amadan

carlos / platform Public

console: instance door fills the app region, proves eligibility, refuses keyless regions (nearest-region §7, R9)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 9e8141012b9f5d375d7845f239a129cc50f92d8a parent a506407
3 files changed, +435 −1
  • internal/console/apiinstances.go +80 −1
  • internal/console/regionchoices.go +45 −0
  • internal/console/regionfill_test.go +310 −0
diff --git a/internal/console/apiinstances.go b/internal/console/apiinstances.go
index fea307c9c..65314f9ad 100644
--- a/internal/console/apiinstances.go
+++ b/internal/console/apiinstances.go
@@ -542,6 +542,11 @@ type apiRecordView struct {
// a fact about what this one request did, and the record's own
// Environment is what names the store afterwards.
PrivateStoreBucket string `json:"private_store_bucket,omitempty"`
+ // RegionFrom and RegionName say how this create chose its region and
+ // what the place is called (spec §7): facts about this request, not
+ // part of the record.
+ RegionFrom string `json:"region_from,omitempty"`
+ RegionName string `json:"region_name,omitempty"`
}
func recordView(rec provision.Record) apiRecordView {
@@ -766,10 +771,65 @@ func (s *Server) handleAPIInstanceCreate(w http.ResponseWriter, r *http.Request)
jsonError(w, http.StatusBadGateway, "could not check this app's placement")
return
}
+ // The app's region is the default for a create that names none
+ // (nearest-region spec §7, R2). It runs BEFORE every check an explicit
+ // region meets, and never for a fleet-placed app, a pooled manifest, a
+ // replica, or anything but a socket-backed instance.
+ raw := strings.TrimSpace(req.Region)
+ regionFrom := ""
+ if raw != "" {
+ regionFrom = "request"
+ }
+ if raw == "" && placed == "" && m.Pool == "" && strings.TrimSpace(req.Role) == "" &&
+ (provision.Record{Kind: strings.TrimSpace(req.Kind), Addrs: req.Addrs}).DerivesPaths() {
+ appRegion, _, err := s.appRegion(acct.ID, app)
+ if err != nil {
+ log.Printf("console: api instances create %s/%s: read app region: %v", acct.Sqid, app, err)
+ jsonError(w, http.StatusBadGateway, msgAppRegionUnreadable)
+ return
+ }
+ if appRegion != "" {
+ raw, regionFrom = appRegion, "app"
+ }
+ }
+ if placed != "" {
+ regionFrom = "fleet"
+ }
// The home region's NAME normalizes to the record's "" before any
// validation (issue #346): pickers speak the code, records keep the
// unconstrained value reconcile has always scoped by.
- region := s.homeRegionIn(strings.TrimSpace(req.Region))
+ region := s.homeRegionIn(raw)
+ // An APP-DERIVED region needs positive eligibility — the secrets key
+ // included (R9) — and never rides the dormant gate (codex R2-2).
+ if regionFrom == "app" {
+ snap, err := readEdgesSnapshot(ctx, s.cfg.Releases)
+ if err != nil {
+ log.Printf("console: api instances create %s/%s: read edges: %v", acct.Sqid, app, err)
+ jsonError(w, http.StatusServiceUnavailable, msgAppRegionUnconfirmed(s.homeRegionOut(region)))
+ return
+ }
+ cands := s.regionCands(snap)
+ reason := "absent"
+ if c, ok := findCandidate(cands, region); ok {
+ reason = c.unavailableReason()
+ }
+ // Each list names only what an explicit request for this same
+ // instance would pass (codex plan-R4 2): instanceChoices.
+ if reason != "" {
+ jsonError(w, http.StatusBadRequest, msgAppRegionUnavailable(s.homeRegionOut(region), reason, s.instanceChoices(ctx, m.Regions, cands, region)))
+ return
+ }
+ if !instanceRegionAllowed(m.Regions, region) {
+ jsonError(w, http.StatusBadRequest, msgAppRegionNotAllowed(s.homeRegionOut(region), s.instanceChoices(ctx, m.Regions, cands, region)))
+ return
+ }
+ for _, rep := range req.Replicas {
+ if s.homeRegionIn(strings.TrimSpace(rep)) == region {
+ jsonError(w, http.StatusBadRequest, msgReplicaOverlap(s.homeRegionOut(region)))
+ return
+ }
+ }
+ }
// The replica rails (#162) run BEFORE the region allow-list, because
// half a decision is a different refusal from "wrong region": a role
// with no placement, or a set on a replica, is a shape error the
@@ -856,6 +916,19 @@ func (s *Server) handleAPIInstanceCreate(w http.ResponseWriter, r *http.Request)
"region "+region+" is reachable but cannot host an instance — no box there has its hibernation activator configured. Regions that can: "+armedCodes(hostingSet(caps)))
return
}
+ // R9: a socket-backed instance or a replica needs its config,
+ // secrets and store binding rendered on the box, which only a box
+ // holding the deployment's secrets key can do. Refused only when a
+ // CURRENT writer proves the region keyless; unknown keeps today's
+ // behaviour, so roll order never refuses a working region.
+ if probe.DerivesPaths() || probe.Role == "replica" {
+ if snap, err := readEdgesSnapshot(ctx, s.cfg.Releases); err == nil {
+ if c, ok := findCandidate(s.regionCands(snap), region); ok && c.NoKeyProven {
+ jsonError(w, http.StatusBadRequest, msgNoSecretsKey(s.homeRegionOut(region)))
+ return
+ }
+ }
+ }
}
channel := strings.TrimSpace(req.Channel)
if channel == "" {
@@ -1096,6 +1169,12 @@ func (s *Server) handleAPIInstanceCreate(w http.ResponseWriter, r *http.Request)
s.bumpSerial(ctx)
out := recordView(rec)
out.PrivateStoreBucket = privateBucket
+ out.RegionFrom = regionFrom
+ // Every non-fleet placement is named, replicas included (codex
+ // plan-R3 6); a fleet-placed record's Region is the fleet itself.
+ if placed == "" {
+ out.RegionName = s.placeOf(rec.Region, s.candsOrHome(ctx))
+ }
writeJSON(w, http.StatusCreated, out)
}
diff --git a/internal/console/regionchoices.go b/internal/console/regionchoices.go
new file mode 100644
index 000000000..884e42e56
--- /dev/null
+++ b/internal/console/regionchoices.go
@@ -0,0 +1,45 @@
+package console
+
+import (
+ "context"
+ "sort"
+)
+
+// instanceChoices lists, under their names, the regions an EXPLICIT
+// request for this same socket-backed instance would pass right now (codex
+// plan-R4 2): the manifest's allow-list as the door reads it (each code
+// normalized through homeRegionIn first), the armed gate's reachable and
+// hosting bars, and R9's refusal. These are the explicit door's rules, not
+// automatic eligibility. except, the region just refused, is left out.
+//
+// The home joins the list only when CONSOLE_HOME_REGION names it: an
+// unnamed home has no name a caller could pass. The bars are
+// explicitGate.refusal, the same predicate the app-region doors use, so no
+// door lists a region another would refuse.
+func (s *Server) instanceChoices(ctx context.Context, allowed []string, cands []regionCandidate, except string) []string {
+ g := explicitGate{cands: cands}
+ g.caps, g.published = placements(ctx, s.cfg.Releases)
+ codes := map[string]bool{}
+ if s.cfg.HomeRegion != "" {
+ codes[""] = true
+ }
+ for c := range g.caps {
+ if code := s.homeRegionIn(c); code != "" {
+ codes[code] = true
+ }
+ }
+ for _, c := range allowed {
+ if code := s.homeRegionIn(c); code != "" {
+ codes[code] = true
+ }
+ }
+ var out []string
+ for code := range codes {
+ if code == except || !instanceRegionAllowed(allowed, code) || g.refusal(code) != "" {
+ continue
+ }
+ out = append(out, s.homeRegionOut(code))
+ }
+ sort.Strings(out)
+ return out
+}
diff --git a/internal/console/regionfill_test.go b/internal/console/regionfill_test.go
new file mode 100644
index 000000000..affd566c4
--- /dev/null
+++ b/internal/console/regionfill_test.go
@@ -0,0 +1,310 @@
+package console
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "fmt"
+ "net/http"
+ "regexp"
+ "strings"
+ "testing"
+
+ "github.com/carlosframework/platform/internal/provision"
+ "github.com/carlosframework/platform/internal/release"
+)
+
+type fillRec struct {
+ provision.Record
+ RegionFrom string `json:"region_from"`
+ RegionName string `json:"region_name"`
+}
+
+// fillFixture: titogo with an unrestricted shared-pool manifest, a stored
+// app region, a named home, the deployment's secrets key, and two
+// eligible boxes. fx.st.db is the Store's own *sql.DB (same package).
+func fillFixture(t *testing.T, appRegion string) (*consoleFixture, string, string) {
+ t.Helper()
+ fx, token := instanceFixture(t, "code-fill-"+appRegion)
+ fx.srv.cfg.HomeRegion, fx.srv.cfg.SecretsPub = "ie", testKeyPub
+ m := titoManifest()
+ m.Pool, m.Regions = "", nil
+ enableInstances(t, fx, "titogo", m)
+ if _, err := fx.st.db.Exec(`UPDATE apps SET region = ?, region_source = 'chosen' WHERE app = 'titogo'`, appRegion); err != nil {
+ t.Fatal(err)
+ }
+ setEdges(t, fx, map[string]string{"ie-box": homeBox, "uk-box": ukEligible})
+ return fx, token, instancesURL(fx, "bab", "titogo")
+}
+
+func create(t *testing.T, u, token, body string) (int, fillRec, string) {
+ t.Helper()
+ status, _, out := rawReq(t, http.MethodPost, u, token, body)
+ var rec fillRec
+ json.Unmarshal([]byte(out), &rec)
+ return status, rec, out
+}
+
+func mustCreate(t *testing.T, u, token, body string) fillRec {
+ t.Helper()
+ status, rec, out := create(t, u, token, body)
+ if status != http.StatusCreated {
+ t.Fatalf("create %s = %d %s, want 201", body, status, out)
+ }
+ return rec
+}
+
+func TestFillFromTheAppRegion(t *testing.T) {
+ _, token, u := fillFixture(t, "uk")
+ if rec := mustCreate(t, u, token, `{"host":"a.go.tito.io"}`); rec.Region != "uk" || rec.RegionFrom != "app" || rec.RegionName != ukPlace {
+ t.Fatalf("fill = %+v", rec)
+ }
+ if rec := mustCreate(t, u, token, `{"host":"b.go.tito.io","region":"ie"}`); rec.Region != "" || rec.RegionFrom != "request" {
+ t.Fatalf("explicit home = %+v", rec)
+ }
+ for _, body := range []string{
+ `{"host":"c.go.tito.io","kind":"static"}`,
+ `{"host":"d.go.tito.io","kind":"service","addrs":["10.0.0.4:8080"]}`,
+ } {
+ if rec := mustCreate(t, u, token, body); rec.Region != "" {
+ t.Errorf("%s was filled: %+v", body, rec)
+ }
+ }
+ status, _, out := create(t, u, token, `{"host":"e.go.tito.io","role":"replica"}`)
+ if status != http.StatusBadRequest || !strings.Contains(out, "role replica needs a placement") {
+ t.Errorf("replica without a region = %d %s, want the existing refusal", status, out)
+ }
+}
+
+func TestFillWithAHomeAppRegionChangesNothing(t *testing.T) {
+ _, token, u := fillFixture(t, "")
+ if rec := mustCreate(t, u, token, `{"host":"a.go.tito.io"}`); rec.Region != "" || rec.RegionFrom != "" {
+ t.Fatalf("home app = %+v", rec)
+ }
+}
+
+// Precedence with a NON-HOME app default in play: pool and fleet win.
+func TestFillPrecedence(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ m := titoManifest()
+ m.Pool, m.Regions = "tito", nil
+ enableInstances(t, fx, "titogo", m)
+ if rec := mustCreate(t, u, token, `{"host":"p.go.tito.io"}`); rec.Region != "" || rec.RegionFrom != "" {
+ t.Fatalf("pooled = %+v, want no fill", rec)
+ }
+ m.Pool = ""
+ enableInstances(t, fx, "titogo", m)
+ if err := fx.st.SetAppPlacement(OpsAccountID, "titogo", "fleet/acme"); err != nil {
+ t.Fatal(err)
+ }
+ if rec := mustCreate(t, u, token, `{"host":"f.go.tito.io"}`); rec.Region != "fleet/acme" || rec.RegionFrom != "fleet" {
+ t.Fatalf("fleet = %+v", rec)
+ }
+}
+
+func TestFillStoreErrorIsC20(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ fx.srv.appRegionOf = func(int64, string) (string, string, error) { return "", "", errors.New("db gone") }
+ status, _, out := create(t, u, token, `{"host":"a.go.tito.io"}`)
+ if status != http.StatusBadGateway || !strings.Contains(out, msgAppRegionUnreadable) {
+ t.Fatalf("store error = %d %s, want 502 C20", status, out)
+ }
+}
+
+// codex R2-2: dormancy keeps explicit requests, never app-derived ones.
+func TestAppDerivedNeedsPositiveEligibility(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ for _, k := range []string{"control/edges/uk-box.json", "control/edges/ie-box.json"} {
+ if err := fx.rel.Delete(t.Context(), k); err != nil {
+ t.Fatal(err)
+ }
+ }
+ mustCreate(t, u, token, `{"host":"x.go.tito.io","region":"uk"}`)
+ status, _, out := create(t, u, token, `{"host":"y.go.tito.io"}`)
+ if status != http.StatusBadRequest || !strings.Contains(out, reasonText("absent")) {
+ t.Fatalf("app-derived uk under dormancy = %d %s, want C16 absent", status, out)
+ }
+}
+
+func TestAppDerivedEdgesReadFailureIs503(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ fx.srv.cfg.Releases = failingList{fx.rel}
+ status, _, out := create(t, u, token, `{"host":"y.go.tito.io"}`)
+ if status != http.StatusServiceUnavailable || !strings.Contains(out, msgAppRegionUnconfirmed("uk")) {
+ t.Fatalf("edges failure = %d %s, want 503 C28", status, out)
+ }
+}
+
+func TestAppDerivedRefusals(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ m := titoManifest()
+ m.Pool, m.Regions = "", []string{"au"}
+ enableInstances(t, fx, "titogo", m)
+ // au publishes no box, so nothing the allow-list names can pass: C17b.
+ if status, _, out := create(t, u, token, `{"host":"y.go.tito.io"}`); status != http.StatusBadRequest ||
+ !strings.Contains(out, msgAppRegionNotAllowed("uk", nil)) {
+ t.Fatalf("allow-list = %d %s, want C17b", status, out)
+ }
+ m.Regions = nil
+ enableInstances(t, fx, "titogo", m)
+ if status, _, out := create(t, u, token, `{"host":"z.go.tito.io","replicas":["uk"]}`); status != http.StatusBadRequest ||
+ !strings.Contains(out, msgReplicaOverlap("uk")) {
+ t.Fatalf("replica overlap = %d %s, want C26", status, out)
+ }
+ setEdges(t, fx, map[string]string{"uk-box": ukNoKey})
+ if status, _, out := create(t, u, token, `{"host":"k.go.tito.io"}`); status != http.StatusBadRequest ||
+ !strings.Contains(out, reasonText("no-secrets-key")) {
+ t.Fatalf("app-derived keyless uk = %d %s, want C16 no-secrets-key", status, out)
+ }
+}
+
+// R9's explicit half: refused only when a current writer PROVES the
+// region keyless, and only for what needs config on the box.
+func TestExplicitCreateIntoAKeylessRegion(t *testing.T) {
+ fx, token, u := fillFixture(t, "")
+ setEdges(t, fx, map[string]string{"uk-box": ukNoKey})
+ if status, _, out := create(t, u, token, `{"host":"a.go.tito.io","region":"uk"}`); status != http.StatusBadRequest || !strings.Contains(out, msgNoSecretsKey("uk")) {
+ t.Fatalf("keyless instance = %d %s, want C31", status, out)
+ }
+ if status, _, out := create(t, u, token, `{"host":"r.go.tito.io","region":"uk","role":"replica"}`); status != http.StatusBadRequest || !strings.Contains(out, msgNoSecretsKey("uk")) {
+ t.Fatalf("keyless replica = %d %s, want C31", status, out)
+ }
+ mustCreate(t, u, token, `{"host":"s.go.tito.io","region":"uk","kind":"static"}`)
+ // An addr-backed service proxies to a process the platform never starts,
+ // so it needs no config on the box either (codex plan-R2 7).
+ mustCreate(t, u, token, `{"host":"v.go.tito.io","region":"uk","kind":"service","addrs":["10.0.0.4:8080"]}`)
+ setEdges(t, fx, map[string]string{"uk-box": ukOldWriter})
+ mustCreate(t, u, token, `{"host":"o.go.tito.io","region":"uk"}`) // unknown keeps today's behaviour
+ setEdges(t, fx, map[string]string{"uk-box": ukNoKey})
+ fx.srv.cfg.SecretsPub = ""
+ mustCreate(t, u, token, `{"host":"n.go.tito.io","region":"uk"}`) // the console cannot judge
+}
+
+// edgesListFails fails only the listing of control/edges/, so the rest of the
+// create door (records, leftovers) runs as it does in production.
+type edgesListFails struct{ release.Store }
+
+func (e edgesListFails) List(ctx context.Context, prefix string) ([]string, error) {
+ if strings.HasPrefix(prefix, edgesFilePrefix) {
+ return nil, errors.New("bucket unreachable")
+ }
+ return e.Store.List(ctx, prefix)
+}
+
+// PF10: an explicit request keeps today's behaviour when the edges cannot be
+// read. R9 refuses only on proof, so unknown data never refuses it.
+func TestExplicitCreateWithTheEdgesListingDownIsNotRefused(t *testing.T) {
+ fx, token, u := fillFixture(t, "")
+ fx.srv.cfg.Releases = edgesListFails{fx.rel}
+ if rec := mustCreate(t, u, token, `{"host":"a.go.tito.io","region":"uk"}`); rec.Region != "uk" || rec.RegionFrom != "request" {
+ t.Fatalf("explicit uk with the edges down = %+v", rec)
+ }
+ if rec := mustCreate(t, u, token, `{"host":"r.go.tito.io","region":"uk","role":"replica"}`); rec.Role != "replica" || rec.Region != "uk" {
+ t.Fatalf("explicit replica with the edges down = %+v", rec)
+ }
+}
+
+func TestFillRunsWithTheSwitchOff(t *testing.T) {
+ fx, token, u := fillFixture(t, "uk")
+ fx.srv.cfg.AppRegions = false
+ if rec := mustCreate(t, u, token, `{"host":"a.go.tito.io"}`); rec.Region != "uk" {
+ t.Fatalf("switch off = %+v, want the stored uk", rec)
+ }
+}
+
+// codex plan-R3 6: a successful replica create names its place too, so the
+// CLI prints C14 for it as for any other placement.
+func TestReplicaCreateNamesItsPlace(t *testing.T) {
+ _, token, u := fillFixture(t, "")
+ rec := mustCreate(t, u, token, `{"host":"r.go.tito.io","region":"uk","role":"replica"}`)
+ if rec.Role != "replica" || rec.Region != "uk" || rec.RegionName != ukPlace {
+ t.Fatalf("replica = %+v, want role replica in uk named %q", rec, ukPlace)
+ }
+}
+
+// persistedRecord is the record's bytes as the bucket holds them, with the
+// create time blanked (the one field a golden cannot pin).
+func persistedRecord(t *testing.T, fx *consoleFixture, host string) string {
+ t.Helper()
+ raw, _, err := fx.rel.Get(t.Context(), provision.RecordKey("bab", "titogo", host))
+ if err != nil {
+ t.Fatal(err)
+ }
+ return regexp.MustCompile(`"created_at":"[^"]*"`).ReplaceAllString(string(raw), `"created_at":"T"`)
+}
+
+// codex plan-R3 5, spec §16: the persisted record, byte for byte. A legacy
+// home create writes exactly what the unmodified door wrote (the golden was
+// taken from the base tree), and an app-defaulted non-home create differs
+// only by its region: no steering stamp, nothing else (R8).
+func TestPersistedRecordsMatchTheirGoldens(t *testing.T) {
+ const legacy = `{"schema":1,"host":"a.go.tito.io","slug":"a","app":"titogo","account":"bab","channel":"stable","created_at":"T","created_by":"alice@keymail.dev"}`
+ const appUK = `{"schema":1,"host":"a.go.tito.io","slug":"a","app":"titogo","account":"bab","region":"uk","channel":"stable","created_at":"T","created_by":"alice@keymail.dev"}`
+ for _, c := range []struct{ appRegion, want string }{{"", legacy}, {"uk", appUK}} {
+ fx, token, u := fillFixture(t, c.appRegion)
+ rec := mustCreate(t, u, token, `{"host":"a.go.tito.io"}`)
+ if rec.Steering != "" {
+ t.Fatalf("app region %q: the response carries a steering stamp %q", c.appRegion, rec.Steering)
+ }
+ if got := persistedRecord(t, fx, "a.go.tito.io"); got != c.want {
+ t.Fatalf("app region %q: stored\n%s\nwant\n%s", c.appRegion, got, c.want)
+ }
+ }
+}
+
+// codex plan-R4 2: C16's and C17's lists name exactly the regions an
+// explicit create of this same instance would pass: the allow-list, the
+// armed gate and R9 (not automatic eligibility), never the region refused.
+// Each advertised region is then submitted, and must be accepted.
+func TestAppRegionRefusalsAdvertiseOnlyWhatPasses(t *testing.T) {
+ auEligible := edgeJSON("au-box", "9.9.9.9", "ap-southeast-2", "au", eligibleBox)
+ for _, c := range []struct {
+ name string
+ ukBox string
+ regions []string
+ want func(choices []string) string
+ choices []string
+ }{
+ // uk is the app's region, keyless; the home is outside the allow-list.
+ {"C16", ukNoKey, []string{"uk", "au", "nz"}, func(ch []string) string { return msgAppRegionUnavailable("uk", "no-secrets-key", ch) }, []string{"au"}},
+ // uk is eligible but outside the allow-list; "ie" there is the
+ // home's NAME, which the door reads as "" and so refuses.
+ {"C17", ukEligible, []string{"au", "nz", "ie"}, func(ch []string) string { return msgAppRegionNotAllowed("uk", ch) }, []string{"au"}},
+ } {
+ fx, token, u := fillFixture(t, "uk")
+ setEdges(t, fx, map[string]string{"uk-box": c.ukBox, "au-box": auEligible, "nz-box": nzNoHosting})
+ m := titoManifest()
+ m.Pool, m.Regions = "", c.regions
+ enableInstances(t, fx, "titogo", m)
+ status, _, out := create(t, u, token, `{"host":"y.go.tito.io"}`)
+ if want := c.want(c.choices); status != http.StatusBadRequest || !strings.Contains(out, want) {
+ t.Errorf("%s = %d %s, want %q", c.name, status, out, want)
+ }
+ for i, code := range c.choices {
+ mustCreate(t, u, token, fmt.Sprintf(`{"host":"alt%d.go.tito.io","region":%q}`, i, code))
+ }
+ }
+}
+
+// PF8: with an unnamed home the empty code is no choice a caller could pass,
+// so it is never listed. The home joins a list only when CONSOLE_HOME_REGION
+// names it, and then under that name.
+func TestAppRegionRefusalListsSeedTheHomeOnlyWhenNamed(t *testing.T) {
+ auEligible := edgeJSON("au-box", "9.9.9.9", "ap-southeast-2", "au", eligibleBox)
+ for _, home := range []string{"", "ie"} {
+ fx, token, u := fillFixture(t, "uk")
+ fx.srv.cfg.HomeRegion = home
+ setEdges(t, fx, map[string]string{"uk-box": ukNoKey, "au-box": auEligible})
+ want := []string{"au"}
+ if home != "" {
+ want = []string{"au", "ie"}
+ }
+ status, _, out := create(t, u, token, `{"host":"y.go.tito.io"}`)
+ if w := msgAppRegionUnavailable("uk", "no-secrets-key", want); status != http.StatusBadRequest || !strings.Contains(out, w) {
+ t.Fatalf("home %q: = %d %s, want %q", home, status, out, w)
+ }
+ for i, code := range want {
+ mustCreate(t, u, token, fmt.Sprintf(`{"host":"alt%d.go.tito.io","region":%q}`, i, code))
+ }
+ }
+}