Use 10 workers instead of the default 100 for re-save all EPP resources (#904 )

* Use 10 workers instead of the default 100 for re-save all EPP resources The intended/desired effect is to have a larger number of GCS commit log diffs spread out over a longer period of time, with each diff itself being significantly smaller. This should retain roughly the same amount of total work for the async Cloud SQL replication action to have to deal with, but spread across 10X as much time.
Add a credential store backed by Secret Manager (#901 )
2026-01-24 06:32:20 +00:00 · 2020-12-10 15:25:25 -05:00 · 2020-12-10 11:29:44 -05:00 · 2020-12-09 15:52:56 -05:00 · 2020-12-09 10:30:23 -05:00 · 2020-12-08 15:13:44 -05:00
660 changed files with 39517 additions and 6171 deletions
--- a/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,25 +1,28 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/compile.lockfile
+++ b/buildSrc/gradle/dependency-locks/compile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/compileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtime.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -50,7 +50,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.json:json:20160212
 org.ow2.asm:asm-analysis:6.0
 org.ow2.asm:asm-commons:6.0
--- a/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/buildSrc/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -22,7 +22,7 @@ com.google.code.gson:gson:2.7
 com.google.common.html.types:types:1.0.4
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
@@ -58,7 +58,7 @@ org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.hamcrest:hamcrest-core:1.3
 org.json:json:20160212
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/compile.lockfile
+++ b/common/gradle/dependency-locks/compile.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/compileClasspath.lockfile
+++ b/common/gradle/dependency-locks/compileClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/default.lockfile
+++ b/common/gradle/dependency-locks/default.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/deploy_jar.lockfile
+++ b/common/gradle/dependency-locks/deploy_jar.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/errorprone.lockfile
+++ b/common/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/runtime.lockfile
+++ b/common/gradle/dependency-locks/runtime.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -4,9 +4,9 @@
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
--- a/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,7 +17,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -18,7 +18,7 @@ joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.apiguardian:apiguardian-api:1.1.0
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
 org.junit.jupiter:junit-jupiter-api:5.6.2
--- a/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
+++ b/common/gradle/dependency-locks/testingAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -6,7 +6,7 @@ com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -16,6 +16,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -7,7 +7,7 @@ com.google.errorprone:error_prone_annotations:2.3.4
 com.google.flogger:flogger-system-backend:0.1
 com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.truth:truth:1.0
@@ -17,6 +17,6 @@ javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
 junit:junit:4.12
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.hamcrest:hamcrest-core:1.3
--- a/common/src/main/java/google/registry/util/DateTimeUtils.java
+++ b/common/src/main/java/google/registry/util/DateTimeUtils.java
@@ -24,6 +24,7 @@ import java.time.ZonedDateTime;
 import java.util.TimeZone;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
+import org.joda.time.LocalDate;

 /** Utilities methods and constants related to Joda {@link DateTime} objects. */
 public class DateTimeUtils {
@@ -108,4 +109,12 @@ public class DateTimeUtils {
        zonedDateTime.toInstant().toEpochMilli(),
        DateTimeZone.forTimeZone(TimeZone.getTimeZone(zonedDateTime.getZone())));
  }
+
+  public static java.sql.Date toSqlDate(LocalDate localDate) {
+    return new java.sql.Date(localDate.toDateTimeAtStartOfDay().getMillis());
+  }
+
+  public static LocalDate toLocalDate(java.sql.Date date) {
+    return new LocalDate(date.getTime(), DateTimeZone.UTC);
+  }
 }
--- a/common/src/main/java/google/registry/util/SystemSleeper.java
+++ b/common/src/main/java/google/registry/util/SystemSleeper.java
@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.util.concurrent.Uninterruptibles;
 import java.io.Serializable;
-import java.util.concurrent.TimeUnit;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.inject.Inject;
 import org.joda.time.ReadableDuration;
@@ -41,6 +40,6 @@ public final class SystemSleeper implements Sleeper, Serializable {
  @Override
  public void sleepUninterruptibly(ReadableDuration duration) {
    checkArgument(duration.getMillis() >= 0);
-    Uninterruptibles.sleepUninterruptibly(duration.getMillis(), TimeUnit.MILLISECONDS);
+    Uninterruptibles.sleepUninterruptibly(java.time.Duration.ofMillis(duration.getMillis()));
  }
 }
--- a/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
+++ b/common/src/testing/java/google/registry/testing/truth/TruthUtils.java
@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.testing.truth;
+
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import com.google.common.truth.Truth;
+import javax.annotation.Nullable;
+
+/** Utils class containing helper functions for {@link Truth}. */
+public class TruthUtils {
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(@Nullable Object thisObj, @Nullable Object thatObj) {
+    if (thisObj == null) {
+      assertWithMessage("Expects both objects are null but thatObj is not null")
+          .that(thatObj)
+          .isNull();
+    } else {
+      assertWithMessage("Expects both objects are not null but thatObj is null")
+          .that(thatObj)
+          .isNotNull();
+    }
+  }
+
+  /** Asserts that both of the given objects are either null or nonnull. */
+  public static void assertNullnessParity(
+      @Nullable Object thisObj, @Nullable Object thatObj, String errorMessage) {
+    if (thisObj == null) {
+      assertWithMessage(errorMessage).that(thatObj).isNull();
+    } else {
+      assertWithMessage(errorMessage).that(thatObj).isNotNull();
+    }
+  }
+}
--- a/config/nom_build.py
+++ b/config/nom_build.py
@@ -16,7 +16,7 @@
 """

 import argparse
-import attr
+import dataclasses
 import io
 import os
 import shutil
@@ -25,7 +25,7 @@ import sys
 from typing import List, Union


-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class Property:
    name : str = ''
    desc : str = ''
@@ -39,7 +39,7 @@ class Property:
                raise ValidationError('value of {self.name} must be "true" or '
                                      '"false".')

-@attr.s(auto_attribs=True)
+@dataclasses.dataclass
 class GradleFlag:
    flags : Union[str, List[str]]
    desc : str
@@ -300,9 +300,15 @@ def do_pseudo_task(task: str) -> None:
                    f'{root}/db/src/main/resources/sql/schema/'
                    'nomulus.golden.sql')

-        if subprocess.call([f'{root}/gradlew', ':db:test']):
-            print('\033[31mERROR:\033[0m Golden file test failed after '
-                  'copying schema.  Please check your flyway files.')
+        # Rerun :db:test and regenerate the ER diagram (at "warning" log
+        # level so it doesn't generate pages of messaging)
+        if subprocess.call([f'{root}/gradlew', ':db:test', 'devTool',
+                            '--args=-e localhost --log_level=WARNING '
+                            'generate_sql_er_diagram -o '
+                            f'{root}/db/src/main/resources/sql/er_diagram']):
+            print('\033[31mERROR:\033[0m Golden file test or ER diagram '
+                  'generation failed after copying schema.  Please check your '
+                  'flyway files.')
            raise Abort()
    else:
        print(f'\033[31mERROR:\033[0m Unknown task {task}')
@@ -377,6 +383,7 @@ def main(args) -> int:

    # See if there are any special ":nom:" pseudo-tasks specified.
    got_non_pseudo_tasks = False
+    got_pseudo_tasks = False
    for arg in args.non_flag_args[1:]:
        if arg.startswith(':nom:'):
            if got_non_pseudo_tasks:
@@ -388,13 +395,14 @@ def main(args) -> int:
                      'specified prior to all actual gradle tasks.  Aborting.')
                return 1
            do_pseudo_task(arg)
+            got_pseudo_tasks = True
        else:
            got_non_pseudo_tasks = True
    non_flag_args = [
        arg for arg in args.non_flag_args[1:] if not arg.startswith(':nom:')]

    if not non_flag_args:
-        if not got_non_pseudo_tasks:
+        if not got_pseudo_tasks:
            print('\033[33mWARNING:\033[0m No tasks specified.  Not '
                  'doing anything')
        return 0
--- a/config/nom_build_test.py
+++ b/config/nom_build_test.py
@@ -113,7 +113,10 @@ class MyTest(unittest.TestCase):
        nom_build.main(['nom_build', ':nom:generate_golden_file'])
        self.call_mock.assert_has_calls([
            mock.call([GRADLEW, ':db:test']),
-            mock.call([GRADLEW, ':db:test'])
+            mock.call([GRADLEW, ':db:test', 'devTool',
+                       '--args=-e localhost --log_level=WARNING '
+                       'generate_sql_er_diagram -o '
+                       '/tmp/rootdir/db/src/main/resources/sql/er_diagram'])
        ])

    def test_generate_golden_file_nofail(self):
@@ -122,5 +125,3 @@ class MyTest(unittest.TestCase):
        self.call_mock.assert_has_calls([mock.call([GRADLEW, ':db:test'])])

 unittest.main()
-
-
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -171,6 +171,8 @@ dependencies {
  testRuntime files(sourceSets.test.resources.srcDirs)

  compile deps['com.beust:jcommander']
+  compile deps['com.google.api:gax']
+  compile deps['com.google.api.grpc:proto-google-cloud-secretmanager-v1']
  compile deps['com.google.api-client:google-api-client']
  compile deps['com.google.api-client:google-api-client-appengine']
  compile deps['com.google.api-client:google-api-client-servlet']
@@ -196,6 +198,7 @@ dependencies {
  compile deps['com.google.auth:google-auth-library-oauth2-http']
  compile deps['com.google.cloud.sql:jdbc-socket-factory-core']
  runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
+  compile deps['com.google.cloud:google-cloud-secretmanager']
  compile deps['com.google.code.gson:gson']
  compile deps['com.google.auto.value:auto-value-annotations']
  compile deps['com.google.code.findbugs:jsr305']
@@ -215,12 +218,15 @@ dependencies {
  compile deps['com.google.oauth-client:google-oauth-client-jetty']
  compile deps['com.google.oauth-client:google-oauth-client-appengine']
  compile deps['com.google.oauth-client:google-oauth-client-servlet']
+  compile deps['com.google.protobuf:protobuf-java']
  compile deps['com.google.re2j:re2j']
  compile deps['com.google.template:soy']
  compile deps['com.googlecode.json-simple:json-simple']
  compile deps['com.jcraft:jsch']
  testCompile deps['com.thoughtworks.qdox:qdox']
+  compile deps['com.zaxxer:HikariCP']
  compile deps['dnsjava:dnsjava']
+  runtime deps['guru.nidi:graphviz-java-all-j2v8']
  testCompile deps['io.github.classgraph:classgraph']
  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['javax.annotation:javax.annotation-api']
@@ -256,8 +262,10 @@ dependencies {
  testCompile deps['com.fasterxml.jackson.core:jackson-databind']
  runtime deps['org.glassfish.jaxb:jaxb-runtime']
  compile deps['org.hibernate:hibernate-core']
+  compile deps['org.hibernate:hibernate-hikaricp']
  compile deps['org.joda:joda-money']
  compile deps['org.json:json']
+  compile deps['org.jsoup:jsoup']
  testCompile deps['org.mortbay.jetty:jetty']
  compile deps['org.postgresql:postgresql']
  testCompile deps['org.seleniumhq.selenium:selenium-api']
@@ -270,6 +278,10 @@ dependencies {
  compile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
+  compile deps['us.fatehi:schemacrawler']
+  compile deps['us.fatehi:schemacrawler-api']
+  compile deps['us.fatehi:schemacrawler-diagram']
+  compile deps['us.fatehi:schemacrawler-tools']
  compile deps['xerces:xmlParserAPIs']
  compile deps['xpp3:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
@@ -304,7 +316,6 @@ dependencies {
  testCompile deps['org.hamcrest:hamcrest-all']
  testCompile deps['org.hamcrest:hamcrest-core']
  testCompile deps['org.hamcrest:hamcrest-library']
-  compile deps['org.hibernate:hibernate-hikaricp']
  testCompile deps['junit:junit']
  testCompile deps['org.junit.jupiter:junit-jupiter-api']
  testCompile deps['org.junit.jupiter:junit-jupiter-engine']
--- a/core/gradle/dependency-locks/annotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/annotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -174,7 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -196,32 +197,33 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -231,7 +233,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -241,10 +243,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -177,7 +187,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,18 +209,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -217,16 +230,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -236,21 +250,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,34 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/errorprone.lockfile
+++ b/core/gradle/dependency-locks/errorprone.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
@@ -1,24 +1,27 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
 com.google.code.findbugs:jsr305:3.0.2
-com.google.errorprone:error_prone_annotation:2.3.3
-com.google.errorprone:error_prone_annotations:2.3.3
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.0.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
 com.google.protobuf:protobuf-java:3.4.0
 com.googlecode.java-diff-utils:diffutils:1.3.0
-org.checkerframework:checker-qual:2.5.3
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.0.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +69,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +113,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +128,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +179,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -198,16 +201,17 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -215,16 +219,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,7 +239,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -244,10 +249,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +68,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,22 +83,23 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,7 +112,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -124,25 +126,25 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -158,7 +160,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -175,7 +176,7 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,16 +198,16 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -214,16 +215,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -233,7 +235,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -243,10 +245,15 @@ org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,18 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,18 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -82,23 +88,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -110,8 +117,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -125,25 +132,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.12
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,18 +208,20 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -216,16 +229,17 @@ org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -235,20 +249,28 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.10.2
-com.fasterxml.jackson.core:jackson-core:2.10.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.10.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -67,9 +73,9 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +89,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -111,8 +118,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.googlecode.charts4j:charts4j:1.3
@@ -126,25 +133,28 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -176,7 +186,8 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.arnx:nashorn-promise:0.1.1
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -197,34 +208,37 @@ org.apache.beam:beam-vendor-grpc-1_26_0:0.3
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.beam:beam-vendor-sdks-java-extensions-protobuf:2.23.0
 org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.jvnet.staxex:stax-ex:1.8
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -234,21 +248,29 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
 org.scijava:native-lib-loader:2.0.2
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/testAnnotationProcessor.lockfile
@@ -1,8 +1,8 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.github.ben-manes.caffeine:caffeine:2.7.0
 com.github.kevinstern:software-and-algorithms:1.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.google.auto.value:auto-value:1.6.3
 com.google.auto:auto-common:0.10
 com.google.code.findbugs:jFormatString:3.0.0
@@ -11,15 +11,15 @@ com.google.dagger:dagger-compiler:2.28
 com.google.dagger:dagger-producers:2.28
 com.google.dagger:dagger-spi:2.28
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotation:2.3.4
 com.google.errorprone:error_prone_annotations:2.3.4
-com.google.errorprone:error_prone_check_api:2.3.3
-com.google.errorprone:error_prone_core:2.3.3
-com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.4
+com.google.errorprone:error_prone_core:2.3.4
+com.google.errorprone:error_prone_type_annotations:2.3.4
 com.google.errorprone:javac-shaded:9-dev-r4023-3
 com.google.googlejavaformat:google-java-format:1.5
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:29.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
 com.google.protobuf:protobuf-java:3.4.0
@@ -30,11 +30,14 @@ javax.inject:javax.inject:1
 javax.persistence:javax.persistence-api:2.2
 net.ltgt.gradle.incap:incap:0.2
 org.checkerframework:checker-compat-qual:2.5.3
-org.checkerframework:checker-qual:2.11.1
-org.checkerframework:dataflow:2.5.3
-org.checkerframework:javacutil:2.5.3
+org.checkerframework:checker-qual:3.5.0
+org.checkerframework:dataflow:3.0.0
+org.checkerframework:javacutil:3.0.0
 org.jetbrains.kotlin:kotlin-stdlib-common:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0
 org.jetbrains:annotations:13.0
 org.pcollections:pcollections:2.1.2
+org.plumelib:plume-util:1.0.6
+org.plumelib:reflection-util:0.0.2
+org.plumelib:require-javadoc:0.1.0
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +36,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +70,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,24 +85,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,8 +116,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -133,25 +136,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -185,7 +188,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -212,7 +215,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -225,10 +228,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -238,16 +241,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -271,7 +275,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -293,10 +297,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -7,7 +7,7 @@ args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.13
 com.github.jnr:jnr-posix:3.0.55
 com.github.jnr:jnr-unixsocket:0.30
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.android:annotations:4.1.1.4
 com.google.api-client:google-api-client-appengine:1.30.8
 com.google.api-client:google-api-client-jackson2:1.30.9
 com.google.api-client:google-api-client-java6:1.30.9
@@ -36,15 +35,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +69,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -83,23 +84,24 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -113,7 +115,7 @@ com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
 com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -132,25 +134,25 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -166,7 +168,6 @@ io.netty:netty-transport:4.1.42.Final
 io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-util:0.24.0
 io.opencensus:opencensus-contrib-http-util:0.24.0
-io.perfmark:perfmark-api:0.19.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -184,7 +185,7 @@ jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -211,7 +212,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.apache.mina:mina-core:2.0.4
@@ -224,10 +225,9 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -237,16 +237,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -270,7 +271,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -292,10 +293,15 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,7 +225,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -228,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -242,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -275,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -290,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.testcontainers:database-commons:1.14.3
 org.testcontainers:jdbc:1.14.3
@@ -297,10 +311,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -6,8 +6,12 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
+com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0
+com.eclipsesource.j2v8:j2v8_win32_x86_64:4.6.0
 com.fasterxml.jackson.core:jackson-annotations:2.11.2
-com.fasterxml.jackson.core:jackson-core:2.11.2
+com.fasterxml.jackson.core:jackson-core:2.11.3
 com.fasterxml.jackson.core:jackson-databind:2.11.2
 com.fasterxml:classmate:1.5.1
 com.github.jnr:jffi:1.2.23
@@ -36,15 +40,17 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-bigtable-v2:1.9.1
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.85.0
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.85.1
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:1.2.3
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:1.2.3
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.49.1
 com.google.api.grpc:proto-google-cloud-spanner-v1:1.49.1
-com.google.api.grpc:proto-google-common-protos:1.18.0
-com.google.api.grpc:proto-google-iam-v1:0.13.0
-com.google.api:api-common:1.8.1
-com.google.api:gax-grpc:1.54.0
+com.google.api.grpc:proto-google-common-protos:2.0.0
+com.google.api.grpc:proto-google-iam-v1:1.0.1
+com.google.api:api-common:1.10.1
+com.google.api:gax-grpc:1.60.0
 com.google.api:gax-httpjson:0.70.1
-com.google.api:gax:1.54.0
+com.google.api:gax:1.60.0
 com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
 com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
 com.google.apis:google-api-services-bigquery:v2-rev20191211-1.30.9
@@ -68,9 +74,9 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.81
 com.google.appengine:appengine-api-stubs:1.9.81
 com.google.appengine:appengine-remote-api:1.9.81
 com.google.appengine:appengine-testing:1.9.81
-com.google.auth:google-auth-library-credentials:0.20.0
-com.google.auth:google-auth-library-oauth2-http:0.20.0
-com.google.auto.value:auto-value-annotations:1.7.1
+com.google.auth:google-auth-library-credentials:0.22.0
+com.google.auth:google-auth-library-oauth2-http:0.22.0
+com.google.auto.value:auto-value-annotations:1.7.4
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:2.1.3
 com.google.cloud.bigdataoss:util:2.1.3
@@ -84,24 +90,25 @@ com.google.cloud:google-cloud-bigtable:1.9.1
 com.google.cloud:google-cloud-core-grpc:1.92.2
 com.google.cloud:google-cloud-core-http:1.92.4
 com.google.cloud:google-cloud-core:1.92.5
+com.google.cloud:google-cloud-secretmanager:1.2.3
 com.google.cloud:google-cloud-spanner:1.49.1
 com.google.code.findbugs:jsr305:3.0.2
 com.google.code.gson:gson:2.8.6
 com.google.common.html.types:types:1.0.4
 com.google.dagger:dagger:2.28
-com.google.errorprone:error_prone_annotations:2.3.4
+com.google.errorprone:error_prone_annotations:2.4.0
 com.google.flogger:flogger-system-backend:0.5.1
 com.google.flogger:flogger:0.5.1
 com.google.flogger:google-extensions:0.5.1
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava-testlib:29.0-jre
-com.google.guava:guava:29.0-jre
+com.google.guava:guava-testlib:30.0-jre
+com.google.guava:guava:30.0-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
 com.google.http-client:google-http-client-appengine:1.34.1
-com.google.http-client:google-http-client-jackson2:1.34.2
+com.google.http-client:google-http-client-jackson2:1.37.0
 com.google.http-client:google-http-client-protobuf:1.33.0
-com.google.http-client:google-http-client:1.34.2
+com.google.http-client:google-http-client:1.37.0
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -114,8 +121,8 @@ com.google.oauth-client:google-oauth-client-java6:1.30.6
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
 com.google.oauth-client:google-oauth-client-servlet:1.30.5
 com.google.oauth-client:google-oauth-client:1.30.6
-com.google.protobuf:protobuf-java-util:3.11.4
-com.google.protobuf:protobuf-java:3.11.4
+com.google.protobuf:protobuf-java-util:3.13.0
+com.google.protobuf:protobuf-java:3.13.0
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
 com.google.truth.extensions:truth-java8-extension:1.0
@@ -134,26 +141,29 @@ com.sun.istack:istack-commons-runtime:3.0.7
 com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-com.zaxxer:HikariCP:3.2.0
+com.zaxxer:HikariCP:3.4.5
 commons-codec:commons-codec:1.13
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
+guru.nidi.com.kitfox:svgSalamander:1.1.3
+guru.nidi:graphviz-java-all-j2v8:0.17.0
+guru.nidi:graphviz-java:0.17.0
 io.dropwizard.metrics:metrics-core:3.2.6
 io.github.classgraph:classgraph:4.8.65
 io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.27.2
-io.grpc:grpc-alts:1.29.0
-io.grpc:grpc-api:1.29.0
-io.grpc:grpc-auth:1.29.0
-io.grpc:grpc-context:1.29.0
-io.grpc:grpc-core:1.29.0
-io.grpc:grpc-grpclb:1.29.0
-io.grpc:grpc-netty-shaded:1.29.0
+io.grpc:grpc-alts:1.32.2
+io.grpc:grpc-api:1.32.2
+io.grpc:grpc-auth:1.32.2
+io.grpc:grpc-context:1.32.2
+io.grpc:grpc-core:1.32.2
+io.grpc:grpc-grpclb:1.32.2
+io.grpc:grpc-netty-shaded:1.32.2
 io.grpc:grpc-netty:1.27.2
 io.grpc:grpc-okhttp:1.27.2
-io.grpc:grpc-protobuf-lite:1.29.0
-io.grpc:grpc-protobuf:1.29.0
-io.grpc:grpc-stub:1.29.0
+io.grpc:grpc-protobuf-lite:1.32.2
+io.grpc:grpc-protobuf:1.32.2
+io.grpc:grpc-stub:1.32.2
 io.grpc:grpc-testing:1.27.2
 io.netty:netty-buffer:4.1.42.Final
 io.netty:netty-codec-http2:4.1.42.Final
@@ -186,8 +196,9 @@ javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.5
 junit:junit:4.13
+net.arnx:nashorn-promise:0.1.1
 net.bytebuddy:byte-buddy-agent:1.10.5
-net.bytebuddy:byte-buddy:1.10.10
+net.bytebuddy:byte-buddy:1.10.17
 net.java.dev.jna:jna-platform:5.5.0
 net.java.dev.jna:jna:5.5.0
 org.apache.avro:avro:1.8.2
@@ -214,7 +225,7 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.11
+org.apache.httpcomponents:httpclient:4.5.13
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
@@ -228,10 +239,10 @@ org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
-org.checkerframework:checker-qual:2.11.1
+org.checkerframework:checker-qual:3.5.0
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
-org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.codehaus.mojo:animal-sniffer-annotations:1.19
 org.conscrypt:conscrypt-openjdk-uber:2.2.1
 org.dom4j:dom4j:2.1.3
 org.easymock:easymock:3.0
@@ -242,16 +253,17 @@ org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-all:1.3
 org.hamcrest:hamcrest-core:1.3
 org.hamcrest:hamcrest-library:1.3
-org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
-org.hibernate:hibernate-core:5.4.17.Final
-org.hibernate:hibernate-hikaricp:5.4.17.Final
+org.hibernate.common:hibernate-commons-annotations:5.1.2.Final
+org.hibernate:hibernate-core:5.4.23.Final
+org.hibernate:hibernate-hikaricp:5.4.23.Final
 org.javassist:javassist:3.24.0-GA
-org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.logging:jboss-logging:3.4.1.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.1.3.Final
 org.jetbrains:annotations:19.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
+org.jsoup:jsoup:1.13.1
 org.junit-pioneer:junit-pioneer:0.7.0
 org.junit.jupiter:junit-jupiter-api:5.6.2
 org.junit.jupiter:junit-jupiter-engine:5.6.2
@@ -275,7 +287,7 @@ org.ow2.asm:asm-commons:7.1
 org.ow2.asm:asm-tree:8.0.1
 org.ow2.asm:asm-util:8.0.1
 org.ow2.asm:asm:8.0.1
-org.postgresql:postgresql:42.2.14
+org.postgresql:postgresql:42.2.18
 org.rnorth.duct-tape:duct-tape:1.0.8
 org.rnorth.visible-assertions:visible-assertions:2.1.2
 org.rnorth:tcp-unix-socket-proxy:1.0.2
@@ -290,6 +302,8 @@ org.seleniumhq.selenium:selenium-opera-driver:3.141.59
 org.seleniumhq.selenium:selenium-remote-driver:3.141.59
 org.seleniumhq.selenium:selenium-safari-driver:3.141.59
 org.seleniumhq.selenium:selenium-support:3.141.59
+org.slf4j:jcl-over-slf4j:1.7.30
+org.slf4j:jul-to-slf4j:1.7.30
 org.slf4j:slf4j-api:1.7.30
 org.slf4j:slf4j-jdk14:1.7.28
 org.testcontainers:database-commons:1.14.3
@@ -298,10 +312,16 @@ org.testcontainers:junit-jupiter:1.14.3
 org.testcontainers:postgresql:1.14.3
 org.testcontainers:selenium:1.14.3
 org.testcontainers:testcontainers:1.14.3
-org.threeten:threetenbp:1.4.1
+org.threeten:threetenbp:1.4.5
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
+org.webjars.npm:viz.js-for-graphviz-java:2.1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+us.fatehi:schemacrawler-api:16.10.1
+us.fatehi:schemacrawler-diagram:16.10.1
+us.fatehi:schemacrawler-tools:16.10.1
+us.fatehi:schemacrawler-utility:16.10.1
+us.fatehi:schemacrawler:16.10.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/src/main/java/google/registry/backup/CommitLogImports.java
+++ b/core/src/main/java/google/registry/backup/CommitLogImports.java
@@ -15,10 +15,10 @@
 package google.registry.backup;

 import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.backup.BackupUtils.createDeserializingIterator;

 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Streams;
 import google.registry.model.ImmutableObject;
 import google.registry.model.ofy.CommitLogCheckpoint;
 import google.registry.model.ofy.CommitLogManifest;
@@ -31,7 +31,6 @@ import java.io.InputStream;
 import java.nio.channels.Channels;
 import java.nio.channels.ReadableByteChannel;
 import java.util.Iterator;
-import java.util.stream.Stream;

 /**
 * Helpers for reading CommitLog records from a file.
@@ -43,6 +42,56 @@ public final class CommitLogImports {

  private CommitLogImports() {}

+  /**
+   * Returns entities in an {@code inputStream} (from a single CommitLog file) as an {@link
+   * ImmutableList} of {@link ImmutableList}s of {@link VersionedEntity} records where the inner
+   * lists each consist of one transaction. Upon completion the {@code inputStream} is closed.
+   *
+   * <p>The returned list may be empty, since CommitLogs are written at fixed intervals regardless
+   * if actual changes exist. Each sublist, however, will not be empty.
+   *
+   * <p>A CommitLog file starts with a {@link CommitLogCheckpoint}, followed by (repeated)
+   * subsequences of [{@link CommitLogManifest}, [{@link CommitLogMutation}] ...]. Each subsequence
+   * represents the changes in one transaction. The {@code CommitLogManifest} contains deleted
+   * entity keys, whereas each {@code CommitLogMutation} contains one whole entity.
+   */
+  public static ImmutableList<ImmutableList<VersionedEntity>> loadEntitiesByTransaction(
+      InputStream inputStream) {
+    try (AppEngineEnvironment appEngineEnvironment = new AppEngineEnvironment();
+        InputStream input = new BufferedInputStream(inputStream)) {
+      Iterator<ImmutableObject> commitLogs = createDeserializingIterator(input);
+      checkState(commitLogs.hasNext());
+      checkState(commitLogs.next() instanceof CommitLogCheckpoint);
+
+      ImmutableList.Builder<ImmutableList<VersionedEntity>> resultBuilder =
+          new ImmutableList.Builder<>();
+      ImmutableList.Builder<VersionedEntity> currentTransactionBuilder =
+          new ImmutableList.Builder<>();
+
+      while (commitLogs.hasNext()) {
+        ImmutableObject currentObject = commitLogs.next();
+        if (currentObject instanceof CommitLogManifest) {
+          // CommitLogManifest means we are starting a new transaction
+          addIfNonempty(resultBuilder, currentTransactionBuilder);
+          currentTransactionBuilder = new ImmutableList.Builder<>();
+          VersionedEntity.fromManifest((CommitLogManifest) currentObject)
+              .forEach(currentTransactionBuilder::add);
+        } else if (currentObject instanceof CommitLogMutation) {
+          currentTransactionBuilder.add(
+              VersionedEntity.fromMutation((CommitLogMutation) currentObject));
+        } else {
+          throw new IllegalStateException(
+              String.format("Unknown entity type %s in commit logs", currentObject.getClass()));
+        }
+      }
+      // Add the last transaction in (if it's not empty)
+      addIfNonempty(resultBuilder, currentTransactionBuilder);
+      return resultBuilder.build();
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
  /**
   * Returns entities in an {@code inputStream} (from a single CommitLog file) as an {@link
   * ImmutableList} of {@link VersionedEntity} records. Upon completion the {@code inputStream} is
@@ -57,23 +106,9 @@ public final class CommitLogImports {
   * entity keys, whereas each {@code CommitLogMutation} contains one whole entity.
   */
  public static ImmutableList<VersionedEntity> loadEntities(InputStream inputStream) {
-    try (AppEngineEnvironment appEngineEnvironment = new AppEngineEnvironment();
-        InputStream input = new BufferedInputStream(inputStream)) {
-      Iterator<ImmutableObject> commitLogs = createDeserializingIterator(input);
-      checkState(commitLogs.hasNext());
-      checkState(commitLogs.next() instanceof CommitLogCheckpoint);
-
-      return Streams.stream(commitLogs)
-          .map(
-              e ->
-                  e instanceof CommitLogManifest
-                      ? VersionedEntity.fromManifest((CommitLogManifest) e)
-                      : Stream.of(VersionedEntity.fromMutation((CommitLogMutation) e)))
-          .flatMap(s -> s)
-          .collect(ImmutableList.toImmutableList());
-    } catch (IOException e) {
-      throw new RuntimeException(e);
-    }
+    return loadEntitiesByTransaction(inputStream).stream()
+        .flatMap(ImmutableList::stream)
+        .collect(toImmutableList());
  }

  /** Covenience method that adapts {@link #loadEntities(InputStream)} to a {@link File}. */
@@ -92,4 +127,13 @@ public final class CommitLogImports {
  public static ImmutableList<VersionedEntity> loadEntities(ReadableByteChannel channel) {
    return loadEntities(Channels.newInputStream(channel));
  }
+
+  private static void addIfNonempty(
+      ImmutableList.Builder<ImmutableList<VersionedEntity>> resultBuilder,
+      ImmutableList.Builder<VersionedEntity> currentTransactionBuilder) {
+    ImmutableList<VersionedEntity> currentTransaction = currentTransactionBuilder.build();
+    if (!currentTransaction.isEmpty()) {
+      resultBuilder.add(currentTransaction);
+    }
+  }
 }
--- a/core/src/main/java/google/registry/backup/GcsDiffFileLister.java
+++ b/core/src/main/java/google/registry/backup/GcsDiffFileLister.java
@@ -122,7 +122,7 @@ class GcsDiffFileLister {

    // Reconstruct the sequence of files by traversing backwards from "lastUpperBoundTime" (i.e. the
    // last file that we found) and finding its previous file until we either run out of files or
-    // get to one that preceeds "fromTime".
+    // get to one that precedes "fromTime".
    //
    // GCS file listing is eventually consistent, so it's possible that we are missing a file. The
    // metadata of a file is sufficient to identify the preceding file, so if we start from the
--- a/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
+++ b/core/src/main/java/google/registry/backup/ReplayCommitLogsToSqlAction.java
@@ -0,0 +1,188 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.backup;
+
+import static google.registry.backup.ExportCommitLogDiffAction.DIFF_FILE_PREFIX;
+import static google.registry.model.ofy.EntityWritePriorities.getEntityPriority;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
+import static javax.servlet.http.HttpServletResponse.SC_NO_CONTENT;
+import static org.joda.time.Duration.standardHours;
+
+import com.google.appengine.api.datastore.Entity;
+import com.google.appengine.api.datastore.Key;
+import com.google.appengine.tools.cloudstorage.GcsFileMetadata;
+import com.google.appengine.tools.cloudstorage.GcsService;
+import com.google.common.collect.ImmutableList;
+import com.google.common.flogger.FluentLogger;
+import google.registry.config.RegistryConfig;
+import google.registry.model.server.Lock;
+import google.registry.model.translators.VKeyTranslatorFactory;
+import google.registry.persistence.VKey;
+import google.registry.request.Action;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
+import google.registry.schema.replay.NonReplicatedEntity;
+import google.registry.schema.replay.SqlReplayCheckpoint;
+import google.registry.util.RequestStatusChecker;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.channels.Channels;
+import java.util.Optional;
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletResponse;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+
+/** Action that replays commit logs to Cloud SQL to keep it up to date. */
+@Action(
+    service = Action.Service.BACKEND,
+    path = ReplayCommitLogsToSqlAction.PATH,
+    method = Action.Method.POST,
+    automaticallyPrintOk = true,
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
+public class ReplayCommitLogsToSqlAction implements Runnable {
+
+  static final String PATH = "/_dr/task/replayCommitLogsToSql";
+
+  private static final int BLOCK_SIZE =
+      1024 * 1024; // Buffer 1mb at a time, for no particular reason.
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final Duration LEASE_LENGTH = standardHours(1);
+
+  @Inject GcsService gcsService;
+  @Inject Response response;
+  @Inject RequestStatusChecker requestStatusChecker;
+  @Inject GcsDiffFileLister diffLister;
+
+  @Inject
+  ReplayCommitLogsToSqlAction() {}
+
+  @Override
+  public void run() {
+    if (!RegistryConfig.getCloudSqlReplayCommitLogs()) {
+      String message = "ReplayCommitLogsToSqlAction was called but disabled in the config.";
+      logger.atWarning().log(message);
+      // App Engine will retry on any non-2xx status code, which we don't want in this case.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload(message);
+      return;
+    }
+    Optional<Lock> lock =
+        Lock.acquire(
+            this.getClass().getSimpleName(), null, LEASE_LENGTH, requestStatusChecker, false);
+    if (lock.isEmpty()) {
+      String message = "Can't acquire SQL commit log replay lock, aborting.";
+      logger.atSevere().log(message);
+      // App Engine will retry on any non-2xx status code, which we don't want in this case.
+      // Let the next run after the next export happen naturally.
+      response.setStatus(SC_NO_CONTENT);
+      response.setPayload(message);
+      return;
+    }
+    try {
+      replayFiles();
+      response.setStatus(HttpServletResponse.SC_OK);
+      logger.atInfo().log("ReplayCommitLogsToSqlAction completed successfully.");
+    } finally {
+      lock.ifPresent(Lock::release);
+    }
+  }
+
+  private void replayFiles() {
+    // Start at the first millisecond we haven't seen yet
+    DateTime fromTime = jpaTm().transact(() -> SqlReplayCheckpoint.get().plusMillis(1));
+    // If there's an inconsistent file set, this will throw IllegalStateException and the job
+    // will try later -- this is likely because an export hasn't finished yet.
+    ImmutableList<GcsFileMetadata> commitLogFiles =
+        diffLister.listDiffFiles(fromTime, /* current time */ null);
+    for (GcsFileMetadata metadata : commitLogFiles) {
+      // One transaction per GCS file
+      jpaTm().transact(() -> processFile(metadata));
+    }
+    logger.atInfo().log("Replayed %d commit log files to SQL successfully.", commitLogFiles.size());
+  }
+
+  private void processFile(GcsFileMetadata metadata) {
+    try (InputStream input =
+        Channels.newInputStream(
+            gcsService.openPrefetchingReadChannel(metadata.getFilename(), 0, BLOCK_SIZE))) {
+      // Load and process the Datastore transactions one at a time
+      ImmutableList<ImmutableList<VersionedEntity>> allTransactions =
+          CommitLogImports.loadEntitiesByTransaction(input);
+      allTransactions.forEach(this::replayTransaction);
+      // if we succeeded, set the last-seen time
+      DateTime checkpoint =
+          DateTime.parse(
+              metadata.getFilename().getObjectName().substring(DIFF_FILE_PREFIX.length()));
+      SqlReplayCheckpoint.set(checkpoint);
+      logger.atInfo().log("Replayed %d transactions from commit log file.", allTransactions.size());
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  private void replayTransaction(ImmutableList<VersionedEntity> transaction) {
+    transaction.stream()
+        .sorted(ReplayCommitLogsToSqlAction::compareByWeight)
+        .forEach(
+            versionedEntity ->
+                versionedEntity
+                    .getEntity()
+                    .ifPresentOrElse(
+                        this::handleEntityPut, () -> handleEntityDelete(versionedEntity)));
+  }
+
+  private void handleEntityPut(Entity entity) {
+    Object ofyPojo = ofy().toPojo(entity);
+    if (ofyPojo instanceof DatastoreEntity) {
+      DatastoreEntity datastoreEntity = (DatastoreEntity) ofyPojo;
+      datastoreEntity.toSqlEntity().ifPresent(jpaTm()::put);
+    } else {
+      // this should never happen, but we shouldn't fail on it
+      logger.atSevere().log(
+          "%s does not implement DatastoreEntity, which is necessary for SQL replay.",
+          ofyPojo.getClass());
+    }
+  }
+
+  private void handleEntityDelete(VersionedEntity entityToDelete) {
+    Key key = entityToDelete.key();
+    VKey<?> entityVKey;
+    try {
+      entityVKey = VKeyTranslatorFactory.createVKey(key);
+    } catch (RuntimeException e) {
+      // This means that the key wasn't convertible to VKey through the standard methods or via
+      // a createVKey method. This means that the object isn't persisted in SQL so we ignore it.
+      logger.atInfo().log(
+          "Skipping SQL delete for kind %s since it is not convertible.", key.getKind());
+      return;
+    }
+    Class<?> entityClass = entityVKey.getKind();
+    // Delete the key iff the class represents a JPA entity that is replicated
+    if (!NonReplicatedEntity.class.isAssignableFrom(entityClass)
+        && !DatastoreOnlyEntity.class.isAssignableFrom(entityClass)
+        && entityClass.getAnnotation(javax.persistence.Entity.class) != null) {
+      jpaTm().delete(entityVKey);
+    }
+  }
+
+  private static int compareByWeight(VersionedEntity a, VersionedEntity b) {
+    return getEntityPriority(a.key().getKind(), a.getEntity().isEmpty())
+        - getEntityPriority(b.key().getKind(), b.getEntity().isEmpty());
+  }
+}
--- a/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
+++ b/core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java
@@ -50,11 +50,21 @@ public class ResaveAllEppResourcesAction implements Runnable {
  @Inject Response response;
  @Inject ResaveAllEppResourcesAction() {}

+  /**
+   * The number of shards to run the map-only mapreduce on.
+   *
+   * <p>This is less than the default of 100 because we only run this action monthly and can afford
+   * it being slower, but we don't want to write out lots of large commit logs in a short period of
+   * time because they make the Cloud SQL migration tougher.
+   */
+  private static final int NUM_SHARDS = 10;
+
  @Override
  public void run() {
    mrRunner
        .setJobName("Re-save all EPP resources")
        .setModuleName("backend")
+        .setDefaultMapShards(NUM_SHARDS)
        .runMapOnly(
            new ResaveAllEppResourcesActionMapper(),
            ImmutableList.of(EppResourceInputs.createKeyInput(EppResource.class)))
--- a/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
+++ b/core/src/main/java/google/registry/beam/initsql/InitSqlPipeline.java
@@ -92,9 +92,8 @@ public class InitSqlPipeline implements Serializable {
   * Datastore kinds to be written to the SQL database before the cleansed version of {@link
   * DomainBase}.
   */
-  // TODO(weiminyu): include Registry.class when it is modeled in JPA.
  private static final ImmutableList<Class<?>> PHASE_ONE_ORDERED =
-      ImmutableList.of(Registrar.class, ContactResource.class);
+      ImmutableList.of(Registry.class, Registrar.class, ContactResource.class);

  /**
   * Datastore kinds to be written to the SQL database after the cleansed version of {@link
--- a/core/src/main/java/google/registry/beam/initsql/Transforms.java
+++ b/core/src/main/java/google/registry/beam/initsql/Transforms.java
@@ -20,6 +20,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Throwables.throwIfUnchecked;
 import static google.registry.beam.initsql.BackupPaths.getCommitLogTimestamp;
 import static google.registry.beam.initsql.BackupPaths.getExportFilePatterns;
+import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.JpaRetries.isFailedTxnRetriable;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.setJpaTm;
@@ -68,6 +69,7 @@ import org.apache.beam.sdk.transforms.MapElements;
 import org.apache.beam.sdk.transforms.PTransform;
 import org.apache.beam.sdk.transforms.ParDo;
 import org.apache.beam.sdk.transforms.ProcessFunction;
+import org.apache.beam.sdk.transforms.SerializableFunction;
 import org.apache.beam.sdk.values.KV;
 import org.apache.beam.sdk.values.PBegin;
 import org.apache.beam.sdk.values.PCollection;
@@ -264,9 +266,9 @@ public final class Transforms {
  }

  /**
-   * Returns a {@link PTransform} that writes a {@link PCollection} of entities to a SQL database.
-   * and outputs an empty {@code PCollection<Void>}. This allows other operations to {@link
-   * org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
+   * Returns a {@link PTransform} that writes a {@link PCollection} of {@link VersionedEntity}s to a
+   * SQL database. and outputs an empty {@code PCollection<Void>}. This allows other operations to
+   * {@link org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
   *
   * <p>Errors are handled according to the pipeline runner's default policy. As part of a one-time
   * job, we will not add features unless proven necessary.
@@ -282,16 +284,53 @@ public final class Transforms {
      int maxWriters,
      int batchSize,
      SerializableSupplier<JpaTransactionManager> jpaSupplier) {
-    return new PTransform<PCollection<VersionedEntity>, PCollection<Void>>() {
+    return writeToSql(
+        transformId,
+        maxWriters,
+        batchSize,
+        jpaSupplier,
+        (e) -> ofy().toPojo(e.getEntity().get()),
+        TypeDescriptor.of(VersionedEntity.class));
+  }
+
+  /**
+   * Returns a {@link PTransform} that writes a {@link PCollection} of entities to a SQL database.
+   * and outputs an empty {@code PCollection<Void>}. This allows other operations to {@link
+   * org.apache.beam.sdk.transforms.Wait wait} for the completion of this transform.
+   *
+   * <p>The converter and type descriptor are generics so that we can convert any type of entity to
+   * an object to be placed in SQL.
+   *
+   * <p>Errors are handled according to the pipeline runner's default policy. As part of a one-time
+   * job, we will not add features unless proven necessary.
+   *
+   * @param transformId a unique ID for an instance of the returned transform
+   * @param maxWriters the max number of concurrent writes to SQL, which also determines the max
+   *     number of connection pools created
+   * @param batchSize the number of entities to write in each operation
+   * @param jpaSupplier supplier of a {@link JpaTransactionManager}
+   * @param jpaConverter the function that converts the input object to a JPA entity
+   * @param objectDescriptor the type descriptor of the input object
+   */
+  public static <T> PTransform<PCollection<T>, PCollection<Void>> writeToSql(
+      String transformId,
+      int maxWriters,
+      int batchSize,
+      SerializableSupplier<JpaTransactionManager> jpaSupplier,
+      SerializableFunction<T, Object> jpaConverter,
+      TypeDescriptor<T> objectDescriptor) {
+    return new PTransform<PCollection<T>, PCollection<Void>>() {
      @Override
-      public PCollection<Void> expand(PCollection<VersionedEntity> input) {
+      public PCollection<Void> expand(PCollection<T> input) {
        return input
            .apply(
                "Shard data for " + transformId,
-                MapElements.into(kvs(integers(), TypeDescriptor.of(VersionedEntity.class)))
+                MapElements.into(kvs(integers(), objectDescriptor))
                    .via(ve -> KV.of(ThreadLocalRandom.current().nextInt(maxWriters), ve)))
            .apply("Batch output by shard " + transformId, GroupIntoBatches.ofSize(batchSize))
-            .apply("Write in batch for " + transformId, ParDo.of(new SqlBatchWriter(jpaSupplier)));
+            .apply(
+                "Write in batch for " + transformId,
+                ParDo.of(new SqlBatchWriter<T>(jpaSupplier, jpaConverter)));
      }
    };
  }
@@ -385,18 +424,22 @@ public final class Transforms {
   * to hold the {@code JpaTransactionManager} instance, we must ensure that JpaTransactionManager
   * is not changed or torn down while being used by some instance.
   */
-  private static class SqlBatchWriter extends DoFn<KV<Integer, Iterable<VersionedEntity>>, Void> {
+  private static class SqlBatchWriter<T> extends DoFn<KV<Integer, Iterable<T>>, Void> {

    private static int instanceCount = 0;
    private static JpaTransactionManager originalJpa;

    private final SerializableSupplier<JpaTransactionManager> jpaSupplier;
+    private final SerializableFunction<T, Object> jpaConverter;

    private transient Ofy ofy;
    private transient SystemSleeper sleeper;

-    SqlBatchWriter(SerializableSupplier<JpaTransactionManager> jpaSupplier) {
+    SqlBatchWriter(
+        SerializableSupplier<JpaTransactionManager> jpaSupplier,
+        SerializableFunction<T, Object> jpaConverter) {
      this.jpaSupplier = jpaSupplier;
+      this.jpaConverter = jpaConverter;
    }

    @Setup
@@ -429,13 +472,11 @@ public final class Transforms {
    }

    @ProcessElement
-    public void processElement(@Element KV<Integer, Iterable<VersionedEntity>> kv) {
+    public void processElement(@Element KV<Integer, Iterable<T>> kv) {
      try (AppEngineEnvironment env = new AppEngineEnvironment()) {
        ImmutableList<Object> ofyEntities =
            Streams.stream(kv.getValue())
-                .map(VersionedEntity::getEntity)
-                .map(Optional::get)
-                .map(ofy::toPojo)
+                .map(this.jpaConverter::apply)
                .collect(ImmutableList.toImmutableList());
        retry(() -> jpaTm().transact(() -> jpaTm().putAll(ofyEntities)));
      }
--- a/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
+++ b/core/src/main/java/google/registry/beam/invoicing/sql/billing_events.sql
@@ -55,7 +55,7 @@ FROM (
    FROM
      `%PROJECT_ID%.%DATASTORE_EXPORT_DATA_SET%.%REGISTRY_TABLE%`
    WHERE
-      enableInvoicing IS TRUE) ) AS BillingEvent
+      invoicingEnabled IS TRUE) ) AS BillingEvent
  -- Gather billing ID from registrar table
  -- This is a 'JOIN' as opposed to 'LEFT JOIN' to filter out
  -- non-billable registrars
--- a/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
+++ b/core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java
@@ -20,7 +20,7 @@ import static google.registry.beam.BeamUtils.getQueryFromFile;
 import com.google.auth.oauth2.GoogleCredentials;
 import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableSet;
-import google.registry.backup.AppEngineEnvironment;
+import google.registry.beam.initsql.Transforms;
 import google.registry.beam.initsql.Transforms.SerializableSupplier;
 import google.registry.beam.spec11.SafeBrowsingTransforms.EvaluateSafeBrowsingFn;
 import google.registry.config.CredentialModule.LocalCredential;
@@ -43,7 +43,6 @@ import org.apache.beam.sdk.options.Description;
 import org.apache.beam.sdk.options.PipelineOptionsFactory;
 import org.apache.beam.sdk.options.ValueProvider;
 import org.apache.beam.sdk.options.ValueProvider.NestedValueProvider;
-import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.GroupByKey;
 import org.apache.beam.sdk.transforms.MapElements;
 import org.apache.beam.sdk.transforms.ParDo;
@@ -191,34 +190,27 @@ public class Spec11Pipeline implements Serializable {
      PCollection<Subdomain> domains,
      EvaluateSafeBrowsingFn evaluateSafeBrowsingFn,
      ValueProvider<String> dateProvider) {
-
    PCollection<KV<Subdomain, ThreatMatch>> subdomainsSql =
        domains.apply("Run through SafeBrowsing API", ParDo.of(evaluateSafeBrowsingFn));
-    /* Store ThreatMatch objects in SQL. */
+    TypeDescriptor<KV<Subdomain, ThreatMatch>> descriptor =
+        new TypeDescriptor<KV<Subdomain, ThreatMatch>>() {};
    subdomainsSql.apply(
-        ParDo.of(
-            new DoFn<KV<Subdomain, ThreatMatch>, Void>() {
-              @ProcessElement
-              public void processElement(ProcessContext context) {
-                // create the Spec11ThreatMatch from Subdomain and ThreatMatch
-                try (AppEngineEnvironment env = new AppEngineEnvironment()) {
-                  Subdomain subdomain = context.element().getKey();
-                  Spec11ThreatMatch threatMatch =
-                      new Spec11ThreatMatch.Builder()
-                          .setThreatTypes(
-                              ImmutableSet.of(
-                                  ThreatType.valueOf(context.element().getValue().threatType())))
-                          .setCheckDate(
-                              LocalDate.parse(dateProvider.get(), ISODateTimeFormat.date()))
-                          .setDomainName(subdomain.domainName())
-                          .setDomainRepoId(subdomain.domainRepoId())
-                          .setRegistrarId(subdomain.registrarId())
-                          .build();
-                  JpaTransactionManager jpaTransactionManager = jpaSupplierFactory.get();
-                  jpaTransactionManager.transact(() -> jpaTransactionManager.insert(threatMatch));
-                }
-              }
-            }));
+        Transforms.writeToSql(
+            "Spec11ThreatMatch",
+            4,
+            4,
+            jpaSupplierFactory,
+            (kv) -> {
+              Subdomain subdomain = kv.getKey();
+              return new Spec11ThreatMatch.Builder()
+                  .setThreatTypes(ImmutableSet.of(ThreatType.valueOf(kv.getValue().threatType())))
+                  .setCheckDate(LocalDate.parse(dateProvider.get(), ISODateTimeFormat.date()))
+                  .setDomainName(subdomain.domainName())
+                  .setDomainRepoId(subdomain.domainRepoId())
+                  .setRegistrarId(subdomain.registrarId())
+                  .build();
+            },
+            descriptor));

    /* Store ThreatMatch objects in JSON. */
    PCollection<KV<Subdomain, ThreatMatch>> subdomainsJson =
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -16,9 +16,12 @@ package google.registry.config;

 import static com.google.common.base.Suppliers.memoize;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static google.registry.config.ConfigUtils.makeUrl;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static google.registry.util.ResourceUtils.readResourceUtf8;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
+import static java.util.Comparator.naturalOrder;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
@@ -27,6 +30,7 @@ import com.google.common.base.Strings;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.util.TaskQueueUtils;
@@ -46,6 +50,7 @@ import javax.inject.Qualifier;
 import javax.inject.Singleton;
 import javax.mail.internet.AddressException;
 import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
 import org.joda.time.DateTimeConstants;
 import org.joda.time.Duration;

@@ -410,6 +415,14 @@ public final class RegistryConfig {
      return config.cloudSql.instanceConnectionName;
    }

+    @Provides
+    @Config("cloudSqlDbInstanceName")
+    public static String providesCloudSqlDbInstance(RegistryConfigSettings config) {
+      // Format of instanceConnectionName: project-id:region:instance-name
+      int lastColonIndex = config.cloudSql.instanceConnectionName.lastIndexOf(':');
+      return config.cloudSql.instanceConnectionName.substring(lastColonIndex + 1);
+    }
+
    @Provides
    @Config("cloudDnsRootUrl")
    public static Optional<String> getCloudDnsRootUrl(RegistryConfigSettings config) {
@@ -1345,6 +1358,39 @@ public final class RegistryConfig {
    public static String provideRdapTosStaticUrl(RegistryConfigSettings config) {
      return config.registryPolicy.rdapTosStaticUrl;
    }
+
+    @Provides
+    @Config("maxValidityDaysSchedule")
+    public static ImmutableSortedMap<DateTime, Integer> provideValidityDaysMap(
+        RegistryConfigSettings config) {
+      return config.sslCertificateValidation.maxValidityDaysSchedule.entrySet().stream()
+          .collect(
+              toImmutableSortedMap(
+                  naturalOrder(),
+                  e ->
+                      e.getKey().equals("START_OF_TIME")
+                          ? START_OF_TIME
+                          : DateTime.parse(e.getKey()),
+                  e -> e.getValue()));
+    }
+
+    @Provides
+    @Config("expirationWarningDays")
+    public static int provideDaysToExpiration(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.expirationWarningDays;
+    }
+
+    @Provides
+    @Config("minimumRsaKeyLength")
+    public static int provideMinimumRsaKeyLength(RegistryConfigSettings config) {
+      return config.sslCertificateValidation.minimumRsaKeyLength;
+    }
+
+    @Provides
+    @Config("allowedEcdsaCurves")
+    public static ImmutableSet<String> provideAllowedEcdsaCurves(RegistryConfigSettings config) {
+      return ImmutableSet.copyOf(config.sslCertificateValidation.allowedEcdsaCurves);
+    }
  }

  /** Returns the App Engine project ID, which is based off the environment name. */
@@ -1554,6 +1600,22 @@ public final class RegistryConfig {
    CONFIG_SETTINGS.get().cloudSql.replicateTransactions = replicateTransactions;
  }

+  /**
+   * Returns whether or not to replay commit logs to the SQL database after export to GCS.
+   *
+   * <p>If true, we will trigger the {@link google.registry.backup.ReplayCommitLogsToSqlAction}
+   * after the {@link google.registry.backup.ExportCommitLogDiffAction} to load the commit logs and
+   * replay them to SQL.
+   */
+  public static boolean getCloudSqlReplayCommitLogs() {
+    return CONFIG_SETTINGS.get().cloudSql.replayCommitLogs;
+  }
+
+  @VisibleForTesting
+  public static void overrideCloudSqlReplayCommitLogs(boolean replayCommitLogs) {
+    CONFIG_SETTINGS.get().cloudSql.replayCommitLogs = replayCommitLogs;
+  }
+
  /** Returns the roid suffix to be used for the roids of all contacts and hosts. */
  public static String getContactAndHostRoidSuffix() {
    return CONFIG_SETTINGS.get().registryPolicy.contactAndHostRoidSuffix;
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -15,6 +15,8 @@
 package google.registry.config;

 import java.util.List;
+import java.util.Map;
+import java.util.Set;

 /** The POJO that YAML config files are deserialized into. */
 public class RegistryConfigSettings {
@@ -38,6 +40,7 @@ public class RegistryConfigSettings {
  public Beam beam;
  public Keyring keyring;
  public RegistryTool registryTool;
+  public SslCertificateValidation sslCertificateValidation;

  /** Configuration options that apply to the entire App Engine project. */
  public static class AppEngine {
@@ -123,6 +126,7 @@ public class RegistryConfigSettings {
    public String username;
    public String instanceConnectionName;
    public boolean replicateTransactions;
+    public boolean replayCommitLogs;
  }

  /** Configuration for Apache Beam (Cloud Dataflow). */
@@ -218,4 +222,12 @@ public class RegistryConfigSettings {
    public String clientSecret;
    public String username;
  }
+
+  /** Configuration for the certificate checker. */
+  public static class SslCertificateValidation {
+    public Map<String, Integer> maxValidityDaysSchedule;
+    public int expirationWarningDays;
+    public int minimumRsaKeyLength;
+    public Set<String> allowedEcdsaCurves;
+  }
 }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -233,6 +233,8 @@ cloudSql:
  # Set this to true to replicate cloud SQL transactions to datastore in the
  # background.
  replicateTransactions: false
+  # Set this to true to enable replay of commit logs to SQL
+  replayCommitLogs: false

 cloudDns:
  # Set both properties to null in Production.
@@ -446,3 +448,21 @@ registryTool:
  # OAuth client secret used by the tool.
  clientSecret: YOUR_CLIENT_SECRET
  username: toolusername
+
+# Configuration options for checking SSL certificates.
+sslCertificateValidation:
+  # A map specifying the maximum amount of days the certificate can be valid.
+  # The entry key is the date closest before the date the certificate was issued
+  # and the entry value is the applicable maximum validity days for that certificate.
+  maxValidityDaysSchedule:
+    "START_OF_TIME": 825
+    "2020-09-01T00:00:00Z": 398
+  # The number of days before a certificate expires that indicates the
+  # certificate is nearing expiration and warnings should be sent.
+  expirationWarningDays: 30
+  # The minimum number of bits an RSA key must contain.
+  minimumRsaKeyLength: 2048
+  # The ECDSA curves that are allowed for public keys.
+  allowedEcdsaCurves:
+    - secp256r1
+    - secp384r1
--- a/core/src/main/java/google/registry/env/common/default/WEB-INF/queue.xml
+++ b/core/src/main/java/google/registry/env/common/default/WEB-INF/queue.xml
@@ -208,6 +208,12 @@
    <max-concurrent-requests>5</max-concurrent-requests>
  </queue>

+  <!-- Queue for replaying commit logs to SQL during the transition from Datastore -> SQL. -->
+  <queue>
+    <name>replay-commit-logs-to-sql</name>
+    <rate>1/s</rate>
+  </queue>
+
  <!-- The load[0-9] queues are used for load-testing, and can be safely deleted
       in any environment that doesn't require load-testing. -->
  <queue>
--- a/core/src/main/java/google/registry/flows/EppRequestHandler.java
+++ b/core/src/main/java/google/registry/flows/EppRequestHandler.java
@@ -74,6 +74,14 @@ public class EppRequestHandler {
          && eppOutput.getResponse().getResult().getCode() == SUCCESS_AND_CLOSE) {
        response.setHeader("Epp-Session", "close");
      }
+      // If a login request returns a success, a logged-in header is added to the response to inform
+      // the proxy that it is no longer necessary to send the full client certificate to the backend
+      // for this connection.
+      if (eppOutput.isResponse()
+          && eppOutput.getResponse().isLoginResponse()
+          && eppOutput.isSuccess()) {
+        response.setHeader("Logged-In", "true");
+      }
    } catch (Exception e) {
      logger.atWarning().withCause(e).log("handleEppCommand general exception");
      response.setStatus(SC_BAD_REQUEST);
--- a/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
+++ b/core/src/main/java/google/registry/flows/certs/CertificateChecker.java
@@ -0,0 +1,261 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.flows.certs;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.util.Clock;
+import google.registry.util.DateTimeUtils;
+import java.io.ByteArrayInputStream;
+import java.security.PublicKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Date;
+import java.util.stream.Collectors;
+import javax.inject.Inject;
+import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.joda.time.DateTime;
+import org.joda.time.Days;
+
+/** An utility to check that a given certificate meets our requirements */
+public class CertificateChecker {
+
+  private final ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule;
+  private final int daysToExpiration;
+  private final int minimumRsaKeyLength;
+  private final Clock clock;
+  private final ImmutableSet<String> allowedEcdsaCurves;
+
+  /**
+   * Constructs a CertificateChecker instance with the specified configuration parameters.
+   *
+   * <p>The max validity length schedule is a sorted map of {@link DateTime} to {@link Integer}
+   * entries representing a maximum validity period for certificates issued on or after that date.
+   * The first entry must have a key of {@link DateTimeUtils#START_OF_TIME}, such that every
+   * possible date has an applicable max validity period. Since security requirements tighten over
+   * time, the max validity periods will be decreasing as the date increases.
+   *
+   * <p>The validity length schedule used by all major Web browsers as of 2020Q4 would be
+   * represented as:
+   *
+   * <pre>
+   *   ImmutableSortedMap.of(
+   *     START_OF_TIME, 825,
+   *     DateTime.parse("2020-09-01T00:00:00Z"), 398
+   *   );
+   * </pre>
+   */
+  @Inject
+  public CertificateChecker(
+      @Config("maxValidityDaysSchedule")
+          ImmutableSortedMap<DateTime, Integer> maxValidityDaysSchedule,
+      @Config("expirationWarningDays") int expirationWarningDays,
+      @Config("minimumRsaKeyLength") int minimumRsaKeyLength,
+      @Config("allowedEcdsaCurves") ImmutableSet<String> allowedEcdsaCurves,
+      Clock clock) {
+    checkArgument(
+        maxValidityDaysSchedule.containsKey(START_OF_TIME),
+        "Max validity length schedule must contain an entry for START_OF_TIME");
+    this.maxValidityLengthSchedule = maxValidityDaysSchedule;
+    this.daysToExpiration = expirationWarningDays;
+    this.minimumRsaKeyLength = minimumRsaKeyLength;
+    this.allowedEcdsaCurves = allowedEcdsaCurves;
+    this.clock = clock;
+  }
+
+  /**
+   * Checks the given certificate string for violations and throws an exception if any violations
+   * exist.
+   */
+  public void validateCertificate(String certificateString) {
+    ImmutableSet<CertificateViolation> violations = checkCertificate(certificateString);
+    if (!violations.isEmpty()) {
+      String displayMessages =
+          violations.stream()
+              .map(violation -> getViolationDisplayMessage(violation))
+              .collect(Collectors.joining("\n"));
+      throw new IllegalArgumentException(displayMessages);
+    }
+  }
+
+  /**
+   * Checks a given certificate for violations and returns a list of all the violations the
+   * certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(X509Certificate certificate) {
+    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();
+
+    // Check if currently in validity period
+    Date now = clock.nowUtc().toDate();
+    if (certificate.getNotAfter().before(now)) {
+      violations.add(CertificateViolation.EXPIRED);
+    } else if (certificate.getNotBefore().after(now)) {
+      violations.add(CertificateViolation.NOT_YET_VALID);
+    }
+
+    // Check validity period length
+    int maxValidityDays =
+        maxValidityLengthSchedule.floorEntry(new DateTime(certificate.getNotBefore())).getValue();
+    if (getValidityLengthInDays(certificate) > maxValidityDays) {
+      violations.add(CertificateViolation.VALIDITY_LENGTH_TOO_LONG);
+    }
+
+    // Check key strengths
+    PublicKey key = certificate.getPublicKey();
+    if (key.getAlgorithm().equals("RSA")) {
+      RSAPublicKey rsaPublicKey = (RSAPublicKey) key;
+      if (rsaPublicKey.getModulus().bitLength() < minimumRsaKeyLength) {
+        violations.add(CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT);
+      }
+    } else if (key.getAlgorithm().equals("EC")) {
+      if (!checkCurveName(key, allowedEcdsaCurves)) {
+        violations.add(CertificateViolation.INVALID_ECDSA_CURVE);
+      }
+    } else {
+      violations.add(CertificateViolation.ALGORITHM_CONSTRAINED);
+    }
+    return violations.build();
+  }
+
+  /**
+   * Converts a given string to a certificate and checks it for violations, returning a list of all
+   * the violations the certificate has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(String certificateString) {
+    X509Certificate certificate;
+
+    try {
+      certificate =
+          (X509Certificate)
+              CertificateFactory.getInstance("X509")
+                  .generateCertificate(new ByteArrayInputStream(certificateString.getBytes(UTF_8)));
+    } catch (CertificateException e) {
+      throw new IllegalArgumentException("Unable to read given certificate.");
+    }
+
+    return checkCertificate(certificate);
+  }
+
+  /**
+   * Returns whether the certificate is nearing expiration.
+   *
+   * <p>Note that this is <i>all</i> that it checks. The certificate itself may well be expired or
+   * not yet valid and this message will still return false. So you definitely want to pair a call
+   * to this method with a call to {@link #checkCertificate} to determine other issues with the
+   * certificate that may be occurring.
+   */
+  public boolean isNearingExpiration(X509Certificate certificate) {
+    Date nearingExpirationDate =
+        DateTime.parse(certificate.getNotAfter().toInstant().toString())
+            .minusDays(daysToExpiration)
+            .toDate();
+    return clock.nowUtc().toDate().after(nearingExpirationDate);
+  }
+
+  private static int getValidityLengthInDays(X509Certificate certificate) {
+    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
+    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
+  }
+
+  /** Checks if the curve used for a public key is in the list of acceptable curves. */
+  private static boolean checkCurveName(PublicKey key, ImmutableSet<String> allowedEcdsaCurves) {
+    org.bouncycastle.jce.spec.ECParameterSpec params;
+    // These 2 different instances of PublicKey need to be handled separately since their OIDs are
+    // encoded differently. More details on this can be found at
+    // https://stackoverflow.com/questions/49895713/how-to-find-the-matching-curve-name-from-an-ecpublickey.
+    if (key instanceof ECPublicKey) {
+      ECPublicKey ecKey = (ECPublicKey) key;
+      params = EC5Util.convertSpec(ecKey.getParams(), false);
+    } else if (key instanceof org.bouncycastle.jce.interfaces.ECPublicKey) {
+      org.bouncycastle.jce.interfaces.ECPublicKey ecKey =
+          (org.bouncycastle.jce.interfaces.ECPublicKey) key;
+      params = ecKey.getParameters();
+    } else {
+      throw new IllegalArgumentException("Unrecognized instance of PublicKey.");
+    }
+    return allowedEcdsaCurves.stream()
+        .anyMatch(
+            curve -> {
+              ECNamedCurveParameterSpec cParams = ECNamedCurveTable.getParameterSpec(curve);
+              return cParams.getN().equals(params.getN())
+                  && cParams.getH().equals(params.getH())
+                  && cParams.getCurve().equals(params.getCurve())
+                  && cParams.getG().equals(params.getG());
+            });
+  }
+
+  private String getViolationDisplayMessage(CertificateViolation certificateViolation) {
+    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
+    // we can't because we need access to configuration (injected as instance variables) which you
+    // can't get in a static enum context.
+    switch (certificateViolation) {
+      case EXPIRED:
+        return "Certificate is expired.";
+      case NOT_YET_VALID:
+        return "Certificate start date is in the future.";
+      case ALGORITHM_CONSTRAINED:
+        return "Certificate key algorithm must be RSA or ECDSA.";
+      case RSA_KEY_LENGTH_TOO_SHORT:
+        return String.format(
+            "RSA key length is too short; the minimum allowed length is %d bits.",
+            this.minimumRsaKeyLength);
+      case VALIDITY_LENGTH_TOO_LONG:
+        return String.format(
+            "Certificate validity period is too long; it must be less than or equal to %d days.",
+            this.maxValidityLengthSchedule.lastEntry().getValue());
+      case INVALID_ECDSA_CURVE:
+        return String.format(
+            "The ECDSA key must use one of these algorithms: %s", allowedEcdsaCurves);
+      default:
+        throw new IllegalArgumentException(
+            String.format(
+                "Unknown CertificateViolation enum value: %s", certificateViolation.name()));
+    }
+  }
+
+  /**
+   * The type of violation a certificate has based on the certificate requirements
+   * (go/registry-proxy-security).
+   */
+  public enum CertificateViolation {
+    EXPIRED,
+    NOT_YET_VALID,
+    VALIDITY_LENGTH_TOO_LONG,
+    RSA_KEY_LENGTH_TOO_SHORT,
+    ALGORITHM_CONSTRAINED,
+    INVALID_ECDSA_CURVE;
+
+    /**
+     * Gets a suitable end-user-facing display message for this particular certificate violation.
+     *
+     * <p>Note that the {@link CertificateChecker} instance must be passed in because it contains
+     * configuration values (e.g. minimum RSA key length) that go into the error message text.
+     */
+    public String getDisplayMessage(CertificateChecker certificateChecker) {
+      return certificateChecker.getViolationDisplayMessage(this);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java
@@ -110,6 +110,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.tmch.LordnTaskUtils;
 import java.util.Optional;
@@ -371,7 +372,7 @@ public class DomainCreateFlow implements TransactionalFlow {
        && TokenType.SINGLE_USE.equals(allocationToken.get().getTokenType())) {
      entitiesToSave.add(
          allocationTokenFlowUtils.redeemToken(
-              allocationToken.get(), HistoryEntry.createVKey(Key.create(historyEntry))));
+              allocationToken.get(), DomainHistoryVKey.create(Key.create(historyEntry))));
    }
    enqueueTasks(newDomain, hasSignedMarks, hasClaimsNotice);

--- a/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java
@@ -67,6 +67,7 @@ import google.registry.model.domain.DomainCommand.Update.AddRemove;
 import google.registry.model.domain.DomainCommand.Update.Change;
 import google.registry.model.domain.fee.FeeUpdateCommandExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
+import google.registry.model.domain.secdns.DelegationSignerData;
 import google.registry.model.domain.secdns.SecDnsUpdateExtension;
 import google.registry.model.domain.superuser.DomainUpdateSuperuserExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -238,10 +239,16 @@ public final class DomainUpdateFlow implements TransactionalFlow {
    DomainBase.Builder domainBuilder =
        domain
            .asBuilder()
-            // Handle the secDNS extension.
+            // Handle the secDNS extension. As dsData in secDnsUpdate is read from EPP input and
+            // does not have domainRepoId set, we create a copy of the existing dsData without
+            // domainRepoId for comparison.
            .setDsData(
                secDnsUpdate.isPresent()
-                    ? updateDsData(domain.getDsData(), secDnsUpdate.get())
+                    ? updateDsData(
+                        domain.getDsData().stream()
+                            .map(DelegationSignerData::cloneWithoutDomainRepoId)
+                            .collect(toImmutableSet()),
+                        secDnsUpdate.get())
                    : domain.getDsData())
            .setLastEppUpdateTime(now)
            .setLastEppUpdateClientId(clientId)
--- a/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java
@@ -32,8 +32,7 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.registry.Registry;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.persistence.VKey;
+import google.registry.persistence.DomainHistoryVKey;
 import java.util.List;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -108,7 +107,7 @@ public class AllocationTokenFlowUtils {

  /** Redeems a SINGLE_USE {@link AllocationToken}, returning the redeemed copy. */
  public AllocationToken redeemToken(
-      AllocationToken token, VKey<HistoryEntry> redemptionHistoryEntry) {
+      AllocationToken token, DomainHistoryVKey redemptionHistoryEntry) {
    checkArgument(
        TokenType.SINGLE_USE.equals(token.getTokenType()),
        "Only SINGLE_USE tokens can be marked as redeemed");
--- a/core/src/main/java/google/registry/flows/session/LoginFlow.java
+++ b/core/src/main/java/google/registry/flows/session/LoginFlow.java
@@ -141,7 +141,7 @@ public class LoginFlow implements Flow {
    sessionMetadata.resetFailedLoginAttempts();
    sessionMetadata.setClientId(login.getClientId());
    sessionMetadata.setServiceExtensionUris(serviceExtensionUrisBuilder.build());
-    return responseBuilder.build();
+    return responseBuilder.setIsLoginResponse().build();
  }

  /** Registrar with this client ID could not be found. */
--- a/core/src/main/java/google/registry/model/EppResource.java
+++ b/core/src/main/java/google/registry/model/EppResource.java
@@ -24,7 +24,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.cache.CacheBuilder;
@@ -387,7 +386,7 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
  private static LoadingCache<VKey<? extends EppResource>, EppResource> createEppResourcesCache(
      Duration expiry) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(expiry.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(expiry.getMillis()))
        .maximumSize(getEppResourceMaxCachedEntries())
        .build(CACHE_LOADER);
  }
--- a/core/src/main/java/google/registry/model/ImmutableObject.java
+++ b/core/src/main/java/google/registry/model/ImmutableObject.java
@@ -61,7 +61,17 @@ public abstract class ImmutableObject implements Cloneable {
  private boolean equalsImmutableObject(ImmutableObject other) {
    return getClass().equals(other.getClass())
        && hashCode() == other.hashCode()
-        && ModelUtils.getFieldValues(this).equals(ModelUtils.getFieldValues(other));
+        && getSignificantFields().equals(other.getSignificantFields());
+  }
+
+  /**
+   * Returns the map of significant fields (fields that we care about for purposes of comparison and
+   * display).
+   *
+   * <p>Isolated into a method so that derived classes can override it.
+   */
+  protected Map<Field, Object> getSignificantFields() {
+    return ModelUtils.getFieldValues(this);
  }

  @Override
@@ -72,7 +82,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public int hashCode() {
    if (hashCode == null) {
-      hashCode = Arrays.hashCode(ModelUtils.getFieldValues(this).values().toArray());
+      hashCode = Arrays.hashCode(getSignificantFields().values().toArray());
    }
    return hashCode;
  }
@@ -111,7 +121,7 @@ public abstract class ImmutableObject implements Cloneable {
  @Override
  public String toString() {
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      sortedFields.put(entry.getKey().getName(), entry.getValue());
    }
    return toStringHelper(sortedFields);
@@ -121,7 +131,7 @@ public abstract class ImmutableObject implements Cloneable {
  public String toHydratedString() {
    // We can't use ImmutableSortedMap because we need to allow null values.
    NavigableMap<String, Object> sortedFields = new TreeMap<>();
-    for (Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+    for (Entry<Field, Object> entry : getSignificantFields().entrySet()) {
      Field field = entry.getKey();
      Object value = entry.getValue();
      sortedFields.put(
@@ -161,7 +171,7 @@ public abstract class ImmutableObject implements Cloneable {
      // LinkedHashMap to preserve field ordering and because ImmutableMap forbids null
      // values.
      Map<String, Object> result = new LinkedHashMap<>();
-      for (Entry<Field, Object> entry : ModelUtils.getFieldValues(o).entrySet()) {
+      for (Entry<Field, Object> entry : ((ImmutableObject) o).getSignificantFields().entrySet()) {
        Field field = entry.getKey();
        if (!field.isAnnotationPresent(IgnoredInDiffableMap.class)) {
          result.put(field.getName(), toMapRecursive(entry.getValue()));
--- a/core/src/main/java/google/registry/model/ModelUtils.java
+++ b/core/src/main/java/google/registry/model/ModelUtils.java
@@ -87,7 +87,7 @@ public class ModelUtils {
              });

  /** Lists all instance fields on an object, including non-public and inherited fields. */
-  static Map<String, Field> getAllFields(Class<?> clazz) {
+  public static Map<String, Field> getAllFields(Class<?> clazz) {
    return ALL_FIELDS_CACHE.getUnchecked(clazz);
  }

@@ -194,7 +194,7 @@ public class ModelUtils {
   * returned map in its implementation of {@link ImmutableObject#toString} and {@link
   * ImmutableObject#equals}, which work by comparing and printing these maps.
   */
-  static Map<Field, Object> getFieldValues(Object instance) {
+  public static Map<Field, Object> getFieldValues(Object instance) {
    // Don't make this ImmutableMap because field values can be null.
    Map<Field, Object> values = new LinkedHashMap<>();
    for (Field field : getAllFields(instance.getClass()).values()) {
--- a/core/src/main/java/google/registry/model/OteAccountBuilder.java
+++ b/core/src/main/java/google/registry/model/OteAccountBuilder.java
@@ -211,11 +211,6 @@ public final class OteAccountBuilder {
    return transformRegistrars(builder -> builder.setPassword(password));
  }

-  /** Sets the client certificate hash to all the OT&amp;E Registrars. */
-  public OteAccountBuilder setCertificateHash(String certHash) {
-    return transformRegistrars(builder -> builder.setClientCertificateHash(certHash));
-  }
-
  /** Sets the client certificate to all the OT&amp;E Registrars. */
  public OteAccountBuilder setCertificate(String asciiCert, DateTime now) {
    return transformRegistrars(builder -> builder.setClientCertificate(asciiCert, now));
@@ -252,7 +247,8 @@ public final class OteAccountBuilder {
  private void saveAllEntities() {
    tm().assertInTransaction();

-    ImmutableList<Registry> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
+    // use ImmutableObject instead of Registry so that the Key generation doesn't break
+    ImmutableList<ImmutableObject> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
    ImmutableList<RegistrarContact> contacts = contactsBuilder.build();

    if (!replaceExisting) {
--- a/core/src/main/java/google/registry/model/OteStats.java
+++ b/core/src/main/java/google/registry/model/OteStats.java
@@ -59,25 +59,11 @@ public class OteStats {

  private OteStats() {}

-  private static final Predicate<EppInput> HAS_CLAIMS_NOTICE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
-      };
-
  private static final Predicate<EppInput> HAS_SEC_DNS =
      eppInput ->
          eppInput.getSingleExtension(SecDnsCreateExtension.class).isPresent()
              || eppInput.getSingleExtension(SecDnsUpdateExtension.class).isPresent();

-  private static final Predicate<EppInput> IS_SUNRISE =
-      eppInput -> {
-        Optional<LaunchCreateExtension> launchCreate =
-            eppInput.getSingleExtension(LaunchCreateExtension.class);
-        return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
-      };
-
  private static final Predicate<EppInput> IS_IDN =
      eppInput ->
          ((DomainCommand.Create)
@@ -94,6 +80,18 @@ public class OteStats {
                          .getResourceCommand())
                  .getInetAddresses());

+  private static boolean hasClaimsNotice(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && launchCreate.get().getNotice() != null;
+  }
+
+  private static boolean isSunrise(EppInput eppInput) {
+    Optional<LaunchCreateExtension> launchCreate =
+        eppInput.getSingleExtension(LaunchCreateExtension.class);
+    return launchCreate.isPresent() && !isNullOrEmpty(launchCreate.get().getSignedMarks());
+  }
+
  /** Enum defining the distinct statistics (types of registrar actions) to record. */
  public enum StatType {
    CONTACT_CREATES(0, equalTo(Type.CONTACT_CREATE)),
@@ -107,8 +105,8 @@ public class OteStats {
    DOMAIN_CREATES(0, equalTo(Type.DOMAIN_CREATE)),
    DOMAIN_CREATES_ASCII(1, equalTo(Type.DOMAIN_CREATE), IS_IDN.negate()),
    DOMAIN_CREATES_IDN(1, equalTo(Type.DOMAIN_CREATE), IS_IDN),
-    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), IS_SUNRISE),
-    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), HAS_CLAIMS_NOTICE),
+    DOMAIN_CREATES_START_DATE_SUNRISE(1, equalTo(Type.DOMAIN_CREATE), OteStats::isSunrise),
+    DOMAIN_CREATES_WITH_CLAIMS_NOTICE(1, equalTo(Type.DOMAIN_CREATE), OteStats::hasClaimsNotice),
    DOMAIN_CREATES_WITH_FEE(
        1,
        equalTo(Type.DOMAIN_CREATE),
--- a/core/src/main/java/google/registry/model/billing/BillingEvent.java
+++ b/core/src/main/java/google/registry/model/billing/BillingEvent.java
@@ -49,6 +49,7 @@ import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithLongVKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
@@ -67,7 +68,6 @@ import org.joda.time.DateTime;

 /** A billable event in a domain's lifecycle. */
@MappedSuperclass
-@WithLongVKey
 public abstract class BillingEvent extends ImmutableObject
    implements Buildable, TransferServerApproveEntity {

@@ -119,13 +119,11 @@ public abstract class BillingEvent extends ImmutableObject
  String clientId;

  /** Revision id of the entry in DomainHistory table that ths bill belongs to. */
-  // TODO(shicong): Add foreign key constraint when DomainHistory table is generated
  @Ignore
  @Column(nullable = false)
  Long domainHistoryRevisionId;

  /** ID of the EPP resource that the bill is for. */
-  // TODO(shicong): Add foreign key constraint when we expand DatastoreHelp for Postgresql
  @Ignore
  @Column(nullable = false)
  String domainRepoId;
@@ -289,9 +287,10 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "eventTime"),
        @javax.persistence.Index(columnList = "billingTime"),
        @javax.persistence.Index(columnList = "syntheticCreationTime"),
-        @javax.persistence.Index(columnList = "allocation_token_id")
+        @javax.persistence.Index(columnList = "allocationToken")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
+  @WithLongVKey(compositeKey = true)
  public static class OneTime extends BillingEvent implements DatastoreAndSqlEntity {

    /** The billable value. */
@@ -327,14 +326,11 @@ public abstract class BillingEvent extends ImmutableObject
     * Cancellation}s.
     */
    @Column(name = "cancellation_matching_billing_recurrence_id")
-    VKey<? extends BillingEvent> cancellationMatchingBillingEvent;
+    VKey<Recurring> cancellationMatchingBillingEvent;

    /**
     * The {@link AllocationToken} used in the creation of this event, or null if one was not used.
-     *
-     * <p>TODO(shicong): Add foreign key constraint when AllocationToken schema is generated
     */
-    @Column(name = "allocation_token_id")
    @Index
    @Nullable
    VKey<AllocationToken> allocationToken;
@@ -409,7 +405,7 @@ public abstract class BillingEvent extends ImmutableObject
      }

      public Builder setCancellationMatchingBillingEvent(
-          VKey<? extends BillingEvent> cancellationMatchingBillingEvent) {
+          VKey<Recurring> cancellationMatchingBillingEvent) {
        getInstance().cancellationMatchingBillingEvent = cancellationMatchingBillingEvent;
        return this;
      }
@@ -468,6 +464,7 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "recurrence_time_of_year")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
+  @WithLongVKey(compositeKey = true)
  public static class Recurring extends BillingEvent implements DatastoreAndSqlEntity {

    /**
@@ -562,6 +559,7 @@ public abstract class BillingEvent extends ImmutableObject
        @javax.persistence.Index(columnList = "billingTime")
      })
  @AttributeOverride(name = "id", column = @Column(name = "billing_cancellation_id"))
+  @WithLongVKey(compositeKey = true)
  public static class Cancellation extends BillingEvent implements DatastoreAndSqlEntity {

    /** The billing time of the charge that is being cancelled. */
@@ -682,7 +680,8 @@ public abstract class BillingEvent extends ImmutableObject
  /** An event representing a modification of an existing one-time billing event. */
  @ReportedOn
  @Entity
-  public static class Modification extends BillingEvent implements DatastoreAndSqlEntity {
+  @WithLongVKey(compositeKey = true)
+  public static class Modification extends BillingEvent implements DatastoreOnlyEntity {

    /** The change in cost that should be applied to the original billing event. */
    Money cost;
--- a/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
+++ b/core/src/main/java/google/registry/model/common/CrossTldSingleton.java
@@ -20,15 +20,16 @@ import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;

 /** A singleton entity in Datastore. */
+@MappedSuperclass
 public abstract class CrossTldSingleton extends ImmutableObject {

-  public static final long SINGLETON_ID = 1;  // There is always exactly one of these.
+  public static final long SINGLETON_ID = 1; // There is always exactly one of these.

-  @Id
-  long id = SINGLETON_ID;
+  @Id @Transient long id = SINGLETON_ID;

-  @Parent
-  Key<EntityGroupRoot> parent = getCrossTldKey();
+  @Transient @Parent Key<EntityGroupRoot> parent = getCrossTldKey();
 }
--- a/core/src/main/java/google/registry/model/common/Cursor.java
+++ b/core/src/main/java/google/registry/model/common/Cursor.java
@@ -21,7 +21,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.base.Splitter;
-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -29,8 +28,7 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UpdateAutoTimestamp;
 import google.registry.model.registry.Registry;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.List;
 import org.joda.time.DateTime;

@@ -40,7 +38,7 @@ import org.joda.time.DateTime;
 * scoped on {@link EntityGroupRoot}.
 */
@Entity
-public class Cursor extends ImmutableObject implements DatastoreEntity {
+public class Cursor extends ImmutableObject implements DatastoreOnlyEntity {

  /** The types of cursors, used as the string id field for each cursor in Datastore. */
  public enum CursorType {
@@ -137,11 +135,6 @@ public class Cursor extends ImmutableObject implements DatastoreEntity {
    return CursorType.valueOf(String.join("_", id.subList(1, id.size())));
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // Cursors are not converted since they are ephemeral
-  }
-
  /**
   * Checks that the type of the scoped object (or null) matches the required type for the specified
   * cursor (or null, if the cursor is a global cursor).
--- a/core/src/main/java/google/registry/model/common/EntityGroupRoot.java
+++ b/core/src/main/java/google/registry/model/common/EntityGroupRoot.java
@@ -14,13 +14,11 @@

 package google.registry.model.common;

-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import google.registry.model.BackupGroupRoot;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /**
 * The root key for the entity group which is known as the cross-tld entity group for historical
@@ -37,7 +35,7 @@ import google.registry.schema.replay.SqlEntity;
 * entity group for the single namespace where global data applicable for all TLDs lived.
 */
@Entity
-public class EntityGroupRoot extends BackupGroupRoot implements DatastoreEntity {
+public class EntityGroupRoot extends BackupGroupRoot implements DatastoreOnlyEntity {

  @SuppressWarnings("unused")
  @Id
@@ -47,9 +45,4 @@ public class EntityGroupRoot extends BackupGroupRoot implements DatastoreEntity
  public static Key<EntityGroupRoot> getCrossTldKey() {
    return Key.create(EntityGroupRoot.class, "cross-tld");
  }
-
-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
 }
--- a/core/src/main/java/google/registry/model/contact/ContactHistory.java
+++ b/core/src/main/java/google/registry/model/contact/ContactHistory.java
@@ -16,18 +16,21 @@ package google.registry.model.contact;

 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EntitySubclass;
-import google.registry.model.EppResource;
+import google.registry.model.ImmutableObject;
+import google.registry.model.contact.ContactHistory.ContactHistoryId;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
+import java.io.Serializable;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import javax.persistence.Access;
 import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
 import javax.persistence.PostLoad;

 /**
@@ -47,16 +50,27 @@ import javax.persistence.PostLoad;
    })
@EntitySubclass
@Access(AccessType.FIELD)
-public class ContactHistory extends HistoryEntry {
+@IdClass(ContactHistoryId.class)
+public class ContactHistory extends HistoryEntry implements SqlEntity {

  // Store ContactBase instead of ContactResource so we don't pick up its @Id
  @Nullable ContactBase contactBase;

-  @Column(nullable = false)
-  VKey<ContactResource> contactRepoId;
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getContactRepoId() {
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
+  }
+
+  /** This method is private because it is only used by Hibernate. */
+  @SuppressWarnings("unused")
+  private void setContactRepoId(String contactRepoId) {
+    parent = Key.create(ContactResource.class, contactRepoId);
+  }

  @Id
-  @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "TempHistorySequenceGenerator")
  @Column(name = "historyRevisionId")
  @Access(AccessType.PROPERTY)
  @Override
@@ -75,8 +89,14 @@ public class ContactHistory extends HistoryEntry {
  }

  /** The key to the {@link ContactResource} this is based off of. */
-  public VKey<ContactResource> getContactRepoId() {
-    return contactRepoId;
+  public VKey<ContactResource> getParentVKey() {
+    return VKey.create(ContactResource.class, getContactRepoId());
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
+  public VKey<ContactHistory> createVKey() {
+    return (VKey<ContactHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -86,11 +106,70 @@ public class ContactHistory extends HistoryEntry {
    if (contactBase != null && contactBase.getContactId() == null) {
      contactBase = null;
    }
-    // Fill in the full, symmetric, parent repo ID key
-    Key<ContactResource> parentKey =
-        Key.create(ContactResource.class, (String) contactRepoId.getSqlKey());
-    parent = parentKey;
-    contactRepoId = VKey.create(ContactResource.class, contactRepoId.getSqlKey(), parentKey);
+  }
+
+  // In Datastore, save as a HistoryEntry object regardless of this object's type
+  @Override
+  public Optional<DatastoreEntity> toDatastoreEntity() {
+    return Optional.of(asHistoryEntry());
+  }
+
+  /** Class to represent the composite primary key of {@link ContactHistory} entity. */
+  public static class ContactHistoryId extends ImmutableObject implements Serializable {
+
+    private String contactRepoId;
+
+    private Long id;
+
+    /** Hibernate requires this default constructor. */
+    private ContactHistoryId() {}
+
+    public ContactHistoryId(String contactRepoId, long id) {
+      this.contactRepoId = contactRepoId;
+      this.id = id;
+    }
+
+    /**
+     * Returns the contact repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private String getContactRepoId() {
+      return contactRepoId;
+    }
+
+    /**
+     * Returns the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private long getId() {
+      return id;
+    }
+
+    /**
+     * Sets the contact repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setContactRepoId(String contactRepoId) {
+      this.contactRepoId = contactRepoId;
+    }
+
+    /**
+     * Sets the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setId(long id) {
+      this.id = id;
+    }
  }

  @Override
@@ -111,18 +190,8 @@ public class ContactHistory extends HistoryEntry {
      return this;
    }

-    public Builder setContactRepoId(VKey<ContactResource> contactRepoId) {
-      getInstance().contactRepoId = contactRepoId;
-      contactRepoId.maybeGetOfyKey().ifPresent(parent -> getInstance().parent = parent);
-      return this;
-    }
-
-    // We can remove this once all HistoryEntries are converted to History objects
-    @Override
-    public Builder setParent(Key<? extends EppResource> parent) {
-      super.setParent(parent);
-      getInstance().contactRepoId =
-          VKey.create(ContactResource.class, parent.getName(), (Key<ContactResource>) parent);
+    public Builder setContactRepoId(String contactRepoId) {
+      getInstance().parent = Key.create(ContactResource.class, contactRepoId);
      return this;
    }
  }
--- a/core/src/main/java/google/registry/model/contact/ContactResource.java
+++ b/core/src/main/java/google/registry/model/contact/ContactResource.java
@@ -51,7 +51,6 @@ public class ContactResource extends ContactBase

  @Override
  public VKey<ContactResource> createVKey() {
-    // TODO(mmuller): create symmetric keys if we can ever reload both sides.
    return VKey.create(ContactResource.class, getRepoId(), Key.create(this));
  }

--- a/core/src/main/java/google/registry/model/domain/DomainBase.java
+++ b/core/src/main/java/google/registry/model/domain/DomainBase.java
@@ -19,6 +19,7 @@ import google.registry.model.EppResource;
 import google.registry.model.EppResource.ForeignKeyedEppResource;
 import google.registry.model.annotations.ExternalMessagingName;
 import google.registry.model.annotations.ReportedOn;
+import google.registry.model.domain.secdns.DelegationSignerData;
 import google.registry.model.host.HostResource;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithStringVKey;
@@ -106,6 +107,32 @@ public class DomainBase extends DomainContent
    return gracePeriods;
  }

+  /**
+   * Returns the set of {@link DelegationSignerData} associated with the domain.
+   *
+   * <p>This is the getter method specific for Hibernate to access the field so it is set to
+   * private. The caller can use the public {@link #getDsData()} to get the DS data.
+   *
+   * <p>Note that we need to set `insertable = false, updatable = false` for @JoinColumn, otherwise
+   * Hibernate would try to set the foreign key to null(through an UPDATE TABLE sql) instead of
+   * deleting the whole entry from the table when the {@link DelegationSignerData} is removed from
+   * the set.
+   */
+  @Access(AccessType.PROPERTY)
+  @OneToMany(
+      cascade = {CascadeType.ALL},
+      fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  @JoinColumn(
+      name = "domainRepoId",
+      referencedColumnName = "repoId",
+      insertable = false,
+      updatable = false)
+  @SuppressWarnings("UnusedMethod")
+  private Set<DelegationSignerData> getInternalDelegationSignerData() {
+    return dsData;
+  }
+
  @Override
  public VKey<DomainBase> createVKey() {
    return VKey.create(DomainBase.class, getRepoId(), Key.create(this));
--- a/core/src/main/java/google/registry/model/domain/DomainContent.java
+++ b/core/src/main/java/google/registry/model/domain/DomainContent.java
@@ -35,11 +35,13 @@ import static google.registry.util.DomainNameUtils.canonicalizeDomainName;
 import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

+import com.google.common.base.Predicate;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Ordering;
 import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
+import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Ignore;
 import com.googlecode.objectify.annotation.IgnoreSave;
 import com.googlecode.objectify.annotation.Index;
@@ -49,6 +51,7 @@ import google.registry.flows.ResourceFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.EntityGroupRoot;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.launch.LaunchNotice;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -57,6 +60,7 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.HostResource;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registry.Registry;
+import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
@@ -65,7 +69,6 @@ import java.util.HashSet;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
-import java.util.function.Predicate;
 import javax.annotation.Nullable;
 import javax.persistence.Access;
 import javax.persistence.AccessType;
@@ -209,6 +212,15 @@ public class DomainContent extends EppResource
  @Column(name = "deletion_poll_message_id")
  VKey<PollMessage.OneTime> deletePollMessage;

+  /**
+   * History record for the delete poll message.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Column(name = "deletion_poll_message_history_id")
+  @Ignore
+  Long deletePollMessageHistoryId;
+
  /**
   * The recurring billing event associated with this domain's autorenewals.
   *
@@ -220,6 +232,15 @@ public class DomainContent extends EppResource
  @Column(name = "billing_recurrence_id")
  VKey<BillingEvent.Recurring> autorenewBillingEvent;

+  /**
+   * History record for the autorenew billing event.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Column(name = "billing_recurrence_history_id")
+  @Ignore
+  Long autorenewBillingEventHistoryId;
+
  /**
   * The recurring poll message associated with this domain's autorenewals.
   *
@@ -231,6 +252,13 @@ public class DomainContent extends EppResource
  @Column(name = "autorenew_poll_message_id")
  VKey<PollMessage.Autorenew> autorenewPollMessage;

+  /**
+   * History record for the autorenew poll message.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Ignore Long autorenewPollMessageHistoryId;
+
  /** The unexpired grace periods for this domain (some of which may not be active yet). */
  @Transient Set<GracePeriod> gracePeriods;

@@ -275,19 +303,31 @@ public class DomainContent extends EppResource
        allContacts.stream().map(DesignatedContact::reconstitute).collect(toImmutableSet());
    setContactFields(allContacts, true);

-    // We have to return the cloned object here because the original object's
-    // hashcode is not correct due to the change to its domainRepoId. The cloned
-    // object will have a null hashcode so that it can get a recalculated hashcode
-    // when its hashCode() is invoked.
+    // We have to return the cloned object here because the original object's hashcode is not
+    // correct due to the change to its domainRepoId and history ids. The cloned object will have a
+    // null hashcode so that it can get a recalculated hashcode when its hashCode() is invoked.
    // TODO(b/162739503): Remove this after fully migrating to Cloud SQL.
    gracePeriods =
        nullToEmptyImmutableCopy(gracePeriods).stream()
-            .map(gracePeriod -> gracePeriod.cloneWithDomainRepoId(getRepoId()))
+            .map(gracePeriod -> gracePeriod.cloneAfterOfyLoad(getRepoId()))
+            .collect(toImmutableSet());
+    // TODO(b/169873747): Remove this method after explicitly re-saving all domain entities.
+    // See also: GradePeriod.onLoad.
+    gracePeriods.forEach(GracePeriod::onLoad);
+
+    // Restore history record ids.
+    autorenewPollMessageHistoryId = getHistoryId(autorenewPollMessage);
+    autorenewBillingEventHistoryId = getHistoryId(autorenewBillingEvent);
+    deletePollMessageHistoryId = getHistoryId(deletePollMessage);
+    dsData =
+        nullToEmptyImmutableCopy(dsData).stream()
+            .map(dsData -> dsData.cloneWithDomainRepoId(getRepoId()))
            .collect(toImmutableSet());
  }

  @PostLoad
-  void postLoad() {
+  @SuppressWarnings("UnusedMethod")
+  private final void postLoad() {
    // Reconstitute the contact list.
    ImmutableSet.Builder<DesignatedContact> contactsBuilder = new ImmutableSet.Builder<>();

@@ -306,6 +346,27 @@ public class DomainContent extends EppResource
    }

    allContacts = contactsBuilder.build();
+
+    // Reconstitute the composite ofy keys from the SQL data.
+    Key<DomainBase> myKey = Key.create(DomainBase.class, getRepoId());
+    deletePollMessage = restoreOfyFrom(myKey, deletePollMessage, deletePollMessageHistoryId);
+    autorenewBillingEvent =
+        restoreOfyFrom(myKey, autorenewBillingEvent, autorenewBillingEventHistoryId);
+    autorenewPollMessage =
+        restoreOfyFrom(myKey, autorenewPollMessage, autorenewPollMessageHistoryId);
+
+    if (transferData != null) {
+      transferData.restoreOfyKeys(myKey);
+    }
+  }
+
+  public static <T> VKey<T> restoreOfyFrom(Key<DomainBase> domainKey, VKey<T> key, Long historyId) {
+    if (historyId == null) {
+      // This is a legacy key (or a null key, in which case this works too)
+      return VKey.restoreOfyFrom(key, EntityGroupRoot.class, "per-tld");
+    } else {
+      return VKey.restoreOfyFrom(key, domainKey, HistoryEntry.class, historyId);
+    }
  }

  public ImmutableSet<String> getSubordinateHosts() {
@@ -387,6 +448,12 @@ public class DomainContent extends EppResource
    this.gracePeriods = gracePeriods;
  }

+  // Hibernate needs this in order to populate dsData but no one else should ever use it
+  @SuppressWarnings("UnusedMethod")
+  private void setInternalDelegationSignerData(Set<DelegationSignerData> dsData) {
+    this.dsData = dsData;
+  }
+
  public final String getCurrentSponsorClientId() {
    return getPersistedCurrentSponsorClientId();
  }
@@ -655,13 +722,31 @@ public class DomainContent extends EppResource
            + " use DomainBase instead");
  }

+  /**
+   * Obtains a history id from the given key.
+   *
+   * <p>The key must be a composite key either of the form domain-key/history-key/long-event-key or
+   * EntityGroupRoot/long-event-key (for legacy keys). In the latter case or for a null key returns
+   * a history id of null.
+   */
+  public static Long getHistoryId(VKey<?> key) {
+    if (key == null) {
+      return null;
+    }
+    Key<?> parent = key.getOfyKey().getParent();
+    if (parent == null || parent.getKind().equals("EntityGroupRoot")) {
+      return null;
+    }
+    return parent.getId();
+  }
+
  /** Predicate to determine if a given {@link DesignatedContact} is the registrant. */
  static final Predicate<DesignatedContact> IS_REGISTRANT =
      (DesignatedContact contact) -> DesignatedContact.Type.REGISTRANT.equals(contact.type);

  /** An override of {@link EppResource#asBuilder} with tighter typing. */
  @Override
-  public Builder asBuilder() {
+  public Builder<? extends DomainContent, ?> asBuilder() {
    return new Builder<>(clone(this));
  }

@@ -698,10 +783,16 @@ public class DomainContent extends EppResource
      instance.tld = getTldFromDomainName(instance.fullyQualifiedDomainName);

      T newDomain = super.build();
-      // Hibernate throws exception if gracePeriods is null because we enabled all cascadable
-      // operations and orphan removal.
+      // Hibernate throws exception if gracePeriods or dsData is null because we enabled all
+      // cascadable operations and orphan removal.
      newDomain.gracePeriods =
          newDomain.gracePeriods == null ? ImmutableSet.of() : newDomain.gracePeriods;
+      newDomain.dsData =
+          newDomain.dsData == null
+              ? ImmutableSet.of()
+              : newDomain.dsData.stream()
+                  .map(ds -> ds.cloneWithDomainRepoId(instance.getRepoId()))
+                  .collect(toImmutableSet());
      return newDomain;
    }

@@ -824,16 +915,19 @@ public class DomainContent extends EppResource

    public B setDeletePollMessage(VKey<PollMessage.OneTime> deletePollMessage) {
      getInstance().deletePollMessage = deletePollMessage;
+      getInstance().deletePollMessageHistoryId = getHistoryId(deletePollMessage);
      return thisCastToDerived();
    }

    public B setAutorenewBillingEvent(VKey<BillingEvent.Recurring> autorenewBillingEvent) {
      getInstance().autorenewBillingEvent = autorenewBillingEvent;
+      getInstance().autorenewBillingEventHistoryId = getHistoryId(autorenewBillingEvent);
      return thisCastToDerived();
    }

    public B setAutorenewPollMessage(VKey<PollMessage.Autorenew> autorenewPollMessage) {
      getInstance().autorenewPollMessage = autorenewPollMessage;
+      getInstance().autorenewPollMessageHistoryId = getHistoryId(autorenewPollMessage);
      return thisCastToDerived();
    }

--- a/core/src/main/java/google/registry/model/domain/DomainHistory.java
+++ b/core/src/main/java/google/registry/model/domain/DomainHistory.java
@@ -14,18 +14,23 @@

 package google.registry.model.domain;

+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;

+import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EntitySubclass;
 import com.googlecode.objectify.annotation.Ignore;
-import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
 import google.registry.model.domain.DomainHistory.DomainHistoryId;
+import google.registry.model.domain.GracePeriod.GracePeriodHistory;
+import google.registry.model.domain.secdns.DomainDsDataHistory;
 import google.registry.model.host.HostResource;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
 import java.io.Serializable;
 import java.util.Optional;
 import java.util.Set;
@@ -38,12 +43,12 @@ import javax.persistence.CascadeType;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
+import javax.persistence.FetchType;
 import javax.persistence.Id;
 import javax.persistence.IdClass;
 import javax.persistence.Index;
 import javax.persistence.JoinColumn;
+import javax.persistence.JoinColumns;
 import javax.persistence.JoinTable;
 import javax.persistence.OneToMany;
 import javax.persistence.PostLoad;
@@ -67,12 +72,24 @@ import javax.persistence.Table;
@EntitySubclass
@Access(AccessType.FIELD)
@IdClass(DomainHistoryId.class)
-public class DomainHistory extends HistoryEntry {
+public class DomainHistory extends HistoryEntry implements SqlEntity {

  // Store DomainContent instead of DomainBase so we don't pick up its @Id
  @Nullable DomainContent domainContent;

-  @Id String domainRepoId;
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getDomainRepoId() {
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
+  }
+
+  /** This method is private because it is only used by Hibernate. */
+  @SuppressWarnings("unused")
+  private void setDomainRepoId(String domainRepoId) {
+    parent = Key.create(DomainBase.class, domainRepoId);
+  }

  // We could have reused domainContent.nsHosts here, but Hibernate throws a weird exception after
  // we change to use a composite primary key.
@@ -83,16 +100,50 @@ public class DomainHistory extends HistoryEntry {
  @Column(name = "host_repo_id")
  Set<VKey<HostResource>> nsHosts;

+  @Ignore
+  @OneToMany(
+      cascade = {CascadeType.ALL},
+      fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  @JoinColumns({
+    @JoinColumn(
+        name = "domainHistoryRevisionId",
+        referencedColumnName = "historyRevisionId",
+        insertable = false,
+        updatable = false),
+    @JoinColumn(
+        name = "domainRepoId",
+        referencedColumnName = "domainRepoId",
+        insertable = false,
+        updatable = false)
+  })
+  Set<DomainDsDataHistory> dsDataHistories = ImmutableSet.of();
+
+  @Ignore
+  @OneToMany(
+      cascade = {CascadeType.ALL},
+      fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  @JoinColumns({
+    @JoinColumn(
+        name = "domainHistoryRevisionId",
+        referencedColumnName = "historyRevisionId",
+        insertable = false,
+        updatable = false),
+    @JoinColumn(
+        name = "domainRepoId",
+        referencedColumnName = "domainRepoId",
+        insertable = false,
+        updatable = false)
+  })
+  Set<GracePeriodHistory> gracePeriodHistories = ImmutableSet.of();
+
  @Override
  @Nullable
  @Access(AccessType.PROPERTY)
  @AttributeOverrides({
-      @AttributeOverride(
-          name = "unit",
-          column = @Column(name = "historyPeriodUnit")),
-      @AttributeOverride(
-          name = "value",
-          column = @Column(name = "historyPeriodValue"))
+    @AttributeOverride(name = "unit", column = @Column(name = "historyPeriodUnit")),
+    @AttributeOverride(name = "value", column = @Column(name = "historyPeriodValue"))
  })
  public Period getPeriod() {
    return super.getPeriod();
@@ -117,18 +168,27 @@ public class DomainHistory extends HistoryEntry {
   *
   * <p>This will be empty for any DomainHistory/HistoryEntry generated before this field was added,
   * mid-2017, as well as any action that does not generate billable events (e.g. updates).
+   *
+   * <p>This method is dedicated for Hibernate, external caller should use {@link
+   * #getDomainTransactionRecords()}.
   */
  @Access(AccessType.PROPERTY)
  @OneToMany(cascade = {CascadeType.ALL})
  @JoinColumn(name = "historyRevisionId", referencedColumnName = "historyRevisionId")
  @JoinColumn(name = "domainRepoId", referencedColumnName = "domainRepoId")
-  @Override
-  public Set<DomainTransactionRecord> getDomainTransactionRecords() {
-    return super.getDomainTransactionRecords();
+  @SuppressWarnings("unused")
+  private Set<DomainTransactionRecord> getInternalDomainTransactionRecords() {
+    return domainTransactionRecords;
+  }
+
+  /** Sets the domain transaction records. This method is dedicated for Hibernate. */
+  @SuppressWarnings("unused")
+  private void setInternalDomainTransactionRecords(
+      Set<DomainTransactionRecord> domainTransactionRecords) {
+    this.domainTransactionRecords = domainTransactionRecords;
  }

  @Id
-  @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "TempHistorySequenceGenerator")
  @Column(name = "historyRevisionId")
  @Access(AccessType.PROPERTY)
  @Override
@@ -141,6 +201,11 @@ public class DomainHistory extends HistoryEntry {
    return nsHosts;
  }

+  /** Returns the collection of {@link DomainDsDataHistory} instances. */
+  public ImmutableSet<DomainDsDataHistory> getDsDataHistories() {
+    return nullToEmptyImmutableCopy(dsDataHistories);
+  }
+
  /**
   * The values of all the fields on the {@link DomainContent} object after the action represented
   * by this history object was executed.
@@ -152,12 +217,18 @@ public class DomainHistory extends HistoryEntry {
  }

  /** The key to the {@link DomainBase} this is based off of. */
-  public VKey<DomainBase> getDomainRepoId() {
-    return VKey.create(DomainBase.class, domainRepoId, Key.create(DomainBase.class, domainRepoId));
+  public VKey<DomainBase> getParentVKey() {
+    return VKey.create(DomainBase.class, getDomainRepoId());
  }

+  public Set<GracePeriodHistory> getGracePeriodHistories() {
+    return nullToEmptyImmutableCopy(gracePeriodHistories);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
  public VKey<DomainHistory> createVKey() {
-    return VKey.createSql(DomainHistory.class, new DomainHistoryId(domainRepoId, getId()));
+    return (VKey<DomainHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -168,13 +239,22 @@ public class DomainHistory extends HistoryEntry {
      // domainContent with a null object. Unfortunately, the updateTimestamp is never null in SQL.
      if (domainContent.getDomainName() == null) {
        domainContent = null;
+      } else {
+        if (domainContent.getRepoId() == null) {
+          domainContent = domainContent.asBuilder().setRepoId(parent.getName()).build();
+        }
      }
    }
-    parent = Key.create(DomainBase.class, domainRepoId);
+  }
+
+  // In Datastore, save as a HistoryEntry object regardless of this object's type
+  @Override
+  public Optional<DatastoreEntity> toDatastoreEntity() {
+    return Optional.of(asHistoryEntry());
  }

  /** Class to represent the composite primary key of {@link DomainHistory} entity. */
-  static class DomainHistoryId extends ImmutableObject implements Serializable {
+  public static class DomainHistoryId extends ImmutableObject implements Serializable {

    private String domainRepoId;

@@ -183,24 +263,50 @@ public class DomainHistory extends HistoryEntry {
    /** Hibernate requires this default constructor. */
    private DomainHistoryId() {}

-    DomainHistoryId(String domainRepoId, long id) {
+    public DomainHistoryId(String domainRepoId, long id) {
      this.domainRepoId = domainRepoId;
      this.id = id;
    }

-    String getDomainRepoId() {
+    /**
+     * Returns the domain repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private String getDomainRepoId() {
      return domainRepoId;
    }

-    void setDomainRepoId(String domainRepoId) {
-      this.domainRepoId = domainRepoId;
-    }
-
-    long getId() {
+    /**
+     * Returns the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private long getId() {
      return id;
    }

-    void setId(long id) {
+    /**
+     * Sets the domain repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setDomainRepoId(String domainRepoId) {
+      this.domainRepoId = domainRepoId;
+    }
+
+    /**
+     * Sets the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setId(long id) {
      this.id = id;
    }
  }
@@ -220,24 +326,33 @@ public class DomainHistory extends HistoryEntry {

    public Builder setDomainContent(DomainContent domainContent) {
      getInstance().domainContent = domainContent;
-      if (domainContent != null) {
-        getInstance().nsHosts = nullToEmptyImmutableCopy(domainContent.nsHosts);
-      }
      return this;
    }

    public Builder setDomainRepoId(String domainRepoId) {
-      getInstance().domainRepoId = domainRepoId;
      getInstance().parent = Key.create(DomainBase.class, domainRepoId);
      return this;
    }

-    // We can remove this once all HistoryEntries are converted to History objects
    @Override
-    public Builder setParent(Key<? extends EppResource> parent) {
-      super.setParent(parent);
-      getInstance().domainRepoId = parent.getName();
-      return this;
+    public DomainHistory build() {
+      DomainHistory instance = super.build();
+      // TODO(b/171990736): Assert instance.domainContent is not null after database migration.
+      // Note that we cannot assert that instance.domainContent is not null here because this
+      // builder is also used to convert legacy HistoryEntry objects to DomainHistory, when
+      // domainContent is not available.
+      if (instance.domainContent != null) {
+        instance.nsHosts = nullToEmptyImmutableCopy(instance.domainContent.nsHosts);
+        instance.dsDataHistories =
+            nullToEmptyImmutableCopy(instance.domainContent.getDsData()).stream()
+                .map(dsData -> DomainDsDataHistory.createFrom(instance.id, dsData))
+                .collect(toImmutableSet());
+        instance.gracePeriodHistories =
+            nullToEmptyImmutableCopy(instance.domainContent.getGracePeriods()).stream()
+                .map(gracePeriod -> GracePeriodHistory.createFrom(instance.id, gracePeriod))
+                .collect(toImmutableSet());
+      }
+      return instance;
    }
  }
 }
--- a/core/src/main/java/google/registry/model/domain/GracePeriod.java
+++ b/core/src/main/java/google/registry/model/domain/GracePeriod.java
@@ -17,13 +17,19 @@ package google.registry.model.domain;
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

+import com.google.common.annotations.VisibleForTesting;
 import com.googlecode.objectify.annotation.Embed;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.Recurring;
 import google.registry.model.domain.rgp.GracePeriodStatus;
+import google.registry.model.ofy.ObjectifyService;
 import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreAndSqlEntity;
 import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Entity;
+import javax.persistence.Id;
 import javax.persistence.Index;
 import javax.persistence.Table;
 import org.joda.time.DateTime;
@@ -37,7 +43,25 @@ import org.joda.time.DateTime;
@Embed
@Entity
@Table(indexes = @Index(columnList = "domainRepoId"))
-public class GracePeriod extends GracePeriodBase {
+public class GracePeriod extends GracePeriodBase implements DatastoreAndSqlEntity {
+
+  @Id
+  @Access(AccessType.PROPERTY)
+  @Override
+  public long getGracePeriodId() {
+    return super.getGracePeriodId();
+  }
+
+  // TODO(b/169873747): Remove this method after explicitly re-saving all domain entities.
+  // This method is invoked from DomainContent.load(): Objectify's @OnLoad annotation
+  // apparently does not work on embedded objects inside an entity.
+  // Changing signature to void onLoad(@AlsoLoad("gracePeriodId") Long gracePeriodId)
+  // would not work. Method is not called if gracePeriodId is null.
+  void onLoad() {
+    if (gracePeriodId == null) {
+      gracePeriodId = ObjectifyService.allocateId();
+    }
+  }

  private static GracePeriod createInternal(
      GracePeriodStatus type,
@@ -45,19 +69,23 @@ public class GracePeriod extends GracePeriodBase {
      DateTime expirationTime,
      String clientId,
      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
-      @Nullable VKey<BillingEvent.Recurring> billingEventRecurring) {
+      @Nullable VKey<BillingEvent.Recurring> billingEventRecurring,
+      @Nullable Long gracePeriodId) {
    checkArgument((billingEventOneTime == null) || (billingEventRecurring == null),
        "A grace period can have at most one billing event");
    checkArgument(
        (billingEventRecurring != null) == GracePeriodStatus.AUTO_RENEW.equals(type),
        "Recurring billing events must be present on (and only on) autorenew grace periods");
    GracePeriod instance = new GracePeriod();
+    instance.gracePeriodId = gracePeriodId == null ? ObjectifyService.allocateId() : gracePeriodId;
    instance.type = checkArgumentNotNull(type);
    instance.domainRepoId = checkArgumentNotNull(domainRepoId);
    instance.expirationTime = checkArgumentNotNull(expirationTime);
    instance.clientId = checkArgumentNotNull(clientId);
    instance.billingEventOneTime = billingEventOneTime;
+    instance.billingEventOneTimeHistoryId = DomainBase.getHistoryId(billingEventOneTime);
    instance.billingEventRecurring = billingEventRecurring;
+    instance.billingEventRecurringHistoryId = DomainBase.getHistoryId(billingEventRecurring);
    return instance;
  }

@@ -74,7 +102,28 @@ public class GracePeriod extends GracePeriodBase {
      DateTime expirationTime,
      String clientId,
      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime) {
-    return createInternal(type, domainRepoId, expirationTime, clientId, billingEventOneTime, null);
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, billingEventOneTime, null, null);
+  }
+
+  /**
+   * Creates a GracePeriod for an (optional) OneTime billing event and a given {@link
+   * #gracePeriodId}.
+   *
+   * <p>Normal callers should always use {@link #forBillingEvent} instead, assuming they do not need
+   * to avoid loading the BillingEvent from Datastore. This method should typically be called only
+   * from test code to explicitly construct GracePeriods.
+   */
+  @VisibleForTesting
+  public static GracePeriod create(
+      GracePeriodStatus type,
+      String domainRepoId,
+      DateTime expirationTime,
+      String clientId,
+      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
+      @Nullable Long gracePeriodId) {
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, billingEventOneTime, null, gracePeriodId);
  }

  /** Creates a GracePeriod for a Recurring billing event. */
@@ -86,13 +135,27 @@ public class GracePeriod extends GracePeriodBase {
      VKey<Recurring> billingEventRecurring) {
    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
    return createInternal(
-        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring);
+        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring, null);
+  }
+
+  /** Creates a GracePeriod for a Recurring billing event and a given {@link #gracePeriodId}. */
+  @VisibleForTesting
+  public static GracePeriod createForRecurring(
+      GracePeriodStatus type,
+      String domainRepoId,
+      DateTime expirationTime,
+      String clientId,
+      VKey<Recurring> billingEventRecurring,
+      @Nullable Long gracePeriodId) {
+    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
+    return createInternal(
+        type, domainRepoId, expirationTime, clientId, null, billingEventRecurring, gracePeriodId);
  }

  /** Creates a GracePeriod with no billing event. */
  public static GracePeriod createWithoutBillingEvent(
      GracePeriodStatus type, String domainRepoId, DateTime expirationTime, String clientId) {
-    return createInternal(type, domainRepoId, expirationTime, clientId, null, null);
+    return createInternal(type, domainRepoId, expirationTime, clientId, null, null, null);
  }

  /** Constructs a GracePeriod of the given type from the provided one-time BillingEvent. */
@@ -107,14 +170,72 @@ public class GracePeriod extends GracePeriodBase {
  }

  /**
-   * Returns a clone of this {@link GracePeriod} with {@link #domainRepoId} set to the given value.
+   * Returns a clone of this {@link GracePeriod} with {@link #domainRepoId} set to the given value
+   * and reconstructed history ids.
   *
   * <p>TODO(b/162739503): Remove this function after fully migrating to Cloud SQL.
   */
-  public GracePeriod cloneWithDomainRepoId(String domainRepoId) {
+  public GracePeriod cloneAfterOfyLoad(String domainRepoId) {
    GracePeriod clone = clone(this);
    clone.domainRepoId = checkArgumentNotNull(domainRepoId);
+    clone.restoreHistoryIds();
    return clone;
  }

+  /**
+   * Returns a clone of this {@link GracePeriod} with {@link #billingEventRecurring} set to the
+   * given value.
+   *
+   * <p>TODO(b/162231099): Remove this function after duplicate id issue is solved.
+   */
+  public GracePeriod cloneWithRecurringBillingEvent(VKey<BillingEvent.Recurring> recurring) {
+    GracePeriod clone = clone(this);
+    clone.billingEventRecurring = recurring;
+    return clone;
+  }
+
+  /**
+   * Returns a clone of this {@link GracePeriod} with prepopulated {@link #gracePeriodId} generated
+   * by {@link ObjectifyService#allocateId()}.
+   *
+   * <p>TODO(shicong): Figure out how to generate the id only when the entity is used for Cloud SQL.
+   */
+  @VisibleForTesting
+  public GracePeriod cloneWithPrepopulatedId() {
+    GracePeriod clone = clone(this);
+    clone.gracePeriodId = ObjectifyService.allocateId();
+    return clone;
+  }
+
+  /** Entity class to represent a historic {@link GracePeriod}. */
+  @Entity(name = "GracePeriodHistory")
+  @Table(indexes = @Index(columnList = "domainRepoId"))
+  static class GracePeriodHistory extends GracePeriodBase {
+    @Id Long gracePeriodHistoryRevisionId;
+
+    /** ID for the associated {@link DomainHistory} entity. */
+    Long domainHistoryRevisionId;
+
+    @Override
+    @Access(AccessType.PROPERTY)
+    public long getGracePeriodId() {
+      return super.getGracePeriodId();
+    }
+
+    static GracePeriodHistory createFrom(long historyRevisionId, GracePeriod gracePeriod) {
+      GracePeriodHistory instance = new GracePeriodHistory();
+      instance.gracePeriodHistoryRevisionId = ObjectifyService.allocateId();
+      instance.domainHistoryRevisionId = historyRevisionId;
+      instance.gracePeriodId = gracePeriod.gracePeriodId;
+      instance.type = gracePeriod.type;
+      instance.domainRepoId = gracePeriod.domainRepoId;
+      instance.expirationTime = gracePeriod.expirationTime;
+      instance.clientId = gracePeriod.clientId;
+      instance.billingEventOneTime = gracePeriod.billingEventOneTime;
+      instance.billingEventOneTimeHistoryId = gracePeriod.billingEventOneTimeHistoryId;
+      instance.billingEventRecurring = gracePeriod.billingEventRecurring;
+      instance.billingEventRecurringHistoryId = gracePeriod.billingEventRecurringHistoryId;
+      return instance;
+    }
+  }
 }
--- a/core/src/main/java/google/registry/model/domain/GracePeriodBase.java
+++ b/core/src/main/java/google/registry/model/domain/GracePeriodBase.java
@@ -14,31 +14,35 @@

 package google.registry.model.domain;

+import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Embed;
 import com.googlecode.objectify.annotation.Ignore;
 import google.registry.model.ImmutableObject;
+import google.registry.model.ModelUtils;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.OneTime;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.persistence.VKey;
+import java.lang.reflect.Field;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
 import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
 import org.joda.time.DateTime;

 /** Base class containing common fields and methods for {@link GracePeriod}. */
@Embed
@MappedSuperclass
+@Access(AccessType.FIELD)
 public class GracePeriodBase extends ImmutableObject {

  /** Unique id required for hibernate representation. */
-  @javax.persistence.Id
-  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Ignore
-  Long id;
+  @Transient Long gracePeriodId;

  /** Repository id for the domain which this grace period belongs to. */
  @Ignore
@@ -67,6 +71,10 @@ public class GracePeriodBase extends ImmutableObject {
  @Column(name = "billing_event_id")
  VKey<OneTime> billingEventOneTime = null;

+  @Ignore
+  @Column(name = "billing_event_history_id")
+  Long billingEventOneTimeHistoryId;
+
  /**
   * The recurring billing event corresponding to the action that triggered this grace period, if
   * applicable - i.e. if the action was an autorenew - or null in all other cases.
@@ -75,6 +83,14 @@ public class GracePeriodBase extends ImmutableObject {
  @Column(name = "billing_recurrence_id")
  VKey<BillingEvent.Recurring> billingEventRecurring = null;

+  @Ignore
+  @Column(name = "billing_recurrence_history_id")
+  Long billingEventRecurringHistoryId;
+
+  public long getGracePeriodId() {
+    return gracePeriodId;
+  }
+
  public GracePeriodStatus getType() {
    return type;
  }
@@ -91,6 +107,12 @@ public class GracePeriodBase extends ImmutableObject {
    return clientId;
  }

+  /** This method is private because it is only used by Hibernate. */
+  @SuppressWarnings("unused")
+  private void setGracePeriodId(long gracePeriodId) {
+    this.gracePeriodId = gracePeriodId;
+  }
+
  /** Returns true if this GracePeriod has an associated BillingEvent; i.e. if it's refundable. */
  public boolean hasBillingEvent() {
    return billingEventOneTime != null || billingEventRecurring != null;
@@ -101,6 +123,7 @@ public class GracePeriodBase extends ImmutableObject {
   * period is not AUTO_RENEW.
   */
  public VKey<BillingEvent.OneTime> getOneTimeBillingEvent() {
+    restoreOfyKeys();
    return billingEventOneTime;
  }

@@ -109,6 +132,63 @@ public class GracePeriodBase extends ImmutableObject {
   * period is AUTO_RENEW.
   */
  public VKey<BillingEvent.Recurring> getRecurringBillingEvent() {
+    restoreOfyKeys();
    return billingEventRecurring;
  }
+
+  /**
+   * Restores history ids for composite VKeys after a load from datastore.
+   *
+   * <p>For use by DomainContent.load() ONLY.
+   */
+  protected void restoreHistoryIds() {
+    billingEventOneTimeHistoryId = DomainBase.getHistoryId(billingEventOneTime);
+    billingEventRecurringHistoryId = DomainBase.getHistoryId(billingEventRecurring);
+  }
+
+  /**
+   * Override {@link ImmutableObject#getSignificantFields()} to exclude "id", which breaks equality
+   * testing in the unit tests.
+   */
+  @Override
+  protected Map<Field, Object> getSignificantFields() {
+    restoreOfyKeys();
+    // Can't use streams or ImmutableMap because we can have null values.
+    Map<Field, Object> result = new LinkedHashMap();
+    for (Map.Entry<Field, Object> entry : ModelUtils.getFieldValues(this).entrySet()) {
+      if (!entry.getKey().getName().equals("id")) {
+        result.put(entry.getKey(), entry.getValue());
+      }
+    }
+    return result;
+  }
+
+  /**
+   * Restores Ofy keys in the billing events.
+   *
+   * <p>This must be called by all methods that access the one time or recurring billing event keys.
+   * When the billing event keys are loaded from SQL, they are loaded as asymmetric keys because the
+   * database columns that we load them from do not contain all of the information necessary to
+   * reconsitute the Ofy side of the key. In other cases, we restore the Ofy key during the
+   * hibernate {@link javax.persistence.PostLoad} method from the other fields of the object, but we
+   * have been unable to make this work with hibernate's internal persistence model in this case
+   * because the {@link GracePeriod}'s hash code is evaluated prior to these calls, and would be
+   * invalidated by changing the fields.
+   */
+  private final synchronized void restoreOfyKeys() {
+    if (billingEventOneTime != null && !billingEventOneTime.maybeGetOfyKey().isPresent()) {
+      billingEventOneTime =
+          DomainBase.restoreOfyFrom(
+              Key.create(DomainBase.class, domainRepoId),
+              billingEventOneTime,
+              billingEventOneTimeHistoryId);
+    }
+    if (billingEventRecurring != null && !billingEventRecurring.maybeGetOfyKey().isPresent()) {
+      billingEventRecurring =
+          DomainBase.restoreOfyFrom(
+              Key.create(DomainBase.class, domainRepoId),
+              billingEventRecurring,
+              billingEventRecurringHistoryId);
+    }
+  }
 }
--- a/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DelegationSignerData.java
@@ -14,96 +14,235 @@

 package google.registry.model.domain.secdns;

+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
 import com.googlecode.objectify.annotation.Embed;
 import google.registry.model.ImmutableObject;
+import google.registry.model.domain.secdns.DelegationSignerData.DomainDsDataId;
+import java.io.Serializable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.Index;
+import javax.persistence.Table;
 import javax.xml.bind.DatatypeConverter;
-import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlType;
-import javax.xml.bind.annotation.adapters.HexBinaryAdapter;
-import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;

 /**
 * Holds the data necessary to construct a single Delegation Signer (DS) record for a domain.
 *
 * @see <a href="http://tools.ietf.org/html/rfc5910">RFC 5910</a>
 * @see <a href="http://tools.ietf.org/html/rfc4034">RFC 4034</a>
+ *     <p>TODO(shicong): Rename this class to DomainDsData.
 */
@Embed
@XmlType(name = "dsData")
-@javax.persistence.Entity
-public class DelegationSignerData extends ImmutableObject {
+@Entity
+@IdClass(DomainDsDataId.class)
+@Table(indexes = @Index(columnList = "domainRepoId"))
+public class DelegationSignerData extends DomainDsDataBase {

  private DelegationSignerData() {}

-  /** The identifier for this particular key in the domain. */
-  @javax.persistence.Id int keyTag;
-
-  /**
-   * The algorithm used by this key.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.1">RFC 4034 Appendix A.1</a>
-   */
-  @XmlElement(name = "alg")
-  int algorithm;
-
-  /**
-   * The algorithm used to generate the digest.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.2">RFC 4034 Appendix A.2</a>
-   */
-  int digestType;
-
-  /**
-   * The hexBinary digest of the public key.
-   *
-   * @see <a href="http://tools.ietf.org/html/rfc4034#section-5.1.4">RFC 4034 Section 5.1.4</a>
-   */
-  @XmlJavaTypeAdapter(HexBinaryAdapter.class)
-  byte[] digest;
+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getDomainRepoId() {
+    return super.getDomainRepoId();
+  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getKeyTag() {
-    return keyTag;
+    return super.getKeyTag();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getAlgorithm() {
-    return algorithm;
+    return super.getAlgorithm();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public int getDigestType() {
-    return digestType;
+    return super.getDigestType();
  }

+  @Override
+  @Id
+  @Access(AccessType.PROPERTY)
  public byte[] getDigest() {
-    return digest;
+    return super.getDigest();
  }

-  public String getDigestAsString() {
-    return digest == null ? "" : DatatypeConverter.printHexBinary(digest);
+  public DelegationSignerData cloneWithDomainRepoId(String domainRepoId) {
+    DelegationSignerData clone = clone(this);
+    clone.domainRepoId = checkArgumentNotNull(domainRepoId);
+    return clone;
+  }
+
+  public DelegationSignerData cloneWithoutDomainRepoId() {
+    DelegationSignerData clone = clone(this);
+    clone.domainRepoId = null;
+    return clone;
  }

  public static DelegationSignerData create(
-      int keyTag, int algorithm, int digestType, byte[] digest) {
+      int keyTag, int algorithm, int digestType, byte[] digest, String domainRepoId) {
    DelegationSignerData instance = new DelegationSignerData();
    instance.keyTag = keyTag;
    instance.algorithm = algorithm;
    instance.digestType = digestType;
    instance.digest = digest;
+    instance.domainRepoId = domainRepoId;
    return instance;
  }

+  public static DelegationSignerData create(
+      int keyTag, int algorithm, int digestType, byte[] digest) {
+    return create(keyTag, algorithm, digestType, digest, null);
+  }
+
  public static DelegationSignerData create(
      int keyTag, int algorithm, int digestType, String digestAsHex) {
    return create(keyTag, algorithm, digestType, DatatypeConverter.parseHexBinary(digestAsHex));
  }

-  /**
-   * Returns the presentation format of this DS record.
-   *
-   * @see <a href="https://tools.ietf.org/html/rfc4034#section-5.3">RFC 4034 Section 5.3</a>
-   */
-  public String toRrData() {
-    return String.format(
-        "%d %d %d %s",
-        this.keyTag, this.algorithm, this.digestType, DatatypeConverter.printHexBinary(digest));
+  /** Class to represent the composite primary key of {@link DelegationSignerData} entity. */
+  static class DomainDsDataId extends ImmutableObject implements Serializable {
+
+    String domainRepoId;
+
+    int keyTag;
+
+    int algorithm;
+
+    int digestType;
+
+    byte[] digest;
+
+    /** Hibernate requires this default constructor. */
+    private DomainDsDataId() {}
+
+    /** Constructs a {link DomainDsDataId} instance. */
+    DomainDsDataId(String domainRepoId, int keyTag, int algorithm, int digestType, byte[] digest) {
+      this.domainRepoId = domainRepoId;
+      this.keyTag = keyTag;
+      this.algorithm = algorithm;
+      this.digestType = digestType;
+      this.digest = digest;
+    }
+
+    /**
+     * Returns the domain repository ID.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private String getDomainRepoId() {
+      return domainRepoId;
+    }
+
+    /**
+     * Returns the key tag.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getKeyTag() {
+      return keyTag;
+    }
+
+    /**
+     * Returns the algorithm.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getAlgorithm() {
+      return algorithm;
+    }
+
+    /**
+     * Returns the digest type.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private int getDigestType() {
+      return digestType;
+    }
+
+    /**
+     * Returns the digest.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private byte[] getDigest() {
+      return digest;
+    }
+
+    /**
+     * Sets the domain repository ID.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDomainRepoId(String domainRepoId) {
+      this.domainRepoId = domainRepoId;
+    }
+
+    /**
+     * Sets the key tag.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setKeyTag(int keyTag) {
+      this.keyTag = keyTag;
+    }
+
+    /**
+     * Sets the algorithm.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setAlgorithm(int algorithm) {
+      this.algorithm = algorithm;
+    }
+
+    /**
+     * Sets the digest type.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDigestType(int digestType) {
+      this.digestType = digestType;
+    }
+
+    /**
+     * Sets the digest.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private void setDigest(byte[] digest) {
+      this.digest = digest;
+    }
+
+    public static DomainDsDataId create(
+        String domainRepoId, int keyTag, int algorithm, int digestType, byte[] digest) {
+      return new DomainDsDataId(
+          domainRepoId, keyTag, algorithm, digestType, checkArgumentNotNull(digest));
+    }
  }
 }
--- a/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java
@@ -0,0 +1,150 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.domain.secdns;
+
+import com.googlecode.objectify.annotation.Embed;
+import com.googlecode.objectify.annotation.Ignore;
+import google.registry.model.ImmutableObject;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+import javax.xml.bind.DatatypeConverter;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlTransient;
+import javax.xml.bind.annotation.adapters.HexBinaryAdapter;
+import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
+
+/** Base class for {@link DelegationSignerData} and {@link DomainDsDataHistory}. */
+@Embed
+@MappedSuperclass
+@Access(AccessType.FIELD)
+public abstract class DomainDsDataBase extends ImmutableObject {
+
+  @Ignore @XmlTransient @Transient String domainRepoId;
+
+  /** The identifier for this particular key in the domain. */
+  @Transient int keyTag;
+
+  /**
+   * The algorithm used by this key.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.1">RFC 4034 Appendix A.1</a>
+   */
+  @Transient
+  @XmlElement(name = "alg")
+  int algorithm;
+
+  /**
+   * The algorithm used to generate the digest.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#appendix-A.2">RFC 4034 Appendix A.2</a>
+   */
+  @Transient int digestType;
+
+  /**
+   * The hexBinary digest of the public key.
+   *
+   * @see <a href="http://tools.ietf.org/html/rfc4034#section-5.1.4">RFC 4034 Section 5.1.4</a>
+   */
+  @Transient
+  @XmlJavaTypeAdapter(HexBinaryAdapter.class)
+  byte[] digest;
+
+  public String getDomainRepoId() {
+    return domainRepoId;
+  }
+
+  public int getKeyTag() {
+    return keyTag;
+  }
+
+  public int getAlgorithm() {
+    return algorithm;
+  }
+
+  public int getDigestType() {
+    return digestType;
+  }
+
+  public byte[] getDigest() {
+    return digest;
+  }
+
+  /**
+   * Sets the domain repository ID.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDomainRepoId(String domainRepoId) {
+    this.domainRepoId = domainRepoId;
+  }
+
+  /**
+   * Sets the key tag.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setKeyTag(int keyTag) {
+    this.keyTag = keyTag;
+  }
+
+  /**
+   * Sets the algorithm.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setAlgorithm(int algorithm) {
+    this.algorithm = algorithm;
+  }
+
+  /**
+   * Sets the digest type.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDigestType(int digestType) {
+    this.digestType = digestType;
+  }
+
+  /**
+   * Sets the digest.
+   *
+   * <p>This method is private because it is only used by Hibernate.
+   */
+  @SuppressWarnings("unused")
+  private void setDigest(byte[] digest) {
+    this.digest = digest;
+  }
+
+  public String getDigestAsString() {
+    return digest == null ? "" : DatatypeConverter.printHexBinary(digest);
+  }
+
+  /**
+   * Returns the presentation format of this DS record.
+   *
+   * @see <a href="https://tools.ietf.org/html/rfc4034#section-5.3">RFC 4034 Section 5.3</a>
+   */
+  public String toRrData() {
+    return String.format(
+        "%d %d %d %s",
+        this.keyTag, this.algorithm, this.digestType, DatatypeConverter.printHexBinary(digest));
+  }
+}
--- a/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java
+++ b/core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java
@@ -0,0 +1,92 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.domain.secdns;
+
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.ofy.ObjectifyService;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
+import java.util.Optional;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/** Entity class to represent a historic {@link DelegationSignerData}. */
+@Entity
+public class DomainDsDataHistory extends DomainDsDataBase implements SqlEntity {
+
+  @Id Long dsDataHistoryRevisionId;
+
+  /** ID of the {@link DomainHistory} entity that this entity is associated with. */
+  @Column(nullable = false)
+  Long domainHistoryRevisionId;
+
+  private DomainDsDataHistory() {}
+
+  /**
+   * Creates a {@link DomainDsDataHistory} instance from given {@link #domainHistoryRevisionId} and
+   * {@link DelegationSignerData} instance.
+   */
+  public static DomainDsDataHistory createFrom(
+      long domainHistoryRevisionId, DelegationSignerData dsData) {
+    DomainDsDataHistory instance = new DomainDsDataHistory();
+    instance.domainHistoryRevisionId = domainHistoryRevisionId;
+    instance.domainRepoId = dsData.domainRepoId;
+    instance.keyTag = dsData.getKeyTag();
+    instance.algorithm = dsData.getAlgorithm();
+    instance.digestType = dsData.getDigestType();
+    instance.digest = dsData.getDigest();
+    instance.dsDataHistoryRevisionId = ObjectifyService.allocateId();
+    return instance;
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public String getDomainRepoId() {
+    return super.getDomainRepoId();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getKeyTag() {
+    return super.getKeyTag();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getAlgorithm() {
+    return super.getAlgorithm();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  public int getDigestType() {
+    return super.getDigestType();
+  }
+
+  @Override
+  @Access(AccessType.PROPERTY)
+  @Column(nullable = false)
+  public byte[] getDigest() {
+    return super.getDigest();
+  }
+
+  @Override
+  public Optional<DatastoreEntity> toDatastoreEntity() {
+    return Optional.empty(); // Not persisted in Datastore
+  }
+}
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -47,12 +47,15 @@ import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.common.TimedTransitionProperty.TimeMapper;
 import google.registry.model.common.TimedTransitionProperty.TimedTransition;
 import google.registry.model.reporting.HistoryEntry;
+import google.registry.persistence.DomainHistoryVKey;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithStringVKey;
 import google.registry.schema.replay.DatastoreAndSqlEntity;
 import java.util.Optional;
 import java.util.Set;
 import javax.annotation.Nullable;
+import javax.persistence.AttributeOverride;
+import javax.persistence.AttributeOverrides;
 import javax.persistence.Column;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
@@ -105,7 +108,15 @@ public class AllocationToken extends BackupGroupRoot implements Buildable, Datas
  @javax.persistence.Id @Id String token;

  /** The key of the history entry for which the token was used. Null if not yet used. */
-  @Nullable @Index VKey<HistoryEntry> redemptionHistoryEntry;
+  @Nullable
+  @Index
+  @AttributeOverrides({
+    @AttributeOverride(name = "domainRepoId", column = @Column(name = "redemption_domain_repo_id")),
+    @AttributeOverride(
+        name = "domainHistoryId",
+        column = @Column(name = "redemption_domain_history_id"))
+  })
+  DomainHistoryVKey redemptionHistoryEntry;

  /** The fully-qualified domain name that this token is limited to, if any. */
  @Nullable @Index String domainName;
@@ -280,7 +291,7 @@ public class AllocationToken extends BackupGroupRoot implements Buildable, Datas
      return this;
    }

-    public Builder setRedemptionHistoryEntry(VKey<HistoryEntry> redemptionHistoryEntry) {
+    public Builder setRedemptionHistoryEntry(DomainHistoryVKey redemptionHistoryEntry) {
      getInstance().redemptionHistoryEntry =
          checkArgumentNotNull(redemptionHistoryEntry, "Redemption history entry must not be null");
      return this;
--- a/core/src/main/java/google/registry/model/eppcommon/StatusValue.java
+++ b/core/src/main/java/google/registry/model/eppcommon/StatusValue.java
@@ -20,8 +20,10 @@ import static com.google.common.base.Strings.nullToEmpty;

 import com.google.common.collect.ImmutableSet;
 import google.registry.model.EppResource;
+import google.registry.model.contact.ContactBase;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
+import google.registry.model.domain.DomainContent;
 import google.registry.model.host.HostBase;
 import google.registry.model.host.HostResource;
 import google.registry.model.translators.EnumToAttributeAdapter.EppEnum;
@@ -128,9 +130,15 @@ public enum StatusValue implements EppEnum {

  /** Enum to help clearly list which resource types a status value is allowed to be present on. */
  private enum AllowedOn {
-    ALL(ContactResource.class, DomainBase.class, HostBase.class, HostResource.class),
+    ALL(
+        ContactBase.class,
+        ContactResource.class,
+        DomainContent.class,
+        DomainBase.class,
+        HostBase.class,
+        HostResource.class),
    NONE,
-    DOMAINS(DomainBase.class);
+    DOMAINS(DomainContent.class, DomainBase.class);

    private final ImmutableSet<Class<? extends EppResource>> classes;

--- a/core/src/main/java/google/registry/model/eppoutput/EppResponse.java
+++ b/core/src/main/java/google/registry/model/eppoutput/EppResponse.java
@@ -65,6 +65,7 @@ import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementRef;
 import javax.xml.bind.annotation.XmlElementRefs;
 import javax.xml.bind.annotation.XmlElementWrapper;
+import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;

 /**
@@ -87,6 +88,9 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
  /** The command result. The RFC allows multiple failure results, but we always return one. */
  Result result;

+  /** Indicates if this response is for a login request. */
+  @XmlTransient boolean isLoginResponse = false;
+
  /**
   * Information about messages queued for retrieval. This may appear in response to any EPP message
   * (if messages are queued), but in practice this will only be set in response to a poll request.
@@ -178,6 +182,10 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
    return result;
  }

+  public boolean isLoginResponse() {
+    return isLoginResponse;
+  }
+
  /** Marker interface for types that can go in the {@link #resData} field. */
  public interface ResponseData {}

@@ -222,5 +230,10 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
      getInstance().extensions = forceEmptyToNull(extensions);
      return this;
    }
+
+    public Builder setIsLoginResponse() {
+      getInstance().isLoginResponse = true;
+      return this;
+    }
  }
 }
--- a/core/src/main/java/google/registry/model/host/HostHistory.java
+++ b/core/src/main/java/google/registry/model/host/HostHistory.java
@@ -16,18 +16,21 @@ package google.registry.model.host;

 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EntitySubclass;
-import google.registry.model.EppResource;
+import google.registry.model.ImmutableObject;
+import google.registry.model.host.HostHistory.HostHistoryId;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.persistence.VKey;
+import google.registry.schema.replay.DatastoreEntity;
+import google.registry.schema.replay.SqlEntity;
+import java.io.Serializable;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import javax.persistence.Access;
 import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
 import javax.persistence.PostLoad;

 /**
@@ -48,16 +51,27 @@ import javax.persistence.PostLoad;
    })
@EntitySubclass
@Access(AccessType.FIELD)
-public class HostHistory extends HistoryEntry {
+@IdClass(HostHistoryId.class)
+public class HostHistory extends HistoryEntry implements SqlEntity {

  // Store HostBase instead of HostResource so we don't pick up its @Id
  @Nullable HostBase hostBase;

-  @Column(nullable = false)
-  VKey<HostResource> hostRepoId;
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getHostRepoId() {
+    // We need to handle null case here because Hibernate sometimes accesses this method before
+    // parent gets initialized
+    return parent == null ? null : parent.getName();
+  }
+
+  /** This method is private because it is only used by Hibernate. */
+  @SuppressWarnings("unused")
+  private void setHostRepoId(String hostRepoId) {
+    parent = Key.create(HostResource.class, hostRepoId);
+  }

  @Id
-  @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "TempHistorySequenceGenerator")
  @Column(name = "historyRevisionId")
  @Access(AccessType.PROPERTY)
  @Override
@@ -76,8 +90,14 @@ public class HostHistory extends HistoryEntry {
  }

  /** The key to the {@link google.registry.model.host.HostResource} this is based off of. */
-  public VKey<HostResource> getHostRepoId() {
-    return hostRepoId;
+  public VKey<HostResource> getParentVKey() {
+    return VKey.create(HostResource.class, getHostRepoId());
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @SuppressWarnings("unchecked")
+  public VKey<HostHistory> createVKey() {
+    return (VKey<HostHistory>) createVKey(Key.create(this));
  }

  @PostLoad
@@ -87,10 +107,70 @@ public class HostHistory extends HistoryEntry {
    if (hostBase != null && hostBase.getHostName() == null) {
      hostBase = null;
    }
-    // Fill in the full, symmetric, parent repo ID key
-    Key<HostResource> parentKey = Key.create(HostResource.class, (String) hostRepoId.getSqlKey());
-    parent = parentKey;
-    hostRepoId = VKey.create(HostResource.class, hostRepoId.getSqlKey(), parentKey);
+  }
+
+  // In Datastore, save as a HistoryEntry object regardless of this object's type
+  @Override
+  public Optional<DatastoreEntity> toDatastoreEntity() {
+    return Optional.of(asHistoryEntry());
+  }
+
+  /** Class to represent the composite primary key of {@link HostHistory} entity. */
+  public static class HostHistoryId extends ImmutableObject implements Serializable {
+
+    private String hostRepoId;
+
+    private Long id;
+
+    /** Hibernate requires this default constructor. */
+    private HostHistoryId() {}
+
+    public HostHistoryId(String hostRepoId, long id) {
+      this.hostRepoId = hostRepoId;
+      this.id = id;
+    }
+
+    /**
+     * Returns the host repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private String getHostRepoId() {
+      return hostRepoId;
+    }
+
+    /**
+     * Returns the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate.
+     */
+    @SuppressWarnings("unused")
+    private long getId() {
+      return id;
+    }
+
+    /**
+     * Sets the host repository id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setHostRepoId(String hostRepoId) {
+      this.hostRepoId = hostRepoId;
+    }
+
+    /**
+     * Sets the history revision id.
+     *
+     * <p>This method is private because it is only used by Hibernate and should not be used
+     * externally to keep immutability.
+     */
+    @SuppressWarnings("unused")
+    private void setId(long id) {
+      this.id = id;
+    }
  }

  @Override
@@ -111,18 +191,8 @@ public class HostHistory extends HistoryEntry {
      return this;
    }

-    public Builder setHostRepoId(VKey<HostResource> hostRepoId) {
-      getInstance().hostRepoId = hostRepoId;
-      hostRepoId.maybeGetOfyKey().ifPresent(parent -> getInstance().parent = parent);
-      return this;
-    }
-
-    // We can remove this once all HistoryEntries are converted to History objects
-    @Override
-    public Builder setParent(Key<? extends EppResource> parent) {
-      super.setParent(parent);
-      getInstance().hostRepoId =
-          VKey.create(HostResource.class, parent.getName(), (Key<HostResource>) parent);
+    public Builder setHostRepoId(String hostRepoId) {
+      getInstance().parent = Key.create(HostResource.class, hostRepoId);
      return this;
    }
  }
--- a/core/src/main/java/google/registry/model/index/EppResourceIndex.java
+++ b/core/src/main/java/google/registry/model/index/EppResourceIndex.java
@@ -17,7 +17,6 @@ package google.registry.model.index;
 import static google.registry.util.TypeUtils.instantiate;

 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
@@ -26,25 +25,21 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.EppResource;
 import google.registry.model.annotations.ReportedOn;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /** An index that allows for quick enumeration of all EppResource entities (e.g. via map reduce). */
@ReportedOn
@Entity
-public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity {
+public class EppResourceIndex extends BackupGroupRoot implements DatastoreOnlyEntity {

-  @Id
-  String id;
+  @Id String id;

-  @Parent
-  Key<EppResourceIndexBucket> bucket;
+  @Parent Key<EppResourceIndexBucket> bucket;

  /** Although this field holds a {@link Key} it is named "reference" for historical reasons. */
  Key<? extends EppResource> reference;

-  @Index
-  String kind;
+  @Index String kind;

  public String getId() {
    return id;
@@ -69,7 +64,7 @@ public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity
    EppResourceIndex instance = instantiate(EppResourceIndex.class);
    instance.reference = resourceKey;
    instance.kind = resourceKey.getKind();
-    instance.id = resourceKey.getString();  // creates a web-safe key string
+    instance.id = resourceKey.getString(); // creates a web-safe key string
    instance.bucket = bucket;
    return instance;
  }
@@ -77,9 +72,4 @@ public class EppResourceIndex extends BackupGroupRoot implements DatastoreEntity
  public static <T extends EppResource> EppResourceIndex create(Key<T> resourceKey) {
    return create(EppResourceIndexBucket.getBucketKey(resourceKey), resourceKey);
  }
-
-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not relevant in SQL
-  }
 }
--- a/core/src/main/java/google/registry/model/index/EppResourceIndexBucket.java
+++ b/core/src/main/java/google/registry/model/index/EppResourceIndexBucket.java
@@ -24,23 +24,17 @@ import com.googlecode.objectify.annotation.Id;
 import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.VirtualEntity;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;

 /** A virtual entity to represent buckets to which EppResourceIndex objects are randomly added. */
@Entity
@VirtualEntity
-public class EppResourceIndexBucket extends ImmutableObject implements DatastoreEntity {
+public class EppResourceIndexBucket extends ImmutableObject implements DatastoreOnlyEntity {

  @SuppressWarnings("unused")
  @Id
  private long bucketId;

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not relevant in SQL
-  }
-
  /**
   * Deterministic function that returns a bucket id based on the resource's roid.
   * NB: At the moment, nothing depends on this being deterministic, so we have the ability to
--- a/core/src/main/java/google/registry/model/index/ForeignKeyIndex.java
+++ b/core/src/main/java/google/registry/model/index/ForeignKeyIndex.java
@@ -20,7 +20,6 @@ import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntri
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.TypeUtils.instantiate;
-import static java.util.concurrent.TimeUnit.MILLISECONDS;

 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.cache.CacheBuilder;
@@ -43,8 +42,7 @@ import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.host.HostResource;
 import google.registry.persistence.VKey;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.util.NonFinalForTesting;
 import java.util.Map;
 import java.util.Optional;
@@ -64,34 +62,19 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
  @ReportedOn
  @Entity
  public static class ForeignKeyContactIndex extends ForeignKeyIndex<ContactResource>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  /** The {@link ForeignKeyIndex} type for {@link DomainBase} entities. */
  @ReportedOn
  @Entity
  public static class ForeignKeyDomainIndex extends ForeignKeyIndex<DomainBase>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  /** The {@link ForeignKeyIndex} type for {@link HostResource} entities. */
  @ReportedOn
  @Entity
  public static class ForeignKeyHostIndex extends ForeignKeyIndex<HostResource>
-      implements DatastoreEntity {
-    @Override
-    public ImmutableList<SqlEntity> toSqlEntities() {
-      return ImmutableList.of(); // not relevant in SQL
-    }
-  }
+      implements DatastoreOnlyEntity {}

  static final ImmutableMap<Class<? extends EppResource>, Class<? extends ForeignKeyIndex<?>>>
      RESOURCE_CLASS_TO_FKI_CLASS =
@@ -244,7 +227,7 @@ public abstract class ForeignKeyIndex<E extends EppResource> extends BackupGroup
  private static LoadingCache<Key<ForeignKeyIndex<?>>, Optional<ForeignKeyIndex<?>>>
      createForeignKeyIndexesCache(Duration expiry) {
    return CacheBuilder.newBuilder()
-        .expireAfterWrite(expiry.getMillis(), MILLISECONDS)
+        .expireAfterWrite(java.time.Duration.ofMillis(expiry.getMillis()))
        .maximumSize(getEppResourceMaxCachedEntries())
        .build(CACHE_LOADER);
  }
--- a/core/src/main/java/google/registry/model/ofy/CommitLogBucket.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogBucket.java
@@ -22,7 +22,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.collect.ContiguousSet;
-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Range;
@@ -34,8 +33,7 @@ import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import google.registry.util.NonFinalForTesting;
 import java.util.Random;
 import java.util.function.Supplier;
@@ -53,7 +51,7 @@ import org.joda.time.DateTime;
 */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogBucket extends ImmutableObject implements Buildable, DatastoreEntity {
+public class CommitLogBucket extends ImmutableObject implements Buildable, DatastoreOnlyEntity {

  /**
   * Ranges from 1 to {@link RegistryConfig#getCommitLogBucketCount()}, inclusive; starts at 1 since
@@ -72,11 +70,6 @@ public class CommitLogBucket extends ImmutableObject implements Buildable, Datas
    return lastWrittenTime;
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  /**
   * Returns the key for the specified bucket ID.
   *
--- a/core/src/main/java/google/registry/model/ofy/CommitLogCheckpoint.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogCheckpoint.java
@@ -27,8 +27,7 @@ import com.googlecode.objectify.annotation.Parent;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
@@ -46,7 +45,7 @@ import org.joda.time.DateTime;
 */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogCheckpoint extends ImmutableObject implements DatastoreEntity {
+public class CommitLogCheckpoint extends ImmutableObject implements DatastoreOnlyEntity {

  /** Shared singleton parent entity for commit log checkpoints. */
  @Parent
@@ -73,11 +72,6 @@ public class CommitLogCheckpoint extends ImmutableObject implements DatastoreEnt
    return builder.build();
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  /**
   * Creates a CommitLogCheckpoint for the given wall time and bucket checkpoint times, specified as
   * a map from bucket ID to bucket commit timestamp.
--- a/core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLogCheckpointRoot.java
@@ -17,21 +17,19 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;

-import com.google.common.collect.ImmutableList;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import google.registry.model.ImmutableObject;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
-import google.registry.schema.replay.DatastoreEntity;
-import google.registry.schema.replay.SqlEntity;
+import google.registry.schema.replay.DatastoreOnlyEntity;
 import org.joda.time.DateTime;

 /** Singleton parent entity for all commit log checkpoints. */
@Entity
@NotBackedUp(reason = Reason.COMMIT_LOGS)
-public class CommitLogCheckpointRoot extends ImmutableObject implements DatastoreEntity {
+public class CommitLogCheckpointRoot extends ImmutableObject implements DatastoreOnlyEntity {

  public static final long SINGLETON_ID = 1;  // There is always exactly one of these.

@@ -50,11 +48,6 @@ public class CommitLogCheckpointRoot extends ImmutableObject implements Datastor
    return lastWrittenTime;
  }

-  @Override
-  public ImmutableList<SqlEntity> toSqlEntities() {
-    return ImmutableList.of(); // not persisted in SQL
-  }
-
  public static CommitLogCheckpointRoot loadRoot() {
    CommitLogCheckpointRoot root = ofy().load().key(getKey()).now();
    return root == null ? new CommitLogCheckpointRoot() : root;
--- a/Show More
+++ b/Show More