Use a single database container for all tests (#313 )

Update Spec11 email template (#308 )
* Changes to Spec11 notice email. * Fix lines that were too long
2026-07-10 18:13:02 +00:00 · 2019-10-15 15:09:03 -04:00 · 2019-10-14 12:23:28 -04:00 · 2019-10-11 14:24:01 -04:00 · 2019-10-11 12:31:34 -04:00 · 2019-10-10 16:32:21 -04:00
303 changed files with 17081 additions and 969 deletions
@@ -2,7 +2,7 @@

 | Internal Build | FOSS Build | LGTM | License | Code Search |
 |----------------|------------|------|---------|-------------|
-|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://github.com/sourcegraph/sourcegraph/blob/master/ui/assets/img/sourcegraph-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|
+|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://sourcegraph.com/.assets/img/sourcegraph-light-head-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|

 ![Nomulus logo](./nomulus-logo.png)

@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-apply from: "${rootDir.path}/projects.gradle"
 apply plugin: 'war'

 def environment = rootProject.environment
@@ -26,14 +25,19 @@ project.convention.plugins['war'].webAppDirName =

 apply plugin: 'com.google.cloud.tools.appengine'

+def coreResourcesDir = "${rootDir}/core/build/resources/main"
+
 // Get the web.xml file for the service.
 war {
    webInf {
        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
+
+        from("${coreResourcesDir}/META-INF/persistence.xml") {
+            into "classes/META-INF"
+        }
    }
 }

-def coreResourcesDir = "${rootDir}/core/build/resources/main"
 war {
    from("${coreResourcesDir}/google/registry/ui/html") {
        include "*.html"
@@ -68,6 +72,10 @@ appengine {
        if (!rootProject.prodOrSandboxEnv) {
            version = 'GCLOUD_CONFIG'
        }
+
+        // Don't set gcpProject directly, it gets overriden in ./build.gradle.
+        // Do -P environment={crash,alpha} instead.  For sandbox/production,
+        // use Spinnaker.
        projectId = gcpProject
    }
 }
@@ -76,6 +84,31 @@ dependencies {
    compile project(':core')
 }

+// The tools.jar file gets pulled in from the java environment and for some
+// reason gets exploded "readonly", causing subsequent builds to fail when
+// they can't overwrite it.  The hack below makes the file writable after
+// we're done exploding it.
+//
+// Fun fact: We only use this jar for documentation generation and as such we
+// don't need it in our warfile, as it is not used by the application at
+// runtime.  But it's not clear how to exclude it, as we seem to be
+// constructing the jar from the entire WEB-INF directory and per-file
+// exclude rules don't seem to work on it.  Better solutions are welcome :-)
+explodeWar.doLast {
+    file("${it.explodedAppDirectory}/WEB-INF/lib/tools.jar").setWritable(true)
+}
+
 rootProject.deploy.dependsOn appengineDeployAll
 rootProject.stage.dependsOn appengineStage
-appengineDeployAll.dependsOn rootProject.verifyDeployment
+
+// Impose verification for all of the deployment tasks.  We haven't found a
+// better way to do this other than to apply to each of them independently.
+// If a new task gets added, it will still fail if "environment"  is not defined
+// because gcpProject is null.  We just won't get as friendly an error message.
+appengineDeployAll.configure rootProject.verifyDeploymentConfig
+appengineDeploy.configure rootProject.verifyDeploymentConfig
+appengineDeployCron.configure rootProject.verifyDeploymentConfig
+appengineDeployDispatch.configure rootProject.verifyDeploymentConfig
+appengineDeployDos.configure rootProject.verifyDeploymentConfig
+appengineDeployIndex.configure rootProject.verifyDeploymentConfig
+appengineDeployQueue.configure rootProject.verifyDeploymentConfig
@@ -109,21 +109,61 @@ task deploy {
  description = 'Deploys all services to App Engine.'
 }

-task verifyDeployment {
-  group = 'deployment'
-  description = 'Ensure that one cannot deploy to production or sandbox.'
-  doFirst {
-    if (rootProject.prodOrSandboxEnv) {
-      throw new GradleException("Cannot deploy to production or sandbox.");
-    }
-  }
-}
-
 task stage {
  group = 'deployment'
  description = 'Generates application directories for all services.'
 }

+// App-engine environment configuration.  We set up all of the variables in
+// the root project.
+
+def environments = ['production', 'sandbox', 'alpha', 'crash']
+
+def gcpProject = null
+
+apply from: "${rootDir.path}/projects.gradle"
+
+if (environment == '') {
+    // Keep the project null, this will prevent deployment.  Set the
+    // environment to "alpha" because other code needs this property to
+    // explode the war file.
+    environment = 'alpha'
+} else if (environment != 'production' && environment != 'sandbox') {
+    gcpProject = projects[environment]
+    if (gcpProject == null) {
+        throw new GradleException("-Penvironment must be one of " +
+                                  "${projects.keySet()}.")
+    }
+}
+
+rootProject.ext.environment = environment
+rootProject.ext.gcpProject = gcpProject
+rootProject.ext.prodOrSandboxEnv = environment in ['production', 'sandbox']
+
+// Function to verify that the deployment parameters have been set.
+def verifyDeploymentParams() {
+    if (prodOrSandboxEnv) {
+        // Do not deploy to prod or sandbox. Print a prominent error in bright red.
+        System.err.println('\033[31;1m-----------------------------------------------------------------')
+        System.err.println('*** DANGER WILL ROBINSON!')
+        System.err.println('*** You may not deploy to production or sandbox from gradle.  Do a')
+        System.err.println('*** release from Spinnaker, see deployment playbook.')
+        System.err.println('-----------------------------------------------------------------')
+        throw new GradleException('Aborting. See prominent error above.')
+    } else if (gcpProject == null) {
+        def error = 'You must specify -P environment={alpha,crash}'
+        System.err.println("\033[33;1m${error}\033[0m")
+        throw GradleException("Aborting:  ${error}")
+    }
+}
+
+// Closure that we can just drop into all of our deployment tasks.
+rootProject.ext.verifyDeploymentConfig = {
+    doFirst { verifyDeploymentParams() }
+}
+
+// Subproject configuration.
+
 allprojects {
  // Skip no-op project
  if (project.name == 'services') return
@@ -178,10 +218,21 @@ subprojects {
        resolutionStrategy.activateDependencyLocking()
      }
    }
-    // Lock application dependencies except for the gradle-license-report
-    // plugin. See dependency_lic.gradle for more information.
-    configurations.findAll { it.name != 'dependencyLicenseReport' }.each {
-      it.resolutionStrategy.activateDependencyLocking()
+  }
+
+  afterEvaluate {
+    if (rootProject.enableDependencyLocking.toBoolean()) {
+      // Lock application dependencies except for the gradle-license-report
+      // plugin. See dependency_lic.gradle for the reason why.
+      //
+      // To selectively activate dependency locking without hardcoding them
+      // in the 'configurations' block, the following code must run after
+      // project evaluation, when all configurations have been created.
+      configurations.each {
+        if (it.name != 'dependencyLicenseReport') {
+          it.resolutionStrategy.activateDependencyLocking()
+        }
+      }
    }
  }

@@ -1 +1 @@
-enableDependencyLocking=false
+enableDependencyLocking=true
@@ -15,12 +15,13 @@ com.googlecode.javaewah:JavaEWAH:1.1.6
 com.jcraft:jsch:0.1.54
 com.jcraft:jzlib:1.1.1
 com.netflix.nebula:gradle-lint-plugin:10.4.2
-com.netflix.nebula:nebula-gradle-interop:1.0.7
-com.netflix.nebula:nebula-test:7.2.5
+com.netflix.nebula:nebula-gradle-interop:1.0.11
+com.netflix.nebula:nebula-test:7.3.0
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
 commons-lang:commons-lang:2.6
 commons-logging:commons-logging:1.2
+javax.inject:javax.inject:1
 junit:junit:4.12
 log4j:log4j:1.2.14
 nebula.lint:nebula.lint.gradle.plugin:10.4.2
@@ -35,10 +36,10 @@ org.apache.ant:ant:1.8.4
 org.apache.commons:commons-lang3:3.8.1
 org.apache.httpcomponents:httpclient:4.5.2
 org.apache.httpcomponents:httpcore:4.4.4
-org.apache.maven:maven-artifact:3.6.1
-org.apache.maven:maven-builder-support:3.6.1
-org.apache.maven:maven-model-builder:3.6.1
-org.apache.maven:maven-model:3.6.1
+org.apache.maven:maven-artifact:3.6.2
+org.apache.maven:maven-builder-support:3.6.2
+org.apache.maven:maven-model-builder:3.6.2
+org.apache.maven:maven-model:3.6.2
 org.codehaus.gpars:gpars:1.2.1
 org.codehaus.groovy:groovy-all:2.4.9
 org.codehaus.groovy:groovy-ant:2.1.8
@@ -47,17 +48,18 @@ org.codehaus.groovy:groovy-templates:2.1.8
 org.codehaus.groovy:groovy-xml:2.4.7
 org.codehaus.groovy:groovy:2.4.7
 org.codehaus.jsr166-mirror:jsr166y:1.7.0
-org.codehaus.plexus:plexus-component-annotations:1.7.1
 org.codehaus.plexus:plexus-interpolation:1.25
-org.codehaus.plexus:plexus-utils:3.2.0
+org.codehaus.plexus:plexus-utils:3.2.1
 org.codenarc:CodeNarc:0.25.2
 org.eclipse.jdt:core:3.1.1
 org.eclipse.jgit:org.eclipse.jgit:5.0.1.201806211838-r
+org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3
 org.gmetrics:GMetrics:0.7
 org.hamcrest:hamcrest-core:1.3
-org.jetbrains.kotlin:kotlin-stdlib-common:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib:1.3.11
+org.jetbrains.kotlin:kotlin-stdlib-common:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib:1.3.50
 org.jetbrains:annotations:13.0
 org.multiverse:multiverse-core:0.7.0
 org.objenesis:objenesis:2.4
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
+org.jacoco:org.jacoco.ant:0.8.4
+org.jacoco:org.jacoco.core:0.8.4
+org.jacoco:org.jacoco.report:0.8.4
+org.ow2.asm:asm-analysis:7.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:7.1
+org.ow2.asm:asm:7.1
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.2.0
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,8 +50,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
@@ -20,9 +20,9 @@ com.google.cloud:google-cloud-storage:1.59.0
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
-com.google.errorprone:error_prone_annotations:2.3.1
+com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -35,8 +35,8 @@ com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
 commons-codec:commons-codec:1.11
@@ -57,8 +57,8 @@ org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.mockito:mockito-core:2.25.0
@@ -114,6 +114,9 @@
    {
      "moduleLicense": "\\n                Dual license consisting of the CDDL v1.1 and GPL v2\\n            "
    },
+    {
+      "moduleLicense": "Eclipse Distribution License (New BSD License)"
+    },
    {
      "moduleLicense": "Eclipse Distribution License v. 1.0"
    },
@@ -56,7 +56,7 @@ def dockerIncompatibleTestPatterns = [
    // every file is read/write-able. There is no way to exclude specific test
    // methods, so we exclude the whole test class.
    "google/registry/tools/params/PathParameterTest.*",
-    "google/registry/persistence/EntityManagerFactoryProviderTest.*",
+    "google/registry/persistence/PersistenceModuleTest.*",
 ]

 // Tests that conflict with members of both the main test suite and the
@@ -168,6 +168,7 @@ dependencies {
  compile deps['com.google.appengine:appengine-remote-api']
  compile deps['com.google.auth:google-auth-library-credentials']
  compile deps['com.google.auth:google-auth-library-oauth2-http']
+  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -233,6 +234,7 @@ dependencies {
  // Known issue: nebula-lint misses inherited dependency.
  compile project(':third_party')
  compile project(':util')
+  testRuntime project(':db')

  // Include auto-value in compile until nebula-lint understands
  // annotationProcessor
@@ -556,10 +558,38 @@ artifacts {
  testRuntime testJar
 }

-task fragileTest(type: Test) {
+/**
+ * We have to break out the test suites because some of the tests conflict
+ * with one another, but unfortunately this breaks the "--tests" flag.  The
+ * --tests flag only applies to the task named on the command line (usually
+ * just "test"), not for all tasks of type "Test".
+ *
+ * As a better solution, FilteringTest sets testNameIncludePatterns (the
+ * internal property that --tests sets) from the value of the "testFilter"
+ * property, allowing us to filter across all the tests in core without
+ * explicitly specifying a test task or causing errors because there are no
+ * matching tests in the main task.
+ *
+ * To use it, define "testFilter" to be a comma-separated collection of class
+ * names (wildcards are allowed):
+ *
+ *   ./gradlew test -P testFilter=*.FooBar,google.registry.tools.ShellCommandTest
+ */
+class FilteringTest extends Test {
+
+  void setTests(List<String> tests) {
+    // Common exclude pattern. See README in parent directory for explanation.
+    exclude "**/*TestCase.*", "**/*TestSuite.*"
+    include tests
+    if (project.testFilter) {
+      testNameIncludePatterns = project.testFilter.split(',')
+    }
+  }
+}
+
+task fragileTest(type: FilteringTest) {
  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include fragileTestPatterns
+  tests = fragileTestPatterns

  if (rootProject.findProperty("skipDockerIncompatibleTests") == "true") {
    exclude dockerIncompatibleTestPatterns
@@ -569,10 +599,8 @@ task fragileTest(type: Test) {
  forkEvery 1
 }

-task outcastTest(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include outcastTestPatterns
+task outcastTest(type: FilteringTest) {
+  tests = outcastTestPatterns

  // Sets the maximum number of test executors that may exist at the same time.
  maxParallelForks 5
@@ -592,10 +620,44 @@ task findGoldenImages(type: JavaExec) {
  args arguments
 }

-task generateGoldenImages(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include "**/webdriver/*"
+// To run the nomulus tool with these command line tokens:
+// "--foo", "bar baz", "--qux=quz"
+//   gradle registryTool --args="--foo 'bar baz' --qux=quz"
+// or:
+//   gradle registryTool --PtoolArgs="--foo|bar baz|--qux=quz"
+// Note that the delimiting pipe can be backslash escaped if it is part of a
+// parameter.
+task registryTool(type: JavaExec) {
+  classpath = sourceSets.main.runtimeClasspath
+  main = 'google.registry.tools.RegistryTool'
+
+  // If "-PtoolArgs=..." is present in the command line, use it to set the args,
+  // otherwise use the default flag, which is "--args" to set the args.
+  doFirst {
+    def toolArgs = rootProject.findProperty("toolArgs")
+    if (toolArgs != null) {
+      def delimiter = '|'
+      toolArgs += delimiter
+      def argsList = []
+      def currArg = ''
+      for (def i = 0; i < toolArgs.length(); i++) {
+        def currChar = toolArgs[i]
+        if (currChar != delimiter) {
+          currArg += currChar
+        } else if (i != 0 && toolArgs[i - 1] == '\\') {
+          currArg = currArg.substring(0, currArg.length() - 1) + currChar
+        } else {
+          argsList.add(currArg)
+          currArg = ''
+        }
+      }
+      args = argsList
+    }
+  }
+}
+
+task generateGoldenImages(type: FilteringTest) {
+  tests = ["**/webdriver/*"]

  // Sets the maximum number of test executors that may exist at the same time.
  maxParallelForks 5
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
@@ -8,6 +9,7 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -80,7 +82,7 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -92,8 +94,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -108,9 +110,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -146,18 +153,23 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -169,20 +181,32 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -192,7 +216,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
@@ -8,6 +9,7 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -79,7 +81,7 @@ com.google.errorprone:error_prone_annotations:2.3.3
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -91,8 +93,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,9 +109,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -144,18 +151,23 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -167,20 +179,32 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -190,7 +214,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,246 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.github.luben:zstd-jni:1.3.8-3
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.9.2
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.11.0
+org.apache.beam:beam-model-pipeline:2.11.0
+org.apache.beam:beam-runners-core-construction-java:2.11.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
+org.apache.beam:beam-sdks-java-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
+org.apache.beam:beam-vendor-grpc-1_13_1:0.2
+org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:0.10.0
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
+org.jacoco:org.jacoco.ant:0.8.4
+org.jacoco:org.jacoco.core:0.8.4
+org.jacoco:org.jacoco.report:0.8.4
+org.ow2.asm:asm-analysis:7.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:7.1
+org.ow2.asm:asm:7.1
@@ -0,0 +1,235 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
+com.github.luben:zstd-jni:1.3.8-3
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.9.2
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.11.0
+org.apache.beam:beam-model-pipeline:2.11.0
+org.apache.beam:beam-runners-core-construction-java:2.11.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
+org.apache.beam:beam-sdks-java-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
+org.apache.beam:beam-vendor-grpc-1_13_1:0.2
+org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:0.10.0
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
@@ -8,6 +9,15 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -49,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -64,6 +75,8 @@ com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -80,7 +93,7 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:27.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -92,8 +105,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -108,11 +121,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
-com.sun.istack:istack-commons-runtime:3.0.5
-com.sun.xml.fastinfoset:FastInfoset:1.2.13
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -148,18 +164,23 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -171,34 +192,51 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
-org.glassfish.jaxb:jaxb-core:2.3.0
-org.glassfish.jaxb:jaxb-runtime:2.3.0
-org.glassfish.jaxb:txw2:2.3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
-org.jvnet.staxex:stax-ex:1.7.8
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
-org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-analysis:7.0
 org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
@@ -8,6 +9,7 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -81,8 +83,8 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -94,9 +96,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,8 +109,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -119,8 +121,11 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -162,6 +167,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
@@ -170,9 +176,9 @@ jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -185,7 +191,7 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -202,17 +208,28 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -222,7 +239,7 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -236,9 +253,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
@@ -8,6 +9,7 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -80,8 +82,8 @@ com.google.errorprone:error_prone_annotations:2.3.3
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -93,9 +95,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -106,8 +108,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -118,8 +120,11 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -160,6 +165,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
@@ -168,9 +174,9 @@ jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -183,7 +189,7 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -200,17 +206,28 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -220,7 +237,7 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -234,9 +251,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
@@ -0,0 +1,281 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.33
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.github.luben:zstd-jni:1.3.8-3
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-api-stubs:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.java-diff-utils:diffutils:1.3.0
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp3:okhttp:3.11.0
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.14.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.9.2
+junit:junit:4.12
+net.bytebuddy:byte-buddy-agent:1.9.7
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.11.0
+org.apache.beam:beam-model-pipeline:2.11.0
+org.apache.beam:beam-runners-core-construction-java:2.11.0
+org.apache.beam:beam-runners-direct-java:2.11.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
+org.apache.beam:beam-sdks-java-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
+org.apache.beam:beam-vendor-grpc-1_13_1:0.2
+org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-exec:1.3
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.ftpserver:ftplet-api:1.0.6
+org.apache.ftpserver:ftpserver-core:1.0.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.apache.mina:mina-core:2.0.4
+org.apache.sshd:sshd-core:2.0.0
+org.apache.sshd:sshd-scp:2.0.0
+org.apache.sshd:sshd-sftp:2.0.0
+org.apache.tomcat:tomcat-annotations-api:8.0.5
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-compat-qual:2.5.5
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.flywaydb:flyway-core:5.2.4
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-all:1.3
+org.hamcrest:hamcrest-core:1.3
+org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:0.10.0
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:2.25.0
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:2.6
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.seleniumhq.selenium:selenium-api:3.141.59
+org.seleniumhq.selenium:selenium-chrome-driver:3.141.59
+org.seleniumhq.selenium:selenium-edge-driver:3.141.59
+org.seleniumhq.selenium:selenium-firefox-driver:3.141.59
+org.seleniumhq.selenium:selenium-ie-driver:3.141.59
+org.seleniumhq.selenium:selenium-java:3.141.59
+org.seleniumhq.selenium:selenium-opera-driver:3.141.59
+org.seleniumhq.selenium:selenium-remote-driver:3.141.59
+org.seleniumhq.selenium:selenium-safari-driver:3.141.59
+org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
@@ -8,6 +9,15 @@ com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -49,6 +59,7 @@ com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
 com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
 com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
 com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
 com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
 com.google.appengine.tools:appengine-gcs-client:0.6
 com.google.appengine.tools:appengine-mapreduce:0.9
@@ -65,6 +76,8 @@ com.google.cloud.bigdataoss:gcsio:1.9.16
 com.google.cloud.bigdataoss:util:1.9.16
 com.google.cloud.bigtable:bigtable-client-core:1.8.0
 com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
 com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
 com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
 com.google.cloud:google-cloud-bigtable:0.73.0-alpha
@@ -81,8 +94,8 @@ com.google.flogger:flogger-system-backend:0.3.1
 com.google.flogger:flogger:0.3.1
 com.google.flogger:google-extensions:0.3.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:25.0-jre
-com.google.guava:guava:27.1-jre
+com.google.guava:guava-testlib:28.1-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.29.2
@@ -94,9 +107,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.4
-com.google.monitoring-client:metrics:1.0.4
-com.google.monitoring-client:stackdriver:1.0.4
+com.google.monitoring-client:contrib:1.0.6
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -107,8 +120,8 @@ com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.45
-com.google.truth:truth:0.45
+com.google.truth.extensions:truth-java8-extension:1.0
+com.google.truth:truth:1.0
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -119,10 +132,11 @@ com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp3:okhttp:3.11.0
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
-com.sun.istack:istack-commons-runtime:3.0.5
-com.sun.xml.fastinfoset:FastInfoset:1.2.13
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -164,6 +178,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
@@ -172,9 +187,9 @@ jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
-net.bytebuddy:byte-buddy:1.9.7
-net.java.dev.jna:jna-platform:5.2.0
-net.java.dev.jna:jna:5.2.0
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -187,7 +202,7 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.18
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
@@ -204,31 +219,40 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.5.2
+org.checkerframework:checker-qual:2.8.1
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
-org.glassfish.jaxb:jaxb-core:2.3.0
-org.glassfish.jaxb:jaxb-runtime:2.3.0
-org.glassfish.jaxb:txw2:2.3.0
+org.flywaydb:flyway-core:5.2.4
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
-org.jvnet.staxex:stax-ex:1.7.8
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:2.6
-org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-analysis:7.0
 org.ow2.asm:asm-commons:6.0
-org.ow2.asm:asm-tree:6.0
-org.ow2.asm:asm-util:6.0
-org.ow2.asm:asm:6.0
-org.rnorth.duct-tape:duct-tape:1.0.7
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
@@ -242,9 +266,12 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
-org.slf4j:slf4j-api:1.7.26
-org.testcontainers:selenium:1.10.7
-org.testcontainers:testcontainers:1.10.7
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:selenium:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
@@ -392,6 +392,24 @@ public final class RegistryConfig {
      return config.datastore.eppResourceIndexBucketsNum;
    }

+    @Provides
+    @Config("cloudSqlJdbcUrl")
+    public static String providesCloudSqlJdbcUrl(RegistryConfigSettings config) {
+      return config.cloudSql.jdbcUrl;
+    }
+
+    @Provides
+    @Config("cloudSqlUsername")
+    public static String providesCloudSqlUsername(RegistryConfigSettings config) {
+      return config.cloudSql.username;
+    }
+
+    @Provides
+    @Config("cloudSqlInstanceConnectionName")
+    public static String providesCloudSqlInstanceConnectionName(RegistryConfigSettings config) {
+      return config.cloudSql.instanceConnectionName;
+    }
+
    @Provides
    @Config("cloudDnsRootUrl")
    public static Optional<String> getCloudDnsRootUrl(RegistryConfigSettings config) {
@@ -1278,6 +1296,18 @@ public final class RegistryConfig {
      return config.registryTool.clientSecret;
    }

+    @Provides
+    @Config("toolsCloudSqlJdbcUrl")
+    public static String providesToolsCloudSqlJdbcUrl(RegistryConfigSettings config) {
+      return config.registryTool.jdbcUrl;
+    }
+
+    @Provides
+    @Config("toolsCloudSqlUsername")
+    public static String providesToolsCloudSqlUsername(RegistryConfigSettings config) {
+      return config.registryTool.username;
+    }
+
    @Provides
    @Config("rdapTos")
    public static ImmutableList<String> provideRdapTos(RegistryConfigSettings config) {
@@ -1469,11 +1499,6 @@ public final class RegistryConfig {
    return CONFIG_SETTINGS.get().hibernate.logSqlQueries;
  }

-  /** Returns true if schema modification is allowed. */
-  public static String getHibernateHbm2ddlAuto() {
-    return CONFIG_SETTINGS.get().hibernate.hbm2ddlAuto;
-  }
-
  /** Returns the connection timeout for HikariCP. */
  public static String getHibernateHikariConnectionTimeout() {
    return CONFIG_SETTINGS.get().hibernate.hikariConnectionTimeout;
@@ -26,6 +26,7 @@ public class RegistryConfigSettings {
  public RegistryPolicy registryPolicy;
  public Datastore datastore;
  public Hibernate hibernate;
+  public CloudSql cloudSql;
  public CloudDns cloudDns;
  public Caching caching;
  public IcannReporting icannReporting;
@@ -110,13 +111,19 @@ public class RegistryConfigSettings {
  public static class Hibernate {
    public String connectionIsolation;
    public String logSqlQueries;
-    public String hbm2ddlAuto;
    public String hikariConnectionTimeout;
    public String hikariMinimumIdle;
    public String hikariMaximumPoolSize;
    public String hikariIdleTimeout;
  }

+  /** Configuration for Cloud SQL. */
+  public static class CloudSql {
+    public String jdbcUrl;
+    public String username;
+    public String instanceConnectionName;
+  }
+
  /** Configuration for Apache Beam (Cloud Dataflow). */
  public static class Beam {
    public String defaultJobZone;
@@ -206,5 +213,7 @@ public class RegistryConfigSettings {
  public static class RegistryTool {
    public String clientId;
    public String clientSecret;
+    public String jdbcUrl;
+    public String username;
  }
 }
@@ -211,6 +211,14 @@ hibernate:
  hikariMaximumPoolSize: 20
  hikariIdleTimeout: 300000

+cloudSql:
+  # jdbc url for the Cloud SQL database.
+  jdbcUrl: jdbc:postgresql://localhost
+  # Username for the database user.
+  username: username
+  # This name is used by Cloud SQL when connecting to the database.
+  instanceConnectionName: project-id:region:instance-id
+
 cloudDns:
  # Set both properties to null in Production.
  # The root url for the Cloud DNS API.  Set this to a non-null value to
@@ -414,3 +422,6 @@ registryTool:
  clientId: YOUR_CLIENT_ID
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
+  # Nomulus tool uses a different jdbc url and user to connect to Cloud SQL
+  jdbcUrl: jdbc:postgresql://localhost/tool
+  username: toolusername
@@ -144,7 +144,7 @@
  <cron>
    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
    <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
    </description>
    <schedule>every 12 hours synchronized</schedule>
    <target>backend</target>
@@ -112,7 +112,7 @@
  <cron>
    <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
    <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
    </description>
    <schedule>every 12 hours synchronized</schedule>
    <target>backend</target>
@@ -56,7 +56,7 @@ import javax.inject.Inject;
 import org.joda.time.DateTime;

 /**
- * A mapreduce that exports the list of active domains on all real TLDs to Google Cloud Storage.
+ * A mapreduce that exports the list of active domains on all real TLDs to Google Drive and GCS.
 *
 * <p>Each TLD's active domain names are exported as a newline-delimited flat text file with the
 * name TLD.txt into the domain-lists bucket. Note that this overwrites the files in place.
@@ -122,7 +122,9 @@ public abstract class DummyKeyringModule {
        "not a real login",
        "not a real password",
        "not a real login",
-        "not a real credential");
+        "not a real credential",
+        "not a real password",
+        "not a real password");
  }

  private DummyKeyringModule() {}
@@ -39,6 +39,8 @@ public final class InMemoryKeyring implements Keyring {
  private final String marksdbLordnPassword;
  private final String marksdbSmdrlLoginAndPassword;
  private final String jsonCredential;
+  private final String cloudSqlPassword;
+  private final String toolsCloudSqlPassword;

  public InMemoryKeyring(
      PGPKeyPair rdeStagingKey,
@@ -53,7 +55,9 @@ public final class InMemoryKeyring implements Keyring {
      String marksdbDnlLoginAndPassword,
      String marksdbLordnPassword,
      String marksdbSmdrlLoginAndPassword,
-      String jsonCredential) {
+      String jsonCredential,
+      String cloudSqlPassword,
+      String toolsCloudSqlPassword) {
    checkArgument(PgpHelper.isSigningKey(rdeSigningKey.getPublicKey()),
        "RDE signing key must support signing: %s", rdeSigningKey.getKeyID());
    checkArgument(rdeStagingKey.getPublicKey().isEncryptionKey(),
@@ -79,6 +83,8 @@ public final class InMemoryKeyring implements Keyring {
    this.marksdbSmdrlLoginAndPassword =
        checkNotNull(marksdbSmdrlLoginAndPassword, "marksdbSmdrlLoginAndPassword");
    this.jsonCredential = checkNotNull(jsonCredential, "jsonCredential");
+    this.cloudSqlPassword = checkNotNull(cloudSqlPassword, "cloudSqlPassword");
+    this.toolsCloudSqlPassword = checkNotNull(toolsCloudSqlPassword, "toolsCloudSqlPassword");
  }

  @Override
@@ -151,6 +157,16 @@ public final class InMemoryKeyring implements Keyring {
    return jsonCredential;
  }

+  @Override
+  public String getCloudSqlPassword() {
+    return cloudSqlPassword;
+  }
+
+  @Override
+  public String getToolsCloudSqlPassword() {
+    return toolsCloudSqlPassword;
+  }
+
  /** Does nothing. */
  @Override
  public void close() {}
@@ -36,6 +36,18 @@ public final class KeyModule {
    String value();
  }

+  @Provides
+  @Key("cloudSqlPassword")
+  static String providesCloudSqlPassword(Keyring keyring) {
+    return keyring.getCloudSqlPassword();
+  }
+
+  @Provides
+  @Key("toolsCloudSqlPassword")
+  static String providesToolsCloudSqlPassword(Keyring keyring) {
+    return keyring.getToolsCloudSqlPassword();
+  }
+
  @Provides
  @Key("brdaReceiverKey")
  static PGPPublicKey provideBrdaReceiverKey(Keyring keyring) {
@@ -28,6 +28,12 @@ import org.bouncycastle.openpgp.PGPPublicKey;
@ThreadSafe
 public interface Keyring extends AutoCloseable {

+  /** Returns the password which is used by App Engine to connect to the Cloud SQL database. */
+  String getCloudSqlPassword();
+
+  /** Returns the password which is used by nomulus tool to connect to the Cloud SQL database. */
+  String getToolsCloudSqlPassword();
+
  /**
   * Returns the key which should be used to sign RDE deposits being uploaded to a third-party.
   *
@@ -67,6 +67,7 @@ public class KmsKeyring implements Keyring {

  /** Key labels for string secrets. */
  enum StringKeyLabel {
+    CLOUD_SQL_PASSWORD_STRING,
    SAFE_BROWSING_API_KEY,
    ICANN_REPORTING_PASSWORD_STRING,
    JSON_CREDENTIAL_STRING,
@@ -74,7 +75,8 @@ public class KmsKeyring implements Keyring {
    MARKSDB_LORDN_PASSWORD_STRING,
    MARKSDB_SMDRL_LOGIN_STRING,
    RDE_SSH_CLIENT_PRIVATE_STRING,
-    RDE_SSH_CLIENT_PUBLIC_STRING;
+    RDE_SSH_CLIENT_PUBLIC_STRING,
+    TOOLS_CLOUD_SQL_PASSWORD_STRING;

    String getLabel() {
      return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
@@ -88,6 +90,16 @@ public class KmsKeyring implements Keyring {
    this.kmsConnection = kmsConnection;
  }

+  @Override
+  public String getCloudSqlPassword() {
+    return getString(StringKeyLabel.CLOUD_SQL_PASSWORD_STRING);
+  }
+
+  @Override
+  public String getToolsCloudSqlPassword() {
+    return getString(StringKeyLabel.TOOLS_CLOUD_SQL_PASSWORD_STRING);
+  }
+
  @Override
  public PGPKeyPair getRdeSigningKey() {
    return getKeyPair(PrivateKeyLabel.RDE_SIGNING_PRIVATE);
@@ -24,6 +24,7 @@ import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.BRDA_SIGNING
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_RECEIVER_PUBLIC;
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_SIGNING_PUBLIC;
 import static google.registry.keyring.kms.KmsKeyring.PublicKeyLabel.RDE_STAGING_PUBLIC;
+import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.CLOUD_SQL_PASSWORD_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.ICANN_REPORTING_PASSWORD_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.JSON_CREDENTIAL_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.MARKSDB_DNL_LOGIN_STRING;
@@ -32,6 +33,7 @@ import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.MARKSDB_SMDR
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.RDE_SSH_CLIENT_PRIVATE_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.RDE_SSH_CLIENT_PUBLIC_STRING;
 import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.SAFE_BROWSING_API_KEY;
+import static google.registry.keyring.kms.KmsKeyring.StringKeyLabel.TOOLS_CLOUD_SQL_PASSWORD_STRING;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
@@ -69,6 +71,10 @@ public final class KmsUpdater {
    this.secretValues = new LinkedHashMap<>();
  }

+  public KmsUpdater setCloudSqlPassword(String password) {
+    return setString(password, CLOUD_SQL_PASSWORD_STRING);
+  }
+
  public KmsUpdater setRdeSigningKey(PGPKeyPair keyPair) throws IOException, PGPException {
    return setKeyPair(keyPair, RDE_SIGNING_PRIVATE, RDE_SIGNING_PUBLIC);
  }
@@ -101,6 +107,10 @@ public final class KmsUpdater {
    return setString(apiKey, SAFE_BROWSING_API_KEY);
  }

+  public KmsUpdater setToolsCloudSqlPassword(String password) {
+    return setString(password, TOOLS_CLOUD_SQL_PASSWORD_STRING);
+  }
+
  public KmsUpdater setIcannReportingPassword(String password) {
    return setString(password, ICANN_REPORTING_PASSWORD_STRING);
  }
@@ -89,7 +89,7 @@ import org.joda.time.Interval;
@ReportedOn
@Entity
@javax.persistence.Entity
-@javax.persistence.Table(name = "domain")
+@javax.persistence.Table(name = "Domain")
@ExternalMessagingName("domain")
 public class DomainBase extends EppResource
    implements ForeignKeyedEppResource, ResourceWithTransferData {
@@ -14,7 +14,6 @@

 package google.registry.model.ofy;

-
 import static google.registry.model.ofy.ObjectifyService.ofy;

 import google.registry.model.transaction.TransactionManager;
@@ -0,0 +1,52 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registry;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.schema.domain.RegistryLock;
+import javax.persistence.EntityManager;
+
+/** Data access object for {@link google.registry.schema.domain.RegistryLock}. */
+public final class RegistryLockDao {
+
+  /**
+   * Returns the most recent version of the {@link RegistryLock} referred to by the verification
+   * code (there may be two instances of the same code in the database--one after lock object
+   * creation and one after verification.
+   */
+  public static RegistryLock getByVerificationCode(String verificationCode) {
+    return jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Long revisionId =
+                  em.createQuery(
+                          "SELECT MAX(revisionId) FROM RegistryLock WHERE verificationCode ="
+                              + " :verificationCode",
+                          Long.class)
+                      .setParameter("verificationCode", verificationCode)
+                      .getSingleResult();
+              checkNotNull(revisionId, "No registry lock with this code");
+              return em.find(RegistryLock.class, revisionId);
+            });
+  }
+
+  public static void save(RegistryLock registryLock) {
+    checkNotNull(registryLock, "Null registry lock cannot be saved");
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(registryLock));
+  }
+}
@@ -0,0 +1,72 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.tmch;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.schema.tmch.ClaimsList;
+import javax.persistence.EntityManager;
+
+/** Data access object for {@link ClaimsList}. */
+public class ClaimsListDao {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static void save(ClaimsList claimsList) {
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(claimsList));
+  }
+
+  /**
+   * Try to save the given {@link ClaimsList} into Cloud SQL. If the save fails, the error will be
+   * logged but no exception will be thrown.
+   *
+   * <p>This method is used during the dual-write phase of database migration as Datastore is still
+   * the authoritative database.
+   */
+  public static void trySave(ClaimsList claimsList) {
+    try {
+      ClaimsListDao.save(claimsList);
+      logger.atInfo().log(
+          "Inserted %,d claims into Cloud SQL, created at %s",
+          claimsList.getLabelsToKeys().size(), claimsList.getTmdbGenerationTime());
+    } catch (Throwable e) {
+      logger.atSevere().withCause(e).log("Error inserting claims into Cloud SQL");
+    }
+  }
+
+  /**
+   * Returns the current revision of the {@link ClaimsList} in Cloud SQL. Throws exception if there
+   * is no claims in the table.
+   */
+  public static ClaimsList getCurrent() {
+    return jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Long revisionId =
+                  em.createQuery("SELECT MAX(revisionId) FROM ClaimsList", Long.class)
+                      .getSingleResult();
+              return em.createQuery(
+                      "FROM ClaimsList cl LEFT JOIN FETCH cl.labelsToKeys WHERE cl.revisionId ="
+                          + " :revisionId",
+                      ClaimsList.class)
+                  .setParameter("revisionId", revisionId)
+                  .getSingleResult();
+            });
+  }
+
+  private ClaimsListDao() {}
+}
@@ -217,8 +217,7 @@ public class ClaimsListShard extends ImmutableObject {
            });
  }

-  public static ClaimsListShard create(
-      DateTime creationTime, ImmutableMap<String, String> labelsToKeys) {
+  public static ClaimsListShard create(DateTime creationTime, Map<String, String> labelsToKeys) {
    ClaimsListShard instance = new ClaimsListShard();
    instance.id = allocateId();
    instance.creationTime = checkNotNull(creationTime);
@@ -0,0 +1,44 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import java.lang.reflect.Proxy;
+
+/**
+ * A dummy implementation for {@link JpaTransactionManager} which throws exception when any of its
+ * method is invoked.
+ *
+ * <p>This is used to initialize the {@link TransactionManagerFactory#jpaTm} when running unit
+ * tests, because obviously we cannot connect to the actual Cloud SQL backend in a unit test.
+ *
+ * <p>If a unit test needs to access the Cloud SQL database, it must add JpaTransactionManagerRule
+ * as a JUnit rule in the test class.
+ */
+public class DummyJpaTransactionManager {
+
+  /** Constructs a dummy {@link JpaTransactionManager} instance. */
+  public static JpaTransactionManager create() {
+    return (JpaTransactionManager)
+        Proxy.newProxyInstance(
+            JpaTransactionManager.class.getClassLoader(),
+            new Class[] {JpaTransactionManager.class},
+            (proxy, method, args) -> {
+              throw new UnsupportedOperationException(
+                  "JpaTransactionManager was not initialized as the runtime is detected as"
+                      + " Unittest. Add JpaTransactionManagerRule in the unit test for"
+                      + " initialization.");
+            });
+  }
+}
@@ -0,0 +1,23 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import javax.persistence.EntityManager;
+
+/** Sub-interface of {@link TransactionManager} which defines JPA related methods. */
+public interface JpaTransactionManager extends TransactionManager {
+  /** Returns the {@link EntityManager} for the current request. */
+  EntityManager getEntityManager();
+}
@@ -0,0 +1,163 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.util.Clock;
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.EntityTransaction;
+import javax.persistence.PersistenceException;
+import org.joda.time.DateTime;
+
+/** Implementation of {@link JpaTransactionManager} for JPA compatible database. */
+public class JpaTransactionManagerImpl implements JpaTransactionManager {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  // EntityManagerFactory is thread safe.
+  private final EntityManagerFactory emf;
+  private final Clock clock;
+  // TODO(shicong): Investigate alternatives for managing transaction information. ThreadLocal adds
+  //  an unnecessary restriction that each request has to be processed by one thread synchronously.
+  private final ThreadLocal<TransactionInfo> transactionInfo =
+      ThreadLocal.withInitial(TransactionInfo::new);
+
+  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock) {
+    this.emf = emf;
+    this.clock = clock;
+  }
+
+  @Override
+  public EntityManager getEntityManager() {
+    if (transactionInfo.get().entityManager == null) {
+      throw new PersistenceException(
+          "No EntityManager has been initialized. getEntityManager() must be invoked in the scope"
+              + " of a transaction");
+    }
+    return transactionInfo.get().entityManager;
+  }
+
+  @Override
+  public boolean inTransaction() {
+    return transactionInfo.get().inTransaction;
+  }
+
+  @Override
+  public void assertInTransaction() {
+    if (!inTransaction()) {
+      throw new PersistenceException("Not in a transaction");
+    }
+  }
+
+  @Override
+  public <T> T transact(Work<T> work) {
+    // TODO(shicong): Investigate removing transactNew functionality after migration as it may
+    //  be same as this one.
+    if (inTransaction()) {
+      return work.run();
+    }
+    TransactionInfo txnInfo = transactionInfo.get();
+    txnInfo.entityManager = emf.createEntityManager();
+    EntityTransaction txn = txnInfo.entityManager.getTransaction();
+    try {
+      txn.begin();
+      txnInfo.inTransaction = true;
+      txnInfo.transactionTime = clock.nowUtc();
+      T result = work.run();
+      txn.commit();
+      return result;
+    } catch (Throwable transactionException) {
+      String rollbackMessage;
+      try {
+        txn.rollback();
+        rollbackMessage = "transaction rolled back";
+      } catch (Throwable rollbackException) {
+        logger.atSevere().withCause(rollbackException).log("Rollback failed, suppressing error");
+        rollbackMessage = "transaction rollback failed";
+      }
+      throw new PersistenceException(
+          "Error during transaction, " + rollbackMessage, transactionException);
+    } finally {
+      txnInfo.clear();
+    }
+  }
+
+  @Override
+  public void transact(Runnable work) {
+    transact(
+        () -> {
+          work.run();
+          return null;
+        });
+  }
+
+  @Override
+  public <T> T transactNew(Work<T> work) {
+    // TODO(shicong): Implements the functionality to start a new transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public void transactNew(Runnable work) {
+    // TODO(shicong): Implements the functionality to start a new transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public <T> T transactNewReadOnly(Work<T> work) {
+    // TODO(shicong): Implements read only transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public void transactNewReadOnly(Runnable work) {
+    // TODO(shicong): Implements read only transaction.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public <T> T doTransactionless(Work<T> work) {
+    // TODO(shicong): Implements doTransactionless.
+    throw new UnsupportedOperationException();
+  }
+
+  @Override
+  public DateTime getTransactionTime() {
+    assertInTransaction();
+    TransactionInfo txnInfo = transactionInfo.get();
+    if (txnInfo.transactionTime == null) {
+      throw new PersistenceException("In a transaction but transactionTime is null");
+    }
+    return txnInfo.transactionTime;
+  }
+
+  private static class TransactionInfo {
+    EntityManager entityManager;
+    boolean inTransaction = false;
+    DateTime transactionTime;
+
+    private void clear() {
+      inTransaction = false;
+      transactionTime = null;
+      if (entityManager != null) {
+        // Close this EntityManager just let the connection pool be able to reuse it, it doesn't
+        // close the underlying database connection.
+        entityManager.close();
+        entityManager = null;
+      }
+    }
+  }
+}
@@ -14,24 +14,57 @@

 package google.registry.model.transaction;

+import com.google.common.annotations.VisibleForTesting;
 import google.registry.model.ofy.DatastoreTransactionManager;

 /** Factory class to create {@link TransactionManager} instance. */
+// TODO: Rename this to PersistenceFactory and move to persistence package.
 public class TransactionManagerFactory {

  private static final TransactionManager TM = createTransactionManager();
+  @VisibleForTesting static JpaTransactionManager jpaTm = createJpaTransactionManager();

  private TransactionManagerFactory() {}

+  private static JpaTransactionManager createJpaTransactionManager() {
+    // TODO(shicong): There is currently no environment where we want to create a real JPA
+    // transaction manager here.  The unit tests that require one are all set up using
+    // JpaTransactionManagerRule which launches its own PostgreSQL instance.  When we actually have
+    // PostgreSQL tables in production, ensure that all of the test environments are set up
+    // correctly and restore the code that creates a JpaTransactionManager when
+    // RegistryEnvironment.get() != UNITTEST.
+    //
+    // We removed the original code because it didn't work in sandbox (due to the absence of the
+    // persistence.xml file, which has since been added), and then (after adding this) didn't work
+    // in crash because the postgresql password hadn't been set up.  Prior to restoring, we'll need
+    // to do setup in all environments, and we probably only want to do this once we're actually
+    // using Cloud SQL for one of the new tables.
+    return DummyJpaTransactionManager.create();
+  }
+
  private static TransactionManager createTransactionManager() {
-    // TODO: Conditionally returns the corresponding implementation once we have
-    //  CloudSqlTransactionManager
+    // TODO: Determine how to provision TransactionManager after the dual-write. During the
+    // dual-write transitional phase, we need the TransactionManager for both Datastore and Cloud
+    // SQL, and this method returns the one for Datastore.
    return new DatastoreTransactionManager(null);
  }

+  /**
+   * Sets jpaTm to the implementation for Nomulus tool. Note that this method should be only used by
+   * {@link google.registry.tools.RegistryCli} to initialize jpaTm.
+   */
+  public static void initForTool() {
+    // TODO(shicong): Uncomment the line below when we set up Cloud SQL instance in all environments
+    // jpaTm = DaggerPersistenceComponent.create().nomulusToolJpaTransactionManager();
+  }
+
  /** Returns {@link TransactionManager} instance. */
  public static TransactionManager tm() {
-
    return TM;
  }
+
+  /** Returns {@link JpaTransactionManager} instance. */
+  public static JpaTransactionManager jpaTm() {
+    return jpaTm;
+  }
 }
@@ -0,0 +1,59 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.hash.Funnels.stringFunnel;
+
+import com.google.common.hash.BloomFilter;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA converter for ASCII String {@link BloomFilter}s. */
+@Converter(autoApply = true)
+public class BloomFilterConverter implements AttributeConverter<BloomFilter<String>, byte[]> {
+
+  @Override
+  @Nullable
+  public byte[] convertToDatabaseColumn(@Nullable BloomFilter<String> entity) {
+    if (entity == null) {
+      return null;
+    }
+    ByteArrayOutputStream bos = new ByteArrayOutputStream();
+    try {
+      entity.writeTo(bos);
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error saving Bloom filter data", e);
+    }
+    return bos.toByteArray();
+  }
+
+  @Override
+  @Nullable
+  public BloomFilter<String> convertToEntityAttribute(@Nullable byte[] columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    try {
+      return BloomFilter.readFrom(new ByteArrayInputStream(columnValue), stringFunnel(US_ASCII));
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error loading Bloom filter data", e);
+    }
+  }
+}
@@ -0,0 +1,49 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.MoreObjects.firstNonNull;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.util.DateTimeUtils;
+import java.sql.Timestamp;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+import org.joda.time.DateTime;
+
+/** JPA converter to for storing/retrieving CreateAutoTimestamp objects. */
+@Converter(autoApply = true)
+public class CreateAutoTimestampConverter
+    implements AttributeConverter<CreateAutoTimestamp, Timestamp> {
+
+  @Override
+  public Timestamp convertToDatabaseColumn(CreateAutoTimestamp entity) {
+    DateTime dateTime = firstNonNull(entity.getTimestamp(), jpaTm().getTransactionTime());
+    return Timestamp.from(DateTimeUtils.toZonedDateTime(dateTime).toInstant());
+  }
+
+  @Override
+  @Nullable
+  public CreateAutoTimestamp convertToEntityAttribute(@Nullable Timestamp columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    ZonedDateTime zdt = ZonedDateTime.ofInstant(columnValue.toInstant(), ZoneOffset.UTC);
+    return CreateAutoTimestamp.create(DateTimeUtils.toJodaDateTime(zdt));
+  }
+}
@@ -1,73 +0,0 @@
-// Copyright 2019 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.persistence;
-
-import static com.google.common.base.Preconditions.checkState;
-import static google.registry.config.RegistryConfig.getHibernateConnectionIsolation;
-import static google.registry.config.RegistryConfig.getHibernateHikariConnectionTimeout;
-import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
-import static google.registry.config.RegistryConfig.getHibernateHikariMaximumPoolSize;
-import static google.registry.config.RegistryConfig.getHibernateHikariMinimumIdle;
-import static google.registry.config.RegistryConfig.getHibernateLogSqlQueries;
-
-import com.google.common.collect.ImmutableMap;
-import javax.persistence.EntityManagerFactory;
-import javax.persistence.Persistence;
-import org.hibernate.cfg.Environment;
-
-/** Factory class to provide {@link EntityManagerFactory} instance. */
-public class EntityManagerFactoryProvider {
-  // This name must be the same as the one defined in persistence.xml.
-  public static final String PERSISTENCE_UNIT_NAME = "nomulus";
-  public static final String HIKARI_CONNECTION_TIMEOUT = "hibernate.hikari.connectionTimeout";
-  public static final String HIKARI_MINIMUM_IDLE = "hibernate.hikari.minimumIdle";
-  public static final String HIKARI_MAXIMUM_POOL_SIZE = "hibernate.hikari.maximumPoolSize";
-  public static final String HIKARI_IDLE_TIMEOUT = "hibernate.hikari.idleTimeout";
-
-  private static ImmutableMap<String, String> getDefaultProperties() {
-    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
-
-    properties.put(Environment.DRIVER, "org.postgresql.Driver");
-    properties.put(
-        Environment.CONNECTION_PROVIDER,
-        "org.hibernate.hikaricp.internal.HikariCPConnectionProvider");
-    // Whether to automatically validate and export schema DDL to the database when the
-    // SessionFactory is created. Setting it to 'none' to turn off the feature.
-    properties.put(Environment.HBM2DDL_AUTO, "none");
-
-    properties.put(Environment.ISOLATION, getHibernateConnectionIsolation());
-    properties.put(Environment.SHOW_SQL, getHibernateLogSqlQueries());
-    properties.put(HIKARI_CONNECTION_TIMEOUT, getHibernateHikariConnectionTimeout());
-    properties.put(HIKARI_MINIMUM_IDLE, getHibernateHikariMinimumIdle());
-    properties.put(HIKARI_MAXIMUM_POOL_SIZE, getHibernateHikariMaximumPoolSize());
-    properties.put(HIKARI_IDLE_TIMEOUT, getHibernateHikariIdleTimeout());
-    return properties.build();
-  }
-
-  /** Constructs the {@link EntityManagerFactory} instance. */
-  public static EntityManagerFactory create(String jdbcUrl, String username, String password) {
-    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
-    properties.putAll(getDefaultProperties());
-    properties.put(Environment.URL, jdbcUrl);
-    properties.put(Environment.USER, username);
-    properties.put(Environment.PASS, password);
-    EntityManagerFactory emf =
-        Persistence.createEntityManagerFactory(PERSISTENCE_UNIT_NAME, properties.build());
-    checkState(
-        emf != null,
-        "Persistence.createEntityManagerFactory() returns a null EntityManagerFactory");
-    return emf;
-  }
-}
@@ -0,0 +1,77 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import com.google.common.base.CaseFormat;
+import org.hibernate.boot.model.naming.Identifier;
+import org.hibernate.boot.model.naming.PhysicalNamingStrategy;
+import org.hibernate.engine.jdbc.env.spi.JdbcEnvironment;
+
+/**
+ * Nomulus naming strategy for Hibernate ORM.
+ *
+ * <p>This class applies the following naming strategies to protect readability of SQL statements:
+ *
+ * <ul>
+ *   <li>Table names are quoted UpperCamelCases.
+ *   <li>Column names are in lower_underscore format.
+ * </ul>
+ *
+ * These strategies ensure that both types of names are readable on case-insensitive platforms, and
+ * are easily distinguishable from each other.
+ *
+ * <p>The use of quoted names may introduce portability problems with hand-crafted SQL queries,
+ * e.g., between postgresql (which only accepts double-quotes) and MySQL(which only accepts
+ * back-quotes). This gives us incentives for adopting SQL query builders such as JOOQ for reporting
+ * etc.
+ */
+public class NomulusNamingStrategy implements PhysicalNamingStrategy {
+
+  @Override
+  public Identifier toPhysicalCatalogName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalSchemaName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalTableName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    if (name.isQuoted()) {
+      return name;
+    }
+    return jdbcEnvironment.getIdentifierHelper().toIdentifier(name.getText(), /* quoted= */ true);
+  }
+
+  @Override
+  public Identifier toPhysicalSequenceName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    return name;
+  }
+
+  @Override
+  public Identifier toPhysicalColumnName(Identifier name, JdbcEnvironment jdbcEnvironment) {
+    if (name.isQuoted()) {
+      return name;
+    }
+    // Convert the lowerCamelCase field name into the snake_case column name
+    return jdbcEnvironment
+        .getIdentifierHelper()
+        .toIdentifier(
+            CaseFormat.LOWER_CAMEL.to(CaseFormat.LOWER_UNDERSCORE, name.getText()),
+            /* quoted= */ false);
+  }
+}
@@ -0,0 +1,27 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import java.sql.Types;
+import org.hibernate.dialect.PostgreSQL95Dialect;
+
+/** Nomulus mapping rules for column types in Postgresql. */
+public class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
+  public NomulusPostgreSQLDialect() {
+    super();
+    registerColumnType(Types.VARCHAR, "text");
+    registerColumnType(Types.TIMESTAMP_WITH_TIMEZONE, "timestamptz");
+    registerColumnType(Types.TIMESTAMP, "timestamptz");
+  }
+}
@@ -0,0 +1,45 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import dagger.Component;
+import google.registry.config.CredentialModule;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.keyring.kms.KmsModule;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
+import google.registry.util.UtilsModule;
+import javax.inject.Singleton;
+import javax.persistence.EntityManagerFactory;
+
+/** Dagger component to provide {@link EntityManagerFactory} instances. */
+@Singleton
+@Component(
+    modules = {
+      ConfigModule.class,
+      CredentialModule.class,
+      KmsModule.class,
+      PersistenceModule.class,
+      UtilsModule.class
+    })
+public interface PersistenceComponent {
+
+  @AppEngineJpaTm
+  JpaTransactionManager appEngineJpaTransactionManager();
+
+  @NomulusToolJpaTm
+  JpaTransactionManager nomulusToolJpaTransactionManager();
+}
@@ -0,0 +1,175 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.base.Preconditions.checkState;
+import static google.registry.config.RegistryConfig.getHibernateConnectionIsolation;
+import static google.registry.config.RegistryConfig.getHibernateHikariConnectionTimeout;
+import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
+import static google.registry.config.RegistryConfig.getHibernateHikariMaximumPoolSize;
+import static google.registry.config.RegistryConfig.getHibernateHikariMinimumIdle;
+import static google.registry.config.RegistryConfig.getHibernateLogSqlQueries;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Maps;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.keyring.kms.KmsKeyring;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.model.transaction.JpaTransactionManagerImpl;
+import google.registry.util.Clock;
+import java.lang.annotation.Documented;
+import java.util.HashMap;
+import java.util.Map;
+import javax.inject.Qualifier;
+import javax.inject.Singleton;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import org.hibernate.cfg.Environment;
+
+/** Dagger module class for the persistence layer. */
+@Module
+public class PersistenceModule {
+  // This name must be the same as the one defined in persistence.xml.
+  public static final String PERSISTENCE_UNIT_NAME = "nomulus";
+  public static final String HIKARI_CONNECTION_TIMEOUT = "hibernate.hikari.connectionTimeout";
+  public static final String HIKARI_MINIMUM_IDLE = "hibernate.hikari.minimumIdle";
+  public static final String HIKARI_MAXIMUM_POOL_SIZE = "hibernate.hikari.maximumPoolSize";
+  public static final String HIKARI_IDLE_TIMEOUT = "hibernate.hikari.idleTimeout";
+
+  @Provides
+  @DefaultHibernateConfigs
+  public static ImmutableMap<String, String> providesDefaultDatabaseConfigs() {
+    ImmutableMap.Builder<String, String> properties = ImmutableMap.builder();
+
+    properties.put(Environment.DRIVER, "org.postgresql.Driver");
+    properties.put(
+        Environment.CONNECTION_PROVIDER,
+        "org.hibernate.hikaricp.internal.HikariCPConnectionProvider");
+    // Whether to automatically validate and export schema DDL to the database when the
+    // SessionFactory is created. Setting it to 'none' to turn off the feature.
+    properties.put(Environment.HBM2DDL_AUTO, "none");
+
+    // Hibernate converts any date to this timezone when writing to the database.
+    properties.put(Environment.JDBC_TIME_ZONE, "UTC");
+    properties.put(
+        Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());
+
+    properties.put(Environment.ISOLATION, getHibernateConnectionIsolation());
+    properties.put(Environment.SHOW_SQL, getHibernateLogSqlQueries());
+    properties.put(HIKARI_CONNECTION_TIMEOUT, getHibernateHikariConnectionTimeout());
+    properties.put(HIKARI_MINIMUM_IDLE, getHibernateHikariMinimumIdle());
+    properties.put(HIKARI_MAXIMUM_POOL_SIZE, getHibernateHikariMaximumPoolSize());
+    properties.put(HIKARI_IDLE_TIMEOUT, getHibernateHikariIdleTimeout());
+    properties.put(Environment.DIALECT, NomulusPostgreSQLDialect.class.getName());
+    return properties.build();
+  }
+
+  @Provides
+  @Singleton
+  @AppEngineJpaTm
+  public static JpaTransactionManager providesAppEngineJpaTm(
+      @Config("cloudSqlJdbcUrl") String jdbcUrl,
+      @Config("cloudSqlUsername") String username,
+      @Config("cloudSqlInstanceConnectionName") String instanceConnectionName,
+      KmsKeyring kmsKeyring,
+      @DefaultHibernateConfigs ImmutableMap<String, String> defaultConfigs,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
+
+    // For Java users, the Cloud SQL JDBC Socket Factory can provide authenticated connections.
+    // See https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory for details.
+    overrides.put("socketFactory", "com.google.cloud.sql.postgres.SocketFactory");
+    overrides.put("cloudSqlInstance", instanceConnectionName);
+
+    overrides.put(Environment.URL, jdbcUrl);
+    overrides.put(Environment.USER, username);
+    overrides.put(Environment.PASS, kmsKeyring.getCloudSqlPassword());
+
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  @Provides
+  @Singleton
+  @NomulusToolJpaTm
+  public static JpaTransactionManager providesNomulusToolJpaTm(
+      @Config("toolsCloudSqlJdbcUrl") String jdbcUrl,
+      @Config("toolsCloudSqlUsername") String username,
+      @Config("cloudSqlInstanceConnectionName") String instanceConnectionName,
+      KmsKeyring kmsKeyring,
+      @DefaultHibernateConfigs ImmutableMap<String, String> defaultConfigs,
+      Clock clock) {
+
+    // Cloud SQL JDBC Socket Factory library requires the jdbc url to include all connection
+    // information, otherwise the connection initialization will fail. See here for more details:
+    // https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory
+    String fullJdbcUrl =
+        new StringBuilder(jdbcUrl)
+            .append("?cloudSqlInstance=" + instanceConnectionName)
+            .append("&socketFactory=com.google.cloud.sql.postgres.SocketFactory")
+            .append("&user=" + username)
+            .append("&password=" + kmsKeyring.getCloudSqlPassword())
+            .toString();
+
+    HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
+    overrides.put(Environment.URL, fullJdbcUrl);
+
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  /** Constructs the {@link EntityManagerFactory} instance. */
+  @VisibleForTesting
+  public static EntityManagerFactory create(
+      String jdbcUrl, String username, String password, ImmutableMap<String, String> configs) {
+    HashMap<String, String> properties = Maps.newHashMap(configs);
+    properties.put(Environment.URL, jdbcUrl);
+    properties.put(Environment.USER, username);
+    properties.put(Environment.PASS, password);
+
+    return create(ImmutableMap.copyOf(properties));
+  }
+
+  private static EntityManagerFactory create(Map<String, String> properties) {
+    // If there are no annotated classes, we can create the EntityManagerFactory from the generic
+    // method.  Otherwise we have to use a more tailored approach.  Note that this adds to the set
+    // of annotated classes defined in the configuration, it does not override them.
+    EntityManagerFactory emf =
+        Persistence.createEntityManagerFactory(
+            PERSISTENCE_UNIT_NAME, ImmutableMap.copyOf(properties));
+    checkState(
+        emf != null,
+        "Persistence.createEntityManagerFactory() returns a null EntityManagerFactory");
+    return emf;
+  }
+
+  /** Dagger qualifier for {@link JpaTransactionManager} used for App Engine application. */
+  @Qualifier
+  @Documented
+  @interface AppEngineJpaTm {}
+
+  /** Dagger qualifier for {@link JpaTransactionManager} used for Nomulus tool. */
+  @Qualifier
+  @Documented
+  @interface NomulusToolJpaTm {}
+
+  /** Dagger qualifier for the default Hibernate configurations. */
+  // TODO(shicong): Change annotations in this class to none public or put them in a top level
+  //  package
+  @Qualifier
+  @Documented
+  public @interface DefaultHibernateConfigs {}
+}
@@ -0,0 +1,46 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.UpdateAutoTimestamp;
+import google.registry.util.DateTimeUtils;
+import java.sql.Timestamp;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA converter for storing/retrieving UpdateAutoTimestamp objects. */
+@Converter(autoApply = true)
+public class UpdateAutoTimestampConverter
+    implements AttributeConverter<UpdateAutoTimestamp, Timestamp> {
+
+  @Override
+  public Timestamp convertToDatabaseColumn(UpdateAutoTimestamp entity) {
+    return Timestamp.from(DateTimeUtils.toZonedDateTime(jpaTm().getTransactionTime()).toInstant());
+  }
+
+  @Override
+  @Nullable
+  public UpdateAutoTimestamp convertToEntityAttribute(@Nullable Timestamp columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    ZonedDateTime zdt = ZonedDateTime.ofInstant(columnValue.toInstant(), ZoneOffset.UTC);
+    return UpdateAutoTimestamp.create(DateTimeUtils.toJodaDateTime(zdt));
+  }
+}
@@ -0,0 +1,48 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.sql.Timestamp;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/**
+ * JPA converter to for storing/retrieving {@link ZonedDateTime} objects.
+ *
+ * <p>Hibernate provides a default converter for {@link ZonedDateTime}, but it converts timestamp to
+ * a non-normalized format, e.g., 2019-09-01T01:01:01Z will be converted to
+ * 2019-09-01T01:01:01Z[UTC]. This converter solves that problem by explicitly calling {@link
+ * ZoneId#normalized()} to normalize the zone id.
+ */
+@Converter(autoApply = true)
+public class ZonedDateTimeConverter implements AttributeConverter<ZonedDateTime, Timestamp> {
+
+  @Override
+  @Nullable
+  public Timestamp convertToDatabaseColumn(@Nullable ZonedDateTime attribute) {
+    return attribute == null ? null : Timestamp.from(attribute.toInstant());
+  }
+
+  @Override
+  @Nullable
+  public ZonedDateTime convertToEntityAttribute(@Nullable Timestamp dbData) {
+    return dbData == null
+        ? null
+        : ZonedDateTime.ofInstant(dbData.toInstant(), ZoneId.of("UTC").normalized());
+  }
+}
@@ -0,0 +1,252 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.domain;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.toZonedDateTime;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
+import google.registry.util.DateTimeUtils;
+import java.time.ZonedDateTime;
+import java.util.Optional;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Index;
+import javax.persistence.Table;
+import org.joda.time.DateTime;
+
+/**
+ * Represents a registry lock/unlock object, meaning that the domain is locked on the registry
+ * level.
+ *
+ * <p>Registry locks must be requested through the registrar console by a lock-enabled contact, then
+ * confirmed through email within a certain length of time. Until that confirmation is processed,
+ * the completion time will remain null and the lock will have no effect. The same applies for
+ * unlock actions.
+ *
+ * <p>Note that there will be at most one row per domain with a null copmleted time -- this means
+ * that there is at most one pending action per domain. This is enforced at the logic level.
+ *
+ * <p>Note as well that in the case of a retry of a write after an unexpected success, the unique
+ * constraint on {@link #verificationCode} means that the second write will fail.
+ */
+@Entity
+@Table(
+    /**
+     * Unique constraint to get around Hibernate's failure to handle auto-increment field in
+     * composite primary key.
+     *
+     * <p>Note: indexes use the camelCase version of the field names because the {@link
+     * google.registry.persistence.NomulusNamingStrategy} does not translate the field name into the
+     * snake_case column name until the write itself.
+     */
+    indexes = {
+      @Index(
+          name = "idx_registry_lock_repo_id_revision_id",
+          columnList = "repoId, revisionId",
+          unique = true),
+      @Index(name = "idx_registry_lock_verification_code", columnList = "verificationCode")
+    })
+public final class RegistryLock extends ImmutableObject implements Buildable {
+
+  /** Describes the action taken by the user. */
+  public enum Action {
+    LOCK,
+    UNLOCK
+  }
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  @Column(nullable = false)
+  private Long revisionId;
+
+  /** EPP repo ID of the domain in question. */
+  @Column(nullable = false)
+  private String repoId;
+
+  // TODO (b/140568328): remove this when everything is in Cloud SQL and we can join on "domain"
+  @Column(nullable = false)
+  private String domainName;
+
+  /**
+   * The ID of the registrar that performed the action -- this may be the admin ID if this action
+   * was performed by a superuser.
+   */
+  @Column(nullable = false)
+  private String registrarId;
+
+  /** The POC that performed the action, or null if it was a superuser. */
+  private String registrarPocId;
+
+  /**
+   * Lock action is immutable and describes whether the action performed was a lock or an unlock.
+   */
+  @Enumerated(EnumType.STRING)
+  @Column(nullable = false)
+  private Action action;
+
+  /** Creation timestamp is when the lock/unlock is first requested. */
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  /**
+   * Completion timestamp is when the user has verified the lock/unlock, when this object de facto
+   * becomes immutable. If this field is null, it means that the lock has not been verified yet (and
+   * thus not been put into effect).
+   */
+  private ZonedDateTime completionTimestamp;
+
+  /**
+   * The user must provide the random verification code in order to complete the lock and move the
+   * status from PENDING to COMPLETED.
+   */
+  @Column(nullable = false)
+  private String verificationCode;
+
+  /**
+   * True iff this action was taken by a superuser, in response to something like a URS request. In
+   * this case, the action was performed by a registry admin rather than a registrar.
+   */
+  @Column(nullable = false)
+  private boolean isSuperuser;
+
+  public String getRepoId() {
+    return repoId;
+  }
+
+  public String getDomainName() {
+    return domainName;
+  }
+
+  public String getRegistrarId() {
+    return registrarId;
+  }
+
+  public String getRegistrarPocId() {
+    return registrarPocId;
+  }
+
+  public Action getAction() {
+    return action;
+  }
+
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
+  }
+
+  /** Returns the completion timestamp, or empty if this lock has not been completed yet. */
+  public Optional<DateTime> getCompletionTimestamp() {
+    return Optional.ofNullable(completionTimestamp).map(DateTimeUtils::toJodaDateTime);
+  }
+
+  public String getVerificationCode() {
+    return verificationCode;
+  }
+
+  public boolean isSuperuser() {
+    return isSuperuser;
+  }
+
+  public Long getRevisionId() {
+    return revisionId;
+  }
+
+  public void setCompletionTimestamp(DateTime dateTime) {
+    this.completionTimestamp = toZonedDateTime(dateTime);
+  }
+
+  @Override
+  public Builder asBuilder() {
+    RegistryLock clone = clone(this);
+    // Revision ID should be different for every object
+    clone.revisionId = null;
+    return new Builder(clone);
+  }
+
+  /** Builder for {@link google.registry.schema.domain.RegistryLock}. */
+  public static class Builder extends Buildable.Builder<RegistryLock> {
+    public Builder() {}
+
+    private Builder(RegistryLock instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistryLock build() {
+      checkArgumentNotNull(getInstance().repoId, "Repo ID cannot be null");
+      checkArgumentNotNull(getInstance().domainName, "Domain name cannot be null");
+      checkArgumentNotNull(getInstance().registrarId, "Registrar ID cannot be null");
+      checkArgumentNotNull(getInstance().action, "Action cannot be null");
+      checkArgumentNotNull(getInstance().verificationCode, "Verification codecannot be null");
+      checkArgument(
+          getInstance().registrarPocId != null || getInstance().isSuperuser,
+          "Registrar POC ID must be provided if superuser is false");
+      return super.build();
+    }
+
+    public Builder setRepoId(String repoId) {
+      getInstance().repoId = repoId;
+      return this;
+    }
+
+    public Builder setDomainName(String domainName) {
+      getInstance().domainName = domainName;
+      return this;
+    }
+
+    public Builder setRegistrarId(String registrarId) {
+      getInstance().registrarId = registrarId;
+      return this;
+    }
+
+    public Builder setRegistrarPocId(String registrarPocId) {
+      getInstance().registrarPocId = registrarPocId;
+      return this;
+    }
+
+    public Builder setAction(Action action) {
+      getInstance().action = action;
+      return this;
+    }
+
+    public Builder setCreationTimestamp(CreateAutoTimestamp creationTimestamp) {
+      getInstance().creationTimestamp = creationTimestamp;
+      return this;
+    }
+
+    public Builder setCompletionTimestamp(DateTime lockTimestamp) {
+      getInstance().completionTimestamp = toZonedDateTime(lockTimestamp);
+      return this;
+    }
+
+    public Builder setVerificationCode(String verificationCode) {
+      getInstance().verificationCode = verificationCode;
+      return this;
+    }
+
+    public Builder isSuperuser(boolean isSuperuser) {
+      getInstance().isSuperuser = isSuperuser;
+      return this;
+    }
+  }
+}
@@ -14,10 +14,14 @@

 package google.registry.schema.tld;

+import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.hash.Funnels.stringFunnel;

+import com.google.common.collect.ImmutableMap;
+import com.google.common.hash.BloomFilter;
+import google.registry.model.CreateAutoTimestamp;
 import java.math.BigDecimal;
-import java.time.ZonedDateTime;
 import java.util.Map;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
@@ -26,10 +30,12 @@ import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
+import javax.persistence.Index;
 import javax.persistence.JoinColumn;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
 import org.joda.money.CurrencyUnit;
+import org.joda.time.DateTime;

 /**
 * A list of premium prices for domain names.
@@ -40,47 +46,55 @@ import org.joda.money.CurrencyUnit;
 * This is fine though, because we only use the list with the highest revisionId.
 */
@Entity
-@Table(name = "PremiumList")
+@Table(indexes = {@Index(columnList = "name", name = "premiumlist_name_idx")})
 public class PremiumList {

+  @Column(nullable = false)
+  private String name;
+
  @Id
  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Column(name = "revision_id")
+  @Column(nullable = false)
  private Long revisionId;

-  @Column(name = "creation_timestamp", nullable = false)
-  private ZonedDateTime creationTimestamp;
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);

-  @Column(name = "currency", nullable = false)
+  @Column(nullable = false)
  private CurrencyUnit currency;

  @ElementCollection
  @CollectionTable(
      name = "PremiumEntry",
-      joinColumns = @JoinColumn(name = "revision_id", referencedColumnName = "revision_id"))
-  @MapKeyColumn(name = "domain_label")
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel")
  @Column(name = "price", nullable = false)
  private Map<String, BigDecimal> labelsToPrices;

-  private PremiumList(
-      ZonedDateTime creationTimestamp,
-      CurrencyUnit currency,
-      Map<String, BigDecimal> labelsToPrices) {
-    this.creationTimestamp = creationTimestamp;
+  @Column(nullable = false)
+  private BloomFilter<String> bloomFilter;
+
+  private PremiumList(String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    this.name = name;
    this.currency = currency;
    this.labelsToPrices = labelsToPrices;
+    // ASCII is used for the charset because all premium list domain labels are stored punycoded.
+    this.bloomFilter = BloomFilter.create(stringFunnel(US_ASCII), labelsToPrices.size());
+    labelsToPrices.keySet().forEach(this.bloomFilter::put);
  }

  // Hibernate requires this default constructor.
  private PremiumList() {}

-  // TODO(mcilwain): Change creationTimestamp to Joda DateTime.
  /** Constructs a {@link PremiumList} object. */
  public static PremiumList create(
-      ZonedDateTime creationTimestamp,
-      CurrencyUnit currency,
-      Map<String, BigDecimal> labelsToPrices) {
-    return new PremiumList(creationTimestamp, currency, labelsToPrices);
+      String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    return new PremiumList(name, currency, labelsToPrices);
+  }
+
+  /** Returns the name of the premium list, which is usually also a TLD string. */
+  public String getName() {
+    return name;
  }

  /** Returns the ID of this revision, or throws if null. */
@@ -91,12 +105,23 @@ public class PremiumList {
  }

  /** Returns the creation time of this revision of the premium list. */
-  public ZonedDateTime getCreationTimestamp() {
-    return creationTimestamp;
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
  }

  /** Returns a {@link Map} of domain labels to prices. */
-  public Map<String, BigDecimal> getLabelsToPrices() {
-    return labelsToPrices;
+  public ImmutableMap<String, BigDecimal> getLabelsToPrices() {
+    return ImmutableMap.copyOf(labelsToPrices);
+  }
+
+  /**
+   * Returns a Bloom filter to determine whether a label might be premium, or is definitely not.
+   *
+   * <p>If the domain label might be premium, then the next step is to check for the existence of a
+   * corresponding row in the PremiumListEntry table. Otherwise, we know for sure it's not premium,
+   * and no DB load is required.
+   */
+  public BloomFilter<String> getBloomFilter() {
+    return bloomFilter;
  }
 }
@@ -0,0 +1,56 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+/** Data access object class for {@link PremiumList}. */
+public class PremiumListDao {
+
+  /** Persist a new premium list to Cloud SQL. */
+  public static void saveNew(PremiumList premiumList) {
+    jpaTm()
+        .transact(
+            () -> {
+              checkArgument(
+                  !checkExists(premiumList.getName()),
+                  "A premium list of this name already exists: %s.",
+                  premiumList.getName());
+              jpaTm().getEntityManager().persist(premiumList);
+            });
+  }
+
+  /**
+   * Returns whether the premium list of the given name exists.
+   *
+   * <p>This means that at least one premium list revision must exist for the given name.
+   */
+  public static boolean checkExists(String premiumListName) {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                        .getEntityManager()
+                        .createQuery("SELECT 1 FROM PremiumList WHERE name = :name", Integer.class)
+                        .setParameter("name", premiumListName)
+                        .setMaxResults(1)
+                        .getResultList()
+                        .size()
+                    > 0);
+  }
+
+  private PremiumListDao() {}
+}
@@ -15,7 +15,11 @@
 package google.registry.schema.tmch;

 import static com.google.common.base.Preconditions.checkState;
+import static google.registry.util.DateTimeUtils.toJodaDateTime;
+import static google.registry.util.DateTimeUtils.toZonedDateTime;

+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
 import java.time.ZonedDateTime;
 import java.util.Map;
 import java.util.Optional;
@@ -29,6 +33,7 @@ import javax.persistence.Id;
 import javax.persistence.JoinColumn;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
+import org.joda.time.DateTime;

 /**
 * A list of TMCH claims labels and their associated claims keys.
@@ -40,26 +45,29 @@ import javax.persistence.Table;
 * highest {@link #revisionId}.
 */
@Entity
-@Table(name = "ClaimsList")
-public class ClaimsList {
+@Table
+public class ClaimsList extends ImmutableObject {
  @Id
  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Column(name = "revision_id")
+  @Column
  private Long revisionId;

-  @Column(name = "creation_timestamp", nullable = false)
-  private ZonedDateTime creationTimestamp;
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  @Column(nullable = false)
+  private ZonedDateTime tmdbGenerationTime;

  @ElementCollection
  @CollectionTable(
      name = "ClaimsEntry",
-      joinColumns = @JoinColumn(name = "revision_id", referencedColumnName = "revision_id"))
-  @MapKeyColumn(name = "domain_label", nullable = false)
-  @Column(name = "claim_key", nullable = false)
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel", nullable = false)
+  @Column(name = "claimKey", nullable = false)
  private Map<String, String> labelsToKeys;

-  private ClaimsList(ZonedDateTime creationTimestamp, Map<String, String> labelsToKeys) {
-    this.creationTimestamp = creationTimestamp;
+  private ClaimsList(ZonedDateTime tmdbGenerationTime, Map<String, String> labelsToKeys) {
+    this.tmdbGenerationTime = tmdbGenerationTime;
    this.labelsToKeys = labelsToKeys;
  }

@@ -67,9 +75,8 @@ public class ClaimsList {
  private ClaimsList() {}

  /** Constructs a {@link ClaimsList} object. */
-  public static ClaimsList create(
-      ZonedDateTime creationTimestamp, Map<String, String> labelsToKeys) {
-    return new ClaimsList(creationTimestamp, labelsToKeys);
+  public static ClaimsList create(DateTime creationTimestamp, Map<String, String> labelsToKeys) {
+    return new ClaimsList(toZonedDateTime(creationTimestamp), labelsToKeys);
  }

  /** Returns the revision id of this claims list, or throws exception if it is null. */
@@ -79,9 +86,14 @@ public class ClaimsList {
    return revisionId;
  }

+  /** Returns the TMDB generation time of this claims list. */
+  public DateTime getTmdbGenerationTime() {
+    return toJodaDateTime(tmdbGenerationTime);
+  }
+
  /** Returns the creation time of this claims list. */
-  public ZonedDateTime getCreationTimestamp() {
-    return creationTimestamp;
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
  }

  /** Returns an {@link Map} mapping domain label to its lookup key. */
@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
-import google.registry.model.tmch.ClaimsListShard;
+import google.registry.schema.tmch.ClaimsList;
 import java.util.List;
 import org.joda.time.DateTime;

@@ -34,11 +34,11 @@ import org.joda.time.DateTime;
 public class ClaimsListParser {

  /**
-   * Converts the lines from the DNL CSV file into a {@link ClaimsListShard} object.
+   * Converts the lines from the DNL CSV file into a {@link ClaimsList} object.
   *
   * <p>Please note that this does <b>not</b> insert the object into Datastore.
   */
-  public static ClaimsListShard parse(List<String> lines) {
+  public static ClaimsList parse(List<String> lines) {
    ImmutableMap.Builder<String, String> builder = new ImmutableMap.Builder<>();

    // First line: <version>,<DNL List creation datetime>
@@ -74,6 +74,6 @@ public class ClaimsListParser {
      builder.put(label, lookupKey);
    }

-    return ClaimsListShard.create(creationTime, builder.build());
+    return ClaimsList.create(creationTime, builder.build());
  }
 }
@@ -18,9 +18,11 @@ import static google.registry.request.Action.Method.POST;

 import com.google.common.flogger.FluentLogger;
 import google.registry.keyring.api.KeyModule.Key;
+import google.registry.model.tmch.ClaimsListDao;
 import google.registry.model.tmch.ClaimsListShard;
 import google.registry.request.Action;
 import google.registry.request.auth.Auth;
+import google.registry.schema.tmch.ClaimsList;
 import java.io.IOException;
 import java.security.SignatureException;
 import java.util.List;
@@ -54,10 +56,14 @@ public final class TmchDnlAction implements Runnable {
    } catch (SignatureException | IOException | PGPException e) {
      throw new RuntimeException(e);
    }
-    ClaimsListShard claims = ClaimsListParser.parse(lines);
-    claims.save();
+    ClaimsList claims = ClaimsListParser.parse(lines);
+    ClaimsListShard claimsListShard =
+        ClaimsListShard.create(claims.getTmdbGenerationTime(), claims.getLabelsToKeys());
+    claimsListShard.save();
    logger.atInfo().log(
        "Inserted %,d claims into Datastore, created at %s",
-        claims.size(), claims.getCreationTime());
+        claimsListShard.size(), claimsListShard.getCreationTime());
+
+    ClaimsListDao.trySave(claims);
  }
 }
@@ -0,0 +1,23 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+/**
+ * Marker interface for commands that use Cloud Sql.
+ *
+ * <p>Just implementing this is sufficient to use Cloud Sql; {@link RegistryTool} will install it as
+ * needed.
+ */
+interface CommandWithCloudSql extends CommandWithRemoteApi {}
@@ -16,6 +16,7 @@ package google.registry.tools;

 import static com.google.common.base.Strings.isNullOrEmpty;
 import static google.registry.security.JsonHttp.JSON_SAFETY_PREFIX;
+import static google.registry.tools.server.CreateOrUpdatePremiumListAction.ALSO_CLOUD_SQL_PARAM;
 import static google.registry.tools.server.CreateOrUpdatePremiumListAction.INPUT_PARAM;
 import static google.registry.tools.server.CreateOrUpdatePremiumListAction.NAME_PARAM;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
@@ -57,6 +58,12 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
      required = true)
  Path inputFile;

+  @Parameter(
+      names = {"--also_cloud_sql"},
+      description =
+          "Persist premium list to Cloud SQL in addition to Datastore; defaults to false.")
+  boolean alsoCloudSql;
+
  protected AppEngineConnection connection;
  protected int inputLineCount;

@@ -67,7 +74,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand

  abstract String getCommandPath();

-  ImmutableMap<String, ?> getParameterMap() {
+  ImmutableMap<String, String> getParameterMap() {
    return ImmutableMap.of();
  }

@@ -88,14 +95,15 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand

  @Override
  public String execute() throws Exception {
-    ImmutableMap.Builder<String, Object> params = new ImmutableMap.Builder<>();
+    ImmutableMap.Builder<String, String> params = new ImmutableMap.Builder<>();
    params.put(NAME_PARAM, name);
+    params.put(ALSO_CLOUD_SQL_PARAM, Boolean.toString(alsoCloudSql));
    String inputFileContents = new String(Files.readAllBytes(inputFile), UTF_8);
    String requestBody =
        Joiner.on('&').withKeyValueSeparator("=").join(
            ImmutableMap.of(INPUT_PARAM, URLEncoder.encode(inputFileContents, UTF_8.toString())));

-    ImmutableMap<String, ?> extraParams = getParameterMap();
+    ImmutableMap<String, String> extraParams = getParameterMap();
    if (extraParams != null) {
      params.putAll(extraParams);
    }
@@ -110,7 +118,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand

  // TODO(user): refactor this behavior into a better general-purpose
  // response validation that can be re-used across the new client/server commands.
-  String extractServerResponse(String response) {
+  private String extractServerResponse(String response) {
    Map<String, Object> responseMap = toMap(JSONValue.parse(stripJsonPrefix(response)));

    // TODO(user): consider using jart's FormField Framework.
@@ -127,7 +135,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
  }

  // TODO(user): figure out better place to put this method to make it re-usable
-  static String stripJsonPrefix(String json) {
+  private static String stripJsonPrefix(String json) {
    Verify.verify(json.startsWith(JSON_SAFETY_PREFIX));
    return json.substring(JSON_SAFETY_PREFIX.length());
  }
@@ -36,12 +36,11 @@ public class CreatePremiumListCommand extends CreateOrUpdatePremiumListCommand {
  }

  @Override
-  ImmutableMap<String, ?> getParameterMap() {
+  ImmutableMap<String, String> getParameterMap() {
    if (override) {
-      return ImmutableMap.of("override", override);
+      return ImmutableMap.of("override", "true");
    } else {
      return ImmutableMap.of();
    }
  }
-
 }
@@ -19,29 +19,23 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableSet;
-import google.registry.model.domain.DesignatedContact;
-import google.registry.model.domain.DomainBase;
-import google.registry.model.domain.GracePeriod;
-import google.registry.model.domain.secdns.DelegationSignerData;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.transfer.BaseTransferObject;
-import google.registry.model.transfer.TransferData;
-import google.registry.schema.tld.PremiumList;
-import google.registry.schema.tmch.ClaimsList;
+import google.registry.persistence.NomulusNamingStrategy;
+import google.registry.persistence.NomulusPostgreSQLDialect;
+import google.registry.persistence.PersistenceModule;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Paths;
-import java.sql.Types;
 import java.util.EnumSet;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import org.hibernate.boot.MetadataSources;
 import org.hibernate.boot.registry.StandardServiceRegistryBuilder;
-import org.hibernate.dialect.PostgreSQL95Dialect;
+import org.hibernate.cfg.Environment;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
 import org.hibernate.tool.hbm2ddl.SchemaExport;
 import org.hibernate.tool.schema.TargetType;
-import org.joda.time.Period;
 import org.testcontainers.containers.PostgreSQLContainer;

 /**
@@ -54,21 +48,6 @@ import org.testcontainers.containers.PostgreSQLContainer;
@Parameters(separators = " =", commandDescription = "Generate PostgreSQL schema.")
 public class GenerateSqlSchemaCommand implements Command {

-  // TODO(mmuller): These should be read from persistence.xml so we don't need to maintain two
-  //                separate lists of all SQL table classes.
-  private static final ImmutableSet<Class> SQL_TABLE_CLASSES =
-      ImmutableSet.of(
-          BaseTransferObject.class,
-          ClaimsList.class,
-          DelegationSignerData.class,
-          DesignatedContact.class,
-          DomainBase.class,
-          GracePeriod.class,
-          Period.class,
-          PremiumList.class,
-          TransferData.class,
-          Trid.class);
-
  @VisibleForTesting
  public static final String DB_OPTIONS_CLASH =
      "Database host and port may not be specified along with the option to start a "
@@ -150,10 +129,14 @@ public class GenerateSqlSchemaCommand implements Command {
      settings.put("hibernate.connection.password", "domain-registry");
      settings.put("hibernate.hbm2ddl.auto", "none");
      settings.put("show_sql", "true");
+      settings.put(
+          Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());

      MetadataSources metadata =
          new MetadataSources(new StandardServiceRegistryBuilder().applySettings(settings).build());
-      SQL_TABLE_CLASSES.forEach(metadata::addAnnotatedClass);
+
+      addAnnotatedClasses(metadata, settings);
+
      SchemaExport schemaExport = new SchemaExport();
      schemaExport.setHaltOnError(true);
      schemaExport.setFormat(true);
@@ -193,12 +176,29 @@ public class GenerateSqlSchemaCommand implements Command {
    }
  }

-  /** Nomulus mapping rules for column types in Postgresql. */
-  public static class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
-    public NomulusPostgreSQLDialect() {
-      super();
-      registerColumnType(Types.VARCHAR, "text");
-      registerColumnType(Types.TIMESTAMP, "timestamptz");
+  private void addAnnotatedClasses(MetadataSources metadata, Map<String, String> settings) {
+    ParsedPersistenceXmlDescriptor descriptor =
+        PersistenceXmlParser.locatePersistenceUnits(settings).stream()
+            .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+            .findFirst()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format(
+                            "Could not find persistence unit with name %s",
+                            PersistenceModule.PERSISTENCE_UNIT_NAME)));
+
+    List<String> classNames = descriptor.getManagedClassNames();
+    for (String className : classNames) {
+      try {
+        Class<?> clazz = Class.forName(className);
+        metadata.addAnnotatedClass(clazz);
+      } catch (ClassNotFoundException e) {
+        throw new IllegalArgumentException(
+            String.format(
+                "Could not load class with name %s present in persistence.xml", className),
+            e);
+      }
    }
  }
 }
@@ -65,6 +65,12 @@ final class GetKeyringSecretCommand implements CommandWithRemoteApi {
      case BRDA_SIGNING_PUBLIC_KEY:
        out.write(KeySerializer.serializePublicKey(keyring.getBrdaSigningKey().getPublicKey()));
        break;
+      case CLOUD_SQL_PASSWORD:
+        out.write(KeySerializer.serializeString(keyring.getCloudSqlPassword()));
+        break;
+      case TOOLS_CLOUD_SQL_PASSWORD:
+        out.write(KeySerializer.serializeString(keyring.getToolsCloudSqlPassword()));
+        break;
      case ICANN_REPORTING_PASSWORD:
        out.write(KeySerializer.serializeString(keyring.getIcannReportingPassword()));
        break;
@@ -31,6 +31,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
 import google.registry.config.RegistryConfig;
 import google.registry.model.ofy.ObjectifyService;
+import google.registry.model.transaction.TransactionManagerFactory;
 import google.registry.tools.AuthModule.LoginRequiredException;
 import google.registry.tools.params.ParameterFactory;
 import java.io.ByteArrayInputStream;
@@ -210,6 +211,8 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
    }

    // CommandWithRemoteApis need to have the remote api installed to work.
+    // CommandWithCloudSql extends CommandWithRemoteApi so the command will also get the remote
+    // api installed. This is because the DB password is stored in Datastore.
    if (command instanceof CommandWithRemoteApi) {
      if (installer == null) {
        installer = new RemoteApiInstaller();
@@ -233,6 +236,10 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
      ofy().clearSessionCache();
    }

+    if (command instanceof CommandWithCloudSql) {
+      TransactionManagerFactory.initForTool();
+    }
+
    command.run();
  }

@@ -65,6 +65,12 @@ final class UpdateKmsKeyringCommand implements CommandWithRemoteApi {
        throw new IllegalArgumentException(
            "Can't update BRDA_SIGNING_PUBLIC_KEY directly."
            + " Must update public and private keys together using BRDA_SIGNING_KEY_PAIR.");
+      case CLOUD_SQL_PASSWORD:
+        kmsUpdater.setCloudSqlPassword(deserializeString(input));
+        break;
+      case TOOLS_CLOUD_SQL_PASSWORD:
+        kmsUpdater.setToolsCloudSqlPassword(deserializeString(input));
+        break;
      case ICANN_REPORTING_PASSWORD:
        kmsUpdater.setIcannReportingPassword(deserializeString(input));
        break;
@@ -21,7 +21,9 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Joiner;
 import com.google.common.io.Files;
+import google.registry.model.tmch.ClaimsListDao;
 import google.registry.model.tmch.ClaimsListShard;
+import google.registry.schema.tmch.ClaimsList;
 import google.registry.tmch.ClaimsListParser;
 import java.io.File;
 import java.io.IOException;
@@ -35,9 +37,14 @@ final class UploadClaimsListCommand extends ConfirmingCommand implements Command
  @Parameter(description = "Claims list filename")
  private List<String> mainParameters = new ArrayList<>();

+  @Parameter(
+      names = {"--also_cloud_sql"},
+      description = "Persist claims list to Cloud SQL in addition to Datastore; defaults to false.")
+  boolean alsoCloudSql;
+
  private String claimsListFilename;

-  private ClaimsListShard claimsList;
+  private ClaimsList claimsList;

  @Override
  protected void init() throws IOException {
@@ -56,7 +63,10 @@ final class UploadClaimsListCommand extends ConfirmingCommand implements Command

  @Override
  public String execute() {
-    claimsList.save();
+    ClaimsListShard.create(claimsList.getTmdbGenerationTime(), claimsList.getLabelsToKeys()).save();
+    if (alsoCloudSql) {
+      ClaimsListDao.trySave(claimsList);
+    }
    return String.format("Successfully uploaded claims list %s", claimsListFilename);
  }
 }
@@ -24,6 +24,7 @@ public enum KeyringKeyName {
  BRDA_RECEIVER_PUBLIC_KEY,
  BRDA_SIGNING_KEY_PAIR,
  BRDA_SIGNING_PUBLIC_KEY,
+  CLOUD_SQL_PASSWORD,
  ICANN_REPORTING_PASSWORD,
  JSON_CREDENTIAL,
  MARKSDB_DNL_LOGIN_AND_PASSWORD,
@@ -37,5 +38,5 @@ public enum KeyringKeyName {
  RDE_STAGING_KEY_PAIR,
  RDE_STAGING_PUBLIC_KEY,
  SAFE_BROWSING_API_KEY,
+  TOOLS_CLOUD_SQL_PASSWORD,
 }
-
@@ -14,17 +14,28 @@

 package google.registry.tools.server;

+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.flogger.LazyArgs.lazy;

+import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Maps;
 import com.google.common.flogger.FluentLogger;
+import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
 import google.registry.request.JsonResponse;
 import google.registry.request.Parameter;
+import java.math.BigDecimal;
+import java.util.List;
+import java.util.Map;
 import javax.inject.Inject;
+import org.joda.money.CurrencyUnit;

-/**
- * Abstract base class for actions that update premium lists.
- */
+/** Abstract base class for actions that update premium lists. */
 public abstract class CreateOrUpdatePremiumListAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -33,24 +44,70 @@ public abstract class CreateOrUpdatePremiumListAction implements Runnable {

  public static final String NAME_PARAM = "name";
  public static final String INPUT_PARAM = "inputData";
+  public static final String ALSO_CLOUD_SQL_PARAM = "alsoCloudSql";

  @Inject JsonResponse response;
-  @Inject @Parameter("premiumListName") String name;
-  @Inject @Parameter(INPUT_PARAM) String inputData;
+
+  @Inject
+  @Parameter("premiumListName")
+  String name;
+
+  @Inject
+  @Parameter(INPUT_PARAM)
+  String inputData;
+
+  @Inject
+  @Parameter(ALSO_CLOUD_SQL_PARAM)
+  boolean alsoCloudSql;

  @Override
  public void run() {
    try {
-      savePremiumList();
+      saveToDatastore();
    } catch (IllegalArgumentException e) {
      logger.atInfo().withCause(e).log(
          "Usage error in attempting to save premium list from nomulus tool command");
      response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+      return;
    } catch (Exception e) {
      logger.atSevere().withCause(e).log(
-          "Unexpected error saving premium list from nomulus tool command");
+          "Unexpected error saving premium list to Datastore from nomulus tool command");
      response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+      return;
    }
+
+    if (alsoCloudSql) {
+      try {
+        saveToCloudSql();
+      } catch (Throwable e) {
+        logger.atSevere().withCause(e).log(
+            "Unexpected error saving premium list to Cloud SQL from nomulus tool command");
+        response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+        return;
+      }
+    }
+  }
+
+  google.registry.schema.tld.PremiumList parseInputToPremiumList() {
+    List<String> inputDataPreProcessed =
+        Splitter.on('\n').omitEmptyStrings().splitToList(inputData);
+
+    ImmutableMap<String, PremiumListEntry> prices =
+        new PremiumList.Builder().setName(name).build().parse(inputDataPreProcessed);
+    ImmutableSet<CurrencyUnit> currencies =
+        prices.values().stream()
+            .map(e -> e.getValue().getCurrencyUnit())
+            .distinct()
+            .collect(toImmutableSet());
+    checkArgument(
+        currencies.size() == 1,
+        "The Cloud SQL schema requires exactly one currency, but got: %s",
+        ImmutableSortedSet.copyOf(currencies));
+    CurrencyUnit currency = Iterables.getOnlyElement(currencies);
+
+    Map<String, BigDecimal> priceAmounts =
+        Maps.transformValues(prices, ple -> ple.getValue().getAmount());
+    return google.registry.schema.tld.PremiumList.create(name, currency, priceAmounts);
  }

  /** Logs the premium list data at INFO, truncated if too long. */
@@ -64,6 +121,9 @@ public abstract class CreateOrUpdatePremiumListAction implements Runnable {
                    : (inputData.substring(0, MAX_LOGGING_PREMIUM_LIST_LENGTH) + "<truncated>")));
  }

-  /** Creates a new premium list or updates an existing one. */
-  protected abstract void savePremiumList();
+  /** Saves the premium list to Datastore. */
+  protected abstract void saveToDatastore();
+
+  /** Saves the premium list to Cloud SQL. */
+  protected abstract void saveToCloudSql();
 }
@@ -27,6 +27,7 @@ import google.registry.model.registry.label.PremiumList;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
+import google.registry.schema.tld.PremiumListDao;
 import java.util.List;
 import javax.inject.Inject;

@@ -50,7 +51,7 @@ public class CreatePremiumListAction extends CreateOrUpdatePremiumListAction {
  @Inject CreatePremiumListAction() {}

  @Override
-  protected void savePremiumList() {
+  protected void saveToDatastore() {
    checkArgument(
        !doesPremiumListExist(name), "A premium list of this name already exists: %s.", name);
    if (!override) {
@@ -71,4 +72,22 @@ public class CreatePremiumListAction extends CreateOrUpdatePremiumListAction {
    logger.atInfo().log(message);
    response.setPayload(ImmutableMap.of("status", "success", "message", message));
  }
+
+  @Override
+  protected void saveToCloudSql() {
+    if (!override) {
+      assertTldExists(name);
+    }
+    logger.atInfo().log("Saving premium list to Cloud SQL for TLD %s", name);
+    // TODO(mcilwain): Call logInputData() here once Datastore persistence is removed.
+
+    google.registry.schema.tld.PremiumList premiumList = parseInputToPremiumList();
+    PremiumListDao.saveNew(premiumList);
+
+    String message =
+        String.format(
+            "Saved premium list %s with %d entries", name, premiumList.getLabelsToPrices().size());
+    logger.atInfo().log(message);
+    // TODO(mcilwain): Call response.setPayload(...) here once Datastore persistence is removed.
+  }
 }
@@ -60,6 +60,12 @@ public class ToolsServerModule {
    return extractRequiredParameter(req, CreatePremiumListAction.INPUT_PARAM);
  }

+  @Provides
+  @Parameter("alsoCloudSql")
+  static boolean provideAlsoCloudSql(HttpServletRequest req) {
+    return extractBooleanParameter(req, CreatePremiumListAction.ALSO_CLOUD_SQL_PARAM);
+  }
+
  @Provides
  @Parameter("premiumListName")
  static String provideName(HttpServletRequest req) {
@@ -46,7 +46,7 @@ public class UpdatePremiumListAction extends CreateOrUpdatePremiumListAction {
  @Inject UpdatePremiumListAction() {}

  @Override
-  protected void savePremiumList() {
+  protected void saveToDatastore() {
    Optional<PremiumList> existingPremiumList = PremiumList.getUncached(name);
    checkArgument(
        existingPremiumList.isPresent(),
@@ -67,4 +67,11 @@ public class UpdatePremiumListAction extends CreateOrUpdatePremiumListAction {
    logger.atInfo().log(message);
    response.setPayload(ImmutableMap.of("status", "success", "message", message));
  }
+
+  // TODO(mcilwain): Implement this in a subsequent PR.
+  @Override
+  protected void saveToCloudSql() {
+    throw new UnsupportedOperationException(
+        "Updating of premium lists in Cloud SQL is not supported yet");
+  }
 }
@@ -20,6 +20,7 @@
      *  Use Hibernate's ServiceRegistry for bootstrapping (not JPA-compliant)
    -->
    <class>google.registry.model.domain.DomainBase</class>
+    <class>google.registry.schema.domain.RegistryLock</class>
    <class>google.registry.schema.tmch.ClaimsList</class>
    <class>google.registry.model.transfer.BaseTransferObject</class>
    <class>google.registry.schema.tld.PremiumList</class>
@@ -31,6 +32,12 @@
    <class>google.registry.model.transfer.TransferData</class>
    <class>google.registry.model.eppcommon.Trid</class>

+    <!-- Customized type converters -->
+    <class>google.registry.persistence.BloomFilterConverter</class>
+    <class>google.registry.persistence.CreateAutoTimestampConverter</class>
+    <class>google.registry.persistence.UpdateAutoTimestampConverter</class>
+    <class>google.registry.persistence.ZonedDateTimeConverter</class>
+
    <!-- TODO(weiminyu): check out application-layer validation. -->
    <validation-mode>NONE</validation-mode>
  </persistence-unit>
@@ -37,17 +37,18 @@
  {/call}

  <p>Please work with the registrant to mitigate any security issues and have the
-    domains delisted.</p>
+    domains delisted. If you believe that any of the domains were reported in error, or are still
+    receiving reports for issues that have been remediated,
+    please <a href="https://safebrowsing.google.com/safebrowsing/report_error/?hl=en">submit a
+    request</a> to have the site reviewed.</p>

  {call .resourceList}
    {param resources: $resources /}
  {/call}

  <p>You will continue to receive a monthly summary of all domains managed by your registrar
-    that remain on our lists of potential security threats. You will additionally receive a daily
-    notice when any new domains that are added to these lists. Once the registrant has resolved
-    the security issues and followed the steps to have his or her domain reviewed and delisted
-    it will automatically be removed from our monthly reporting.</p>
+    that remain on our lists of potential security threats. You will also receive a daily
+    notice when any new domains are added to these lists.</p>

  <p>If you have any questions regarding this notice, please contact {$replyToEmail}.</p>
 {/template}
@@ -79,11 +80,14 @@
    {param resources: $resources /}
  {/call}

+   <p>If you believe that any of the domains were reported in error, or are still receiving
+   reports for issues that have been remediated,
+   please <a href="https://safebrowsing.google.com/safebrowsing/report_error/?hl=en">submit
+   a request</a> to have the site reviewed.</p>
+
  <p>You will continue to receive daily notices when new domains managed by your registrar
    are flagged for abuse, as well as a monthly summary of all of your domains under management
-    that remain flagged for abuse. Once the registrant has resolved the security issues and
-    followed the steps to have his or her domain reviewed and delisted it will automatically
-    be removed from our reporting.</p>
+    that remain flagged for abuse.</p>

  <p>If you would like to change the email to which these notices are sent please update your
    abuse contact using your registrar portal account.</p>
@@ -16,7 +16,7 @@ package google.registry.dns.writer.dnsupdate;

 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assert_;
+import static com.google.common.truth.Truth.assertWithMessage;
 import static google.registry.testing.DatastoreHelper.createTld;
 import static google.registry.testing.DatastoreHelper.newDomainBase;
 import static google.registry.testing.DatastoreHelper.newHostResource;
@@ -450,9 +450,10 @@ public class DnsUpdateWriterTest {
        return fixIterator(Record.class, set.rrs());
      }
    }
-    assert_().fail(
-        "No record set found for resource '%s' type '%s'",
-        resourceName, Type.string(recordType));
+    assertWithMessage(
+            "No record set found for resource '%s' type '%s'",
+            resourceName, Type.string(recordType))
+        .fail();
    throw new AssertionError();
  }

@@ -14,7 +14,7 @@

 package google.registry.documentation;

-import static com.google.common.truth.Truth.assert_;
+import static com.google.common.truth.Truth.assertWithMessage;
 import static google.registry.util.BuildPathUtils.getProjectRoot;
 import static java.nio.charset.StandardCharsets.UTF_8;

@@ -53,7 +53,7 @@ public class FlowDocumentationTest {
    // Don't use Truth's isEqualTo() because the output is huge and unreadable for large files.
    DocumentationGenerator generator = new DocumentationGenerator();
    if (!generator.generateMarkdown().equals(goldenMarkdown)) {
-      assert_().fail(UPDATE_INSTRUCTIONS);
+      assertWithMessage(UPDATE_INSTRUCTIONS).fail();
    }
  }
 }
@@ -46,6 +46,24 @@ public class KmsKeyringTest {
    keyring = new KmsKeyring(new FakeKmsConnection());
  }

+  @Test
+  public void test_getCloudSqlPassword() throws Exception {
+    saveCleartextSecret("cloud-sql-password-string");
+
+    String cloudSqlPassword = keyring.getCloudSqlPassword();
+
+    assertThat(cloudSqlPassword).isEqualTo("cloud-sql-password-stringmoo");
+  }
+
+  @Test
+  public void test_getToolsCloudSqlPassword() throws Exception {
+    saveCleartextSecret("tools-cloud-sql-password-string");
+
+    String toolsCloudSqlPassword = keyring.getToolsCloudSqlPassword();
+
+    assertThat(toolsCloudSqlPassword).isEqualTo("tools-cloud-sql-password-stringmoo");
+  }
+
  @Test
  public void test_getRdeSigningKey() throws Exception {
    saveKeyPairSecret("rde-signing-public", "rde-signing-private");
@@ -91,6 +91,24 @@ public class KmsUpdaterTest {
        getCiphertext(KmsTestHelper.getPublicKey()));
  }

+  @Test
+  public void test_setCloudSqlPassword() {
+    updater.setCloudSqlPassword("value1").update();
+
+    verifySecretAndSecretRevisionWritten(
+        "cloud-sql-password-string", "cloud-sql-password-string/foo", getCiphertext("value1"));
+  }
+
+  @Test
+  public void test_setToolsCloudSqlPassword() {
+    updater.setToolsCloudSqlPassword("value1").update();
+
+    verifySecretAndSecretRevisionWritten(
+        "tools-cloud-sql-password-string",
+        "tools-cloud-sql-password-string/foo",
+        getCiphertext("value1"));
+  }
+
  @Test
  public void test_setIcannReportingPassword() {
    updater.setIcannReportingPassword("value1").update();
@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;

 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assert_;
+import static com.google.common.truth.Truth.assertWithMessage;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createChildEntityInput;
 import static google.registry.model.index.EppResourceIndexBucket.getBucketKey;
 import static google.registry.testing.DatastoreHelper.createTld;
@@ -290,7 +290,7 @@ public class ChildEntityInputTest {
      seen.add(reader.next());
      try {
        ImmutableObject o = reader.next();
-        assert_().fail("Unexpected element: " + o);
+        assertWithMessage("Unexpected element: %s", o).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;

 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assert_;
+import static com.google.common.truth.Truth.assertWithMessage;

 import com.google.appengine.tools.mapreduce.Input;
 import com.google.appengine.tools.mapreduce.InputReader;
@@ -65,7 +65,7 @@ public final class CommitLogManifestInputTest {
      seen.add(reader.next());
      try {
        Key<CommitLogManifest> key = reader.next();
-        assert_().fail("Unexpected element: " + key);
+        assertWithMessage("Unexpected element: %s", key).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -93,7 +93,7 @@ public final class CommitLogManifestInputTest {
          key = reader.next();
          seen.add(key);
        }
-        assert_().fail("Unexpected element: " + key);
+        assertWithMessage("Unexpected element: %s", key).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -121,7 +121,7 @@ public final class CommitLogManifestInputTest {
          key = reader.next();
          seen.add(key);
        }
-        assert_().fail("Unexpected element: " + key);
+        assertWithMessage("Unexpected element: %s", key).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -15,7 +15,7 @@
 package google.registry.mapreduce.inputs;

 import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assert_;
+import static com.google.common.truth.Truth.assertWithMessage;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createEntityInput;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createKeyInput;
 import static google.registry.model.index.EppResourceIndexBucket.getBucketKey;
@@ -123,7 +123,7 @@ public class EppResourceInputsTest {
      seen.add(reader.next());
      try {
        Key<DomainBase> key = reader.next();
-        assert_().fail("Unexpected element: " + key);
+        assertWithMessage("Unexpected element: %s", key).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -148,7 +148,7 @@ public class EppResourceInputsTest {
      seen.add(reader.next());
      try {
        DomainBase domain = reader.next();
-        assert_().fail("Unexpected element: " + domain);
+        assertWithMessage("Unexpected element: %s", domain).fail();
      } catch (NoSuchElementException expected) {
      }
    }
@@ -16,7 +16,6 @@ package google.registry.model;

 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static com.google.common.truth.Truth.assert_;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static org.joda.time.DateTimeZone.UTC;

@@ -127,10 +126,10 @@ public abstract class EntityTestCase {
        // If the field's type was not indexable (because it's not a supported Datastore type) then
        // this error will be thrown. If we expected no indexing, that's fine. Otherwise, fail.
        if (indexed || !e.getMessage().endsWith(" is not a supported property type.")) {
-          assert_().fail(String.format("%s was %sindexed", fieldPath, indexed ? "not " : ""));
+          assertWithMessage("%s was %sindexed", fieldPath, indexed ? "not " : "").fail();
        }
      } catch (IllegalStateException e) {
-        assert_().fail(String.format("%s (indexed=%b): %s", fieldPath, indexed, e.getMessage()));
+        assertWithMessage("%s (indexed=%b): %s", fieldPath, indexed, e.getMessage()).fail();
      }
    }
  }
@@ -0,0 +1,104 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registry;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import google.registry.schema.domain.RegistryLock;
+import google.registry.schema.domain.RegistryLock.Action;
+import google.registry.testing.AppEngineRule;
+import java.util.UUID;
+import javax.persistence.PersistenceException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link RegistryLockDao}. */
+@RunWith(JUnit4.class)
+public final class RegistryLockDaoTest {
+
+  @Rule public final AppEngineRule appEngine = AppEngineRule.builder().withDatastore().build();
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder().build();
+
+  @Test
+  public void testSaveAndLoad_success() {
+    RegistryLock lock = createLock();
+    RegistryLockDao.save(lock);
+    RegistryLock fromDatabase = RegistryLockDao.getByVerificationCode(lock.getVerificationCode());
+    assertThat(fromDatabase.getDomainName()).isEqualTo(lock.getDomainName());
+    assertThat(fromDatabase.getVerificationCode()).isEqualTo(lock.getVerificationCode());
+  }
+
+  @Test
+  public void testSaveAndLoad_failure_differentCode() {
+    RegistryLock lock = createLock();
+    RegistryLockDao.save(lock);
+    PersistenceException exception =
+        assertThrows(
+            PersistenceException.class,
+            () -> RegistryLockDao.getByVerificationCode(UUID.randomUUID().toString()));
+    assertThat(exception)
+        .hasCauseThat()
+        .hasMessageThat()
+        .isEqualTo("No registry lock with this code");
+    assertThat(exception).hasCauseThat().isInstanceOf(NullPointerException.class);
+  }
+
+  @Test
+  public void testSaveTwiceAndLoad_returnsLatest() {
+    RegistryLock lock = createLock();
+    jpaTm().transact(() -> RegistryLockDao.save(lock));
+    jpaTmRule.getTxnClock().advanceOneMilli();
+    jpaTm()
+        .transact(
+            () -> {
+              RegistryLock secondLock =
+                  RegistryLockDao.getByVerificationCode(lock.getVerificationCode());
+              secondLock.setCompletionTimestamp(jpaTmRule.getTxnClock().nowUtc());
+              RegistryLockDao.save(secondLock);
+            });
+    jpaTm()
+        .transact(
+            () -> {
+              RegistryLock fromDatabase =
+                  RegistryLockDao.getByVerificationCode(lock.getVerificationCode());
+              assertThat(fromDatabase.getCompletionTimestamp().get())
+                  .isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+            });
+  }
+
+  @Test
+  public void testFailure_saveNull() {
+    assertThrows(NullPointerException.class, () -> RegistryLockDao.save(null));
+  }
+
+  private RegistryLock createLock() {
+    return new RegistryLock.Builder()
+        .setRepoId("repoId")
+        .setDomainName("example.test")
+        .setRegistrarId("TheRegistrar")
+        .setAction(Action.LOCK)
+        .setVerificationCode(UUID.randomUUID().toString())
+        .isSuperuser(true)
+        .build();
+  }
+}
@@ -0,0 +1,95 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.tmch;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import google.registry.schema.tmch.ClaimsList;
+import google.registry.testing.FakeClock;
+import javax.persistence.NoResultException;
+import javax.persistence.PersistenceException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link ClaimsListDao}. */
+@RunWith(JUnit4.class)
+public class ClaimsListDaoTest {
+
+  private FakeClock fakeClock = new FakeClock();
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder().build();
+
+  @Test
+  public void trySave_insertsClaimsListSuccessfully() {
+    ClaimsList claimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    assertThat(insertedClaimsList.getCreationTimestamp())
+        .isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+  }
+
+  @Test
+  public void trySave_noExceptionThrownWhenSaveFail() {
+    ClaimsList claimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    // Save ClaimsList with existing revisionId should fail because revisionId is the primary key.
+    ClaimsListDao.trySave(insertedClaimsList);
+  }
+
+  @Test
+  public void trySave_claimsListWithNoEntries() {
+    ClaimsList claimsList = ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of());
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    assertThat(insertedClaimsList.getLabelsToKeys()).isEmpty();
+  }
+
+  @Test
+  public void getCurrent_throwsNoResultExceptionIfTableIsEmpty() {
+    PersistenceException thrown =
+        assertThrows(PersistenceException.class, () -> ClaimsListDao.getCurrent());
+    assertThat(thrown).hasCauseThat().isInstanceOf(NoResultException.class);
+  }
+
+  @Test
+  public void getCurrent_returnsLatestClaims() {
+    ClaimsList oldClaimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsList newClaimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label3", "key3", "label4", "key4"));
+    ClaimsListDao.trySave(oldClaimsList);
+    ClaimsListDao.trySave(newClaimsList);
+    assertClaimsListEquals(newClaimsList, ClaimsListDao.getCurrent());
+  }
+
+  private void assertClaimsListEquals(ClaimsList left, ClaimsList right) {
+    assertThat(left.getRevisionId()).isEqualTo(right.getRevisionId());
+    assertThat(left.getTmdbGenerationTime()).isEqualTo(right.getTmdbGenerationTime());
+    assertThat(left.getLabelsToKeys()).isEqualTo(right.getLabelsToKeys());
+  }
+}
@@ -0,0 +1,33 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** JUnit test for {@link DummyJpaTransactionManager} */
+@RunWith(JUnit4.class)
+public class DummyJpaTransactionManagerTest {
+
+  @Test
+  public void throwsExceptionWhenAnyMethodIsInvoked() {
+    assertThrows(UnsupportedOperationException.class, () -> jpaTm().transact(() -> null));
+    assertThrows(UnsupportedOperationException.class, () -> jpaTm().getTransactionTime());
+  }
+}
@@ -0,0 +1,192 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+import static google.registry.testing.TestDataHelper.fileClassPath;
+
+import google.registry.testing.FakeClock;
+import java.math.BigInteger;
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link JpaTransactionManagerImpl}. */
+@RunWith(JUnit4.class)
+public class JpaTransactionManagerImplTest {
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withInitScript(fileClassPath(getClass(), "test_schema.sql"))
+          .build();
+
+  @Test
+  public void inTransaction_returnsCorrespondingResult() {
+    assertThat(jpaTm().inTransaction()).isFalse();
+    jpaTm().transact(() -> assertThat(jpaTm().inTransaction()).isTrue());
+    assertThat(jpaTm().inTransaction()).isFalse();
+  }
+
+  @Test
+  public void assertInTransaction_throwsExceptionWhenNotInTransaction() {
+    assertThrows(PersistenceException.class, () -> jpaTm().assertInTransaction());
+    jpaTm().transact(() -> jpaTm().assertInTransaction());
+    assertThrows(PersistenceException.class, () -> jpaTm().assertInTransaction());
+  }
+
+  @Test
+  public void getTransactionTime_throwsExceptionWhenNotInTransaction() {
+    FakeClock txnClock = jpaTmRule.getTxnClock();
+    txnClock.advanceOneMilli();
+    assertThrows(PersistenceException.class, () -> jpaTm().getTransactionTime());
+    jpaTm().transact(() -> assertThat(jpaTm().getTransactionTime()).isEqualTo(txnClock.nowUtc()));
+    assertThrows(PersistenceException.class, () -> jpaTm().getTransactionTime());
+  }
+
+  @Test
+  public void transact_succeeds() {
+    assertPersonEmpty();
+    assertCompanyEmpty();
+    jpaTm()
+        .transact(
+            () -> {
+              insertPerson(10);
+              insertCompany("Foo");
+              insertCompany("Bar");
+            });
+    assertPersonCount(1);
+    assertPersonExist(10);
+    assertCompanyCount(2);
+    assertCompanyExist("Foo");
+    assertCompanyExist("Bar");
+  }
+
+  @Test
+  public void transact_hasNoEffectWithPartialSuccess() {
+    assertPersonEmpty();
+    assertCompanyEmpty();
+    assertThrows(
+        RuntimeException.class,
+        () ->
+            jpaTm()
+                .transact(
+                    () -> {
+                      insertPerson(10);
+                      insertCompany("Foo");
+                      throw new RuntimeException();
+                    }));
+    assertPersonEmpty();
+    assertCompanyEmpty();
+  }
+
+  @Test
+  public void transact_reusesExistingTransaction() {
+    assertPersonEmpty();
+    assertCompanyEmpty();
+    jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .transact(
+                        () -> {
+                          insertPerson(10);
+                          insertCompany("Foo");
+                          insertCompany("Bar");
+                        }));
+    assertPersonCount(1);
+    assertPersonExist(10);
+    assertCompanyCount(2);
+    assertCompanyExist("Foo");
+    assertCompanyExist("Bar");
+  }
+
+  private void insertPerson(int age) {
+    jpaTm()
+        .getEntityManager()
+        .createNativeQuery(String.format("INSERT INTO Person (age) VALUES (%d)", age))
+        .executeUpdate();
+  }
+
+  private void insertCompany(String name) {
+    jpaTm()
+        .getEntityManager()
+        .createNativeQuery(String.format("INSERT INTO Company (name) VALUES ('%s')", name))
+        .executeUpdate();
+  }
+
+  private void assertPersonExist(int age) {
+    jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Integer maybeAge =
+                  (Integer)
+                      em.createNativeQuery(
+                              String.format("SELECT age FROM Person WHERE age = %d", age))
+                          .getSingleResult();
+              assertThat(maybeAge).isEqualTo(age);
+            });
+  }
+
+  private void assertCompanyExist(String name) {
+    jpaTm()
+        .transact(
+            () -> {
+              String maybeName =
+                  (String)
+                      jpaTm()
+                          .getEntityManager()
+                          .createNativeQuery(
+                              String.format("SELECT name FROM Company WHERE name = '%s'", name))
+                          .getSingleResult();
+              assertThat(maybeName).isEqualTo(name);
+            });
+  }
+
+  private void assertPersonCount(int count) {
+    assertThat(countTable("Person")).isEqualTo(count);
+  }
+
+  private void assertCompanyCount(int count) {
+    assertThat(countTable("Company")).isEqualTo(count);
+  }
+
+  private void assertPersonEmpty() {
+    assertPersonCount(0);
+  }
+
+  private void assertCompanyEmpty() {
+    assertCompanyCount(0);
+  }
+
+  private int countTable(String tableName) {
+    return jpaTm()
+        .transact(
+            () -> {
+              BigInteger colCount =
+                  (BigInteger)
+                      jpaTm()
+                          .getEntityManager()
+                          .createNativeQuery(String.format("SELECT COUNT(*) FROM %s", tableName))
+                          .getSingleResult();
+              return colCount.intValue();
+            });
+  }
+}
@@ -0,0 +1,223 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import static org.joda.time.DateTimeZone.UTC;
+import static org.testcontainers.containers.PostgreSQLContainer.POSTGRESQL_PORT;
+
+import com.google.common.base.Charsets;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Maps;
+import com.google.common.io.Resources;
+import google.registry.persistence.PersistenceModule;
+import google.registry.testing.FakeClock;
+import java.sql.Connection;
+import java.sql.Driver;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import javax.persistence.EntityManagerFactory;
+import org.hibernate.cfg.Environment;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
+import org.hibernate.jpa.boot.spi.Bootstrap;
+import org.joda.time.DateTime;
+import org.junit.rules.ExternalResource;
+import org.testcontainers.containers.JdbcDatabaseContainer;
+import org.testcontainers.containers.PostgreSQLContainer;
+
+/**
+ * JUnit Rule to provision {@link JpaTransactionManagerImpl} backed by {@link PostgreSQLContainer}.
+ *
+ * <p>This rule also replaces the {@link JpaTransactionManagerImpl} provided by {@link
+ * TransactionManagerFactory} with the {@link JpaTransactionManagerImpl} generated by the rule
+ * itself, so that all SQL queries will be sent to the database instance created by {@link
+ * PostgreSQLContainer} to achieve test purpose.
+ */
+public class JpaTransactionManagerRule extends ExternalResource {
+  private static final String SCHEMA_GOLDEN_SQL = "sql/schema/nomulus.golden.sql";
+  private static final String DB_CLEANUP_SQL =
+      "google/registry/model/transaction/cleanup_database.sql";
+  private static final String MANAGEMENT_DB_NAME = "management";
+  private static final String POSTGRES_DB_NAME = "postgres";
+
+  private final DateTime now = DateTime.now(UTC);
+  private final FakeClock clock = new FakeClock(now);
+  private final String initScriptPath;
+  private final ImmutableList<Class> extraEntityClasses;
+  private final ImmutableMap userProperties;
+
+  private static final JdbcDatabaseContainer database = create();
+  private EntityManagerFactory emf;
+  private JpaTransactionManager cachedTm;
+
+  private JpaTransactionManagerRule(
+      String initScriptPath,
+      ImmutableList<Class> extraEntityClasses,
+      ImmutableMap<String, String> userProperties) {
+    this.initScriptPath = initScriptPath;
+    this.extraEntityClasses = extraEntityClasses;
+    this.userProperties = userProperties;
+  }
+
+  private static JdbcDatabaseContainer create() {
+    PostgreSQLContainer container = new PostgreSQLContainer().withDatabaseName(MANAGEMENT_DB_NAME);
+    container.start();
+    Runtime.getRuntime().addShutdownHook(new Thread(() -> container.close()));
+    return container;
+  }
+
+  @Override
+  public void before() throws Exception {
+    executeSql(MANAGEMENT_DB_NAME, DB_CLEANUP_SQL);
+    executeSql(POSTGRES_DB_NAME, initScriptPath);
+
+    ImmutableMap properties = PersistenceModule.providesDefaultDatabaseConfigs();
+    if (!userProperties.isEmpty()) {
+      // If there are user properties, create a new properties object with these added.
+      ImmutableMap.Builder builder = properties.builder();
+      builder.putAll(userProperties);
+      properties = builder.build();
+    }
+
+    emf =
+        createEntityManagerFactory(
+            getJdbcUrlFor(POSTGRES_DB_NAME),
+            database.getUsername(),
+            database.getPassword(),
+            properties,
+            extraEntityClasses);
+    JpaTransactionManagerImpl txnManager = new JpaTransactionManagerImpl(emf, clock);
+    cachedTm = TransactionManagerFactory.jpaTm;
+    TransactionManagerFactory.jpaTm = txnManager;
+  }
+
+  @Override
+  public void after() {
+    TransactionManagerFactory.jpaTm = cachedTm;
+    if (emf != null) {
+      emf.close();
+    }
+    cachedTm = null;
+  }
+
+  private void executeSql(String dbName, String sqlScriptPath) {
+    try (Connection conn = createConnection(dbName)) {
+      String sqlScript = Resources.toString(Resources.getResource(sqlScriptPath), Charsets.UTF_8);
+      conn.createStatement().execute(sqlScript);
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  private String getJdbcUrlFor(String dbName) {
+    // Disable Postgres driver use of java.util.logging to reduce noise at startup time
+    return "jdbc:postgresql://"
+        + database.getContainerIpAddress()
+        + ":"
+        + database.getMappedPort(POSTGRESQL_PORT)
+        + "/"
+        + dbName
+        + "?loggerLevel=OFF";
+  }
+
+  private Connection createConnection(String dbName) {
+    final Properties info = new Properties();
+    info.put("user", database.getUsername());
+    info.put("password", database.getPassword());
+    final Driver jdbcDriverInstance = database.getJdbcDriverInstance();
+    try {
+      return jdbcDriverInstance.connect(getJdbcUrlFor(dbName), info);
+    } catch (SQLException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  /** Constructs the {@link EntityManagerFactory} instance. */
+  private static EntityManagerFactory createEntityManagerFactory(
+      String jdbcUrl,
+      String username,
+      String password,
+      ImmutableMap<String, String> configs,
+      ImmutableList<Class> extraEntityClasses) {
+    HashMap<String, String> properties = Maps.newHashMap(configs);
+    properties.put(Environment.URL, jdbcUrl);
+    properties.put(Environment.USER, username);
+    properties.put(Environment.PASS, password);
+
+    ParsedPersistenceXmlDescriptor descriptor =
+        PersistenceXmlParser.locatePersistenceUnits(properties).stream()
+            .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+            .findFirst()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format(
+                            "Could not find persistence unit with name %s",
+                            PersistenceModule.PERSISTENCE_UNIT_NAME)));
+
+    extraEntityClasses.stream().map(Class::getName).forEach(descriptor::addClasses);
+    return Bootstrap.getEntityManagerFactoryBuilder(descriptor, properties).build();
+  }
+
+  /** Returns the {@link FakeClock} used by the underlying {@link JpaTransactionManagerImpl}. */
+  public FakeClock getTxnClock() {
+    return clock;
+  }
+
+  /** Builder for {@link JpaTransactionManagerRule}. */
+  public static class Builder {
+    private String initScript;
+    private List<Class> extraEntityClasses = new ArrayList<Class>();
+    private Map<String, String> userProperties = new HashMap<String, String>();
+
+    /**
+     * Sets the SQL script to be used to initialize the database. If not set,
+     * sql/schema/nomulus.golden.sql will be used.
+     */
+    public Builder withInitScript(String initScript) {
+      this.initScript = initScript;
+      return this;
+    }
+
+    /** Adds annotated class(es) to the known entities for the database. */
+    public Builder withEntityClass(Class... classes) {
+      this.extraEntityClasses.addAll(ImmutableSet.copyOf(classes));
+      return this;
+    }
+
+    /** Adds the specified property to those used to initialize the transaction manager. */
+    public Builder withProperty(String name, String value) {
+      this.userProperties.put(name, value);
+      return this;
+    }
+
+    /** Builds a {@link JpaTransactionManagerRule} instance. */
+    public JpaTransactionManagerRule build() {
+      if (initScript == null) {
+        initScript = SCHEMA_GOLDEN_SQL;
+      }
+      return new JpaTransactionManagerRule(
+          initScript,
+          ImmutableList.copyOf(extraEntityClasses),
+          ImmutableMap.copyOf(userProperties));
+    }
+  }
+}
@@ -0,0 +1,90 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.transaction;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import google.registry.model.ImmutableObject;
+import java.util.List;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.PersistenceException;
+import org.hibernate.cfg.Environment;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** JUnit test for {@link JpaTransactionManagerRule} */
+@RunWith(JUnit4.class)
+public class JpaTransactionManagerRuleTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .withProperty(Environment.HBM2DDL_AUTO, "update")
+          .build();
+
+  @Test
+  public void verifiesRuleWorks() {
+    assertThrows(
+        PersistenceException.class,
+        () ->
+            jpaTm()
+                .transact(
+                    () ->
+                        jpaTm()
+                            .getEntityManager()
+                            .createNativeQuery("SELECT * FROM NoneExistentTable")
+                            .getResultList()));
+    jpaTm()
+        .transact(
+            () -> {
+              List results =
+                  jpaTm()
+                      .getEntityManager()
+                      .createNativeQuery("SELECT * FROM \"ClaimsList\"")
+                      .getResultList();
+              assertThat(results).isEmpty();
+            });
+  }
+
+  @Test
+  public void testExtraParameters() {
+    // This test verifies that 1) withEntityClass() has registered TestEntity and 2) The table
+    // has been created, implying withProperty(HBM2DDL_AUTO, "update") worked.
+    TestEntity original = new TestEntity("key", "value");
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(original));
+    TestEntity retrieved =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "key"));
+    assertThat(retrieved).isEqualTo(original);
+  }
+
+  @Entity(name = "TestEntity") // Specify name to avoid nested class naming issues.
+  static class TestEntity extends ImmutableObject {
+    @Id String key;
+    String value;
+
+    TestEntity(String key, String value) {
+      this.key = key;
+      this.value = value;
+    }
+
+    TestEntity() {}
+  }
+}
@@ -0,0 +1,67 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.hash.Funnels.stringFunnel;
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.hash.BloomFilter;
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import org.hibernate.cfg.Environment;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class BloomFilterConverterTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .withProperty(Environment.HBM2DDL_AUTO, "update")
+          .build();
+
+  @Test
+  public void roundTripConversion_returnsSameBloomFilter() {
+    BloomFilter<String> bloomFilter = BloomFilter.create(stringFunnel(US_ASCII), 3);
+    ImmutableSet.of("foo", "bar", "baz").forEach(bloomFilter::put);
+    TestEntity entity = new TestEntity(bloomFilter);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    TestEntity persisted =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "id"));
+    assertThat(persisted.bloomFilter).isEqualTo(bloomFilter);
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  public static class TestEntity extends ImmutableObject {
+
+    @Id String name = "id";
+
+    BloomFilter<String> bloomFilter;
+
+    public TestEntity() {}
+
+    public TestEntity(BloomFilter<String> bloomFilter) {
+      this.bloomFilter = bloomFilter;
+    }
+  }
+}
@@ -0,0 +1,78 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import org.hibernate.cfg.Environment;
+import org.joda.time.DateTime;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class CreateAutoTimestampConverterTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .withProperty(Environment.HBM2DDL_AUTO, "update")
+          .build();
+
+  @Test
+  public void testTypeConversion() {
+    CreateAutoTimestamp ts = CreateAutoTimestamp.create(DateTime.parse("2019-09-9T11:39:00Z"));
+    TestEntity ent = new TestEntity("myinst", ts);
+
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(ent));
+    TestEntity result =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "myinst"));
+    assertThat(result).isEqualTo(new TestEntity("myinst", ts));
+  }
+
+  @Test
+  public void testAutoInitialization() {
+    CreateAutoTimestamp ts = CreateAutoTimestamp.create(null);
+    TestEntity ent = new TestEntity("autoinit", ts);
+
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(ent));
+
+    TestEntity result =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "autoinit"));
+    assertThat(result.cat.getTimestamp()).isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  public static class TestEntity extends ImmutableObject {
+
+    @Id String name;
+
+    CreateAutoTimestamp cat;
+
+    public TestEntity() {}
+
+    public TestEntity(String name, CreateAutoTimestamp cat) {
+      this.name = name;
+      this.cat = cat;
+    }
+  }
+}
@@ -26,9 +26,9 @@ import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 import org.testcontainers.containers.PostgreSQLContainer;

-/** Unit tests for {@link EntityManagerFactoryProvider}. */
+/** Unit tests for {@link PersistenceModule}. */
@RunWith(JUnit4.class)
-public class EntityManagerFactoryProviderTest {
+public class PersistenceModuleTest {
  @Rule public PostgreSQLContainer database = new PostgreSQLContainer();

  private EntityManagerFactory emf;
@@ -36,8 +36,11 @@ public class EntityManagerFactoryProviderTest {
  @Before
  public void init() {
    emf =
-        EntityManagerFactoryProvider.create(
-            database.getJdbcUrl(), database.getUsername(), database.getPassword());
+        PersistenceModule.create(
+            database.getJdbcUrl(),
+            database.getUsername(),
+            database.getPassword(),
+            PersistenceModule.providesDefaultDatabaseConfigs());
  }

  @After
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Shicong Huang	85c11ca889	Use a single database container for all tests (#313 )	2019-10-15 15:09:03 -04:00
sarahcaseybot	340bf40642	Update Spec11 email template (#308 ) * Changes to Spec11 notice email. * Fix lines that were too long	2019-10-14 12:23:28 -04:00
Michael Muller	53ece5eda4	Enable filtering across all test tasks (#311 ) The segregated test targets in core break the --tests filter. Fix this by defining a "testFilter" property and creating the FilteringTest task type that applies it to the property set by "--tests".	2019-10-11 14:24:01 -04:00
Shicong Huang	6c220567c8	Write ClaimsList to Cloud SQL (#223 ) * Rewrite ClaimsListShard with new API * Write ClaimsList to Cloud SQL * Add creationTimestamp	2019-10-11 12:31:34 -04:00
Weimin Yu	c3e3a1353b	Allow schema-push to all env with Flyway (#309 ) * Make Flyway schema task work with prod and sandbox Also renamed the 'superuser' role to 'admin' since we do not own super user in Cloud SQL. * Allow pushing schema to all env with Flyway Desktop schema push to production is needed in the short term. Long-termly we need to decide if this should be kept for glass breaking Schema push to sandbox and production requires interactiveconfirmation. Also fixed a typo in initialize_roles.sql.	2019-10-10 16:32:21 -04:00
Ben McIlwain	ce480a5191	Add Bloom filters to the Cloud SQL PremiumList schema (#306 ) * Add Bloom filters to the Cloud SQL PremiumList schema They are slightly different from the existing Bloom filters stored in Datastore in that they now use an ASCII String encoding rather than the more generic CharSequence, and there is no maximum size (whereas we previously had to live within the 1 MB max entity size for Datastore).	2019-10-09 17:06:42 -04:00
Weimin Yu	f2a2b2d2e2	Modify Cloud SQL user management scripts (#302 ) * Modify Cloud SQL user management scripts Create readonly and readwrite roles that may be granted to users. Also configured default privileges for tables created in the future. Made sure arbitrary users may not create database or tables. * Modify Cloud SQL user management scripts Create readonly and readwrite roles that may be granted to users. Also configured default privileges for tables created in the future. Made sure arbitrary users may not create database or tables.	2019-10-09 16:02:42 -04:00
gbrodman	906b054f4b	Load persistence.xml classes before adding test entities (#307 ) * Load persistence.xml classes before adding test entities * Also use persistence.xml in GenerateSqlSchemaCommand * Add exception message * remove duplicate line	2019-10-09 15:15:04 -04:00
Shicong Huang	a694e247cd	Add support for nomulus tool to connect to Cloud SQL (#303 )	2019-10-09 10:30:35 -04:00
Shicong Huang	022f397cd9	Implement ZonedDateTimeConverter (#287 ) * Implement ZonedDateTimeConverter * Use dedicated TestEntity for ZonedDateTimeConverterTest	2019-10-08 16:46:07 -04:00
Ben McIlwain	5dc058ec99	Automatically apply JPA type converters (#305 ) * Automatically apply JPA type converters * Include converters in tests and schema generation too	2019-10-08 13:16:39 -04:00
Ben McIlwain	0fd7cf29b5	Make it clear that registered domain lists are also exported to Drive (#304 ) * Make it clear that registered domain lists are also exported to Drive	2019-10-08 13:15:55 -04:00
Ben McIlwain	bc7f3546c7	Add initial support for persisting premium lists to Cloud SQL (#285 ) * Add initial support for persisting premium lists to Cloud SQL This adds support to the `nomulus create_premium_list` command only; support for `nomulus update_premium_list` will be in a subsequent PR. The design goals for this PR were: 1. Do not change the existing codepaths for premium lists at all, especially not on the read path. 2. Write premium lists to Cloud SQL only if requested (i.e. not by default), and write to Datastore first so as to not be blocked by errors with Cloud SQL. 3. Reuse existing codepaths to the maximum possible extent (e.g. don't yet re-implement premium list parsing; take advantage of the existing logic), but also ... 4. Some duplication is OK, since the existing Datastore path will be deleted once this migration is complete, leaving only the codepaths for Cloud SQL. * Refactor out common logic * Add DAO test * Add tests for parsing premium lists * Use containsExactly * Code review changes * Format * Re-generate schema * Fix column names * Make some tests pass * Add SQL migration scripts * Fix test errors	2019-10-08 11:47:22 -04:00
Ben McIlwain	658f61bd8f	Fix errors in DB update README file (#301 ) * Fix errors in DB update README file	2019-10-07 15:55:53 -04:00
Michael Muller	8ca8fff387	Refactor environment -> project map out of build (#300 ) Move the project mapping into its own file so that it can be more easily overriden.	2019-10-07 13:34:49 -04:00
Michael Muller	8bcfb1802e	Add an explanation to dummied-out JPA init (#299 ) * Add an explanation to dummied-out JPA init Add a more elaborate explanation of why actual JpaTransactionManager initialization was removed from the factory.	2019-10-07 12:47:24 -04:00
gbrodman	a259dee986	Add a DAO for RegistryLock objects (#290 ) * Add a DAO for RegistryLock objects * Add an index on verification code and remove old file * Move to v4 * Use camelCase in index names * Javadoc fixes * Allow alteration of RegistryLock objects in-place * save, load-modify, read in separate transactions * Change the creation timestamp to be a CreateAutoTimestamp	2019-10-07 11:24:08 -04:00
Michael Muller	ebc8d54f94	Add persistence.xml to the war files (#293 ) * Add persistence.xml to the war files * Always use the DummyJpaTransactionManager Use the DJTM until we get all of the dependencies set up for all of the environments. This shouldn't affect any of the unit tests, these use the JpaTransactionManagerRule to set up a local database and connection. This fixes the App Engine build.	2019-10-06 21:32:27 -04:00
sarahcaseybot	e9ce389269	Implement UpdateAutoTimestampConverter (#298 ) * Implement a JPA-based converter for UpdateAutoTimestamp, allowing us to persist instances of this class.	2019-10-04 16:45:32 -04:00
Michael Muller	e07be9780e	Implement CreateAutoTimestampConverter (#282 ) * Implement CreateAutoTimestampConverter Implement a JPA-based converter for CreateAutoTimestamp, allowing us to persist instances of this class. Note that converters appear to be required to convert to and from database types that are generally known to JDBC. For example, conversion to Timestamp works, conversion to OffsetDateTime does not (even though this works through the JDBC interface directly).	2019-10-04 16:31:14 -04:00
Michael Muller	31b5abb9a1	Improve error handling for environment property (#295 ) * Improve error handling for environment property Improve the error messages that we get for a bad or missing environment property. Move the property processing into the main build so that we do it only once and configure all of the appengine deployment tasks to check that a project has been defined and print a friendly error if it hasn't. Note that even if the check isn't configured, this change prevents deployment because the gcpProject will be set to null. It just won't print as useful an error message. Tested: ran appengineDeployAll with and without the environment property, ran "build" to verify that we don't get any complaints for non-deployment targets. * Changes for review. * Changes for review * Changes for review. * Changes for review.	2019-10-04 13:23:36 -04:00
Michael Muller	aa4e242a34	Give JpaTransactionManagerRule more parameters (#292 ) * Give JpaTransactionManagerRule more parameters Allow users of the rule to add annotated classes and properties, both useful for testing. * Change in response to review. * Changes for review. * Move test EntityManagerFactory create method Move the test create method into the JpaTransactionManagerRuleTest. * Remove nomulus SQL dialect from G.S.S.Command Remove NomulusPostgreSQLDialect from GenerateSqlSchemaCommand (it has been moved to its own top-level class).	2019-10-03 16:14:28 -04:00
Weimin Yu	964f264c9d	Add maven-publish task for SQL schema jar (#289 ) * Add maven-publish task for SQL schema jar Add task to publish SQL schema jar with flyway scripts and golden schema to a maven repo. This will be used for pre-release testing in the future. This task is not part of build and needs to be invoked explicitly. User needs to provide schema_jar_repo and schema_version properties. * Merge branch 'master' of https://github.com/google/nomulus into publish-schema-jar * Add maven-publish task for SQL schema jar Add task to publish SQL schema jar with flyway scripts and golden schema to a maven repo. This will be used for pre-release testing in the future. This task is not part of build and needs to be invoked explicitly. User needs to provide schema_jar_repo and schema_version properties.	2019-10-02 14:27:36 -04:00
gbrodman	cc018a6dac	Don't crash on a null completion timestamp (#296 ) * Don't crash on a null completion timestamp * optional	2019-10-02 12:53:22 -04:00
Weimin Yu	c25adbbd9c	Restrict nomulus user access to flyway table (#297 ) * Restrict nomulus user access to flyway table The regular read-write user should not have write permissions to the flyway metadata table.	2019-10-02 11:05:46 -04:00
gbrodman	42edf16f3f	Edit a couple of nits in the db README (#291 ) * Edit a couple of nits in the db README * Update README.md	2019-09-30 15:50:19 -04:00
Shicong Huang	36ab0cb45c	Add Cloud SQL configs for nomulus tool (#288 ) We will use a different user for nomulus tool to connect to Cloud SQL. This PR added corresponding configurations for that.	2019-09-27 15:58:18 -04:00
Shicong Huang	34da498958	Add sql scripts to create other types of user (#283 ) 1. User with read-only permission to all tables 2. User with read-write permission to schema and all tables	2019-09-27 15:12:59 -04:00
Lai Jiang	a3317b8552	Protect KMS-secured data against destruction in upcoming google provider update. (#284 ) Export of cl/270900150. To refer to a KMS key or key ring, we should use the stable `.self_link`. Using `.id` instead provides an unstable identifier which may change (and it will change in the upcoming update of the google provider to 2.9.1). A change in the identifier will cause Terraform to destroy and recreate the key. Destroying the key means all data associated with it is lost; the key cannot be recreated. This CL replaces `.id` with `.self_link`, so all of those problems will not happen. In addition, `prevent_destroy` protects the key against delete-and-recreate in general.	2019-09-27 12:12:58 -04:00
Shicong Huang	9c7872dbb7	Add socket factory as runtime dependency (#286 ) * Add Cloud SQL socket factory as runtime dependency * Lock update from update_dependency.sh	2019-09-27 11:41:59 -04:00
Shicong Huang	ff439f598d	Add JpaTransactionManagerRule (#277 ) * Add RegistryRuntime and JpaTransactionManagerRule * Revert RegistryJavaRuntime change * Add JpaTransactionManager interface	2019-09-24 15:38:53 -04:00
Weimin Yu	b0c13042a6	Upgrade to Truth 1.0 (#281 ) * Upgrade to Truth 1.0 Refactored fail(...) to assertWithMessage().fail(). Upgraded com.google.monitoring-client family of dependencies to 1.0.6 Also fixed bad use of io.StringIO (on binary buffer) recently introduced to google-java-format-diff.py.	2019-09-24 10:23:58 -04:00
Lai Jiang	3009f754fa	Link to Sourcegraph logo a different file. (#280 ) The logo will be visible on cloned repos outside GitHub. See b/141380880.	2019-09-23 15:31:09 -04:00
Shicong Huang	cc314d4838	Make project core depend on db at test runtime (#278 ) This PR also upgraded the version of Guava to 28.1-jre to resolve missing stream package issue.	2019-09-23 14:12:24 -04:00
Michael Muller	153fc7d6bf	Add work-around for our "explode war" failure (#279 ) For some reason tools.jar (which we don't need in the runtime in the first place) gets exploded readonly, causing subsequent builds to fail since they can't overwrite it. This hack makes it writable at the end of explodeWar.	2019-09-20 16:23:36 -04:00
Shicong Huang	b35c813ae6	Add sql files to manage nomulus user (#274 )	2019-09-20 14:46:02 -04:00
Lai Jiang	3764e2b26c	Update registryTool task to better handle command line arguments (#273 ) * Update registryTool task to better handle command line arguments Tokens are delimited by pipes and can be escaped. If we use -args directly, we will not be able to escape the delimiter, if both the double and single quotes happen to be present in the arguments. See: https://docs.gradle.org/current/javadoc/org/gradle/api/tasks/JavaExec.html#setArgsString-java.lang.String-	2019-09-20 13:04:01 -04:00
gbrodman	8f5bd5da01	Fix non-Python3-compliant code in formatter script (#275 ) * Fix non-Python3-compliant code in formatter script * Add space	2019-09-19 12:49:22 -04:00
Weimin Yu	8123c53916	Fix dependency-locking config (#276 ) * Fix dependency-locking config Reenable dependency locking after a bug errorneouly turned it off. Removed the guava-related workaround that forcefully resolve to the -jre distribution. Enabled locking for buildSrc by updating its property file. Updated all lock files.	2019-09-19 11:37:20 -04:00
Shicong Huang	d031dedad6	Implement JpaTransactionManager (#268 )	2019-09-19 10:01:40 -04:00
Michael Muller	d14f0fe485	Output command test output as well as consuming it (#248 ) * Output command test output as well as consuming it CommandTestCase currently consumes stdout & stderr for the command being tested. Unfortunately, this results in us not being able to see the command output. Add an output splitter so that output gets written to the original stream in addition to being captured. A simpler approach would be to print the captured data after command completion. However, this won't work for tests that become hung and also won't display results in real-time. Tested: Ran a command test with verboseTestOutput=true, verified that standard output was visible. * Save and restore original stdout/err in cmd tests We have to restore the original stdout/stderr print streams otherwise we end up nesting them across tests which eventually causes the RDE tests to OOM.	2019-09-17 13:23:30 -04:00
Lai Jiang	b86a35bca1	Upgrade to Gradle 5.6.2 (#272 )	2019-09-16 14:07:59 -07:00
Weimin Yu	1db5fba452	Add RegistryLock schema to Flyway deployment folder (#270 ) * Add RegistryLock schema to Flyway deployment folder Added creation script of RegistryLock to Flyway deployment folder. Fixed previous scripts (PremiumList- and ClaimsList-related) for FK name change (cause by table name changes: names are quoted now). We should consider generating foreign key names by ourselves. Since the alpha database is empty, we dropped and recreated the schema. Added instructions on how to submit new database incremental changes in the README file. Updated RegistryLock.java, removing unnecessary annotations: - For most fields, the 'name=' property is no longer necessary not that the naming strategy is in place. The exceptions are the two used in the unique index. - The @Column annotation is implicit.	2019-09-16 16:47:58 -04:00
Weimin Yu	668ed7c5f6	Force Gradle to use jre version of Guava (#271 ) * Force Gradle to use jre version of Guava Guava is often specified by version only by other dependencies. In such cases, Gradle usually resolves it to the '-android' version, which lacks the collection classes. We use custom resolution strategy to force the selection of the '-jre' version.	2019-09-16 14:36:14 -04:00
Weimin Yu	3fb799f112	Add schema deployment tests (#265 ) * Add schema deployment tests Updated flyway schema script files so that they reflect what is currently deployed in alpha: ClaimsList and PremiumList related elements. Put post-schema-push pg_dump output in nomulus.golden.sql as the authoritative schema. Also added test to verify that the schema pushed by flyway will result in exactly the golden schema. Upgraded testcontainers to 1.12.1. Added a custom Truth subject for better diffing of multi-line text blocks. Removed claims_list.sql and premium_list.sql, as we do not have use for them. * Add schema deployment tests Updated flyway schema script files so that they reflect what is currently deployed in alpha: ClaimsList and PremiumList related elements. Put post-schema-push pg_dump output in nomulus.golden.sql as the authoritative schema. Also added test to verify that the schema pushed by flyway will result in exactly the golden schema. Upgraded testcontainers to 1.12.1. Added a custom Truth subject for better diffing of multi-line text blocks. Removed claims_list.sql and premium_list.sql, as we do not have use for them. * Add schema deployment tests Updated flyway schema script files so that they reflect what is currently deployed in alpha: ClaimsList and PremiumList related elements. Put post-schema-push pg_dump output in nomulus.golden.sql as the authoritative schema. Also added test to verify that the schema pushed by flyway will result in exactly the golden schema. Upgraded testcontainers to 1.12.1. Added a custom Truth subject for better diffing of multi-line text blocks. Removed claims_list.sql and premium_list.sql, as we do not have use for them.	2019-09-12 15:16:12 -04:00
Weimin Yu	40a6b788a0	Regenerate schema using tools command (#269 ) * Regenerate schema using tools command Rerun GenerateSqlSchemaCommand to pick up RegistryLock and naming strategy change. Also updated a new license term which seems to just pop up.	2019-09-12 14:26:22 -04:00
Lai Jiang	b87ef869a0	Add a task to run the nomulus tool (#262 )	2019-09-12 08:09:32 -07:00
Shicong Huang	48d8b1274f	Add configurations for Cloud SQL secrets (#266 )	2019-09-11 12:20:08 -04:00
gbrodman	401653ad4a	Add RegistryLock SQL schema (#243 ) * Add RegistryLock SQL schema * Refactor a bit * Move registrylock -> domain * Clearing up lock workflow * Add more docs and remove LockStatus * Responses to CR * Add repoId javadoc * Add registry lock to persistence xml file * Quote rather than backtick * Remove unnecessary check * File TODO * Remove uniqueness constraint on verification code * Remove import * add index * Add to SQL generation task * Move fields around to be the same order as Hibernate's generated sql	2019-09-10 18:17:36 -04:00
gbrodman	b35026b30d	Add naming strategy (#256 ) * Add naming strategy * Add test for formatting in GenerateSqlSchemaCommandTest * "domain" -> "Domain" * Call site literals * checkstyle * varchar -> text * Fix external messaging capitalization typo	2019-09-09 14:27:52 -04:00
Michael Muller	c5e4e862bd	Fix command tests that set stdout/stderr (#258 ) * Fix command tests that set stdout/stderr CommandTestCase already wraps stdout stderr, just use the provided methods.	2019-09-09 09:12:48 -04:00