__` (double underscore between section and field). When the same field is set in more than one layer, the environment variable wins. Real secrets are injected only through environment variables — never written into `config.yaml`, never committed. ## config.yaml ```yaml server: addr: ":8080" shutdown_timeout: 20s enable_cors: true cors_origins: [] # CORS allowlist; enable_cors is only the master switch — origins not listed here get no CORS headers openapi: true reflection: false # gRPC reflection off by default auth: jwt_secret: "dev-only-insecure-secret-change-me-please" issuer: "gortexa" # audience: "myapp" # optional: stamps aud into signed tokens and requires it — isolates services sharing a secret ttl: 1h db: dsn: "" # PostgreSQL DSN (Secret, masked in logs); inject via env: GORTEXA_DB__DSN max_conns: 10 cache: driver: "memory" # "memory" (default, process-local) or "redis" mq: driver: "nats" # "nats" (core, at-most-once) or "jetstream" (durable, at-least-once) url: "" # comma-separated servers, e.g. "nats://a:4222,nats://b:4222" group_id: "" # empty = fanout; non-empty = load-balance log: level: "info" format: "json" observ: service_name: "gortexa" service_version: "dev" # tracing_otlp: "localhost:4317" # OTLP trace endpoint; empty disables # metrics_otlp: "localhost:4317" # OTLP metrics endpoint; empty disables (rate-limit/circuit-breaker metrics need it) # logs_otlp: "localhost:4317" # OTLP log endpoint; empty disables otlp_insecure: true # local docker compose only; never true for remote sample_ratio: 1.0 genai_capture_content: false # when true, MCP tool-call arguments are recorded in telemetry # genai_mask_fields: ["password", "token", "secret", "authorization", "api_key"] ``` `genai_capture_content: true` sends AI tool-call arguments into telemetry; the default mask list only covers common field names. Combined with `otlp_insecure: true`, that content leaves the host in cleartext — do not enable both in production. ## Cache: memory and redis `cache.driver` selects the backend. The default `memory` needs no external service; `redis` is the only driver that reads `addr` and the fields below it. Any value other than `memory` or `redis` fails startup with `cache: unsupported driver`. #### memory (default) ```yaml cache: driver: "memory" ``` Process-local, no external dependency. Good for single-instance deployments and local development. #### redis ```yaml cache: driver: "redis" addr: "localhost:6379" password: "" # inject via env: GORTEXA_CACHE__PASSWORD db: 0 # The client tunables below are all optional; omit to use the built-in default dial_timeout: 5s # default 5s read_timeout: 3s # default 3s write_timeout: 3s # default 3s pool_size: 10 # default 10; must not be negative ``` On redis, the framework's built-in zero-dependency RESP client connects — no third-party redis package. Each tunable's zero value means "use the built-in default", so set only the one you need to change: | Field | Default | Purpose | | --- | --- | --- | | `dial_timeout` | 5s | Timeout for establishing a connection | | `read_timeout` | 3s | Timeout for reading a single reply | | `write_timeout` | 3s | Timeout for writing a single command | | `pool_size` | 10 | Connection pool size; `0` uses the default, negative is rejected | Behind a load balancer, shortening the timeouts fails fast instead of stalling the whole request; a busy service can raise `pool_size`. ## Database (PostgreSQL) `db.dsn` is the pgx connection string (a Secret field, always masked in logs); `db.max_conns` defaults to 10. Inject the real DSN via an environment variable: ```bash GORTEXA_DB__DSN=postgres://user:pass@pgbouncer:6432/app ``` The pool is PgBouncer-safe: `QueryExecModeExec` with statement and description caches disabled, so it works behind PgBouncer in transaction-pooling mode without prepared-statement errors. The development flow: schema goes in `db/migrations/`, SQL in `db/queries/`, and `make sqlc` generates type-safe query code into `internal/storage/db/`. `deploy/docker-compose.yaml` already ships postgres and PgBouncer for local verification. ## Environment overrides Any field can be overridden with an environment variable, using `GORTEXA_

__`: ```bash GORTEXA_SERVER__ADDR=:9090 GORTEXA_AUTH__JWT_SECRET= GORTEXA_CACHE__DRIVER=redis GORTEXA_CACHE__ADDR=redis.internal:6379 GORTEXA_SERVER__REFLECTION=true ``` ## Secret rules - The placeholder `dev-only-insecure-secret-change-me-please` is refused at startup — it cannot ship by accident. - JWT secrets shorter than 32 bytes are also refused. - Services sharing a secret and the default issuer accept each other's tokens — set a distinct `auth.audience` per service to isolate them (a token minted for A is rejected by B). - Secret fields such as the redis password and the MQ URL (which can embed credentials) are masked in logs and error output. - Real secrets are injected via environment variables, never committed. ## MQ semantics `mq.group_id` selects the delivery mode, identically on both drivers: | group_id | NATS (core) | JetStream | Semantics | | --- | --- | --- | --- | | Empty (default) | Subscribe | Ephemeral consumer | Fanout: every subscriber receives each message | | Non-empty | QueueSubscribe | Durable consumer (named after group_id, acked only after the handler succeeds) | Load-balance: one handler per message | The drivers differ in the delivery guarantee: core NATS is at-most-once (no redelivery — a message whose handler fails is gone), while `driver: "jetstream"` is at-least-once — publish blocks on the server's storage ack and a handler error triggers a delayed redelivery, so handlers must be idempotent. JetStream needs the server started with `-js`; the framework lazily creates a stream per topic (24h retention), and an operator may pre-create a stream with different retention — the framework adopts it and never rewrites an existing stream. ## Diagnostics ```bash gortexa doctor # check the Go toolchain and proto tools ``` # Deployment The framework repo ships reference material under `deploy/`: a multi-stage distroless Dockerfile (proto regenerated inside the image with pinned tools) and a docker-compose with otelcol, Prometheus, Grafana and PgBouncer configuration. The three items below are deliberately left to the operator — the framework does not do them for you. **Wire these before going live** TLS termination, authorization and readiness dependency checks are not done for you. Skip any one and a service facing the public internet silently loses transport security or authorization — no error, no warning. ## Scaffold secret preflight A new scaffold carries local development configuration. Before the first git add, Docker build, or CI handoff, verify that every secret is externalized. **Do not leave a usable JWT signing secret in version control or an image layer.** - Supply real secrets through a secret manager, mounted file, or runtime environment using GORTEXA_AUTH__JWT_SECRET. - Keep only an unusable placeholder or a secret-free example configuration in the repository; ignore local overrides. - Make sure both the Docker build context and runtime image exclude local secret configuration, and verify the image starts only with runtime injection. - Plan rotation, issuer, and audience; services sharing a secret should use different audiences. This is a deployment gate, not optional later work. Likewise, the scaffold's in-memory resource is only a demo; establish real storage, cache, and MQ lifecycle before treating readiness as meaningful. ## Terminate TLS in front The service port is cleartext h2c; the server does no TLS itself. Bearer tokens crossing this port are unencrypted. Put the service behind a reverse proxy, service mesh or load balancer that terminates TLS. Do not expose the h2c port to the public internet. ## Wire readiness to real dependencies `/readyz` only reflects that the process is alive until you register real checks with `app.Health().Register(...)`: ```go app.Health().Register("postgres", func(ctx context.Context) health.State { if err := pool.Ping(ctx); err != nil { return health.Unhealthy } return health.Healthy }) ``` Health probes can target a private ops port, separate from the public one: `kernel.WithAdminListener(addr)` serves only `/healthz` and `/readyz` on a separate plain-HTTP port, so an orchestrator can probe health without reaching the public h2c port (`app.AdminAddr()` reports the bound address). To expose pprof or a custom ops handler on a separate port, use `kernel.WithExtraListener(lis, h)`. Both are opt-in; the main h2c port's single-port multiplexing is unchanged. Each check runs under a 5-second timeout, so a single slow dependency cannot stall the query. ## Authorization is the application's job The framework does authentication only: it verifies the JWT signature and puts the claims into the context. Who may do what (roles, permission policy) is decided by the application, in handlers or its own interceptor: ```go claims, ok := auth.ClaimsFrom(ctx) if !ok || !slices.Contains(claims.Roles, "admin") { // reject } ``` ## Graceful shutdown On SIGTERM the server drains in-flight requests within `server.shutdown_timeout` (default 20s) before exiting. Interruption under authenticated load is verified by [example 05](/en/examples/resilience/). ## Production flags - Keep `server.reflection` at `false`: do not expose the service structure. - `observ.otlp_insecure` must be `false` for any remote collector. - Real secrets use runtime injection and must not exist in Git or an image layer — see [Configuration](/en/configuration/). # Examples overview These examples are the framework's verification matrix: 11 independent scenarios, each proving one concrete behaviour with a `run.sh`. The sub-pages below list the key checks and copyable snippets, so you can verify the same properties in your own project. ## Shared setup - **Test token**: scenarios that pass auth need a JWT. Sign one with your project's `auth` — see [Getting a dev token](/en/quickstart/#getting-a-dev-token). The example set also ships a `tools/mint` HS256 minter, resolving the secret from `-secret` → `GORTEXA_AUTH__JWT_SECRET` → `etc/config.yaml`. - **Ports**: server scenarios run from `:18080` up (each uses a distinct port to avoid clashes), polling `/readyz` before probing. - **Cleanup**: each scenario tears down its server via `trap cleanup EXIT` or `docker compose stop`; all are re-runnable. - **Dependencies**: only the two NATS-family scenarios (core and JetStream) need docker; the rest are pure local binaries. ## Sub-pages - [Developer flow](/en/examples/workflow/): the full scaffold loop, one entity across three protocols. - [Security & boundaries](/en/examples/security/): auth rejections leak nothing, secret startup safety, the header allowlist, the reflection gate. - [Contract & resilience](/en/examples/resilience/): the buf breaking gate, graceful drain on SIGTERM. - [AI & messaging](/en/examples/messaging/): export tool schemas, NATS/JetStream integration. - [Full example](/en/examples/full-example/): after `go get`, wire the public packages into a service with a complete, annotated `main.go`. ## Suggested path 1. [Developer flow](/en/examples/workflow/) — walk the full development loop once. 2. See one proto become three protocols. 3. [Security & boundaries](/en/examples/security/) — the error model and interceptor chain under adversarial input. # Developer flow ## 01 scaffold-smoke — the full developer loop Proves create → gen → build → test runs end to end and still holds after adding a second API. This is a scaffold transport smoke test; checking that create replaces the placeholder does **not** authorize committing or baking the resulting usable secret into an image. ```bash gortexa create myapp --module github.com/me/myapp cd myapp make gen # buf lint → breaking → generate go build ./... && go test ./... gortexa gen shop/v1 Product # add a second API make gen && go build ./... && go test ./... ``` Key assertions: `proto/shop/v1/product.proto` and `internal/logic/product.go` are generated, `cmd/server/main.go` is wired for product, and finding `dev-only-insecure-secret-change-me-please` in `etc/config.yaml` fails the run. That only proves local startup; before Git or Docker, move to external secret injection and replace the in-memory logic with a real data layer. ## 02 multi-protocol-e2e — one entity across three protocols On a single h2c port (`:18080`), an entity created over gRPC is fetchable over HTTP, and one created over MCP shows up in the list — all three share one store. `$TOK` is a dev token, `$SCHEMA` is the descriptor from `buf build`. Create over gRPC: ```bash buf curl --protocol grpc --http2-prior-knowledge --schema $SCHEMA \ -H "authorization: Bearer $TOK" \ -d '{"resource":{"name":"grpc-entity","owner":"owner-e2e"}}' \ http://localhost:18080/resource.v1.ResourceService/CreateResource ``` Fetch the same id over the HTTP gateway, then create a third over MCP `tools/call`: ```bash curl -H "authorization: Bearer $TOK" http://localhost:18080/v1/resources/$RID # 200, same entity curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \ -H "authorization: Bearer $TOK" \ -d '{"jsonrpc":"2.0","id":3,"method":"tools/call", "params":{"name":"create_resource", "arguments":{"resource":{"name":"mcp-entity","owner":"owner-e2e"}}}}' ``` Listing `owner-e2e` at the end shows the entities created over gRPC, HTTP and MCP together — proof the three surfaces sit on one store. # Security & boundaries ## 03 security-probe — rejection paths leak nothing Adversarial input across all three protocols, asserting no error body carries internal detail. ```bash # missing/bad/expired token → 401 UNAUTHENTICATED curl -H "authorization: Bearer xxx" http://localhost:18080/v1/resources # 401 # evil origin → response carries no Access-Control-Allow-Origin curl -D - -H "Origin: https://evil.example" http://localhost:18080/v1/resources # >1MB body to /mcp → 413, clean curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \ --data-binary @big.json # 413 # bad version / unknown tool / huge id / not-JSON → structured JSON-RPC error, no panic curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"no_such_tool","arguments":{}}}' ``` A final scan over every rejection body asserts no stack traces, internal paths, or unmasked causes. ## 06 config-matrix — JWT secret startup safety A placeholder or too-short secret is refused at startup (fail-loud), and the error never echoes the secret itself. ```bash GORTEXA_AUTH__JWT_SECRET="dev-only-insecure-secret-change-me-please" ./server # exit 1, no port bound GORTEXA_AUTH__JWT_SECRET='tooshort' ./server # exit 1 GORTEXA_AUTH__JWT_SECRET="<45-byte real secret>" ./server # starts; env overrides file secret ``` Rejection happens before listen, so (a) and (b) never bind a port. ## 08 header-leak-probe — response header allowlist Response headers stay within a fixed allowlist: no `Grpc-Metadata-*` passthrough, while `X-Request-Id` must survive (the allowlist must not overshoot). ```bash curl -D - -H "authorization: Bearer $TOK" http://localhost:18082/v1/resources/x # asserts: no grpc-metadata-* headers, nothing outside the allowlist, X-Request-Id present ``` ## 09 reflection-probe — reflection off by default, config-gated gRPC reflection is off by default; the same call succeeds only once it is enabled via env. ```bash buf curl --protocol grpc --http2-prior-knowledge --reflect ... # default: fails (service not found) GORTEXA_SERVER__REFLECTION=true ./server buf curl --protocol grpc --http2-prior-knowledge --reflect ... # enabled: succeeds ``` Keep it off in production — see the production flags in [Deployment](/en/deployment/). # Contract & resilience ## 04 breaking-gate — the contract-breaking gate Proves `gortexa regen`'s buf breaking gate blocks compatibility-breaking proto edits and allows additive ones. This scenario also exercises `regen`'s `isGitToplevel()` path (a macOS `/tmp` → `/private/tmp` symlink once made the gate skip silently; fixed). ```bash gortexa create bg --module github.com/me/bg --repo "$REPO" --ref main cd bg && make gen # first gen: no main ref yet, gate skips (expected) git add -A && git commit -m base && git branch -M main # delete Resource's owner field (tag 3) — a breaking edit gortexa regen # non-zero exit: gate BLOCKS the breaking edit ``` An additive edit (a new field) passes `regen` cleanly. The gate reads proto from the git `main` ref, not from `gen/`. ## 05 resilience-shutdown — graceful drain on SIGTERM Authenticated mixed load is interrupted mid-flight with SIGTERM; the server must drain in-flight requests within `shutdown_timeout`, exit 0, not panic, and recover on restart. ```bash ./server & # a real binary, so SIGTERM lands on the server (not a go run wrapper) ./loadgen ... # authenticated load kill -TERM $SRV # SIGTERM while load is in flight wait $SRV # exit 0, drain complete, drain time <= shutdown_timeout ``` A real binary (not `go run`) is used so the exit code is unambiguous — `go run` wraps the server in an extra process. # AI & messaging ## 10 export-cli — AI tool schema export `gortexa export` emits valid JSON schemas in three provider formats for every `gortexa.ai.v1`-annotated method, without a running server. ```bash for fmt in mcp openai gemini; do gortexa export --format "$fmt" # each emits valid JSON containing the resource tools done gortexa export --format nope # unknown format: non-zero exit, clean failure ``` All three outputs are locked by golden tests: change the proto and the schemas change, so drift is caught. ## 11 nats-integration — against a real NATS broker Starts a real NATS broker from the scenario's own `docker-compose.yaml` and runs the mq core-NATS integration tests. With `NATS_URL` set, the tests connect to the container's broker rather than an in-process embedded server, and a connection failure fails — a skip counts as failure too. ```bash docker compose -f docker-compose.yaml up -d nats NATS_URL=nats://127.0.0.1:4222 go test -tags integration -race -count=1 \ -run 'TestNATS' ./mq/ ``` Asserts `TestNATSPubSub` and `TestNATSQueueGroupLoadBalance` PASS — the latter verifies the load-balance semantics of a non-empty `group_id` (see [Configuration](/en/configuration/#mq-semantics)). ## 12 jetstream-integration — against a real JetStream broker Same structure as 11 with the JetStream driver: the broker starts with `-js` and the tests use the `JETSTREAM_URL` env var. Beyond the fanout and load-balance semantics shared with core NATS, it verifies the JetStream-specific at-least-once property — a handler error triggers a delayed redelivery. ```bash docker compose -f docker-compose.yaml up -d nats # nats:2 with command: ["-js"] JETSTREAM_URL=nats://127.0.0.1:4222 go test -tags integration -race -count=1 \ -run 'TestJetStream' ./mq/ ``` Asserts `TestJetStreamPubSub`, `TestJetStreamQueueGroupLoadBalance` and `TestJetStreamRedeliveryOnHandlerError` PASS — the last one pins the at-least-once redelivery (which is why handlers must be idempotent, see [Configuration](/en/configuration/#mq-semantics)). # Full example: assembling a service as a module Wire the public packages into one runnable service — after `go get`, no scaffold. For each package's usage see [Components](/en/components/). Fetch the module: ```bash go get github.com/yshengliao/gortexa@v0.27.0 ``` How each component is enabled (all driven by config): - **config**: `MustBuild` layers `etc/config.yaml` and the environment (`GORTEXA_` prefix). - **observability**: exports OTLP only when `observ.tracing_otlp` / `metrics_otlp` / `logs_otlp` is set; a no-op otherwise. - **auth**: set `auth.jwt_secret` (≥ 32 bytes) and `auth.issuer`. - **interceptor**: `NewSet` builds the fixed eight-stage chain. - **health**: `app.Health().Register` adds a check that `/readyz` aggregates. - **gateway (HTTP/JSON)**: `httpcompat.NewServeMux` plus your gateway handler. - **mcp**: `mcp.NewBridge` turns `gortexa.ai.v1`-annotated RPCs into MCP tools. - **mq / cache / storage / client**: once `mq.url` / `cache.driver: redis` / `db.dsn` are set, use `mq.New` / `cache.New` / `storage.NewPool` / `client.NewGRPCConn` inside your handlers. The complete `main.go` (your own generated service is a commented placeholder; the framework wiring in this snippet is compile-verified against v0.27.0): ```go package main import ( "context" "fmt" "net/http" "os" "os/signal" "strings" "syscall" "time" "google.golang.org/protobuf/reflect/protoreflect" "github.com/yshengliao/gortexa/apperr" "github.com/yshengliao/gortexa/auth" "github.com/yshengliao/gortexa/config" "github.com/yshengliao/gortexa/health" "github.com/yshengliao/gortexa/httpcompat" "github.com/yshengliao/gortexa/interceptor" "github.com/yshengliao/gortexa/kernel" "github.com/yshengliao/gortexa/mcp" "github.com/yshengliao/gortexa/observability" // billingpb "github.com/me/myapp/gen/billing/v1" // your own generated service ) func main() { if err := run(); err != nil { fmt.Fprintln(os.Stderr, "fatal:", err) os.Exit(1) } } func run() error { // 1. Config — layered: defaults < YAML < .env < env (GORTEXA_ prefix). // MustBuild fails loud on a missing/short jwt_secret or blank issuer. cfg := config.MustBuild(config.WithConfigFile("etc/config.yaml")) ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM) defer stop() // 2. Observability — logs/traces/metrics. Each exports over OTLP only when // its observ.*_otlp endpoint is set, and is a no-op otherwise. Each // returns a ShutdownFunc that flushes buffered telemetry on exit. log, logShutdown, err := observability.SetupLogs(ctx, cfg.Log, cfg.Observ) if err != nil { return fmt.Errorf("setup logs: %w", err) } traceShutdown, err := observability.SetupTracing(ctx, cfg.Observ) if err != nil { return fmt.Errorf("setup tracing: %w", err) } metricShutdown, err := observability.SetupMetrics(ctx, cfg.Observ) if err != nil { return fmt.Errorf("setup metrics: %w", err) } govMetrics, err := observability.NewGovernanceMetrics() if err != nil { return fmt.Errorf("governance metrics: %w", err) } // 3. Auth — HS256 verifier from the configured secret / issuer / audience. verifier, err := auth.NewVerifier([]byte(cfg.Auth.JWTSecret.Reveal()), cfg.Auth.Issuer, cfg.Auth.Audience) if err != nil { return fmt.Errorf("auth verifier: %w", err) } // 4. Interceptor chain — recover → request-id → logger → load-shed → // rate-limit → circuit-breaker → auth → validation. Health probes carry // no token, so skip auth for them. set, err := interceptor.NewSet(interceptor.Config{ Logger: log, Verifier: verifier, Metrics: govMetrics, AuthSkip: func(method string) bool { return strings.HasPrefix(method, "/grpc.health.") }, RateLimit: interceptor.RateLimitConfig{RPS: 200, Burst: 100, TTL: 10 * time.Minute}, CircuitBreaker: interceptor.CBConfig{MaxFailures: 5, OpenInterval: 10 * time.Second, HalfOpenMax: 2}, LoadShedding: interceptor.LoadSheddingConfig{MaxInflight: 1024}, }) if err != nil { return fmt.Errorf("interceptors: %w", err) } // 5. Kernel — the App owns the single h2c port. StatsHandler carries OTel // (not interceptors); HTTPWrap adds CORS around the HTTP surface; // shutdown hooks flush the three telemetry providers on exit. app, err := kernel.New( kernel.WithConfig(cfg), kernel.WithLogger(log), kernel.WithInterceptors(set), kernel.WithStatsHandler(observability.ServerStatsHandler()), kernel.WithHTTPWrap(func(h http.Handler) http.Handler { return httpcompat.CORS(h, cfg.Server) }), kernel.WithShutdownHook(traceShutdown), kernel.WithShutdownHook(metricShutdown), kernel.WithShutdownHook(logShutdown), ) if err != nil { return fmt.Errorf("build app: %w", err) } // 6. Register your generated gRPC service, plus a health check that /readyz // aggregates. StartMetricsExport publishes component health as an OTel gauge. // billingpb.RegisterInvoiceServiceServer(app.GRPCServer(), billing.NewInvoiceService()) app.Health().Register("self", func(context.Context) health.State { return health.Healthy }) app.Health().StartMetricsExport(ctx, govMetrics, 0) // 7. Loopback — the gateway and MCP bridge dial the in-process server, so // HTTP/JSON and MCP calls go through the same interceptor chain as gRPC. conn, err := app.Loopback() if err != nil { return fmt.Errorf("loopback: %w", err) } // 8. HTTP/JSON via grpc-gateway. Register your service's gateway handler, // then cap the body at 1 MiB. gateway := httpcompat.NewServeMux(apperr.Default) // _ = billingpb.RegisterInvoiceServiceHandler(ctx, gateway, conn) app.SetGateway(httpcompat.MaxBodyBytes(gateway)) // 9. MCP bridge — exposes every gortexa.ai.v1-annotated RPC in the listed // services as an MCP tool. SetAllowedOrigins is the DNS-rebinding guard. descs, err := mcp.ServiceDescriptors(mcpServices()...) if err != nil { return fmt.Errorf("mcp descriptors: %w", err) } bridge, err := mcp.NewBridge(conn, descs, apperr.Default, cfg.Observ) if err != nil { return fmt.Errorf("mcp bridge: %w", err) } bridge.SetAllowedOrigins(cfg.Server.CORSOrigins) app.SetMCPHandler(bridge.Handler()) // 10. Run until SIGINT/SIGTERM; graceful shutdown drains in-flight work and // runs the shutdown hooks. Optional batteries — mq.New(cfg.MQ), // cache.New(cfg.Cache), storage.NewPool(ctx, cfg.DB, tracer), // client.NewGRPCConn(...) — are wired here as your handlers need them. log.Info("starting", "addr", cfg.Server.Addr) return app.Run(ctx) } // mcpServices lists the services exposed over the MCP bridge (and schema export). func mcpServices() []protoreflect.FullName { return []protoreflect.FullName{ "billing.v1.InvoiceService", } } ```