Add a bit of documentation about the replica config (#1488 )

Add support for empty or null params for createTask() (#1448 )
* Add support for null or empty params * Add Null or empty check in CollectionUtils * Remove content type header for empty params in POST request
2026-06-09 16:33:02 +00:00 · 2022-01-13 15:44:04 -05:00 · 2022-01-13 12:44:41 -05:00 · 2022-01-13 12:33:19 -05:00 · 2022-01-13 09:32:49 -05:00 · 2022-01-11 14:17:32 -05:00
63 changed files with 1483 additions and 297 deletions
@@ -676,9 +676,9 @@ Optional<List<String>> getToolArgsList() {

 // To run the nomulus tools with these command line tokens:
 // "--foo", "bar baz", "--qux=quz"
-//   gradle registryTool --args="--foo 'bar baz' --qux=quz"
+//   gradle core:registryTool --args="--foo 'bar baz' --qux=quz"
 // or:
-//   gradle registryTool --PtoolArgs="--foo|bar baz|--qux=quz"
+//   gradle core:registryTool -PtoolArgs="--foo|bar baz|--qux=quz"
 // Note that the delimiting pipe can be backslash escaped if it is part of a
 // parameter.
 ext.createToolTask = {
@@ -17,7 +17,7 @@ package google.registry.backup;
 import static google.registry.backup.ExportCommitLogDiffAction.LOWER_CHECKPOINT_TIME_PARAM;
 import static google.registry.backup.ExportCommitLogDiffAction.UPPER_CHECKPOINT_TIME_PARAM;
 import static google.registry.model.ofy.ObjectifyService.auditedOfy;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;

 import com.google.common.collect.ImmutableMultimap;
@@ -67,7 +67,8 @@ public final class CommitLogCheckpointAction implements Runnable {
    final CommitLogCheckpoint checkpoint = strategy.computeCheckpoint();
    logger.atInfo().log(
        "Generated candidate checkpoint for time: %s", checkpoint.getCheckpointTime());
-    tm().transact(
+    ofyTm()
+        .transact(
            () -> {
              DateTime lastWrittenTime = CommitLogCheckpointRoot.loadRoot().getLastWrittenTime();
              if (isBeforeOrAt(checkpoint.getCheckpointTime(), lastWrittenTime)) {
@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.model.ofy.ObjectifyService.auditedOfy;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.ofyTm;
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;

@@ -288,7 +288,8 @@ public final class DeleteOldCommitLogsAction implements Runnable {
      }

      DeletionResult deletionResult =
-          tm().transactNew(
+          ofyTm()
+              .transactNew(
                  () -> {
                    CommitLogManifest manifest = auditedOfy().load().key(manifestKey).now();
                    // It is possible that the same manifestKey was run twice, if a shard had to be
@@ -110,7 +110,7 @@ public final class AsyncTaskEnqueuer {
            .method(Method.POST)
            .header("Host", backendHostname)
            .countdownMillis(etaDuration.getMillis())
-            .param(PARAM_RESOURCE_KEY, entityKey.getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, entityKey.stringify())
            .param(PARAM_REQUESTED_TIME, now.toString());
    if (whenToResave.size() > 1) {
      task.param(PARAM_RESAVE_TIMES, Joiner.on(',').join(whenToResave.tailSet(firstResave, false)));
@@ -131,7 +131,7 @@ public final class AsyncTaskEnqueuer {
    TaskOptions task =
        TaskOptions.Builder.withMethod(Method.PULL)
            .countdownMillis(asyncDeleteDelay.getMillis())
-            .param(PARAM_RESOURCE_KEY, resourceToDelete.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, resourceToDelete.createVKey().stringify())
            .param(PARAM_REQUESTING_CLIENT_ID, requestingRegistrarId)
            .param(PARAM_SERVER_TRANSACTION_ID, trid.getServerTransactionId())
            .param(PARAM_IS_SUPERUSER, Boolean.toString(isSuperuser))
@@ -148,7 +148,7 @@ public final class AsyncTaskEnqueuer {
    addTaskToQueueWithRetry(
        asyncDnsRefreshPullQueue,
        TaskOptions.Builder.withMethod(Method.PULL)
-            .param(PARAM_HOST_KEY, hostKey.getOfyKey().getString())
+            .param(PARAM_HOST_KEY, hostKey.stringify())
            .param(PARAM_REQUESTED_TIME, now.toString()));
  }

@@ -23,6 +23,7 @@ import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.BeamBulkQueryJpaTm;
 import google.registry.persistence.PersistenceModule.BeamJpaTm;
+import google.registry.persistence.PersistenceModule.BeamReadOnlyReplicaJpaTm;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.privileges.secretmanager.SecretManagerModule;
@@ -59,6 +60,13 @@ public interface RegistryPipelineComponent {
  @BeamBulkQueryJpaTm
  Lazy<JpaTransactionManager> getBulkQueryJpaTransactionManager();

+  /**
+   * A {@link JpaTransactionManager} that uses the Postgres read-only replica if configured (uses
+   * the standard DB otherwise).
+   */
+  @BeamReadOnlyReplicaJpaTm
+  Lazy<JpaTransactionManager> getReadOnlyReplicaJpaTransactionManager();
+
  @Component.Builder
  interface Builder {

@@ -56,6 +56,10 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
      case BULK_QUERY:
        transactionManagerLazy = registryPipelineComponent.getBulkQueryJpaTransactionManager();
        break;
+      case READ_ONLY_REPLICA:
+        transactionManagerLazy =
+            registryPipelineComponent.getReadOnlyReplicaJpaTransactionManager();
+        break;
      case REGULAR:
      default:
        transactionManagerLazy = registryPipelineComponent.getJpaTransactionManager();
@@ -23,6 +23,7 @@ import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.backup.VersionedEntity;
 import google.registry.beam.initsql.Transforms;
+import google.registry.model.EppResource;
 import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.common.Cursor;
@@ -42,6 +43,7 @@ import google.registry.model.tld.Registry;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import javax.annotation.Nullable;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.ParDo;
@@ -93,7 +95,8 @@ public final class DatastoreSnapshots {
      String commitLogDir,
      DateTime commitLogFromTime,
      DateTime commitLogToTime,
-      Set<Class<?>> kinds) {
+      Set<Class<?>> kinds,
+      Optional<DateTime> compareStartTime) {
    PCollectionTuple snapshot =
        pipeline.apply(
            "Load Datastore snapshot.",
@@ -112,11 +115,11 @@ public final class DatastoreSnapshots {
        perTypeSnapshots =
            perTypeSnapshots.and(
                createSqlEntityTupleTag((Class<? extends SqlEntity>) kind),
-                datastoreEntityToPojo(perKindSnapshot, kind.getSimpleName()));
+                datastoreEntityToPojo(perKindSnapshot, kind.getSimpleName(), compareStartTime));
        continue;
      }
      Verify.verify(kind == HistoryEntry.class, "Unexpected Non-SqlEntity class: %s", kind);
-      PCollectionTuple historyEntriesByType = splitHistoryEntry(perKindSnapshot);
+      PCollectionTuple historyEntriesByType = splitHistoryEntry(perKindSnapshot, compareStartTime);
      for (Map.Entry<TupleTag<?>, PCollection<?>> entry :
          historyEntriesByType.getAll().entrySet()) {
        perTypeSnapshots = perTypeSnapshots.and(entry.getKey().getId(), entry.getValue());
@@ -129,7 +132,9 @@ public final class DatastoreSnapshots {
   * Splits a {@link PCollection} of {@link HistoryEntry HistoryEntries} into three collections of
   * its child entities by type.
   */
-  static PCollectionTuple splitHistoryEntry(PCollection<VersionedEntity> historyEntries) {
+  static PCollectionTuple splitHistoryEntry(
+      PCollection<VersionedEntity> historyEntries, Optional<DateTime> compareStartTime) {
+    DateTime nullableStartTime = compareStartTime.orElse(null);
    return historyEntries.apply(
        "Split HistoryEntry by Resource Type",
        ParDo.of(
@@ -138,6 +143,7 @@ public final class DatastoreSnapshots {
                  public void processElement(
                      @Element VersionedEntity historyEntry, MultiOutputReceiver out) {
                    Optional.ofNullable(Transforms.convertVersionedEntityToSqlEntity(historyEntry))
+                        .filter(e -> isEntityIncludedForComparison(e, nullableStartTime))
                        .ifPresent(
                            sqlEntity ->
                                out.get(createSqlEntityTupleTag(sqlEntity.getClass()))
@@ -155,7 +161,8 @@ public final class DatastoreSnapshots {
   * objects.
   */
  static PCollection<SqlEntity> datastoreEntityToPojo(
-      PCollection<VersionedEntity> entities, String desc) {
+      PCollection<VersionedEntity> entities, String desc, Optional<DateTime> compareStartTime) {
+    DateTime nullableStartTime = compareStartTime.orElse(null);
    return entities.apply(
        "Datastore Entity to Pojo " + desc,
        ParDo.of(
@@ -164,8 +171,23 @@ public final class DatastoreSnapshots {
              public void processElement(
                  @Element VersionedEntity entity, OutputReceiver<SqlEntity> out) {
                Optional.ofNullable(Transforms.convertVersionedEntityToSqlEntity(entity))
+                    .filter(e -> isEntityIncludedForComparison(e, nullableStartTime))
                    .ifPresent(out::output);
              }
            }));
  }
+
+  static boolean isEntityIncludedForComparison(
+      SqlEntity entity, @Nullable DateTime compareStartTime) {
+    if (compareStartTime == null) {
+      return true;
+    }
+    if (entity instanceof HistoryEntry) {
+      return compareStartTime.isBefore(((HistoryEntry) entity).getModificationTime());
+    }
+    if (entity instanceof EppResource) {
+      return compareStartTime.isBefore(((EppResource) entity).getUpdateTimestamp().getTimestamp());
+    }
+    return true;
+  }
 }
@@ -14,15 +14,22 @@

 package google.registry.beam.comparedb;

+import static com.google.common.base.Preconditions.checkState;
 import static google.registry.beam.comparedb.ValidateSqlUtils.createSqlEntityTupleTag;
 import static google.registry.beam.comparedb.ValidateSqlUtils.getMedianIdForHistoryTable;

+import com.google.auto.value.AutoValue;
+import com.google.common.base.Strings;
 import com.google.common.base.Verify;
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.Streams;
 import google.registry.beam.common.RegistryJpaIO;
+import google.registry.beam.common.RegistryJpaIO.Read;
+import google.registry.model.EppResource;
+import google.registry.model.UpdateAutoTimestamp;
 import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.bulkquery.BulkQueryEntities;
@@ -50,8 +57,10 @@ import google.registry.model.replay.SqlEntity;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.tld.Registry;
 import google.registry.persistence.transaction.CriteriaQueryBuilder;
+import google.registry.util.DateTimeUtils;
 import java.io.Serializable;
 import java.util.Optional;
+import javax.persistence.Entity;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.transforms.DoFn;
 import org.apache.beam.sdk.transforms.Flatten;
@@ -65,6 +74,7 @@ import org.apache.beam.sdk.values.PCollectionList;
 import org.apache.beam.sdk.values.PCollectionTuple;
 import org.apache.beam.sdk.values.TypeDescriptor;
 import org.apache.beam.sdk.values.TypeDescriptors;
+import org.joda.time.DateTime;

 /**
 * Utilities for loading SQL snapshots.
@@ -113,28 +123,48 @@ public final class SqlSnapshots {
  public static PCollectionTuple loadCloudSqlSnapshotByType(
      Pipeline pipeline,
      ImmutableSet<Class<? extends SqlEntity>> sqlEntityTypes,
-      Optional<String> snapshotId) {
+      Optional<String> snapshotId,
+      Optional<DateTime> compareStartTime) {
    PCollectionTuple perTypeSnapshots = PCollectionTuple.empty(pipeline);
    for (Class<? extends SqlEntity> clazz : sqlEntityTypes) {
      if (clazz == DomainBase.class) {
        perTypeSnapshots =
            perTypeSnapshots.and(
                createSqlEntityTupleTag(DomainBase.class),
-                loadAndAssembleDomainBase(pipeline, snapshotId));
+                loadAndAssembleDomainBase(pipeline, snapshotId, compareStartTime));
        continue;
      }
      if (clazz == DomainHistory.class) {
        perTypeSnapshots =
            perTypeSnapshots.and(
                createSqlEntityTupleTag(DomainHistory.class),
-                loadAndAssembleDomainHistory(pipeline, snapshotId));
+                loadAndAssembleDomainHistory(pipeline, snapshotId, compareStartTime));
        continue;
      }
      if (clazz == ContactHistory.class) {
        perTypeSnapshots =
            perTypeSnapshots.and(
                createSqlEntityTupleTag(ContactHistory.class),
-                loadContactHistory(pipeline, snapshotId));
+                loadContactHistory(pipeline, snapshotId, compareStartTime));
+        continue;
+      }
+      if (clazz == HostHistory.class) {
+        perTypeSnapshots =
+            perTypeSnapshots.and(
+                createSqlEntityTupleTag(HostHistory.class),
+                loadHostHistory(
+                    pipeline, snapshotId, compareStartTime.orElse(DateTimeUtils.START_OF_TIME)));
+        continue;
+      }
+      if (EppResource.class.isAssignableFrom(clazz) && compareStartTime.isPresent()) {
+        perTypeSnapshots =
+            perTypeSnapshots.and(
+                createSqlEntityTupleTag(clazz),
+                pipeline.apply(
+                    "SQL Load " + clazz.getSimpleName(),
+                    buildEppResourceQueryWithTimeFilter(
+                            clazz, SqlEntity.class, snapshotId, compareStartTime.get())
+                        .withSnapshot(snapshotId.orElse(null))));
        continue;
      }
      perTypeSnapshots =
@@ -155,20 +185,33 @@ public final class SqlSnapshots {
   * @see BulkQueryEntities
   */
  public static PCollection<SqlEntity> loadAndAssembleDomainBase(
-      Pipeline pipeline, Optional<String> snapshotId) {
+      Pipeline pipeline, Optional<String> snapshotId, Optional<DateTime> compareStartTime) {
    PCollection<KV<String, Serializable>> baseObjects =
-        readAllAndAssignKey(pipeline, DomainBaseLite.class, DomainBaseLite::getRepoId, snapshotId);
+        readAllAndAssignKey(
+            pipeline,
+            DomainBaseLite.class,
+            DomainBaseLite::getRepoId,
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> gracePeriods =
-        readAllAndAssignKey(pipeline, GracePeriod.class, GracePeriod::getDomainRepoId, snapshotId);
+        readAllAndAssignKey(
+            pipeline,
+            GracePeriod.class,
+            GracePeriod::getDomainRepoId,
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> delegationSigners =
        readAllAndAssignKey(
            pipeline,
            DelegationSignerData.class,
            DelegationSignerData::getDomainRepoId,
-            snapshotId);
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> domainHosts =
-        readAllAndAssignKey(pipeline, DomainHost.class, DomainHost::getDomainRepoId, snapshotId);
+        readAllAndAssignKey(
+            pipeline, DomainHost.class, DomainHost::getDomainRepoId, snapshotId, compareStartTime);

+    DateTime nullableCompareStartTime = compareStartTime.orElse(null);
    return PCollectionList.of(
            ImmutableList.of(baseObjects, gracePeriods, delegationSigners, domainHosts))
        .apply("SQL Merge DomainBase parts", Flatten.pCollections())
@@ -184,6 +227,14 @@ public final class SqlSnapshots {
                    TypedClassifier partsByType = new TypedClassifier(kv.getValue());
                    ImmutableSet<DomainBaseLite> baseObjects =
                        partsByType.getAllOf(DomainBaseLite.class);
+                    if (nullableCompareStartTime != null) {
+                      Verify.verify(
+                          baseObjects.size() <= 1,
+                          "Found duplicate DomainBaseLite object per repoId: " + kv.getKey());
+                      if (baseObjects.isEmpty()) {
+                        return;
+                      }
+                    }
                    Verify.verify(
                        baseObjects.size() == 1,
                        "Expecting one DomainBaseLite object per repoId: " + kv.getKey());
@@ -205,16 +256,16 @@ public final class SqlSnapshots {
   * <p>This method uses two queries to load data in parallel. This is a performance optimization
   * specifically for the production database.
   */
-  static PCollection<SqlEntity> loadContactHistory(Pipeline pipeline, Optional<String> snapshotId) {
-    long medianId =
-        getMedianIdForHistoryTable("ContactHistory")
-            .orElseThrow(
-                () -> new IllegalStateException("Not a valid database: no ContactHistory."));
+  static PCollection<SqlEntity> loadContactHistory(
+      Pipeline pipeline, Optional<String> snapshotId, Optional<DateTime> compareStartTime) {
+    PartitionedQuery partitionedQuery =
+        buildPartitonedHistoryQuery(ContactHistory.class, compareStartTime);
    PCollection<SqlEntity> part1 =
        pipeline.apply(
            "SQL Load ContactHistory first half",
            RegistryJpaIO.read(
-                    String.format("select c from ContactHistory c where id <= %s", medianId),
+                    partitionedQuery.firstHalfQuery(),
+                    partitionedQuery.parameters(),
                    false,
                    SqlEntity.class::cast)
                .withSnapshot(snapshotId.orElse(null)));
@@ -222,7 +273,8 @@ public final class SqlSnapshots {
        pipeline.apply(
            "SQL Load ContactHistory second half",
            RegistryJpaIO.read(
-                    String.format("select c from ContactHistory c where id > %s", medianId),
+                    partitionedQuery.secondHalfQuery(),
+                    partitionedQuery.parameters(),
                    false,
                    SqlEntity.class::cast)
                .withSnapshot(snapshotId.orElse(null)));
@@ -231,6 +283,19 @@ public final class SqlSnapshots {
        .apply("Combine ContactHistory parts", Flatten.pCollections());
  }

+  /** Loads all {@link HostHistory} entities from the database. */
+  static PCollection<SqlEntity> loadHostHistory(
+      Pipeline pipeline, Optional<String> snapshotId, DateTime compareStartTime) {
+    return pipeline.apply(
+        "SQL Load HostHistory",
+        RegistryJpaIO.read(
+                "select c from HostHistory c where :compareStartTime  < modificationTime",
+                ImmutableMap.of("compareStartTime", compareStartTime),
+                false,
+                SqlEntity.class::cast)
+            .withSnapshot(snapshotId.orElse(null)));
+  }
+
  /**
   * Bulk-loads all parts of {@link DomainHistory} and assembles them in the pipeline.
   *
@@ -240,16 +305,15 @@ public final class SqlSnapshots {
   * @see BulkQueryEntities
   */
  static PCollection<SqlEntity> loadAndAssembleDomainHistory(
-      Pipeline pipeline, Optional<String> snapshotId) {
-    long medianId =
-        getMedianIdForHistoryTable("DomainHistory")
-            .orElseThrow(
-                () -> new IllegalStateException("Not a valid database: no DomainHistory."));
+      Pipeline pipeline, Optional<String> snapshotId, Optional<DateTime> compareStartTime) {
+    PartitionedQuery partitionedQuery =
+        buildPartitonedHistoryQuery(DomainHistoryLite.class, compareStartTime);
    PCollection<KV<String, Serializable>> baseObjectsPart1 =
        queryAndAssignKey(
            pipeline,
            "first half",
-            String.format("select c from DomainHistory c where id <= %s", medianId),
+            partitionedQuery.firstHalfQuery(),
+            partitionedQuery.parameters(),
            DomainHistoryLite.class,
            compose(DomainHistoryLite::getDomainHistoryId, DomainHistoryId::toString),
            snapshotId);
@@ -257,7 +321,8 @@ public final class SqlSnapshots {
        queryAndAssignKey(
            pipeline,
            "second half",
-            String.format("select c from DomainHistory c where id > %s", medianId),
+            partitionedQuery.secondHalfQuery(),
+            partitionedQuery.parameters(),
            DomainHistoryLite.class,
            compose(DomainHistoryLite::getDomainHistoryId, DomainHistoryId::toString),
            snapshotId);
@@ -266,26 +331,31 @@ public final class SqlSnapshots {
            pipeline,
            GracePeriodHistory.class,
            compose(GracePeriodHistory::getDomainHistoryId, DomainHistoryId::toString),
-            snapshotId);
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> delegationSigners =
        readAllAndAssignKey(
            pipeline,
            DomainDsDataHistory.class,
            compose(DomainDsDataHistory::getDomainHistoryId, DomainHistoryId::toString),
-            snapshotId);
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> domainHosts =
        readAllAndAssignKey(
            pipeline,
            DomainHistoryHost.class,
            compose(DomainHistoryHost::getDomainHistoryId, DomainHistoryId::toString),
-            snapshotId);
+            snapshotId,
+            compareStartTime);
    PCollection<KV<String, Serializable>> transactionRecords =
        readAllAndAssignKey(
            pipeline,
            DomainTransactionRecord.class,
            compose(DomainTransactionRecord::getDomainHistoryId, DomainHistoryId::toString),
-            snapshotId);
+            snapshotId,
+            compareStartTime);

+    DateTime nullableCompareStartTime = compareStartTime.orElse(null);
    return PCollectionList.of(
            ImmutableList.of(
                baseObjectsPart1,
@@ -307,6 +377,15 @@ public final class SqlSnapshots {
                    TypedClassifier partsByType = new TypedClassifier(kv.getValue());
                    ImmutableSet<DomainHistoryLite> baseObjects =
                        partsByType.getAllOf(DomainHistoryLite.class);
+                    if (nullableCompareStartTime != null) {
+                      Verify.verify(
+                          baseObjects.size() <= 1,
+                          "Found duplicate DomainHistoryLite object per domainHistoryId: "
+                              + kv.getKey());
+                      if (baseObjects.isEmpty()) {
+                        return;
+                      }
+                    }
                    Verify.verify(
                        baseObjects.size() == 1,
                        "Expecting one DomainHistoryLite object per domainHistoryId: "
@@ -328,12 +407,19 @@ public final class SqlSnapshots {
      Pipeline pipeline,
      Class<R> type,
      SerializableFunction<R, String> keyFunction,
-      Optional<String> snapshotId) {
+      Optional<String> snapshotId,
+      Optional<DateTime> compareStartTime) {
+    Read<R, R> queryObject;
+    if (compareStartTime.isPresent() && EppResource.class.isAssignableFrom(type)) {
+      queryObject =
+          buildEppResourceQueryWithTimeFilter(type, type, snapshotId, compareStartTime.get());
+    } else {
+      queryObject =
+          RegistryJpaIO.read(() -> CriteriaQueryBuilder.create(type).build())
+              .withSnapshot(snapshotId.orElse(null));
+    }
    return pipeline
-        .apply(
-            "SQL Load " + type.getSimpleName(),
-            RegistryJpaIO.read(() -> CriteriaQueryBuilder.create(type).build())
-                .withSnapshot(snapshotId.orElse(null)))
+        .apply("SQL Load " + type.getSimpleName(), queryObject)
        .apply(
            "Assign Key to " + type.getSimpleName(),
            MapElements.into(
@@ -346,13 +432,15 @@ public final class SqlSnapshots {
      Pipeline pipeline,
      String diffrentiator,
      String jplQuery,
+      ImmutableMap<String, Object> queryParameters,
      Class<R> type,
      SerializableFunction<R, String> keyFunction,
      Optional<String> snapshotId) {
    return pipeline
        .apply(
            "SQL Load " + type.getSimpleName() + " " + diffrentiator,
-            RegistryJpaIO.read(jplQuery, false, type::cast).withSnapshot(snapshotId.orElse(null)))
+            RegistryJpaIO.read(jplQuery, queryParameters, false, type::cast)
+                .withSnapshot(snapshotId.orElse(null)))
        .apply(
            "Assign Key to " + type.getSimpleName() + " " + diffrentiator,
            MapElements.into(
@@ -367,6 +455,71 @@ public final class SqlSnapshots {
    return r -> f2.apply(f1.apply(r));
  }

+  static <R, T> Read<R, T> buildEppResourceQueryWithTimeFilter(
+      Class<R> entityType,
+      Class<T> castOutputAsType,
+      Optional<String> snapshotId,
+      DateTime compareStartTime) {
+    String tableName = getJpaEntityName(entityType);
+    String jpql =
+        String.format("select c from %s c where :compareStartTime < updateTimestamp", tableName);
+    return RegistryJpaIO.read(
+            jpql,
+            ImmutableMap.of("compareStartTime", UpdateAutoTimestamp.create(compareStartTime)),
+            false,
+            (R x) -> castOutputAsType.cast(x))
+        .withSnapshot(snapshotId.orElse(null));
+  }
+
+  static PartitionedQuery buildPartitonedHistoryQuery(
+      Class<?> entityType, Optional<DateTime> compareStartTime) {
+    String tableName = getJpaEntityName(entityType);
+    Verify.verify(
+        !Strings.isNullOrEmpty(tableName), "Invalid entity type %s", entityType.getSimpleName());
+    long medianId =
+        getMedianIdForHistoryTable(tableName)
+            .orElseThrow(() -> new IllegalStateException("Not a valid database: no " + tableName));
+    String firstHalfQuery = String.format("select c from %s c where id <= :historyId", tableName);
+    String secondHalfQuery = String.format("select c from %s c where id > :historyId", tableName);
+    if (compareStartTime.isPresent()) {
+      String timeFilter = "  and :compareStartTime  < modificationTime";
+      firstHalfQuery += timeFilter;
+      secondHalfQuery += timeFilter;
+      return PartitionedQuery.createPartitionedQuery(
+          firstHalfQuery,
+          secondHalfQuery,
+          ImmutableMap.of("historyId", medianId, "compareStartTime", compareStartTime.get()));
+    } else {
+      return PartitionedQuery.createPartitionedQuery(
+          firstHalfQuery, secondHalfQuery, ImmutableMap.of("historyId", medianId));
+    }
+  }
+
+  private static String getJpaEntityName(Class entityType) {
+    Entity entityAnnotation = (Entity) entityType.getAnnotation(Entity.class);
+    checkState(
+        entityAnnotation != null, "Unexpected non-entity type %s", entityType.getSimpleName());
+    return Strings.isNullOrEmpty(entityAnnotation.name())
+        ? entityType.getSimpleName()
+        : entityAnnotation.name();
+  }
+
+  /** Contains two queries that partition the target table in two. */
+  @AutoValue
+  abstract static class PartitionedQuery {
+    abstract String firstHalfQuery();
+
+    abstract String secondHalfQuery();
+
+    abstract ImmutableMap<String, Object> parameters();
+
+    public static PartitionedQuery createPartitionedQuery(
+        String firstHalfQuery, String secondHalfQuery, ImmutableMap<String, Object> parameters) {
+      return new AutoValue_SqlSnapshots_PartitionedQuery(
+          firstHalfQuery, secondHalfQuery, parameters);
+    }
+  }
+
  /** Container that receives mixed-typed data and groups them by {@link Class}. */
  static class TypedClassifier {
    private final ImmutableSetMultimap<Class<?>, Object> classifiedEntities;
@@ -126,6 +126,9 @@ public class ValidateSqlPipeline {
        .getCoderRegistry()
        .registerCoderForClass(SqlEntity.class, SerializableCoder.of(Serializable.class));

+    Optional<DateTime> compareStartTime =
+        Optional.ofNullable(options.getComparisonStartTimestamp()).map(DateTime::parse);
+
    PCollectionTuple datastoreSnapshot =
        DatastoreSnapshots.loadDatastoreSnapshotByKind(
            pipeline,
@@ -135,11 +138,12 @@ public class ValidateSqlPipeline {
            // Increase by 1ms since we want to include commitLogs latestCommitLogTime but
            // this parameter is exclusive.
            latestCommitLogTime.plusMillis(1),
-            DatastoreSnapshots.ALL_DATASTORE_KINDS);
+            DatastoreSnapshots.ALL_DATASTORE_KINDS,
+            compareStartTime);

    PCollectionTuple cloudSqlSnapshot =
        SqlSnapshots.loadCloudSqlSnapshotByType(
-            pipeline, SqlSnapshots.ALL_SQL_ENTITIES, sqlSnapshotId);
+            pipeline, SqlSnapshots.ALL_SQL_ENTITIES, sqlSnapshotId, compareStartTime);

    verify(
        datastoreSnapshot.getAll().keySet().equals(cloudSqlSnapshot.getAll().keySet()),
@@ -16,7 +16,19 @@ package google.registry.beam.comparedb;

 import google.registry.beam.common.RegistryPipelineOptions;
 import google.registry.model.annotations.DeleteAfterMigration;
+import javax.annotation.Nullable;
+import org.apache.beam.sdk.options.Description;

 /** BEAM pipeline options for {@link ValidateSqlPipeline}. */
@DeleteAfterMigration
-public interface ValidateSqlPipelineOptions extends RegistryPipelineOptions {}
+public interface ValidateSqlPipelineOptions extends RegistryPipelineOptions {
+
+  @Description(
+      "For history entries and EPP resources, only those modified strictly after this time are "
+          + "included in comparison. Value is in ISO8601 format. "
+          + "Other entity types are not affected.")
+  @Nullable
+  String getComparisonStartTimestamp();
+
+  void setComparisonStartTimestamp(String comparisonStartTimestamp);
+}
@@ -33,6 +33,7 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.util.TaskQueueUtils;
 import google.registry.util.YamlUtils;
 import java.lang.annotation.Documented;
@@ -392,19 +393,26 @@ public final class RegistryConfig {

    @Provides
    @Config("cloudSqlJdbcUrl")
-    public static String providesCloudSqlJdbcUrl(RegistryConfigSettings config) {
+    public static String provideCloudSqlJdbcUrl(RegistryConfigSettings config) {
      return config.cloudSql.jdbcUrl;
    }

    @Provides
    @Config("cloudSqlInstanceConnectionName")
-    public static String providesCloudSqlInstanceConnectionName(RegistryConfigSettings config) {
+    public static String provideCloudSqlInstanceConnectionName(RegistryConfigSettings config) {
      return config.cloudSql.instanceConnectionName;
    }

+    @Provides
+    @Config("cloudSqlReplicaInstanceConnectionName")
+    public static Optional<String> provideCloudSqlReplicaInstanceConnectionName(
+        RegistryConfigSettings config) {
+      return Optional.ofNullable(config.cloudSql.replicaInstanceConnectionName);
+    }
+
    @Provides
    @Config("cloudSqlDbInstanceName")
-    public static String providesCloudSqlDbInstance(RegistryConfigSettings config) {
+    public static String provideCloudSqlDbInstance(RegistryConfigSettings config) {
      // Format of instanceConnectionName: project-id:region:instance-name
      int lastColonIndex = config.cloudSql.instanceConnectionName.lastIndexOf(':');
      return config.cloudSql.instanceConnectionName.substring(lastColonIndex + 1);
@@ -1524,6 +1532,31 @@ public final class RegistryConfig {
    return CONFIG_SETTINGS.get().hibernate.hikariIdleTimeout;
  }

+  /**
+   * JDBC-specific: driver default batch size is 0, which means that every INSERT statement will be
+   * sent to the database individually. Batching allows us to group together multiple inserts into
+   * one single INSERT statement which can dramatically increase speed in situations with many
+   * inserts.
+   *
+   * <p>Hibernate docs, i.e.
+   * https://docs.jboss.org/hibernate/orm/5.6/userguide/html_single/Hibernate_User_Guide.html,
+   * recommend between 10 and 50.
+   */
+  public static String getHibernateJdbcBatchSize() {
+    return CONFIG_SETTINGS.get().hibernate.jdbcBatchSize;
+  }
+
+  /**
+   * Returns the JDBC fetch size.
+   *
+   * <p>Postgresql-specific: driver default fetch size is 0, which disables streaming result sets.
+   * Here we set a small default geared toward Nomulus server transactions. Large queries can
+   * override the defaults using {@link JpaTransactionManager#setQueryFetchSize}.
+   */
+  public static String getHibernateJdbcFetchSize() {
+    return CONFIG_SETTINGS.get().hibernate.jdbcFetchSize;
+  }
+
  /** Returns the roid suffix to be used for the roids of all contacts and hosts. */
  public static String getContactAndHostRoidSuffix() {
    return CONFIG_SETTINGS.get().registryPolicy.contactAndHostRoidSuffix;
@@ -120,6 +120,8 @@ public class RegistryConfigSettings {
    public String hikariMinimumIdle;
    public String hikariMaximumPoolSize;
    public String hikariIdleTimeout;
+    public String jdbcBatchSize;
+    public String jdbcFetchSize;
  }

  /** Configuration for Cloud SQL. */
@@ -128,6 +130,7 @@ public class RegistryConfigSettings {
    // TODO(05012021): remove username field after it is removed from all yaml files.
    public String username;
    public String instanceConnectionName;
+    public String replicaInstanceConnectionName;
  }

  /** Configuration for Apache Beam (Cloud Dataflow). */
@@ -221,6 +221,17 @@ hibernate:
  hikariMinimumIdle: 1
  hikariMaximumPoolSize: 10
  hikariIdleTimeout: 300000
+  # The batch size is basically the number of insertions / updates in a single
+  # transaction that will be batched together into one INSERT/UPDATE statement.
+  # A larger batch size is useful when inserting or updating many entities in a
+  # single transaction. Hibernate docs
+  # (https://docs.jboss.org/hibernate/orm/5.6/userguide/html_single/Hibernate_User_Guide.html)
+  # recommend between 10 and 50.
+  jdbcBatchSize: 50
+  # The fetch size is the number of entities retrieved at a time from the
+  # database cursor. Here we set a small default geared toward Nomulus server
+  # transactions. Large queries can override the defaults on a per-query basis.
+  jdbcFetchSize: 20

 cloudSql:
  # jdbc url for the Cloud SQL database.
@@ -231,6 +242,10 @@ cloudSql:
  jdbcUrl: jdbc:postgresql://localhost
  # This name is used by Cloud SQL when connecting to the database.
  instanceConnectionName: project-id:region:instance-id
+  # If non-null, we will use this instance for certain read-only actions or
+  # pipelines, e.g. RDE, in order to offload some work from the primary
+  # instance. Expect any write actions on this instance to fail.
+  replicaInstanceConnectionName: null

 cloudDns:
  # Set both properties to null in Production.
@@ -349,6 +349,15 @@
    <target>backend</target>
  </cron>

+  <cron>
+    <url><![CDATA[/_dr/cron/replicateToDatastore]]></url>
+    <description>
+      Replays recent transactions from SQL to the Datastore secondary backend.
+    </description>
+    <schedule>every 3 minutes</schedule>
+    <target>backend</target>
+  </cron>
+
  <cron>
    <url><![CDATA[/_dr/task/wipeOutContactHistoryPii]]></url>
    <description>
@@ -26,7 +26,6 @@ import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Iterables;
-import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
@@ -143,7 +142,7 @@ public class ExportPremiumTermsAction implements Runnable {
        PremiumListDao.getLatestRevision(premiumListName).isPresent(),
        "Could not load premium list for " + tld);
    SortedSet<String> premiumTerms =
-        Streams.stream(PremiumListDao.loadAllPremiumEntries(premiumListName))
+        PremiumListDao.loadAllPremiumEntries(premiumListName).stream()
            .map(PremiumEntry::toString)
            .collect(ImmutableSortedSet.toImmutableSortedSet(String::compareTo));

@@ -27,6 +27,7 @@ import google.registry.model.EppResource;
 import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.model.annotations.ReportedOn;
 import google.registry.model.replay.DatastoreOnlyEntity;
+import google.registry.persistence.VKey;

 /** An index that allows for quick enumeration of all EppResource entities (e.g. via map reduce). */
@ReportedOn
@@ -66,8 +67,9 @@ public class EppResourceIndex extends BackupGroupRoot implements DatastoreOnlyEn
    EppResourceIndex instance = instantiate(EppResourceIndex.class);
    instance.reference = resourceKey;
    instance.kind = resourceKey.getKind();
-    // TODO(b/207368050): figure out if this value has ever been used other than test cases
-    instance.id = resourceKey.getString(); // creates a web-safe key string
+    // creates a web-safe key string, this value is never used
+    // TODO(b/211785379): remove unused id
+    instance.id = VKey.from(resourceKey).stringify();
    instance.bucket = bucket;
    return instance;
  }
@@ -21,7 +21,6 @@ import static com.google.common.hash.Funnels.stringFunnel;

 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.Streams;
 import com.google.common.hash.BloomFilter;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
@@ -86,9 +85,8 @@ public final class PremiumList extends BaseDomainLabelList<BigDecimal, PremiumEn
   */
  public synchronized ImmutableMap<String, BigDecimal> getLabelsToPrices() {
    if (labelsToPrices == null) {
-      Iterable<PremiumEntry> entries = PremiumListDao.loadAllPremiumEntries(name);
      labelsToPrices =
-          Streams.stream(entries)
+          PremiumListDao.loadAllPremiumEntries(name).stream()
              .collect(
                  toImmutableMap(
                      PremiumEntry::getDomainLabel,
@@ -28,8 +28,8 @@ import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
 import com.google.common.cache.LoadingCache;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Streams;
 import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.util.NonFinalForTesting;
 import java.math.BigDecimal;
@@ -56,8 +56,7 @@ public class PremiumListDao {
   * <p>This is cached for a shorter duration because we need to periodically reload this entity to
   * check if a new revision has been published, and if so, then use that.
   *
-   * <p>We also cache the absence of premium lists with a given name to avoid unnecessary pointless
-   * lookups. Note that this cache is only applicable to PremiumList objects stored in SQL.
+   * <p>We also cache the absence of premium lists with a given name to avoid pointless lookups.
   */
  @NonFinalForTesting
  static LoadingCache<String, Optional<PremiumList>> premiumListCache =
@@ -170,11 +169,10 @@ public class PremiumListDao {

              if (!isNullOrEmpty(premiumList.getLabelsToPrices())) {
                ImmutableSet.Builder<PremiumEntry> entries = new ImmutableSet.Builder<>();
-                premiumList.getLabelsToPrices().entrySet().stream()
+                premiumList
+                    .getLabelsToPrices()
                    .forEach(
-                        entry ->
-                            entries.add(
-                                PremiumEntry.create(revisionId, entry.getValue(), entry.getKey())));
+                        (key, value) -> entries.add(PremiumEntry.create(revisionId, value, key)));
                jpaTm().insertAll(entries.build());
              }
            });
@@ -217,7 +215,7 @@ public class PremiumListDao {
   *
   * <p>This is an expensive operation and should only be used when the entire list is required.
   */
-  public static Iterable<PremiumEntry> loadPremiumEntries(PremiumList premiumList) {
+  public static List<PremiumEntry> loadPremiumEntries(PremiumList premiumList) {
    return jpaTm()
        .transact(
            () ->
@@ -254,15 +252,14 @@ public class PremiumListDao {
   *
   * <p>This is an expensive operation and should only be used when the entire list is required.
   */
-  public static Iterable<PremiumEntry> loadAllPremiumEntries(String premiumListName) {
+  public static ImmutableList<PremiumEntry> loadAllPremiumEntries(String premiumListName) {
    PremiumList premiumList =
        getLatestRevision(premiumListName)
            .orElseThrow(
                () ->
                    new IllegalArgumentException(
                        String.format("No premium list with name %s.", premiumListName)));
-    Iterable<PremiumEntry> entries = loadPremiumEntries(premiumList);
-    return Streams.stream(entries)
+    return loadPremiumEntries(premiumList).stream()
        .map(
            premiumEntry ->
                new PremiumEntry.Builder()
@@ -19,6 +19,7 @@ import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.keyring.kms.KmsModule;
 import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.privileges.secretmanager.SecretManagerModule;
 import google.registry.util.UtilsModule;
@@ -40,4 +41,7 @@ public interface PersistenceComponent {

  @AppEngineJpaTm
  JpaTransactionManager appEngineJpaTransactionManager();
+
+  @ReadOnlyReplicaJpaTm
+  JpaTransactionManager readOnlyReplicaJpaTransactionManager();
 }
@@ -20,6 +20,8 @@ import static google.registry.config.RegistryConfig.getHibernateHikariConnection
 import static google.registry.config.RegistryConfig.getHibernateHikariIdleTimeout;
 import static google.registry.config.RegistryConfig.getHibernateHikariMaximumPoolSize;
 import static google.registry.config.RegistryConfig.getHibernateHikariMinimumIdle;
+import static google.registry.config.RegistryConfig.getHibernateJdbcBatchSize;
+import static google.registry.config.RegistryConfig.getHibernateJdbcFetchSize;
 import static google.registry.config.RegistryConfig.getHibernateLogSqlQueries;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

@@ -76,15 +78,9 @@ public abstract class PersistenceModule {
  public static final String HIKARI_DS_CLOUD_SQL_INSTANCE =
      "hibernate.hikari.dataSource.cloudSqlInstance";

-  /**
-   * Postgresql-specific: driver default fetch size is 0, which disables streaming result sets. Here
-   * we set a small default geared toward Nomulus server transactions. Large queries can override
-   * the defaults using {@link JpaTransactionManager#setQueryFetchSize}.
-   */
+  public static final String JDBC_BATCH_SIZE = "hibernate.jdbc.batch_size";
  public static final String JDBC_FETCH_SIZE = "hibernate.jdbc.fetch_size";

-  private static final int DEFAULT_SERVER_FETCH_SIZE = 20;
-
  @VisibleForTesting
  @Provides
  @DefaultHibernateConfigs
@@ -111,7 +107,8 @@ public abstract class PersistenceModule {
    properties.put(HIKARI_MAXIMUM_POOL_SIZE, getHibernateHikariMaximumPoolSize());
    properties.put(HIKARI_IDLE_TIMEOUT, getHibernateHikariIdleTimeout());
    properties.put(Environment.DIALECT, NomulusPostgreSQLDialect.class.getName());
-    properties.put(JDBC_FETCH_SIZE, Integer.toString(DEFAULT_SERVER_FETCH_SIZE));
+    properties.put(JDBC_BATCH_SIZE, getHibernateJdbcBatchSize());
+    properties.put(JDBC_FETCH_SIZE, getHibernateJdbcFetchSize());
    return properties.build();
  }

@@ -122,8 +119,11 @@ public abstract class PersistenceModule {
      @Config("cloudSqlJdbcUrl") String jdbcUrl,
      @Config("cloudSqlInstanceConnectionName") String instanceConnectionName,
      @DefaultHibernateConfigs ImmutableMap<String, String> defaultConfigs) {
-    return createPartialSqlConfigs(
-        jdbcUrl, instanceConnectionName, defaultConfigs, Optional.empty());
+    HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
+    overrides.put(Environment.URL, jdbcUrl);
+    overrides.put(HIKARI_DS_SOCKET_FACTORY, "com.google.cloud.sql.postgres.SocketFactory");
+    overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, instanceConnectionName);
+    return ImmutableMap.copyOf(overrides);
  }

  /**
@@ -184,22 +184,6 @@ public abstract class PersistenceModule {
    return ImmutableMap.copyOf(overrides);
  }

-  @VisibleForTesting
-  static ImmutableMap<String, String> createPartialSqlConfigs(
-      String jdbcUrl,
-      String instanceConnectionName,
-      ImmutableMap<String, String> defaultConfigs,
-      Optional<Provider<TransactionIsolationLevel>> isolationOverride) {
-    HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
-    overrides.put(Environment.URL, jdbcUrl);
-    overrides.put(HIKARI_DS_SOCKET_FACTORY, "com.google.cloud.sql.postgres.SocketFactory");
-    overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, instanceConnectionName);
-    isolationOverride
-        .map(Provider::get)
-        .ifPresent(override -> overrides.put(Environment.ISOLATION, override.name()));
-    return ImmutableMap.copyOf(overrides);
-  }
-
  /**
   * Provides a {@link Supplier} of single-use JDBC {@link Connection connections} that can manage
   * the database DDL schema.
@@ -280,6 +264,36 @@ public abstract class PersistenceModule {
    return new JpaTransactionManagerImpl(create(overrides), clock);
  }

+  @Provides
+  @Singleton
+  @ReadOnlyReplicaJpaTm
+  static JpaTransactionManager provideReadOnlyReplicaJpaTm(
+      SqlCredentialStore credentialStore,
+      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
+      @Config("cloudSqlReplicaInstanceConnectionName")
+          Optional<String> replicaInstanceConnectionName,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
+    setSqlCredential(credentialStore, new RobotUser(RobotId.NOMULUS), overrides);
+    replicaInstanceConnectionName.ifPresent(
+        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  @Provides
+  @Singleton
+  @BeamReadOnlyReplicaJpaTm
+  static JpaTransactionManager provideBeamReadOnlyReplicaJpaTm(
+      @BeamPipelineCloudSqlConfigs ImmutableMap<String, String> beamCloudSqlConfigs,
+      @Config("cloudSqlReplicaInstanceConnectionName")
+          Optional<String> replicaInstanceConnectionName,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(beamCloudSqlConfigs);
+    replicaInstanceConnectionName.ifPresent(
+        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
  /** Constructs the {@link EntityManagerFactory} instance. */
  @VisibleForTesting
  static EntityManagerFactory create(
@@ -357,7 +371,12 @@ public abstract class PersistenceModule {
     * The {@link JpaTransactionManager} optimized for bulk loading multi-level JPA entities. Please
     * see {@link google.registry.model.bulkquery.BulkQueryEntities} for more information.
     */
-    BULK_QUERY
+    BULK_QUERY,
+    /**
+     * The {@link JpaTransactionManager} that uses the read-only Postgres replica if configured, or
+     * the standard DB if not.
+     */
+    READ_ONLY_REPLICA
  }

  /** Dagger qualifier for JDBC {@link Connection} with schema management privilege. */
@@ -383,6 +402,22 @@ public abstract class PersistenceModule {
  @Documented
  public @interface BeamBulkQueryJpaTm {}

+  /**
+   * Dagger qualifier for {@link JpaTransactionManager} used inside BEAM pipelines that uses the
+   * read-only Postgres replica if one is configured (otherwise it uses the standard DB).
+   */
+  @Qualifier
+  @Documented
+  public @interface BeamReadOnlyReplicaJpaTm {}
+
+  /**
+   * Dagger qualifier for {@link JpaTransactionManager} that uses the read-only Postgres replica if
+   * one is configured (otherwise it uses the standard DB).
+   */
+  @Qualifier
+  @Documented
+  public @interface ReadOnlyReplicaJpaTm {}
+
  /** Dagger qualifier for {@link JpaTransactionManager} used for Nomulus tool. */
  @Qualifier
  @Documented
@@ -144,7 +144,7 @@ public class VKey<T> extends ImmutableObject implements Serializable {
   */
  public static <T> VKey<T> create(String keyString) {
    if (!keyString.startsWith(CLASS_TYPE + KV_SEPARATOR)) {
-      // to handle the existing ofy key string
+      // handle the existing ofy key string
      return fromWebsafeKey(keyString);
    } else {
      ImmutableMap<String, String> kvs =
@@ -307,6 +307,7 @@ public class VKey<T> extends ImmutableObject implements Serializable {
    if (maybeGetSqlKey().isPresent()) {
      key += DELIMITER + SQL_LOOKUP_KEY + KV_SEPARATOR + SerializeUtils.stringify(getSqlKey());
    }
+    // getString() method returns a Base64 encoded web safe of ofy key
    if (maybeGetOfyKey().isPresent()) {
      key += DELIMITER + OFY_LOOKUP_KEY + KV_SEPARATOR + getOfyKey().getString();
    }
@@ -141,14 +141,15 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
    // Postgresql-specific: 'set transaction' command must be called inside a transaction
    assertInTransaction();

-    EntityManager entityManager = getEntityManager();
+    ReadOnlyCheckingEntityManager entityManager =
+        (ReadOnlyCheckingEntityManager) getEntityManager();
    // Isolation is hardcoded to REPEATABLE READ, as specified by parent's Javadoc.
    entityManager
        .createNativeQuery("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
-        .executeUpdate();
+        .executeUpdateIgnoringReadOnly();
    entityManager
        .createNativeQuery(String.format("SET TRANSACTION SNAPSHOT '%s'", snapshotId))
-        .executeUpdate();
+        .executeUpdateIgnoringReadOnly();
    return this;
  }

@@ -206,7 +206,7 @@ public class ReadOnlyCheckingEntityManager implements EntityManager {
  }

  @Override
-  public Query createNativeQuery(String sqlString) {
+  public ReadOnlyCheckingQuery createNativeQuery(String sqlString) {
    return new ReadOnlyCheckingQuery(delegate.createNativeQuery(sqlString));
  }

@@ -14,7 +14,6 @@

 package google.registry.rde;

-import static com.google.appengine.api.taskqueue.QueueFactory.getQueue;
 import static google.registry.request.RequestParameters.extractBooleanParameter;
 import static google.registry.request.RequestParameters.extractOptionalIntParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
@@ -22,7 +21,6 @@ import static google.registry.request.RequestParameters.extractRequiredDatetimeP
 import static google.registry.request.RequestParameters.extractSetOfDatetimeParameters;
 import static google.registry.request.RequestParameters.extractSetOfParameters;

-import com.google.appengine.api.taskqueue.Queue;
 import com.google.common.collect.ImmutableSet;
 import com.jcraft.jsch.SftpProgressMonitor;
 import dagger.Binds;
@@ -30,7 +28,6 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.request.Parameter;
 import java.util.Optional;
-import javax.inject.Named;
 import javax.servlet.http.HttpServletRequest;
 import org.joda.time.DateTime;

@@ -110,12 +107,6 @@ public abstract class RdeModule {
    return extractOptionalParameter(req, PARAM_PREFIX);
  }

-  @Provides
-  @Named("rde-report")
-  static Queue provideQueueRdeReport() {
-    return getQueue("rde-report");
-  }
-
  @Binds
  abstract SftpProgressMonitor provideSftpProgressMonitor(
      LoggingSftpProgressMonitor loggingSftpProgressMonitor);
@@ -56,6 +56,7 @@ import google.registry.model.host.HostResource;
 import google.registry.model.index.EppResourceIndex;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.registrar.Registrar;
+import google.registry.persistence.PersistenceModule.JpaTransactionManagerType;
 import google.registry.request.Action;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.Parameter;
@@ -340,6 +341,9 @@ public final class RdeStagingAction implements Runnable {
                                          .encode(stagingKeyBytes))
                                  .put("registryEnvironment", RegistryEnvironment.get().name())
                                  .put("workerMachineType", machineType)
+                                  .put(
+                                      "jpaTransactionManagerType",
+                                      JpaTransactionManagerType.READ_ONLY_REPLICA.toString())
                                  // TODO (jianglai): Investigate turning off public IPs (for which
                                  // there is a quota) in order to increase the total number of
                                  // workers allowed (also under quota).
@@ -14,7 +14,6 @@

 package google.registry.tools;

-import static com.google.appengine.api.taskqueue.TaskOptions.Builder.withUrl;
 import static google.registry.model.tld.Registries.assertTldsExist;
 import static google.registry.rde.RdeModule.PARAM_BEAM;
 import static google.registry.rde.RdeModule.PARAM_DIRECTORY;
@@ -23,23 +22,22 @@ import static google.registry.rde.RdeModule.PARAM_MANUAL;
 import static google.registry.rde.RdeModule.PARAM_MODE;
 import static google.registry.rde.RdeModule.PARAM_REVISION;
 import static google.registry.rde.RdeModule.PARAM_WATERMARKS;
+import static google.registry.rde.RdeModule.RDE_REPORT_QUEUE;
 import static google.registry.request.RequestParameters.PARAM_TLDS;

 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.ParameterException;
 import com.beust.jcommander.Parameters;
-import com.google.appengine.api.taskqueue.Queue;
-import com.google.appengine.api.taskqueue.TaskOptions;
-import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableMultimap;
 import google.registry.model.rde.RdeMode;
 import google.registry.rde.RdeStagingAction;
+import google.registry.request.Action.Service;
 import google.registry.tools.params.DateTimeParameter;
 import google.registry.util.AppEngineServiceUtils;
+import google.registry.util.CloudTasksUtils;
 import java.util.List;
-import java.util.Optional;
 import java.util.stream.Collectors;
 import javax.inject.Inject;
-import javax.inject.Named;
 import org.joda.time.DateTime;

 /**
@@ -94,15 +92,7 @@ final class GenerateEscrowDepositCommand implements CommandWithRemoteApi {

  @Inject AppEngineServiceUtils appEngineServiceUtils;

-  @Inject
-  @Named("rde-report")
-  Queue queue;
-
-  // ETA is a required property for TaskOptions but we let the service to set it when submitting the
-  // task to the task queue. However, the local test service doesn't do that for us during the unit
-  // test, so we add this field here to let the unit test be able to inject the ETA to pass the
-  // test.
-  @VisibleForTesting Optional<Long> maybeEtaMillis = Optional.empty();
+  @Inject CloudTasksUtils cloudTasksUtils;

  @Override
  public void run() {
@@ -126,27 +116,25 @@ final class GenerateEscrowDepositCommand implements CommandWithRemoteApi {
      throw new ParameterException("Output subdirectory must not be empty");
    }

-    // Unlike many tool commands, this command is actually invoking an action on the backend module
-    // (because it's a mapreduce). So we invoke it in a different way.
-    String hostname = appEngineServiceUtils.getCurrentVersionHostname("backend");
-    TaskOptions opts =
-        withUrl(RdeStagingAction.PATH)
-            .header("Host", hostname)
-            .param(PARAM_MANUAL, String.valueOf(true))
-            .param(PARAM_MODE, mode.toString())
-            .param(PARAM_DIRECTORY, outdir)
-            .param(PARAM_LENIENT, Boolean.toString(lenient))
-            .param(PARAM_BEAM, Boolean.toString(beam))
-            .param(PARAM_TLDS, tlds.stream().collect(Collectors.joining(",")))
-            .param(
+    ImmutableMultimap.Builder<String, String> paramsBuilder =
+        new ImmutableMultimap.Builder<String, String>()
+            .put(PARAM_MANUAL, String.valueOf(true))
+            .put(PARAM_MODE, mode.toString())
+            .put(PARAM_DIRECTORY, outdir)
+            .put(PARAM_LENIENT, Boolean.toString(lenient))
+            .put(PARAM_BEAM, Boolean.toString(beam))
+            .put(PARAM_TLDS, tlds.stream().collect(Collectors.joining(",")))
+            .put(
                PARAM_WATERMARKS,
                watermarks.stream().map(DateTime::toString).collect(Collectors.joining(",")));
+
    if (revision != null) {
-      opts = opts.param(PARAM_REVISION, String.valueOf(revision));
+      paramsBuilder.put(PARAM_REVISION, String.valueOf(revision));
    }
-    if (maybeEtaMillis.isPresent()) {
-      opts = opts.etaMillis(maybeEtaMillis.get());
-    }
-    queue.add(opts);
+    cloudTasksUtils.enqueue(
+        RDE_REPORT_QUEUE,
+        CloudTasksUtils.createPostTask(
+            RdeStagingAction.PATH, Service.BACKEND.toString(), paramsBuilder.build()));
  }
+
 }
@@ -55,7 +55,7 @@ abstract class GetEppResourceCommand implements CommandWithRemoteApi {
            ? String.format(
                "%s\n\nWebsafe key: %s",
                expand ? resource.get().toHydratedString() : resource.get(),
-                resource.get().createVKey().getOfyKey().getString())
+                resource.get().createVKey().stringify())
            : String.format("%s '%s' does not exist or is deleted\n", resourceType, uniqueId));
  }

@@ -16,7 +16,6 @@ package google.registry.tools;

 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
-import com.google.common.collect.Streams;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.model.tld.label.PremiumListDao;
@@ -40,7 +39,7 @@ public class GetPremiumListCommand implements CommandWithRemoteApi {
        System.out.printf(
            "%s:\n%s\n",
            premiumListName,
-            Streams.stream(PremiumListDao.loadAllPremiumEntries(premiumListName))
+            PremiumListDao.loadAllPremiumEntries(premiumListName).stream()
                .sorted(Comparator.comparing(PremiumEntry::getDomainLabel))
                .map(premiumEntry -> premiumEntry.toString(premiumList.get().getCurrency()))
                .collect(Collectors.joining("\n")));
@@ -17,6 +17,7 @@ package google.registry.tools;
 import com.google.common.collect.ImmutableMap;
 import google.registry.tools.javascrap.BackfillRegistryLocksCommand;
 import google.registry.tools.javascrap.BackfillSpec11ThreatMatchesCommand;
+import google.registry.tools.javascrap.CompareEscrowDepositsCommand;
 import google.registry.tools.javascrap.DeleteContactByRoidCommand;
 import google.registry.tools.javascrap.HardDeleteHostCommand;
 import google.registry.tools.javascrap.PopulateNullRegistrarFieldsCommand;
@@ -40,6 +41,7 @@ public final class RegistryTool {
          .put("canonicalize_labels", CanonicalizeLabelsCommand.class)
          .put("check_domain", CheckDomainCommand.class)
          .put("check_domain_claims", CheckDomainClaimsCommand.class)
+          .put("compare_escrow_deposits", CompareEscrowDepositsCommand.class)
          .put("convert_idn", ConvertIdnCommand.class)
          .put("count_domains", CountDomainsCommand.class)
          .put("create_anchor_tenant", CreateAnchorTenantCommand.class)
@@ -19,6 +19,7 @@ import dagger.Component;
 import dagger.Lazy;
 import google.registry.batch.BatchModule;
 import google.registry.bigquery.BigqueryModule;
+import google.registry.config.CloudTasksUtilsModule;
 import google.registry.config.CredentialModule.LocalCredentialJson;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.config.RegistryConfig.ConfigModule;
@@ -42,6 +43,7 @@ import google.registry.request.Modules.UrlFetchTransportModule;
 import google.registry.request.Modules.UserServiceModule;
 import google.registry.tools.AuthModule.LocalCredentialModule;
 import google.registry.tools.javascrap.BackfillRegistryLocksCommand;
+import google.registry.tools.javascrap.CompareEscrowDepositsCommand;
 import google.registry.tools.javascrap.DeleteContactByRoidCommand;
 import google.registry.tools.javascrap.HardDeleteHostCommand;
 import google.registry.util.UtilsModule;
@@ -64,6 +66,7 @@ import javax.inject.Singleton;
      BigqueryModule.class,
      ConfigModule.class,
      CloudDnsWriterModule.class,
+      CloudTasksUtilsModule.class,
      DatastoreAdminModule.class,
      DatastoreServiceModule.class,
      DummyKeyringModule.class,
@@ -93,6 +96,8 @@ interface RegistryToolComponent {

  void inject(CheckDomainCommand command);

+  void inject(CompareEscrowDepositsCommand command);
+
  void inject(CountDomainsCommand command);

  void inject(CreateAnchorTenantCommand command);
@@ -15,21 +15,15 @@
 package google.registry.tools;

 import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static google.registry.model.tld.label.PremiumListUtils.parseToPremiumList;
-import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
 import static java.nio.charset.StandardCharsets.UTF_8;

 import com.beust.jcommander.Parameters;
 import com.google.common.base.Strings;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Streams;
 import google.registry.model.tld.label.PremiumList;
-import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.model.tld.label.PremiumListDao;
+import google.registry.model.tld.label.PremiumListUtils;
 import java.nio.file.Files;
-import java.util.List;
 import java.util.Optional;

 /** Command to safely update {@link PremiumList} in Database for a given TLD. */
@@ -43,46 +37,12 @@ class UpdatePremiumListCommand extends CreateOrUpdatePremiumListCommand {
    checkArgument(
        list.isPresent(),
        String.format("Could not update premium list %s because it doesn't exist.", name));
-    List<String> existingEntry = getExistingPremiumEntry(list.get()).asList();
    inputData = Files.readAllLines(inputFile, UTF_8);
    checkArgument(!inputData.isEmpty(), "New premium list data cannot be empty");
    currency = list.get().getCurrency();
-    // reconstructing existing premium list to bypass Hibernate lazy initialization exception
-    PremiumList existingPremiumList = parseToPremiumList(name, currency, existingEntry);
-    PremiumList updatedPremiumList = parseToPremiumList(name, currency, inputData);
-
+    PremiumList updatedPremiumList = PremiumListUtils.parseToPremiumList(name, currency, inputData);
    return String.format(
        "Update premium list for %s?\n Old List: %s\n New List: %s",
-        name, existingPremiumList, updatedPremiumList);
-  }
-
-  /*
-    To get premium list content as a set of string. This is a workaround to avoid dealing with
-    Hibernate.LazyInitizationException error. It occurs when trying to access data of the
-    latest revision of an existing premium list.
-    "Cannot evaluate google.registry.model.tld.label.PremiumList.toString()'".
-    Ideally, the following should be the way to verify info in latest revision of a premium list:
-
-    PremiumList existingPremiumList =
-        PremiumListSqlDao.getLatestRevision(name)
-            .orElseThrow(
-                () ->
-                    new IllegalArgumentException(
-                        String.format(
-                            "Could not update premium list %s because it doesn't exist.", name)));
-    assertThat(persistedList.getLabelsToPrices()).containsEntry("foo", new BigDecimal("9000.00"));
-    assertThat(persistedList.size()).isEqualTo(1);
-  */
-  protected ImmutableSet<String> getExistingPremiumEntry(PremiumList list) {
-
-    Iterable<PremiumEntry> sqlListEntries =
-        jpaTm().transact(() -> PremiumListDao.loadPremiumEntries(list));
-    return Streams.stream(sqlListEntries)
-        .map(
-            premiumEntry ->
-                String.format(
-                    "%s,%s %s",
-                    premiumEntry.getDomainLabel(), list.getCurrency(), premiumEntry.getValue()))
-        .collect(toImmutableSet());
+        name, list, updatedPremiumList);
  }
 }
@@ -0,0 +1,130 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools.javascrap;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.collect.Sets.difference;
+
+import com.beust.jcommander.Parameter;
+import com.beust.jcommander.Parameters;
+import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
+import google.registry.keyring.api.Keyring;
+import google.registry.model.annotations.DeleteAfterMigration;
+import google.registry.rde.Ghostryde;
+import google.registry.tools.Command;
+import google.registry.tools.params.PathParameter;
+import google.registry.xjc.XjcXmlTransformer;
+import google.registry.xjc.rde.XjcRdeDeposit;
+import google.registry.xjc.rdedomain.XjcRdeDomain;
+import google.registry.xjc.rderegistrar.XjcRdeRegistrar;
+import google.registry.xml.XmlException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import javax.inject.Inject;
+import javax.inject.Provider;
+import javax.xml.bind.JAXBElement;
+
+/**
+ * Command to view and schema validate an XML RDE escrow deposit.
+ *
+ * <p>Note that this command only makes sure that both deposits contain the same registrars and
+ * domains, regardless of the order. To verify that they are indeed equivalent one still needs to
+ * verify internal consistency within each deposit (i.e. to check that all hosts and contacts
+ * referenced by domains are included in the deposit) by calling {@code
+ * google.registry.tools.ValidateEscrowDepositCommand}.
+ */
+@DeleteAfterMigration
+@Parameters(separators = " =", commandDescription = "Compare two XML escrow deposits.")
+public final class CompareEscrowDepositsCommand implements Command {
+
+  @Parameter(
+      description =
+          "Two XML escrow deposit files. Each may be a plain XML or an XML GhostRyDE file.",
+      validateWith = PathParameter.InputFile.class)
+  private List<Path> inputs;
+
+  @Inject Provider<Keyring> keyring;
+
+  private XjcRdeDeposit getDeposit(Path input) throws IOException, XmlException {
+    InputStream fileStream = Files.newInputStream(input);
+    InputStream inputStream = fileStream;
+    if (input.toString().endsWith(".ghostryde")) {
+      inputStream = Ghostryde.decoder(fileStream, keyring.get().getRdeStagingDecryptionKey());
+    }
+    return XjcXmlTransformer.unmarshal(XjcRdeDeposit.class, inputStream);
+  }
+
+  @Override
+  public void run() throws Exception {
+    checkArgument(
+        inputs.size() == 2,
+        "Must supply 2 files to compare, but %s was/were supplied.",
+        inputs.size());
+    XjcRdeDeposit deposit1 = getDeposit(inputs.get(0));
+    XjcRdeDeposit deposit2 = getDeposit(inputs.get(1));
+    compareXmlDeposits(deposit1, deposit2);
+  }
+
+  private static void process(XjcRdeDeposit deposit, Set<String> domains, Set<String> registrars) {
+    for (JAXBElement<?> item : deposit.getContents().getContents()) {
+      if (XjcRdeDomain.class.isAssignableFrom(item.getDeclaredType())) {
+        XjcRdeDomain domain = (XjcRdeDomain) item.getValue();
+        domains.add(checkNotNull(domain.getName()));
+      } else if (XjcRdeRegistrar.class.isAssignableFrom(item.getDeclaredType())) {
+        XjcRdeRegistrar registrar = (XjcRdeRegistrar) item.getValue();
+        registrars.add(checkNotNull(registrar.getId()));
+      }
+    }
+  }
+
+  private static boolean printUniqueElements(
+      Set<String> set1, Set<String> set2, String element, String deposit) {
+    ImmutableList<String> uniqueElements = ImmutableList.copyOf(difference(set1, set2));
+    if (!uniqueElements.isEmpty()) {
+      System.out.printf(
+          "%s only in %s:\n%s\n", element, deposit, Joiner.on("\n").join(uniqueElements));
+      return false;
+    }
+    return true;
+  }
+
+  private static void compareXmlDeposits(XjcRdeDeposit deposit1, XjcRdeDeposit deposit2) {
+    Set<String> domains1 = new HashSet<>();
+    Set<String> domains2 = new HashSet<>();
+    Set<String> registrars1 = new HashSet<>();
+    Set<String> registrars2 = new HashSet<>();
+    process(deposit1, domains1, registrars1);
+    process(deposit2, domains2, registrars2);
+    boolean good = true;
+    good &= printUniqueElements(domains1, domains2, "domains", "deposit1");
+    good &= printUniqueElements(domains2, domains1, "domains", "deposit2");
+    good &= printUniqueElements(registrars1, registrars2, "registrars", "deposit1");
+    good &= printUniqueElements(registrars2, registrars1, "registrars", "deposit2");
+    if (good) {
+      System.out.println(
+          "The two deposits contain the same domains and registrars. "
+              + "You still need to run validate_escrow_deposit to check reference consistency.");
+    } else {
+      System.out.println("The two deposits differ.");
+    }
+  }
+}
@@ -11,6 +11,12 @@
        "^PRODUCTION|SANDBOX|CRASH|QA|ALPHA$"
      ]
    },
+    {
+      "name": "jpaTransactionManagerType",
+      "label": "The type of JPA transaction manager to use",
+      "helpText": "The standard SQL instance or a read-only replica may be used",
+      "regexes": ["^REGULAR|READ_ONLY_REPLICA$"]
+    },
    {
      "name": "pendings",
      "label": "The pendings deposits to generate.",
@@ -103,7 +103,7 @@ public class AsyncTaskEnqueuerTest {
            .method("POST")
            .header("Host", "backend.hostname.fake")
            .header("content-type", "application/x-www-form-urlencoded")
-            .param(PARAM_RESOURCE_KEY, contact.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, contact.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, clock.nowUtc().toString())
            .etaDelta(
                standardDays(5).minus(standardSeconds(30)),
@@ -125,7 +125,7 @@ public class AsyncTaskEnqueuerTest {
            .method("POST")
            .header("Host", "backend.hostname.fake")
            .header("content-type", "application/x-www-form-urlencoded")
-            .param(PARAM_RESOURCE_KEY, contact.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, contact.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, now.toString())
            .param(PARAM_RESAVE_TIMES, "2015-05-20T14:34:56.000Z,2015-05-21T15:34:56.000Z")
            .etaDelta(
@@ -18,6 +18,7 @@ import static com.google.appengine.api.taskqueue.QueueFactory.getQueue;
 import static com.google.common.collect.MoreCollectors.onlyElement;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_DELETE;
 import static google.registry.batch.AsyncTaskMetrics.OperationResult.STALE;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
@@ -496,7 +497,7 @@ public class DeleteContactsAndHostsActionTest
        QUEUE_ASYNC_DELETE,
        new TaskMatcher()
            .etaDelta(standardHours(23), standardHours(25))
-            .param("resourceKey", contactNotSaved.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, contactNotSaved.createVKey().stringify())
            .param("requestingClientId", "TheRegistrar")
            .param("clientTransactionId", "fakeClientTrid")
            .param("serverTransactionId", "fakeServerTrid")
@@ -504,7 +505,7 @@ public class DeleteContactsAndHostsActionTest
            .param("requestedTime", timeBeforeRun.toString()),
        new TaskMatcher()
            .etaDelta(standardHours(23), standardHours(25))
-            .param("resourceKey", hostNotSaved.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, hostNotSaved.createVKey().stringify())
            .param("requestingClientId", "TheRegistrar")
            .param("clientTransactionId", "fakeClientTrid")
            .param("serverTransactionId", "fakeServerTrid")
@@ -145,7 +145,7 @@ public class RefreshDnsOnHostRenameActionTest
    assertTasksEnqueued(
        QUEUE_ASYNC_HOST_RENAME,
        new TaskMatcher()
-            .param(PARAM_HOST_KEY, host.createVKey().getOfyKey().getString())
+            .param(PARAM_HOST_KEY, host.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, timeEnqueued.toString()));
    verify(action.asyncTaskMetrics).recordDnsRefreshBatchSize(1L);
    verifyNoMoreInteractions(action.asyncTaskMetrics);
@@ -237,7 +237,7 @@ public class RefreshDnsOnHostRenameActionTest
        QUEUE_ASYNC_HOST_RENAME,
        new TaskMatcher()
            .etaDelta(standardHours(23), standardHours(25))
-            .param("hostKey", host.createVKey().getOfyKey().getString()));
+            .param(PARAM_HOST_KEY, host.createVKey().stringify()));
    assertThat(acquireLock()).isPresent();
  }

@@ -150,7 +150,7 @@ public class ResaveEntityActionTest {
            .method("POST")
            .header("Host", "backend.hostname.fake")
            .header("content-type", "application/x-www-form-urlencoded")
-            .param(PARAM_RESOURCE_KEY, resavedDomain.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, resavedDomain.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, requestedTime.toString())
            .etaDelta(
                standardDays(5).minus(standardSeconds(30)),
@@ -28,6 +28,7 @@ import google.registry.testing.FakeClock;
 import google.registry.testing.InjectExtension;
 import java.io.Serializable;
 import java.nio.file.Path;
+import java.util.Optional;
 import org.apache.beam.sdk.coders.SerializableCoder;
 import org.apache.beam.sdk.testing.PAssert;
 import org.apache.beam.sdk.values.PCollectionTuple;
@@ -83,7 +84,8 @@ class DatastoreSnapshotsTest {
            setupHelper.commitLogDir.getAbsolutePath(),
            START_TIME,
            fakeClock.nowUtc().plusMillis(1),
-            ImmutableSet.copyOf(DatastoreSetupHelper.ALL_KINDS));
+            ImmutableSet.copyOf(DatastoreSetupHelper.ALL_KINDS),
+            Optional.empty());
    PAssert.that(tuple.get(ValidateSqlUtils.createSqlEntityTupleTag(Registrar.class)))
        .containsInAnyOrder(setupHelper.registrar1, setupHelper.registrar2);
    PAssert.that(tuple.get(ValidateSqlUtils.createSqlEntityTupleTag(DomainHistory.class)))
@@ -88,6 +88,7 @@ class SqlSnapshotsTest {
                DomainHistory.class,
                ContactResource.class,
                HostResource.class),
+            Optional.empty(),
            Optional.empty());
    PAssert.that(sqlSnapshot.get(createSqlEntityTupleTag(Registry.class)))
        .containsInAnyOrder(setupHelper.registry);
@@ -98,11 +98,7 @@ class TldFanoutActionTest {
  }

  private void assertTaskWithoutTld() {
-    cloudTasksHelper.assertTasksEnqueued(
-        QUEUE,
-        new TaskMatcher()
-            .url(ENDPOINT)
-            .header("content-type", "application/x-www-form-urlencoded"));
+    cloudTasksHelper.assertTasksEnqueued(QUEUE, new TaskMatcher().url(ENDPOINT));
  }

  @Test
@@ -16,6 +16,7 @@ package google.registry.flows;

 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
 import static google.registry.model.ofy.ObjectifyService.auditedOfy;
@@ -146,7 +147,7 @@ public abstract class ResourceFlowTestCase<F extends Flow, R extends EppResource
    TaskMatcher expected =
        new TaskMatcher()
            .etaDelta(Duration.standardSeconds(75), Duration.standardSeconds(105)) // expected: 90
-            .param("resourceKey", resource.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, resource.createVKey().stringify())
            .param("requestingClientId", requestingClientId)
            .param("serverTransactionId", trid.getServerTransactionId())
            .param("isSuperuser", Boolean.toString(isSuperuser))
@@ -321,7 +321,7 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
            .method("POST")
            .header("Host", "backend.hostname.fake")
            .header("content-type", "application/x-www-form-urlencoded")
-            .param(PARAM_RESOURCE_KEY, domain.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, domain.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, clock.nowUtc().toString())
            .param(PARAM_RESAVE_TIMES, clock.nowUtc().plusDays(5).toString())
            .etaDelta(when.minus(standardSeconds(30)), when.plus(standardSeconds(30))));
@@ -521,7 +521,7 @@ class DomainTransferRequestFlowTest
            .method("POST")
            .header("Host", "backend.hostname.fake")
            .header("content-type", "application/x-www-form-urlencoded")
-            .param(PARAM_RESOURCE_KEY, domain.createVKey().getOfyKey().getString())
+            .param(PARAM_RESOURCE_KEY, domain.createVKey().stringify())
            .param(PARAM_REQUESTED_TIME, clock.nowUtc().toString())
            .etaDelta(
                registry.getAutomaticTransferLength().minus(standardSeconds(30)),
@@ -16,6 +16,7 @@ package google.registry.flows.host;

 import static com.google.common.base.Strings.nullToEmpty;
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.batch.AsyncTaskEnqueuer.PARAM_HOST_KEY;
 import static google.registry.batch.AsyncTaskEnqueuer.QUEUE_ASYNC_HOST_RENAME;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -230,7 +231,7 @@ class HostUpdateFlowTest extends ResourceFlowTestCase<HostUpdateFlow, HostResour
    assertTasksEnqueued(
        QUEUE_ASYNC_HOST_RENAME,
        new TaskMatcher()
-            .param("hostKey", renamedHost.createVKey().getOfyKey().getString())
+            .param(PARAM_HOST_KEY, renamedHost.createVKey().stringify())
            .param("requestedTime", clock.nowUtc().toString()));
  }

@@ -14,6 +14,7 @@

 package google.registry.model.tld.label;

+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
@@ -24,14 +25,18 @@ import static org.joda.money.CurrencyUnit.USD;
 import static org.joda.time.Duration.standardDays;
 import static org.junit.jupiter.api.Assertions.assertThrows;

+import com.google.common.base.Stopwatch;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.flogger.FluentLogger;
 import google.registry.persistence.transaction.TransactionManagerUtil;
 import google.registry.testing.AppEngineExtension;
 import google.registry.testing.FakeClock;
 import google.registry.testing.TestCacheExtension;
 import java.math.BigDecimal;
 import java.util.Optional;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.IntStream;
 import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
 import org.junit.jupiter.api.BeforeEach;
@@ -41,6 +46,8 @@ import org.junit.jupiter.api.extension.RegisterExtension;
 /** Unit tests for {@link PremiumListDao}. */
 public class PremiumListDaoTest {

+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
  private final FakeClock fakeClock = new FakeClock();

  @RegisterExtension
@@ -260,6 +267,27 @@ public class PremiumListDaoTest {
    assertThat(PremiumListDao.premiumListCache.getIfPresent("testname")).isNull();
  }

+  @Test
+  void testSave_largeSize_savedQuickly() {
+    Stopwatch stopwatch = Stopwatch.createStarted();
+    ImmutableMap<String, BigDecimal> prices =
+        IntStream.range(0, 20000).boxed().collect(toImmutableMap(String::valueOf, BigDecimal::new));
+    PremiumList list =
+        new PremiumList.Builder()
+            .setName("testname")
+            .setCurrency(USD)
+            .setLabelsToPrices(prices)
+            .setCreationTimestamp(fakeClock.nowUtc())
+            .build();
+    PremiumListDao.save(list);
+    long duration = stopwatch.stop().elapsed(TimeUnit.MILLISECONDS);
+    if (duration >= 6000) {
+      // Don't fail directly since we can't rely on what sort of machines the test is running on
+      logger.atSevere().log(
+          "Expected premium list update to take 2-3 seconds but it took %d ms", duration);
+    }
+  }
+
  private static Money moneyOf(CurrencyUnit unit, double amount) {
    return Money.of(unit, BigDecimal.valueOf(amount).setScale(unit.getDecimalPlaces()));
  }
@@ -29,6 +29,7 @@ import com.googlecode.objectify.annotation.Entity;
 import google.registry.model.billing.BillingEvent.OneTime;
 import google.registry.model.common.ClassPathManager;
 import google.registry.model.domain.DomainBase;
+import google.registry.model.host.HostResource;
 import google.registry.model.registrar.RegistrarContact;
 import google.registry.testing.AppEngineExtension;
 import google.registry.testing.TaskQueueHelper.TaskMatcher;
@@ -207,6 +208,29 @@ class VKeyTest {
        .isEqualTo(VKey.createSql(TestObject.class, "foo"));
  }

+  @Test
+  void testCreate_stringifiedVKey_resourceKeyFromTaskQueue() throws Exception {
+    VKey<HostResource> vkeyFromNewWebsafeKey =
+        VKey.create(
+            "kind:HostResource@sql:rO0ABXQADzZCQjJGNDc2LUdPT0dMRQ@ofy:ahdzfm"
+                + "RvbWFpbi1yZWdpc3RyeS1hbHBoYXIhCxIMSG9zdFJlc291cmNlIg82QkIyRjQ3Ni1HT09HTEUM");
+
+    assertThat(vkeyFromNewWebsafeKey.getSqlKey()).isEqualTo("6BB2F476-GOOGLE");
+    assertThat(vkeyFromNewWebsafeKey.getOfyKey().getString())
+        .isEqualTo(
+            "ahdzfmRvbWFpb"
+                + "i1yZWdpc3RyeS1hbHBoYXIhCxIMSG9zdFJlc291cmNlIg82QkIyRjQ3Ni1HT09HTEUM");
+
+    // the ofy portion of the new vkey string representation was the old vkey string representation
+    VKey<HostResource> vkeyFromOldWebsafeString =
+        VKey.fromWebsafeKey(
+            "ahdzfmRvbW"
+                + "Fpbi1yZWdpc3RyeS1hbHBoYXIhCxIMSG9zdFJlc291cmNlIg82QkIyRjQ3Ni1HT09HTEUM");
+
+    // the following is assertion is ensure backwork compatibility
+    assertThat(vkeyFromNewWebsafeKey).isEqualTo(vkeyFromOldWebsafeString);
+  }
+
  @Test
  void testCreate_stringifedVKey_ofyOnlyVKeyString() {
    assertThat(VKey.create("kind:TestObject@ofy:agR0ZXN0chMLEgpUZXN0T2JqZWN0IgNmb28M"))
@@ -227,22 +227,20 @@ public class CloudTasksHelper implements Serializable {
              });
      headers = headerBuilder.build();
      ImmutableMultimap.Builder<String, String> paramBuilder = new ImmutableMultimap.Builder<>();
-      String query = null;
+      // Note that UriParameters.parse() does not throw an IAE on a bad query string (e.g. one
+      // where parameters are not properly URL-encoded); it always does a best-effort parse.
      if (method == HttpMethod.GET) {
-        query = uri.getQuery();
-      } else if (method == HttpMethod.POST) {
+        paramBuilder.putAll(UriParameters.parse(uri.getQuery()));
+      } else if (method == HttpMethod.POST && !task.getAppEngineHttpRequest().getBody().isEmpty()) {
        assertThat(
                headers.containsEntry(
                    Ascii.toLowerCase(HttpHeaders.CONTENT_TYPE), MediaType.FORM_DATA.toString()))
            .isTrue();
-        query = task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8);
-      }
-      if (query != null) {
-        // Note that UriParameters.parse() does not throw an IAE on a bad query string (e.g. one
-        // where parameters are not properly URL-encoded); it always does a best-effort parse.
-        paramBuilder.putAll(UriParameters.parse(query));
-        params = paramBuilder.build();
+        paramBuilder.putAll(
+            UriParameters.parse(
+                task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)));
      }
+      params = paramBuilder.build();
    }

    public Map<String, Object> toMap() {
@@ -60,7 +60,6 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
-import com.google.common.collect.Streams;
 import com.google.common.net.InetAddresses;
 import com.googlecode.objectify.Key;
 import google.registry.dns.writer.VoidDnsWriter;
@@ -1264,7 +1263,7 @@ public class DatabaseHelper {

  /** Returns the entire map of {@link PremiumEntry}s for the given {@link PremiumList}. */
  public static ImmutableMap<String, PremiumEntry> loadPremiumEntries(PremiumList premiumList) {
-    return Streams.stream(PremiumListDao.loadAllPremiumEntries(premiumList.getName()))
+    return PremiumListDao.loadAllPremiumEntries(premiumList.getName()).stream()
        .collect(toImmutableMap(PremiumEntry::getDomainLabel, Function.identity()));
  }

@@ -134,7 +134,7 @@ public abstract class CommandTestCase<C extends Command> {
  }

  /** Writes the data to a named temporary file and then returns a path to the file. */
-  private String writeToNamedTmpFile(String filename, byte[] data) throws IOException {
+  protected String writeToNamedTmpFile(String filename, byte[] data) throws IOException {
    Path tmpFile = tmpDir.resolve(filename);
    Files.write(data, tmpFile.toFile());
    return tmpFile.toString();
@@ -151,7 +151,7 @@ public abstract class CommandTestCase<C extends Command> {
  }

  /** Writes the data to a temporary file and then returns a path to the file. */
-  String writeToTmpFile(byte[] data) throws IOException {
+  public String writeToTmpFile(byte[] data) throws IOException {
    return writeToNamedTmpFile("tmp_file", data);
  }

@@ -220,7 +220,7 @@ public abstract class CommandTestCase<C extends Command> {
    assertThat(getStderrAsString()).doesNotContain(expected);
  }

-  String getStdoutAsString() {
+  protected String getStdoutAsString() {
    return new String(stdout.toByteArray(), UTF_8);
  }

@@ -14,18 +14,16 @@

 package google.registry.tools;

-import static com.google.appengine.api.taskqueue.QueueFactory.getQueue;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.testing.DatabaseHelper.createTld;
-import static google.registry.testing.TaskQueueHelper.assertTasksEnqueued;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.when;

 import com.beust.jcommander.ParameterException;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.InjectExtension;
-import google.registry.testing.TaskQueueHelper.TaskMatcher;
 import google.registry.util.AppEngineServiceUtils;
-import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -42,14 +40,15 @@ public class GenerateEscrowDepositCommandTest

  @Mock AppEngineServiceUtils appEngineServiceUtils;

+  CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+
  @BeforeEach
  void beforeEach() {
    createTld("tld");
    createTld("anothertld");
    command = new GenerateEscrowDepositCommand();
    command.appEngineServiceUtils = appEngineServiceUtils;
-    command.queue = getQueue("rde-report");
-    command.maybeEtaMillis = Optional.of(fakeClock.nowUtc().getMillis());
+    command.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
    when(appEngineServiceUtils.getCurrentVersionHostname("backend"))
        .thenReturn("backend.test.localhost");
  }
@@ -197,11 +196,10 @@ public class GenerateEscrowDepositCommandTest
        "-r 42",
        "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("mode", "THIN")
            .param("lenient", "true")
            .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -221,11 +219,10 @@ public class GenerateEscrowDepositCommandTest
        "-r 42",
        "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("mode", "THIN")
            .param("beam", "true")
            .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -239,11 +236,10 @@ public class GenerateEscrowDepositCommandTest
  void testCommand_successWithDefaultValidationMode() throws Exception {
    runCommand("--tld=tld", "--watermark=2017-01-01T00:00:00Z", "--mode=thin", "-r 42", "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("mode", "THIN")
            .param("lenient", "false")
            .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -257,11 +253,10 @@ public class GenerateEscrowDepositCommandTest
  void testCommand_successWithDefaultRevision() throws Exception {
    runCommand("--tld=tld", "--watermark=2017-01-01T00:00:00Z", "--mode=thin", "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("lenient", "false")
            .param("beam", "false")
            .param("mode", "THIN")
@@ -275,11 +270,10 @@ public class GenerateEscrowDepositCommandTest
  void testCommand_successWithDefaultMode() throws Exception {
    runCommand("--tld=tld", "--watermark=2017-01-01T00:00:00Z", "-r=42", "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("mode", "FULL")
            .param("lenient", "false")
            .param("beam", "false")
@@ -299,11 +293,10 @@ public class GenerateEscrowDepositCommandTest
        "-r 42",
        "-o test");

-    assertTasksEnqueued(
+    cloudTasksHelper.assertTasksEnqueued(
        "rde-report",
        new TaskMatcher()
            .url("/_dr/task/rdeStaging")
-            .header("Host", "backend.test.localhost")
            .param("mode", "THIN")
            .param("lenient", "false")
            .param("beam", "false")
@@ -42,7 +42,11 @@ class GetContactCommandTest extends CommandTestCase<GetContactCommand> {
    persistActiveContact("sh8013");
    runCommand("sh8013");
    assertInStdout("contactId=sh8013");
-    assertInStdout("Websafe key: agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:ContactResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
  }

  @Test
@@ -50,7 +54,11 @@ class GetContactCommandTest extends CommandTestCase<GetContactCommand> {
    persistActiveContact("sh8013");
    runCommand("sh8013", "--expand");
    assertInStdout("contactId=sh8013");
-    assertInStdout("Websafe key: agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:ContactResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
    assertNotInStdout("LiveRef");
  }

@@ -61,8 +69,16 @@ class GetContactCommandTest extends CommandTestCase<GetContactCommand> {
    runCommand("sh8013", "jd1234");
    assertInStdout("contactId=sh8013");
    assertInStdout("contactId=jd1234");
-    assertInStdout("Websafe key: agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
-    assertInStdout("Websafe key: agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjMtUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:ContactResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:ContactResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chsLEg9Db250YWN0UmVzb3VyY2UiBjItUk9JRAw");
  }

  @Test
@@ -43,7 +43,11 @@ class GetDomainCommandTest extends CommandTestCase<GetDomainCommand> {
    runCommand("example.tld");
    assertInStdout("fullyQualifiedDomainName=example.tld");
    assertInStdout("contact=Key<?>(ContactResource(\"3-ROID\"))");
-    assertInStdout("Websafe key: agR0ZXN0chULEgpEb21haW5CYXNlIgUyLVRMRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:DomainBase"
+            + "@sql:rO0ABXQABTItVExE"
+            + "@ofy:agR0ZXN0chULEgpEb21haW5CYXNlIgUyLVRMRAw");
  }

  @Test
@@ -52,7 +56,11 @@ class GetDomainCommandTest extends CommandTestCase<GetDomainCommand> {
    runCommand("example.tld", "--expand");
    assertInStdout("fullyQualifiedDomainName=example.tld");
    assertInStdout("contactId=contact1234");
-    assertInStdout("Websafe key: agR0ZXN0chULEgpEb21haW5CYXNlIgUyLVRMRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:DomainBase"
+            + "@sql:rO0ABXQABTItVExE"
+            + "@ofy:agR0ZXN0chULEgpEb21haW5CYXNlIgUyLVRMRAw");
    assertNotInStdout("LiveRef");
  }

@@ -63,8 +71,16 @@ class GetDomainCommandTest extends CommandTestCase<GetDomainCommand> {
    runCommand("example.tld", "example2.tld");
    assertInStdout("fullyQualifiedDomainName=example.tld");
    assertInStdout("fullyQualifiedDomainName=example2.tld");
-    assertInStdout("Websafe key: agR0ZXN0chULEgpEb21haW5CYXNlIgUyLVRMRAw");
-    assertInStdout("Websafe key: agR0ZXN0chULEgpEb21haW5CYXNlIgU0LVRMRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:DomainBase"
+            + "@sql:rO0ABXQABTQtVExE"
+            + "@ofy:agR0ZXN0chULEgpEb21haW5CYXNlIgU0LVRMRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:DomainBase"
+            + "@sql:rO0ABXQABTQtVExE"
+            + "@ofy:agR0ZXN0chULEgpEb21haW5CYXNlIgU0LVRMRAw");
  }

  @Test
@@ -42,7 +42,11 @@ class GetHostCommandTest extends CommandTestCase<GetHostCommand> {
    persistActiveHost("ns1.example.tld");
    runCommand("ns1.example.tld");
    assertInStdout("fullyQualifiedHostName=ns1.example.tld");
-    assertInStdout("Websafe key: agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:HostResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
  }

  @Test
@@ -50,7 +54,11 @@ class GetHostCommandTest extends CommandTestCase<GetHostCommand> {
    persistActiveHost("ns1.example.tld");
    runCommand("ns1.example.tld", "--expand");
    assertInStdout("fullyQualifiedHostName=ns1.example.tld");
-    assertInStdout("Websafe key: agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:HostResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
    assertNotInStdout("LiveRef");
  }

@@ -61,8 +69,16 @@ class GetHostCommandTest extends CommandTestCase<GetHostCommand> {
    runCommand("ns1.example.tld", "ns2.example.tld");
    assertInStdout("fullyQualifiedHostName=ns1.example.tld");
    assertInStdout("fullyQualifiedHostName=ns2.example.tld");
-    assertInStdout("Websafe key: agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
-    assertInStdout("Websafe key: agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjMtUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:HostResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
+    assertInStdout(
+        "Websafe key: "
+            + "kind:HostResource"
+            + "@sql:rO0ABXQABjItUk9JRA"
+            + "@ofy:agR0ZXN0chgLEgxIb3N0UmVzb3VyY2UiBjItUk9JRAw");
  }

  @Test
@@ -52,6 +52,26 @@ class ResaveEntitiesCommandTest extends CommandTestCase<ResaveEntitiesCommand> {
        .containsExactlyElementsIn(auditedOfy().load().entities(contact1, contact2).values());
  }

+  @Test
+  void testSuccess_createsCommitLogs_withNewWebsafeKey() throws Exception {
+    ContactResource contact1 = persistActiveContact("contact1");
+    ContactResource contact2 = persistActiveContact("contact2");
+    deleteEntitiesOfTypes(CommitLogManifest.class, CommitLogMutation.class);
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).isEmpty();
+    assertThat(auditedOfy().load().type(CommitLogMutation.class).keys()).isEmpty();
+    runCommandForced(contact1.createVKey().stringify(), contact2.createVKey().stringify());
+
+    assertThat(auditedOfy().load().type(CommitLogManifest.class).keys()).hasSize(1);
+    Iterable<ImmutableObject> savedEntities =
+        transform(
+            auditedOfy().load().type(CommitLogMutation.class).list(),
+            mutation -> auditedOfy().load().fromEntity(mutation.getEntity()));
+    // Reload the contacts before asserting, since their update times will have changed.
+    auditedOfy().clearSessionCache();
+    assertThat(savedEntities)
+        .containsExactlyElementsIn(auditedOfy().load().entities(contact1, contact2).values());
+  }
+
  @SafeVarargs
  private static void deleteEntitiesOfTypes(Class<? extends ImmutableObject>... types) {
    for (Class<? extends ImmutableObject> type : types) {
@@ -14,17 +14,20 @@

 package google.registry.tools;

+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.ImmutableObjectSubject.immutableObjectCorrespondence;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableSet;
 import com.google.common.io.Files;
 import google.registry.model.tld.Registry;
 import google.registry.model.tld.label.PremiumList;
+import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.model.tld.label.PremiumListDao;
 import java.io.File;
+import java.math.BigDecimal;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Optional;
@@ -46,12 +49,10 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
    Optional<PremiumList> list = PremiumListDao.getLatestRevision(TLD_TEST);
    // ensure that no premium list is created before running the command
    assertThat(list.isPresent()).isTrue();
-    // ensure that there's value in existing premium list;
-    UpdatePremiumListCommand command = new UpdatePremiumListCommand();
-    ImmutableSet<String> entries = command.getExistingPremiumEntry(list.get());
-    assertThat(entries.size()).isEqualTo(1);
    // data from @beforeEach of CreateOrUpdatePremiumListCommandTestCase.java
-    assertThat(entries.contains("doge,USD 9090.00")).isTrue();
+    assertThat(PremiumListDao.loadPremiumEntries(list.get()))
+        .comparingElementsUsing(immutableObjectCorrespondence("revisionId"))
+        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9090.00"), "doge"));
  }

  @Test
@@ -77,11 +78,9 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
    command.inputFile = Paths.get(tmpFile.getPath());
    runCommandForced("--name=" + TLD_TEST, "--input=" + command.inputFile);

-    ImmutableSet<String> entries =
-        command.getExistingPremiumEntry(PremiumListDao.getLatestRevision(TLD_TEST).get());
-    assertThat(entries.size()).isEqualTo(1);
-    // verify that list is updated; cannot use only string since price is formatted;
-    assertThat(entries.contains("eth,USD 9999.00")).isTrue();
+    assertThat(PremiumListDao.loadAllPremiumEntries(TLD_TEST))
+        .comparingElementsUsing(immutableObjectCorrespondence("revisionId"))
+        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9999.00"), "eth"));
  }

  @Test
@@ -98,11 +97,9 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
    command.inputFile = Paths.get(newPremiumFile.getPath());
    runCommandForced("--name=" + TLD_TEST, "--input=" + command.inputFile);

-    ImmutableSet<String> entries =
-        command.getExistingPremiumEntry(PremiumListDao.getLatestRevision(TLD_TEST).get());
-    assertThat(entries.size()).isEqualTo(1);
-    // verify that list is updated; cannot use only string since price is formatted;
-    assertThat(entries.contains("eth,USD 9999.00")).isTrue();
+    assertThat(PremiumListDao.loadAllPremiumEntries(TLD_TEST))
+        .comparingElementsUsing(immutableObjectCorrespondence("revisionId"))
+        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9999.00"), "eth"));
  }

  @Test
@@ -116,12 +113,11 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
    runCommandForced("--name=" + TLD_TEST, "--input=" + command.inputFile);

    // assert all three lines from premiumTerms are added
-    ImmutableSet<String> entries =
-        command.getExistingPremiumEntry(PremiumListDao.getLatestRevision(TLD_TEST).get());
-    assertThat(entries.size()).isEqualTo(3);
-    assertThat(entries.contains("foo,USD 9000.00")).isTrue();
-    assertThat(entries.contains("doge,USD 100.00")).isTrue();
-    assertThat(entries.contains("elon,USD 2021.00")).isTrue();
+    assertThat(
+            PremiumListDao.loadAllPremiumEntries(TLD_TEST).stream()
+                .map(Object::toString)
+                .collect(toImmutableList()))
+        .containsExactly("foo, 9000.00", "doge, 100.00", "elon, 2021.00");
  }

  @Test
@@ -0,0 +1,63 @@
+// Copyright 2021 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools.javascrap;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import google.registry.rde.RdeTestData;
+import google.registry.tools.CommandTestCase;
+import java.nio.charset.StandardCharsets;
+import org.junit.jupiter.api.Test;
+
+/** Unit tests for {@link CompareEscrowDepositsCommand}. */
+class CompareEscrowDepositsCommandTest extends CommandTestCase<CompareEscrowDepositsCommand> {
+
+  @Test
+  void testFailure_wrongNumberOfFiles() throws Exception {
+    String file1 = writeToNamedTmpFile("file1", "foo".getBytes(StandardCharsets.UTF_8));
+    String file2 = writeToNamedTmpFile("file2", "bar".getBytes(StandardCharsets.UTF_8));
+    String file3 = writeToNamedTmpFile("file3", "baz".getBytes(StandardCharsets.UTF_8));
+    assertThrows(IllegalArgumentException.class, () -> runCommand(file1));
+    assertThrows(IllegalArgumentException.class, () -> runCommand(file1, file2, file3));
+  }
+
+  @Test
+  void testSuccess_sameContentDifferentOrder() throws Exception {
+    String file1 = writeToNamedTmpFile("file1", RdeTestData.loadBytes("deposit_full.xml").read());
+    String file2 =
+        writeToNamedTmpFile("file2", RdeTestData.loadBytes("deposit_full_out_of_order.xml").read());
+    runCommand(file1, file2);
+    assertThat(getStdoutAsString())
+        .contains("The two deposits contain the same domains and registrars.");
+  }
+
+  @Test
+  void testSuccess_differentContent() throws Exception {
+    String file1 = writeToNamedTmpFile("file1", RdeTestData.loadBytes("deposit_full.xml").read());
+    String file2 =
+        writeToNamedTmpFile("file2", RdeTestData.loadBytes("deposit_full_different.xml").read());
+    runCommand(file1, file2);
+    assertThat(getStdoutAsString())
+        .isEqualTo(
+            "domains only in deposit1:\n"
+                + "example2.test\n"
+                + "domains only in deposit2:\n"
+                + "example3.test\n"
+                + "registrars only in deposit2:\n"
+                + "RegistrarY\n"
+                + "The two deposits differ.\n");
+  }
+}
@@ -0,0 +1,295 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<rde:deposit type="FULL" id="20101017001" prevId="20101010001"
+  xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
+  xmlns:contact="urn:ietf:params:xml:ns:contact-1.0"
+  xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1"
+  xmlns:rde="urn:ietf:params:xml:ns:rde-1.0"
+  xmlns:rdeHeader="urn:ietf:params:xml:ns:rdeHeader-1.0"
+  xmlns:rdeDom="urn:ietf:params:xml:ns:rdeDomain-1.0"
+  xmlns:rdeHost="urn:ietf:params:xml:ns:rdeHost-1.0"
+  xmlns:rdeContact="urn:ietf:params:xml:ns:rdeContact-1.0"
+  xmlns:rdeRegistrar="urn:ietf:params:xml:ns:rdeRegistrar-1.0"
+  xmlns:rdeIDN="urn:ietf:params:xml:ns:rdeIDN-1.0"
+  xmlns:rdeNNDN="urn:ietf:params:xml:ns:rdeNNDN-1.0"
+  xmlns:rdeEppParams="urn:ietf:params:xml:ns:rdeEppParams-1.0"
+  xmlns:rdePolicy="urn:ietf:params:xml:ns:rdePolicy-1.0"
+  xmlns:epp="urn:ietf:params:xml:ns:epp-1.0">
+
+  <rde:watermark>2010-10-17T00:00:00Z</rde:watermark>
+  <rde:rdeMenu>
+    <rde:version>1.0</rde:version>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeHeader-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeContact-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeHost-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeRegistrar-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeIDN-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeNNDN-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeEppParams-1.0</rde:objURI>
+  </rde:rdeMenu>
+
+  <!-- Contents -->
+  <rde:contents>
+    <!-- Header -->
+    <rdeHeader:header>
+      <rdeHeader:tld>test</rdeHeader:tld>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeDomain-1.0">2
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeHost-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeContact-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1
+    </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeIDN-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeNNDN-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeEppParams-1.0">1
+    </rdeHeader:count>
+    </rdeHeader:header>
+
+    <!-- Domain: example1.test -->
+    <rdeDom:domain>
+      <rdeDom:name>example1.test</rdeDom:name>
+      <rdeDom:roid>Dexample1-TEST</rdeDom:roid>
+      <rdeDom:status s="ok"/>
+      <rdeDom:registrant>jd1234</rdeDom:registrant>
+      <rdeDom:contact type="admin">sh8013</rdeDom:contact>
+      <rdeDom:contact type="tech">sh8013</rdeDom:contact>
+      <rdeDom:ns>
+        <domain:hostObj>ns1.example.com</domain:hostObj>
+        <domain:hostObj>ns1.example1.test</domain:hostObj>
+      </rdeDom:ns>
+      <rdeDom:clID>RegistrarX</rdeDom:clID>
+      <rdeDom:crRr client="jdoe">RegistrarX</rdeDom:crRr>
+      <rdeDom:crDate>1999-04-03T22:00:00.0Z</rdeDom:crDate>
+      <rdeDom:exDate>2015-04-03T22:00:00.0Z</rdeDom:exDate>
+    </rdeDom:domain>
+
+    <!-- Domain: example3.test -->
+    <rdeDom:domain>
+      <rdeDom:name>example3.test</rdeDom:name>
+      <rdeDom:roid>Dexample3-TEST</rdeDom:roid>
+      <rdeDom:status s="ok"/>
+      <rdeDom:status s="clientUpdateProhibited"/>
+      <rdeDom:registrant>jd1234</rdeDom:registrant>
+      <rdeDom:contact type="admin">sh8013</rdeDom:contact>
+      <rdeDom:contact type="tech">sh8013</rdeDom:contact>
+      <rdeDom:clID>RegistrarY</rdeDom:clID>
+      <rdeDom:crRr>RegistrarY</rdeDom:crRr>
+      <rdeDom:crDate>1999-04-03T22:00:00.0Z</rdeDom:crDate>
+      <rdeDom:exDate>2015-04-03T22:00:00.0Z</rdeDom:exDate>
+    </rdeDom:domain>
+
+    <!-- Host: ns1.example.com -->
+    <rdeHost:host>
+      <rdeHost:name>ns1.example.com</rdeHost:name>
+      <rdeHost:roid>Hns1_example_com-TEST</rdeHost:roid>
+      <rdeHost:status s="ok"/>
+      <rdeHost:status s="linked"/>
+      <rdeHost:addr ip="v4">192.0.2.2</rdeHost:addr>
+      <rdeHost:addr ip="v4">192.0.2.29</rdeHost:addr>
+      <rdeHost:addr ip="v6">1080:0:0:0:8:800:200C:417A
+      </rdeHost:addr>
+      <rdeHost:clID>RegistrarX</rdeHost:clID>
+      <rdeHost:crRr>RegistrarX</rdeHost:crRr>
+      <rdeHost:crDate>1999-05-08T12:10:00.0Z</rdeHost:crDate>
+      <rdeHost:upRr>RegistrarX</rdeHost:upRr>
+      <rdeHost:upDate>2009-10-03T09:34:00.0Z</rdeHost:upDate>
+    </rdeHost:host>
+
+    <!-- Host: ns1.example1.test -->
+    <rdeHost:host>
+      <rdeHost:name>ns1.example1.test</rdeHost:name>
+      <rdeHost:roid>Hns1_example1_test-TEST</rdeHost:roid>
+      <rdeHost:status s="ok"/>
+      <rdeHost:status s="linked"/>
+      <rdeHost:addr ip="v4">192.0.2.2</rdeHost:addr>
+      <rdeHost:addr ip="v4">192.0.2.29</rdeHost:addr>
+      <rdeHost:addr ip="v6">1080:0:0:0:8:800:200C:417A
+      </rdeHost:addr>
+      <rdeHost:clID>RegistrarX</rdeHost:clID>
+      <rdeHost:crRr>RegistrarX</rdeHost:crRr>
+      <rdeHost:crDate>1999-05-08T12:10:00.0Z</rdeHost:crDate>
+      <rdeHost:upRr>RegistrarX</rdeHost:upRr>
+      <rdeHost:upDate>2009-10-03T09:34:00.0Z</rdeHost:upDate>
+    </rdeHost:host>
+
+    <!-- Contact: sh8013 -->
+    <rdeContact:contact>
+      <rdeContact:id>sh8013</rdeContact:id>
+      <rdeContact:roid>Csh8013-TEST</rdeContact:roid>
+      <rdeContact:status s="linked"/>
+      <rdeContact:status s="clientDeleteProhibited"/>
+      <rdeContact:postalInfo type="int">
+        <contact:name>John Doe</contact:name>
+        <contact:org>Example Inc.</contact:org>
+        <contact:addr>
+          <contact:street>123 Example Dr.</contact:street>
+          <contact:street>Suite 100</contact:street>
+          <contact:city>Dulles</contact:city>
+          <contact:sp>VA</contact:sp>
+          <contact:pc>20166-6503</contact:pc>
+          <contact:cc>US</contact:cc>
+        </contact:addr>
+      </rdeContact:postalInfo>
+      <rdeContact:voice x="1234">+1.7035555555
+      </rdeContact:voice>
+      <rdeContact:fax>+1.7035555556
+      </rdeContact:fax>
+      <rdeContact:email>jdoe@example.test
+      </rdeContact:email>
+      <rdeContact:clID>RegistrarX</rdeContact:clID>
+      <rdeContact:crRr client="jdoe">RegistrarX
+      </rdeContact:crRr>
+      <rdeContact:crDate>2009-09-13T08:01:00.0Z</rdeContact:crDate>
+      <rdeContact:upRr client="jdoe">RegistrarX
+      </rdeContact:upRr>
+      <rdeContact:upDate>2009-11-26T09:10:00.0Z</rdeContact:upDate>
+      <rdeContact:trDate>2009-12-03T09:05:00.0Z</rdeContact:trDate>
+      <rdeContact:disclose flag="0">
+        <contact:voice/>
+        <contact:email/>
+      </rdeContact:disclose>
+    </rdeContact:contact>
+
+    <!-- Registrar: RegistrarX -->
+    <rdeRegistrar:registrar>
+      <rdeRegistrar:id>RegistrarX</rdeRegistrar:id>
+      <rdeRegistrar:name>Registrar X</rdeRegistrar:name>
+      <rdeRegistrar:gurid>123</rdeRegistrar:gurid>
+      <rdeRegistrar:status>ok</rdeRegistrar:status>
+      <rdeRegistrar:postalInfo type="int">
+        <rdeRegistrar:addr>
+          <rdeRegistrar:street>123 Example Dr.
+          </rdeRegistrar:street>
+          <rdeRegistrar:street>Suite 100
+          </rdeRegistrar:street>
+          <rdeRegistrar:city>Dulles</rdeRegistrar:city>
+          <rdeRegistrar:sp>VA</rdeRegistrar:sp>
+          <rdeRegistrar:pc>20166-6503</rdeRegistrar:pc>
+          <rdeRegistrar:cc>US</rdeRegistrar:cc>
+        </rdeRegistrar:addr>
+      </rdeRegistrar:postalInfo>
+      <rdeRegistrar:voice x="1234">+1.7035555555
+      </rdeRegistrar:voice>
+      <rdeRegistrar:fax>+1.7035555556
+      </rdeRegistrar:fax>
+      <rdeRegistrar:email>jdoe@example.test
+      </rdeRegistrar:email>
+      <rdeRegistrar:url>http://www.example.test
+      </rdeRegistrar:url>
+      <rdeRegistrar:whoisInfo>
+        <rdeRegistrar:name>whois.example.test
+        </rdeRegistrar:name>
+        <rdeRegistrar:url>http://whois.example.test
+        </rdeRegistrar:url>
+      </rdeRegistrar:whoisInfo>
+      <rdeRegistrar:crDate>2005-04-23T11:49:00.0Z</rdeRegistrar:crDate>
+      <rdeRegistrar:upDate>2009-02-17T17:51:00.0Z</rdeRegistrar:upDate>
+    </rdeRegistrar:registrar>
+
+    <!-- Registrar: RegistrarY -->
+    <rdeRegistrar:registrar>
+      <rdeRegistrar:id>RegistrarY</rdeRegistrar:id>
+      <rdeRegistrar:name>Registrar Y</rdeRegistrar:name>
+      <rdeRegistrar:gurid>1234</rdeRegistrar:gurid>
+      <rdeRegistrar:status>ok</rdeRegistrar:status>
+      <rdeRegistrar:postalInfo type="int">
+        <rdeRegistrar:addr>
+          <rdeRegistrar:street>123 Example Dr.
+          </rdeRegistrar:street>
+          <rdeRegistrar:street>Suite 100
+          </rdeRegistrar:street>
+          <rdeRegistrar:city>Dulles</rdeRegistrar:city>
+          <rdeRegistrar:sp>VA</rdeRegistrar:sp>
+          <rdeRegistrar:pc>20166-6503</rdeRegistrar:pc>
+          <rdeRegistrar:cc>US</rdeRegistrar:cc>
+        </rdeRegistrar:addr>
+      </rdeRegistrar:postalInfo>
+      <rdeRegistrar:voice x="1234">+1.7035555555
+      </rdeRegistrar:voice>
+      <rdeRegistrar:fax>+1.7035555556
+      </rdeRegistrar:fax>
+      <rdeRegistrar:email>jdoe@example.test
+      </rdeRegistrar:email>
+      <rdeRegistrar:url>http://www.example.test
+      </rdeRegistrar:url>
+      <rdeRegistrar:whoisInfo>
+        <rdeRegistrar:name>whois.example.test
+        </rdeRegistrar:name>
+        <rdeRegistrar:url>http://whois.example.test
+        </rdeRegistrar:url>
+      </rdeRegistrar:whoisInfo>
+      <rdeRegistrar:crDate>2005-04-23T11:49:00.0Z</rdeRegistrar:crDate>
+      <rdeRegistrar:upDate>2009-02-17T17:51:00.0Z</rdeRegistrar:upDate>
+    </rdeRegistrar:registrar>
+
+    <!-- IDN Table -->
+    <rdeIDN:idnTableRef id="pt-BR">
+      <rdeIDN:url>
+http://www.iana.org/domains/idn-tables/tables/br_pt-br_1.0.html
+      </rdeIDN:url>
+      <rdeIDN:urlPolicy>
+        http://registro.br/dominio/regras.html
+      </rdeIDN:urlPolicy>
+    </rdeIDN:idnTableRef>
+
+    <!-- NNDN: pinguino.test -->
+    <rdeNNDN:NNDN>
+      <rdeNNDN:aName>xn--exampl-gva.test</rdeNNDN:aName>
+      <rdeNNDN:idnTableId>pt-BR</rdeNNDN:idnTableId>
+      <rdeNNDN:originalName>example1.test</rdeNNDN:originalName>
+      <rdeNNDN:nameState>withheld</rdeNNDN:nameState>
+      <rdeNNDN:crDate>2005-04-23T11:49:00.0Z</rdeNNDN:crDate>
+    </rdeNNDN:NNDN>
+
+    <!-- EppParams -->
+    <rdeEppParams:eppParams>
+      <rdeEppParams:version>1.0</rdeEppParams:version>
+      <rdeEppParams:lang>en</rdeEppParams:lang>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:domain-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:contact-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:host-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:svcExtension>
+        <epp:extURI>urn:ietf:params:xml:ns:rgp-1.0
+        </epp:extURI>
+        <epp:extURI>urn:ietf:params:xml:ns:secDNS-1.1
+        </epp:extURI>
+      </rdeEppParams:svcExtension>
+      <rdeEppParams:dcp>
+      <epp:access><epp:all/></epp:access>
+        <epp:statement>
+          <epp:purpose>
+            <epp:admin/>
+            <epp:prov/>
+          </epp:purpose>
+          <epp:recipient>
+            <epp:ours/>
+            <epp:public/>
+          </epp:recipient>
+          <epp:retention>
+            <epp:stated/>
+          </epp:retention>
+        </epp:statement>
+      </rdeEppParams:dcp>
+    </rdeEppParams:eppParams>
+  <rdePolicy:policy
+     scope="//rde:deposit/rde:contents/rdeDomain:domain"
+     element="rdeDom:registrant" />
+  </rde:contents>
+</rde:deposit>
@@ -0,0 +1,261 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<rde:deposit type="FULL" id="20101017001" prevId="20101010001"
+  xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
+  xmlns:contact="urn:ietf:params:xml:ns:contact-1.0"
+  xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1"
+  xmlns:rde="urn:ietf:params:xml:ns:rde-1.0"
+  xmlns:rdeHeader="urn:ietf:params:xml:ns:rdeHeader-1.0"
+  xmlns:rdeDom="urn:ietf:params:xml:ns:rdeDomain-1.0"
+  xmlns:rdeHost="urn:ietf:params:xml:ns:rdeHost-1.0"
+  xmlns:rdeContact="urn:ietf:params:xml:ns:rdeContact-1.0"
+  xmlns:rdeRegistrar="urn:ietf:params:xml:ns:rdeRegistrar-1.0"
+  xmlns:rdeIDN="urn:ietf:params:xml:ns:rdeIDN-1.0"
+  xmlns:rdeNNDN="urn:ietf:params:xml:ns:rdeNNDN-1.0"
+  xmlns:rdeEppParams="urn:ietf:params:xml:ns:rdeEppParams-1.0"
+  xmlns:rdePolicy="urn:ietf:params:xml:ns:rdePolicy-1.0"
+  xmlns:epp="urn:ietf:params:xml:ns:epp-1.0">
+
+  <rde:watermark>2010-10-17T00:00:00Z</rde:watermark>
+  <rde:rdeMenu>
+    <rde:version>1.0</rde:version>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeHeader-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeContact-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeHost-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeRegistrar-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeIDN-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeNNDN-1.0</rde:objURI>
+    <rde:objURI>urn:ietf:params:xml:ns:rdeEppParams-1.0</rde:objURI>
+  </rde:rdeMenu>
+
+  <!-- Contents -->
+  <rde:contents>
+    <!-- Header -->
+    <rdeHeader:header>
+      <rdeHeader:tld>test</rdeHeader:tld>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeDomain-1.0">2
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeHost-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeContact-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1
+    </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeIDN-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeNNDN-1.0">1
+        </rdeHeader:count>
+      <rdeHeader:count
+        uri="urn:ietf:params:xml:ns:rdeEppParams-1.0">1
+    </rdeHeader:count>
+    </rdeHeader:header>
+
+    <!-- Domain: example2.test -->
+    <rdeDom:domain>
+      <rdeDom:name>example2.test</rdeDom:name>
+      <rdeDom:roid>Dexample2-TEST</rdeDom:roid>
+      <rdeDom:status s="ok"/>
+      <rdeDom:status s="clientUpdateProhibited"/>
+      <rdeDom:registrant>jd1234</rdeDom:registrant>
+      <rdeDom:contact type="admin">sh8013</rdeDom:contact>
+      <rdeDom:contact type="tech">sh8013</rdeDom:contact>
+      <rdeDom:clID>RegistrarX</rdeDom:clID>
+      <rdeDom:crRr>RegistrarX</rdeDom:crRr>
+      <rdeDom:crDate>1999-04-03T22:00:00.0Z</rdeDom:crDate>
+      <rdeDom:exDate>2015-04-03T22:00:00.0Z</rdeDom:exDate>
+    </rdeDom:domain>
+
+    <!-- Domain: example1.test -->
+    <rdeDom:domain>
+      <rdeDom:name>example1.test</rdeDom:name>
+      <rdeDom:roid>Dexample1-TEST</rdeDom:roid>
+      <rdeDom:status s="ok"/>
+      <rdeDom:registrant>jd1234</rdeDom:registrant>
+      <rdeDom:contact type="admin">sh8013</rdeDom:contact>
+      <rdeDom:contact type="tech">sh8013</rdeDom:contact>
+      <rdeDom:ns>
+        <domain:hostObj>ns1.example.com</domain:hostObj>
+        <domain:hostObj>ns1.example1.test</domain:hostObj>
+      </rdeDom:ns>
+      <rdeDom:clID>RegistrarX</rdeDom:clID>
+      <rdeDom:crRr client="jdoe">RegistrarX</rdeDom:crRr>
+      <rdeDom:crDate>1999-04-03T22:00:00.0Z</rdeDom:crDate>
+      <rdeDom:exDate>2015-04-03T22:00:00.0Z</rdeDom:exDate>
+    </rdeDom:domain>
+
+
+
+    <!-- Host: ns1.example.com -->
+    <rdeHost:host>
+      <rdeHost:name>ns1.example.com</rdeHost:name>
+      <rdeHost:roid>Hns1_example_com-TEST</rdeHost:roid>
+      <rdeHost:status s="ok"/>
+      <rdeHost:status s="linked"/>
+      <rdeHost:addr ip="v4">192.0.2.2</rdeHost:addr>
+      <rdeHost:addr ip="v4">192.0.2.29</rdeHost:addr>
+      <rdeHost:addr ip="v6">1080:0:0:0:8:800:200C:417A
+      </rdeHost:addr>
+      <rdeHost:clID>RegistrarX</rdeHost:clID>
+      <rdeHost:crRr>RegistrarX</rdeHost:crRr>
+      <rdeHost:crDate>1999-05-08T12:10:00.0Z</rdeHost:crDate>
+      <rdeHost:upRr>RegistrarX</rdeHost:upRr>
+      <rdeHost:upDate>2009-10-03T09:34:00.0Z</rdeHost:upDate>
+    </rdeHost:host>
+
+    <!-- Host: ns1.example1.test -->
+    <rdeHost:host>
+      <rdeHost:name>ns1.example1.test</rdeHost:name>
+      <rdeHost:roid>Hns1_example1_test-TEST</rdeHost:roid>
+      <rdeHost:status s="ok"/>
+      <rdeHost:status s="linked"/>
+      <rdeHost:addr ip="v4">192.0.2.2</rdeHost:addr>
+      <rdeHost:addr ip="v4">192.0.2.29</rdeHost:addr>
+      <rdeHost:addr ip="v6">1080:0:0:0:8:800:200C:417A
+      </rdeHost:addr>
+      <rdeHost:clID>RegistrarX</rdeHost:clID>
+      <rdeHost:crRr>RegistrarX</rdeHost:crRr>
+      <rdeHost:crDate>1999-05-08T12:10:00.0Z</rdeHost:crDate>
+      <rdeHost:upRr>RegistrarX</rdeHost:upRr>
+      <rdeHost:upDate>2009-10-03T09:34:00.0Z</rdeHost:upDate>
+    </rdeHost:host>
+
+    <!-- Contact: sh8013 -->
+    <rdeContact:contact>
+      <rdeContact:id>sh8013</rdeContact:id>
+      <rdeContact:roid>Csh8013-TEST</rdeContact:roid>
+      <rdeContact:status s="linked"/>
+      <rdeContact:status s="clientDeleteProhibited"/>
+      <rdeContact:postalInfo type="int">
+        <contact:name>John Doe</contact:name>
+        <contact:org>Example Inc.</contact:org>
+        <contact:addr>
+          <contact:street>123 Example Dr.</contact:street>
+          <contact:street>Suite 100</contact:street>
+          <contact:city>Dulles</contact:city>
+          <contact:sp>VA</contact:sp>
+          <contact:pc>20166-6503</contact:pc>
+          <contact:cc>US</contact:cc>
+        </contact:addr>
+      </rdeContact:postalInfo>
+      <rdeContact:voice x="1234">+1.7035555555
+      </rdeContact:voice>
+      <rdeContact:fax>+1.7035555556
+      </rdeContact:fax>
+      <rdeContact:email>jdoe@example.test
+      </rdeContact:email>
+      <rdeContact:clID>RegistrarX</rdeContact:clID>
+      <rdeContact:crRr client="jdoe">RegistrarX
+      </rdeContact:crRr>
+      <rdeContact:crDate>2009-09-13T08:01:00.0Z</rdeContact:crDate>
+      <rdeContact:upRr client="jdoe">RegistrarX
+      </rdeContact:upRr>
+      <rdeContact:upDate>2009-11-26T09:10:00.0Z</rdeContact:upDate>
+      <rdeContact:trDate>2009-12-03T09:05:00.0Z</rdeContact:trDate>
+      <rdeContact:disclose flag="0">
+        <contact:voice/>
+        <contact:email/>
+      </rdeContact:disclose>
+    </rdeContact:contact>
+
+    <!-- Registrar: RegistrarX -->
+    <rdeRegistrar:registrar>
+      <rdeRegistrar:id>RegistrarX</rdeRegistrar:id>
+      <rdeRegistrar:name>Registrar X</rdeRegistrar:name>
+      <rdeRegistrar:gurid>123</rdeRegistrar:gurid>
+      <rdeRegistrar:status>ok</rdeRegistrar:status>
+      <rdeRegistrar:postalInfo type="int">
+        <rdeRegistrar:addr>
+          <rdeRegistrar:street>123 Example Dr.
+          </rdeRegistrar:street>
+          <rdeRegistrar:street>Suite 100
+          </rdeRegistrar:street>
+          <rdeRegistrar:city>Dulles</rdeRegistrar:city>
+          <rdeRegistrar:sp>VA</rdeRegistrar:sp>
+          <rdeRegistrar:pc>20166-6503</rdeRegistrar:pc>
+          <rdeRegistrar:cc>US</rdeRegistrar:cc>
+        </rdeRegistrar:addr>
+      </rdeRegistrar:postalInfo>
+      <rdeRegistrar:voice x="1234">+1.7035555555
+      </rdeRegistrar:voice>
+      <rdeRegistrar:fax>+1.7035555556
+      </rdeRegistrar:fax>
+      <rdeRegistrar:email>jdoe@example.test
+      </rdeRegistrar:email>
+      <rdeRegistrar:url>http://www.example.test
+      </rdeRegistrar:url>
+      <rdeRegistrar:whoisInfo>
+        <rdeRegistrar:name>whois.example.test
+        </rdeRegistrar:name>
+        <rdeRegistrar:url>http://whois.example.test
+        </rdeRegistrar:url>
+      </rdeRegistrar:whoisInfo>
+      <rdeRegistrar:crDate>2005-04-23T11:49:00.0Z</rdeRegistrar:crDate>
+      <rdeRegistrar:upDate>2009-02-17T17:51:00.0Z</rdeRegistrar:upDate>
+    </rdeRegistrar:registrar>
+
+    <!-- IDN Table -->
+    <rdeIDN:idnTableRef id="pt-BR">
+      <rdeIDN:url>
+http://www.iana.org/domains/idn-tables/tables/br_pt-br_1.0.html
+      </rdeIDN:url>
+      <rdeIDN:urlPolicy>
+        http://registro.br/dominio/regras.html
+      </rdeIDN:urlPolicy>
+    </rdeIDN:idnTableRef>
+
+    <!-- NNDN: pinguino.test -->
+    <rdeNNDN:NNDN>
+      <rdeNNDN:aName>xn--exampl-gva.test</rdeNNDN:aName>
+      <rdeNNDN:idnTableId>pt-BR</rdeNNDN:idnTableId>
+      <rdeNNDN:originalName>example1.test</rdeNNDN:originalName>
+      <rdeNNDN:nameState>withheld</rdeNNDN:nameState>
+      <rdeNNDN:crDate>2005-04-23T11:49:00.0Z</rdeNNDN:crDate>
+    </rdeNNDN:NNDN>
+
+    <!-- EppParams -->
+    <rdeEppParams:eppParams>
+      <rdeEppParams:version>1.0</rdeEppParams:version>
+      <rdeEppParams:lang>en</rdeEppParams:lang>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:domain-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:contact-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:objURI>
+        urn:ietf:params:xml:ns:host-1.0
+      </rdeEppParams:objURI>
+      <rdeEppParams:svcExtension>
+        <epp:extURI>urn:ietf:params:xml:ns:rgp-1.0
+        </epp:extURI>
+        <epp:extURI>urn:ietf:params:xml:ns:secDNS-1.1
+        </epp:extURI>
+      </rdeEppParams:svcExtension>
+      <rdeEppParams:dcp>
+      <epp:access><epp:all/></epp:access>
+        <epp:statement>
+          <epp:purpose>
+            <epp:admin/>
+            <epp:prov/>
+          </epp:purpose>
+          <epp:recipient>
+            <epp:ours/>
+            <epp:public/>
+          </epp:recipient>
+          <epp:retention>
+            <epp:stated/>
+          </epp:retention>
+        </epp:statement>
+      </rdeEppParams:dcp>
+    </rdeEppParams:eppParams>
+  <rdePolicy:policy
+     scope="//rde:deposit/rde:contents/rdeDomain:domain"
+     element="rdeDom:registrant" />
+  </rde:contents>
+</rde:deposit>
@@ -19,11 +19,21 @@
 # expanded in the copies sent to Spinnaker, we preserve the brackets around
 # them for safe pattern matching during release.
 # See https://github.com/spinnaker/spinnaker/issues/3028 for more information.
-steps:
-# Delete unused GAE versions.
+#
 # GAE has a limit of ~250 versions per-project, including unused versions. We
 # therefore need to periodically delete old versions. This GCB job finds all
 # stopped versions and delete all but the last 3 (in case we need to rollback).
+steps:
+# Pull the credential for nomulus tool.
+- name: 'gcr.io/$PROJECT_ID/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    gcloud secrets versions access latest \
+      --secret nomulus-tool-cloudbuild-credential > tool-credential.json
+# Delete unused GAE versions.
 - name: 'gcr.io/$PROJECT_ID/builder:latest'
  entrypoint: /bin/bash
  args:
@@ -36,6 +46,8 @@ steps:
      project_id="domain-registry-${_ENV}"
    fi

+    gcloud auth activate-service-account --key-file=tool-credential.json
+
    for service in default pubapi backend tools
    do
      for version in $(gcloud app versions list \
@@ -106,30 +106,34 @@ public class CloudTasksUtils implements Serializable {
    checkArgument(
        path != null && !path.isEmpty() && path.charAt(0) == '/',
        "The path must start with a '/'.");
+    checkArgument(
+        method.equals(HttpMethod.GET) || method.equals(HttpMethod.POST),
+        "HTTP method %s is used. Only GET and POST are allowed.",
+        method);
    AppEngineHttpRequest.Builder requestBuilder =
        AppEngineHttpRequest.newBuilder()
            .setHttpMethod(method)
            .setAppEngineRouting(AppEngineRouting.newBuilder().setService(service).build());
-    Escaper escaper = UrlEscapers.urlPathSegmentEscaper();
-    String encodedParams =
-        Joiner.on("&")
-            .join(
-                params.entries().stream()
-                    .map(
-                        entry ->
-                            String.format(
-                                "%s=%s",
-                                escaper.escape(entry.getKey()), escaper.escape(entry.getValue())))
-                    .collect(toImmutableList()));
-    if (method == HttpMethod.GET) {
-      path = String.format("%s?%s", path, encodedParams);
-    } else if (method == HttpMethod.POST) {
-      requestBuilder
-          .putHeaders(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString())
-          .setBody(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
-    } else {
-      throw new IllegalArgumentException(
-          String.format("HTTP method %s is used. Only GET and POST are allowed.", method));
+
+    if (!CollectionUtils.isNullOrEmpty(params)) {
+      Escaper escaper = UrlEscapers.urlPathSegmentEscaper();
+      String encodedParams =
+          Joiner.on("&")
+              .join(
+                  params.entries().stream()
+                      .map(
+                          entry ->
+                              String.format(
+                                  "%s=%s",
+                                  escaper.escape(entry.getKey()), escaper.escape(entry.getValue())))
+                      .collect(toImmutableList()));
+      if (method == HttpMethod.GET) {
+        path = String.format("%s?%s", path, encodedParams);
+      } else {
+        requestBuilder
+            .putHeaders(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString())
+            .setBody(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
+      }
    }
    requestBuilder.setRelativeUri(path);
    return Task.newBuilder().setAppEngineHttpRequest(requestBuilder.build()).build();
@@ -49,6 +49,11 @@ public class CollectionUtils {
    return potentiallyNull == null || potentiallyNull.isEmpty();
  }

+  /** Checks if a Multimap is null or empty. */
+  public static boolean isNullOrEmpty(@Nullable Multimap<?, ?> potentiallyNull) {
+    return potentiallyNull == null || potentiallyNull.isEmpty();
+  }
+
  /** Turns a null set into an empty set. JAXB leaves lots of null sets lying around. */
  public static <T> Set<T> nullToEmpty(@Nullable Set<T> potentiallyNull) {
    return firstNonNull(potentiallyNull, ImmutableSet.of());
@@ -25,6 +25,7 @@ import static org.mockito.Mockito.when;
 import com.google.cloud.tasks.v2.HttpMethod;
 import com.google.cloud.tasks.v2.Task;
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMultimap;
 import com.google.common.collect.LinkedListMultimap;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeSleeper;
@@ -80,6 +81,48 @@ public class CloudTasksUtilsTest {
    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
  }

+  @Test
+  void testSuccess_createGetTasks_withNullParams() {
+    Task task = CloudTasksUtils.createGetTask("/the/path", "myservice", null);
+    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
+    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
+    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
+        .isEqualTo("myservice");
+    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
+  }
+
+  @Test
+  void testSuccess_createPostTasks_withNullParams() {
+    Task task = CloudTasksUtils.createPostTask("/the/path", "myservice", null);
+    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
+    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
+    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
+        .isEqualTo("myservice");
+    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
+    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
+  }
+
+  @Test
+  void testSuccess_createGetTasks_withEmptyParams() {
+    Task task = CloudTasksUtils.createGetTask("/the/path", "myservice", ImmutableMultimap.of());
+    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
+    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
+    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
+        .isEqualTo("myservice");
+    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
+  }
+
+  @Test
+  void testSuccess_createPostTasks_withEmptyParams() {
+    Task task = CloudTasksUtils.createPostTask("/the/path", "myservice", ImmutableMultimap.of());
+    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
+    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
+    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
+        .isEqualTo("myservice");
+    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
+    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
+  }
+
  @SuppressWarnings("ProtoTimestampGetSecondsGetNano")
  @Test
  void testSuccess_createGetTasks_withJitterSeconds() {
@@ -22,6 +22,8 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.google.common.collect.HashMultimap;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableMultimap;
+import com.google.common.collect.Multimap;
 import java.util.Map;
 import org.junit.jupiter.api.Test;

@@ -43,6 +45,12 @@ class CollectionUtilsTest {
    assertThat(convertedMap).isEmpty();
  }

+  @Test
+  void testNullOrEmptyMultimap() {
+    assertThat(CollectionUtils.isNullOrEmpty((Multimap<?, ?>) null)).isTrue();
+    assertThat(CollectionUtils.isNullOrEmpty(ImmutableMultimap.of())).isTrue();
+  }
+
  @Test
  void testPartitionMap() {
    Map<String, String> map = ImmutableMap.of("ka", "va", "kb", "vb", "kc", "vc");
Author	SHA1	Message	Date
gbrodman	eded6813ab	Add a bit of documentation about the replica config (#1488 )	2022-01-13 15:44:04 -05:00
Rachel Guan	bbe5c058fe	Add support for empty or null params for createTask() (#1448 ) * Add support for null or empty params * Add Null or empty check in CollectionUtils * Remove content type header for empty params in POST request	2022-01-13 12:44:41 -05:00
Weimin Yu	4b0cf576f8	CommitLog handling code should call ofyTm (#1492 ) * CommitLog handling code should call ofyTm The tm() call will use JPA transaction manager after the switch-over to SQL. These calls would lose their transaction semantics. Both actions are to be invoked after the switchover in case we have to switch back to Datastore as primary.	2022-01-13 12:33:19 -05:00
Michael Muller	045de3889b	Allow database comparison when in read-only mode (#1490 ) Note: this change was actually authored by @weiminyu, I'm checking it in for expediency.	2022-01-13 09:32:49 -05:00
Weimin Yu	68fc4cd022	Only compare recent changes in Datastore and SQL (#1485 ) * Only compare recent changes in Datastore and SQL When comparing Datastore and SQL, ignore older History and EPP resource objects. This cuts the run time in half compared with a full comparison. The intention is to run a full comparison before the switch-over from Datastore and SQL, and run this incremental comparison during the down time. The incremental comparison takes about 25 minutes in production. Performance can be improved further by filtering out older billing events (OneTime and Cancellation). However, we don't think further optimization is worth the effort (considering that Recurring events cannot be filtered since they are mutable but without lastUpdateTime). Verified in Sandbox and prod with and without time filter.	2022-01-11 14:17:32 -05:00
Lai Jiang	ebe55146c3	Add a command to compare two escrow deposits (#1476 ) We already have ValidateEscrowDepositCommand to check for internal reference consistency of two deposits, i. e. making sure that all contacts and hosts referenced by domains exist in the same deposit. Therefore to compare whether two deposits are equal we only need to make sure that they contain the same domains and registrars, assuming they both pass the validation. We don't compare their contents directly because the MapReduce deposit contains all contacts and domains whereas the Beam deposit only contains referenced ones, making a direct comparison impossible. <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1476) <!-- Reviewable:end -->	2022-01-11 11:47:58 -05:00
gbrodman	807ddf46b9	Add replicateToDatastore cron job to prod (#1459 ) No issues with this in sandbox so we should add it in prod	2022-01-10 16:38:25 -05:00
gbrodman	ff8f86090d	Speed up updating of premium lists (#1482 ) * Speed up updating of premium lists There are two parts to this: 1. Don't load the premium entries in the command prompt (this isn't necessary and we didn't display that information anyway). 2. Set a proper batch size (rather than just 1) when saving all the premium entries. This means that we generate only one INSERT statement rather than N statements.	2022-01-10 16:33:35 -05:00
gbrodman	5822f53e14	Allow usage of a read-only Postgres replica (#1470 ) * Allow usage of a read-only Postgres replica This adds the Dagger provider code for both the regular and the BEAM environments, which are similar but not quite the same. In addition, this demonstrates usage of the replica DB in the RdePipeline. I tested this on alpha with a modified version of the RdePipeline that attempts to write some dummy values to the database and it failed with the expected message that one cannot write to a replica.	2022-01-07 13:21:22 -05:00
Rachel Guan	d04b3299aa	Replace all existing vkey string to vkey.stringify() (#1430 ) * Resolve ResaveEntityAction related conflicts * Replace string with existing constants * Remove solved TODOs related to ofy string to new vkey string * Add a TODO for clean up * Fix missing annotation	2022-01-07 12:11:15 -05:00
Lai Jiang	ceade7f954	Use the service account credential to delete unused versions (#1484 )	2022-01-07 11:06:19 -05:00
Rachel Guan	1fcf63facd	Use CloudTasksUtils to enqueue in GenerateEscrowDepositCommand (#1465 ) * Use CloudTasksUtils to enqueue in GenerateEscrowDepositCommand * Add CloudTasksUtil to RegistryToolComponent * Remove header param	2022-01-06 15:36:22 -05:00