              "trigger": "Delete the dedicated TiDB node group after request validation and mutex checks",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteTidbNodeGroup() -> dedicatedCli.DeleteTidbNodeGroup()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.UpdateTidbNodeGroup": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.UpdateTidbNodeGroup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateTidbNodeGroup",
              "trigger": "Update the dedicated TiDB node group after mutex validation",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateTidbNodeGroup() -> dedicatedCli.UpdateTidbNodeGroup()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.GetPublicEndpointSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the target TiDB node group to read its public endpoint setting",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPublicEndpointSetting() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        }
      ]
    },
    "DedicatedTidbNodeGroupService.UpdatePublicEndpointSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the target TiDB node group before updating its public endpoint setting",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdatePublicEndpointSetting() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.UpdateTidbNodeGroup",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateTidbNodeGroup",
              "trigger": "Persist the updated public endpoint setting through dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdatePublicEndpointSetting() -> dedicatedCli.UpdateTidbNodeGroup()"
            }
          ]
        }
      ]
    },
    "DedicatedPrivateEndpointConnectionService.GetPrivateLinkService": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the target TiDB node group before resolving its private-link service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load cluster metadata needed to build the OpenAPI private-link service response",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> clusterSvc.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.SelectRegionByOrgId",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC SelectRegionByOrgId",
              "trigger": "Resolve region display metadata for the dedicated private-link service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> dedicatedCli.SelectRegionByOrgId()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.ListTidbNodeGroupPrivateLinkEndpoints",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroupPrivateLinkEndpoints",
              "trigger": "Load the private-link service status for the TiDB node group",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateLinkService() -> dedicatedCli.ListTidbNodeGroupPrivateLinkEndpoints()"
            }
          ]
        }
      ]
    },
    "DedicatedPrivateEndpointConnectionService.CreatePrivateEndpointConnection": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check create-private-link mutex custom status before provisioning a dedicated private endpoint",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            },
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load the dedicated cluster before resolving region and project context",
              "implementation": "clusterRepo.GetCluster() / clusterSvc.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.SelectRegionByOrgId",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC SelectRegionByOrgId",
              "trigger": "Resolve the region display context for the target dedicated cluster before endpoint creation",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> dedicatedCli.SelectRegionByOrgId()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the target TiDB node group before creating the private endpoint",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.CreatePrivateLinkEndpoint",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreatePrivateLinkEndpoint",
              "trigger": "Create the dedicated private endpoint in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> dedicatedCli.CreatePrivateLinkEndpoint()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.ListTidbNodeGroupPrivateLinkEndpoints",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroupPrivateLinkEndpoints",
              "trigger": "Reload the TiDB-group private endpoints after creation to build the OpenAPI response",
              "conditions": [
                "Always"
              ],
              "implementation": "CreatePrivateEndpointConnection() -> dedicatedCli.ListTidbNodeGroupPrivateLinkEndpoints()"
            }
          ]
        }
      ]
    },
    "DedicatedPrivateEndpointConnectionService.ListPrivateEndpointConnections": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "List clusters or load the target cluster before enumerating dedicated private endpoints",
              "implementation": "clusterRepo.List() / clusterRepo.GetCluster() / clusterSvc.ListClusters() / clusterSvc.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.SelectRegionByOrgId",
          "operation_type": "grpc_unary",
          "conditions": [
            "cluster_id scoped listing"
          ],
          "operations": [
            {
              "operation": "gRPC SelectRegionByOrgId",
              "trigger": "Resolve region display metadata for cluster-scoped dedicated private-endpoint listings",
              "conditions": [
                "cluster_id scoped listing"
              ],
              "implementation": "ListPrivateEndpointConnections() -> dedicatedCli.SelectRegionByOrgId()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Enumerate TiDB node groups whose private endpoints should be listed",
              "conditions": [
                "Always"
              ],
              "implementation": "ListPrivateEndpointConnections() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.ListTidbNodeGroupPrivateLinkEndpoints",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroupPrivateLinkEndpoints",
              "trigger": "List private endpoints for each TiDB node group in scope",
              "conditions": [
                "Always"
              ],
              "implementation": "ListPrivateEndpointConnections() -> dedicatedCli.ListTidbNodeGroupPrivateLinkEndpoints()"
            }
          ]
        }
      ]
    },
    "DedicatedPrivateEndpointConnectionService.GetPrivateEndpointConnection": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load the target dedicated cluster before resolving the requested private endpoint",
              "implementation": "clusterRepo.GetCluster() / clusterSvc.GetCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.SelectRegionByOrgId",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC SelectRegionByOrgId",
              "trigger": "Resolve region display metadata for the requested dedicated private endpoint",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateEndpointConnection() -> dedicatedCli.SelectRegionByOrgId()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "TidbNodeGroupService.ListTidbNodeGroups",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroups",
              "trigger": "Load the TiDB node group that owns the requested private endpoint",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateEndpointConnection() -> dedicatedCli.ListTidbNodeGroups()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.ListTidbNodeGroupPrivateLinkEndpoints",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListTidbNodeGroupPrivateLinkEndpoints",
              "trigger": "List TiDB-group private endpoints and pick the requested one by endpoint ID",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPrivateEndpointConnection() -> dedicatedCli.ListTidbNodeGroupPrivateLinkEndpoints()"
            }
          ]
        }
      ]
    },
    "DedicatedPrivateEndpointConnectionService.DeletePrivateEndpointConnection": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PrivateLinkConnectionService.DeletePrivateLinkEndpoint",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeletePrivateLinkEndpoint",
              "trigger": "Delete the requested dedicated private endpoint in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeletePrivateEndpointConnection() -> dedicatedCli.DeletePrivateLinkEndpoint()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.GetAuditLogConfig": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load dedicated cluster metadata before converting audit log config region/provider fields",
              "conditions": [
                "Always"
              ],
              "implementation": "GetAuditLogConfig() -> clusterSvc.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetAuditLogConfig",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetAuditLogConfig",
              "trigger": "Fetch the current dedicated audit log config from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetAuditLogConfig() -> dedicatedCli.GetAuditLogConfig()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateAuditLogConfig",
          "operation_type": "grpc_unary",
          "conditions": [
            "resp.bucket_manager == CUSTOMER && resp.enabled == true"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateAuditLogConfig",
              "trigger": "Run validate-only write-permission check when customer-managed storage is enabled",
              "conditions": [
                "resp.bucket_manager == CUSTOMER && resp.enabled == true"
              ],
              "implementation": "GetAuditLogConfig() -> dedicatedCli.UpdateAuditLogConfig()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.UpdateAuditLogConfig": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load dedicated cluster metadata before translating audit log storage settings",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateAuditLogConfig() -> clusterSvc.GetCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateAuditLogConfig",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateAuditLogConfig",
              "trigger": "Persist the dedicated audit log config update in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateAuditLogConfig() -> dedicatedCli.UpdateAuditLogConfig()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.CreateAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.CreateAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAuditLogFilterRule",
              "trigger": "Persist the dedicated audit log filter-rule mutation in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateAuditLogFilterRule() -> dedicatedCli.CreateAuditLogFilterRule()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListAuditLogFilterRules",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListAuditLogFilterRules",
              "trigger": "Read back the latest dedicated audit log filter rule after create because the create RPC does not return the new id",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateAuditLogFilterRule() -> dedicatedCli.ListAuditLogFilterRules()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.ReplaceAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ReplaceAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ReplaceAuditLogFilterRule",
              "trigger": "Persist the dedicated audit log filter-rule mutation in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ReplaceAuditLogFilterRule() -> dedicatedCli.ReplaceAuditLogFilterRule()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.GetAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListAuditLogFilterRules",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListAuditLogFilterRules",
              "trigger": "Load dedicated audit log filter rules and select the requested rule in-process",
              "conditions": [
                "Always"
              ],
              "implementation": "GetAuditLogFilterRule() -> dedicatedCli.ListAuditLogFilterRules()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.ListAuditLogFilterRules": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListAuditLogFilterRules",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListAuditLogFilterRules",
              "trigger": "List dedicated audit log filter rules from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListAuditLogFilterRules() -> dedicatedCli.ListAuditLogFilterRules()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.DeleteAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.DeleteAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteAuditLogFilterRule",
              "trigger": "Persist the dedicated audit log filter-rule mutation in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteAuditLogFilterRule() -> dedicatedCli.DeleteAuditLogFilterRule()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.ShowObjectStorageAccessIamPrincipal": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetAccount",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetAccount",
              "trigger": "Resolve the object-storage access IAM principal for dedicated audit logs",
              "conditions": [
                "Always"
              ],
              "implementation": "ShowObjectStorageAccessIamPrincipal() -> dedicatedCli.GetAccount()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.QueryAuditLogFiles": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.QueryAuditLogFiles",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC QueryAuditLogFiles",
              "trigger": "Query dedicated audit log files from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "QueryAuditLogFiles() -> dedicatedCli.QueryAuditLogFiles()"
            }
          ]
        }
      ]
    },
    "DedicatedDatabaseAuditLogService.GenerateAuditLogFileDownloadAddress": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GenerateAuditLogFileDownloadAddress",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GenerateAuditLogFileDownloadAddress",
              "trigger": "Generate a download URL for the requested dedicated audit log file",
              "conditions": [
                "Always"
              ],
              "implementation": "GenerateAuditLogFileDownloadAddress() -> dedicatedCli.GenerateAuditLogFileDownloadAddress()"
            }
          ]
        }
      ]
    },
    "DedicatedCustomerManagedEncryptionKeyService.CreateCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionService.CreateCustomerManagedEncryptionKey",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateCustomerManagedEncryptionKey",
              "trigger": "Create a dedicated CMEK in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateCustomerManagedEncryptionKey() -> dedicatedCli.CreateCustomerManagedEncryptionKey()"
            }
          ]
        }
      ]
    },
    "DedicatedCustomerManagedEncryptionKeyService.GetCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionService.GetCustomerManagedEncryptionKey",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCustomerManagedEncryptionKey",
              "trigger": "Fetch a dedicated CMEK by ID from dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCustomerManagedEncryptionKey() -> dedicatedCli.GetCustomerManagedEncryptionKey()"
            }
          ]
        }
      ]
    },
    "DedicatedCustomerManagedEncryptionKeyService.ListCustomerManagedEncryptionKeys": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionService.ListCustomerManagedEncryptionKeys",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCustomerManagedEncryptionKeys",
              "trigger": "List dedicated CMEKs under the resolved project scope",
              "conditions": [
                "Always"
              ],
              "implementation": "ListCustomerManagedEncryptionKeys() -> dedicatedCli.ListCustomerManagedEncryptionKeys()"
            }
          ]
        }
      ]
    },
    "DedicatedCustomerManagedEncryptionKeyService.DeleteCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionService.DeleteCustomerManagedEncryptionKey",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCustomerManagedEncryptionKey",
              "trigger": "Delete a dedicated CMEK by ID in dedicated-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteCustomerManagedEncryptionKey() -> dedicatedCli.DeleteCustomerManagedEncryptionKey()"
            }
          ]
        }
      ]
    },
    "DedicatedCustomerManagedEncryptionKeyService.ShowCmekAccessIamPrincipal": {
      "infrastructure": {},
      "services": [
        {
          "name": "dedicated-global-service",
          "target_binary": "dedicated-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionService.GetCmekAccessIamPrincipal",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCmekAccessIamPrincipal",
              "trigger": "Resolve the IAM principal that should be granted access to a dedicated CMEK",
              "conditions": [
                "Always"
              ],
              "implementation": "ShowCmekAccessIamPrincipal() -> dedicatedCli.GetCmekAccessIamPrincipal()"
            }
          ]
        }
      ]
    },
    "NextgenRegionService.ListRegions": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "regions",
              "purpose": "Query available regions",
              "implementation": "regionRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListRegions",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListRegions",
              "trigger": "List nextgen regions from nextgen-global-service for the requested provider and service plan",
              "conditions": [
                "Always"
              ],
              "implementation": "ListRegions() -> nextgenCli.ListRegions()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter nextgen regions by tenant third-party provider availability",
              "conditions": [
                "Always"
              ],
              "implementation": "ListRegions() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "NextgenRegionService.ListCloudProviders": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RegionService.ListCloudProviders",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCloudProviders",
              "trigger": "List active nextgen cloud providers from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListCloudProviders() -> nextgenCli.ListCloudProviders()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Filter nextgen cloud providers by tenant third-party provider availability",
              "conditions": [
                "Always"
              ],
              "implementation": "ListCloudProviders() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "NextgenCustomerManagedEncryptionKeyService.GetCmekAccessIamPrincipal": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionKeyService.GetCmekAccessIamPrincipal",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCmekAccessIamPrincipal",
              "trigger": "Resolve the IAM principal that should be granted access to a nextgen CMEK",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCmekAccessIamPrincipal() -> nextgenCli.GetCmekAccessIamPrincipal()"
            }
          ]
        }
      ]
    },
    "NextgenCustomerManagedEncryptionKeyService.VerifyCmekAccessIamPrincipal": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionKeyService.VerifyCmekAccessIamPrincipal",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC VerifyCmekAccessIamPrincipal",
              "trigger": "Verify that the supplied nextgen CMEK principal permissions are usable before binding the key",
              "conditions": [
                "Always"
              ],
              "implementation": "VerifyCmekAccessIamPrincipal() -> nextgenCli.VerifyCmekAccessIamPrincipal()"
            }
          ]
        }
      ]
    },
    "NextgenCustomerManagedEncryptionKeyService.GetCustomerManagedEncryptionKey": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionKeyService.GetCustomerManagedEncryptionKey",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCustomerManagedEncryptionKey",
              "trigger": "Fetch a nextgen CMEK by ID from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCustomerManagedEncryptionKey() -> nextgenCli.GetCustomerManagedEncryptionKey()"
            }
          ]
        }
      ]
    },
    "NextgenCustomerManagedEncryptionKeyService.GetCustomerManagedEncryptionKeyByClusterId": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionKeyService.GetCustomerManagedEncryptionKeyByClusterId",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCustomerManagedEncryptionKeyByClusterId",
              "trigger": "Resolve the CMEK currently bound to the target nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetCustomerManagedEncryptionKeyByClusterId() -> nextgenCli.GetCustomerManagedEncryptionKeyByClusterId()"
            }
          ]
        }
      ]
    },
    "NextgenCustomerManagedEncryptionKeyService.ListCustomerManagedEncryptionKeys": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CustomerManagedEncryptionKeyService.ListCustomerManagedEncryptionKeys",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCustomerManagedEncryptionKeys",
              "trigger": "List nextgen CMEKs under the caller organization",
              "conditions": [
                "Always"
              ],
              "implementation": "ListCustomerManagedEncryptionKeys() -> nextgenCli.ListCustomerManagedEncryptionKeys()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.GetAuditLogSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load nextgen cluster metadata before converting audit log storage settings",
              "conditions": [
                "Always"
              ],
              "implementation": "GetAuditLogSetting() -> clusterSvc.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetAuditLogSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetAuditLogSetting",
              "trigger": "Fetch the current nextgen audit log setting from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetAuditLogSetting() -> nextgenCli.GetAuditLogSetting()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateAuditLogSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "resp.enabled == true"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateAuditLogSetting",
              "trigger": "Run validate-only write-permission check when nextgen audit logs are enabled",
              "conditions": [
                "resp.enabled == true"
              ],
              "implementation": "GetAuditLogSetting() -> nextgenCli.UpdateAuditLogSetting()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.UpdateAuditLogSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.GetCluster",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetCluster",
              "trigger": "Load nextgen cluster metadata before translating audit log storage settings",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateAuditLogSetting() -> clusterSvc.GetCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateAuditLogSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateAuditLogSetting",
              "trigger": "Persist the nextgen audit log setting update in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateAuditLogSetting() -> nextgenCli.UpdateAuditLogSetting()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.ListAuditLogFilterRules": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListAuditLogFilterRules",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListAuditLogFilterRules",
              "trigger": "List nextgen audit log filter rules from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "ListAuditLogFilterRules() -> nextgenCli.ListAuditLogFilterRules()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.CreateAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.CreateAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC CreateAuditLogFilterRule",
              "trigger": "Persist the nextgen audit log filter-rule mutation in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateAuditLogFilterRule() -> nextgenCli.CreateAuditLogFilterRule()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.ListAuditLogFilterRules",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListAuditLogFilterRules",
              "trigger": "Read back the latest nextgen audit log filter rule after create because the create RPC does not return the new id",
              "conditions": [
                "Always"
              ],
              "implementation": "CreateAuditLogFilterRule() -> nextgenCli.ListAuditLogFilterRules()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.DeleteAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.DeleteAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteAuditLogFilterRule",
              "trigger": "Persist the nextgen audit log filter-rule mutation in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "DeleteAuditLogFilterRule() -> nextgenCli.DeleteAuditLogFilterRule()"
            }
          ]
        }
      ]
    },
    "NextgenDatabaseAuditLogService.UpdateAuditLogFilterRule": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ClusterService.UpdateAuditLogFilterRule",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateAuditLogFilterRule",
              "trigger": "Persist the nextgen audit log filter-rule mutation in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateAuditLogFilterRule() -> nextgenCli.UpdateAuditLogFilterRule()"
            }
          ]
        }
      ]
    },
    "NextgenLogRedactionPolicyService.GetLogRedactionPolicy": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "LogRedactionPolicyService.GetLogRedactionPolicy",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetLogRedactionPolicy",
              "trigger": "Read nextgen cluster log-redaction policy from nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "GetLogRedactionPolicy() -> nextgenCli.GetLogRedactionPolicy()"
            }
          ]
        }
      ]
    },
    "NextgenLogRedactionPolicyService.UpdateLogRedactionPolicy": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "LogRedactionPolicyService.UpdateLogRedactionPolicy",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdateLogRedactionPolicy",
              "trigger": "Update nextgen cluster log-redaction policy in nextgen-global-service",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdateLogRedactionPolicy() -> nextgenCli.UpdateLogRedactionPolicy()"
            }
          ]
        }
      ]
    },
    "NextgenPublicConnectionSettingService.GetPublicConnectionSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PublicConnectionSettingService.GetPublicConnectionSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetPublicConnectionSetting",
              "trigger": "Read the public connection setting for the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "GetPublicConnectionSetting() -> nextgenCli.GetPublicConnectionSetting()"
            }
          ]
        }
      ]
    },
    "NextgenPublicConnectionSettingService.UpdatePublicConnectionSetting": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "PublicConnectionSettingService.UpdatePublicConnectionSetting",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC UpdatePublicConnectionSetting",
              "trigger": "Persist the public connection setting for the selected nextgen TiDB cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "UpdatePublicConnectionSetting() -> nextgenCli.UpdatePublicConnectionSetting()"
            }
          ]
        }
      ]
    },
    "NextgenQuotaService.ListQuotas": {
      "infrastructure": {},
      "services": [
        {
          "name": "nextgen-global-service",
          "target_binary": "nextgen-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "RcuQuotaService.ListOrgRcuQuotas",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListOrgRcuQuotas",
              "trigger": "List nextgen organization quotas for the authenticated tenant",
              "conditions": [
                "Always"
              ],
              "implementation": "ListQuotas() -> nextgenCli.ListOrgRcuQuotas()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.CreateCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Persist serverless cluster record before create DAG submission",
              "implementation": "clusterRepo.InsertNewCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "oneConsoleConfig.CheckXProjectType == true"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Validate target project is an x-project when one-console enforcement is enabled",
              "conditions": [
                "CheckXProjectType enabled"
              ],
              "implementation": "accountCli.GetProject()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.Create",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC Create",
              "trigger": "Validate and stage serverless cluster creation in global control plane",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.createSingleCluster() -> validateGlobalCreate() / serverlessCli.CreateCluster()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.AddClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "validateOnly == false"
          ],
          "operations": [
            {
              "operation": "gRPC AddClusterRelations",
              "trigger": "Initialize cluster-to-org/project relations after persistence",
              "conditions": [
                "Create is not validate-only"
              ],
              "implementation": "accountCli.UpsertClusterRelations()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.ListClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Count and page serverless cluster base records before remote enrichment",
              "implementation": "clusterSvc.CountClusters() + clusterRepo.QueryClusterByFilterAndPage()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch cluster custom status for response enrichment",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "CountClusters > 0",
            "clusterFilter.View != Local"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Fetch serverless global state for paged cluster ids",
              "conditions": [
                "Base cluster ids found in MySQL",
                "View != Local"
              ],
              "implementation": "clusterSvc.ListClusters() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.GetCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load serverless cluster record before global lookup",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch custom status for response override",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "view != Local"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Resolve single serverless cluster from global control plane by cluster id",
              "conditions": [
                "View != Local"
              ],
              "implementation": "clusterSvc.GetCluster() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.DeleteCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "DELETE",
              "table": "clusters",
              "purpose": "Delete serverless cluster record before delete DAG submission",
              "implementation": "clusterRepo.DeleteCluster()"
            },
            {
              "operation": "DELETE",
              "table": "custom_statuses",
              "purpose": "Delete cluster custom status records",
              "implementation": "customStatusRepo.DeleteClusterCustomStatusByCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Check cluster exists in global serverless before delete validation",
              "conditions": [
                "Always"
              ],
              "implementation": "serverlessCli.ListClusters()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.Delete",
          "operation_type": "grpc_unary",
          "conditions": [
            "global cluster exists"
          ],
          "operations": [
            {
              "operation": "gRPC Delete (validate only)",
              "trigger": "Validate serverless cluster deletion before DAG submission",
              "conditions": [
                "Global cluster found"
              ],
              "implementation": "serverlessCli.DeleteCluster(validateOnly=true)"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.DeleteClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "delete DAG submitted successfully"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteClusterRelations",
              "trigger": "Remove cluster relation bindings after delete orchestration starts",
              "conditions": [
                "Delete path continues after validation"
              ],
              "implementation": "accountCli.DeleteClusterRelations()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.PartialUpdateCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Update serverless display name, labels, service plan, and touch timestamp in management DB",
              "implementation": "clusterRepo.UpdateDisplayName() + clusterRepo.UpdateLabels() + clusterRepo.UpdateServicePlan() + clusterRepo.TouchCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Fetch custom status for response override",
              "implementation": "customStatusSvc.ListClusterCustomStatus()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Load full serverless cluster state before computing partial update mask",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.GetCluster() -> serverlessCli.ListClusters()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.Update",
          "operation_type": "grpc_unary",
          "conditions": [
            "newCluster != nil"
          ],
          "operations": [
            {
              "operation": "gRPC Update",
              "trigger": "Apply partial update to global serverless cluster after request reconstruction",
              "conditions": [
                "At least one mutable field changes"
              ],
              "implementation": "clusterSvc.UpdateCluster() -> serverlessCli.UpdateCluster()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.ChangeRootPassword": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load the target serverless cluster and resolve its user prefix before changing the root password",
              "implementation": "clusterRepo.GetCluster() / clusterSvc.GetCluster()"
            },
            {
              "operation": "SELECT",
              "table": "custom_statuses",
              "purpose": "Check root-password mutex custom status before invoking the global SQL-user API",
              "implementation": "customStatusRepo.IsMutexClusterAction()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "SqlUserService.ChangeSqlUserPasswd",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ChangeSqlUserPasswd",
              "trigger": "Change the root SQL user password in serverless-global-service after cluster lookup and mutex checks",
              "conditions": [
                "Always"
              ],
              "implementation": "ChangeRootPassword() -> userSvc.ChangeSqlUserPassword() -> serverlessCli.ChangeSqlUserPasswd()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.ListRegions": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Check whether third-party provider restrictions exist before listing serverless regions",
              "conditions": [
                "Always"
              ],
              "implementation": "ListRegions() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.IsHitFeatureFlag",
          "operation_type": "grpc_unary",
          "conditions": [
            "thirdProviders is empty"
          ],
          "operations": [
            {
              "operation": "gRPC IsHitFeatureFlag",
              "trigger": "Check the Alibaba Cloud whitelist feature when no third-party provider restrictions exist",
              "conditions": [
                "thirdProviders is empty"
              ],
              "implementation": "ListRegions() -> accountCli.IsHitFeatureFlag()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "thirdProviders is empty && isAlicloudOrg == false"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Load org country metadata when neither marketplace nor Alibaba whitelist rules apply",
              "conditions": [
                "thirdProviders is empty && isAlicloudOrg == false"
              ],
              "implementation": "ListRegions() -> accountCli.GetOrgByID()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CloudProviderService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "List serverless cloud providers and their regions before applying visibility filters",
              "conditions": [
                "Always"
              ],
              "implementation": "ListRegions() -> serverlessCli.ListCloudProviders()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.ListCloudProviders": {
      "infrastructure": {},
      "services": [
        {
          "name": "tidb-mgmt-service",
          "target_binary": "tidb-mgmt-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessClusterService.ListRegions",
          "operation_type": "local_call",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "local ListRegions",
              "trigger": "Delegate provider enumeration to the same OpenAPI ListRegions handler and uniq the resulting provider set",
              "conditions": [
                "Always"
              ],
              "implementation": "ListCloudProviders() -> ListRegions()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.BatchCreateClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Check duplicate display names for each cluster in the batch",
              "implementation": "clusterRepo.CountDisplayNameUnderProject()"
            },
            {
              "operation": "INSERT",
              "table": "clusters",
              "purpose": "Persist each serverless cluster record before DAG submission",
              "implementation": "clusterRepo.InsertNewCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Load tenant third-party provider restrictions before validating the batch request",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.BatchCreateClusters() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "CloudProviderService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ListCloudProviders",
              "trigger": "Validate requested cloud-provider and region pairs against the global serverless inventory",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.BatchCreateClusters() -> serverlessCli.ListCloudProviders()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.Create",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC Create",
              "trigger": "Validate and stage each serverless cluster create request in the global control plane",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.BatchCreateClusters() -> createSingleCluster() -> validateGlobalCreate() / serverlessCli.CreateCluster()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.AddClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "validateOnly == false for each created cluster"
          ],
          "operations": [
            {
              "operation": "gRPC AddClusterRelations",
              "trigger": "Create org/project relation records for each persisted serverless cluster",
              "conditions": [
                "validateOnly == false for each created cluster"
              ],
              "implementation": "clusterSvc.BatchCreateClusters() -> createSingleCluster() -> accountCli.UpsertClusterRelations()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.BatchGetClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Resolve the requested cluster IDs under org/project permission filters",
              "implementation": "clusterRepo.List()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Hydrate serverless cluster runtime details for the requested cluster ID set",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.ListClusters() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.ClaimClusterFromZero": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Load the original zero cluster and verify its rented state before claim",
              "implementation": "clusterRepo.GetCluster()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Advance zero-cluster shadow state and insert the claimed cluster record inside the transaction",
              "implementation": "clusterRepo.UpdateShadowState() / clusterRepo.InsertNewCluster()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Load tenant third-party provider restrictions before claim validation",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.ClaimClusterFromZero() -> accountCli.GetTenantThirdPartyAccountProviders() -> account.GetOrgByID()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.Create",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC Create",
              "trigger": "Validate the target permanent cluster against the global serverless control plane before launching the claim DAG",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.claimSingleCluster() -> validateGlobalCreate() / serverlessCli.CreateCluster()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_binary": "provider",
          "target_repo": "tidbcloud/account",
          "target_interface": "AccountAPIService.AddClusterRelations",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC AddClusterRelations",
              "trigger": "Persist org/project relation records for the newly claimed cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.claimSingleCluster() -> accountCli.UpsertClusterRelations()"
            }
          ]
        }
      ]
    },
    "ServerlessClusterService.TakeoverClusterFromPool": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "shadow_pools",
              "purpose": "Load the requested shadow pool and verify org ownership before takeover",
              "implementation": "shadowPoolRepo.Get()"
            },
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Lock and pick a prepared cluster from the shadow pool",
              "implementation": "clusterRepo.QueryPreparedShadowClustersForUpdate()"
            },
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Advance the selected shadow cluster through taking-over and taken-over states",
              "implementation": "clusterRepo.UpdateShadowState()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "SqlUserService.ChangeSqlUserPasswd",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC ChangeSqlUserPasswd",
              "trigger": "Reset the root password on the prepared shadow cluster before handing it to the caller",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.TakeoverCluster() -> serverlessCli.ChangeSqlUserPasswd()"
            }
          ]
        },
        {
          "name": "serverless-global-service",
          "target_binary": "serverless-global-service",
          "target_repo": "tidbcloud/tidb-management-service",
          "target_interface": "ServerlessService.List",
          "operation_type": "grpc_unary",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC List",
              "trigger": "Reload the taken-over cluster through the standard GetCluster/List path after takeover",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterSvc.TakeoverCluster() -> GetCluster() -> ListClusters() -> serverlessCli.ListClusters()"
            }
          ]
        }
      ]
    },
    "BffClusterService.GetCluster": {
      "infrastructure": {},
      "services": []
    },
    "InternalClusterService.ListClusters": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "clusters",
              "purpose": "Query cluster metadata",
              "implementation": "clusterRepo.List()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalClusterService.DeleteCluster": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "UPDATE",
              "table": "clusters",
              "purpose": "Soft delete cluster record",
              "implementation": "clusterRepo.SoftDelete()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_interface": "ServerlessService.Delete",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == SERVERLESS"
          ],
          "operations": [
            {
              "operation": "gRPC Delete",
              "trigger": "Delete serverless cluster",
              "conditions": [
                "DeployType == SERVERLESS"
              ],
              "implementation": "serverlessCli.DeleteCluster()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_interface": "ClusterService.DeleteCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == DEDICATED"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteCluster",
              "trigger": "Delete dedicated cluster",
              "conditions": [
                "DeployType == DEDICATED"
              ],
              "implementation": "dedicatedCli.DeleteCluster()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_interface": "ClusterService.DeleteCluster",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == NEXTGEN"
          ],
          "operations": [
            {
              "operation": "gRPC DeleteTidb",
              "trigger": "Delete nextgen cluster",
              "conditions": [
                "DeployType == NEXTGEN"
              ],
              "implementation": "nextgenCli.DeleteTidb()"
            }
          ]
        }
      ]
    },
    "InternalRegionService.GetRegion": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.ListCloudProviders": {
      "infrastructure": {},
      "services": []
    },
    "InternalRegionService.ListRegions": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "regions",
              "purpose": "Query available regions",
              "implementation": "regionRepo.List()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalRegionService.RegisterRegion": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "INSERT",
              "table": "regions",
              "purpose": "Register new region",
              "implementation": "regionRepo.Create()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "serverless-global-service",
          "target_interface": "RegionService.Register",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == SERVERLESS"
          ],
          "operations": [
            {
              "operation": "gRPC Register (region)",
              "trigger": "Register region in serverless-global",
              "conditions": [
                "DeployType == SERVERLESS"
              ],
              "implementation": "serverlessCli.RegisterRegion()"
            }
          ]
        },
        {
          "name": "dedicated-global-service",
          "target_interface": "RegionService.RegisterRegion",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == DEDICATED"
          ],
          "operations": [
            {
              "operation": "gRPC RegisterRegion",
              "trigger": "Register region in dedicated-global",
              "conditions": [
                "DeployType == DEDICATED"
              ],
              "implementation": "dedicatedCli.RegisterRegion()"
            }
          ]
        },
        {
          "name": "nextgen-global-service",
          "target_interface": "RegionService.RegisterRegion",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/tidb-management-service",
          "conditions": [
            "DeployType == NEXTGEN"
          ],
          "operations": [
            {
              "operation": "gRPC Register (region)",
              "trigger": "Register region in nextgen-global",
              "conditions": [
                "DeployType == NEXTGEN"
              ],
              "implementation": "nextgenCli.RegisterRegion()"
            }
          ]
        }
      ]
    },
    "InternalMaintenanceService.GetMaintenanceTask": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_tasks",
              "purpose": "Load the maintenance task by ID",
              "implementation": "mtRepo.Load()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalMaintenanceService.GetMaintenanceWindow": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_windows",
              "purpose": "Load the project maintenance window, or fall back to the default in-memory window when no row exists",
              "implementation": "mwRepo.LoadByProjectID()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Resolve the project before deriving tenant timezone",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetProjectByID()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Resolve the tenant timezone used to render the maintenance window",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "InternalMaintenanceService.ListMaintenanceTasks": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_tasks",
              "purpose": "List maintenance tasks for the specified project",
              "implementation": "mtRepo.Query()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalMaintenanceService.ListMaintenanceWindows": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_windows",
              "purpose": "Load the project maintenance window, or fall back to the default in-memory window when no row exists",
              "implementation": "mwRepo.LoadByProjectID()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Resolve the project before deriving tenant timezone",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetProjectByID()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Resolve the tenant timezone used to render the maintenance window",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "InternalMaintenanceService.UpdateMaintenanceTask": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_tasks, maintenance_task_executions",
              "purpose": "Load the maintenance task and any pending/running executions before validating the state transition",
              "implementation": "mtRepo.Load(); mteRepo.Query()"
            },
            {
              "operation": "UPDATE",
              "table": "maintenance_tasks",
              "purpose": "Persist the updated maintenance task state or scheduled apply time",
              "implementation": "mtRepo.Save()"
            }
          ]
        }
      },
      "services": []
    },
    "InternalMaintenanceService.UpdateMaintenanceWindow": {
      "infrastructure": {
        "mysql": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "SELECT",
              "table": "maintenance_windows",
              "purpose": "Load any existing maintenance-window row for the project before deciding whether to create or overwrite it",
              "implementation": "mwRepo.LoadByProjectID()"
            },
            {
              "operation": "UPSERT",
              "table": "maintenance_windows",
              "purpose": "Persist the updated maintenance window after converting the user timezone into UTC storage fields",
              "implementation": "mwRepo.Save()"
            }
          ]
        }
      },
      "services": [
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetProjectByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetProjectByID",
              "trigger": "Resolve the project before deriving tenant timezone for maintenance-window conversion",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetProjectByID()"
            }
          ]
        },
        {
          "name": "account-service",
          "target_interface": "AccountAPIService.GetOrgByID",
          "operation_type": "grpc_unary",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "gRPC GetOrgByID",
              "trigger": "Resolve the tenant timezone used to convert the incoming maintenance window",
              "conditions": [
                "Always"
              ],
              "implementation": "accountCli.GetTimeZoneByProjectID() -> account.GetOrgByID()"
            }
          ]
        }
      ]
    },
    "BffClusterService.ListClusters": {
      "infrastructure": {},
      "services": []
    }
  },
  "notes": [
    "Complete scan based on register.go (lines 418-472)",
    "40 gRPC services with 245 methods registered",
    "Service types: dedicated_openapi(8), nextgen_openapi(10), serverless_openapi(1), zero_openapi(1), internal_api(16), bff_console_api(1), bff_oneconsole_api(2), core_api(1)",
    "Dependencies documented for key methods (23/245)",
    "Remaining method dependencies need manual analysis of implementation code",
    "Routes requests to regional/global services based on cluster deploy type (SERVERLESS/DEDICATED/NEXTGEN)",
    "Uses workflow engine (FastFlow) for complex multi-step operations",
    "Emits events to Kafka for audit logging and downstream processing",
    "Lifecycle coverage now includes reverse-proxy registration and background worker startup from app.RegisterGrpcServer.",
    "Package-qualified OpenAPI backend keys were added so tidb-mgmt-portal roots can continue traversal into tidb-mgmt-service without losing API-family identity.",
    "Deepened package-qualified OpenAPI backend dependencies for dedicated pause/resume/reset, serverless batch/claim/takeover, and nextgen restore/backup/export roots using source-backed control-plane calls.",
    "Deepened package-qualified OpenAPI backend dependencies for nextgen backup/public/private-link settings and serverless root-password flows using source-backed control-plane calls.",
    "Deepened package-qualified OpenAPI backend dependencies for dedicated private-endpoint/CMEK flows and nextgen log-redaction, dual-layer encryption, and CMEK roots using source-backed control-plane calls."
  ]
}