Add PersistenceXmlUtility and refactor related code (#357 )

* Refactor GenerateSqlSchemaCommand * Add and throw UncheckedClassNotFoundException
Add by-repo-id method to RegistryLockDao (#344 )
2026-02-02 19:12:27 +00:00 · 2019-11-12 15:08:54 -05:00 · 2019-11-12 11:47:59 -05:00 · 2019-11-12 11:14:51 -05:00 · 2019-11-12 11:06:16 -05:00 · 2019-11-11 18:04:46 -05:00
426 changed files with 21853 additions and 3768 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -98,7 +98,6 @@ nomulus.iws
 .gradle/
 **/build
 node_modules/**
-!node_modules/soyutils_usegoog.js
 /repos/

 # Compiled JS/CSS code
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@

 | Internal Build | FOSS Build | LGTM | License | Code Search |
 |----------------|------------|------|---------|-------------|
-|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://github.com/sourcegraph/sourcegraph/blob/master/ui/assets/img/sourcegraph-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|
+|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://sourcegraph.com/.assets/img/sourcegraph-light-head-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|

 ![Nomulus logo](./nomulus-logo.png)

--- a/appengine_war.gradle
+++ b/appengine_war.gradle
@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-apply from: "${rootDir.path}/projects.gradle"
 apply plugin: 'war'

 def environment = rootProject.environment
@@ -26,14 +25,19 @@ project.convention.plugins['war'].webAppDirName =

 apply plugin: 'com.google.cloud.tools.appengine'

+def coreResourcesDir = "${rootDir}/core/build/resources/main"
+
 // Get the web.xml file for the service.
 war {
    webInf {
        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
+
+        from("${coreResourcesDir}/META-INF/persistence.xml") {
+            into "classes/META-INF"
+        }
    }
 }

-def coreResourcesDir = "${rootDir}/core/build/resources/main"
 war {
    from("${coreResourcesDir}/google/registry/ui/html") {
        include "*.html"
@@ -68,6 +72,10 @@ appengine {
        if (!rootProject.prodOrSandboxEnv) {
            version = 'GCLOUD_CONFIG'
        }
+
+        // Don't set gcpProject directly, it gets overriden in ./build.gradle.
+        // Do -P environment={crash,alpha} instead.  For sandbox/production,
+        // use Spinnaker.
        projectId = gcpProject
    }
 }
@@ -76,6 +84,31 @@ dependencies {
    compile project(':core')
 }

+// The tools.jar file gets pulled in from the java environment and for some
+// reason gets exploded "readonly", causing subsequent builds to fail when
+// they can't overwrite it.  The hack below makes the file writable after
+// we're done exploding it.
+//
+// Fun fact: We only use this jar for documentation generation and as such we
+// don't need it in our warfile, as it is not used by the application at
+// runtime.  But it's not clear how to exclude it, as we seem to be
+// constructing the jar from the entire WEB-INF directory and per-file
+// exclude rules don't seem to work on it.  Better solutions are welcome :-)
+explodeWar.doLast {
+    file("${it.explodedAppDirectory}/WEB-INF/lib/tools.jar").setWritable(true)
+}
+
 rootProject.deploy.dependsOn appengineDeployAll
 rootProject.stage.dependsOn appengineStage
-appengineDeployAll.dependsOn rootProject.verifyDeployment
+
+// Impose verification for all of the deployment tasks.  We haven't found a
+// better way to do this other than to apply to each of them independently.
+// If a new task gets added, it will still fail if "environment"  is not defined
+// because gcpProject is null.  We just won't get as friendly an error message.
+appengineDeployAll.configure rootProject.verifyDeploymentConfig
+appengineDeploy.configure rootProject.verifyDeploymentConfig
+appengineDeployCron.configure rootProject.verifyDeploymentConfig
+appengineDeployDispatch.configure rootProject.verifyDeploymentConfig
+appengineDeployDos.configure rootProject.verifyDeploymentConfig
+appengineDeployIndex.configure rootProject.verifyDeploymentConfig
+appengineDeployQueue.configure rootProject.verifyDeploymentConfig
--- a/build.gradle
+++ b/build.gradle
@@ -82,6 +82,8 @@ apply from: 'dependencies.gradle'

 apply from: 'dependency_lic.gradle'

+apply from: 'utils.gradle'
+
 // Custom task to run checkLicense in buildSrc, which is not triggered
 // by root project tasks. A shell task is used because buildSrc tasks
 // cannot be referenced in the same way as tasks from a regular included
@@ -107,21 +109,61 @@ task deploy {
  description = 'Deploys all services to App Engine.'
 }

-task verifyDeployment {
-  group = 'deployment'
-  description = 'Ensure that one cannot deploy to production or sandbox.'
-  doFirst {
-    if (rootProject.prodOrSandboxEnv) {
-      throw new GradleException("Cannot deploy to production or sandbox.");
-    }
-  }
-}
-
 task stage {
  group = 'deployment'
  description = 'Generates application directories for all services.'
 }

+// App-engine environment configuration.  We set up all of the variables in
+// the root project.
+
+def environments = ['production', 'sandbox', 'alpha', 'crash']
+
+def gcpProject = null
+
+apply from: "${rootDir.path}/projects.gradle"
+
+if (environment == '') {
+    // Keep the project null, this will prevent deployment.  Set the
+    // environment to "alpha" because other code needs this property to
+    // explode the war file.
+    environment = 'alpha'
+} else if (environment != 'production' && environment != 'sandbox') {
+    gcpProject = projects[environment]
+    if (gcpProject == null) {
+        throw new GradleException("-Penvironment must be one of " +
+                                  "${projects.keySet()}.")
+    }
+}
+
+rootProject.ext.environment = environment
+rootProject.ext.gcpProject = gcpProject
+rootProject.ext.prodOrSandboxEnv = environment in ['production', 'sandbox']
+
+// Function to verify that the deployment parameters have been set.
+def verifyDeploymentParams() {
+    if (prodOrSandboxEnv) {
+        // Do not deploy to prod or sandbox. Print a prominent error in bright red.
+        System.err.println('\033[31;1m-----------------------------------------------------------------')
+        System.err.println('*** DANGER WILL ROBINSON!')
+        System.err.println('*** You may not deploy to production or sandbox from gradle.  Do a')
+        System.err.println('*** release from Spinnaker, see deployment playbook.')
+        System.err.println('-----------------------------------------------------------------')
+        throw new GradleException('Aborting. See prominent error above.')
+    } else if (gcpProject == null) {
+        def error = 'You must specify -P environment={alpha,crash}'
+        System.err.println("\033[33;1m${error}\033[0m")
+        throw GradleException("Aborting:  ${error}")
+    }
+}
+
+// Closure that we can just drop into all of our deployment tasks.
+rootProject.ext.verifyDeploymentConfig = {
+    doFirst { verifyDeploymentParams() }
+}
+
+// Subproject configuration.
+
 allprojects {
  // Skip no-op project
  if (project.name == 'services') return
@@ -176,10 +218,21 @@ subprojects {
        resolutionStrategy.activateDependencyLocking()
      }
    }
-    // Lock application dependencies except for the gradle-license-report
-    // plugin. See dependency_lic.gradle for more information.
-    configurations.findAll { it.name != 'dependencyLicenseReport' }.each {
-      it.resolutionStrategy.activateDependencyLocking()
+  }
+
+  afterEvaluate {
+    if (rootProject.enableDependencyLocking.toBoolean()) {
+      // Lock application dependencies except for the gradle-license-report
+      // plugin. See dependency_lic.gradle for the reason why.
+      //
+      // To selectively activate dependency locking without hardcoding them
+      // in the 'configurations' block, the following code must run after
+      // project evaluation, when all configurations have been created.
+      configurations.each {
+        if (it.name != 'dependencyLicenseReport') {
+          it.resolutionStrategy.activateDependencyLocking()
+        }
+      }
    }
  }

@@ -235,19 +288,6 @@ subprojects {
      }
    }
  }
-
-  if (['util', 'proxy', 'core', 'prober'].contains(project.name)) return
-
-  ext.relativePath = "google/registry/${project.name}"
-
-  sourceSets.each {
-    it.java {
-      include "${project.relativePath}/"
-    }
-    it.resources {
-      include "${project.relativePath}/"
-    }
-  }
 }

 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
@@ -320,26 +360,12 @@ def createGetBuildSrcDirectDepsTask(outputFileName) {
          "getBuildSrcDeps_${java.util.UUID.randomUUID()}".toString(),
          Exec) {
    workingDir "${rootDir}/buildSrc"
-    commandLine '../gradlew', 'exportDenpendencies',
+    commandLine '../gradlew', 'exportDependencies',
                "-PdependencyExportFile=${outputFileName}"
  }
 }

 rootProject.ext {
-
-  // Executes an arbitrary shell command in bash and returns all output
-  // to stdout as a string. This method allows pipes in shell command.
-  execInBash = { shellCommand, bashWorkingDir ->
-    return new ByteArrayOutputStream().withStream { os ->
-      exec {
-        workingDir bashWorkingDir
-        commandLine 'bash', '-c', "${shellCommand}"
-        standardOutput os
-      }
-      return os
-    }.toString().trim()
-  }
-
  invokeJavaDiffFormatScript = { action ->
    def scriptDir = rootDir.path.endsWith('buildSrc')
            ? "${rootDir}/../java-format"
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -90,7 +90,7 @@ gradle.projectsEvaluated {
  }
 }

-task exportDenpendencies {
+task exportDependencies {
  def outputFileProperty = 'dependencyExportFile'
  def output = project.hasProperty(outputFileProperty)
      ? new PrintStream(
--- a/buildSrc/gradle.properties
+++ b/buildSrc/gradle.properties
@@ -1 +1 @@
-enableDependencyLocking=false
+enableDependencyLocking=true
--- a/buildSrc/gradle/dependency-locks/buildscript-classpath.lockfile
+++ b/buildSrc/gradle/dependency-locks/buildscript-classpath.lockfile
@@ -15,12 +15,13 @@ com.googlecode.javaewah:JavaEWAH:1.1.6
 com.jcraft:jsch:0.1.54
 com.jcraft:jzlib:1.1.1
 com.netflix.nebula:gradle-lint-plugin:10.4.2
-com.netflix.nebula:nebula-gradle-interop:1.0.7
-com.netflix.nebula:nebula-test:7.2.5
+com.netflix.nebula:nebula-gradle-interop:1.0.11
+com.netflix.nebula:nebula-test:7.4.0
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
 commons-lang:commons-lang:2.6
 commons-logging:commons-logging:1.2
+javax.inject:javax.inject:1
 junit:junit:4.12
 log4j:log4j:1.2.14
 nebula.lint:nebula.lint.gradle.plugin:10.4.2
@@ -35,32 +36,33 @@ org.apache.ant:ant:1.8.4
 org.apache.commons:commons-lang3:3.8.1
 org.apache.httpcomponents:httpclient:4.5.2
 org.apache.httpcomponents:httpcore:4.4.4
-org.apache.maven:maven-artifact:3.6.1
-org.apache.maven:maven-builder-support:3.6.1
-org.apache.maven:maven-model-builder:3.6.1
-org.apache.maven:maven-model:3.6.1
+org.apache.maven:maven-artifact:3.6.2
+org.apache.maven:maven-builder-support:3.6.2
+org.apache.maven:maven-model-builder:3.6.2
+org.apache.maven:maven-model:3.6.2
 org.codehaus.gpars:gpars:1.2.1
-org.codehaus.groovy:groovy-all:2.4.9
+org.codehaus.groovy:groovy-all:2.4.15
 org.codehaus.groovy:groovy-ant:2.1.8
 org.codehaus.groovy:groovy-groovydoc:2.1.8
 org.codehaus.groovy:groovy-templates:2.1.8
 org.codehaus.groovy:groovy-xml:2.4.7
 org.codehaus.groovy:groovy:2.4.7
 org.codehaus.jsr166-mirror:jsr166y:1.7.0
-org.codehaus.plexus:plexus-component-annotations:1.7.1
 org.codehaus.plexus:plexus-interpolation:1.25
-org.codehaus.plexus:plexus-utils:3.2.0
+org.codehaus.plexus:plexus-utils:3.2.1
 org.codenarc:CodeNarc:0.25.2
 org.eclipse.jdt:core:3.1.1
 org.eclipse.jgit:org.eclipse.jgit:5.0.1.201806211838-r
+org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3
 org.gmetrics:GMetrics:0.7
 org.hamcrest:hamcrest-core:1.3
-org.jetbrains.kotlin:kotlin-stdlib-common:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib:1.3.11
+org.jetbrains.kotlin:kotlin-stdlib-common:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib:1.3.50
 org.jetbrains:annotations:13.0
 org.multiverse:multiverse-core:0.7.0
 org.objenesis:objenesis:2.4
 org.ow2.asm:asm:7.0
 org.slf4j:slf4j-api:1.7.2
-org.spockframework:spock-core:1.1-groovy-2.4-rc-4
+org.spockframework:spock-core:1.3-groovy-2.4
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAgent.lockfile
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
--- a/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/buildSrc/gradle/dependency-locks/jacocoAnt.lockfile
@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
+org.jacoco:org.jacoco.ant:0.8.4
+org.jacoco:org.jacoco.core:0.8.4
+org.jacoco:org.jacoco.report:0.8.4
+org.ow2.asm:asm-analysis:7.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:7.1
+org.ow2.asm:asm:7.1
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
--- a/buildSrc/src/main/java/google/registry/gradle/plugin/CoverPageGenerator.java
+++ b/buildSrc/src/main/java/google/registry/gradle/plugin/CoverPageGenerator.java
@@ -26,6 +26,7 @@ import com.google.common.collect.ImmutableSetMultimap;
 import com.google.template.soy.SoyFileSet;
 import com.google.template.soy.tofu.SoyTofu;
 import google.registry.gradle.plugin.ProjectData.TaskData;
+import java.io.File;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.function.Supplier;
@@ -148,10 +149,14 @@ final class CoverPageGenerator {

  /** returns a soy-friendly version of the given task data. */
  static ImmutableMap<String, Object> taskDataToSoy(TaskData task) {
+    // Note that all instances of File.separator are replaced with forward slashes so that we can
+    // generate a valid href on Windows.
    return new ImmutableMap.Builder<String, Object>()
        .put("uniqueName", task.uniqueName())
        .put("description", task.description())
-        .put("log", task.log().isPresent() ? getLogPath(task).toString() : "")
+        .put(
+            "log",
+            task.log().isPresent() ? getLogPath(task).toString().replace(File.separator, "/") : "")
        .put(
            "reports",
            task.reports().entrySet().stream()
@@ -161,7 +166,11 @@ final class CoverPageGenerator {
                        entry ->
                            entry.getValue().files().isEmpty()
                                ? ""
-                                : entry.getValue().entryPoint().toString())))
+                                : entry
+                                    .getValue()
+                                    .entryPoint()
+                                    .toString()
+                                    .replace(File.separator, "/"))))
        .build();
  }

@@ -188,8 +197,10 @@ final class CoverPageGenerator {
  }

  private static Path getLogPath(TaskData task) {
-    // TODO(guyben):escape uniqueName to guarantee legal file name.
-    return Paths.get("logs", task.uniqueName() + ".log");
+    // We replace colons with dashes so that the resulting filename is always valid, even in
+    // Windows. As a dash is not a valid character in Java identifies, a task name cannot include
+    // it, so the uniqueness of the name is perserved.
+    return Paths.get("logs", task.uniqueName().replace(":", "-") + ".log");
  }

  private static Supplier<byte[]> resourceLoader(Path path) {
--- a/buildSrc/src/main/java/google/registry/gradle/plugin/GcsPluginUtils.java
+++ b/buildSrc/src/main/java/google/registry/gradle/plugin/GcsPluginUtils.java
@@ -64,7 +64,8 @@ final class GcsPluginUtils {

  static void uploadFileToGcs(
      Storage storage, String bucket, Path path, Supplier<byte[]> dataSupplier) {
-    String filename = path.toString();
+    // Replace Windows file separators with forward slashes.
+    String filename = path.toString().replace(File.separator, "/");
    storage.create(
        BlobInfo.newBuilder(bucket, filename).setContentType(getContentType(filename)).build(),
        dataSupplier.get());
--- a/buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java
+++ b/buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java
@@ -20,9 +20,11 @@ import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.gradle.plugin.GcsPluginUtils.toByteArraySupplier;
 import static java.nio.charset.StandardCharsets.UTF_8;

+import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import google.registry.gradle.plugin.ProjectData.TaskData;
+import java.io.File;
 import java.nio.file.Paths;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -63,6 +65,8 @@ public final class CoverPageGeneratorTest {
          .setState(TaskData.State.UP_TO_DATE)
          .build();

+  private static final Joiner filenameJoiner = Joiner.on(File.separator);
+
  private ImmutableMap<String, String> getGeneratedFiles(ProjectData project) {
    CoverPageGenerator coverPageGenerator = new CoverPageGenerator(project);
    FilesWithEntryPoint files = coverPageGenerator.getFilesToUpload();
@@ -172,8 +176,8 @@ public final class CoverPageGeneratorTest {
  @Test
  public void testGetFilesToUpload_containsCssFile() {
    ImmutableMap<String, String> files = getGeneratedFiles(EMPTY_PROJECT);
-    assertThat(files).containsKey("css/style.css");
-    assertThat(files.get("css/style.css")).contains("body {");
+    assertThat(files).containsKey(filenameJoiner.join("css", "style.css"));
+    assertThat(files.get(filenameJoiner.join("css", "style.css"))).contains("body {");
    assertThat(files.get("index.html"))
        .contains("<link rel=\"stylesheet\" type=\"text/css\" href=\"css/style.css\">");
  }
@@ -191,8 +195,8 @@ public final class CoverPageGeneratorTest {
                        .setLog(toByteArraySupplier("my log data"))
                        .build())
                .build());
-    assertThat(files).containsEntry("logs/my:name.log", "my log data");
-    assertThat(files.get("index.html")).contains("<a href=\"logs/my:name.log\">[log]</a>");
+    assertThat(files).containsEntry(filenameJoiner.join("logs", "my-name.log"), "my log data");
+    assertThat(files.get("index.html")).contains("<a href=\"logs/my-name.log\">[log]</a>");
  }

  @Test
@@ -203,7 +207,7 @@ public final class CoverPageGeneratorTest {
                .toBuilder()
                .addTask(EMPTY_TASK_SUCCESS.toBuilder().setUniqueName("my:name").build())
                .build());
-    assertThat(files).doesNotContainKey("logs/my:name.log");
+    assertThat(files).doesNotContainKey("logs/my-name.log");
    assertThat(files.get("index.html")).contains("<span class=\"report_link_broken\">[log]</span>");
  }

@@ -225,7 +229,7 @@ public final class CoverPageGeneratorTest {
                                Paths.get("path", "report.txt")))
                        .build())
                .build());
-    assertThat(files).containsEntry("path/report.txt", "report content");
+    assertThat(files).containsEntry(filenameJoiner.join("path", "report.txt"), "report content");
    assertThat(files.get("index.html")).contains("<a href=\"path/report.txt\">[someReport]</a>");
  }

@@ -244,7 +248,7 @@ public final class CoverPageGeneratorTest {
                                ImmutableMap.of(), Paths.get("path", "report.txt")))
                        .build())
                .build());
-    assertThat(files).doesNotContainKey("path/report.txt");
+    assertThat(files).doesNotContainKey(filenameJoiner.join("path", "report.txt"));
    assertThat(files.get("index.html"))
        .contains("<span class=\"report_link_broken\">[someReport]</span>");
  }
@@ -275,12 +279,15 @@ public final class CoverPageGeneratorTest {
                                ImmutableMap.of(), Paths.get("path-empty", "report.txt")))
                        .build())
                .build());
-    assertThat(files).containsEntry("path-filled/report.txt", "report content");
-    assertThat(files).containsEntry("path-filled/other/file.txt", "some other content");
-    assertThat(files).containsEntry("logs/my:name.log", "log data");
+    assertThat(files)
+        .containsEntry(filenameJoiner.join("path-filled", "report.txt"), "report content");
+    assertThat(files)
+        .containsEntry(
+            filenameJoiner.join("path-filled", "other", "file.txt"), "some other content");
+    assertThat(files).containsEntry(filenameJoiner.join("logs", "my-name.log"), "log data");
    assertThat(files.get("index.html"))
        .contains("<a href=\"path-filled/report.txt\">[filledReport]</a>");
-    assertThat(files.get("index.html")).contains("<a href=\"logs/my:name.log\">[log]</a>");
+    assertThat(files.get("index.html")).contains("<a href=\"logs/my-name.log\">[log]</a>");
    assertThat(files.get("index.html"))
        .contains("<span class=\"report_link_broken\">[emptyReport]</span>");
  }
--- a/buildSrc/src/test/java/google/registry/gradle/plugin/GcsPluginUtilsTest.java
+++ b/buildSrc/src/test/java/google/registry/gradle/plugin/GcsPluginUtilsTest.java
@@ -29,6 +29,7 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;

 import com.google.cloud.storage.BlobInfo;
 import com.google.cloud.storage.Storage;
+import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableMap;
 import java.io.File;
 import java.nio.file.Files;
@@ -45,6 +46,8 @@ import org.junit.runners.JUnit4;
@RunWith(JUnit4.class)
 public final class GcsPluginUtilsTest {

+  private static final Joiner filenameJoiner = Joiner.on(File.separator);
+
  @Rule public final TemporaryFolder folder = new TemporaryFolder();

  @Test
@@ -155,8 +158,10 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/file.txt");
-    assertThat(readAllFiles(files)).containsExactly("some/path/file.txt", "some data");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "file.txt"));
+    assertThat(readAllFiles(files))
+        .containsExactly(filenameJoiner.join("some", "path", "file.txt"), "some data");
  }

  @Test
@@ -171,7 +176,7 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("non/existing.txt");
+    assertThat(files.entryPoint().toString()).isEqualTo(filenameJoiner.join("non", "existing.txt"));
    assertThat(files.files()).isEmpty();
  }

@@ -187,7 +192,7 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path");
+    assertThat(files.entryPoint().toString()).isEqualTo(filenameJoiner.join("some", "path"));
    assertThat(files.files()).isEmpty();
  }

@@ -205,8 +210,10 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/a/file.txt");
-    assertThat(readAllFiles(files)).containsExactly("some/path/a/file.txt", "some data");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "a", "file.txt"));
+    assertThat(readAllFiles(files))
+        .containsExactly(filenameJoiner.join("some", "path", "a", "file.txt"), "some data");
  }

  /**
@@ -232,8 +239,10 @@ public final class GcsPluginUtilsTest {

    FilesWithEntryPoint files = readFilesWithEntryPoint(destination, Optional.empty(), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/path.zip");
-    assertThat(readAllFiles(files).keySet()).containsExactly("some/path/path.zip");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "path.zip"));
+    assertThat(readAllFiles(files).keySet())
+        .containsExactly(filenameJoiner.join("some", "path", "path.zip"));
  }

  /**
@@ -261,8 +270,10 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(badEntryPoint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/path.zip");
-    assertThat(readAllFiles(files).keySet()).containsExactly("some/path/path.zip");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "path.zip"));
+    assertThat(readAllFiles(files).keySet())
+        .containsExactly(filenameJoiner.join("some", "path", "path.zip"));
  }

  @Test
@@ -285,12 +296,13 @@ public final class GcsPluginUtilsTest {
    FilesWithEntryPoint files =
        readFilesWithEntryPoint(destination, Optional.of(goodEntryPoint), root);

-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/index.html");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "index.html"));
    assertThat(readAllFiles(files))
        .containsExactly(
-            "some/path/index.html", "some data",
-            "some/path/a/index.html", "wrong index",
-            "some/path/c/style.css", "css file",
-            "some/path/my_image.png", "images");
+            filenameJoiner.join("some", "path", "index.html"), "some data",
+            filenameJoiner.join("some", "path", "a", "index.html"), "wrong index",
+            filenameJoiner.join("some", "path", "c", "style.css"), "css file",
+            filenameJoiner.join("some", "path", "my_image.png"), "images");
  }
 }
--- a/config/dependency-license/README.md
+++ b/config/dependency-license/README.md
@@ -0,0 +1,16 @@
+## Summary
+
+This folder contains configuration files for the gradle-license-report plugin:
+
+*   allowed_licenses.json declares the acceptable licenses. A license may have
+    multiple entries in this file, since the 'moduleLicense' property value must
+    match exactly the phrases found in pom or manifest files.
+*   license_normalizer_bundle.json configures normalization rules for license
+    reporting.
+
+## Notes About Adding New Licenses
+
+*   The WTFPL license is not allowed.
+
+*   Each 'Public Domain' license entry must include a specific 'moduleName'. Do
+    not omit moduleName or use wildcards.
--- a/config/dependency-license/allowed_licenses.json
+++ b/config/dependency-license/allowed_licenses.json
@@ -3,6 +3,9 @@
    {
      "moduleLicense": "Apache Software License, Version 1.1"
    },
+    {
+      "moduleLicense": "Apache Software License, version 1.1"
+    },
    {
      "moduleLicense": "Apache 2"
    },
@@ -12,6 +15,9 @@
    {
      "moduleLicense": "Apache-2.0"
    },
+    {
+      "moduleLicense": "Apache License"
+    },
    {
      "moduleLicense": "Apache License 2.0"
    },
@@ -87,6 +93,9 @@
    {
      "moduleLicense": "The BSD License"
    },
+    {
+      "moduleLicense": "The New BSD License"
+    },
    {
      "moduleLicense": "The PostgreSQL License"
    },
@@ -111,6 +120,9 @@
    {
      "moduleLicense": "\\n                Dual license consisting of the CDDL v1.1 and GPL v2\\n            "
    },
+    {
+      "moduleLicense": "Eclipse Distribution License (New BSD License)"
+    },
    {
      "moduleLicense": "Eclipse Distribution License v. 1.0"
    },
@@ -126,9 +138,18 @@
    {
      "moduleLicense": "Eclipse Public License v1.0"
    },
+    {
+      "moduleLicense": "Eclipse Public License - v 2.0"
+    },
+    {
+      "moduleLicense": "https://www.eclipse.org/legal/epl-2.0/, http://www.gnu.org/copyleft/gpl.html, http://www.gnu.org/licenses/lgpl.html"
+    },
    {
      "moduleLicense": "Google App Engine Terms of Service"
    },
+    {
+      "moduleLicense": "GNU General Public License Version 2"
+    },
    {
      "moduleLicense": "GNU General Public License, version 2, with the Classpath Exception"
    },
@@ -144,6 +165,9 @@
    {
      "moduleLicense": "GNU Lesser Public License"
    },
+    {
+      "moduleLicense": "GNU Lesser General Public License Version 2.1"
+    },
    {
      "moduleLicense": "GNU Library General Public License v2.1 or later"
    },
@@ -180,6 +204,9 @@
    {
      "moduleLicense": "The MIT license"
    },
+    {
+      "moduleLicense": "The MIT License (MIT)"
+    },
    {
      "moduleLicense": "The PostgreSQL License"
    },
@@ -187,10 +214,12 @@
      "moduleLicense": "Mozilla Public License Version 2.0"
    },
    {
-      "moduleLicense": "Public Domain"
+      "moduleLicense": "Public Domain",
+      "moduleName": "aopalliance:aopalliance"
    },
    {
-      "moduleLicense": "PUBLIC DOMAIN"
+      "moduleLicense": "Public Domain",
+      "moduleName": "org.tukaani:xz"
    },
    {
      "moduleLicense": "The W3C Software License"
--- a/config/presubmits.py
+++ b/config/presubmits.py
@@ -79,7 +79,8 @@ PRESUBMITS = {
        ("java", "js", "soy", "sql", "py", "sh", "gradle"), {
            ".git", "/build/", "/generated/", "node_modules/",
            "JUnitBackports.java", "registrar_bin.", "registrar_dbg.",
-            "google-java-format-diff.py"
+            "google-java-format-diff.py",
+            "nomulus.golden.sql", "soyutils_usegoog.js"
        }, REQUIRED):
        "File did not include the license header.",

--- a/core/build.gradle
+++ b/core/build.gradle
@@ -43,21 +43,6 @@ def outcastTestPatterns = [
    "google/registry/tools/server/CreatePremiumListActionTest.*",
 ]

-// Tests that conflict with members of both the main test suite and the
-// outcast suite. They seem to be affected by global states outside of
-// Nomulus classes, e.g., threads and objects retained by frameworks.
-// TODO(weiminyu): identify cause and fix offending tests.
-def fragileTestPatterns = [
-    // Problem seems to lie with AppEngine TaskQueue for test.
-    "google/registry/cron/TldFanoutActionTest.*",
-    // Test Datastore inexplicably aborts transaction.
-    "google/registry/model/tmch/ClaimsListShardTest.*",
-    // Creates large object (64MBytes), occasionally throws OOM error.
-    "google/registry/model/server/KmsSecretRevisionTest.*",
-    "google/registry/tools/GenerateSqlSchemaCommandTest.*",
-    "google/registry/webdriver/*",
-]
-
 // Tests that fail when running Gradle in a docker container, e. g. when
 // building the release artifacts in Google Cloud Build.
 def dockerIncompatibleTestPatterns = [
@@ -70,16 +55,30 @@ def dockerIncompatibleTestPatterns = [
    // respected. However when running in Docker the user is root by default, so
    // every file is read/write-able. There is no way to exclude specific test
    // methods, so we exclude the whole test class.
-    "google/registry/tools/params/PathParameterTest.*"
+    "google/registry/tools/params/PathParameterTest.*",
+    "google/registry/persistence/PersistenceModuleTest.*",
 ]

+// Tests that conflict with members of both the main test suite and the
+// outcast suite. They seem to be affected by global states outside of
+// Nomulus classes, e.g., threads and objects retained by frameworks.
+// TODO(weiminyu): identify cause and fix offending tests.
+def fragileTestPatterns = [
+    // Problem seems to lie with AppEngine TaskQueue for test.
+    "google/registry/cron/TldFanoutActionTest.*",
+    // Test Datastore inexplicably aborts transaction.
+    "google/registry/model/tmch/ClaimsListShardTest.*",
+    // Creates large object (64MBytes), occasionally throws OOM error.
+    "google/registry/model/server/KmsSecretRevisionTest.*",
+] + dockerIncompatibleTestPatterns
+
 sourceSets {
  main {
    java {
      srcDirs += generatedDir
-      // Javadoc API is deprecated and removed in Java 12.
+      // Javadoc API is deprecated in Java 11 and removed in Java 12.
      // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
        exclude 'google/registry/documentation/**'
      }
    }
@@ -89,9 +88,9 @@ sourceSets {
  }
  test {
    java {
-      // Javadoc API is deprecated and removed in Java 12.
+      // Javadoc API is deprecated in Java 11 and removed in Java 12.
      // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
        exclude 'google/registry/documentation/**'
      }
    }
@@ -169,6 +168,7 @@ dependencies {
  compile deps['com.google.appengine:appengine-remote-api']
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
+  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -192,7 +192,7 @@ dependencies {
  compile deps['com.jcraft:jsch']
  testCompile deps['com.thoughtworks.qdox:qdox']
  compile deps['dnsjava:dnsjava']
-  runtime deps['org.glassfish.jaxb:jaxb-runtime']
+  testCompile deps['io.github.classgraph:classgraph']
  testCompile deps['javax.annotation:jsr250-api']
  compile deps['javax.inject:javax.inject']
  compile deps['javax.mail:mail']
@@ -218,6 +218,7 @@ dependencies {
  compile deps['org.bouncycastle:bcpg-jdk15on']
  testCompile deps['org.bouncycastle:bcpkix-jdk15on']
  compile deps['org.bouncycastle:bcprov-jdk15on']
+  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  compile deps['org.joda:joda-money']
  compile deps['org.json:json']
  testCompile deps['org.mortbay.jetty:jetty']
@@ -234,6 +235,7 @@ dependencies {
  // Known issue: nebula-lint misses inherited dependency.
  compile project(':third_party')
  compile project(':util')
+  testRuntime project(':db')

  // Include auto-value in compile until nebula-lint understands
  // annotationProcessor
@@ -288,12 +290,12 @@ dependencies {
 task jaxbToJava {
  def xsdFilesDir = "${javaDir}/google/registry/xml/xsd"
  def bindingsFile = "${javaDir}/google/registry/xjc/bindings.xjb"
-  def pkgInfoGenerator = "${javaDir}/google/registry/xjc/make_pkginfo.sh"
  def pkgInfoTemplate = "${javaDir}/google/registry/xjc/package-info.java.in"
+  def pkgInfoMap = "${javaDir}/google/registry/xjc/package-info.map"
  def outputDir = "${generatedDir}/google/registry/xjc"

  inputs.dir xsdFilesDir
-  inputs.files bindingsFile, pkgInfoTemplate, pkgInfoGenerator
+  inputs.files bindingsFile, pkgInfoTemplate, pkgInfoMap
  outputs.dir outputDir

  doLast {
@@ -331,11 +333,17 @@ task jaxbToJava {
      // below.
      arg(line: '-npa -quiet -extension')
    }
-    exec {
-      workingDir "${generatedDir}"
-
-      executable pkgInfoGenerator
-      args pkgInfoTemplate, outputDir
+    new File(pkgInfoMap).eachLine { line ->
+      def (packageName, namespace) = line.split()
+      ant.copy(
+          tofile: "${outputDir}/${packageName}/package-info.java",
+          overwrite: true,
+          file: "${pkgInfoTemplate}") {
+        filterSet() {
+          filter(token: 'PACKAGE', value: packageName)
+          filter(token: 'NAMESPACE', value: namespace)
+        }
+      }
    }
  }
 }
@@ -411,8 +419,10 @@ task soyToJS {
          "--allowExternalCalls", "false",
          "--srcs", "${soyFiles.join(',')}",
          "--shouldProvideRequireSoyNamespaces", "true",
-          "--compileTimeGlobalsFile", "${resourcesSourceDir}/google/registry/ui/globals.txt",
-          "--deps", "${deps.join(',')}"
+          "--compileTimeGlobalsFile", "${resourcesSourceDir}/google/registry/ui/globals.txt"
+      if (deps != "") {
+        args "--deps", "${deps.join(',')}"
+      }
    }
  }

@@ -513,7 +523,7 @@ task compileProdJS(type: JavaExec) {

  // manually include all the required js files
  closureArgs << "--js=${nodeModulesDir}/google-closure-library/**.js"
-  closureArgs << "--js=${nodeModulesDir}/soyutils_usegoog.js"
+  closureArgs << "--js=${jsDir}/soyutils_usegoog.js"
  closureArgs << "--js=${cssSourceDir}/registrar_bin.css.js"
  closureArgs << "--js=${jsSourceDir}/**.js"
  // TODO(shicong) Verify the compiled JS file works in Alpha
@@ -524,7 +534,12 @@ task compileProdJS(type: JavaExec) {

 compileJava.dependsOn jaxbToJava
 compileJava.dependsOn soyToJava
-compileJava.dependsOn compileProdJS
+// The Closure JS compiler does not support Windows. It is fine to disable it if
+// all we want to do is to complile the Java code on Windows.
+if (!System.properties['os.name'].toLowerCase().contains('windows')) {
+  compileJava.dependsOn compileProdJS
+  assemble.dependsOn compileProdJS
+}

 // stylesheetsToJavascript must happen after processResources, which wipes the
 // resources folder before copying data into it.
@@ -535,13 +550,12 @@ compileProdJS.dependsOn rootProject.npmInstall
 compileProdJS.dependsOn processResources
 compileProdJS.dependsOn processTestResources
 compileProdJS.dependsOn soyToJS
-assemble.dependsOn compileProdJS

 task karmaTest(type: Exec) {
  dependsOn ':npmInstall'
  workingDir rootProject.projectDir
  executable 'node_modules/karma/bin/karma'
-  args('start')
+  args('start', "${project.projectDir}/karma.conf.js")
 }

 test.dependsOn karmaTest
@@ -557,10 +571,67 @@ artifacts {
  testRuntime testJar
 }

-task fragileTest(type: Test) {
+/**
+ * We have to break out the test suites because some of the tests conflict
+ * with one another, but unfortunately this breaks the "--tests" flag.  The
+ * --tests flag only applies to the task named on the command line (usually
+ * just "test"), not for all tasks of type "Test".
+ *
+ * As a better solution, FilteringTest sets testNameIncludePatterns (the
+ * internal property that --tests sets) from the value of the "testFilter"
+ * property, allowing us to filter across all the tests in core without
+ * explicitly specifying a test task or causing errors because there are no
+ * matching tests in the main task.
+ *
+ * To use it, define "testFilter" to be a comma-separated collection of class
+ * names (wildcards are allowed):
+ *
+ *   ./gradlew test -P testFilter=*.FooBar,google.registry.tools.ShellCommandTest
+ */
+class FilteringTest extends Test {
+
+  private void applyTestFilter() {
+    if (project.testFilter) {
+      testNameIncludePatterns = project.testFilter.split(',')
+
+      // By default, gradle test tasks will produce a failure if no tests
+      // match the include/exclude/filter rules.  Since test filtering allows us
+      // to select a set of tests from a particular task, we don't want this
+      // behavior.
+      filter.failOnNoMatchingTests = false
+    }
+  }
+
+  /**
+   * Set to false if you also want to include TestCase and TestSuite classes.
+   *
+   * <p>Must be defined before "test", if at all.
+   */
+  boolean excludeTestCases = true
+
+  void setTests(List<String> tests) {
+    // Common exclude pattern. See README in parent directory for explanation.
+    if (excludeTestCases) {
+      exclude "**/*TestCase.*", "**/*TestSuite.*"
+    }
+    include tests
+    applyTestFilter()
+  }
+
+  /**
+   * Include all of the tests (except Test{Case,TestSuite}).  This actually
+   * doesn't explicitly "include" anything, in which cast the Test class tries
+   * to include everything that is not explicitly excluded.
+   */
+  void includeAllTests() {
+    exclude "**/*TestCase.*", "**/*TestSuite.*"
+    applyTestFilter()
+  }
+}
+
+task fragileTest(type: FilteringTest) {
  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include fragileTestPatterns
+  tests = fragileTestPatterns

  if (rootProject.findProperty("skipDockerIncompatibleTests") == "true") {
    exclude dockerIncompatibleTestPatterns
@@ -570,15 +641,19 @@ task fragileTest(type: Test) {
  forkEvery 1
 }

-task outcastTest(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include outcastTestPatterns
+task outcastTest(type: FilteringTest) {
+  tests = outcastTestPatterns

  // Sets the maximum number of test executors that may exist at the same time.
  maxParallelForks 5
 }

+// Dedicated test suite for schema-dependent tests.
+task sqlIntegrationTest(type: FilteringTest) {
+  excludeTestCases = false
+  tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
+}
+
 task findGoldenImages(type: JavaExec) {
  classpath = sourceSets.test.runtimeClasspath
  main = 'google.registry.webdriver.GoldenImageFinder'
@@ -593,10 +668,44 @@ task findGoldenImages(type: JavaExec) {
  args arguments
 }

-task generateGoldenImages(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include "**/webdriver/*"
+// To run the nomulus tool with these command line tokens:
+// "--foo", "bar baz", "--qux=quz"
+//   gradle registryTool --args="--foo 'bar baz' --qux=quz"
+// or:
+//   gradle registryTool --PtoolArgs="--foo|bar baz|--qux=quz"
+// Note that the delimiting pipe can be backslash escaped if it is part of a
+// parameter.
+task registryTool(type: JavaExec) {
+  classpath = sourceSets.main.runtimeClasspath
+  main = 'google.registry.tools.RegistryTool'
+
+  // If "-PtoolArgs=..." is present in the command line, use it to set the args,
+  // otherwise use the default flag, which is "--args" to set the args.
+  doFirst {
+    def toolArgs = rootProject.findProperty("toolArgs")
+    if (toolArgs != null) {
+      def delimiter = '|'
+      toolArgs += delimiter
+      def argsList = []
+      def currArg = ''
+      for (def i = 0; i < toolArgs.length(); i++) {
+        def currChar = toolArgs[i]
+        if (currChar != delimiter) {
+          currArg += currChar
+        } else if (i != 0 && toolArgs[i - 1] == '\\') {
+          currArg = currArg.substring(0, currArg.length() - 1) + currChar
+        } else {
+          argsList.add(currArg)
+          currArg = ''
+        }
+      }
+      args = argsList
+    }
+  }
+}
+
+task generateGoldenImages(type: FilteringTest) {
+  tests = ["**/webdriver/*"]

  // Sets the maximum number of test executors that may exist at the same time.
  maxParallelForks 5
@@ -627,9 +736,8 @@ task flowDocsTool(type: JavaExec) {
  args arguments
 }

-test {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
+task standardTest(type: FilteringTest) {
+  includeAllTests()
  exclude fragileTestPatterns
  exclude outcastTestPatterns

@@ -651,7 +759,13 @@ test {
  doFirst {
    new File(screenshotsDir).deleteDir()
  }
-}.dependsOn(fragileTest, outcastTest)
+}
+
+test {
+  // Don't run any tests from this task, all testing gets done in the
+  // FilteringTest tasks.
+  exclude "**"
+}.dependsOn(fragileTest, outcastTest, standardTest)

 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
 project.nomulus.dependsOn project(':third_party').jar
--- a/core/gradle/dependency-locks/apt.lockfile
+++ b/core/gradle/dependency-locks/apt.lockfile
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
--- a/core/gradle/dependency-locks/archives.lockfile
+++ b/core/gradle/dependency-locks/archives.lockfile
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -1,14 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -80,7 +81,7 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -92,8 +93,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -108,9 +109,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -146,43 +152,61 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.joda:joda-money:0.10.0
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -192,7 +216,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -1,14 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -79,7 +80,7 @@ com.google.errorprone:error_prone_annotations:2.3.3
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -91,8 +92,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,9 +108,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -144,43 +150,61 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.joda:joda-money:0.10.0
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -190,7 +214,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/compileOnly.lockfile
+++ b/core/gradle/dependency-locks/compileOnly.lockfile
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -0,0 +1,246 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/errorprone.lockfile
+++ b/core/gradle/dependency-locks/errorprone.lockfile
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
--- a/core/gradle/dependency-locks/jacocoAgent.lockfile
+++ b/core/gradle/dependency-locks/jacocoAgent.lockfile
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
--- a/core/gradle/dependency-locks/jacocoAnt.lockfile
+++ b/core/gradle/dependency-locks/jacocoAnt.lockfile
@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
+org.jacoco:org.jacoco.ant:0.8.4
+org.jacoco:org.jacoco.core:0.8.4
+org.jacoco:org.jacoco.report:0.8.4
+org.ow2.asm:asm-analysis:7.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:7.1
+org.ow2.asm:asm:7.1
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -0,0 +1,235 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -1,14 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,13 +51,14 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -64,6 +74,8 @@ com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -80,7 +92,7 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -92,8 +104,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -108,11 +120,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
-com.sun.istack:istack-commons-runtime:3.0.5
-com.sun.xml.fastinfoset:FastInfoset:1.2.13
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -148,57 +163,80 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
-org.glassfish.jaxb:jaxb-core:2.3.0
-org.glassfish.jaxb:jaxb-runtime:2.3.0
-org.glassfish.jaxb:txw2:2.3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.joda:joda-money:0.10.0
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
-org.jvnet.staxex:stax-ex:1.7.8
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-analysis:7.0
 org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testApt.lockfile
+++ b/core/gradle/dependency-locks/testApt.lockfile
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -1,14 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -81,8 +82,8 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -94,9 +95,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,8 +108,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -119,12 +120,16 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -162,30 +167,32 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -202,17 +209,28 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -222,7 +240,7 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -236,9 +254,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -1,14 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -80,8 +81,8 @@ com.google.errorprone:error_prone_annotations:2.3.3
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -93,9 +94,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -106,8 +107,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -118,12 +119,16 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -160,30 +165,32 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -200,17 +207,28 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -220,7 +238,7 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -234,9 +252,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/gradle/dependency-locks/testCompileOnly.lockfile
+++ b/core/gradle/dependency-locks/testCompileOnly.lockfile
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -0,0 +1,282 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.33
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-api-stubs:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.java-diff-utils:diffutils:1.3.0
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp3:okhttp:3.11.0
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy-agent:1.9.7
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-exec:1.3
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.ftpserver:ftplet-api:1.0.6
+org.apache.ftpserver:ftpserver-core:1.0.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.apache.mina:mina-core:2.0.4
+org.apache.sshd:sshd-core:2.0.0
+org.apache.sshd:sshd-scp:2.0.0
+org.apache.sshd:sshd-sftp:2.0.0
+org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-compat-qual:2.5.5
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.flywaydb:flyway-core:5.2.4
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-all:1.3
+org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:2.25.0
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:2.6
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.seleniumhq.selenium:selenium-api:3.141.59
+org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
+org.seleniumhq.selenium:selenium-edge-driver:3.141.59
+org.seleniumhq.selenium:selenium-firefox-driver:3.141.59
+org.seleniumhq.selenium:selenium-ie-driver:3.141.59
+org.seleniumhq.selenium:selenium-java:3.141.59
+org.seleniumhq.selenium:selenium-opera-driver:3.141.59
+org.seleniumhq.selenium:selenium-remote-driver:3.141.59
+org.seleniumhq.selenium:selenium-safari-driver:3.141.59
+org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -1,14 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
-com.github.luben:zstd-jni:1.3.8-3
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -16,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -42,13 +51,14 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -65,6 +75,8 @@ com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -81,8 +93,8 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -94,9 +106,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,8 +119,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -119,14 +131,16 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
-com.sun.istack:istack-commons-runtime:3.0.5
-com.sun.xml.fastinfoset:FastInfoset:1.2.13
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -164,30 +178,32 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -204,31 +220,40 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
-org.glassfish.jaxb:jaxb-core:2.3.0
-org.glassfish.jaxb:jaxb-runtime:2.3.0
-org.glassfish.jaxb:txw2:2.3.0
+org.flywaydb:flyway-core:5.2.4
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
-org.jvnet.staxex:stax-ex:1.7.8
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-analysis:7.0
 org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -242,9 +267,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
--- a/core/karma.conf.js
+++ b/core/karma.conf.js
@@ -16,6 +16,7 @@ process.env.CHROME_BIN = require('puppeteer').executablePath()

 module.exports = function(config) {
  config.set({
+    basePath: '..',
    browsers: ['ChromeHeadlessNoSandbox'],
    customLaunchers: {
      ChromeHeadlessNoSandbox: {
@@ -41,15 +42,15 @@ module.exports = function(config) {
        pattern: 'core/build/generated/source/custom/main/**/*.soy.js',
        included: false
      },
-      {
-        pattern: 'node_modules/soyutils_usegoog.js',
-        included: false
-      },
      {
        pattern: 'node_modules/google-closure-library/closure/goog/deps.js',
        included: false,
        served: false
      },
+      {
+        pattern: 'node_modules/google-closure-library/closure/goog/**/*.js',
+        included: false
+      },
      {
        pattern: 'core/build/resources/main/google/registry/ui/assets/images/*.png',
        included: false
@@ -65,7 +66,6 @@ module.exports = function(config) {
      'node_modules/google-closure-library/closure/**/*.js': ['closure'],
      'core/src/*/javascript/**/*.js': ['closure'],
      'core/build/generated/source/custom/main/**/*.soy.js': ['closure'],
-      'node_modules/soyutils_usegoog.js': ['closure']
    },
    proxies: {
      "/assets/": "/base/core/build/resources/main/google/registry/ui/assets/"
--- a/core/src/main/java/google/registry/beam/invoicing/InvoicingPipeline.java
+++ b/core/src/main/java/google/registry/beam/invoicing/InvoicingPipeline.java
@@ -85,7 +85,7 @@ public class InvoicingPipeline implements Serializable {
  }

  /** Custom options for running the invoicing pipeline. */
-  interface InvoicingPipelineOptions extends DataflowPipelineOptions {
+  public interface InvoicingPipelineOptions extends DataflowPipelineOptions {
    /** Returns the yearMonth we're generating invoices for, in yyyy-MM format. */
    @Description("The yearMonth we generate invoices for, in yyyy-MM format.")
    ValueProvider<String> getYearMonth();
--- a/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
+++ b/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
@@ -105,7 +105,7 @@ public class Spec11Pipeline implements Serializable {
  }

  /** Custom options for running the spec11 pipeline. */
-  interface Spec11PipelineOptions extends DataflowPipelineOptions {
+  public interface Spec11PipelineOptions extends DataflowPipelineOptions {
    /** Returns the local date we're generating the report for, in yyyy-MM-dd format. */
    @Description("The local date we generate the report for, in yyyy-MM-dd format.")
    ValueProvider<String> getDate();
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -392,6 +392,24 @@ public final class RegistryConfig {
      return config.datastore.eppResourceIndexBucketsNum;
    }

+    @Provides
+    @Config("cloudSqlJdbcUrl")
+    public static String providesCloudSqlJdbcUrl(RegistryConfigSettings config) {
+      return config.cloudSql.jdbcUrl;
+    }
+
+    @Provides
+    @Config("cloudSqlUsername")
+    public static String providesCloudSqlUsername(RegistryConfigSettings config) {
+      return config.cloudSql.username;
+    }
+
+    @Provides
+    @Config("cloudSqlInstanceConnectionName")
+    public static String providesCloudSqlInstanceConnectionName(RegistryConfigSettings config) {
+      return config.cloudSql.instanceConnectionName;
+    }
+
    @Provides
    @Config("cloudDnsRootUrl")
    public static Optional<String> getCloudDnsRootUrl(RegistryConfigSettings config) {
@@ -1278,6 +1296,12 @@ public final class RegistryConfig {
      return config.registryTool.clientSecret;
    }

+    @Provides
+    @Config("toolsCloudSqlUsername")
+    public static String providesToolsCloudSqlUsername(RegistryConfigSettings config) {
+      return config.registryTool.username;
+    }
+
    @Provides
    @Config("rdapTos")
    public static ImmutableList<String> provideRdapTos(RegistryConfigSettings config) {
@@ -1469,11 +1493,6 @@ public final class RegistryConfig {
    return CONFIG_SETTINGS.get().hibernate.logSqlQueries;
  }

-  /** Returns true if schema modification is allowed. */
-  public static String getHibernateHbm2ddlAuto() {
-    return CONFIG_SETTINGS.get().hibernate.hbm2ddlAuto;
-  }
-
  /** Returns the connection timeout for HikariCP. */
  public static String getHibernateHikariConnectionTimeout() {
    return CONFIG_SETTINGS.get().hibernate.hikariConnectionTimeout;
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -26,6 +26,7 @@ public class RegistryConfigSettings {
  public RegistryPolicy registryPolicy;
  public Datastore datastore;
  public Hibernate hibernate;
+  public CloudSql cloudSql;
  public CloudDns cloudDns;
  public Caching caching;
  public IcannReporting icannReporting;
@@ -110,13 +111,19 @@ public class RegistryConfigSettings {
  public static class Hibernate {
    public String connectionIsolation;
    public String logSqlQueries;
-    public String hbm2ddlAuto;
    public String hikariConnectionTimeout;
    public String hikariMinimumIdle;
    public String hikariMaximumPoolSize;
    public String hikariIdleTimeout;
  }

+  /** Configuration for Cloud SQL. */
+  public static class CloudSql {
+    public String jdbcUrl;
+    public String username;
+    public String instanceConnectionName;
+  }
+
  /** Configuration for Apache Beam (Cloud Dataflow). */
  public static class Beam {
    public String defaultJobZone;
@@ -206,5 +213,6 @@ public class RegistryConfigSettings {
  public static class RegistryTool {
    public String clientId;
    public String clientSecret;
+    public String username;
  }
 }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -211,6 +211,14 @@ hibernate:
  hikariMaximumPoolSize: 20
  hikariIdleTimeout: 300000

+cloudSql:
+  # jdbc url for the Cloud SQL database.
+  jdbcUrl: jdbc:postgresql://localhost
+  # Username for the database user.
+  username: username
+  # This name is used by Cloud SQL when connecting to the database.
+  instanceConnectionName: project-id:region:instance-id
+
 cloudDns:
  # Set both properties to null in Production.
  # The root url for the Cloud DNS API.  Set this to a non-null value to
@@ -414,3 +422,4 @@ registryTool:
  clientId: YOUR_CLIENT_ID
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
+  username: toolusername
--- a/core/src/main/java/google/registry/env/common/default/WEB-INF/web.xml
+++ b/core/src/main/java/google/registry/env/common/default/WEB-INF/web.xml
@@ -55,6 +55,12 @@
    <url-pattern>/registrar-settings</url-pattern>
  </servlet-mapping>

+  <!-- Registry lock get/post/verify. -->
+  <servlet-mapping>
+    <servlet-name>frontend-servlet</servlet-name>
+    <url-pattern>/registry-lock-get</url-pattern>
+  </servlet-mapping>
+
  <!-- Security config -->
  <security-constraint>
    <web-resource-collection>
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml
@@ -144,7 +144,7 @@
  <cron>
    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
    <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
    </description>
    <schedule>every 12 hours synchronized</schedule>
    <target>backend</target>
--- a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
+++ b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
@@ -112,7 +112,7 @@
  <cron>
    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
    <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
    </description>
    <schedule>every 12 hours synchronized</schedule>
    <target>backend</target>
--- a/core/src/main/java/google/registry/export/ExportDomainListsAction.java
+++ b/core/src/main/java/google/registry/export/ExportDomainListsAction.java
@@ -56,7 +56,7 @@ import javax.inject.Inject;
 import org.joda.time.DateTime;

 /**
- * A mapreduce that exports the list of active domains on all real TLDs to Google Cloud Storage.
+ * A mapreduce that exports the list of active domains on all real TLDs to Google Drive and GCS.
 *
 * <p>Each TLD's active domain names are exported as a newline-delimited flat text file with the
 * name TLD.txt into the domain-lists bucket. Note that this overwrites the files in place.
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -187,6 +187,7 @@ import org.joda.time.Duration;
 * @error {@link DomainFlowUtils.UnexpectedClaimsNoticeException}
 * @error {@link DomainFlowUtils.UnsupportedFeeAttributeException}
 * @error {@link DomainFlowUtils.UnsupportedMarkTypeException}
+ * @error {@link DomainPricingLogic.AllocationTokenInvalidForPremiumNameException}
 */
@ReportingSpec(ActivityReportField.DOMAIN_CREATE)
 public class DomainCreateFlow implements TransactionalFlow {
--- a/core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java
@@ -14,12 +14,12 @@

 package google.registry.flows.domain;

-import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.pricing.PricingEngineProxy.getDomainFeeClass;
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;

 import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
+import google.registry.flows.EppException.CommandUseErrorException;
 import google.registry.flows.FlowScope;
 import google.registry.flows.custom.DomainPricingCustomLogic;
 import google.registry.flows.custom.DomainPricingCustomLogic.CreatePriceParameters;
@@ -182,13 +182,14 @@ public final class DomainPricingLogic {
  }

  private Money getDomainCreateCostWithDiscount(
-      String domainName, DateTime date, int years, Optional<AllocationToken> allocationToken) {
+      String domainName, DateTime date, int years, Optional<AllocationToken> allocationToken)
+      throws EppException {
    DomainPrices domainPrices = PricingEngineProxy.getPricesForDomainName(domainName, date);
-    checkArgument(
-        !allocationToken.isPresent()
-            || allocationToken.get().getDiscountFraction() == 0.0
-            || !domainPrices.isPremium(),
-        "A nonzero discount code cannot be applied to premium domains");
+    if (allocationToken.isPresent()
+        && allocationToken.get().getDiscountFraction() != 0.0
+        && domainPrices.isPremium()) {
+      throw new AllocationTokenInvalidForPremiumNameException();
+    }
    Money oneYearCreateCost = domainPrices.getCreateCost();
    Money totalDomainCreateCost = oneYearCreateCost.multipliedBy(years);
    // If a discount is applicable, apply it only to the first year
@@ -200,4 +201,12 @@ public final class DomainPricingLogic {
    }
    return totalDomainCreateCost;
  }
+
+  /** An allocation token was provided that is invalid for premium domains. */
+  public static class AllocationTokenInvalidForPremiumNameException
+      extends CommandUseErrorException {
+    public AllocationTokenInvalidForPremiumNameException() {
+      super("A nonzero discount code cannot be applied to premium domains");
+    }
+  }
 }
--- a/core/src/main/java/google/registry/keyring/api/DummyKeyringModule.java
+++ b/core/src/main/java/google/registry/keyring/api/DummyKeyringModule.java
@@ -122,7 +122,9 @@ public abstract class DummyKeyringModule {
        "not a real login",
        "not a real password",
        "not a real login",
-        "not a real credential");
+        "not a real credential",
+        "not a real password",
+        "not a real password");
  }

  private DummyKeyringModule() {}
--- a/core/src/main/java/google/registry/keyring/api/InMemoryKeyring.java
+++ b/core/src/main/java/google/registry/keyring/api/InMemoryKeyring.java
@@ -39,6 +39,8 @@ public final class InMemoryKeyring implements Keyring {
  private final String marksdbLordnPassword;
  private final String marksdbSmdrlLoginAndPassword;
  private final String jsonCredential;
+  private final String cloudSqlPassword;
+  private final String toolsCloudSqlPassword;

  public InMemoryKeyring(
      PGPKeyPair rdeStagingKey,
@@ -53,7 +55,9 @@ public final class InMemoryKeyring implements Keyring {
      String marksdbDnlLoginAndPassword,
      String marksdbLordnPassword,
      String marksdbSmdrlLoginAndPassword,
-      String jsonCredential) {
+      String jsonCredential,
+      String cloudSqlPassword,
+      String toolsCloudSqlPassword) {
    checkArgument(PgpHelper.isSigningKey(rdeSigningKey.getPublicKey()),
        "RDE signing key must support signing: %s", rdeSigningKey.getKeyID());
    checkArgument(rdeStagingKey.getPublicKey().isEncryptionKey(),
@@ -79,6 +83,8 @@ public final class InMemoryKeyring implements Keyring {
    this.marksdbSmdrlLoginAndPassword =
        checkNotNull(marksdbSmdrlLoginAndPassword, "marksdbSmdrlLoginAndPassword");
    this.jsonCredential = checkNotNull(jsonCredential, "jsonCredential");
+    this.cloudSqlPassword = checkNotNull(cloudSqlPassword, "cloudSqlPassword");
+    this.toolsCloudSqlPassword = checkNotNull(toolsCloudSqlPassword, "toolsCloudSqlPassword");
  }

  @Override
@@ -151,6 +157,16 @@ public final class InMemoryKeyring implements Keyring {
    return jsonCredential;
  }

+  @Override
+  public String getCloudSqlPassword() {
+    return cloudSqlPassword;
+  }
+
+  @Override
+  public String getToolsCloudSqlPassword() {
+    return toolsCloudSqlPassword;
+  }
+
  /** Does nothing. */
  @Override
  public void close() {}
--- a/core/src/main/java/google/registry/keyring/api/KeyModule.java
+++ b/core/src/main/java/google/registry/keyring/api/KeyModule.java
@@ -36,6 +36,18 @@ public final class KeyModule {
    String value();
  }

+  @Provides
+  @Key("cloudSqlPassword")
+  static String providesCloudSqlPassword(Keyring keyring) {
+    return keyring.getCloudSqlPassword();
+  }
+
+  @Provides
+  @Key("toolsCloudSqlPassword")
+  static String providesToolsCloudSqlPassword(Keyring keyring) {
+    return keyring.getToolsCloudSqlPassword();
+  }
+
  @Provides
  @Key("brdaReceiverKey")
  static PGPPublicKey provideBrdaReceiverKey(Keyring keyring) {
--- a/core/src/main/java/google/registry/keyring/api/Keyring.java
+++ b/core/src/main/java/google/registry/keyring/api/Keyring.java
@@ -28,6 +28,12 @@ import org.bouncycastle.openpgp.PGPPublicKey;
@ThreadSafe
 public interface Keyring extends AutoCloseable {

+  /** Returns the password which is used by App Engine to connect to the Cloud SQL database. */
+  String getCloudSqlPassword();
+
+  /** Returns the password which is used by nomulus tool to connect to the Cloud SQL database. */
+  String getToolsCloudSqlPassword();
+
  /**
   * Returns the key which should be used to sign RDE deposits being uploaded to a third-party.
   *
--- a/core/src/main/java/google/registry/keyring/kms/KmsKeyring.java
+++ b/core/src/main/java/google/registry/keyring/kms/KmsKeyring.java
@@ -67,6 +67,7 @@ public class KmsKeyring implements Keyring {

  /** Key labels for string secrets. */
  enum StringKeyLabel {
+    CLOUD_SQL_PASSWORD_STRING,
    SAFE_BROWSING_API_KEY,
    ICANN_REPORTING_PASSWORD_STRING,
    JSON_CREDENTIAL_STRING,
@@ -74,7 +75,8 @@ public class KmsKeyring implements Keyring {
    MARKSDB_LORDN_PASSWORD_STRING,
    MARKSDB_SMDRL_LOGIN_STRING,
    RDE_SSH_CLIENT_PRIVATE_STRING,
-    RDE_SSH_CLIENT_PUBLIC_STRING;
+    RDE_SSH_CLIENT_PUBLIC_STRING,
+    TOOLS_CLOUD_SQL_PASSWORD_STRING;

    String getLabel() {
      return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
@@ -88,6 +90,16 @@ public class KmsKeyring implements Keyring {
    this.kmsConnection = kmsConnection;
  }

+  @Override
+  public String getCloudSqlPassword() {
+    return getString(StringKeyLabel.CLOUD_SQL_PASSWORD_STRING);
+  }
+
+  @Override
+  public String getToolsCloudSqlPassword() {
+    return getString(StringKeyLabel.TOOLS_CLOUD_SQL_PASSWORD_STRING);
+  }
+
  @Override
  public PGPKeyPair getRdeSigningKey() {
    return getKeyPair(PrivateKeyLabel.RDE_SIGNING_PRIVATE);
--- a/core/src/main/java/google/registry/keyring/kms/KmsUpdater.java
+++ b/core/src/main/java/google/registry/keyring/kms/KmsUpdater.java
@@ -24,6 +24,7 @@ import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.BRDA_SIGNING
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_RECEIVER_PUBLIC;
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_SIGNING_PUBLIC;
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_STAGING_PUBLIC;
+import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.CLOUD_SQL_PASSWORD_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.ICANN_REPORTING_PASSWORD_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.JSON_CREDENTIAL_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.MARKSDB_DNL_LOGIN_STRING;
@@ -32,6 +33,7 @@ import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.MARKSDB_SMDR
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.RDE_SSH_CLIENT_PRIVATE_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.RDE_SSH_CLIENT_PUBLIC_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.SAFE_BROWSING_API_KEY;
+import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.TOOLS_CLOUD_SQL_PASSWORD_STRING;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
@@ -69,6 +71,10 @@ public final class KmsUpdater {
    this.secretValues = new LinkedHashMap<>();
  }

+  public KmsUpdater setCloudSqlPassword(String password) {
+    return setString(password, CLOUD_SQL_PASSWORD_STRING);
+  }
+
  public KmsUpdater setRdeSigningKey(PGPKeyPair keyPair) throws IOException, PGPException {
    return setKeyPair(keyPair, RDE_SIGNING_PRIVATE, RDE_SIGNING_PUBLIC);
  }
@@ -101,6 +107,10 @@ public final class KmsUpdater {
    return setString(apiKey, SAFE_BROWSING_API_KEY);
  }

+  public KmsUpdater setToolsCloudSqlPassword(String password) {
+    return setString(password, TOOLS_CLOUD_SQL_PASSWORD_STRING);
+  }
+
  public KmsUpdater setIcannReportingPassword(String password) {
    return setString(password, ICANN_REPORTING_PASSWORD_STRING);
  }
--- a/core/src/main/java/google/registry/model/common/Cursor.java
+++ b/core/src/main/java/google/registry/model/common/Cursor.java
@@ -79,7 +79,16 @@ public class Cursor extends ImmutableObject {
     * stored is the last time that registrar changes were successfully synced to the sheet. If
     * there were no changes since the last time the action run, the cursor is not updated.
     */
-    SYNC_REGISTRAR_SHEET(EntityGroupRoot.class);
+    SYNC_REGISTRAR_SHEET(EntityGroupRoot.class),
+
+    /** Cursor for tracking monthly uploads of ICANN transaction reports. */
+    ICANN_UPLOAD_TX(Registry.class),
+
+    /** Cursor for tracking monthly uploads of ICANN activity reports. */
+    ICANN_UPLOAD_ACTIVITY(Registry.class),
+
+    /** Cursor for tracking monthly upload of MANIFEST.txt to ICANN. */
+    ICANN_UPLOAD_MANIFEST(EntityGroupRoot.class);

    /** See the definition of scope on {@link #getScopeClass}. */
    private final Class<? extends ImmutableObject> scope;
--- a/core/src/main/java/google/registry/model/domain/DesignatedContact.java
+++ b/core/src/main/java/google/registry/model/domain/DesignatedContact.java
@@ -21,24 +21,26 @@ import com.googlecode.objectify.annotation.Embed;
 import com.googlecode.objectify.annotation.Index;
 import google.registry.model.ImmutableObject;
 import google.registry.model.contact.ContactResource;
+import javax.persistence.Id;
 import javax.xml.bind.annotation.XmlEnumValue;

 /**
 * Persisted type for storing a domain's contact associations.
 *
 * <p>A contact association on a domain consists of the contact key and the contact "type", which is
- * the designated role of this contact with respect to this domain.  When converting to and from
- * EPP XML, we use {@link ForeignKeyedDesignatedContact} to replace the contact's Datastore key
- * with its foreign key, since that is what EPP exposes.
+ * the designated role of this contact with respect to this domain. When converting to and from EPP
+ * XML, we use {@link ForeignKeyedDesignatedContact} to replace the contact's Datastore key with its
+ * foreign key, since that is what EPP exposes.
 *
 * <p>Note one could in principle store contact foreign keys here in addition to keys, unlike the
- * situation with hosts where client-side renames would make that data stale.  However, we sometimes
+ * situation with hosts where client-side renames would make that data stale. However, we sometimes
 * rename contacts internally ourselves, and it's easier to use the same model for both cases.
 *
- * @see <a href="http://tools.ietf.org/html/rfc5731#section-2.2">
- *     RFC 5731 - EPP Domain Name Mapping - Contact and Client Identifiers</a>
+ * @see <a href="http://tools.ietf.org/html/rfc5731#section-2.2">RFC 5731 - EPP Domain Name Mapping
+ *     - Contact and Client Identifiers</a>
 */
@Embed
+@javax.persistence.Entity
 public class DesignatedContact extends ImmutableObject {

  /**
@@ -65,8 +67,7 @@ public class DesignatedContact extends ImmutableObject {

  Type type;

-  @Index
-  Key<ContactResource> contact;
+  @Index @Id Key<ContactResource> contact;

  public Type getType() {
    return type;
--- a/core/src/main/java/google/registry/model/domain/DomainAuthInfo.java
+++ b/core/src/main/java/google/registry/model/domain/DomainAuthInfo.java
@@ -19,6 +19,7 @@ import google.registry.model.eppcommon.AuthInfo;

 /** A version of authInfo specifically for domains. */
@Embed
+@javax.persistence.Embeddable
 public class DomainAuthInfo extends AuthInfo {
  public static DomainAuthInfo create(PasswordAuth pw) {
    DomainAuthInfo instance = new DomainAuthInfo();
--- a/core/src/main/java/google/registry/model/domain/DomainBase.java
+++ b/core/src/main/java/google/registry/model/domain/DomainBase.java
@@ -69,7 +69,11 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.function.Predicate;
 import javax.annotation.Nullable;
-import javax.persistence.Transient;
+import javax.persistence.AttributeOverride;
+import javax.persistence.AttributeOverrides;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Embedded;
 import org.joda.time.DateTime;
 import org.joda.time.Interval;

@@ -85,7 +89,7 @@ import org.joda.time.Interval;
@ReportedOn
@Entity
@javax.persistence.Entity
-@javax.persistence.Table(name = "domain")
+@javax.persistence.Table(name = "Domain")
@ExternalMessagingName("domain")
 public class DomainBase extends EppResource
    implements ForeignKeyedEppResource, ResourceWithTransferData {
@@ -118,17 +122,22 @@ public class DomainBase extends EppResource
  String tld;

  /** References to hosts that are the nameservers for the domain. */
-  @Index @Transient Set<Key<HostResource>> nsHosts;
+  @Index @ElementCollection Set<Key<HostResource>> nsHosts;

  /**
   * The union of the contacts visible via {@link #getContacts} and {@link #getRegistrant}.
   *
   * <p>These are stored in one field so that we can query across all contacts at once.
   */
-  @Transient Set<DesignatedContact> allContacts;
+  @ElementCollection Set<DesignatedContact> allContacts;

  /** Authorization info (aka transfer secret) of the domain. */
-  @Transient DomainAuthInfo authInfo;
+  @Embedded
+  @AttributeOverrides({
+    @AttributeOverride(name = "pw.value", column = @Column(name = "auth_info_value")),
+    @AttributeOverride(name = "pw.repoId", column = @Column(name = "auth_info_repo_id")),
+  })
+  DomainAuthInfo authInfo;

  /**
   * Data used to construct DS records for this domain.
@@ -136,13 +145,27 @@ public class DomainBase extends EppResource
   * <p>This is {@literal @}XmlTransient because it needs to be returned under the "extension" tag
   * of an info response rather than inside the "infData" tag.
   */
-  @Transient Set<DelegationSignerData> dsData;
+  @ElementCollection Set<DelegationSignerData> dsData;

  /**
   * The claims notice supplied when this application or domain was created, if there was one. It's
   * {@literal @}XmlTransient because it's not returned in an info response.
   */
-  @IgnoreSave(IfNull.class) @Transient LaunchNotice launchNotice;
+  @IgnoreSave(IfNull.class)
+  @Embedded
+  @AttributeOverrides({
+    @AttributeOverride(name = "noticeId.tcnId", column = @Column(name = "launch_notice_tcn_id")),
+    @AttributeOverride(
+        name = "noticeId.validatorId",
+        column = @Column(name = "launch_notice_validator_id")),
+    @AttributeOverride(
+        name = "expirationTime",
+        column = @Column(name = "launch_notice_expiration_time")),
+    @AttributeOverride(
+        name = "acceptedTime",
+        column = @Column(name = "launch_notice_accepted_time")),
+  })
+  LaunchNotice launchNotice;

  /**
   * Name of first IDN table associated with TLD that matched the characters in this domain label.
@@ -153,7 +176,7 @@ public class DomainBase extends EppResource
  String idnTableName;

  /** Fully qualified host names of this domain's active subordinate hosts. */
-  @Transient Set<String> subordinateHosts;
+  @ElementCollection Set<String> subordinateHosts;

  /** When this domain's registration will expire. */
  DateTime registrationExpirationTime;
@@ -188,7 +211,7 @@ public class DomainBase extends EppResource
  Key<PollMessage.Autorenew> autorenewPollMessage;

  /** The unexpired grace periods for this domain (some of which may not be active yet). */
-  @Transient Set<GracePeriod> gracePeriods;
+  @ElementCollection Set<GracePeriod> gracePeriods;

  /**
   * The id of the signed mark that was used to create this domain in sunrise.
@@ -199,7 +222,31 @@ public class DomainBase extends EppResource
  String smdId;

  /** Data about any pending or past transfers on this domain. */
-  @Transient TransferData transferData;
+  @Embedded
+  @AttributeOverrides({
+    @AttributeOverride(
+        name = "transferRequestTrid",
+        column = @Column(name = "transfer_data_request_trid")),
+    @AttributeOverride(
+        name = "transferPeriod",
+        column = @Column(name = "transfer_data_transfer_period")),
+    @AttributeOverride(
+        name = "transferredRegistrationExpirationTime",
+        column = @Column(name = "transfer_data_registration_expiration_time")),
+    @AttributeOverride(
+        name = "serverApproveEntities",
+        column = @Column(name = "transfer_data_server_approve_entities")),
+    @AttributeOverride(
+        name = "serverApproveBillingEvent",
+        column = @Column(name = "transfer_data_server_approve_billing_event")),
+    @AttributeOverride(
+        name = "serverApproveAutorenewEvent",
+        column = @Column(name = "transfer_data_server_approve_autorenrew_event")),
+    @AttributeOverride(
+        name = "serverApproveAutorenewPollMessage",
+        column = @Column(name = "transfer_data_server_approve_autorenrew_poll_message")),
+  })
+  TransferData transferData;

  /**
   * The time that this resource was last transferred.
--- a/core/src/main/java/google/registry/model/domain/GracePeriod.java
+++ b/core/src/main/java/google/registry/model/domain/GracePeriod.java
@@ -19,21 +19,31 @@ import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Embed;
+import com.googlecode.objectify.annotation.Ignore;
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import javax.annotation.Nullable;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
 import org.joda.time.DateTime;

 /**
 * A domain grace period with an expiration time.
 *
- * <p>When a grace period expires, it is lazily removed from the {@link DomainBase} the next
- * time the resource is loaded from Datastore.
+ * <p>When a grace period expires, it is lazily removed from the {@link DomainBase} the next time
+ * the resource is loaded from Datastore.
 */
@Embed
+@javax.persistence.Entity
 public class GracePeriod extends ImmutableObject {

+  @javax.persistence.Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  @Ignore
+  /** Unique id required for hibernate representation. */
+  long id;
+
  /** The type of grace period. */
  GracePeriodStatus type;

--- a/core/src/main/java/google/registry/model/domain/Period.java
+++ b/core/src/main/java/google/registry/model/domain/Period.java
@@ -22,6 +22,7 @@ import javax.xml.bind.annotation.XmlValue;

 /** The "periodType" from {@link "http://tools.ietf.org/html/rfc5731"}. */
@Embed
+@javax.persistence.Embeddable
 public class Period extends ImmutableObject {

  @XmlAttribute
--- a/core/src/main/java/google/registry/model/domain/launch/LaunchNotice.java
+++ b/core/src/main/java/google/registry/model/domain/launch/LaunchNotice.java
@@ -28,6 +28,7 @@ import com.googlecode.objectify.annotation.IgnoreSave;
 import com.googlecode.objectify.condition.IfNull;
 import google.registry.model.ImmutableObject;
 import java.util.Optional;
+import javax.persistence.Embedded;
 import javax.xml.bind.annotation.XmlAttribute;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlType;
@@ -37,6 +38,7 @@ import org.joda.time.DateTime;
 /** The claims notice id from the claims phase. */
@Embed
@XmlType(propOrder = {"noticeId", "expirationTime", "acceptedTime"})
+@javax.persistence.Embeddable
 public class LaunchNotice extends ImmutableObject {

  /** An empty instance to use in place of null. */
@@ -44,6 +46,7 @@ public class LaunchNotice extends ImmutableObject {

  /** An id with a validator-id attribute. */
  @Embed
+  @javax.persistence.Embeddable
  public static class NoticeIdType extends ImmutableObject {

    /**
@@ -69,6 +72,7 @@ public class LaunchNotice extends ImmutableObject {
  }

  @XmlElement(name = "noticeID")
+  @Embedded
  NoticeIdType noticeId;

  @XmlElement(name = "notAfter")
--- a/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
@@ -30,12 +30,13 @@ import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 */
@Embed
@XmlType(name = "dsData")
+@javax.persistence.Entity
 public class DelegationSignerData extends ImmutableObject {

  private DelegationSignerData() {}

  /** The identifier for this particular key in the domain. */
-  int keyTag;
+  @javax.persistence.Id int keyTag;

  /**
   * The algorithm used by this key.
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -35,6 +35,8 @@ import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Index;
 import com.googlecode.objectify.annotation.Mapify;
+import google.registry.flows.EppException;
+import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.Buildable;
 import google.registry.model.CreateAutoTimestamp;
@@ -201,6 +203,13 @@ public class AllocationToken extends BackupGroupRoot implements Buildable {
          getInstance().redemptionHistoryEntry == null
              || TokenType.SINGLE_USE.equals(getInstance().tokenType),
          "Redemption history entry can only be specified for SINGLE_USE tokens");
+      if (getInstance().domainName != null) {
+        try {
+          DomainFlowUtils.validateDomainName(getInstance().domainName);
+        } catch (EppException e) {
+          throw new IllegalArgumentException("Invalid domain name: " + getInstance().domainName, e);
+        }
+      }
      return super.build();
    }

--- a/core/src/main/java/google/registry/model/eppcommon/AuthInfo.java
+++ b/core/src/main/java/google/registry/model/eppcommon/AuthInfo.java
@@ -16,6 +16,9 @@ package google.registry.model.eppcommon;

 import com.googlecode.objectify.annotation.Embed;
 import google.registry.model.ImmutableObject;
+import javax.persistence.Embeddable;
+import javax.persistence.Embedded;
+import javax.persistence.MappedSuperclass;
 import javax.xml.bind.annotation.XmlAttribute;
 import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
@@ -30,9 +33,11 @@ import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 * <p>RFCs 5731 and 5732 define this almost identically up to the namespace.
 */
@XmlTransient
+@Embeddable
+@MappedSuperclass
 public abstract class AuthInfo extends ImmutableObject {

-  protected PasswordAuth pw;
+  @Embedded protected PasswordAuth pw;

  public PasswordAuth getPw() {
    return pw;
@@ -41,6 +46,7 @@ public abstract class AuthInfo extends ImmutableObject {
  /** The "pwAuthInfoType" complex type. */
  @Embed
  @XmlType(namespace = "urn:ietf:params:xml:ns:eppcom-1.0")
+  @Embeddable
  public static class PasswordAuth extends ImmutableObject {
    @XmlValue
    @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
--- a/core/src/main/java/google/registry/model/eppcommon/Trid.java
+++ b/core/src/main/java/google/registry/model/eppcommon/Trid.java
@@ -31,6 +31,7 @@ import javax.xml.bind.annotation.XmlType;
 */
@Embed
@XmlType(propOrder = {"clientTransactionId", "serverTransactionId"})
+@javax.persistence.Embeddable
 public class Trid extends ImmutableObject {

  /** The server transaction id. */
--- a/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
+++ b/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
@@ -14,7 +14,6 @@

 package google.registry.model.ofy;

-
 import static google.registry.model.ofy.ObjectifyService.ofy;

 import google.registry.model.transaction.TransactionManager;
--- a/core/src/main/java/google/registry/model/registrar/Registrar.java
+++ b/core/src/main/java/google/registry/model/registrar/Registrar.java
@@ -619,6 +619,7 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
        .putListOfStrings("allowedTlds", getAllowedTlds())
        .putListOfStrings("ipAddressWhitelist", ipAddressWhitelist)
        .putListOfJsonObjects("contacts", getContacts())
+        .put("registryLockAllowed", registryLockAllowed)
        .build();
  }

--- a/core/src/main/java/google/registry/model/registrar/RegistrarContact.java
+++ b/core/src/main/java/google/registry/model/registrar/RegistrarContact.java
@@ -314,6 +314,7 @@ public class RegistrarContact extends ImmutableObject implements Jsonifiable {
        .put("visibleInWhoisAsTech", visibleInWhoisAsTech)
        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
+        .put("registryLockAllowed", isRegistryLockAllowed())
        .put("gaeUserId", gaeUserId)
        .build();
  }
--- a/core/src/main/java/google/registry/model/registry/RegistryLockDao.java
+++ b/core/src/main/java/google/registry/model/registry/RegistryLockDao.java
@@ -0,0 +1,91 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registry;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.collect.ImmutableList;
+import google.registry.schema.domain.RegistryLock;
+import java.util.Optional;
+import javax.persistence.EntityManager;
+
+/** Data access object for {@link google.registry.schema.domain.RegistryLock}. */
+public final class RegistryLockDao {
+
+  /**
+   * Returns the most recent version of the {@link RegistryLock} referred to by the verification
+   * code (there may be two instances of the same code in the database--one after lock object
+   * creation and one after verification.
+   */
+  public static RegistryLock getByVerificationCode(String verificationCode) {
+    return jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Long revisionId =
+                  em.createQuery(
+                          "SELECT MAX(revisionId) FROM RegistryLock WHERE verificationCode ="
+                              + " :verificationCode",
+                          Long.class)
+                      .setParameter("verificationCode", verificationCode)
+                      .getSingleResult();
+              // TODO(gbrodman): Don't throw NPE here. Maybe NoResultException fits better?
+              checkNotNull(revisionId, "No registry lock with this code");
+              return em.find(RegistryLock.class, revisionId);
+            });
+  }
+
+  /** Returns all lock objects that this registrar has created. */
+  public static ImmutableList<RegistryLock> getByRegistrarId(String registrarId) {
+    return jpaTm()
+        .transact(
+            () ->
+                ImmutableList.copyOf(
+                    jpaTm()
+                        .getEntityManager()
+                        .createQuery(
+                            "SELECT lock FROM RegistryLock lock WHERE"
+                                + " lock.registrarId = :registrarId",
+                            RegistryLock.class)
+                        .setParameter("registrarId", registrarId)
+                        .getResultList()));
+  }
+
+  /**
+   * Returns the most recent lock object for a given repo ID (i.e. a domain) or empty if this domain
+   * hasn't been locked before.
+   */
+  public static Optional<RegistryLock> getMostRecentByRepoId(String repoId) {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createQuery(
+                        "SELECT lock FROM RegistryLock lock WHERE lock.repoId = :repoId"
+                            + " ORDER BY lock.revisionId DESC",
+                        RegistryLock.class)
+                    .setParameter("repoId", repoId)
+                    .setMaxResults(1)
+                    .getResultStream()
+                    .findFirst());
+  }
+
+  public static RegistryLock save(RegistryLock registryLock) {
+    checkNotNull(registryLock, "Null registry lock cannot be saved");
+    return jpaTm().transact(() -> jpaTm().getEntityManager().merge(registryLock));
+  }
+}
--- a/core/src/main/java/google/registry/model/tmch/ClaimsListDao.java
+++ b/core/src/main/java/google/registry/model/tmch/ClaimsListDao.java
@@ -0,0 +1,72 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.tmch;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.schema.tmch.ClaimsList;
+import javax.persistence.EntityManager;
+
+/** Data access object for {@link ClaimsList}. */
+public class ClaimsListDao {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static void save(ClaimsList claimsList) {
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(claimsList));
+  }
+
+  /**
+   * Try to save the given {@link ClaimsList} into Cloud SQL. If the save fails, the error will be
+   * logged but no exception will be thrown.
+   *
+   * <p>This method is used during the dual-write phase of database migration as Datastore is still
+   * the authoritative database.
+   */
+  public static void trySave(ClaimsList claimsList) {
+    try {
+      ClaimsListDao.save(claimsList);
+      logger.atInfo().log(
+          "Inserted %,d claims into Cloud SQL, created at %s",
+          claimsList.getLabelsToKeys().size(), claimsList.getTmdbGenerationTime());
+    } catch (Throwable e) {
+      logger.atSevere().withCause(e).log("Error inserting claims into Cloud SQL");
+    }
+  }
+
+  /**
+   * Returns the current revision of the {@link ClaimsList} in Cloud SQL. Throws exception if there
+   * is no claims in the table.
+   */
+  public static ClaimsList getCurrent() {
+    return jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Long revisionId =
+                  em.createQuery("SELECT MAX(revisionId) FROM ClaimsList", Long.class)
+                      .getSingleResult();
+              return em.createQuery(
+                      "FROM ClaimsList cl LEFT JOIN FETCH cl.labelsToKeys WHERE cl.revisionId ="
+                          + " :revisionId",
+                      ClaimsList.class)
+                  .setParameter("revisionId", revisionId)
+                  .getSingleResult();
+            });
+  }
+
+  private ClaimsListDao() {}
+}
--- a/core/src/main/java/google/registry/model/tmch/ClaimsListShard.java
+++ b/core/src/main/java/google/registry/model/tmch/ClaimsListShard.java
@@ -217,8 +217,7 @@ public class ClaimsListShard extends ImmutableObject {
            });
  }

-  public static ClaimsListShard create(
-      DateTime creationTime, ImmutableMap<String, String> labelsToKeys) {
+  public static ClaimsListShard create(DateTime creationTime, Map<String, String> labelsToKeys) {
    ClaimsListShard instance = new ClaimsListShard();
    instance.id = allocateId();
    instance.creationTime = checkNotNull(creationTime);
--- a/core/src/main/java/google/registry/model/transaction/DummyJpaTransactionManager.java
+++ b/core/src/main/java/google/registry/model/transaction/DummyJpaTransactionManager.java
@@ -0,0 +1,44 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import java.lang.reflect.Proxy;
+
+/**
+ * A dummy implementation for {@link JpaTransactionManager} which throws exception when any of its
+ * method is invoked.
+ *
+ * <p>This is used to initialize the {@link TransactionManagerFactory#jpaTm} when running unit
+ * tests, because obviously we cannot connect to the actual Cloud SQL backend in a unit test.
+ *
+ * <p>If a unit test needs to access the Cloud SQL database, it must add JpaTransactionManagerRule
+ * as a JUnit rule in the test class.
+ */
+public class DummyJpaTransactionManager {
+
+  /** Constructs a dummy {@link JpaTransactionManager} instance. */
+  public static JpaTransactionManager create() {
+    return (JpaTransactionManager)
+        Proxy.newProxyInstance(
+            JpaTransactionManager.class.getClassLoader(),
+            new Class[] {JpaTransactionManager.class},
+            (proxy, method, args) -> {
+              throw new UnsupportedOperationException(
+                  "JpaTransactionManager was not initialized as the runtime is detected as"
+                      + " Unittest. Add JpaTransactionManagerRule in the unit test for"
+                      + " initialization.");
+            });
+  }
+}
--- a/core/src/main/java/google/registry/model/transaction/JpaTransactionManager.java
+++ b/core/src/main/java/google/registry/model/transaction/JpaTransactionManager.java
@@ -0,0 +1,23 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import javax.persistence.EntityManager;
+
+/** Sub-interface of {@link TransactionManager} which defines JPA related methods. */
+public interface JpaTransactionManager extends TransactionManager {
+  /** Returns the {@link EntityManager} for the current request. */
+  EntityManager getEntityManager();
+}
--- a/core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java
+++ b/core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java
@@ -0,0 +1,160 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.util.Clock;
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.EntityTransaction;
+import javax.persistence.PersistenceException;
+import org.joda.time.DateTime;
+
+/** Implementation of {@link JpaTransactionManager} for JPA compatible database. */
+public class JpaTransactionManagerImpl implements JpaTransactionManager {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  // EntityManagerFactory is thread safe.
+  private final EntityManagerFactory emf;
+  private final Clock clock;
+  // TODO(shicong): Investigate alternatives for managing transaction information. ThreadLocal adds
+  //  an unnecessary restriction that each request has to be processed by one thread synchronously.
+  private final ThreadLocal<TransactionInfo> transactionInfo =
+      ThreadLocal.withInitial(TransactionInfo::new);
+
+  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock) {
+    this.emf = emf;
+    this.clock = clock;
+  }
+
+  @Override
+  public EntityManager getEntityManager() {
+    if (transactionInfo.get().entityManager == null) {
+      throw new PersistenceException(
+          "No EntityManager has been initialized. getEntityManager() must be invoked in the scope"
+              + " of a transaction");
+    }
+    return transactionInfo.get().entityManager;
+  }
+
+  @Override
+  public boolean inTransaction() {
+    return transactionInfo.get().inTransaction;
+  }
+
+  @Override
+  public void assertInTransaction() {
+    if (!inTransaction()) {
+      throw new PersistenceException("Not in a transaction");
+    }
+  }
+
+  @Override
+  public <T> T transact(Work<T> work) {
+    // TODO(shicong): Investigate removing transactNew functionality after migration as it may
+    //  be same as this one.
+    if (inTransaction()) {
+      return work.run();
+    }
+    TransactionInfo txnInfo = transactionInfo.get();
+    txnInfo.entityManager = emf.createEntityManager();
+    EntityTransaction txn = txnInfo.entityManager.getTransaction();
+    try {
+      txn.begin();
+      txnInfo.inTransaction = true;
+      txnInfo.transactionTime = clock.nowUtc();
+      T result = work.run();
+      txn.commit();
+      return result;
+    } catch (RuntimeException e) {
+      try {
+        txn.rollback();
+        logger.atWarning().log("Error during transaction; transaction rolled back");
+      } catch (Throwable rollbackException) {
+        logger.atSevere().withCause(rollbackException).log("Rollback failed; suppressing error");
+      }
+      throw e;
+    } finally {
+      txnInfo.clear();
+    }
+  }
+
+  @Override
+  public void transact(Runnable work) {
+    transact(
+        () -> {
+          work.run();
+          return null;
+        });
+  }
+
+  @Override
+  public <T> T transactNew(Work<T> work) {
+    // TODO(shicong): Implements the functionality to start a new transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public void transactNew(Runnable work) {
+    // TODO(shicong): Implements the functionality to start a new transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public <T> T transactNewReadOnly(Work<T> work) {
+    // TODO(shicong): Implements read only transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public void transactNewReadOnly(Runnable work) {
+    // TODO(shicong): Implements read only transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public <T> T doTransactionless(Work<T> work) {
+    // TODO(shicong): Implements doTransactionless.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public DateTime getTransactionTime() {
+    assertInTransaction();
+    TransactionInfo txnInfo = transactionInfo.get();
+    if (txnInfo.transactionTime == null) {
+      throw new PersistenceException("In a transaction but transactionTime is null");
+    }
+    return txnInfo.transactionTime;
+  }
+
+  private static class TransactionInfo {
+    EntityManager entityManager;
+    boolean inTransaction = false;
+    DateTime transactionTime;
+
+    private void clear() {
+      inTransaction = false;
+      transactionTime = null;
+      if (entityManager != null) {
+        // Close this EntityManager just let the connection pool be able to reuse it, it doesn't
+        // close the underlying database connection.
+        entityManager.close();
+        entityManager = null;
+      }
+    }
+  }
+}
--- a/core/src/main/java/google/registry/model/transaction/TransactionManagerFactory.java
+++ b/core/src/main/java/google/registry/model/transaction/TransactionManagerFactory.java
@@ -14,24 +14,78 @@

 package google.registry.model.transaction;

+import static google.registry.config.RegistryEnvironment.ALPHA;
+import static google.registry.config.RegistryEnvironment.CRASH;
+import static google.registry.config.RegistryEnvironment.SANDBOX;
+
+import com.google.appengine.api.utils.SystemProperty;
+import com.google.appengine.api.utils.SystemProperty.Environment.Value;
+import com.google.common.annotations.VisibleForTesting;
+import google.registry.config.RegistryEnvironment;
 import google.registry.model.ofy.DatastoreTransactionManager;
+import google.registry.persistence.DaggerPersistenceComponent;

 /** Factory class to create {@link TransactionManager} instance. */
+// TODO: Rename this to PersistenceFactory and move to persistence package.
 public class TransactionManagerFactory {

  private static final TransactionManager TM = createTransactionManager();
+  @VisibleForTesting static JpaTransactionManager jpaTm = createJpaTransactionManager();

  private TransactionManagerFactory() {}

+  private static JpaTransactionManager createJpaTransactionManager() {
+    if (shouldEnableJpaTm() && isInAppEngine()) {
+      return DaggerPersistenceComponent.create().appEngineJpaTransactionManager();
+    } else {
+      return DummyJpaTransactionManager.create();
+    }
+  }
+
  private static TransactionManager createTransactionManager() {
-    // TODO: Conditionally returns the corresponding implementation once we have
-    //  CloudSqlTransactionManager
+    // TODO: Determine how to provision TransactionManager after the dual-write. During the
+    // dual-write transitional phase, we need the TransactionManager for both Datastore and Cloud
+    // SQL, and this method returns the one for Datastore.
    return new DatastoreTransactionManager(null);
  }

+  /**
+   * Sets jpaTm to the implementation for Nomulus tool. Note that this method should be only used by
+   * {@link google.registry.tools.RegistryCli} to initialize jpaTm.
+   */
+  public static void initForTool() {
+    if (shouldEnableJpaTm()) {
+      jpaTm = DaggerPersistenceComponent.create().nomulusToolJpaTransactionManager();
+    }
+  }
+
+  // TODO(shicong): Enable JpaTm for all environments and remove this function
+  private static boolean shouldEnableJpaTm() {
+    return RegistryEnvironment.get() == ALPHA
+        || RegistryEnvironment.get() == CRASH
+        || RegistryEnvironment.get() == SANDBOX;
+  }
+
+  /**
+   * This function uses App Engine API to determine if the current runtime environment is App
+   * Engine.
+   *
+   * @see <a
+   *     href="https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/utils/SystemProperty">App
+   *     Engine API public doc</a>
+   */
+  private static boolean isInAppEngine() {
+    // SystemProperty.environment.value() returns null if the current runtime is local JVM
+    return SystemProperty.environment.value() == Value.Production;
+  }
+
  /** Returns {@link TransactionManager} instance. */
  public static TransactionManager tm() {
-
    return TM;
  }
+
+  /** Returns {@link JpaTransactionManager} instance. */
+  public static JpaTransactionManager jpaTm() {
+    return jpaTm;
+  }
 }
--- a/core/src/main/java/google/registry/model/transfer/BaseTransferObject.java
+++ b/core/src/main/java/google/registry/model/transfer/BaseTransferObject.java
@@ -16,12 +16,14 @@ package google.registry.model.transfer;

 import google.registry.model.Buildable.GenericBuilder;
 import google.registry.model.ImmutableObject;
+import javax.persistence.MappedSuperclass;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlTransient;
 import org.joda.time.DateTime;

 /** Fields common to {@link TransferData} and {@link TransferResponse}. */
@XmlTransient
+@MappedSuperclass
 public abstract class BaseTransferObject extends ImmutableObject {
  /**
   * The status of the current or last transfer. Can be null if never transferred. Note that we
--- a/core/src/main/java/google/registry/model/transfer/TransferData.java
+++ b/core/src/main/java/google/registry/model/transfer/TransferData.java
@@ -31,20 +31,23 @@ import google.registry.model.eppcommon.Trid;
 import google.registry.model.poll.PollMessage;
 import java.util.Set;
 import javax.annotation.Nullable;
+import javax.persistence.ElementCollection;
+import javax.persistence.Embedded;
 import org.joda.time.DateTime;

 /**
- * Common transfer data for {@link EppResource} types. Only applies to domains and contacts;
- * hosts are implicitly transferred with their superordinate domain.
+ * Common transfer data for {@link EppResource} types. Only applies to domains and contacts; hosts
+ * are implicitly transferred with their superordinate domain.
 */
@Embed
@Unindex
+@javax.persistence.Embeddable
 public class TransferData extends BaseTransferObject implements Buildable {

  public static final TransferData EMPTY = new TransferData();

  /** The transaction id of the most recent transfer request (or null if there never was one). */
-  Trid transferRequestTrid;
+  @Embedded Trid transferRequestTrid;

  /**
   * The period to extend the registration upon completion of the transfer.
@@ -52,7 +55,7 @@ public class TransferData extends BaseTransferObject implements Buildable {
   * <p>By default, domain transfers are for one year. This can be changed to zero by using the
   * superuser EPP extension.
   */
-  Period transferPeriod = Period.create(1, Unit.YEARS);
+  @Embedded Period transferPeriod = Period.create(1, Unit.YEARS);

  /**
   * The registration expiration time resulting from the approval - speculative or actual - of the
@@ -81,6 +84,7 @@ public class TransferData extends BaseTransferObject implements Buildable {
   * be deleted.
   */
  @IgnoreSave(IfNull.class)
+  @ElementCollection
  Set<Key<? extends TransferServerApproveEntity>> serverApproveEntities;

  /**
--- a/core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java
+++ b/core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java
@@ -30,6 +30,7 @@ import google.registry.ui.server.registrar.ConsoleUiAction;
 import google.registry.ui.server.registrar.OteStatusAction;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
 import google.registry.ui.server.registrar.RegistrarSettingsAction;
+import google.registry.ui.server.registrar.RegistryLockGetAction;

 /** Dagger component with per-request lifetime for "default" App Engine module. */
@RequestScope
@@ -50,6 +51,8 @@ interface FrontendRequestComponent {
  OteStatusAction oteStatusAction();
  RegistrarSettingsAction registrarSettingsAction();

+  RegistryLockGetAction registryLockGetAction();
+
  @Subcomponent.Builder
  abstract class Builder implements RequestComponentBuilder<FrontendRequestComponent> {
    @Override public abstract Builder requestModule(RequestModule requestModule);
--- a/core/src/main/java/google/registry/persistence/BloomFilterConverter.java
+++ b/core/src/main/java/google/registry/persistence/BloomFilterConverter.java
@@ -0,0 +1,59 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.hash.Funnels.stringFunnel;
+
+import com.google.common.hash.BloomFilter;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA converter for ASCII String {@link BloomFilter}s. */
+@Converter(autoApply = true)
+public class BloomFilterConverter implements AttributeConverter<BloomFilter<String>, byte[]> {
+
+  @Override
+  @Nullable
+  public byte[] convertToDatabaseColumn(@Nullable BloomFilter<String> entity) {
+    if (entity == null) {
+      return null;
+    }
+    ByteArrayOutputStream bos = new ByteArrayOutputStream();
+    try {
+      entity.writeTo(bos);
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error saving Bloom filter data", e);
+    }
+    return bos.toByteArray();
+  }
+
+  @Override
+  @Nullable
+  public BloomFilter<String> convertToEntityAttribute(@Nullable byte[] columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    try {
+      return BloomFilter.readFrom(new ByteArrayInputStream(columnValue), stringFunnel(US_ASCII));
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error loading Bloom filter data", e);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/persistence/CreateAutoTimestampConverter.java
+++ b/core/src/main/java/google/registry/persistence/CreateAutoTimestampConverter.java
@@ -0,0 +1,49 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.MoreObjects.firstNonNull;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.util.DateTimeUtils;
+import java.sql.Timestamp;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+import org.joda.time.DateTime;
+
+/** JPA converter to for storing/retrieving CreateAutoTimestamp objects. */
+@Converter(autoApply = true)
+public class CreateAutoTimestampConverter
+    implements AttributeConverter<CreateAutoTimestamp, Timestamp> {
+
+  @Override
+  public Timestamp convertToDatabaseColumn(CreateAutoTimestamp entity) {
+    DateTime dateTime = firstNonNull(entity.getTimestamp(), jpaTm().getTransactionTime());
+    return Timestamp.from(DateTimeUtils.toZonedDateTime(dateTime).toInstant());
+  }
+
+  @Override
+  @Nullable
+  public CreateAutoTimestamp convertToEntityAttribute(@Nullable Timestamp columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    ZonedDateTime zdt = ZonedDateTime.ofInstant(columnValue.toInstant(), ZoneOffset.UTC);
+    return CreateAutoTimestamp.create(DateTimeUtils.toJodaDateTime(zdt));
+  }
+}
--- a/core/src/main/java/google/registry/persistence/CurrencyUnitConverter.java
+++ b/core/src/main/java/google/registry/persistence/CurrencyUnitConverter.java
@@ -0,0 +1,29 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import javax.annotation.Nullable;
+import javax.persistence.Converter;
+import org.joda.money.CurrencyUnit;
+
+/** JPA converter for {@link CurrencyUnit}s. */
+@Converter(autoApply = true)
+public class CurrencyUnitConverter extends ToStringConverterBase<CurrencyUnit> {
+
+  @Override
+  @Nullable
+  public CurrencyUnit convertToEntityAttribute(@Nullable String columnValue) {
+    return (columnValue == null) ? null : CurrencyUnit.of(columnValue);
+  }
+}
--- a/core/src/main/java/google/registry/persistence/DateTimeConverter.java
+++ b/core/src/main/java/google/registry/persistence/DateTimeConverter.java
@@ -0,0 +1,41 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static org.joda.time.DateTimeZone.UTC;
+
+import java.sql.Timestamp;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+import org.joda.time.DateTime;
+
+/** JPA converter to for storing/retrieving {@link org.joda.time.DateTime} objects. */
+@Converter(autoApply = true)
+public class DateTimeConverter implements AttributeConverter<DateTime, Timestamp> {
+
+  @Override
+  @Nullable
+  public Timestamp convertToDatabaseColumn(@Nullable DateTime attribute) {
+    return attribute == null ? null : new Timestamp(attribute.getMillis());
+  }
+
+  @Override
+  @Nullable
+  public DateTime convertToEntityAttribute(@Nullable Timestamp dbData) {
+    DateTime result = dbData == null ? null : new DateTime(dbData.getTime(), UTC);
+    return result;
+  }
+}
--- a/core/src/main/java/google/registry/persistence/EntityManagerFactoryProvider.java
+++ b/core/src/main/java/google/registry/persistence/EntityManagerFactoryProvider.java
@@ -1,67 +0,0 @@
-// Copyright 2019 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.persistence;
-
-import static google.registry.config.RegistryConfig.getHibernateConnectionIsolation;
-import static google.registry.config.RegistryConfig.getHibernateHikariConnectionTimeout;
-import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
-import static google.registry.config.RegistryConfig.getHibernateHikariMaximumPoolSize;
-import static google.registry.config.RegistryConfig.getHibernateHikariMinimumIdle;
-import static google.registry.config.RegistryConfig.getHibernateLogSqlQueries;
-
-import com.google.common.collect.ImmutableMap;
-import javax.persistence.EntityManagerFactory;
-import javax.persistence.Persistence;
-import org.hibernate.cfg.Environment;
-
-/** Factory class to provide {@link EntityManagerFactory} instance. */
-public class EntityManagerFactoryProvider {
-  // This name must be the same as the one defined in persistence.xml.
-  public static final String PERSISTENCE_UNIT_NAME = "nomulus";
-  public static final String HIKARI_CONNECTION_TIMEOUT = "hibernate.hikari.connectionTimeout";
-  public static final String HIKARI_MINIMUM_IDLE = "hibernate.hikari.minimumIdle";
-  public static final String HIKARI_MAXIMUM_POOL_SIZE = "hibernate.hikari.maximumPoolSize";
-  public static final String HIKARI_IDLE_TIMEOUT = "hibernate.hikari.idleTimeout";
-
-  private static ImmutableMap<String, String> getDefaultProperties() {
-    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
-
-    properties.put(Environment.DRIVER, "org.postgresql.Driver");
-    properties.put(
-        Environment.CONNECTION_PROVIDER,
-        "org.hibernate.hikaricp.internal.HikariCPConnectionProvider");
-    // Whether to automatically validate and export schema DDL to the database when the
-    // SessionFactory is created. Setting it to 'none' to turn off the feature.
-    properties.put(Environment.HBM2DDL_AUTO, "none");
-
-    properties.put(Environment.ISOLATION, getHibernateConnectionIsolation());
-    properties.put(Environment.SHOW_SQL, getHibernateLogSqlQueries());
-    properties.put(HIKARI_CONNECTION_TIMEOUT, getHibernateHikariConnectionTimeout());
-    properties.put(HIKARI_MINIMUM_IDLE, getHibernateHikariMinimumIdle());
-    properties.put(HIKARI_MAXIMUM_POOL_SIZE, getHibernateHikariMaximumPoolSize());
-    properties.put(HIKARI_IDLE_TIMEOUT, getHibernateHikariIdleTimeout());
-    return properties.build();
-  }
-
-  /** Constructs the {@link EntityManagerFactory} instance. */
-  public static EntityManagerFactory create(String jdbcUrl, String username, String password) {
-    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
-    properties.putAll(getDefaultProperties());
-    properties.put(Environment.URL, jdbcUrl);
-    properties.put(Environment.USER, username);
-    properties.put(Environment.PASS, password);
-    return Persistence.createEntityManagerFactory(PERSISTENCE_UNIT_NAME, properties.build());
-  }
-}
--- a/core/src/main/java/google/registry/persistence/HibernateSchemaExporter.java
+++ b/core/src/main/java/google/registry/persistence/HibernateSchemaExporter.java
@@ -0,0 +1,86 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Maps;
+import java.io.File;
+import java.util.EnumSet;
+import java.util.Map;
+import java.util.stream.Stream;
+import javax.persistence.AttributeConverter;
+import org.hibernate.boot.MetadataSources;
+import org.hibernate.boot.registry.StandardServiceRegistry;
+import org.hibernate.boot.registry.StandardServiceRegistryBuilder;
+import org.hibernate.cfg.Environment;
+import org.hibernate.tool.hbm2ddl.SchemaExport;
+import org.hibernate.tool.schema.TargetType;
+
+/** Utility class to export DDL script for given {@link javax.persistence.Entity} classes. */
+public class HibernateSchemaExporter {
+  private final String jdbcUrl;
+  private final String username;
+  private final String password;
+
+  private HibernateSchemaExporter(String jdbcUrl, String username, String password) {
+    this.jdbcUrl = jdbcUrl;
+    this.username = username;
+    this.password = password;
+  }
+
+  /** Constructs a {@link HibernateSchemaExporter} instance. */
+  public static HibernateSchemaExporter create(String jdbcUrl, String username, String password) {
+    return new HibernateSchemaExporter(jdbcUrl, username, password);
+  }
+
+  /** Exports DDL script to the {@code outputFile} for the given {@code entityClasses}. */
+  public void export(ImmutableList<Class> entityClasses, File outputFile) {
+    // Configure Hibernate settings.
+    Map<String, String> settings = Maps.newHashMap();
+    settings.put(Environment.DIALECT, NomulusPostgreSQLDialect.class.getName());
+    settings.put(Environment.URL, jdbcUrl);
+    settings.put(Environment.USER, username);
+    settings.put(Environment.PASS, password);
+    settings.put(Environment.HBM2DDL_AUTO, "none");
+    settings.put(Environment.SHOW_SQL, "true");
+    settings.put(
+        Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());
+
+    try (StandardServiceRegistry registry =
+        new StandardServiceRegistryBuilder().applySettings(settings).build()) {
+      MetadataSources metadata = new MetadataSources(registry);
+
+      // Note that we need to also add all converters to the Hibernate context because
+      // the entity class may use the customized type.
+      Stream.concat(entityClasses.stream(), findAllConverters().stream())
+          .forEach(metadata::addAnnotatedClass);
+
+      SchemaExport export = new SchemaExport();
+      export.setHaltOnError(true);
+      export.setFormat(true);
+      export.setDelimiter(";");
+      export.setOutputFile(outputFile.getAbsolutePath());
+      export.createOnly(EnumSet.of(TargetType.SCRIPT), metadata.buildMetadata());
+    }
+  }
+
+  private ImmutableList<Class> findAllConverters() {
+    return PersistenceXmlUtility.getManagedClasses().stream()
+        .filter(AttributeConverter.class::isAssignableFrom)
+        .collect(toImmutableList());
+  }
+}
--- a/core/src/main/java/google/registry/persistence/NomulusNamingStrategy.java
+++ b/core/src/main/java/google/registry/persistence/NomulusNamingStrategy.java
@@ -0,0 +1,77 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import com.google.common.base.CaseFormat;
+import org.hibernate.boot.model.naming.Identifier;
+import org.hibernate.boot.model.naming.PhysicalNamingStrategy;
+import org.hibernate.engine.jdbc.env.spi.JdbcEnvironment;
+
+/**
+ * Nomulus naming strategy for Hibernate ORM.
+ *
+ * <p>This class applies the following naming strategies to protect readability of SQL statements:
+ *
+ * <ul>
+ *   <li>Table names are quoted UpperCamelCases.
+ *   <li>Column names are in lower_underscore format.
+ * </ul>
+ *
+ * These strategies ensure that both types of names are readable on case-insensitive platforms, and
+ * are easily distinguishable from each other.
+ *
+ * <p>The use of quoted names may introduce portability problems with hand-crafted SQL queries,
+ * e.g., between postgresql (which only accepts double-quotes) and MySQL(which only accepts
+ * back-quotes). This gives us incentives for adopting SQL query builders such as JOOQ for reporting
+ * etc.
+ */
+public class NomulusNamingStrategy implements PhysicalNamingStrategy {
+
+  @Override
+  public Identifier toPhysicalCatalogName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalSchemaName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalTableName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    if (name.isQuoted()) {
+      return name;
+    }
+    return jdbcEnvironment.getIdentifierHelper().toIdentifier(name.getText(), /* quoted= */ true);
+  }
+
+  @Override
+  public Identifier toPhysicalSequenceName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalColumnName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    if (name.isQuoted()) {
+      return name;
+    }
+    // Convert the lowerCamelCase field name into the snake_case column name
+    return jdbcEnvironment
+        .getIdentifierHelper()
+        .toIdentifier(
+            CaseFormat.LOWER_CAMEL.to(CaseFormat.LOWER_UNDERSCORE, name.getText()),
+            /* quoted= */ false);
+  }
+}
--- a/core/src/main/java/google/registry/persistence/NomulusPostgreSQLDialect.java
+++ b/core/src/main/java/google/registry/persistence/NomulusPostgreSQLDialect.java
@@ -0,0 +1,27 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import java.sql.Types;
+import org.hibernate.dialect.PostgreSQL95Dialect;
+
+/** Nomulus mapping rules for column types in Postgresql. */
+public class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
+  public NomulusPostgreSQLDialect() {
+    super();
+    registerColumnType(Types.VARCHAR, "text");
+    registerColumnType(Types.TIMESTAMP_WITH_TIMEZONE, "timestamptz");
+    registerColumnType(Types.TIMESTAMP, "timestamptz");
+  }
+}
--- a/core/src/main/java/google/registry/persistence/PersistenceComponent.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceComponent.java
@@ -0,0 +1,45 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import dagger.Component;
+import google.registry.config.CredentialModule;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.keyring.kms.KmsModule;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
+import google.registry.util.UtilsModule;
+import javax.inject.Singleton;
+import javax.persistence.EntityManagerFactory;
+
+/** Dagger component to provide {@link EntityManagerFactory} instances. */
+@Singleton
+@Component(
+    modules = {
+      ConfigModule.class,
+      CredentialModule.class,
+      KmsModule.class,
+      PersistenceModule.class,
+      UtilsModule.class
+    })
+public interface PersistenceComponent {
+
+  @AppEngineJpaTm
+  JpaTransactionManager appEngineJpaTransactionManager();
+
+  @NomulusToolJpaTm
+  JpaTransactionManager nomulusToolJpaTransactionManager();
+}
--- a/core/src/main/java/google/registry/persistence/PersistenceModule.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceModule.java
@@ -0,0 +1,174 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.base.Preconditions.checkState;
+import static google.registry.config.RegistryConfig.getHibernateConnectionIsolation;
+import static google.registry.config.RegistryConfig.getHibernateHikariConnectionTimeout;
+import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
+import static google.registry.config.RegistryConfig.getHibernateHikariMaximumPoolSize;
+import static google.registry.config.RegistryConfig.getHibernateHikariMinimumIdle;
+import static google.registry.config.RegistryConfig.getHibernateLogSqlQueries;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Maps;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.keyring.kms.KmsKeyring;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.model.transaction.JpaTransactionManagerImpl;
+import google.registry.util.Clock;
+import java.lang.annotation.Documented;
+import java.util.HashMap;
+import java.util.Map;
+import javax.inject.Qualifier;
+import javax.inject.Singleton;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import org.hibernate.cfg.Environment;
+
+/** Dagger module class for the persistence layer. */
+@Module
+public class PersistenceModule {
+  // This name must be the same as the one defined in persistence.xml.
+  public static final String PERSISTENCE_UNIT_NAME = "nomulus";
+  public static final String HIKARI_CONNECTION_TIMEOUT = "hibernate.hikari.connectionTimeout";
+  public static final String HIKARI_MINIMUM_IDLE = "hibernate.hikari.minimumIdle";
+  public static final String HIKARI_MAXIMUM_POOL_SIZE = "hibernate.hikari.maximumPoolSize";
+  public static final String HIKARI_IDLE_TIMEOUT = "hibernate.hikari.idleTimeout";
+
+  public static final String HIKARI_DS_SOCKET_FACTORY = "hibernate.hikari.dataSource.socketFactory";
+  public static final String HIKARI_DS_CLOUD_SQL_INSTANCE =
+      "hibernate.hikari.dataSource.cloudSqlInstance";
+
+  @Provides
+  @DefaultHibernateConfigs
+  public static ImmutableMap<String, String> providesDefaultDatabaseConfigs() {
+    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
+
+    properties.put(Environment.DRIVER, "org.postgresql.Driver");
+    properties.put(
+        Environment.CONNECTION_PROVIDER,
+        "org.hibernate.hikaricp.internal.HikariCPConnectionProvider");
+    // Whether to automatically validate and export schema DDL to the database when the
+    // SessionFactory is created. Setting it to 'none' to turn off the feature.
+    properties.put(Environment.HBM2DDL_AUTO, "none");
+
+    // Hibernate converts any date to this timezone when writing to the database.
+    properties.put(Environment.JDBC_TIME_ZONE, "UTC");
+    properties.put(
+        Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());
+
+    properties.put(Environment.ISOLATION, getHibernateConnectionIsolation());
+    properties.put(Environment.SHOW_SQL, getHibernateLogSqlQueries());
+    properties.put(HIKARI_CONNECTION_TIMEOUT, getHibernateHikariConnectionTimeout());
+    properties.put(HIKARI_MINIMUM_IDLE, getHibernateHikariMinimumIdle());
+    properties.put(HIKARI_MAXIMUM_POOL_SIZE, getHibernateHikariMaximumPoolSize());
+    properties.put(HIKARI_IDLE_TIMEOUT, getHibernateHikariIdleTimeout());
+    properties.put(Environment.DIALECT, NomulusPostgreSQLDialect.class.getName());
+    return properties.build();
+  }
+
+  @Provides
+  @Singleton
+  @PartialCloudSqlConfigs
+  public static ImmutableMap<String, String> providesPartialCloudSqlConfigs(
+      @Config("cloudSqlJdbcUrl") String jdbcUrl,
+      @Config("cloudSqlInstanceConnectionName") String instanceConnectionName,
+      @DefaultHibernateConfigs ImmutableMap<String, String> defaultConfigs) {
+    HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
+    overrides.put(Environment.URL, jdbcUrl);
+    overrides.put(HIKARI_DS_SOCKET_FACTORY, "com.google.cloud.sql.postgres.SocketFactory");
+    overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, instanceConnectionName);
+    return ImmutableMap.copyOf(overrides);
+  }
+
+  @Provides
+  @Singleton
+  @AppEngineJpaTm
+  public static JpaTransactionManager providesAppEngineJpaTm(
+      @Config("cloudSqlUsername") String username,
+      KmsKeyring kmsKeyring,
+      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
+    overrides.put(Environment.USER, username);
+    overrides.put(Environment.PASS, kmsKeyring.getCloudSqlPassword());
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  @Provides
+  @Singleton
+  @NomulusToolJpaTm
+  public static JpaTransactionManager providesNomulusToolJpaTm(
+      @Config("toolsCloudSqlUsername") String username,
+      KmsKeyring kmsKeyring,
+      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
+    overrides.put(Environment.USER, username);
+    overrides.put(Environment.PASS, kmsKeyring.getToolsCloudSqlPassword());
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  /** Constructs the {@link EntityManagerFactory} instance. */
+  @VisibleForTesting
+  public static EntityManagerFactory create(
+      String jdbcUrl, String username, String password, ImmutableMap<String, String> configs) {
+    HashMap<String, String> properties = Maps.newHashMap(configs);
+    properties.put(Environment.URL, jdbcUrl);
+    properties.put(Environment.USER, username);
+    properties.put(Environment.PASS, password);
+
+    return create(ImmutableMap.copyOf(properties));
+  }
+
+  private static EntityManagerFactory create(Map<String, String> properties) {
+    // If there are no annotated classes, we can create the EntityManagerFactory from the generic
+    // method.  Otherwise we have to use a more tailored approach.  Note that this adds to the set
+    // of annotated classes defined in the configuration, it does not override them.
+    EntityManagerFactory emf =
+        Persistence.createEntityManagerFactory(
+            PERSISTENCE_UNIT_NAME, ImmutableMap.copyOf(properties));
+    checkState(
+        emf != null,
+        "Persistence.createEntityManagerFactory() returns a null EntityManagerFactory");
+    return emf;
+  }
+
+  /** Dagger qualifier for {@link JpaTransactionManager} used for App Engine application. */
+  @Qualifier
+  @Documented
+  @interface AppEngineJpaTm {}
+
+  /** Dagger qualifier for {@link JpaTransactionManager} used for Nomulus tool. */
+  @Qualifier
+  @Documented
+  @interface NomulusToolJpaTm {}
+
+  /** Dagger qualifier for the partial Cloud SQL configs. */
+  @Qualifier
+  @Documented
+  @interface PartialCloudSqlConfigs {}
+
+  /** Dagger qualifier for the default Hibernate configurations. */
+  // TODO(shicong): Change annotations in this class to none public or put them in a top level
+  //  package
+  @Qualifier
+  @Documented
+  public @interface DefaultHibernateConfigs {}
+}
--- a/core/src/main/java/google/registry/persistence/PersistenceXmlUtility.java
+++ b/core/src/main/java/google/registry/persistence/PersistenceXmlUtility.java
@@ -0,0 +1,59 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+
+import com.google.common.collect.ImmutableList;
+import java.util.Properties;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
+
+/** Utility class that provides methods to manipulate persistence.xml file. */
+public class PersistenceXmlUtility {
+  private PersistenceXmlUtility() {}
+
+  /**
+   * Returns the {@link ParsedPersistenceXmlDescriptor} instance constructed from persistence.xml.
+   */
+  public static ParsedPersistenceXmlDescriptor getParsedPersistenceXmlDescriptor() {
+    return PersistenceXmlParser.locatePersistenceUnits(new Properties()).stream()
+        .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+        .findFirst()
+        .orElseThrow(
+            () ->
+                new IllegalArgumentException(
+                    String.format(
+                        "Could not find persistence unit with name %s",
+                        PersistenceModule.PERSISTENCE_UNIT_NAME)));
+  }
+
+  /** Returns all managed classes defined in persistence.xml. */
+  public static ImmutableList<Class> getManagedClasses() {
+    return getParsedPersistenceXmlDescriptor().getManagedClassNames().stream()
+        .map(
+            className -> {
+              try {
+                return Class.forName(className);
+              } catch (ClassNotFoundException e) {
+                throw new IllegalArgumentException(
+                    String.format(
+                        "Could not load class with name %s present in persistence.xml", className),
+                    e);
+              }
+            })
+        .collect(toImmutableList());
+  }
+}
--- a/core/src/main/java/google/registry/persistence/ToStringConverterBase.java
+++ b/core/src/main/java/google/registry/persistence/ToStringConverterBase.java
@@ -0,0 +1,27 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+
+/** Abstract JPA converter for objects that are stored by their toString() value. */
+abstract class ToStringConverterBase<T> implements AttributeConverter<T, String> {
+
+  @Override
+  @Nullable
+  public String convertToDatabaseColumn(@Nullable T entity) {
+    return (entity == null) ? null : entity.toString();
+  }
+}
--- a/core/src/main/java/google/registry/persistence/UpdateAutoTimestampConverter.java
+++ b/core/src/main/java/google/registry/persistence/UpdateAutoTimestampConverter.java
@@ -0,0 +1,46 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.UpdateAutoTimestamp;
+import google.registry.util.DateTimeUtils;
+import java.sql.Timestamp;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA converter for storing/retrieving UpdateAutoTimestamp objects. */
+@Converter(autoApply = true)
+public class UpdateAutoTimestampConverter
+    implements AttributeConverter<UpdateAutoTimestamp, Timestamp> {
+
+  @Override
+  public Timestamp convertToDatabaseColumn(UpdateAutoTimestamp entity) {
+    return Timestamp.from(DateTimeUtils.toZonedDateTime(jpaTm().getTransactionTime()).toInstant());
+  }
+
+  @Override
+  @Nullable
+  public UpdateAutoTimestamp convertToEntityAttribute(@Nullable Timestamp columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    ZonedDateTime zdt = ZonedDateTime.ofInstant(columnValue.toInstant(), ZoneOffset.UTC);
+    return UpdateAutoTimestamp.create(DateTimeUtils.toJodaDateTime(zdt));
+  }
+}
--- a/core/src/main/java/google/registry/persistence/ZonedDateTimeConverter.java
+++ b/core/src/main/java/google/registry/persistence/ZonedDateTimeConverter.java
@@ -0,0 +1,48 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.sql.Timestamp;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/**
+ * JPA converter to for storing/retrieving {@link ZonedDateTime} objects.
+ *
+ * <p>Hibernate provides a default converter for {@link ZonedDateTime}, but it converts timestamp to
+ * a non-normalized format, e.g., 2019-09-01T01:01:01Z will be converted to
+ * 2019-09-01T01:01:01Z[UTC]. This converter solves that problem by explicitly calling {@link
+ * ZoneId#normalized()} to normalize the zone id.
+ */
+@Converter(autoApply = true)
+public class ZonedDateTimeConverter implements AttributeConverter<ZonedDateTime, Timestamp> {
+
+  @Override
+  @Nullable
+  public Timestamp convertToDatabaseColumn(@Nullable ZonedDateTime attribute) {
+    return attribute == null ? null : Timestamp.from(attribute.toInstant());
+  }
+
+  @Override
+  @Nullable
+  public ZonedDateTime convertToEntityAttribute(@Nullable Timestamp dbData) {
+    return dbData == null
+        ? null
+        : ZonedDateTime.ofInstant(dbData.toInstant(), ZoneId.of("UTC").normalized());
+  }
+}
--- a/core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java
+++ b/core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java
@@ -39,6 +39,7 @@ import google.registry.util.Retrier;
 import google.registry.util.SendEmailService;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import javax.inject.Inject;
 import javax.mail.internet.InternetAddress;
@@ -102,7 +103,7 @@ public final class IcannReportingUploadAction implements Runnable {
                  final byte[] payload = readBytesFromGcs(gcsFilename);
                  return icannReporter.send(payload, reportFilename);
                },
-                IOException.class);
+                IcannReportingUploadAction::isUploadFailureRetryable);
      } catch (RuntimeException e) {
        logger.atWarning().withCause(e).log("Upload to %s failed.", gcsFilename);
      }
@@ -115,6 +116,21 @@ public final class IcannReportingUploadAction implements Runnable {
        String.format("OK, attempted uploading %d reports", manifestedFiles.size()));
  }

+  /** Don't retry when reports are already uploaded or can't be uploaded. */
+  private static final String ICANN_UPLOAD_PERMANENT_ERROR_MESSAGE =
+      "A report for that month already exists, the cut-off date already passed.";
+
+  /** Don't retry when the IP address isn't whitelisted, as retries go through the same IP. */
+  private static final Pattern ICANN_UPLOAD_WHITELIST_ERROR =
+      Pattern.compile("Your IP address .+ is not allowed to connect");
+
+  /** Predicate to retry uploads on IOException, so long as they aren't non-retryable errors. */
+  private static boolean isUploadFailureRetryable(Throwable e) {
+    return (e instanceof IOException)
+        && !e.getMessage().contains(ICANN_UPLOAD_PERMANENT_ERROR_MESSAGE)
+        && !ICANN_UPLOAD_WHITELIST_ERROR.matcher(e.getMessage()).matches();
+  }
+
  private void emailUploadResults(ImmutableMap<String, Boolean> reportSummary) {
    String subject = String.format(
        "ICANN Monthly report upload summary: %d/%d succeeded",
--- a/core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java
+++ b/core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java
@@ -347,7 +347,7 @@ public class AuthenticatedRegistrarAccessor {

  /** Exception thrown when the current user doesn't have access to the requested Registrar. */
  public static class RegistrarAccessDeniedException extends Exception {
-    RegistrarAccessDeniedException(String message) {
+    public RegistrarAccessDeniedException(String message) {
      super(message);
    }
  }
--- a/core/src/main/java/google/registry/schema/domain/RegistryLock.java
+++ b/core/src/main/java/google/registry/schema/domain/RegistryLock.java
@@ -0,0 +1,254 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.domain;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.toZonedDateTime;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
+import google.registry.util.DateTimeUtils;
+import java.time.ZonedDateTime;
+import java.util.Optional;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Index;
+import javax.persistence.Table;
+import org.joda.time.DateTime;
+
+/**
+ * Represents a registry lock/unlock object, meaning that the domain is locked on the registry
+ * level.
+ *
+ * <p>Registry locks must be requested through the registrar console by a lock-enabled contact, then
+ * confirmed through email within a certain length of time. Until that confirmation is processed,
+ * the completion time will remain null and the lock will have no effect. The same applies for
+ * unlock actions.
+ *
+ * <p>Note that there will be at most one row per domain with a null copmleted time -- this means
+ * that there is at most one pending action per domain. This is enforced at the logic level.
+ *
+ * <p>Note as well that in the case of a retry of a write after an unexpected success, the unique
+ * constraint on {@link #verificationCode} means that the second write will fail.
+ */
+@Entity
+@Table(
+    /**
+     * Unique constraint to get around Hibernate's failure to handle auto-increment field in
+     * composite primary key.
+     *
+     * <p>Note: indexes use the camelCase version of the field names because the {@link
+     * google.registry.persistence.NomulusNamingStrategy} does not translate the field name into the
+     * snake_case column name until the write itself.
+     */
+    indexes = {
+      @Index(
+          name = "idx_registry_lock_repo_id_revision_id",
+          columnList = "repoId, revisionId",
+          unique = true),
+      @Index(name = "idx_registry_lock_verification_code", columnList = "verificationCode"),
+      @Index(name = "idx_registry_lock_registrar_id", columnList = "registrarId")
+    })
+public final class RegistryLock extends ImmutableObject implements Buildable {
+
+  /** Describes the action taken by the user. */
+  public enum Action {
+    LOCK,
+    UNLOCK
+  }
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  @Column(nullable = false)
+  private Long revisionId;
+
+  /** EPP repo ID of the domain in question. */
+  @Column(nullable = false)
+  private String repoId;
+
+  // TODO (b/140568328): remove this when everything is in Cloud SQL and we can join on "domain"
+  @Column(nullable = false)
+  private String domainName;
+
+  /**
+   * The ID of the registrar that performed the action -- this may be the admin ID if this action
+   * was performed by a superuser.
+   */
+  @Column(nullable = false)
+  private String registrarId;
+
+  /** The POC that performed the action, or null if it was a superuser. */
+  private String registrarPocId;
+
+  /**
+   * Lock action is immutable and describes whether the action performed was a lock or an unlock.
+   */
+  @Enumerated(EnumType.STRING)
+  @Column(nullable = false)
+  private Action action;
+
+  /** Creation timestamp is when the lock/unlock is first requested. */
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  /**
+   * Completion timestamp is when the user has verified the lock/unlock, when this object de facto
+   * becomes immutable. If this field is null, it means that the lock has not been verified yet (and
+   * thus not been put into effect).
+   */
+  private ZonedDateTime completionTimestamp;
+
+  /**
+   * The user must provide the random verification code in order to complete the lock and move the
+   * status from PENDING to COMPLETED.
+   */
+  @Column(nullable = false)
+  private String verificationCode;
+
+  /**
+   * True iff this action was taken by a superuser, in response to something like a URS request. In
+   * this case, the action was performed by a registry admin rather than a registrar.
+   */
+  @Column(nullable = false)
+  private boolean isSuperuser;
+
+  public String getRepoId() {
+    return repoId;
+  }
+
+  public String getDomainName() {
+    return domainName;
+  }
+
+  public String getRegistrarId() {
+    return registrarId;
+  }
+
+  public String getRegistrarPocId() {
+    return registrarPocId;
+  }
+
+  public Action getAction() {
+    return action;
+  }
+
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
+  }
+
+  /** Returns the completion timestamp, or empty if this lock has not been completed yet. */
+  public Optional<DateTime> getCompletionTimestamp() {
+    return Optional.ofNullable(completionTimestamp).map(DateTimeUtils::toJodaDateTime);
+  }
+
+  public String getVerificationCode() {
+    return verificationCode;
+  }
+
+  public boolean isSuperuser() {
+    return isSuperuser;
+  }
+
+  public Long getRevisionId() {
+    return revisionId;
+  }
+
+  public void setCompletionTimestamp(DateTime dateTime) {
+    this.completionTimestamp = toZonedDateTime(dateTime);
+  }
+
+  public boolean isVerified() {
+    return completionTimestamp != null;
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for {@link google.registry.schema.domain.RegistryLock}. */
+  public static class Builder extends Buildable.Builder<RegistryLock> {
+    public Builder() {}
+
+    private Builder(RegistryLock instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistryLock build() {
+      checkArgumentNotNull(getInstance().repoId, "Repo ID cannot be null");
+      checkArgumentNotNull(getInstance().domainName, "Domain name cannot be null");
+      checkArgumentNotNull(getInstance().registrarId, "Registrar ID cannot be null");
+      checkArgumentNotNull(getInstance().action, "Action cannot be null");
+      checkArgumentNotNull(getInstance().verificationCode, "Verification codecannot be null");
+      checkArgument(
+          getInstance().registrarPocId != null || getInstance().isSuperuser,
+          "Registrar POC ID must be provided if superuser is false");
+      return super.build();
+    }
+
+    public Builder setRepoId(String repoId) {
+      getInstance().repoId = repoId;
+      return this;
+    }
+
+    public Builder setDomainName(String domainName) {
+      getInstance().domainName = domainName;
+      return this;
+    }
+
+    public Builder setRegistrarId(String registrarId) {
+      getInstance().registrarId = registrarId;
+      return this;
+    }
+
+    public Builder setRegistrarPocId(String registrarPocId) {
+      getInstance().registrarPocId = registrarPocId;
+      return this;
+    }
+
+    public Builder setAction(Action action) {
+      getInstance().action = action;
+      return this;
+    }
+
+    public Builder setCreationTimestamp(CreateAutoTimestamp creationTimestamp) {
+      getInstance().creationTimestamp = creationTimestamp;
+      return this;
+    }
+
+    public Builder setCompletionTimestamp(DateTime lockTimestamp) {
+      getInstance().completionTimestamp = toZonedDateTime(lockTimestamp);
+      return this;
+    }
+
+    public Builder setVerificationCode(String verificationCode) {
+      getInstance().verificationCode = verificationCode;
+      return this;
+    }
+
+    public Builder isSuperuser(boolean isSuperuser) {
+      getInstance().isSuperuser = isSuperuser;
+      return this;
+    }
+  }
+}
--- a/core/src/main/java/google/registry/schema/tld/PremiumList.java
+++ b/core/src/main/java/google/registry/schema/tld/PremiumList.java
@@ -0,0 +1,127 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.hash.Funnels.stringFunnel;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.hash.BloomFilter;
+import google.registry.model.CreateAutoTimestamp;
+import java.math.BigDecimal;
+import java.util.Map;
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Index;
+import javax.persistence.JoinColumn;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.Table;
+import org.joda.money.CurrencyUnit;
+import org.joda.time.DateTime;
+
+/**
+ * A list of premium prices for domain names.
+ *
+ * <p>Note that the primary key of this entity is {@link #revisionId}, which is auto-generated by
+ * the database. So, if a retry of insertion happens after the previous attempt unexpectedly
+ * succeeds, we will end up with having two exact same premium lists that differ only by revisionId.
+ * This is fine though, because we only use the list with the highest revisionId.
+ */
+@Entity
+@Table(indexes = {@Index(columnList = "name", name = "premiumlist_name_idx")})
+public class PremiumList {
+
+  @Column(nullable = false)
+  private String name;
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  @Column(nullable = false)
+  private Long revisionId;
+
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  @Column(nullable = false)
+  private CurrencyUnit currency;
+
+  @ElementCollection
+  @CollectionTable(
+      name = "PremiumEntry",
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel")
+  @Column(name = "price", nullable = false)
+  private Map<String, BigDecimal> labelsToPrices;
+
+  @Column(nullable = false)
+  private BloomFilter<String> bloomFilter;
+
+  private PremiumList(String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    this.name = name;
+    this.currency = currency;
+    this.labelsToPrices = labelsToPrices;
+    // ASCII is used for the charset because all premium list domain labels are stored punycoded.
+    this.bloomFilter = BloomFilter.create(stringFunnel(US_ASCII), labelsToPrices.size());
+    labelsToPrices.keySet().forEach(this.bloomFilter::put);
+  }
+
+  // Hibernate requires this default constructor.
+  private PremiumList() {}
+
+  /** Constructs a {@link PremiumList} object. */
+  public static PremiumList create(
+      String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    return new PremiumList(name, currency, labelsToPrices);
+  }
+
+  /** Returns the name of the premium list, which is usually also a TLD string. */
+  public String getName() {
+    return name;
+  }
+
+  /** Returns the ID of this revision, or throws if null. */
+  public Long getRevisionId() {
+    checkState(
+        revisionId != null, "revisionId is null because it is not persisted in the database");
+    return revisionId;
+  }
+
+  /** Returns the creation time of this revision of the premium list. */
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
+  }
+
+  /** Returns a {@link Map} of domain labels to prices. */
+  public ImmutableMap<String, BigDecimal> getLabelsToPrices() {
+    return ImmutableMap.copyOf(labelsToPrices);
+  }
+
+  /**
+   * Returns a Bloom filter to determine whether a label might be premium, or is definitely not.
+   *
+   * <p>If the domain label might be premium, then the next step is to check for the existence of a
+   * corresponding row in the PremiumListEntry table. Otherwise, we know for sure it's not premium,
+   * and no DB load is required.
+   */
+  public BloomFilter<String> getBloomFilter() {
+    return bloomFilter;
+  }
+}
--- a/Show More
+++ b/Show More