Move SQL files to resources from java (#1879 )

This is similar to where we store the SQL files for beam pipelines, and frankly makes more sense. Also streamlined the use of the API to read SQL files from a jar.
Add CodeQL workflow (#1884 )
2026-06-09 16:33:02 +00:00 · 2022-12-12 16:32:27 -05:00 · 2022-12-12 15:52:47 -05:00 · 2022-12-12 15:42:02 -05:00 · 2022-12-12 13:51:33 -05:00 · 2022-12-12 11:55:24 -05:00
254 changed files with 3269 additions and 5850 deletions
@@ -6,5 +6,4 @@ node_modules/
 repos/**
 **/.idea/
 *.jar
-!third_party/**/*.jar
 !/gradle/wrapper/**/*.jar
@@ -0,0 +1,63 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ 'master' ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ 'master' ]
+  schedule:
+    - cron: '24 4 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java', 'javascript', 'python' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        queries: security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"
@@ -14,7 +14,6 @@ gjf.out
 *.jar
 *.war
 *.ear
-!/third_party/**/*.jar

 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
@@ -1,6 +0,0 @@
-extraction:
-  java:
-    prepare:
-      packages: "npm"
-    index:
-      java_version: "11"
@@ -1,8 +1,8 @@
 # Nomulus

-| Internal Build | FOSS Build | LGTM | License | Code Search |
-|:--------------:|:----------:|:----:|:-------:|:-----------:|
-|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Code Search](https://www.gstatic.com/devopsconsole/images/oss/favicons/oss-32x32.png)](https://cs.opensource.google/nomulus/nomulus)|
+| Internal Build | FOSS Build | License | Code Search |
+|:--------------:|:----------:|:-------:|:-----------:|
+|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Code Search](https://www.gstatic.com/devopsconsole/images/oss/favicons/oss-32x32.png)](https://cs.opensource.google/nomulus/nomulus)|

 ![Nomulus logo](./nomulus-logo.png)

@@ -355,8 +355,6 @@ subprojects {
    }
  }

-  if (project.name == 'third_party') return
-
  project.tasks.test.dependsOn runPresubmits

  def commonlyExcludedResources = ['**/*.java', '**/BUILD']
@@ -528,6 +526,10 @@ task javaIncrementalFormatApply {

 task javadoc(type: Javadoc) {
  source javadocSource
+  // Java 11.0.17 has the following bug that affects annotation handling on
+  // package-info.java:
+  // https://bugs.openjdk.org/browse/JDK-8222091
+  exclude "**/package-info.java"
  classpath = files(javadocClasspath)
  destinationDir = file("${buildDir}/docs/javadoc")
  options.encoding = "UTF-8"
@@ -4,38 +4,38 @@
 antlr:antlr:2.7.7=checkstyle
 aopalliance:aopalliance:1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 args4j:args4j:2.0.23=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.13.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.13.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,testAnnotationProcessor
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=testRuntimeClasspath
-com.google.api-client:google-api-client:2.0.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-iam-v1:1.6.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.9.6=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.6.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.2.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.19.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:0.104.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.19.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.1.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-iam-v1:1.6.22=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.11.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.6.22=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.2.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.20.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:0.105.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.20.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20220705-2.0.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.12.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.12.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.10=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.10=annotationProcessor
+com.google.auth:google-auth-library-credentials:1.13.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.13.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value:1.10.1=annotationProcessor
 com.google.auto:auto-common:0.10=annotationProcessor,testAnnotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.8.22=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.8.22=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.8.22=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.14.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.9.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.9.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.9.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.16.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.code.gson:gson:2.9.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.code.gson:gson:2.10=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.6=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.11.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.16=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,checkstyle,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,testAnnotationProcessor
@@ -46,19 +46,19 @@ com.google.guava:guava:27.0.1-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:29.0-jre=checkstyle
 com.google.guava:guava:31.1-jre=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.42.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.42.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.42.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.42.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.42.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.42.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.42.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.42.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.42.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.42.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:4.1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle,compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:1.0.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client:1.34.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:3.21.8=compileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java:3.21.8=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:3.21.10=compileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.21.10=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,testAnnotationProcessor
 com.google.re2j:re2j:1.6=testRuntimeClasspath
 com.google.template:soy:2021-02-01=compileClasspath,testCompileClasspath,testRuntimeClasspath
@@ -68,27 +68,27 @@ com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,testAnnotatio
 com.ibm.icu:icu4j:57.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 com.puppycrawl.tools:checkstyle:8.37=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-codec:commons-codec:1.11=compileClasspath,testCompileClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.15=compileClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
 commons-logging:commons-logging:1.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
 info.picocli:picocli:4.5.2=checkstyle
-io.grpc:grpc-alts:1.50.1=testRuntimeClasspath
-io.grpc:grpc-api:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.50.1=testRuntimeClasspath
-io.grpc:grpc-grpclb:1.50.1=testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.50.1=testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.50.1=testRuntimeClasspath
-io.grpc:grpc-stub:1.50.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.50.1=testRuntimeClasspath
+io.grpc:grpc-alts:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.51.0=testRuntimeClasspath
+io.grpc:grpc-grpclb:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.51.0=testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.51.0=testRuntimeClasspath
+io.grpc:grpc-stub:1.51.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.51.0=testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=testRuntimeClasspath
-io.perfmark:perfmark-api:0.25.0=testRuntimeClasspath
+io.perfmark:perfmark-api:0.26.0=testRuntimeClasspath
 javax.annotation:javax.annotation-api:1.3.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
 javax.annotation:jsr250-api:1.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 javax.inject:javax.inject:1=compileClasspath,testCompileClasspath,testRuntimeClasspath
@@ -104,12 +104,12 @@ org.apache.httpcomponents:httpcore:4.4.15=compileClasspath,testCompileClasspath,
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.checkerframework:checker-qual:2.11.1=checkstyle
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.26.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.28.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.22=testRuntimeClasspath
-org.conscrypt:conscrypt-openjdk-uber:2.5.2=testRuntimeClasspath
+org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
 org.jacoco:org.jacoco.agent:0.8.6=jacocoAgent,jacocoAnt
 org.jacoco:org.jacoco.ant:0.8.6=jacocoAnt
@@ -122,8 +122,8 @@ org.junit.jupiter:junit-jupiter-engine:5.9.1=testCompileClasspath,testRuntimeCla
 org.junit.platform:junit-platform-commons:1.9.1=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-engine:1.9.1=testCompileClasspath,testRuntimeClasspath
 org.junit:junit-bom:5.9.1=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-core:4.8.1=testCompileClasspath,testRuntimeClasspath
-org.objenesis:objenesis:3.2=testRuntimeClasspath
+org.mockito:mockito-core:4.9.0=testCompileClasspath,testRuntimeClasspath
+org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:7.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:8.0.1=jacocoAnt
@@ -140,5 +140,5 @@ org.plumelib:plume-util:1.0.6=annotationProcessor,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,testAnnotationProcessor
 org.plumelib:require-javadoc:0.1.0=annotationProcessor,testAnnotationProcessor
 org.reflections:reflections:0.9.12=checkstyle
-org.threeten:threetenbp:1.6.3=compileClasspath,testCompileClasspath,testRuntimeClasspath
+org.threeten:threetenbp:1.6.4=compileClasspath,testCompileClasspath,testRuntimeClasspath
 empty=
@@ -32,7 +32,7 @@ commons-collections:commons-collections:3.2.2=checkstyle
 info.picocli:picocli:4.5.2=checkstyle
 io.github.java-diff-utils:java-diff-utils:4.12=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 javax.inject:javax.inject:1=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-joda-time:joda-time:2.12.1=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+joda-time:joda-time:2.12.2=compileClasspath,default,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 junit:junit:4.13.2=default,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 net.sf.saxon:Saxon-HE:10.3=checkstyle
 org.antlr:antlr4-runtime:4.8-1=checkstyle
@@ -43,12 +43,6 @@ by Joshua Bloch in his book Effective Java -->
    <property name="message" value='Your Javadocs appear to use invalid &lt;a&gt; tag syntax in @see tags. Please use the correct syntax: @see &lt;a href="http(s)://your_url"&gt;url_description&lt;/a&gt;'/>
  </module>

-  <!-- Checks that our Ofy wrapper is used instead of the "real" ofy(). -->
-  <module name="RegexpSingleline">
-    <property name="format" value="com\.googlecode\.objectify\.ObjectifyService\.ofy"/>
-    <property name="message" value="Use google.registry.model.ofy.ObjectifyService.ofy(). Do not use com.googlecode.objectify.v4.ObjectifyService.ofy()."/>
-  </module>
-
  <!-- Checks that java.util.Optional is used instead of Guava's Optional. -->
  <module name="RegexpSingleline">
    <property name="format" value="com\.google\.common\.base\.Optional"/>
@@ -58,7 +52,7 @@ by Joshua Bloch in his book Effective Java -->
  <!-- Checks that the deprecated ExpectedException is not used. -->
  <module name="RegexpSingleline">
    <property name="format" value="org\.junit\.rules\.ExpectedException"/>
-    <property name="message" value="Use assertThrows and expectThrows from JUnitBackports instead of the deprecated methods on ExpectedException."/>
+    <property name="message" value="Use assertThrows and expectThrows instead of the deprecated methods on ExpectedException."/>
  </module>

  <module name="LineLength">
@@ -9,6 +9,4 @@
  <suppress files="[/\\].*[/\\]generated.*[/\\]" checks="."/>
  <!-- Ignore Javadoc checks in test files -->
  <suppress files="[/\\].*[/\\]src/test/java/.*[/\\]" checks="JavadocType"/>
-  <!-- ofy() regex check doesn't apply to these files -->
-  <suppress files="AugmentedDeleter.java|AugmentedSaver.java|Ofy.java" checks="RegexpSingleline"/>
 </suppressions>
@@ -109,15 +109,6 @@ PRESUBMITS = {
        "System.(out|err).println is only allowed in tools/ packages. Please "
        "use a logger instead.",

-    # ObjectifyService.register is restricted to main/ or AppEngineExtension.
-    PresubmitCheck(
-        r".*\bObjectifyService\.register", "java", {
-            "/build/", "/generated/", "node_modules/", "src/main/",
-            "AppEngineExtension.java"
-        }):
-      "ObjectifyService.register(...) is not allowed in tests. Please use "
-      "AppEngineExtension.register(...) instead.",
-
    # PostgreSQLContainer instantiation must specify docker tag
    # TODO(b/204572437): Fix the pattern to pass DatabaseSnapshotTest.java
    PresubmitCheck(
@@ -163,11 +163,6 @@ configurations {
 dependencies {
  def deps = rootProject.dependencyMap

-  // Custom-built objectify jar at commit ecd5165, included in Nomulus
-  // release.
-  implementation files(
-      "${rootDir}/third_party/objectify/v4_1/objectify-4.1.3.jar")
-
  testRuntimeOnly files(sourceSets.test.resources.srcDirs)

  implementation deps['com.beust:jcommander']
@@ -194,9 +189,6 @@ dependencies {
  implementation deps['com.google.apis:google-api-services-sheets']
  implementation deps['com.google.apis:google-api-services-storage']
  testImplementation deps['com.google.appengine:appengine-api-stubs']
-  implementation deps['com.google.appengine.tools:appengine-gcs-client']
-  implementation deps['com.google.appengine.tools:appengine-pipeline']
-  implementation deps['com.google.appengine:appengine-remote-api']
  implementation deps['com.google.auth:google-auth-library-credentials']
  implementation deps['com.google.auth:google-auth-library-oauth2-http']
  implementation deps['com.google.cloud.bigdataoss:util']
@@ -8,16 +8,14 @@ args4j:args4j:2.0.26=css
 cglib:cglib-nodep:2.2=css
 com.101tec:zkclient:0.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.electronwill.night-config:core:3.6.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.electronwill.night-config:toml:3.6.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.13.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -39,73 +37,73 @@ com.google.api-client:google-api-client-jackson2:1.32.2=compileClasspath,default
 com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.20.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.144.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.144.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.23.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.147.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.147.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:1.27.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.102.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.6.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.9.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-iam-v1:1.6.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.20.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.144.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.144.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.102.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.4.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.4.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.102.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.6.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.14.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.95.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.95.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.9.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.6.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.2.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.19.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:0.104.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.19.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.102.20=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.7.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.9.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-iam-v1:1.6.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.23.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.147.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.147.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.102.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:1.64.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.4.6=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.102.20=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.7.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.16.0-alpha=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.96.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.96.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.6.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.2.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.20.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:0.105.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.20.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-admin-directory:directory_v1-rev118-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-appengine:v1-rev20220818-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20220827-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-appengine:v1-rev20221205-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20220924-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-clouddebugger:v2-rev20220318-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20220828-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20220812-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20220920-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dns:v2beta1-rev99-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20220818-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20210326-1.32.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20220930-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-pubsub:v1-rev20220829-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20221205-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20220927-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20221017-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20220705-2.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine.tools:appengine-gcs-client:0.8.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine.tools:appengine-pipeline:0.2.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-1.0-sdk:2.0.9=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-api-stubs:2.0.9=testCompileClasspath,testRuntimeClasspath
-com.google.appengine:appengine-remote-api:2.0.9=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.appengine:appengine-api-1.0-sdk:2.0.10=testCompileClasspath,testRuntimeClasspath
+com.google.appengine:appengine-api-stubs:2.0.10=testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-testing:1.9.86=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.12.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.12.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.13.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.13.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.0.1=annotationProcessor
-com.google.auto.value:auto-value-annotations:1.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.10=annotationProcessor,default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value:1.10.1=annotationProcessor,testAnnotationProcessor
+com.google.auto.value:auto-value:1.9=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto:auto-common:0.10=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto:auto-common:1.2=annotationProcessor
 com.google.closure-stylesheets:closure-stylesheets:1.5.0=css
@@ -116,33 +114,34 @@ com.google.cloud.bigtable:bigtable-metrics-api:1.26.3=compileClasspath,default,d
 com.google.cloud.datastore:datastore-v1-proto-client:2.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.sql:jdbc-socket-factory-core:1.7.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.sql:postgres-socket-factory:1.7.2=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:2.20.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable-stats:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.11.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.8.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.8.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.8.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.4.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.4.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.124.19=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.120.13=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.6.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-spanner:6.29.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.14.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:2.23.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable-stats:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.14.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.cloud:google-cloud-monitoring:3.4.6=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.125.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsub:1.120.20=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-pubsublite:1.7.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-spanner:6.31.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.16.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.2.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.4.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.6.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.1=css
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.7=css,soy
 com.google.common.html.types:types:1.0.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.dagger:dagger-compiler:2.44=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-producers:2.44=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-spi:2.44=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger:2.44=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.dagger:dagger-compiler:2.44.2=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-producers:2.44.2=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-spi:2.44.2=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger:2.44.2=annotationProcessor,compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.devtools.ksp:symbol-processing-api:1.7.0-1.0.6=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.16=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -168,10 +167,10 @@ com.google.guava:guava:31.0.1-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:31.1-jre=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,default,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.42.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:1.42.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.42.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.42.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.42.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.42.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.42.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.41.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.42.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -192,9 +191,9 @@ com.google.oauth-client:google-oauth-client-java6:1.34.1=compileClasspath,defaul
 com.google.oauth-client:google-oauth-client-jetty:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client-servlet:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client:1.34.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:3.21.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:3.21.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:2.5.0=css
-com.google.protobuf:protobuf-java:3.21.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.21.10=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:4.0.0-rc-2=soy
 com.google.re2j:re2j:1.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -211,6 +210,7 @@ com.puppycrawl.tools:checkstyle:8.37=checkstyle
 com.squareup.okhttp3:okhttp:3.11.0=testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio:1.14.0=testCompileClasspath,testRuntimeClasspath
 com.squareup:javapoet:1.13.0=annotationProcessor,testAnnotationProcessor
+com.squareup:kotlinpoet:1.11.0=annotationProcessor,testAnnotationProcessor
 com.sun.activation:jakarta.activation:1.2.2=jaxb
 com.sun.activation:javax.activation:1.2.0=jaxb
 com.sun.istack:istack-commons-runtime:3.0.7=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -226,7 +226,7 @@ commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-codec:commons-codec:1.15=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
 commons-logging:commons-logging:1.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-dnsjava:dnsjava:3.5.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+dnsjava:dnsjava:3.5.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_linux_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_macosx_x86_64:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
 guru.nidi.com.eclipsesource.j2v8:j2v8_win32_x86:4.6.0=nonprodRuntime,runtime,testRuntimeClasspath
@@ -242,26 +242,24 @@ io.confluent:kafka-schema-registry-client:5.3.2=compileClasspath,default,deploy_
 io.dropwizard.metrics:metrics-core:3.1.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.classgraph:classgraph:4.8.104=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.12=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.48.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-alts:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.48.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-grpclb:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.48.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-netty-shaded:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.48.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-services:1.48.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.50.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.48.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.50.1=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-census:1.49.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.51.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty:1.49.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.49.2=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.49.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-services:1.51.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.51.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.49.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.51.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-buffer:4.1.77.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http2:4.1.77.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http:4.1.77.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -286,7 +284,7 @@ io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,defa
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.perfmark:perfmark-api:0.25.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.perfmark:perfmark-api:0.26.0=default,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.0=jaxb,nonprodRuntime,runtime
 jakarta.xml.bind:jakarta.xml.bind-api:4.0.0=jaxb,nonprodRuntime,runtime
 javacc:javacc:4.1=css
@@ -317,25 +315,25 @@ org.apache.arrow:arrow-format:5.0.0=compileClasspath,default,deploy_jar,nonprodC
 org.apache.arrow:arrow-memory-core:5.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-vector:5.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.avro:avro:1.8.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-construction-java:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.42.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-fn-execution:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-kafka:2.42.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-construction-java:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.43.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-fn-execution:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-kafka:2.43.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-grpc-1_48_1:0.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-compress:1.21=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-compress:1.22=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.9.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=nonprodRuntime,runtime,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.12.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -348,7 +346,7 @@ org.apache.mina:mina-core:2.1.6=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:2.0.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:2.0.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:2.0.0=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:10.1.1=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.0-M1=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.bouncycastle:bcpkix-jdk15on:1.67=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -358,7 +356,7 @@ org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,compileClassp
 org.checkerframework:checker-qual:2.11.1=checkstyle
 org.checkerframework:checker-qual:3.0.0=errorprone,nonprodAnnotationProcessor
 org.checkerframework:checker-qual:3.12.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.26.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.28.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.5.0=nonprodRuntime,runtime,soy
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -369,7 +367,7 @@ org.codehaus.mojo:animal-sniffer-annotations:1.22=default,deploy_jar,nonprodRunt
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.easymock:easymock:3.0=css
 org.eclipse.angus:angus-activation:1.0.0=nonprodRuntime,runtime
-org.flywaydb:flyway-core:9.7.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.1=nonprodRuntime,runtime
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:4.0.1=nonprodRuntime,runtime
@@ -393,6 +391,7 @@ org.javassist:javassist:3.26.0-GA=checkstyle
 org.jboss.logging:jboss-logging:3.4.3.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jboss:jandex:2.4.2.Final=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-reflect:1.6.10=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-common:1.7.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.0=annotationProcessor,testAnnotationProcessor
@@ -400,11 +399,11 @@ org.jetbrains.kotlin:kotlin-stdlib:1.7.0=annotationProcessor,testAnnotationProce
 org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.5.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:17.0.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.joda:joda-money:1.0.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.joda:joda-money:1.0.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20160212=soy
 org.json:json:20200518=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.15.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.junit-pioneer:junit-pioneer:1.7.1=testCompileClasspath,testRuntimeClasspath
+org.junit-pioneer:junit-pioneer:1.9.1=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-api:5.9.1=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-engine:5.9.1=testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-migrationsupport:5.9.1=testCompileClasspath,testRuntimeClasspath
@@ -418,12 +417,12 @@ org.junit.platform:junit-platform-suite-commons:1.9.1=testRuntimeClasspath
 org.junit:junit-bom:5.9.1=testCompileClasspath,testRuntimeClasspath
 org.jvnet.staxex:stax-ex:1.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:1.10.19=css
-org.mockito:mockito-core:4.8.1=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-junit-jupiter:4.8.1=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:4.9.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-junit-jupiter:4.9.0=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty-util:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.mortbay.jetty:jetty:6.1.26=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:2.1=css
-org.objenesis:objenesis:3.2=testRuntimeClasspath
+org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-analysis:7.0=soy
 org.ow2.asm:asm-analysis:8.0.1=jacocoAnt
@@ -443,7 +442,7 @@ org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,nonprodAnnota
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 org.plumelib:require-javadoc:0.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.5.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.5.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntime,nonprodRuntimeClasspath,runtime,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.9.12=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.seleniumhq.selenium:selenium-api:3.141.59=testCompileClasspath,testRuntimeClasspath
@@ -460,23 +459,23 @@ org.slf4j:jcl-over-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=nonprodRuntime,runtime,testRuntimeClasspath
 org.slf4j:slf4j-api:1.7.30=nonprodRuntime,runtime
 org.slf4j:slf4j-api:1.7.36=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
-org.slf4j:slf4j-api:2.0.3=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.slf4j:slf4j-jdk14:2.0.3=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:2.0.5=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.slf4j:slf4j-jdk14:2.0.5=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.springframework:spring-core:5.3.18=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-expression:5.3.18=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.springframework:spring-jcl:5.3.18=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.17.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.17.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:junit-jupiter:1.17.5=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.17.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:selenium:1.17.5=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.17.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.threeten:threetenbp:1.6.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.17.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.17.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:junit-jupiter:1.17.6=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.17.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:selenium:1.17.6=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.17.6=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.threeten:threetenbp:1.6.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.tukaani:xz:1.5=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=nonprodRuntime,runtime,testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.8.4=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:1.31=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:1.33=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -18,9 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;

 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
-import com.google.common.io.Resources;
 import google.registry.util.Clock;
-import google.registry.util.ResourceUtils;
 import java.util.regex.Pattern;
 import org.apache.avro.generic.GenericRecord;
 import org.apache.beam.sdk.io.gcp.bigquery.SchemaAndRecord;
@@ -57,14 +55,6 @@ public class BeamUtils {
    }
  }

-  /**
-   * Returns the {@link String} contents for a file in the {@code sql/} directory relative to a
-   * class.
-   */
-  public static String getQueryFromFile(Class<?> clazz, String filename) {
-    return ResourceUtils.readResourceUtf8(Resources.getResource(clazz, "sql/" + filename));
-  }
-
  /** Creates a beam job name and validates that it conforms to the requirements. */
  public static String createJobName(String prefix, Clock clock) {
    // Flex template job name must be unique and consists of only characters [-a-z0-9], starting
@@ -26,7 +26,6 @@ import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
 import java.util.Map;
 import java.util.Objects;
-import java.util.concurrent.ThreadLocalRandom;
 import javax.annotation.Nullable;
 import javax.persistence.criteria.CriteriaQuery;
 import org.apache.beam.sdk.coders.Coder;
@@ -263,38 +262,11 @@ public final class RegistryJpaIO {

    public static final int DEFAULT_BATCH_SIZE = 1;

-    /** The default number of write shard. Please refer to {@link #shards} for more information. */
-    public static final int DEFAULT_SHARDS = 1;
-
    public abstract String name();

    /** Number of elements to be written in one call. */
    public abstract int batchSize();

-    /**
-     * The number of shards the output should be split into.
-     *
-     * <p>This value is a hint to the pipeline runner on the level of parallelism, and should be
-     * significantly greater than the number of threads working on this transformation (see next
-     * paragraph for more information). On the other hand, it should not be too large to the point
-     * that the number of elements per shard is lower than {@link #batchSize()}. As a rule of thumb,
-     * the following constraint should hold: {@code shards * batchSize * nThreads <=
-     * inputElementCount}. Although it is not always possible to determine the number of threads
-     * working on this transform, when the pipeline run is IO-bound, it most likely is close to the
-     * total number of threads in the pipeline, which is explained below.
-     *
-     * <p>With Cloud Dataflow runner, the total number of worker threads in a batch pipeline (which
-     * includes all existing Registry pipelines) is the number of vCPUs used by the pipeline, and
-     * can be set by the {@code --maxNumWorkers} and {@code --workerMachineType} parameters. The
-     * number of worker threads in a streaming pipeline can be set by the {@code --maxNumWorkers}
-     * and {@code --numberOfWorkerHarnessThreads} parameters.
-     *
-     * <p>Note that connections on the database server are a limited resource, therefore the number
-     * of threads that interact with the database should be set to an appropriate limit. Again, we
-     * cannot control this number, but can influence it by controlling the total number of threads.
-     */
-    public abstract int shards();
-
    public abstract SerializableFunction<T, Object> jpaConverter();

    public Write<T> withName(String name) {
@@ -305,10 +277,6 @@ public final class RegistryJpaIO {
      return toBuilder().batchSize(batchSize).build();
    }

-    public Write<T> withShards(int shards) {
-      return toBuilder().shards(shards).build();
-    }
-
    /**
     * An optional function that converts the input entities to a form that can be written into the
     * database.
@@ -322,10 +290,7 @@ public final class RegistryJpaIO {
    @Override
    public PCollection<Void> expand(PCollection<T> input) {
      return input
-          .apply(
-              "Shard data " + name(),
-              WithKeys.<Integer, T>of(e -> ThreadLocalRandom.current().nextInt(shards()))
-                  .withKeyType(integers()))
+          .apply("Add key to data " + name(), WithKeys.<Integer, T>of(0).withKeyType(integers()))
          // The call to withShardedKey() is performance critical. The resulting transform ensures
          // that data is spread evenly across all worker threads.
          .apply(
@@ -340,7 +305,6 @@ public final class RegistryJpaIO {
      return new AutoValue_RegistryJpaIO_Write.Builder<T>()
          .name(DEFAULT_NAME)
          .batchSize(DEFAULT_BATCH_SIZE)
-          .shards(DEFAULT_SHARDS)
          .jpaConverter(x -> x);
    }

@@ -351,8 +315,6 @@ public final class RegistryJpaIO {

      abstract Builder<T> batchSize(int batchSize);

-      abstract Builder<T> shards(int jdbcNumConnsHint);
-
      abstract Builder<T> jpaConverter(SerializableFunction<T, Object> jpaConverter);

      abstract Write<T> build();
@@ -14,7 +14,6 @@

 package google.registry.beam.common;

-import google.registry.beam.common.RegistryJpaIO.Write;
 import google.registry.config.RegistryEnvironment;
 import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.persistence.PersistenceModule.JpaTransactionManagerType;
@@ -29,9 +28,9 @@ import org.apache.beam.sdk.options.Description;
 * Defines Nomulus-specific pipeline options, e.g. JPA configurations.
 *
 * <p>When using the Cloud Dataflow runner, users are recommended to set an upper bound on active
- * database connections by setting the pipeline worker options including {@code --maxNumWorkers},
- * {@code workerMachineType}, and {@code numberOfWorkerHarnessThreads}. Please refer to {@link
- * Write#shards()} for more information.
+ * database connections by setting the max number of pipeline worker threads using {@code
+ * --maxNumWorkers} and {@code workerMachineType} for batch pipelines, or {@code --maxNumWorkers}
+ * and {@code --numberOfWorkerHarnessThreads} for streaming pipelines.
 */
 public interface RegistryPipelineOptions extends GcpOptions {

@@ -58,14 +57,6 @@ public interface RegistryPipelineOptions extends GcpOptions {

  void setSqlWriteBatchSize(int sqlWriteBatchSize);

-  @Description(
-      "Number of shards to create out of the data before writing to the SQL database. Please refer "
-          + "to the Javadoc of RegistryJpaIO.Write.shards() for how to choose this value.")
-  @Default.Integer(100)
-  int getSqlWriteShards();
-
-  void setSqlWriteShards(int maxConcurrentSqlWriters);
-
  @DeleteAfterMigration
  @Description(
      "Whether to use self allocated primary IDs when building entities. This should only be used"
@@ -21,7 +21,6 @@ import com.google.common.flogger.FluentLogger;
 import dagger.Lazy;
 import google.registry.config.RegistryEnvironment;
 import google.registry.config.SystemPropertySetter;
-import google.registry.model.AppEngineEnvironment;
 import google.registry.model.IdService;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
@@ -63,10 +62,6 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
        transactionManagerLazy = registryPipelineComponent.getJpaTransactionManager();
    }
    TransactionManagerFactory.setJpaTmOnBeamWorker(transactionManagerLazy::get);
-    // Masquerade all threads as App Engine threads, so we can create Ofy keys in the pipeline. Also
-    // loads all ofy entities.
-    new AppEngineEnvironment("s~" + registryPipelineComponent.getProjectId())
-        .setEnvironmentForAllThreads();
    SystemPropertySetter.PRODUCTION_IMPL.setProperty(PROPERTY, "true");
    // Use self-allocated IDs if requested. Note that this inevitably results in duplicate IDs from
    // multiple workers, which can also collide with existing IDs in the database. So they cannot be
@@ -15,7 +15,6 @@
 package google.registry.beam.invoicing;

 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static google.registry.beam.BeamUtils.getQueryFromFile;
 import static org.apache.beam.sdk.values.TypeDescriptors.strings;

 import com.google.common.flogger.FluentLogger;
@@ -29,6 +28,7 @@ import google.registry.model.registrar.Registrar;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.reporting.billing.BillingModule;
 import google.registry.util.DomainNameUtils;
+import google.registry.util.ResourceUtils;
 import google.registry.util.SqlTemplate;
 import java.io.Serializable;
 import java.time.YearMonth;
@@ -209,7 +209,8 @@ public class InvoicingPipeline implements Serializable {
    YearMonth endMonth = YearMonth.parse(yearMonth).plusMonths(1);
    String queryWithComments =
        SqlTemplate.create(
-                getQueryFromFile(InvoicingPipeline.class, "cloud_sql_billing_events.sql"))
+                ResourceUtils.readResourceUtf8(
+                    InvoicingPipeline.class, "sql/cloud_sql_billing_events.sql"))
            .put("FIRST_TIMESTAMP_OF_MONTH", yearMonth + "-01")
            .put(
                "LAST_TIMESTAMP_OF_MONTH",
@@ -33,7 +33,6 @@ import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import google.registry.util.DateTimeUtils;
 import java.io.Serializable;
-import java.util.concurrent.ThreadLocalRandom;
 import org.apache.beam.sdk.Pipeline;
 import org.apache.beam.sdk.PipelineResult;
 import org.apache.beam.sdk.coders.StringUtf8Coder;
@@ -143,15 +142,13 @@ public class ResaveAllEppResourcesPipeline implements Serializable {
  /** Projects and re-saves all resources with repo IDs provided by the {@link Read}. */
  private <T extends EppResource> void projectAndResaveResources(
      Pipeline pipeline, Class<T> clazz, Read<?, String> repoIdRead) {
-    int numShards = options.getSqlWriteShards();
    int batchSize = options.getSqlWriteBatchSize();
    String className = clazz.getSimpleName();
    pipeline
        .apply("Read " + className, repoIdRead)
        .apply(
            "Shard data for class" + className,
-            WithKeys.<Integer, String>of(e -> ThreadLocalRandom.current().nextInt(numShards))
-                .withKeyType(integers()))
+            WithKeys.<Integer, String>of(0).withKeyType(integers()))
        .apply(
            "Group into batches for class" + className,
            GroupIntoBatches.<Integer, String>ofSize(batchSize).withShardedKey())
@@ -162,7 +162,6 @@ public class Spec11Pipeline implements Serializable {
        RegistryJpaIO.<KV<DomainNameInfo, ThreatMatch>>write()
            .withName(transformId)
            .withBatchSize(options.getSqlWriteBatchSize())
-            .withShards(options.getSqlWriteShards())
            .withJpaConverter(
                (kv) -> {
                  DomainNameInfo domainNameInfo = kv.getKey();
@@ -103,13 +103,19 @@ public final class RegistryConfig {
    @Provides
    @Config("projectId")
    public static String provideProjectId(RegistryConfigSettings config) {
-      return config.appEngine.projectId;
+      return config.gcpProject.projectId;
+    }
+
+    @Provides
+    @Config("projectIdNumber")
+    public static long provideProjectIdNumber(RegistryConfigSettings config) {
+      return config.gcpProject.projectIdNumber;
    }

    @Provides
    @Config("locationId")
    public static String provideLocationId(RegistryConfigSettings config) {
-      return config.appEngine.locationId;
+      return config.gcpProject.locationId;
    }

    /**
@@ -1325,7 +1331,7 @@ public final class RegistryConfig {

  /** Returns the App Engine project ID, which is based off the environment name. */
  public static String getProjectId() {
-    return CONFIG_SETTINGS.get().appEngine.projectId;
+    return CONFIG_SETTINGS.get().gcpProject.projectId;
  }

  /**
@@ -1338,7 +1344,7 @@ public final class RegistryConfig {
  }

  public static boolean areServersLocal() {
-    return CONFIG_SETTINGS.get().appEngine.isLocal;
+    return CONFIG_SETTINGS.get().gcpProject.isLocal;
  }

  /**
@@ -1347,7 +1353,7 @@ public final class RegistryConfig {
   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
   */
  public static URL getDefaultServer() {
-    return makeUrl(CONFIG_SETTINGS.get().appEngine.defaultServiceUrl);
+    return makeUrl(CONFIG_SETTINGS.get().gcpProject.defaultServiceUrl);
  }

  /**
@@ -1356,7 +1362,7 @@ public final class RegistryConfig {
   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
   */
  public static URL getBackendServer() {
-    return makeUrl(CONFIG_SETTINGS.get().appEngine.backendServiceUrl);
+    return makeUrl(CONFIG_SETTINGS.get().gcpProject.backendServiceUrl);
  }

  /**
@@ -1365,7 +1371,7 @@ public final class RegistryConfig {
   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
   */
  public static URL getToolsServer() {
-    return makeUrl(CONFIG_SETTINGS.get().appEngine.toolsServiceUrl);
+    return makeUrl(CONFIG_SETTINGS.get().gcpProject.toolsServiceUrl);
  }

  /**
@@ -1374,7 +1380,7 @@ public final class RegistryConfig {
   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
   */
  public static URL getPubapiServer() {
-    return makeUrl(CONFIG_SETTINGS.get().appEngine.pubapiServiceUrl);
+    return makeUrl(CONFIG_SETTINGS.get().gcpProject.pubapiServiceUrl);
  }

  /** Returns the amount of time a singleton should be cached, before expiring. */
@@ -1450,11 +1456,6 @@ public final class RegistryConfig {
    return CONFIG_SETTINGS.get().registryPolicy.defaultRegistrarWhoisServer;
  }

-  /** Returns the base retry duration that gets doubled after each failure within {@code Ofy}. */
-  public static Duration getBaseOfyRetryDuration() {
-    return Duration.millis(CONFIG_SETTINGS.get().datastore.baseOfyRetryMillis);
-  }
-
  /** Returns the default database transaction isolation. */
  public static String getHibernateConnectionIsolation() {
    return CONFIG_SETTINGS.get().hibernate.connectionIsolation;
@@ -21,12 +21,11 @@ import java.util.Set;
 /** The POJO that YAML config files are deserialized into. */
 public class RegistryConfigSettings {

-  public AppEngine appEngine;
+  public GcpProject gcpProject;
  public GSuite gSuite;
  public OAuth oAuth;
  public CredentialOAuth credentialOAuth;
  public RegistryPolicy registryPolicy;
-  public Datastore datastore;
  public Hibernate hibernate;
  public CloudSql cloudSql;
  public CloudDns cloudDns;
@@ -45,9 +44,10 @@ public class RegistryConfigSettings {
  public DnsUpdate dnsUpdate;
  public PackageMonitoring packageMonitoring;

-  /** Configuration options that apply to the entire App Engine project. */
-  public static class AppEngine {
+  /** Configuration options that apply to the entire GCP project. */
+  public static class GcpProject {
    public String projectId;
+    public long projectIdNumber;
    public String locationId;
    public boolean isLocal;
    public String defaultServiceUrl;
@@ -108,11 +108,6 @@ public class RegistryConfigSettings {
    public boolean requireSslCertificates;
  }

-  /** Configuration for Cloud Datastore. */
-  public static class Datastore {
-    public int baseOfyRetryMillis;
-  }
-
  /** Configuration for Hibernate. */
  public static class Hibernate {
    public String connectionIsolation;
@@ -5,12 +5,14 @@
 # to override some of these values to configure and enable some services used in
 # production environments.

-appEngine:
-  # Globally unique App Engine project ID
+gcpProject:
+  # Globally unique GCP project ID
  projectId: registry-project-id
-  # Location of the App engine project, note that us-central1 and europe-west1 are special in that
-  # they are used without the trailing number in App Engine commands and Google Cloud Console.
-  # See: https://cloud.google.com/appengine/docs/locations
+  # Corresponding project ID number
+  projectIdNumber: 123456789012
+  # Location of the GCP project, note that us-central1 and europe-west1 are special in that
+  # they are used without the trailing number in GCP commands and Google Cloud Console.
+  # See: https://cloud.google.com/appengine/docs/locations as an example
  locationId: registry-location-id

  # whether to use local/test credentials when connecting to the servers
@@ -182,11 +184,6 @@ registryPolicy:
  # should generally be true for production environments, for added security.
  requireSslCertificates: true

-datastore:
-  # Milliseconds that Objectify waits to retry a Datastore transaction (this
-  # doubles after each failure).
-  baseOfyRetryMillis: 100
-
 hibernate:
  # Make 'SERIALIZABLE' the default isolation level to ensure correctness.
  #
@@ -2,7 +2,7 @@
 # This is the same as what Google Registry runs in production, except with
 # placeholders for Google-specific settings.

-appEngine:
+gcpProject:
  projectId: placeholder
  # Set to true if running against local servers (localhost)
  isLocal: false
@@ -10,10 +10,6 @@ registryPolicy:
    Disclaimer line 1.
    Line 2 is this 1.

-datastore:
-  eppResourceIndexBucketsNum: 3
-  baseOfyRetryMillis: 0
-
 caching:
  singletonCacheRefreshSeconds: 0
  domainLabelCachingSeconds: 0
@@ -341,24 +341,4 @@ have been in the database for a certain period of time. -->
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
-
-  <!-- See: https://code.google.com/p/objectify-appengine/wiki/Setup -->
-  <filter>
-    <filter-name>ObjectifyFilter</filter-name>
-    <filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>ObjectifyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
-
-  <!-- Register types with Objectify. -->
-  <filter>
-    <filter-name>OfyFilter</filter-name>
-    <filter-class>google.registry.model.ofy.OfyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>OfyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 </web-app>
@@ -139,24 +139,4 @@
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
-
-  <!-- See: https://code.google.com/p/objectify-appengine/wiki/Setup -->
-  <filter>
-    <filter-name>ObjectifyFilter</filter-name>
-    <filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>ObjectifyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
-
-  <!-- Register types with Objectify. -->
-  <filter>
-    <filter-name>OfyFilter</filter-name>
-    <filter-class>google.registry.model.ofy.OfyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>OfyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 </web-app>
@@ -105,24 +105,4 @@
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
-
-  <!-- See: https://code.google.com/p/objectify-appengine/wiki/Setup -->
-  <filter>
-    <filter-name>ObjectifyFilter</filter-name>
-    <filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>ObjectifyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
-
-  <!-- Register types with Objectify. -->
-  <filter>
-    <filter-name>OfyFilter</filter-name>
-    <filter-class>google.registry.model.ofy.OfyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>OfyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 </web-app>
@@ -48,34 +48,12 @@
    <url-pattern>/_dr/loadtest</url-pattern>
  </servlet-mapping>

-  <!-- The nomulus command line tool uses this endpoint to write to Datastore. -->
-  <servlet>
-    <display-name>Remote API Servlet</display-name>
-    <servlet-name>RemoteApiServlet</servlet-name>
-    <servlet-class>com.google.apphosting.utils.remoteapi.RemoteApiServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-  <servlet-mapping>
-    <servlet-name>RemoteApiServlet</servlet-name>
-    <url-pattern>/remote_api</url-pattern>
-  </servlet-mapping>
-
  <!--  ExecuteEppCommand uses this to execute remotely. -->
  <servlet-mapping>
    <servlet-name>tools-servlet</servlet-name>
    <url-pattern>/_dr/epptool</url-pattern>
  </servlet-mapping>

-  <!-- Pipeline GUI servlets. -->
-  <servlet>
-    <servlet-name>pipeline</servlet-name>
-    <servlet-class>com.google.appengine.tools.pipeline.impl.servlets.PipelineServlet</servlet-class>
-  </servlet>
-  <servlet-mapping>
-    <servlet-name>pipeline</servlet-name>
-    <url-pattern>/_ah/pipeline/*</url-pattern>
-  </servlet-mapping>
-
  <!-- Refreshes all active domains in DNS -->
  <servlet-mapping>
    <servlet-name>tools-servlet</servlet-name>
@@ -135,24 +113,4 @@
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
-
-  <!-- See: https://code.google.com/p/objectify-appengine/wiki/Setup -->
-  <filter>
-    <filter-name>ObjectifyFilter</filter-name>
-    <filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>ObjectifyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
-
-  <!-- Register types with Objectify. -->
-  <filter>
-    <filter-name>OfyFilter</filter-name>
-    <filter-class>google.registry.model.ofy.OfyFilter</filter-class>
-  </filter>
-  <filter-mapping>
-    <filter-name>OfyFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 </web-app>
@@ -682,7 +682,13 @@ public class DomainFlowUtils {
          builder.setAvailIfSupported(true);
          fees =
              pricingLogic
-                  .getCreatePrice(registry, domainNameString, now, years, false, allocationToken)
+                  .getCreatePrice(
+                      registry,
+                      domainNameString,
+                      now,
+                      years,
+                      isAnchorTenant(domainName, allocationToken, Optional.empty()),
+                      allocationToken)
                  .getFees();
        }
        break;
@@ -49,6 +49,7 @@ import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.Flag;
 import google.registry.model.billing.BillingEvent.Reason;
 import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -67,6 +68,7 @@ import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Optional;
 import javax.inject.Inject;
+import org.joda.money.Money;
 import org.joda.time.DateTime;

 /**
@@ -147,6 +149,8 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
    HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
    historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
+    boolean hasPackageToken = existingDomain.getCurrentPackageToken().isPresent();
+    Money renewalPrice = hasPackageToken ? null : existingRecurring.getRenewalPrice().orElse(null);
    Optional<BillingEvent.OneTime> billingEvent =
        transferData.getTransferPeriod().getValue() == 0
            ? Optional.empty()
@@ -162,12 +166,16 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
                                Registry.get(tld),
                                targetId,
                                transferData.getTransferRequestTime(),
-                                existingRecurring)
+                                // When removing a domain from a package it should return to the
+                                // default recurring billing behavior so the existing recurring
+                                // billing event should not be passed in.
+                                hasPackageToken ? null : existingRecurring)
                            .getRenewCost())
                    .setEventTime(now)
                    .setBillingTime(now.plus(Registry.get(tld).getTransferGracePeriodLength()))
                    .setDomainHistoryId(domainHistoryId)
                    .build());
+
    ImmutableList.Builder<ImmutableObject> entitiesToSave = new ImmutableList.Builder<>();
    // If we are within an autorenew grace period, cancel the autorenew billing event and don't
    // increase the registration time, since the transfer subsumes the autorenew's extra year.
@@ -198,8 +206,11 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
            .setTargetId(targetId)
            .setRegistrarId(gainingRegistrarId)
            .setEventTime(newExpirationTime)
-            .setRenewalPriceBehavior(existingRecurring.getRenewalPriceBehavior())
-            .setRenewalPrice(existingRecurring.getRenewalPrice().orElse(null))
+            .setRenewalPriceBehavior(
+                hasPackageToken
+                    ? RenewalPriceBehavior.DEFAULT
+                    : existingRecurring.getRenewalPriceBehavior())
+            .setRenewalPrice(renewalPrice)
            .setRecurrenceEndTime(END_OF_TIME)
            .setDomainHistoryId(domainHistoryId)
            .build();
@@ -243,7 +254,11 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
                    .orElseGet(ImmutableSet::of))
            .setLastEppUpdateTime(now)
            .setLastEppUpdateRegistrarId(registrarId)
+            // Even if the existing domain had a package token, that package token should be removed
+            // on transfer
+            .setCurrentPackageToken(null)
            .build();
+
    Registry registry = Registry.get(existingDomain.getTld());
    DomainHistory domainHistory = buildDomainHistory(newDomain, registry, now, gainingRegistrarId);
    // Create a poll message for the gaining client.
@@ -194,11 +194,21 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
    }
    // If the period is zero, then there is no fee for the transfer.
    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
-    Optional<FeesAndCredits> feesAndCredits =
-        period.getValue() == 0
-            ? Optional.empty()
-            : Optional.of(
-                pricingLogic.getTransferPrice(registry, targetId, now, existingRecurring));
+    Optional<FeesAndCredits> feesAndCredits;
+    if (period.getValue() == 0) {
+      feesAndCredits = Optional.empty();
+    } else if (!existingDomain.getCurrentPackageToken().isPresent()) {
+      feesAndCredits =
+          Optional.of(pricingLogic.getTransferPrice(registry, targetId, now, existingRecurring));
+    } else {
+      // If existing domain is in a package, calculate the transfer price with default renewal price
+      // behavior
+      feesAndCredits =
+          period.getValue() == 0
+              ? Optional.empty()
+              : Optional.of(pricingLogic.getTransferPrice(registry, targetId, now, null));
+    }
+
    if (feesAndCredits.isPresent()) {
      validateFeeChallenge(feeTransfer, feesAndCredits.get());
    }
@@ -24,6 +24,7 @@ import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingEvent.Flag;
 import google.registry.model.billing.BillingEvent.Reason;
 import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.domain.Period;
@@ -144,7 +145,13 @@ public final class DomainTransferUtils {
    return builder
        .add(
            createGainingClientAutorenewEvent(
-                existingRecurring,
+                existingDomain.getCurrentPackageToken().isPresent()
+                    ? existingRecurring
+                        .asBuilder()
+                        .setRenewalPriceBehavior(RenewalPriceBehavior.DEFAULT)
+                        .setRenewalPrice(null)
+                        .build()
+                    : existingRecurring,
                serverApproveNewExpirationTime,
                domainHistoryId,
                targetId,
@@ -1,124 +0,0 @@
-// Copyright 2020 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model;
-
-import com.google.apphosting.api.ApiProxy;
-import com.google.apphosting.api.ApiProxy.Environment;
-import com.google.common.collect.ImmutableMap;
-import google.registry.model.annotations.DeleteAfterMigration;
-import google.registry.model.ofy.ObjectifyService;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.lang.reflect.Proxy;
-
-/**
- * Sets up a fake {@link Environment} so that the following operations can be performed without the
- * Datastore service:
- *
- * <ul>
- *   <li>Create Objectify {@code Keys}.
- *   <li>Instantiate Objectify objects.
- *   <li>Convert Datastore {@code Entities} to their corresponding Objectify objects.
- * </ul>
- *
- * <p>User has the option to specify their desired {@code appId} string, which forms part of an
- * Objectify {@code Key} and is included in the equality check. This feature makes it easy to
- * compare a migrated object in SQL with the original in Objectify.
- *
- * <p>Note that conversion from Objectify objects to Datastore {@code Entities} still requires the
- * Datastore service.
- */
-@DeleteAfterMigration
-public class AppEngineEnvironment {
-
-  private Environment environment;
-
-  /**
-   * Constructor for use by tests.
-   *
-   * <p>All test suites must use the same appId for environments, since when tearing down we do not
-   * clear cached environments in spawned threads. See {@link #unsetEnvironmentForAllThreads} for
-   * more information.
-   */
-  public AppEngineEnvironment() {
-    /**
-     * Use AppEngineExtension's appId here so that ofy and sql entities can be compared with {@code
-     * Objects#equals()}. The choice of this value does not impact functional correctness.
-     */
-    this("test");
-  }
-
-  /** Constructor for use by applications, e.g., BEAM pipelines. */
-  public AppEngineEnvironment(String appId) {
-    environment = createAppEngineEnvironment(appId);
-  }
-
-  public void setEnvironmentForCurrentThread() {
-    ApiProxy.setEnvironmentForCurrentThread(environment);
-    ObjectifyService.initOfy();
-  }
-
-  public void setEnvironmentForAllThreads() {
-    setEnvironmentForCurrentThread();
-    ApiProxy.setEnvironmentFactory(() -> environment);
-  }
-
-  public void unsetEnvironmentForCurrentThread() {
-    ApiProxy.clearEnvironmentForCurrentThread();
-  }
-
-  /**
-   * Unsets the test environment in all threads with best effort.
-   *
-   * <p>This method unsets the environment factory and clears the cached environment in the current
-   * thread (the main test runner thread). We do not clear the cache in spawned threads, even though
-   * they may be reused. This is not a problem as long as the appId stays the same: those threads
-   * are used only in AppEngine or BEAM tests, and expect the presence of an environment.
-   */
-  public void unsetEnvironmentForAllThreads() {
-    unsetEnvironmentForCurrentThread();
-
-    try {
-      Method method = ApiProxy.class.getDeclaredMethod("clearEnvironmentFactory");
-      method.setAccessible(true);
-      method.invoke(null);
-    } catch (NoSuchMethodException | InvocationTargetException | IllegalAccessException e) {
-      throw new RuntimeException(e);
-    }
-  }
-
-  /** Returns a placeholder {@link Environment} that can return hardcoded AppId and Attributes. */
-  private static Environment createAppEngineEnvironment(String appId) {
-    return (Environment)
-        Proxy.newProxyInstance(
-            Environment.class.getClassLoader(),
-            new Class[] {Environment.class},
-            (Object proxy, Method method, Object[] args) -> {
-              switch (method.getName()) {
-                case "getAppId":
-                  return appId;
-                case "getAttributes":
-                  return ImmutableMap.<String, Object>of();
-                default:
-                  throw new UnsupportedOperationException(method.getName());
-              }
-            });
-  }
-
-  /** Returns true if the current thread is in an App Engine Environment. */
-  public static boolean isInAppEngineEnvironment() {
-    return ApiProxy.getCurrentEnvironment() != null;
-  }
-}
@@ -18,13 +18,9 @@ import static com.google.common.base.Suppliers.memoizeWithExpiration;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static java.util.concurrent.TimeUnit.MILLISECONDS;

-import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.Caffeine;
 import com.google.common.base.Supplier;
-import google.registry.model.annotations.DeleteAfterMigration;
 import java.time.Duration;
-import org.checkerframework.checker.nullness.qual.NonNull;
-import org.checkerframework.checker.nullness.qual.Nullable;

 /** Utility methods related to caching Datastore entities. */
 public class CacheUtils {
@@ -77,29 +73,4 @@ public class CacheUtils {
    }
    return caffeine;
  }
-
-  /**
-   * A {@link CacheLoader} that automatically masquerade the background thread where the refresh
-   * action runs in to be an GAE thread.
-   */
-  @DeleteAfterMigration
-  public abstract static class AppEngineEnvironmentCacheLoader<K, V> implements CacheLoader<K, V> {
-
-    private static final AppEngineEnvironment environment = new AppEngineEnvironment();
-
-    @Override
-    public @Nullable V reload(@NonNull K key, @NonNull V oldValue) throws Exception {
-      V value;
-      boolean isMasqueraded = false;
-      if (!AppEngineEnvironment.isInAppEngineEnvironment()) {
-        environment.setEnvironmentForCurrentThread();
-        isMasqueraded = true;
-      }
-      value = load(key);
-      if (isMasqueraded) {
-        environment.unsetEnvironmentForCurrentThread();
-      }
-      return value;
-    }
-  }
 }
@@ -32,7 +32,6 @@ import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import google.registry.config.RegistryConfig;
-import google.registry.model.CacheUtils.AppEngineEnvironmentCacheLoader;
 import google.registry.model.annotations.IdAllocation;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.transfer.TransferData;
@@ -354,7 +353,7 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B
  }

  static final CacheLoader<VKey<? extends EppResource>, EppResource> CACHE_LOADER =
-      new AppEngineEnvironmentCacheLoader<VKey<? extends EppResource>, EppResource>() {
+      new CacheLoader<VKey<? extends EppResource>, EppResource>() {

        @Override
        public EppResource load(VKey<? extends EppResource> key) {
@@ -165,8 +165,8 @@ public final class EppResourceUtils {
    // UpdateAutoTimestamp. For non-mutating uses (info, whois, etc.), this is equivalent to rolling
    // "now" forward to at least the last update on the resource, so that a read right after a write
    // doesn't appear stale. For mutating flows, if we had to roll now forward then the flow will
-    // fail when it tries to save anything via Ofy, since "now" is needed to be > the last update
-    // time for writes.
+    // fail when it tries to save anything, since "now" is needed to be > the last update time for
+    // writes.
    return Optional.of(
        cloneProjectedAtTime(
            resource, latestOf(now, resource.getUpdateTimestamp().getTimestamp())));
@@ -22,7 +22,6 @@ import com.google.appengine.api.datastore.DatastoreServiceFactory;
 import com.google.common.flogger.FluentLogger;
 import google.registry.beam.common.RegistryPipelineWorkerInitializer;
 import google.registry.config.RegistryEnvironment;
-import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.model.common.DatabaseMigrationStateSchedule;
 import google.registry.model.common.DatabaseMigrationStateSchedule.MigrationState;
 import java.math.BigInteger;
@@ -33,7 +32,6 @@ import org.joda.time.DateTime;
 /**
 * Allocates a {@link long} to use as a {@code @Id}, (part) of the primary SQL key for an entity.
 */
-@DeleteAfterMigration
 public final class IdService {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -14,6 +14,7 @@

 package google.registry.model;

+import static com.google.common.collect.Iterables.transform;
 import static com.google.common.collect.Maps.transformValues;
 import static java.lang.annotation.ElementType.FIELD;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
@@ -50,15 +51,6 @@ public abstract class ImmutableObject implements Cloneable {
  @Target(FIELD)
  public @interface DoNotHydrate {}

-  /**
-   * Indicates that the field stores a null value to indicate an empty set. This is also used in
-   * object comparison.
-   */
-  @Documented
-  @Retention(RUNTIME)
-  @Target(FIELD)
-  public @interface EmptySetToNull {}
-
  /**
   * Indicates that the field does not take part in the immutability contract.
   *
@@ -178,7 +170,7 @@ public abstract class ImmutableObject implements Cloneable {
      return transformValues((Map<?, ?>) value, ImmutableObject::hydrate);
    }
    if (value instanceof Collection) {
-      return ((Collection<?>) value).stream().map(ImmutableObject::hydrate);
+      return transform((Collection<?>) value, ImmutableObject::hydrate);
    }
    if (value instanceof ImmutableObject) {
      return ((ImmutableObject) value).toHydratedString();
@@ -15,7 +15,6 @@
 package google.registry.model;

 import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
@@ -30,7 +29,6 @@ import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
 import google.registry.config.RegistryEnvironment;
-import google.registry.model.common.GaeUserIdConverter;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
@@ -77,14 +75,14 @@ public final class OteAccountBuilder {
   * Validation regex for registrar base client IDs (3-14 lowercase alphanumeric characters).
   *
   * <p>The base client ID is appended with numbers to create four different test registrar accounts
-   * (e.g. reg-1, reg-3, reg-4, reg-5).  Registrar client IDs are of type clIDType in eppcom.xsd
+   * (e.g. reg-1, reg-3, reg-4, reg-5). Registrar client IDs are of type clIDType in eppcom.xsd
   * which is limited to 16 characters, hence the limit of 14 here to account for the dash and
   * numbers.
   *
   * <p>The base client ID is also used to generate the OT&E TLDs, hence the restriction to
   * lowercase alphanumeric characters.
   */
-  private static final Pattern REGISTRAR_PATTERN = Pattern.compile("^[a-z0-9]{3,14}$");
+  private static final Pattern REGISTRAR_PATTERN = Pattern.compile("^[a-z\\d]{3,14}$");

  // Durations are short so that registrars can test with quick transfer (etc.) turnaround.
  private static final Duration SHORT_ADD_GRACE_PERIOD = Duration.standardMinutes(60);
@@ -179,17 +177,11 @@ public final class OteAccountBuilder {
   * <p>NOTE: can be called more than once, adding multiple contacts. Each contact will have access
   * to all OT&amp;E Registrars.
   *
-   * @param email the contact email that will have web-console access to all the Registrars. Must be
-   *     from "our G Suite domain" (we have to be able to get its GaeUserId)
+   * @param email the contact/login email that will have web-console access to all the Registrars.
+   *     Must be from "our G Suite domain".
   */
  public OteAccountBuilder addContact(String email) {
-    String gaeUserId =
-        checkNotNull(
-            GaeUserIdConverter.convertEmailAddressToGaeUserId(email),
-            "Email address %s is not associated with any GAE ID",
-            email);
-    registrars.forEach(
-        registrar -> contactsBuilder.add(createRegistrarContact(email, gaeUserId, registrar)));
+    registrars.forEach(registrar -> contactsBuilder.add(createRegistrarContact(email, registrar)));
    return this;
  }

@@ -304,7 +296,7 @@ public final class OteAccountBuilder {
      TldState initialTldState,
      boolean isEarlyAccess,
      int roidSuffix) {
-    String tldNameAlphaNumerical = tldName.replaceAll("[^a-z0-9]", "");
+    String tldNameAlphaNumerical = tldName.replaceAll("[^a-z\\d]", "");
    Optional<PremiumList> premiumList = PremiumListDao.getLatestRevision(DEFAULT_PREMIUM_LIST);
    checkState(premiumList.isPresent(), "Couldn't find premium list %s.", DEFAULT_PREMIUM_LIST);
    Registry.Builder builder =
@@ -348,13 +340,12 @@ public final class OteAccountBuilder {
        .build();
  }

-  private static RegistrarPoc createRegistrarContact(
-      String email, String gaeUserId, Registrar registrar) {
+  private static RegistrarPoc createRegistrarContact(String email, Registrar registrar) {
    return new RegistrarPoc.Builder()
        .setRegistrar(registrar)
        .setName(email)
        .setEmailAddress(email)
-        .setGaeUserId(gaeUserId)
+        .setLoginEmailAddress(email)
        .build();
  }

@@ -1,47 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.annotations;
-
-import com.googlecode.objectify.annotation.Entity;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * Annotation for an Objectify {@link Entity} to indicate that it should not be backed up by the
- * default Datastore backup configuration (it may be backed up by something else).
- */
-@DeleteAfterMigration
-@Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.TYPE)
-public @interface NotBackedUp {
-  Reason reason();
-
-  /** Reasons why a given entity does not need to be be backed up. */
-  enum Reason {
-    /** This entity is transient by design and has only a short-term useful lifetime. */
-    TRANSIENT,
-
-    /** This entity's data is already regularly pulled down from an external source. */
-    EXTERNALLY_SOURCED,
-
-    /** This entity is generated automatically by the app and will be recreated if need be. */
-    AUTO_GENERATED,
-
-    /** Commit log entities are exported separately from the regular backups, by design. */
-    COMMIT_LOGS
-  }
-}
@@ -1,32 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.annotations;
-
-import com.googlecode.objectify.annotation.Entity;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * Annotation for an Objectify {@link Entity} to indicate that it is a "virtual entity".
- *
- * <p>A virtual entity type exists only to define part of the parentage key hierarchy for its child
- * entities, and is never actually persisted and thus has no fields besides its ID field.
- */
-@DeleteAfterMigration
-@Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.TYPE)
-public @interface VirtualEntity {}
@@ -1,73 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.common;
-
-import static com.google.common.base.Preconditions.checkState;
-import static google.registry.model.IdService.allocateId;
-import static google.registry.model.ofy.ObjectifyService.auditedOfy;
-
-import com.google.appengine.api.users.User;
-import com.google.common.base.Splitter;
-import com.googlecode.objectify.annotation.Entity;
-import com.googlecode.objectify.annotation.Id;
-import google.registry.model.ImmutableObject;
-import google.registry.model.annotations.NotBackedUp;
-import google.registry.model.annotations.NotBackedUp.Reason;
-import java.util.List;
-
-/**
- * A helper class to convert email addresses to GAE user ids. It does so by persisting a User
- * object with the email address to Datastore, and then immediately reading it back.
- */
-@Entity
-@NotBackedUp(reason = Reason.TRANSIENT)
-public class GaeUserIdConverter extends ImmutableObject {
-
-  @Id
-  public long id;
-
-  User user;
-
-  /**
-   * Converts an email address to a GAE user id.
-   *
-   * @return Numeric GAE user id (in String form), or null if email address has no GAE id
-   */
-  public static String convertEmailAddressToGaeUserId(String emailAddress) {
-    final GaeUserIdConverter gaeUserIdConverter = new GaeUserIdConverter();
-    gaeUserIdConverter.id = allocateId();
-    List<String> emailParts = Splitter.on('@').splitToList(emailAddress);
-    checkState(emailParts.size() == 2, "'%s' is not a valid email address", emailAddress);
-    gaeUserIdConverter.user = new User(emailAddress, emailParts.get(1));
-
-    try {
-      // Perform these operations in a transactionless context to avoid enlisting in some outer
-      // transaction (if any).
-      auditedOfy()
-          .doTransactionless(
-              () -> {
-                auditedOfy().saveWithoutBackup().entity(gaeUserIdConverter).now();
-                return null;
-              });
-      // The read must be done in its own transaction to avoid reading from the session cache.
-      return auditedOfy()
-          .transactNew(() -> auditedOfy().load().entity(gaeUserIdConverter).now().user.getUserId());
-    } finally {
-      auditedOfy()
-          .doTransactionless(
-              () -> auditedOfy().deleteWithoutBackup().entity(gaeUserIdConverter).now());
-    }
-  }
-}
@@ -124,7 +124,7 @@ public class DomainBase extends EppResource
  String tld;

  /** References to hosts that are the nameservers for the domain. */
-  @EmptySetToNull @Transient Set<VKey<Host>> nsHosts;
+  @Transient Set<VKey<Host>> nsHosts;

  /** Contacts. */
  VKey<Contact> adminContact;
@@ -481,7 +481,8 @@ public class DomainBase extends EppResource
              // Set the speculatively-written new autorenew events as the domain's autorenew
              // events.
              .setAutorenewBillingEvent(transferData.getServerApproveAutorenewEvent())
-              .setAutorenewPollMessage(transferData.getServerApproveAutorenewPollMessage());
+              .setAutorenewPollMessage(transferData.getServerApproveAutorenewPollMessage())
+              .setCurrentPackageToken(null);
      if (transferData.getTransferPeriod().getValue() == 1) {
        // Set the grace period using a key to the pre-scheduled transfer billing event.  Not using
        // GracePeriod.forBillingEvent() here in order to avoid the actual Datastore fetch.
@@ -96,7 +96,6 @@ public class DomainHistory extends HistoryEntry {
              columnList =
                  "domain_history_history_revision_id,domain_history_domain_repo_id,host_repo_id",
              unique = true))
-  @EmptySetToNull
  @Column(name = "host_repo_id")
  Set<VKey<Host>> nsHosts;

@@ -160,7 +159,6 @@ public class DomainHistory extends HistoryEntry {
  @OneToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER, orphanRemoval = true)
  @JoinColumn(name = "historyRevisionId", referencedColumnName = "historyRevisionId")
  @JoinColumn(name = "domainRepoId", referencedColumnName = "domainRepoId")
-  @EmptySetToNull
  Set<DomainTransactionRecord> domainTransactionRecords;

  public Set<DomainTransactionRecord> getDomainTransactionRecords() {
@@ -1,90 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.google.common.collect.ImmutableList.toImmutableList;
-import static com.googlecode.objectify.ObjectifyService.ofy;
-
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Streams;
-import com.googlecode.objectify.Key;
-import com.googlecode.objectify.Result;
-import com.googlecode.objectify.cmd.DeleteType;
-import com.googlecode.objectify.cmd.Deleter;
-import google.registry.model.annotations.DeleteAfterMigration;
-import java.util.Arrays;
-import java.util.stream.Stream;
-
-/**
- * A Deleter that forwards to {@code auditedOfy().delete()}, but can be augmented via subclassing to
- * do custom processing on the keys to be deleted prior to their deletion.
- */
-@DeleteAfterMigration
-abstract class AugmentedDeleter implements Deleter {
-  private final Deleter delegate = ofy().delete();
-
-  /** Extension method to allow this Deleter to do extra work prior to the actual delete. */
-  protected abstract void handleDeletion(Iterable<Key<?>> keys);
-
-  private void handleDeletionStream(Stream<?> entityStream) {
-    handleDeletion(entityStream.map(Key::create).collect(toImmutableList()));
-  }
-
-  @Override
-  public Result<Void> entities(Iterable<?> entities) {
-    handleDeletionStream(Streams.stream(entities));
-    return delegate.entities(entities);
-  }
-
-  @Override
-  public Result<Void> entities(Object... entities) {
-    handleDeletionStream(Arrays.stream(entities));
-    return delegate.entities(entities);
-  }
-
-  @Override
-  public Result<Void> entity(Object entity) {
-    handleDeletionStream(Stream.of(entity));
-    return delegate.entity(entity);
-  }
-
-  @Override
-  public Result<Void> key(Key<?> key) {
-    handleDeletion(ImmutableList.of(key));
-    return delegate.keys(key);
-  }
-
-  @Override
-  public Result<Void> keys(Iterable<? extends Key<?>> keys) {
-    // Magic to convert the type Iterable<? extends Key<?>> (a family of types which allows for
-    // homogeneous iterables of a fixed Key<T> type, e.g. List<Key<Lock>>, and is convenient for
-    // callers) into the type Iterable<Key<?>> (a concrete type of heterogeneous keys, which is
-    // convenient for users).
-    handleDeletion(ImmutableList.copyOf(keys));
-    return delegate.keys(keys);
-  }
-
-  @Override
-  public Result<Void> keys(Key<?>... keys) {
-    handleDeletion(Arrays.asList(keys));
-    return delegate.keys(keys);
-  }
-
-  /** Augmenting this gets ugly; you can always just use keys(Key.create(...)) instead. */
-  @Override
-  public DeleteType type(Class<?> clazz) {
-    throw new UnsupportedOperationException();
-  }
-}
@@ -1,63 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.googlecode.objectify.ObjectifyService.ofy;
-
-import com.google.appengine.api.datastore.Entity;
-import com.google.common.collect.ImmutableList;
-import com.googlecode.objectify.Key;
-import com.googlecode.objectify.Result;
-import com.googlecode.objectify.cmd.Saver;
-import google.registry.model.annotations.DeleteAfterMigration;
-import java.util.Arrays;
-import java.util.Map;
-
-/**
- * A Saver that forwards to {@code ofy().save()}, but can be augmented via subclassing to do custom
- * processing on the entities to be saved prior to their saving.
- */
-@DeleteAfterMigration
-abstract class AugmentedSaver implements Saver {
-  private final Saver delegate = ofy().save();
-
-  /** Extension method to allow this Saver to do extra work prior to the actual save. */
-  protected abstract void handleSave(Iterable<?> entities);
-
-  @Override
-  public <E> Result<Map<Key<E>, E>> entities(Iterable<E> entities) {
-    handleSave(entities);
-    return delegate.entities(entities);
-  }
-
-  @Override
-  @SafeVarargs
-  public final <E> Result<Map<Key<E>, E>> entities(E... entities) {
-    handleSave(Arrays.asList(entities));
-    return delegate.entities(entities);
-  }
-
-  @Override
-  public <E> Result<Key<E>> entity(E entity) {
-    handleSave(ImmutableList.of(entity));
-    return delegate.entity(entity);
-  }
-
-  @Override
-  public Entity toEntity(Object pojo) {
-    // No call to the extension method, since toEntity() doesn't do any actual saving.
-    return delegate.toEntity(pojo);
-  }
-}
@@ -1,84 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.google.common.base.Preconditions.checkState;
-
-import com.google.common.collect.ImmutableSet;
-import google.registry.model.ImmutableObject;
-import google.registry.model.annotations.DeleteAfterMigration;
-import google.registry.util.Clock;
-import java.util.function.Supplier;
-
-/** Wrapper for {@link Supplier} that associates a time with each attempt. */
-@DeleteAfterMigration
-public class CommitLoggedWork<R> implements Runnable {
-
-  private final Supplier<R> work;
-  private final Clock clock;
-
-  /**
-   * Temporary place to store the result of a non-void work.
-   *
-   * <p>We don't want to return the result directly because we are going to try to recover from a
-   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify when
-   * it tries to commit the transaction. When an exception is thrown the return value would be lost,
-   * but sometimes we will be able to determine that we actually succeeded despite the timeout, and
-   * we'll want to get the result.
-   */
-  private R result;
-
-  /**
-   * Temporary place to store the mutations belonging to the commit log manifest.
-   *
-   * <p>These are used along with the manifest to determine whether a transaction succeeded.
-   */
-  protected ImmutableSet<ImmutableObject> mutations = ImmutableSet.of();
-
-  /** Lifecycle marker to track whether {@link #run} has been called. */
-  private boolean runCalled;
-
-  CommitLoggedWork(Supplier<R> work, Clock clock) {
-    this.work = work;
-    this.clock = clock;
-  }
-
-  protected TransactionInfo createNewTransactionInfo() {
-    return new TransactionInfo(clock.nowUtc());
-  }
-
-  boolean hasRun() {
-    return runCalled;
-  }
-
-  R getResult() {
-    checkState(runCalled, "Cannot call getResult() before run()");
-    return result;
-  }
-
-  @Override
-  public void run() {
-    // The previous time will generally be null, except when using transactNew.
-    TransactionInfo previous = Ofy.TRANSACTION_INFO.get();
-    // Set the time to be used for "now" within the transaction.
-    try {
-      Ofy.TRANSACTION_INFO.set(createNewTransactionInfo());
-      result = work.get();
-    } finally {
-      Ofy.TRANSACTION_INFO.set(previous);
-    }
-    runCalled = true;
-  }
-}
@@ -1,140 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.googlecode.objectify.ObjectifyService.factory;
-import static google.registry.util.TypeUtils.hasAnnotation;
-
-import com.google.appengine.api.datastore.AsyncDatastoreService;
-import com.google.appengine.api.datastore.DatastoreServiceConfig;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Streams;
-import com.googlecode.objectify.Key;
-import com.googlecode.objectify.ObjectifyFactory;
-import com.googlecode.objectify.annotation.Entity;
-import com.googlecode.objectify.annotation.EntitySubclass;
-import google.registry.config.RegistryEnvironment;
-import google.registry.model.Buildable;
-import google.registry.model.ImmutableObject;
-import google.registry.model.annotations.DeleteAfterMigration;
-import google.registry.model.common.GaeUserIdConverter;
-
-/**
- * An instance of Ofy, obtained via {@code #auditedOfy()}, should be used to access all persistable
- * objects. The class contains a static initializer to call factory().register(...) on all
- * persistable objects in this package.
- */
-@DeleteAfterMigration
-public class ObjectifyService {
-
-  /** A singleton instance of our Ofy wrapper. */
-  private static final Ofy OFY = new Ofy(null);
-
-  /**
-   * Returns the singleton {@link Ofy} instance, signifying that the caller has been audited for the
-   * Registry 3.0 conversion.
-   */
-  public static Ofy auditedOfy() {
-    return OFY;
-  }
-
-  static {
-    initOfyOnce();
-  }
-
-  /** Ensures that Objectify has been fully initialized. */
-  public static void initOfy() {
-    // This method doesn't actually do anything; it's here so that callers have something to call
-    // to ensure that the static initialization of ObjectifyService has been performed (which Java
-    // guarantees will happen exactly once, before any static methods are invoked).
-    //
-    // See JLS section 12.4: http://docs.oracle.com/javase/specs/jls/se7/html/jls-12.html#jls-12.4
-  }
-
-  /**
-   * Performs static initialization for Objectify to register types and do other setup.
-   *
-   * <p>This method is non-idempotent, so it should only be called exactly once, which is achieved
-   * by calling it from this class's static initializer block.
-   */
-  private static void initOfyOnce() {
-    // Set an ObjectifyFactory that uses our extended ObjectifyImpl.
-    // The "false" argument means that we are not using the v5-style Objectify embedded entities.
-    com.googlecode.objectify.ObjectifyService.setFactory(
-        new ObjectifyFactory(false) {
-          @Override
-          protected AsyncDatastoreService createRawAsyncDatastoreService(
-              DatastoreServiceConfig cfg) {
-            // In the unit test environment, wrap the Datastore service in a proxy that can be used
-            // to examine the number of requests sent to Datastore.
-            AsyncDatastoreService service = super.createRawAsyncDatastoreService(cfg);
-            return RegistryEnvironment.get().equals(RegistryEnvironment.UNITTEST)
-                ? new RequestCapturingAsyncDatastoreService(service)
-                : service;
-          }
-        });
-
-    registerEntityClasses(ImmutableSet.of(GaeUserIdConverter.class));
-  }
-
-  /** Register classes that can be persisted via Objectify as Datastore entities. */
-  private static void registerEntityClasses(
-      ImmutableSet<Class<? extends ImmutableObject>> entityClasses) {
-    // Register all the @Entity classes before any @EntitySubclass classes so that we can check
-    // that every @Entity registration is a new kind and every @EntitySubclass registration is not.
-    // This is future-proofing for Objectify 5.x where the registration logic gets less lenient.
-
-    for (Class<?> clazz :
-        Streams.concat(
-                entityClasses.stream().filter(hasAnnotation(Entity.class)),
-                entityClasses.stream().filter(hasAnnotation(Entity.class).negate()))
-            .collect(toImmutableSet())) {
-      String kind = Key.getKind(clazz);
-      boolean registered = factory().getMetadata(kind) != null;
-      if (clazz.isAnnotationPresent(Entity.class)) {
-        // Objectify silently replaces current registration for a given kind string when a different
-        // class is registered again for this kind. For simplicity's sake, throw an exception on any
-        // re-registration.
-        checkState(
-            !registered,
-            "Kind '%s' already registered, cannot register new @Entity %s",
-            kind,
-            clazz.getCanonicalName());
-      } else if (clazz.isAnnotationPresent(EntitySubclass.class)) {
-        // Ensure that any @EntitySubclass classes have also had their parent @Entity registered,
-        // which Objectify nominally requires but doesn't enforce in 4.x (though it may in 5.x).
-        checkState(
-            registered,
-            "No base entity for kind '%s' registered yet, cannot register new @EntitySubclass %s",
-            kind,
-            clazz.getCanonicalName());
-      }
-      com.googlecode.objectify.ObjectifyService.register(clazz);
-      // Autogenerated ids make the commit log code very difficult since we won't always be able
-      // to create a key for an entity immediately when requesting a save. So, we require such
-      // entities to implement google.registry.model.Buildable as its build() function allocates the
-      // id to the entity.
-      if (factory().getMetadata(clazz).getKeyMetadata().isIdGeneratable()) {
-        checkState(
-            Buildable.class.isAssignableFrom(clazz),
-            "Can't register %s: Entity with autogenerated ids (@Id on a Long) must implement"
-                + " google.registry.model.Buildable.",
-            kind);
-      }
-    }
-  }
-}
@@ -1,374 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.Maps.uniqueIndex;
-import static com.googlecode.objectify.ObjectifyService.ofy;
-import static google.registry.config.RegistryConfig.getBaseOfyRetryDuration;
-
-import com.google.appengine.api.datastore.DatastoreFailureException;
-import com.google.appengine.api.datastore.DatastoreTimeoutException;
-import com.google.appengine.api.taskqueue.TransientFailureException;
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.Streams;
-import com.google.common.flogger.FluentLogger;
-import com.googlecode.objectify.Key;
-import com.googlecode.objectify.Objectify;
-import com.googlecode.objectify.ObjectifyFactory;
-import com.googlecode.objectify.cmd.Deleter;
-import com.googlecode.objectify.cmd.Loader;
-import com.googlecode.objectify.cmd.Saver;
-import google.registry.model.annotations.DeleteAfterMigration;
-import google.registry.model.annotations.NotBackedUp;
-import google.registry.model.annotations.VirtualEntity;
-import google.registry.model.ofy.ReadOnlyWork.KillTransactionException;
-import google.registry.util.Clock;
-import google.registry.util.NonFinalForTesting;
-import google.registry.util.Sleeper;
-import google.registry.util.SystemClock;
-import google.registry.util.SystemSleeper;
-import java.lang.annotation.Annotation;
-import java.util.Objects;
-import java.util.function.Supplier;
-import javax.inject.Inject;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
-
-/**
- * A wrapper around ofy().
- *
- * <p>The primary purpose of this class is to add functionality to support commit logs. It is
- * simpler to wrap {@link Objectify} rather than extend it because this way we can remove some
- * methods that we don't really want exposed and add some shortcuts.
- */
-@DeleteAfterMigration
-public class Ofy {
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  /** Default clock for transactions that don't provide one. */
-  @NonFinalForTesting
-  static Clock clock = new SystemClock();
-
-  /** Default sleeper for transactions that don't provide one. */
-  @NonFinalForTesting
-  static Sleeper sleeper = new SystemSleeper();
-
-  /**
-   * An injected clock that overrides the static clock.
-   *
-   * <p>Eventually the static clock should go away when we are 100% injected, but for now we need to
-   * preserve the old way of overriding the clock in tests by changing the static field.
-   */
-  private final Clock injectedClock;
-
-  /** Retry for 8^2 * 100ms = ~25 seconds. */
-  private static final int NUM_RETRIES = 8;
-
-  @Inject
-  public Ofy(Clock injectedClock) {
-    this.injectedClock = injectedClock;
-  }
-
-  /**
-   * Thread local transaction info. There can only be one active transaction on a thread at a given
-   * time, and this will hold metadata for it.
-   */
-  static final ThreadLocal<TransactionInfo> TRANSACTION_INFO = new ThreadLocal<>();
-
-  /** Returns the wrapped Objectify's ObjectifyFactory. */
-  public ObjectifyFactory factory() {
-    return ofy().factory();
-  }
-
-  /** Clears the session cache. */
-  public void clearSessionCache() {
-    ofy().clear();
-  }
-
-  boolean inTransaction() {
-    return ofy().getTransaction() != null;
-  }
-
-  public void assertInTransaction() {
-    checkState(inTransaction(), "Must be called in a transaction");
-  }
-
-  /** Load from Datastore. */
-  public Loader load() {
-    return ofy().load();
-  }
-
-  /**
-   * Delete, augmented to enroll the deleted entities in a commit log.
-   *
-   * <p>We only allow this in transactions so commit logs can be written in tandem with the delete.
-   */
-  public Deleter delete() {
-    return deleteIgnoringReadOnlyWithBackup();
-  }
-
-  /**
-   * Delete, without any augmentations except to check that we're not saving any virtual entities.
-   *
-   * <p>No backups get written.
-   */
-  public Deleter deleteWithoutBackup() {
-    return deleteIgnoringReadOnlyWithoutBackup();
-  }
-
-  /**
-   * Save, augmented to enroll the saved entities in a commit log and to check that we're not saving
-   * virtual entities.
-   *
-   * <p>We only allow this in transactions so commit logs can be written in tandem with the save.
-   */
-  public Saver save() {
-    return saveIgnoringReadOnlyWithBackup();
-  }
-
-  /**
-   * Save, without any augmentations except to check that we're not saving any virtual entities.
-   *
-   * <p>No backups get written.
-   */
-  public Saver saveWithoutBackup() {
-    return saveIgnoringReadOnlyWithoutBackup();
-  }
-
-  /** Save, ignoring any backups or any read-only settings. */
-  public Saver saveIgnoringReadOnlyWithoutBackup() {
-    return new AugmentedSaver() {
-      @Override
-      protected void handleSave(Iterable<?> entities) {
-        checkProhibitedAnnotations(entities, VirtualEntity.class);
-      }
-    };
-  }
-
-  /** Delete, ignoring any backups or any read-only settings. */
-  public Deleter deleteIgnoringReadOnlyWithoutBackup() {
-    return new AugmentedDeleter() {
-      @Override
-      protected void handleDeletion(Iterable<Key<?>> keys) {
-        checkProhibitedAnnotations(keys, VirtualEntity.class);
-      }
-    };
-  }
-
-  /** Save, ignoring any read-only settings (but still write commit logs). */
-  public Saver saveIgnoringReadOnlyWithBackup() {
-    return new AugmentedSaver() {
-      @Override
-      protected void handleSave(Iterable<?> entities) {
-        assertInTransaction();
-        checkState(
-            Streams.stream(entities).allMatch(Objects::nonNull), "Can't save a null entity.");
-        checkProhibitedAnnotations(entities, NotBackedUp.class, VirtualEntity.class);
-        ImmutableMap<Key<?>, ?> keysToEntities = uniqueIndex(entities, Key::create);
-        TRANSACTION_INFO.get().putSaves(keysToEntities);
-      }
-    };
-  }
-
-  /** Delete, ignoring any read-only settings (but still write commit logs). */
-  public Deleter deleteIgnoringReadOnlyWithBackup() {
-    return new AugmentedDeleter() {
-      @Override
-      protected void handleDeletion(Iterable<Key<?>> keys) {
-        assertInTransaction();
-        checkState(Streams.stream(keys).allMatch(Objects::nonNull), "Can't delete a null key.");
-        checkProhibitedAnnotations(keys, NotBackedUp.class, VirtualEntity.class);
-        TRANSACTION_INFO.get().putDeletes(keys);
-      }
-    };
-  }
-
-  private Clock getClock() {
-    return injectedClock == null ? clock : injectedClock;
-  }
-
-  /** Execute a transaction. */
-  <R> R transact(Supplier<R> work) {
-    // If we are already in a transaction, don't wrap in a CommitLoggedWork.
-    return inTransaction() ? work.get() : transactNew(work);
-  }
-
-  /**
-   * Execute a transaction.
-   *
-   * <p>This overload is used for transactions that don't return a value, formerly implemented using
-   * VoidWork.
-   */
-  void transact(Runnable work) {
-    transact(
-        () -> {
-          work.run();
-          return null;
-        });
-  }
-
-  /** Pause the current transaction (if any) and complete this one before returning to it. */
-  public <R> R transactNew(Supplier<R> work) {
-    // Wrap the Work in a CommitLoggedWork so that we can give transactions a frozen view of time.
-    return transactCommitLoggedWork(new CommitLoggedWork<>(work, getClock()));
-  }
-
-  /**
-   * Pause the current transaction (if any) and complete this one before returning to it.
-   *
-   * <p>This overload is used for transactions that don't return a value, formerly implemented using
-   * VoidWork.
-   */
-  void transactNew(Runnable work) {
-    transactNew(
-        () -> {
-          work.run();
-          return null;
-        });
-  }
-
-  /**
-   * Transact with commit logs and retry with exponential backoff.
-   *
-   * <p>This method is broken out from {@link #transactNew(Supplier)} for testing purposes.
-   */
-  @VisibleForTesting
-  <R> R transactCommitLoggedWork(CommitLoggedWork<R> work) {
-    long baseRetryMillis = getBaseOfyRetryDuration().getMillis();
-    for (long attempt = 0, sleepMillis = baseRetryMillis;
-        true;
-        attempt++, sleepMillis *= 2) {
-      try {
-        ofy().transactNew(() -> {
-          work.run();
-          return null;
-        });
-        return work.getResult();
-      } catch (TransientFailureException
-          | DatastoreTimeoutException
-          | DatastoreFailureException e) {
-        // TransientFailureExceptions come from task queues and always mean nothing committed.
-        // TimestampInversionExceptions are thrown by our code and are always retryable as well.
-        // However, Datastore exceptions might get thrown even if the transaction succeeded.
-        if ((e instanceof DatastoreTimeoutException || e instanceof DatastoreFailureException)
-            && work.hasRun()) {
-          return work.getResult();
-        }
-        if (attempt == NUM_RETRIES) {
-          throw e;  // Give up.
-        }
-        sleeper.sleepUninterruptibly(Duration.millis(sleepMillis));
-        logger.atInfo().withCause(e).log(
-            "Retrying %s, attempt %d.", e.getClass().getSimpleName(), attempt);
-      }
-    }
-  }
-
-  /** A read-only transaction is useful to get strongly consistent reads at a shared timestamp. */
-  <R> R transactNewReadOnly(Supplier<R> work) {
-    ReadOnlyWork<R> readOnlyWork = new ReadOnlyWork<>(work, getClock());
-    try {
-      ofy().transactNew(() -> {
-        readOnlyWork.run();
-        return null;
-      });
-    } catch (TransientFailureException | DatastoreTimeoutException | DatastoreFailureException e) {
-      // These are always retryable for a read-only operation.
-      return transactNewReadOnly(work);
-    } catch (KillTransactionException e) {
-      // Expected; we killed the transaction as a safety measure, and now we can return the result.
-      return readOnlyWork.getResult();
-    }
-    throw new AssertionError();  // How on earth did we get here?
-  }
-
-  void transactNewReadOnly(Runnable work) {
-    transactNewReadOnly(
-        () -> {
-          work.run();
-          return null;
-        });
-  }
-
-  /** Execute some work in a transactionless context. */
-  public <R> R doTransactionless(Supplier<R> work) {
-    try {
-      com.googlecode.objectify.ObjectifyService.push(
-          com.googlecode.objectify.ObjectifyService.ofy().transactionless());
-      return work.get();
-    } finally {
-      com.googlecode.objectify.ObjectifyService.pop();
-    }
-  }
-
-  /**
-   * Execute some work with a fresh session cache.
-   *
-   * <p>This is useful in cases where we want to load the latest possible data from Datastore but
-   * don't need point-in-time consistency across loads and consequently don't need a transaction.
-   * Note that unlike a transaction's fresh session cache, the contents of this cache will be
-   * discarded once the work completes, rather than being propagated into the enclosing session.
-   */
-  public <R> R doWithFreshSessionCache(Supplier<R> work) {
-    try {
-      com.googlecode.objectify.ObjectifyService.push(
-          com.googlecode.objectify.ObjectifyService.factory().begin());
-      return work.get();
-    } finally {
-      com.googlecode.objectify.ObjectifyService.pop();
-    }
-  }
-
-  /** Get the time associated with the start of this particular transaction attempt. */
-  DateTime getTransactionTime() {
-    assertInTransaction();
-    return TRANSACTION_INFO.get().transactionTime;
-  }
-
-  /**
-   * Returns the @Entity-annotated base class for an object that is either an {@code Key<?>} or an
-   * object of an entity class registered with Objectify.
-   */
-  @VisibleForTesting
-  static Class<?> getBaseEntityClassFromEntityOrKey(Object entityOrKey) {
-    // Convert both keys and entities into keys, so that we get consistent behavior in either case.
-    Key<?> key = (entityOrKey instanceof Key<?> ? (Key<?>) entityOrKey : Key.create(entityOrKey));
-    // Get the entity class associated with this key's kind, which should be the base @Entity class
-    // from which the kind name is derived.  Don't be tempted to use getMetadata(String kind) or
-    // getMetadataForEntity(T pojo) instead; the former won't throw an exception for an unknown
-    // kind (it just returns null) and the latter will return the @EntitySubclass if there is one.
-    return ofy().factory().getMetadata(key).getEntityClass();
-  }
-
-  /**
-   * Checks that the base @Entity classes for the provided entities or keys don't have any of the
-   * specified forbidden annotations.
-   */
-  @SafeVarargs
-  private static void checkProhibitedAnnotations(
-      Iterable<?> entitiesOrKeys, Class<? extends Annotation>... annotations) {
-    for (Object entityOrKey : entitiesOrKeys) {
-      Class<?> entityClass = getBaseEntityClassFromEntityOrKey(entityOrKey);
-      for (Class<? extends Annotation> annotation : annotations) {
-        checkArgument(!entityClass.isAnnotationPresent(annotation),
-            "Can't save/delete a @%s entity: %s", annotation.getSimpleName(), entityClass);
-      }
-    }
-  }
-}
@@ -1,44 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import google.registry.model.annotations.DeleteAfterMigration;
-import java.io.IOException;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-
-/** A filter that statically registers types with Objectify. */
-@DeleteAfterMigration
-public class OfyFilter implements Filter {
-
-  @Override
-  public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
-      throws IOException, ServletException {
-    filterChain.doFilter(request, response);
-  }
-
-  @Override
-  public void init(FilterConfig config) {
-    // Make sure that we've registered all types before we do anything else with Objectify.
-    ObjectifyService.initOfy();
-  }
-
-  @Override
-  public void destroy() {}
-}
@@ -1,42 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import google.registry.model.annotations.DeleteAfterMigration;
-import google.registry.util.Clock;
-import java.util.function.Supplier;
-
-/** Wrapper for {@link Supplier} that disallows mutations and fails the transaction at the end. */
-@DeleteAfterMigration
-class ReadOnlyWork<R> extends CommitLoggedWork<R> {
-
-  ReadOnlyWork(Supplier<R> work, Clock clock) {
-    super(work, clock);
-  }
-
-  @Override
-  protected TransactionInfo createNewTransactionInfo() {
-    return super.createNewTransactionInfo().setReadOnly();
-  }
-
-  @Override
-  public void run() {
-    super.run();
-    throw new KillTransactionException();
-  }
-
-  /** Exception used to exit a transaction. */
-  static class KillTransactionException extends RuntimeException {}
-}
@@ -1,194 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static java.util.Collections.synchronizedList;
-
-import com.google.appengine.api.datastore.AsyncDatastoreService;
-import com.google.appengine.api.datastore.DatastoreAttributes;
-import com.google.appengine.api.datastore.Entity;
-import com.google.appengine.api.datastore.Index;
-import com.google.appengine.api.datastore.Index.IndexState;
-import com.google.appengine.api.datastore.Key;
-import com.google.appengine.api.datastore.KeyRange;
-import com.google.appengine.api.datastore.PreparedQuery;
-import com.google.appengine.api.datastore.Query;
-import com.google.appengine.api.datastore.Transaction;
-import com.google.appengine.api.datastore.TransactionOptions;
-import com.google.common.collect.ImmutableList;
-import google.registry.model.annotations.DeleteAfterMigration;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.Future;
-
-/** A proxy for {@link AsyncDatastoreService} that exposes call counts. */
-@DeleteAfterMigration
-public class RequestCapturingAsyncDatastoreService implements AsyncDatastoreService {
-
-  private final AsyncDatastoreService delegate;
-
-  // Each outer lists represents Datastore operations, with inner lists representing the keys or
-  // entities involved in that operation. We use static lists because we care about overall calls to
-  // Datastore, not calls via a specific instance of the service.
-
-  private static List<List<Key>> reads = synchronizedList(new ArrayList<List<Key>>());
-  private static List<List<Key>> deletes = synchronizedList(new ArrayList<List<Key>>());
-  private static List<List<Entity>> puts = synchronizedList(new ArrayList<List<Entity>>());
-
-  RequestCapturingAsyncDatastoreService(AsyncDatastoreService delegate) {
-    this.delegate = delegate;
-  }
-
-  public static List<List<Key>> getReads() {
-    return reads;
-  }
-
-  public static List<List<Key>> getDeletes() {
-    return deletes;
-  }
-
-  public static List<List<Entity>> getPuts() {
-    return puts;
-  }
-
-  @Override
-  public Collection<Transaction> getActiveTransactions() {
-    return delegate.getActiveTransactions();
-  }
-
-  @Override
-  public Transaction getCurrentTransaction() {
-    return delegate.getCurrentTransaction();
-  }
-
-  @Override
-  public Transaction getCurrentTransaction(Transaction transaction) {
-    return delegate.getCurrentTransaction(transaction);
-  }
-
-  @Override
-  public PreparedQuery prepare(Query query) {
-    return delegate.prepare(query);
-  }
-
-  @Override
-  public PreparedQuery prepare(Transaction transaction, Query query) {
-    return delegate.prepare(transaction, query);
-  }
-
-  @Override
-  public Future<KeyRange> allocateIds(String kind, long num) {
-    return delegate.allocateIds(kind, num);
-  }
-
-  @Override
-  public Future<KeyRange> allocateIds(Key parent, String kind, long num) {
-    return delegate.allocateIds(parent, kind, num);
-  }
-
-  @Override
-  public Future<Transaction> beginTransaction() {
-    return delegate.beginTransaction();
-  }
-
-  @Override
-  public Future<Transaction> beginTransaction(TransactionOptions transaction) {
-    return delegate.beginTransaction(transaction);
-  }
-
-  @Override
-  public Future<Void> delete(Key... keys) {
-    deletes.add(ImmutableList.copyOf(keys));
-    return delegate.delete(keys);
-  }
-
-  @Override
-  public Future<Void> delete(Iterable<Key> keys) {
-    deletes.add(ImmutableList.copyOf(keys));
-    return delegate.delete(keys);
-  }
-
-  @Override
-  public Future<Void> delete(Transaction transaction, Key... keys) {
-    deletes.add(ImmutableList.copyOf(keys));
-    return delegate.delete(transaction, keys);
-  }
-
-  @Override
-  public Future<Void> delete(Transaction transaction, Iterable<Key> keys) {
-    deletes.add(ImmutableList.copyOf(keys));
-    return delegate.delete(transaction, keys);
-  }
-
-  @Override
-  public Future<Entity> get(Key key) {
-    reads.add(ImmutableList.of(key));
-    return delegate.get(key);
-  }
-
-  @Override
-  public Future<Map<Key, Entity>> get(Iterable<Key> keys) {
-    reads.add(ImmutableList.copyOf(keys));
-    return delegate.get(keys);
-  }
-
-  @Override
-  public Future<Entity> get(Transaction transaction, Key key) {
-    reads.add(ImmutableList.of(key));
-    return delegate.get(transaction, key);
-  }
-
-  @Override
-  public Future<Map<Key, Entity>> get(Transaction transaction, Iterable<Key> keys) {
-    reads.add(ImmutableList.copyOf(keys));
-    return delegate.get(transaction, keys);
-  }
-
-  @Override
-  public Future<DatastoreAttributes> getDatastoreAttributes() {
-    return delegate.getDatastoreAttributes();
-  }
-
-  @Override
-  public Future<Map<Index, IndexState>> getIndexes() {
-    return delegate.getIndexes();
-  }
-
-  @Override
-  public Future<Key> put(Entity entity) {
-    puts.add(ImmutableList.of(entity));
-    return delegate.put(entity);
-  }
-
-  @Override
-  public Future<List<Key>> put(Iterable<Entity> entities) {
-    puts.add(ImmutableList.copyOf(entities));
-    return delegate.put(entities);
-  }
-
-  @Override
-  public Future<Key> put(Transaction transaction, Entity entity) {
-    puts.add(ImmutableList.of(entity));
-    return delegate.put(transaction, entity);
-  }
-
-  @Override
-  public Future<List<Key>> put(Transaction transaction, Iterable<Entity> entities) {
-    puts.add(ImmutableList.copyOf(entities));
-    return delegate.put(transaction, entities);
-  }
-}
@@ -1,73 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.ofy;
-
-import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.Maps.toMap;
-
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableMap;
-import com.googlecode.objectify.Key;
-import google.registry.model.annotations.DeleteAfterMigration;
-import java.util.Map;
-import org.joda.time.DateTime;
-
-/** Metadata for an {@link Ofy} transaction that saves commit logs. */
-@DeleteAfterMigration
-public class TransactionInfo {
-
-  @VisibleForTesting
-  public enum Delete {
-    SENTINEL
-  }
-
-  /** Logical "now" of the transaction. */
-  DateTime transactionTime;
-
-  /** Whether this is a read-only transaction. */
-  private boolean readOnly;
-
-  /**
-   * Accumulator of save/delete operations performed in transaction.
-   *
-   * <p>The {@link ImmutableMap} builder provides us the benefit of not permitting duplicates.
-   * This allows us to avoid potential race conditions where the same key is mutated twice in a
-   * transaction.
-   */
-  private final ImmutableMap.Builder<Key<?>, Object> changesBuilder = new ImmutableMap.Builder<>();
-
-  TransactionInfo(DateTime now) {
-    this.transactionTime = now;
-  }
-
-  TransactionInfo setReadOnly() {
-    this.readOnly = true;
-    return this;
-  }
-
-  void assertNotReadOnly() {
-    checkState(!readOnly, "This is a read only transaction.");
-  }
-
-  void putSaves(Map<Key<?>, ?> keysToEntities) {
-    assertNotReadOnly();
-    changesBuilder.putAll(keysToEntities);
-  }
-
-  void putDeletes(Iterable<Key<?>> keys) {
-    assertNotReadOnly();
-    changesBuilder.putAll(toMap(keys, k -> Delete.SENTINEL));
-  }
-}
@@ -57,7 +57,7 @@ import javax.persistence.Table;
 * set to true.
 */
@Entity
-@Table(indexes = {@Index(columnList = "gaeUserId", name = "registrarpoc_gae_user_id_idx")})
+@Table(indexes = @Index(columnList = "loginEmailAddress", name = "registrarpoc_login_email_idx"))
@IdClass(RegistrarPocId.class)
 public class RegistrarPoc extends ImmutableObject implements Jsonifiable, UnsafeSerializable {

@@ -89,7 +89,7 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
    }

    Type(String display, boolean required) {
-      this.displayName = display;
+      displayName = display;
      this.required = required;
    }
  }
@@ -97,7 +97,12 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
  /** The name of the contact. */
  String name;

-  /** The email address of the contact. */
+  /**
+   * The contact email address of the contact.
+   *
+   * <p>This is different from the login email which is assgined to the regstrar and cannot be
+   * changed.
+   */
  @Id String emailAddress;

  @Id String registrarId;
@@ -118,13 +123,21 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
  Set<Type> types;

  /**
-   * A GAE user ID allowed to act as this registrar contact.
+   * A GAIA email address that was assigned to the registrar for console login purpose.
   *
-   * <p>This can be derived from a known email address using http://email-to-gae-id.appspot.com.
+   * <p>We used to store the GAE user ID directly to identify the logged-in user in the registrar
+   * console, and relied on a hacky trick with datastore to get the ID from the email address when
+   * creating a {@link RegistrarPoc}. We switched to using the login email directly as each
+   * registrar is assigned a unique email address that is immutable (to them at least), so it is as
+   * good as an identifier as the ID itself, and it allows us to get rid of the datastore
+   * dependency.
   *
-   * @see com.google.appengine.api.users.User#getUserId()
+   * <p>We backfilled all login email addresses for existing {@link RegistrarPoc}s that have a
+   * non-null GAE user ID. The backfill is done by first trying the {@link #emailAddress} field,
+   * then trying {@link #registrarId}+"@known-dasher_domain" and picking the ones that converted to
+   * the existing ID stored in the database.
   */
-  String gaeUserId;
+  String loginEmailAddress;

  /**
   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
@@ -220,8 +233,8 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
    return visibleInDomainWhoisAsAbuse;
  }

-  public String getGaeUserId() {
-    return gaeUserId;
+  public String getLoginEmailAddress() {
+    return loginEmailAddress;
  }

  public Builder asBuilder() {
@@ -258,8 +271,8 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
   * Types: [ADMIN, WHOIS]
   * Visible in WHOIS as Admin contact: Yes
   * Visible in WHOIS as Technical contact: No
-   * GAE-UserID: 1234567890
   * Registrar-Console access: Yes
+   * Login Email Address: person@registry.example
   * }</pre>
   */
  public String toStringMultilinePlainText() {
@@ -289,10 +302,10 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
        .append('\n');
    result
        .append("Registrar-Console access: ")
-        .append(getGaeUserId() != null ? "Yes" : "No")
+        .append(getLoginEmailAddress() != null ? "Yes" : "No")
        .append('\n');
-    if (getGaeUserId() != null) {
-      result.append("GAE-UserID: ").append(getGaeUserId()).append('\n');
+    if (getLoginEmailAddress() != null) {
+      result.append("Login Email Address: ").append(getLoginEmailAddress()).append('\n');
    }
    return result.toString();
  }
@@ -311,7 +324,7 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
        .put("registryLockAllowed", isRegistryLockAllowed())
-        .put("gaeUserId", gaeUserId)
+        .put("loginEmailAddress", loginEmailAddress)
        .build();
  }

@@ -418,8 +431,8 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
      return this;
    }

-    public Builder setGaeUserId(String gaeUserId) {
-      getInstance().gaeUserId = gaeUserId;
+    public Builder setLoginEmailAddress(String loginEmailAddress) {
+      getInstance().loginEmailAddress = loginEmailAddress;
      return this;
    }

@@ -137,7 +137,7 @@ public abstract class HistoryEntry extends ImmutableObject
  @Column(name = "historyXmlBytes")
  byte[] xmlBytes;

-  /** The time the command occurred, represented by the ofy transaction time. */
+  /** The time the command occurred, represented by the transaction time. */
  @Column(nullable = false, name = "historyModificationTime")
  DateTime modificationTime;

@@ -17,12 +17,11 @@ package google.registry.model.smd;
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.io.BaseEncoding.base64;

-import com.google.appengine.api.datastore.Text;
+import com.google.common.base.CharMatcher;
 import google.registry.model.ImmutableObject;
 import javax.xml.bind.annotation.XmlAttribute;
 import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlValue;
-import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;

 /**
 * Encoded data representation of a {@link SignedMark} object.
@@ -35,31 +34,27 @@ public class EncodedSignedMark extends ImmutableObject implements AbstractSigned

  private static final String ENCODING_DEFAULT = "base64";

+  private static final CharMatcher WHITESPACE = CharMatcher.anyOf(" \t\r\n");
+
  /** Encoding used for contained data. Default is {@value #ENCODING_DEFAULT}. */
  @XmlAttribute
  String encoding;

-  /**
-   * Encoded data. This is stored in a Text field rather than a String due to historical reasons,
-   * namely that Objectify cannot autoconvert Strings greater than 500 characters to Text within
-   * {@code Embed} collections.
-   */
-  @XmlValue
-  @XmlJavaTypeAdapter(RemoveWhitespaceTextAdapter.class)
-  Text encodedData;
+  /** Encoded data. */
+  @XmlValue String encodedData;

  public String getEncoding() {
    return firstNonNull(encoding, ENCODING_DEFAULT);
  }

  public String getEncodedData() {
-    return encodedData == null ? "" : encodedData.getValue();
+    return encodedData == null ? "" : WHITESPACE.removeFrom(encodedData);
  }

  public static EncodedSignedMark create(String encoding, String encodedData) {
    EncodedSignedMark instance = new EncodedSignedMark();
    instance.encoding = encoding;
-    instance.encodedData = new Text(encodedData);
+    instance.encodedData = encodedData;
    return instance;
  }

@@ -1,38 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.model.smd;
-
-import com.google.appengine.api.datastore.Text;
-import com.google.common.base.CharMatcher;
-import javax.xml.bind.annotation.adapters.XmlAdapter;
-
-/**
- * {@link XmlAdapter} which removes all whitespace from a string and then converts the result a
- * {@link Text} object.
- */
-public class RemoveWhitespaceTextAdapter extends XmlAdapter<String, Text> {
-
-  private static final CharMatcher WHITESPACE = CharMatcher.anyOf(" \t\r\n");
-
-  @Override
-  public Text unmarshal(String value) {
-    return (value == null) ? null : new Text(WHITESPACE.removeFrom(value));
-  }
-
-  @Override
-  public String marshal(Text t) {
-    return (t == null) ? null : t.getValue();
-  }
-}
@@ -30,6 +30,7 @@ import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
@@ -45,11 +46,14 @@ import google.registry.model.UnsafeSerializable;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
+import google.registry.model.domain.token.AllocationToken;
+import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.persistence.VKey;
 import google.registry.persistence.converter.JodaMoneyType;
 import google.registry.util.Idn;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
@@ -451,6 +455,18 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
  /** An allowlist of hosts allowed to be used on domains on this TLD (ignored if empty). */
  @Nullable Set<String> allowedFullyQualifiedHostNames;

+  /**
+   * References to allocation tokens that can be used on the TLD if no other token is passed in on a
+   * domain create.
+   *
+   * <p>Ordering is important for this field as it will determine which token is used if multiple
+   * tokens in the list are valid for a specific registration. It is crucial that modifications to
+   * this field only modify the entire list contents. Modifications to a single token in the list
+   * (ex: add a token to the list or remove a token from the list) should not be allowed without
+   * resetting the entire list contents.
+   */
+  List<VKey<AllocationToken>> defaultPromoTokens;
+
  public String getTldStr() {
    return tldStr;
  }
@@ -639,6 +655,10 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    return nullToEmptyImmutableCopy(allowedFullyQualifiedHostNames);
  }

+  public ImmutableList<VKey<AllocationToken>> getDefaultPromoTokens() {
+    return nullToEmptyImmutableCopy(defaultPromoTokens);
+  }
+
  @Override
  public Builder asBuilder() {
    return new Builder(clone(this));
@@ -900,6 +920,28 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
      return this;
    }

+    public Builder setDefaultPromoTokens(ImmutableList<VKey<AllocationToken>> promoTokens) {
+      tm().transact(
+              () -> {
+                for (VKey<AllocationToken> tokenKey : promoTokens) {
+                  AllocationToken token = tm().loadByKey(tokenKey);
+                  checkArgument(
+                      token.getTokenType().equals(TokenType.DEFAULT_PROMO),
+                      String.format(
+                          "Token %s has an invalid token type of %s. DefaultPromoTokens must be of"
+                              + " the type DEFAULT_PROMO",
+                          token.getToken(), token.getTokenType()));
+                  checkArgument(
+                      token.getAllowedTlds().contains(getInstance().tldStr),
+                      String.format(
+                          "The token %s is not valid for this TLD. The valid TLDs for it are %s",
+                          token.getToken(), token.getAllowedTlds()));
+                }
+                getInstance().defaultPromoTokens = promoTokens;
+              });
+      return this;
+    }
+
    @Override
    public Registry build() {
      final Registry instance = getInstance();
@@ -75,7 +75,7 @@ public class VKey<T> extends ImmutableObject implements Serializable {
   * Constructs a {@link VKey} for an {@link EppResource } from the string representation.
   *
   * <p>The string representation is obtained from the {@link #stringify()} function and like this:
-   * {@code kind:TestObject@sql:rO0ABXQAA2Zvbw}
+   * {@code kind:SomeEntity@sql:rO0ABXQAA2Zvbw}
   */
  public static <T extends EppResource> VKey<T> createEppVKeyFromString(String keyString) {
    ImmutableMap<String, String> kvs =
@@ -0,0 +1,33 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence.converter;
+
+import google.registry.model.domain.token.AllocationToken;
+import google.registry.persistence.VKey;
+import javax.persistence.Converter;
+
+@Converter(autoApply = true)
+public class AllocationTokenListConverter extends StringListConverterBase<VKey<AllocationToken>> {
+
+  @Override
+  String toString(VKey<AllocationToken> element) {
+    return element.getKey().toString();
+  }
+
+  @Override
+  VKey<AllocationToken> fromString(String value) {
+    return VKey.create(AllocationToken.class, value);
+  }
+}
@@ -149,14 +149,6 @@ public abstract class QueryComposer<T> {
  /**
   * Enum used to specify comparison operations, e.g. {@code where("fieldName", Comparator.NE,
   * "someval")'}.
-   *
-   * <p>These contain values that specify the comparison behavior for both objectify and criteria
-   * queries. For objectify, we provide a string to be appended to the field name in a {@code
-   * filter()} expression. For criteria queries we provide a function that knows how to obtain a
-   * {@link WhereOperator} from a {@link CriteriaBuilder}.
-   *
-   * <p>Note that the objectify strings for comparators other than equality are preceded by a space
-   * because {@code filter()} expects the fieldname to be separated from the operator by a space.
   */
  public enum Comparator {
    /**
@@ -14,7 +14,6 @@

 package google.registry.reporting.icann;

-import com.google.common.io.Resources;
 import google.registry.util.ResourceUtils;
 import google.registry.util.SqlTemplate;
 import org.joda.time.YearMonth;
@@ -28,9 +27,7 @@ public class BasicDnsCountQueryCoordinator implements DnsCountQueryCoordinator {

  @Override
  public String createQuery(YearMonth yearMonth) {
-    return SqlTemplate.create(
-            ResourceUtils.readResourceUtf8(
-                Resources.getResource(this.getClass(), "sql/" + "dns_counts.sql")))
+    return SqlTemplate.create(ResourceUtils.readResourceUtf8(this.getClass(), "sql/dns_counts.sql"))
        .build();
  }

@@ -14,13 +14,10 @@

 package google.registry.request.auth;

-import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;
-import com.google.api.client.http.javanet.NetHttpTransport;
-import com.google.api.client.json.JsonFactory;
 import com.google.appengine.api.oauth.OAuthService;
 import com.google.appengine.api.oauth.OAuthServiceFactory;
+import com.google.auth.oauth2.TokenVerifier;
 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSet;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
@@ -32,12 +29,14 @@ import javax.inject.Singleton;
@Module
 public class AuthModule {

+  private static final String IAP_ISSUER_URL = "https://cloud.google.com/iap";
+
  /** Provides the custom authentication mechanisms (including OAuth). */
  @Provides
  ImmutableList<AuthenticationMechanism> provideApiAuthenticationMechanisms(
      OAuthAuthenticationMechanism oauthAuthenticationMechanism,
-      CookieOAuth2AuthenticationMechanism cookieOAuth2AuthenticationMechanism) {
-    return ImmutableList.of(oauthAuthenticationMechanism, cookieOAuth2AuthenticationMechanism);
+      IapHeaderAuthenticationMechanism iapHeaderAuthenticationMechanism) {
+    return ImmutableList.of(oauthAuthenticationMechanism, iapHeaderAuthenticationMechanism);
  }

  /** Provides the OAuthService instance. */
@@ -48,12 +47,9 @@ public class AuthModule {

  @Provides
  @Singleton
-  GoogleIdTokenVerifier provideGoogleIdTokenVerifier(
-      @Config("allowedOauthClientIds") ImmutableSet<String> allowedOauthClientIds,
-      NetHttpTransport httpTransport,
-      JsonFactory jsonFactory) {
-    return new GoogleIdTokenVerifier.Builder(httpTransport, jsonFactory)
-        .setAudience(allowedOauthClientIds)
-        .build();
+  TokenVerifier provideTokenVerifier(
+      @Config("projectId") String projectId, @Config("projectIdNumber") long projectIdNumber) {
+    String audience = String.format("/projects/%d/apps/%s", projectIdNumber, projectId);
+    return TokenVerifier.newBuilder().setAudience(audience).setIssuer(IAP_ISSUER_URL).build();
  }
 }
@@ -21,6 +21,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.

 import com.google.appengine.api.users.User;
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Ascii;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.flogger.FluentLogger;
@@ -307,7 +308,7 @@ public class AuthenticatedRegistrarAccessor {
    UserAuthInfo userAuthInfo = authResult.userAuthInfo().get();
    if (userAuthInfo.appEngineUser().isPresent()) {
      User user = userAuthInfo.appEngineUser().get();
-      logger.atInfo().log("Checking registrar contacts for user ID %s.", user.getUserId());
+      logger.atInfo().log("Checking registrar contacts for user ID %s.", user.getEmail());

      // Find all registrars that have a registrar contact with this user's ID.
      jpaTm()
@@ -315,11 +316,11 @@ public class AuthenticatedRegistrarAccessor {
              () ->
                  jpaTm()
                      .query(
-                          "SELECT r FROM Registrar r INNER JOIN RegistrarPoc rp ON "
-                              + "r.registrarId = rp.registrarId WHERE rp.gaeUserId = "
-                              + ":gaeUserId AND r.state != :state",
+                          "SELECT r FROM Registrar r INNER JOIN RegistrarPoc rp ON r.registrarId ="
+                              + " rp.registrarId WHERE lower(rp.loginEmailAddress) = :email AND"
+                              + " r.state != :state",
                          Registrar.class)
-                      .setParameter("gaeUserId", user.getUserId())
+                      .setParameter("email", Ascii.toLowerCase(user.getEmail()))
                      .setParameter("state", State.DISABLED)
                      .getResultStream()
                      .forEach(registrar -> builder.put(registrar.getRegistrarId(), Role.OWNER)));
@@ -1,89 +0,0 @@
-// Copyright 2022 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.request.auth;
-
-import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken;
-import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;
-import com.google.common.flogger.FluentLogger;
-import google.registry.model.console.User;
-import google.registry.model.console.UserDao;
-import java.io.IOException;
-import java.security.GeneralSecurityException;
-import java.util.Optional;
-import javax.annotation.Nullable;
-import javax.inject.Inject;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-
-/**
- * A way to authenticate HTTP requests using OAuth2 ID tokens stored in cookies.
- *
- * <p>This is generic to Google Single-Sign-On and doesn't have any ties with Google App Engine.
- */
-public class CookieOAuth2AuthenticationMechanism implements AuthenticationMechanism {
-
-  private static final String ID_TOKEN_COOKIE_NAME = "idToken";
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private final GoogleIdTokenVerifier googleIdTokenVerifier;
-
-  @Inject
-  public CookieOAuth2AuthenticationMechanism(GoogleIdTokenVerifier googleIdTokenVerifier) {
-    this.googleIdTokenVerifier = googleIdTokenVerifier;
-  }
-
-  @Override
-  public AuthResult authenticate(HttpServletRequest request) {
-    String rawIdToken = getRawIdTokenFromCookie(request);
-    if (rawIdToken == null) {
-      return AuthResult.NOT_AUTHENTICATED;
-    }
-    GoogleIdToken googleIdToken;
-    try {
-      googleIdToken = googleIdTokenVerifier.verify(rawIdToken);
-    } catch (IOException | GeneralSecurityException e) {
-      logger.atInfo().withCause(e).log("Error when verifying access token");
-      return AuthResult.NOT_AUTHENTICATED;
-    }
-    // A null token means the provided ID token was invalid or expired
-    if (googleIdToken == null) {
-      logger.atInfo().log("Token %s failed validation", rawIdToken);
-      return AuthResult.NOT_AUTHENTICATED;
-    }
-    String emailAddress = googleIdToken.getPayload().getEmail();
-    Optional<User> maybeUser = UserDao.loadUser(emailAddress);
-    if (!maybeUser.isPresent()) {
-      logger.atInfo().log("No user found for email address %s", emailAddress);
-      return AuthResult.NOT_AUTHENTICATED;
-    }
-    return AuthResult.create(AuthLevel.USER, UserAuthInfo.create(maybeUser.get()));
-  }
-
-  @Nullable
-  private String getRawIdTokenFromCookie(HttpServletRequest request) {
-    if (request.getCookies() == null) {
-      logger.atInfo().log("No cookies passed in request");
-      return null;
-    }
-    for (Cookie cookie : request.getCookies()) {
-      if (cookie.getName().equals(ID_TOKEN_COOKIE_NAME)) {
-        return cookie.getValue();
-      }
-    }
-    logger.atInfo().log("No ID token cookie");
-    return null;
-  }
-}
@@ -0,0 +1,87 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.request.auth;
+
+import com.google.api.client.json.webtoken.JsonWebSignature;
+import com.google.auth.oauth2.TokenVerifier;
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.flogger.FluentLogger;
+import google.registry.config.RegistryEnvironment;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
+import java.util.Optional;
+import javax.annotation.Nullable;
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * A way to authenticate HTTP requests that have gone through the GCP Identity-Aware Proxy.
+ *
+ * <p>When the user logs in, IAP provides a JWT in the <code>X-Goog-IAP-JWT-Assertion</code> header.
+ * This header is included on all requests to IAP-enabled services (which should be all of them that
+ * receive requests from the front end). The token verification libraries ensure that the signed
+ * token has the proper audience and issuer.
+ *
+ * @see <a href="https://cloud.google.com/iap/docs/signed-headers-howto">the documentation on GCP
+ *     IAP's signed headers for more information.</a>
+ */
+public class IapHeaderAuthenticationMechanism implements AuthenticationMechanism {
+
+  private static final String ID_TOKEN_HEADER_NAME = "X-Goog-IAP-JWT-Assertion";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  // A workaround that allows "use" of the IAP-based authenticator when running local testing, i.e.
+  // the RegistryTestServer
+  private static Optional<User> userForTesting = Optional.empty();
+
+  private final TokenVerifier tokenVerifier;
+
+  @Inject
+  public IapHeaderAuthenticationMechanism(TokenVerifier tokenVerifier) {
+    this.tokenVerifier = tokenVerifier;
+  }
+
+  @Override
+  public AuthResult authenticate(HttpServletRequest request) {
+    if (RegistryEnvironment.get().equals(RegistryEnvironment.UNITTEST)
+        && userForTesting.isPresent()) {
+      return AuthResult.create(AuthLevel.USER, UserAuthInfo.create(userForTesting.get()));
+    }
+    String rawIdToken = request.getHeader(ID_TOKEN_HEADER_NAME);
+    if (rawIdToken == null) {
+      return AuthResult.NOT_AUTHENTICATED;
+    }
+    JsonWebSignature token;
+    try {
+      token = tokenVerifier.verify(rawIdToken);
+    } catch (TokenVerifier.VerificationException e) {
+      logger.atInfo().withCause(e).log("Error when verifying access token");
+      return AuthResult.NOT_AUTHENTICATED;
+    }
+    String emailAddress = (String) token.getPayload().get("email");
+    Optional<User> maybeUser = UserDao.loadUser(emailAddress);
+    if (!maybeUser.isPresent()) {
+      logger.atInfo().log("No user found for email address %s", emailAddress);
+      return AuthResult.NOT_AUTHENTICATED;
+    }
+    return AuthResult.create(AuthLevel.USER, UserAuthInfo.create(maybeUser.get()));
+  }
+
+  @VisibleForTesting
+  public static void setUserAuthInfoForTestServer(@Nullable User user) {
+    userForTesting = Optional.ofNullable(user);
+  }
+}
@@ -46,8 +46,8 @@ public final class LordnTaskUtils {
  /** Enqueues a task in the LORDN queue representing a line of CSV for LORDN export. */
  public static void enqueueDomainTask(Domain domain) {
    tm().assertInTransaction();
-    // This method needs to use ofy transactionTime as the Domain's creationTime because
-    // CreationTime isn't yet populated when this method is called during the resource flow.
+    // This method needs to use transactionTime as the Domain's creationTime because CreationTime
+    // isn't yet populated when this method is called during the resource flow.
    String tld = domain.getTld();
    if (domain.getLaunchNotice() == null) {
      getQueue(QUEUE_SUNRISE).add(TaskOptions.Builder
@@ -19,12 +19,12 @@ import static google.registry.config.RegistryConfig.ConfigModule.TmchCaMode.PROD
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static google.registry.util.ResourceUtils.readResourceUtf8;

+import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.collect.ImmutableMap;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.config.RegistryConfig.ConfigModule.TmchCaMode;
 import google.registry.model.CacheUtils;
-import google.registry.model.CacheUtils.AppEngineEnvironmentCacheLoader;
 import google.registry.model.tmch.TmchCrl;
 import google.registry.util.Clock;
 import google.registry.util.X509Utils;
@@ -78,7 +78,7 @@ public final class TmchCertificateAuthority {
  private static final LoadingCache<TmchCaMode, X509CRL> CRL_CACHE =
      CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
          .build(
-              new AppEngineEnvironmentCacheLoader<TmchCaMode, X509CRL>() {
+              new CacheLoader<TmchCaMode, X509CRL>() {
                @Override
                public X509CRL load(final TmchCaMode tmchCaMode) throws GeneralSecurityException {
                  Optional<TmchCrl> storedCrl = TmchCrl.get();
@@ -53,7 +53,7 @@ import javax.inject.Inject;
 * event time is in the past), same as through EPP.
 */
@Parameters(separators = " =", commandDescription = "Acknowledge one-time poll messages.")
-final class AckPollMessagesCommand implements CommandWithRemoteApi {
+final class AckPollMessagesCommand implements Command {

  @Parameter(
      names = {"-c", "--client"},
@@ -16,5 +16,5 @@ package google.registry.tools;

 /** A command that can send HTTP requests to a backend module. */
 public interface CommandWithConnection extends Command {
-  void setConnection(AppEngineConnection connection);
+  void setConnection(ServiceConnection connection);
 }
@@ -1,23 +0,0 @@
-// Copyright 2018 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.tools;
-
-/**
- * Marker interface for commands that use the remote api.
- *
- * <p>Just implementing this is sufficient to use the remote api; {@link RegistryTool} will install
- * it as needed.
- */
-public interface CommandWithRemoteApi extends Command {}
@@ -28,7 +28,7 @@ import org.joda.time.DateTime;

 /** Command to show the count of active domains on a given TLD. */
@Parameters(separators = " =", commandDescription = "Show count of domains on TLD")
-final class CountDomainsCommand implements CommandWithRemoteApi {
+final class CountDomainsCommand implements Command {

  @Parameter(
      names = {"-t", "--tld", "--tlds"},
@@ -33,8 +33,7 @@ import org.joda.time.DateTime;

 /** A command to create a new domain via EPP. */
@Parameters(separators = " =", commandDescription = "Create a new domain via EPP.")
-final class CreateDomainCommand extends CreateOrUpdateDomainCommand
-    implements CommandWithRemoteApi {
+final class CreateDomainCommand extends CreateOrUpdateDomainCommand {

  @Parameter(
      names = "--period",
@@ -27,8 +27,7 @@ import org.joda.money.CurrencyUnit;
 * Base class for specification of command line parameters common to creating and updating premium
 * lists.
 */
-abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
-    implements CommandWithRemoteApi {
+abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
  protected List<String> inputData;
@@ -26,8 +26,7 @@ import javax.annotation.Nullable;
 * Base class for specification of command line parameters common to creating and updating reserved
 * lists.
 */
-public abstract class CreateOrUpdateReservedListCommand extends ConfirmingCommand
-    implements CommandWithRemoteApi {
+public abstract class CreateOrUpdateReservedListCommand extends ConfirmingCommand {

  static final FluentLogger logger = FluentLogger.forEnclosingClass();

@@ -40,7 +40,7 @@ import javax.annotation.Nullable;
 /** Command to create a Registrar. */
@Parameters(separators = " =", commandDescription = "Create new registrar account(s)")
 final class CreateRegistrarCommand extends CreateOrUpdateRegistrarCommand
-    implements CommandWithConnection, CommandWithRemoteApi {
+    implements CommandWithConnection {

  private static final ImmutableSet<RegistryToolEnvironment> ENVIRONMENTS_ALLOWING_GROUP_CREATION =
      ImmutableSet.of(PRODUCTION, SANDBOX, UNITTEST);
@@ -51,10 +51,10 @@ final class CreateRegistrarCommand extends CreateOrUpdateRegistrarCommand
      arity = 1)
  boolean createGoogleGroups = true;

-  private AppEngineConnection connection;
+  private ServiceConnection connection;

  @Override
-  public void setConnection(AppEngineConnection connection) {
+  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
  }

@@ -30,7 +30,7 @@ import java.util.List;
 /** Command to create groups in Google Groups for all contact types for a registrar. */
@Parameters(separators = " =", commandDescription = "Create groups for a registrar.")
 public class CreateRegistrarGroupsCommand extends ConfirmingCommand
-    implements CommandWithConnection, CommandWithRemoteApi {
+    implements CommandWithConnection {

  @Parameter(
      description = "Client identifier(s) of the registrar(s) to create groups for",
@@ -39,10 +39,10 @@ public class CreateRegistrarGroupsCommand extends ConfirmingCommand

  private List<Registrar> registrars = new ArrayList<>();

-  private AppEngineConnection connection;
+  private ServiceConnection connection;

  @Override
-  public void setConnection(AppEngineConnection connection) {
+  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
  }

@@ -66,7 +66,7 @@ public class CreateRegistrarGroupsCommand extends ConfirmingCommand
  }

  /** Calls the server endpoint to create groups for the specified registrar client id. */
-  static void executeOnServer(AppEngineConnection connection, String clientId) throws IOException {
+  static void executeOnServer(ServiceConnection connection, String clientId) throws IOException {
    connection.sendPostRequest(
        CreateGroupsAction.PATH,
        ImmutableMap.of(CreateGroupsAction.CLIENT_ID_PARAM, clientId),
@@ -31,7 +31,7 @@ import java.util.List;

@Parameters(separators = " =", commandDescription = "Send an HTTP command to the nomulus server.")
 class CurlCommand implements CommandWithConnection {
-  private AppEngineConnection connection;
+  private ServiceConnection connection;

  // HTTP Methods that are acceptable for use as values for --method.
  public enum Method {
@@ -76,7 +76,7 @@ class CurlCommand implements CommandWithConnection {
  private Service service;

  @Override
-  public void setConnection(AppEngineConnection connection) {
+  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
  }

@@ -90,7 +90,7 @@ class CurlCommand implements CommandWithConnection {
      throw new IllegalArgumentException("You may not specify a body for a get method.");
    }

-    AppEngineConnection connectionToService = connection.withService(service);
+    ServiceConnection connectionToService = connection.withService(service);
    String response =
        (method == Method.GET)
            ? connectionToService.sendGetRequest(path, ImmutableMap.<String, String>of())
@@ -29,7 +29,7 @@ import javax.annotation.Nullable;
 * in use on a tld.
 */
@Parameters(separators = " =", commandDescription = "Delete a PremiumList.")
-final class DeletePremiumListCommand extends ConfirmingCommand implements CommandWithRemoteApi {
+final class DeletePremiumListCommand extends ConfirmingCommand {

  @Nullable PremiumList premiumList;

@@ -28,7 +28,7 @@ import google.registry.model.tld.label.ReservedListDao;
 * reserved list is currently in use on a tld.
 */
@Parameters(separators = " =", commandDescription = "Deletes a ReservedList from the database.")
-final class DeleteReservedListCommand extends ConfirmingCommand implements CommandWithRemoteApi {
+final class DeleteReservedListCommand extends ConfirmingCommand {

  @Parameter(
      names = {"-n", "--name"},
@@ -31,7 +31,7 @@ import google.registry.persistence.transaction.QueryComposer.Comparator;
 * <p>This command will fail if any domains are currently registered on the TLD.
 */
@Parameters(separators = " =", commandDescription = "Delete a TLD from Datastore.")
-final class DeleteTldCommand extends ConfirmingCommand implements CommandWithRemoteApi {
+final class DeleteTldCommand extends ConfirmingCommand {

  private Registry registry;

@@ -26,7 +26,7 @@ import javax.inject.Inject;

 /** Command to encrypt an escrow deposit. */
@Parameters(separators = " =", commandDescription = "Encrypt an escrow deposit")
-class EncryptEscrowDepositCommand implements CommandWithRemoteApi {
+class EncryptEscrowDepositCommand implements Command {

  @Parameter(
      names = {"-t", "--tld"},
@@ -1,80 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.tools;
-
-import com.google.appengine.api.datastore.Entity;
-import com.google.auto.value.AutoValue;
-import com.google.common.base.Objects;
-
-/**
- * Wraps {@link Entity} for ease of processing in collections.
- *
- * <p>Note that the {@link #hashCode}/{@link #equals} methods are based on both the entity's key and
- * its properties.
- */
-final class EntityWrapper {
-  private static final String TEST_ENTITY_KIND = "TestEntity";
-
-  private final Entity entity;
-
-  EntityWrapper(Entity entity) {
-    this.entity = entity;
-  }
-
-  public Entity getEntity() {
-    return entity;
-  }
-
-  @Override
-  public boolean equals(Object that) {
-    if (that instanceof EntityWrapper) {
-      EntityWrapper thatEntity = (EntityWrapper) that;
-      return entity.equals(thatEntity.entity)
-          && entity.getProperties().equals(thatEntity.entity.getProperties());
-    }
-
-    return false;
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hashCode(entity.getKey(), entity.getProperties());
-  }
-
-  @Override
-  public String toString() {
-    return "EntityWrapper(" + entity + ")";
-  }
-
-  public static EntityWrapper from(int id, Property... properties) {
-    Entity entity = new Entity(TEST_ENTITY_KIND, id);
-    for (Property prop : properties) {
-      entity.setProperty(prop.name(), prop.value());
-    }
-    return new EntityWrapper(entity);
-  }
-
-  @AutoValue
-  abstract static class Property {
-
-    static Property create(String name, Object value) {
-      return new AutoValue_EntityWrapper_Property(name, value);
-    }
-
-    abstract String name();
-
-    abstract Object value();
-  }
-}
@@ -47,8 +47,7 @@ import java.util.Map;
 import java.util.Objects;

 /** A command to execute an epp command. */
-abstract class EppToolCommand extends ConfirmingCommand
-    implements CommandWithConnection, CommandWithRemoteApi {
+abstract class EppToolCommand extends ConfirmingCommand implements CommandWithConnection {

  @Parameter(
      names = {"-u", "--superuser"},
@@ -60,7 +59,7 @@ abstract class EppToolCommand extends ConfirmingCommand

  private List<XmlEppParameters> commands = new ArrayList<>();

-  private AppEngineConnection connection;
+  private ServiceConnection connection;

  static class XmlEppParameters {
    final String clientId;
@@ -97,7 +96,7 @@ abstract class EppToolCommand extends ConfirmingCommand
  }

  @Override
-  public void setConnection(AppEngineConnection connection) {
+  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
  }

@@ -27,7 +27,6 @@ import static java.nio.charset.StandardCharsets.UTF_8;

 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
-import com.google.appengine.tools.remoteapi.RemoteApiException;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Joiner;
 import com.google.common.base.Splitter;
@@ -47,7 +46,6 @@ import google.registry.tools.params.TransitionListParameter.TokenStatusTransitio
 import google.registry.util.CollectionUtils;
 import google.registry.util.DomainNameUtils;
 import google.registry.util.NonFinalForTesting;
-import google.registry.util.Retrier;
 import google.registry.util.StringGenerator;
 import java.io.File;
 import java.io.IOException;
@@ -69,7 +67,7 @@ import org.joda.time.DateTime;
        "Generates and persists the given number of AllocationTokens, "
            + "printing each token to stdout.")
@NonFinalForTesting
-class GenerateAllocationTokensCommand implements CommandWithRemoteApi {
+class GenerateAllocationTokensCommand implements Command {

  @Parameter(
      names = {"--tokens"},
@@ -170,8 +168,6 @@ class GenerateAllocationTokensCommand implements CommandWithRemoteApi {
  @Named("base58StringGenerator")
  StringGenerator stringGenerator;

-  @Inject Retrier retrier;
-
  private static final int BATCH_SIZE = 20;
  private static final Joiner SKIP_NULLS = Joiner.on(',').skipNulls();

@@ -220,8 +216,7 @@ class GenerateAllocationTokensCommand implements CommandWithRemoteApi {
                    return token.build();
                  })
              .collect(toImmutableSet());
-      // Wrap in a retrier to deal with transient 404 errors (thrown as RemoteApiExceptions).
-      tokensSaved += retrier.callWithRetry(() -> saveTokens(tokens), RemoteApiException.class);
+      tokensSaved += saveTokens(tokens);
    } while (tokensSaved < numTokens);
  }

@@ -287,7 +282,7 @@ class GenerateAllocationTokensCommand implements CommandWithRemoteApi {
    if (dryRun) {
      savedTokens = tokens;
    } else {
-      tm().transact(() -> tm().transact(() -> tm().putAll(tokens)));
+      tm().transact(() -> tm().putAll(tokens));
      savedTokens = tm().transact(() -> tm().loadByEntities(tokens));
    }
    savedTokens.forEach(
@@ -42,7 +42,7 @@ import org.json.simple.JSONValue;

 /** Command to generate a report of all DNS data. */
@Parameters(separators = " =", commandDescription = "Generate report of all DNS data in a TLD.")
-final class GenerateDnsReportCommand implements CommandWithRemoteApi {
+final class GenerateDnsReportCommand implements Command {

  @Parameter(
      names = {"-t", "--tld"},
@@ -43,7 +43,7 @@ import org.joda.time.DateTime;
 * be stored in the specified manual subdirectory of the GCS RDE bucket.
 */
@Parameters(separators = " =", commandDescription = "Generate an XML escrow deposit.")
-final class GenerateEscrowDepositCommand implements CommandWithRemoteApi {
+final class GenerateEscrowDepositCommand implements Command {

  @Parameter(
      names = {"-t", "--tld"},
@@ -33,7 +33,7 @@ import org.joda.time.DateTime;

 /** Command to generate a LORDN CSV file for an entire TLD. */
@Parameters(separators = " =", commandDescription = "Generate LORDN CSV file")
-final class GenerateLordnCommand implements CommandWithRemoteApi {
+final class GenerateLordnCommand implements Command {

  @Parameter(
      names = {"-t", "--tld"},
@@ -30,7 +30,7 @@ import org.joda.time.DateTime;

 /** Command to generate zone files. */
@Parameters(separators = " =", commandDescription = "Generate zone files")
-final class GenerateZoneFilesCommand implements CommandWithConnection, CommandWithRemoteApi {
+final class GenerateZoneFilesCommand implements CommandWithConnection {

  @Parameter(
      description = "One or more TLDs to generate zone files for",
@@ -45,10 +45,10 @@ final class GenerateZoneFilesCommand implements CommandWithConnection, CommandWi
      validateWith = DateParameter.class)
  private DateTime exportDate = DateTime.now(UTC).minus(standardMinutes(2)).withTimeAtStartOfDay();

-  private AppEngineConnection connection;
+  private ServiceConnection connection;

  @Override
-  public void setConnection(AppEngineConnection connection) {
+  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
  }

@@ -32,7 +32,7 @@ import java.util.Optional;

 /** Command to show allocation tokens. */
@Parameters(separators = " =", commandDescription = "Show allocation token(s)")
-final class GetAllocationTokenCommand implements CommandWithRemoteApi {
+final class GetAllocationTokenCommand implements Command {

  @Parameter(
      description = "Allocation token(s)",
@@ -34,7 +34,7 @@ import java.nio.file.Paths;
 * currently storing in SQL.
 */
@Parameters(separators = " =", commandDescription = "Download the current claims list")
-final class GetClaimsListCommand implements CommandWithRemoteApi {
+final class GetClaimsListCommand implements Command {

  @Parameter(
      names = {"-o", "--output"},
@@ -23,7 +23,7 @@ import google.registry.model.common.TimedTransitionProperty;
 /** A command to check the current Registry 3.0 migration state of the database. */
@DeleteAfterMigration
@Parameters(separators = " =", commandDescription = "Check current Registry 3.0 migration state")
-public class GetDatabaseMigrationStateCommand implements CommandWithRemoteApi {
+public class GetDatabaseMigrationStateCommand implements Command {

  @Override
  public void run() throws Exception {
@@ -26,7 +26,7 @@ import org.joda.time.DateTime;

 /** Abstract command to print one or more resources to stdout. */
@Parameters(separators = " =")
-abstract class GetEppResourceCommand implements CommandWithRemoteApi {
+abstract class GetEppResourceCommand implements Command {

  @Parameter(
      names = "--read_timestamp",
@@ -60,11 +60,11 @@ abstract class GetEppResourceCommand implements CommandWithRemoteApi {

  @Override
  public void run() {
+    DateTime now = clock.nowUtc();
    if (readTimestamp == null) {
-      readTimestamp = clock.nowUtc();
+      readTimestamp = now;
    }
-    checkArgument(
-        !readTimestamp.isBefore(clock.nowUtc()), "--read_timestamp may not be in the past");
+    checkArgument(!readTimestamp.isBefore(now), "--read_timestamp may not be in the past");
    runAndPrint();
  }
 }
@@ -34,7 +34,7 @@ import org.joda.time.DateTime;
@Parameters(
    separators = " =",
    commandDescription = "Show history entries that occurred in a given time range")
-final class GetHistoryEntriesCommand implements CommandWithRemoteApi {
+final class GetHistoryEntriesCommand implements Command {

  @Parameter(
      names = {"-a", "--after"},
@@ -30,10 +30,9 @@ import org.bouncycastle.openpgp.PGPKeyPair;

 /** Retrieves ASCII-armored secrets from the active {@link Keyring} implementation. */
@Parameters(
-  separators = " =",
-  commandDescription = "Retrieves the value of a secret from the keyring."
-)
-final class GetKeyringSecretCommand implements CommandWithRemoteApi {
+    separators = " =",
+    commandDescription = "Retrieves the value of a secret from the keyring.")
+final class GetKeyringSecretCommand implements Command {

  @Inject Keyring keyring;

@@ -26,7 +26,7 @@ import java.util.stream.Collectors;

 /** Retrieves and prints one or more premium lists. */
@Parameters(separators = " =", commandDescription = "Show one or more premium lists")
-public class GetPremiumListCommand implements CommandWithRemoteApi {
+public class GetPremiumListCommand implements Command {

  @Parameter(description = "Name(s) of the premium list(s) to retrieve", required = true)
  private List<String> mainParameters;
@@ -23,7 +23,7 @@ import java.util.List;

 /** Command to show a registrar record. */
@Parameters(separators = " =", commandDescription = "Show registrar record(s)")
-final class GetRegistrarCommand implements CommandWithRemoteApi {
+final class GetRegistrarCommand implements Command {

  @Parameter(
      description = "Client identifier of the registrar account(s)",
@@ -16,7 +16,7 @@ package google.registry.tools;

 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
-import com.google.appengine.repackaged.com.google.common.collect.Streams;
+import com.google.common.collect.Streams;
 import google.registry.model.tld.label.ReservedList.ReservedListEntry;
 import google.registry.model.tld.label.ReservedListDao;
 import java.util.Comparator;
@@ -24,7 +24,7 @@ import java.util.stream.Collectors;

 /** Retrieves and prints one or more reserved lists. */
@Parameters(separators = " =", commandDescription = "Show one or more reserved lists")
-public class GetReservedListCommand implements CommandWithRemoteApi {
+public class GetReservedListCommand implements Command {

  @Parameter(
      names = {"-n", "--name"},
@@ -23,7 +23,7 @@ import java.util.List;

 /** Command to show a TLD record. */
@Parameters(separators = " =", commandDescription = "Show TLD record(s)")
-final class GetTldCommand implements CommandWithRemoteApi {
+final class GetTldCommand implements Command {

  @Parameter(
      description = "TLD(s) to show",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Lai Jiang	d7e008a4af	Move SQL files to resources from java (#1879 ) This is similar to where we store the SQL files for beam pipelines, and frankly makes more sense. Also streamlined the use of the API to read SQL files from a jar.	2022-12-12 16:32:27 -05:00
Lai Jiang	d943ebd423	Add CodeQL workflow (#1884 ) This is based on #1864. Also removes the LGTM setup as it is turning down.	2022-12-12 15:52:47 -05:00
gbrodman	0ff9543efa	Use standard Java thread creation in Concurrent (#1880 ) The AppEngine thread factory is only useful if we can't create our own (this is no longer the case) or if we need access to AppEngine APIs (this is no longer the case). The Concurrent class is only used by the DNS writer and the CreateGroupsAction.	2022-12-12 15:42:02 -05:00
gbrodman	bb54ace0c0	Change the cookie auth mechanism to use IAP-provided JWTs (#1877 )	2022-12-12 13:51:33 -05:00
Lai Jiang	cfee4713ed	Remove sharding parameter from RegistryJpaIO (#1856 ) This parameter is misleading and does not do what it purports to do. Namely, it does not impact the level of parallelism. Given the input n for this parameter, and m for the batch size, the elements are divided (keyed) into n groups, each of which are then spread evenly across all threads, which are eventually in turn batched into batches with size m: https://github.com/apache/beam/blob/master/sdks/java/core/src/main/java/org/apache/beam/sdk/transforms/GroupIntoBatches.java#L227 This is also evident in the implementation itself, where the ShardedKey is determined by the unique number for a worker/thread combo and the original key: https://github.com/apache/beam/blob/master/sdks/java/core/src/main/java/org/apache/beam/sdk/transforms/GroupIntoBatches.java#L268 Using a more concrete example, suppose we have 100 elements and 10 worker threads, with a target batch size of 5. If the "shard" number is set to 1, we first spread the 100 elements across 10 threads, resulting in 10 elements per thread, each thread then batches the elements into 2 batches of size 5. If the "shard" number is set to 2, the 100 elements are first divided into 2 "shards" of 50 each. Each "shard" is then distributed within the 10 threads, resulting in 5 elements per "shard" per thread. They then get turned into 1 batch per "shard" per thread. In the end, each thread still processes 2 batches, even though they are from 2 different "shards". Therefore this "shard" number does not perform horizontal partitioning that one normally associates with sharding, and provides no performance benefits but rather confuses the user. It is also suggested that using withShardedKey() alone is already sufficient to achieve auto-sharding within the keyed group. There is no need to manually divide the input by keying them differently based on the "shard" number specified: https://youtu.be/jses0W4Zalc?t=967	2022-12-12 11:55:24 -05:00
Lai Jiang	dc7d123f6d	Remove @EmptySetToNull (#1878 ) This annotation was only used in cross-database comparison. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1878) <!-- Reviewable:end -->	2022-12-09 15:07:00 -05:00
Lai Jiang	717334aa89	Remove the mention of ofy in most places (#1872 ) There are still some mentions of ofy after this PR, but mostly in places that would need to be modified later anyway.	2022-12-08 20:38:57 -05:00
Lai Jiang	215a70feba	Remove the use of datastore.Text (#1875 ) There doesn't seem to be any reason to do this any more. This data is no longer persisted to datastore.	2022-12-08 17:17:16 -05:00
Lai Jiang	82f636a21e	Remove some appengine dependencies (#1874 ) Some retriers are no longer needed because transactions are automatically retried by the JPA transaction manager when there's a transient exception. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1874) <!-- Reviewable:end -->	2022-12-08 11:46:47 -05:00
Lai Jiang	87e8cf4165	Remove unused endpoints on the Tools service (#1873 ) We no longer use App Engine Remote API as of #1858. The pipeline endpoint is only for GAE mapreduce, which we stopped doing for a while. TESTED=deployed to alpha and used nomulus tool built from master to connect to the tools service. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1873) <!-- Reviewable:end -->	2022-12-08 11:15:24 -05:00
Lai Jiang	55dcd65ffd	Replace appengine repackaged class with the proper class (#1871 )	2022-12-07 12:35:29 -05:00
Lai Jiang	9088a8d0ac	Remove unused nomulus tool command (#1870 ) This command was used to compare mapreduce-generated escrow deposits with those generated by dataflow. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1870) <!-- Reviewable:end -->	2022-12-07 12:33:38 -05:00
sarahcaseybot	342ae7a5de	Add defaultPromoTokens to Registry (#1850 ) * Add defaultPromoTokens to Registry * Remove flyway files from this PR * Fix merge conflicts * Add back flyway file * Add more info to error messages * Change to a list * Fix javadoc * Change error message * Add note to field declaration	2022-12-06 12:22:43 -05:00
gbrodman	9bf1bf47dd	Take anchor tenant tokens into account in domain check flows (#1868 ) These were always properly reflected in the actual creations, but when running a check flow it would still show a non-zero cost even when using an ANCHOR_TENANT allocation token. This changes it so that we accurately show the $0.00 cost.	2022-12-05 16:14:53 -05:00
gbrodman	6dc1ca0279	Remove usage of the AppEngine remote API (#1858 ) This is only used for contacting Datastore. With the removal of: 1. All standard usages of Datastore 2. Usage of Datastore for allocation of object IDs 3. Usage of Datastore for GAE user IDs we can remove the remote API without affecting functionality. This also allows us to just use SQL for every command since it's lazily supplied. This simplifies the SQL setup and means that we remove a possible situation where we forget the SQL setup.	2022-12-05 13:23:18 -05:00
Lai Jiang	1d7dfe4e07	Remove Ofy (#1863 ) So long, farewell, adios, ciao, sayonara, 再见! TESTED=deployed to alpha and used `nomulus list_tlds` to confirm that the web app can receive and serve requests. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1863) <!-- Reviewable:end -->	2022-12-02 22:28:33 -05:00
Lai Jiang	601aed388c	Fix javadoc build (#1866 ) With newer versions of Java 11, javadoc fails to build due to unknown tags in package-info.java files. These files are not important so we exclude them. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/google/nomulus/1866) <!-- Reviewable:end -->	2022-12-02 13:37:56 -05:00
Weimin Yu	46a7956f77	Fix nomulus GetEppResourceCommand (#1865 ) * Fix nomulus GetEppResourceCommand Fixes a bug in read_timestamp validation. Fixes string representation of Collection fields in Epp Resources.	2022-12-01 18:35:15 -05:00
Lai Jiang	63d3453848	Re-add parenthesis (#1862 ) Apparently IntelliJ doesn't like the extra parens, but our own ErrorProne checks want it for clarity.	2022-11-30 10:45:12 -05:00
Lai Jiang	85272a30a2	Use login email instead of GAE user ID for RegistrarPoc (#1852 ) Switch to using the login email address instead of GAE user ID to identify console users. The primary use cases are: 1) When the user logged in the registrar console, need to figure out which registrars they have access to (in AuthenticatedReigstrarAccess). 2) When a user tries to apply a registry lock, needs to know if they can (in RegistryLockGetAction). Both cases are tested in alpha with a personal email address to ensure it does not get the permission due to being a GAE admin account. Also verified that the soy templates includes the hidden login email form field instead of GAE user ID when registrars are displayed on the console; and consequently when a contact update is posted to the server, the login email is part of the JSON payload. Even though it does not look like it is used in any way by RegistrarSettingsAction, which receives the POST request. Like GAE user ID, the field is hidden, so cannot be changed by the user from the console, it is also not used to identify the RegistryPoc entity, whose composite keys are the contact email and the registrar ID associated with it. The login email address is backfilled for all RegistrarPocs that have a non-null GAE user ID. The backfilled addresses converted to the same ID as stored in the database.	2022-11-29 17:16:19 -05:00
gbrodman	e3944d5d52	Rename AppEngineConnection to ServiceConnection (#1857 ) It doesn't actually use any App Engine libraries or code -- it's just a generic connection with authentication to a service. This also involves changing that block of config to be "gcpProject" instead of "appEngine" since it's more generic. Note: this will require an internal PR as well to change the corresponding private config block	2022-11-28 15:46:51 -05:00
sarahcaseybot	124a3d83ba	Remove package token on manual transfer approval (#1819 ) * Remove package token on manual transfer approval * remove extra variables * Add back white space * Don't overwrite existingDomain * Format fixes, use available helper variables * Use PACKAGE allocation tokens in tests * Refactor * Fix merge conflicts * Dont overwrite existingRecurring	2022-11-28 15:30:55 -05:00
Pavlo Tkach	99cbb862dc	remove jpaTransactionManagerType rde pipeline param (#1860 )	2022-11-28 12:13:45 -05:00
sarahcaseybot	4e3151ca02	Remove names from packages on automatic transfers (#1827 ) * Remove names from packages on automatic transfers * Add more tests * Remove unneccesary local variable * Eliminate unnecessary api call * Reformat if blocks * Don't overwrite existingRecurring	2022-11-23 15:48:59 -05:00
sarahcaseybot	292bc788fb	Flyway files for defaultPromoTokens (#1851 ) * Flyway files for defaultPromoTokens * Add flyway file	2022-11-22 14:51:08 -05:00
Lai Jiang	b1ee1e8441	Delete DatastoreEntityExtension (#1855 ) All entities are Ofy key free and therefore do not this hack any more.	2022-11-21 14:39:01 -05:00