Don't allow a list of the empty string in List<String> fields (#2011)

If the user does, e.g. `--allowed_nameservers=` (or contact ids) that
shouldn't mean a list consisting solely of the empty string.

Using this parameter / converter allows us to ensure that lists of
strings look reasonable.

core/build.gradle

@@ -693,10 +693,6 @@ createToolTask(
     'google.registry.tools.DevTool',
     sourceSets.nonprod)
 
-createToolTask(
-    'createSyntheticDomainHistories',
-    'google.registry.tools.javascrap.CreateSyntheticDomainHistoriesPipeline')
-
 project.tasks.create('generateSqlSchema', JavaExec) {
   classpath = sourceSets.nonprod.runtimeClasspath
   main = 'google.registry.tools.DevTool'
@@ -753,8 +749,8 @@ if (environment == 'alpha') {
           ],
       expandBilling      :
           [
-              mainClass: 'google.registry.beam.billing.ExpandRecurringBillingEventsPipeline',
-              metaData : 'google/registry/beam/expand_recurring_billing_events_pipeline_metadata.json'
+              mainClass: 'google.registry.beam.billing.ExpandBillingRecurrencesPipeline',
+              metaData : 'google/registry/beam/expand_billing_recurrences_pipeline_metadata.json'
           ],
       rde                :
           [
@@ -766,6 +762,11 @@ if (environment == 'alpha') {
               mainClass: 'google.registry.beam.resave.ResaveAllEppResourcesPipeline',
               metaData: 'google/registry/beam/resave_all_epp_resources_pipeline_metadata.json'
           ],
+      wipeOutContactHistoryPii:
+              [
+                      mainClass: 'google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline',
+                      metaData: 'google/registry/beam/wipe_out_contact_history_pii_pipeline_metadata.json'
+              ],
   ]
   project.tasks.create("stageBeamPipelines") {
     doLast {

core/src/main/java/google/registry/batch/BatchModule.java

@@ -105,22 +105,27 @@ public class BatchModule {
   }
 
   @Provides
-  @Parameter(ExpandRecurringBillingEventsAction.PARAM_START_TIME)
+  @Parameter(ExpandBillingRecurrencesAction.PARAM_START_TIME)
   static Optional<DateTime> provideStartTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(
-        req, ExpandRecurringBillingEventsAction.PARAM_START_TIME);
+    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_START_TIME);
   }
 
   @Provides
-  @Parameter(ExpandRecurringBillingEventsAction.PARAM_END_TIME)
+  @Parameter(ExpandBillingRecurrencesAction.PARAM_END_TIME)
   static Optional<DateTime> provideEndTime(HttpServletRequest req) {
-    return extractOptionalDatetimeParameter(req, ExpandRecurringBillingEventsAction.PARAM_END_TIME);
+    return extractOptionalDatetimeParameter(req, ExpandBillingRecurrencesAction.PARAM_END_TIME);
   }
 
   @Provides
-  @Parameter(ExpandRecurringBillingEventsAction.PARAM_ADVANCE_CURSOR)
+  @Parameter(WipeOutContactHistoryPiiAction.PARAM_CUTOFF_TIME)
+  static Optional<DateTime> provideCutoffTime(HttpServletRequest req) {
+    return extractOptionalDatetimeParameter(req, WipeOutContactHistoryPiiAction.PARAM_CUTOFF_TIME);
+  }
+
+  @Provides
+  @Parameter(ExpandBillingRecurrencesAction.PARAM_ADVANCE_CURSOR)
   static boolean provideAdvanceCursor(HttpServletRequest req) {
-    return extractBooleanParameter(req, ExpandRecurringBillingEventsAction.PARAM_ADVANCE_CURSOR);
+    return extractBooleanParameter(req, ExpandBillingRecurrencesAction.PARAM_ADVANCE_CURSOR);
   }
 
   @Provides

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -37,7 +37,7 @@ import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.EppResourceUtils;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;

core/src/main/java/google/registry/batch/ExpandBillingRecurrencesAction.java

@@ -29,11 +29,11 @@ import com.google.api.services.dataflow.model.LaunchFlexTemplateRequest;
 import com.google.api.services.dataflow.model.LaunchFlexTemplateResponse;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
-import google.registry.beam.billing.ExpandRecurringBillingEventsPipeline;
+import google.registry.beam.billing.ExpandBillingRecurrencesPipeline;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.config.RegistryEnvironment;
-import google.registry.model.billing.BillingEvent.OneTime;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.Cursor;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
@@ -46,20 +46,20 @@ import javax.inject.Inject;
 import org.joda.time.DateTime;
 
 /**
- * An action that kicks off a {@link ExpandRecurringBillingEventsPipeline} dataflow job to expand
- * {@link Recurring} billing events into synthetic {@link OneTime} events.
+ * An action that kicks off a {@link ExpandBillingRecurrencesPipeline} dataflow job to expand {@link
+ * BillingRecurrence} billing events into synthetic {@link BillingEvent} events.
  */
 @Action(
     service = Action.Service.BACKEND,
-    path = "/_dr/task/expandRecurringBillingEvents",
+    path = "/_dr/task/expandBillingRecurrences",
     auth = Auth.AUTH_INTERNAL_OR_ADMIN)
-public class ExpandRecurringBillingEventsAction implements Runnable {
+public class ExpandBillingRecurrencesAction implements Runnable {
 
   public static final String PARAM_START_TIME = "startTime";
   public static final String PARAM_END_TIME = "endTime";
   public static final String PARAM_ADVANCE_CURSOR = "advanceCursor";
 
-  private static final String PIPELINE_NAME = "expand_recurring_billing_events_pipeline";
+  private static final String PIPELINE_NAME = "expand_billing_recurrences_pipeline";
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   @Inject Clock clock;
@@ -97,7 +97,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
   @Inject Response response;
 
   @Inject
-  ExpandRecurringBillingEventsAction() {}
+  ExpandBillingRecurrencesAction() {}
 
   @Override
   public void run() {
@@ -133,7 +133,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
                     .put("advanceCursor", Boolean.toString(advanceCursor))
                     .build());
     logger.atInfo().log(
-        "Launching recurring billing event expansion pipeline for event time range [%s, %s)%s.",
+        "Launching billing recurrence expansion pipeline for event time range [%s, %s)%s.",
         startTime,
         endTime,
         isDryRun ? " in dry run mode" : advanceCursor ? "" : " without advancing the cursor");
@@ -152,7 +152,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
       response.setStatus(SC_OK);
       response.setPayload(
           String.format(
-              "Launched recurring billing event expansion pipeline: %s",
+              "Launched billing recurrence expansion pipeline: %s",
               launchResponse.getJob().getId()));
     } catch (IOException e) {
       logger.atWarning().withCause(e).log("Pipeline Launch failed");

core/src/main/java/google/registry/batch/WipeOutContactHistoryPiiAction.java

@@ -14,31 +14,39 @@
 
 package google.registry.batch;
 
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.apache.http.HttpStatus.SC_INTERNAL_SERVER_ERROR;
-import static org.apache.http.HttpStatus.SC_OK;
+import static google.registry.batch.BatchModule.PARAM_DRY_RUN;
+import static google.registry.beam.BeamUtils.createJobName;
+import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static javax.servlet.http.HttpServletResponse.SC_OK;
 
-import com.google.common.annotations.VisibleForTesting;
+import com.google.api.services.dataflow.Dataflow;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateParameter;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateRequest;
+import com.google.api.services.dataflow.model.LaunchFlexTemplateResponse;
+import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
+import google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryEnvironment;
 import google.registry.model.contact.ContactHistory;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
+import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.stream.Stream;
+import java.io.IOException;
+import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 
 /**
- * An action that wipes out Personal Identifiable Information (PII) fields of {@link ContactHistory}
- * entities.
+ * An action that launches {@link WipeOutContactHistoryPiiPipeline} to wipe out Personal
+ * Identifiable Information (PII) fields of {@link ContactHistory} entities.
  *
- * <p>ContactHistory entities should be retained in the database for only certain amount of time.
- * This periodic wipe out action only applies to SQL.
+ * <p>{@link ContactHistory} entities should be retained in the database for only certain amount of
+ * time.
  */
 @Action(
     service = Service.BACKEND,
@@ -47,90 +55,89 @@ import org.joda.time.DateTime;
 public class WipeOutContactHistoryPiiAction implements Runnable {
 
   public static final String PATH = "/_dr/task/wipeOutContactHistoryPii";
+  public static final String PARAM_CUTOFF_TIME = "wipeoutTime";
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final String PIPELINE_NAME = "wipe_out_contact_history_pii_pipeline";
+
   private final Clock clock;
-  private final Response response;
+  private final boolean isDryRun;
+  private final Optional<DateTime> maybeCutoffTime;
   private final int minMonthsBeforeWipeOut;
-  private final int wipeOutQueryBatchSize;
+  private final String stagingBucketUrl;
+  private final String projectId;
+  private final String jobRegion;
+  private final Dataflow dataflow;
+  private final Response response;
 
   @Inject
   public WipeOutContactHistoryPiiAction(
       Clock clock,
+      @Parameter(PARAM_DRY_RUN) boolean isDryRun,
+      @Parameter(PARAM_CUTOFF_TIME) Optional<DateTime> maybeCutoffTime,
       @Config("minMonthsBeforeWipeOut") int minMonthsBeforeWipeOut,
-      @Config("wipeOutQueryBatchSize") int wipeOutQueryBatchSize,
+      @Config("beamStagingBucketUrl") String stagingBucketUrl,
+      @Config("projectId") String projectId,
+      @Config("defaultJobRegion") String jobRegion,
+      Dataflow dataflow,
       Response response) {
     this.clock = clock;
-    this.response = response;
+    this.isDryRun = isDryRun;
+    this.maybeCutoffTime = maybeCutoffTime;
     this.minMonthsBeforeWipeOut = minMonthsBeforeWipeOut;
-    this.wipeOutQueryBatchSize = wipeOutQueryBatchSize;
+    this.stagingBucketUrl = stagingBucketUrl;
+    this.projectId = projectId;
+    this.jobRegion = jobRegion;
+    this.dataflow = dataflow;
+    this.response = response;
   }
 
   @Override
   public void run() {
     response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
+    DateTime cutoffTime =
+        maybeCutoffTime.orElse(clock.nowUtc().minusMonths(minMonthsBeforeWipeOut));
+    LaunchFlexTemplateParameter launchParameter =
+        new LaunchFlexTemplateParameter()
+            .setJobName(
+                createJobName(
+                    String.format(
+                        "contact-history-pii-wipeout-%s",
+                        cutoffTime.toString("yyyy-MM-dd't'HH-mm-ss'z'")),
+                    clock))
+            .setContainerSpecGcsPath(
+                String.format("%s/%s_metadata.json", stagingBucketUrl, PIPELINE_NAME))
+            .setParameters(
+                ImmutableMap.of(
+                    "registryEnvironment",
+                    RegistryEnvironment.get().name(),
+                    "cutoffTime",
+                    cutoffTime.toString("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"),
+                    "isDryRun",
+                    Boolean.toString(isDryRun)));
+    logger.atInfo().log(
+        "Launching Beam pipeline to wipe out all PII of contact history entities prior to %s%s.",
+        cutoffTime, " in dry run mode");
     try {
-      int totalNumOfWipedEntities = 0;
-      DateTime wipeOutTime = clock.nowUtc().minusMonths(minMonthsBeforeWipeOut);
-      logger.atInfo().log(
-          "About to wipe out all PII of contact history entities prior to %s.", wipeOutTime);
-
-      int numOfWipedEntities = 0;
-      do {
-        numOfWipedEntities =
-            tm().transact(
-                    () ->
-                        wipeOutContactHistoryData(
-                            getNextContactHistoryEntitiesWithPiiBatch(wipeOutTime)));
-        totalNumOfWipedEntities += numOfWipedEntities;
-      } while (numOfWipedEntities > 0);
-      String msg =
-          String.format(
-              "Done. Wiped out PII of %d ContactHistory entities in total.",
-              totalNumOfWipedEntities);
-      logger.atInfo().log(msg);
-      response.setPayload(msg);
+      LaunchFlexTemplateResponse launchResponse =
+          dataflow
+              .projects()
+              .locations()
+              .flexTemplates()
+              .launch(
+                  projectId,
+                  jobRegion,
+                  new LaunchFlexTemplateRequest().setLaunchParameter(launchParameter))
+              .execute();
+      logger.atInfo().log("Got response: %s", launchResponse.getJob().toPrettyString());
       response.setStatus(SC_OK);
-
-    } catch (Exception e) {
-      logger.atSevere().withCause(e).log(
-          "Exception thrown during the process of wiping out contact history PII.");
-      response.setStatus(SC_INTERNAL_SERVER_ERROR);
       response.setPayload(
           String.format(
-              "Exception thrown during the process of wiping out contact history PII with cause"
-                  + ": %s",
-              e));
+              "Launched contact history PII wipeout pipeline: %s",
+              launchResponse.getJob().getId()));
+    } catch (IOException e) {
+      logger.atWarning().withCause(e).log("Pipeline Launch failed");
+      response.setStatus(SC_INTERNAL_SERVER_ERROR);
+      response.setPayload(String.format("Pipeline launch failed: %s", e.getMessage()));
     }
   }
-
-  /**
-   * Returns a stream of up to {@link #wipeOutQueryBatchSize} {@link ContactHistory} entities
-   * containing PII that are prior to @param wipeOutTime.
-   */
-  @VisibleForTesting
-  Stream<ContactHistory> getNextContactHistoryEntitiesWithPiiBatch(DateTime wipeOutTime) {
-    // email is one of the required fields in EPP, meaning it's initially not null.
-    // Therefore, checking if it's null is one way to avoid processing contact history entities
-    // that have been processed previously. Refer to RFC 5733 for more information.
-    return tm().query(
-            "FROM ContactHistory WHERE modificationTime < :wipeOutTime " + "AND email IS NOT NULL",
-            ContactHistory.class)
-        .setParameter("wipeOutTime", wipeOutTime)
-        .setMaxResults(wipeOutQueryBatchSize)
-        .getResultStream();
-  }
-
-  /** Wipes out the PII of each of the {@link ContactHistory} entities in the stream. */
-  @VisibleForTesting
-  int wipeOutContactHistoryData(Stream<ContactHistory> contactHistoryEntities) {
-    AtomicInteger numOfEntities = new AtomicInteger(0);
-    contactHistoryEntities.forEach(
-        contactHistoryEntity -> {
-          tm().update(contactHistoryEntity.asBuilder().wipeOutPii().build());
-          numOfEntities.incrementAndGet();
-        });
-    logger.atInfo().log(
-        "Wiped out all PII fields of %d ContactHistory entities.", numOfEntities.get());
-    return numOfEntities.get();
-  }
 }

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -64,7 +64,7 @@ public abstract class BillingEvent implements Serializable {
           "amount",
           "flags");
 
-  /** Returns the unique ID for the {@code OneTime} associated with this event. */
+  /** Returns the unique ID for the {@code BillingEvent} associated with this event. */
   abstract long id();
 
   /** Returns the UTC DateTime this event becomes billable. */

core/src/main/java/google/registry/beam/billing/ExpandBillingRecurrencesPipeline.java

@@ -38,17 +38,17 @@ import google.registry.flows.custom.CustomLogicModule;
 import google.registry.flows.domain.DomainPricingLogic;
 import google.registry.flows.domain.DomainPricingLogic.AllocationTokenInvalidForPremiumNameException;
 import google.registry.model.ImmutableObject;
-import google.registry.model.billing.BillingEvent.Cancellation;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.OneTime;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingCancellation;
+import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.Cursor;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.Period;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.util.Clock;
 import google.registry.util.SystemClock;
@@ -77,48 +77,49 @@ import org.apache.beam.sdk.values.PDone;
 import org.joda.time.DateTime;
 
 /**
- * Definition of a Dataflow Flex pipeline template, which expands {@link Recurring} to {@link
- * OneTime} when an autorenew occurs within the given time frame.
+ * Definition of a Dataflow Flex pipeline template, which expands {@link BillingRecurrence} to
+ * {@link BillingEvent} when an autorenew occurs within the given time frame.
  *
  * <p>This pipeline works in three stages:
  *
  * <ul>
- *   <li>Gather the {@link Recurring}s that are in scope for expansion. The exact condition of
- *       {@link Recurring}s to include can be found in {@link #getRecurringsInScope(Pipeline)}.
- *   <li>Expand the {@link Recurring}s to {@link OneTime} (and corresponding {@link DomainHistory})
- *       that fall within the [{@link #startTime}, {@link #endTime}) window, excluding those that
- *       are already present (to make this pipeline idempotent when running with the same parameters
- *       multiple times, either in parallel or in sequence). The {@link Recurring} is also updated
- *       with the information on when it was last expanded, so it would not be in scope for
- *       expansion until at least a year later.
+ *   <li>Gather the {@link BillingRecurrence}s that are in scope for expansion. The exact condition
+ *       of {@link BillingRecurrence}s to include can be found in {@link
+ *       #getRecurrencesInScope(Pipeline)}.
+ *   <li>Expand the {@link BillingRecurrence}s to {@link BillingEvent} (and corresponding {@link
+ *       DomainHistory}) that fall within the [{@link #startTime}, {@link #endTime}) window,
+ *       excluding those that are already present (to make this pipeline idempotent when running
+ *       with the same parameters multiple times, either in parallel or in sequence). The {@link
+ *       BillingRecurrence} is also updated with the information on when it was last expanded, so it
+ *       would not be in scope for expansion until at least a year later.
  *   <li>If the cursor for billing events should be advanced, advance it to {@link #endTime} after
  *       all of the expansions in the previous step is done, only when it is currently at {@link
  *       #startTime}.
  * </ul>
  *
- * <p>Note that the creation of new {@link OneTime} and {@link DomainHistory} is done speculatively
- * as soon as its event time is in scope for expansion (i.e. within the window of operation). If a
- * domain is subsequently cancelled during the autorenew grace period, a {@link Cancellation} would
- * have been created to cancel the {@link OneTime} out. Similarly, a {@link DomainHistory} for the
- * delete will be created which negates the effect of the speculatively created {@link
- * DomainHistory}, specifically for the transaction records. Both the {@link OneTime} and {@link
- * DomainHistory} will only be used (and cancelled out) when the billing time becomes effective,
- * which is after the grace period, when the cancellations would have been written, if need be. This
- * is no different from what we do with manual renewals or normal creates, where entities are always
- * created for the action regardless of whether their effects will be negated later due to
- * subsequent actions within respective grace periods.
+ * <p>Note that the creation of new {@link BillingEvent} and {@link DomainHistory} is done
+ * speculatively as soon as its event time is in scope for expansion (i.e. within the window of
+ * operation). If a domain is subsequently cancelled during the autorenew grace period, a {@link
+ * BillingCancellation} would have been created to cancel the {@link BillingEvent} out. Similarly, a
+ * {@link DomainHistory} for the delete will be created which negates the effect of the
+ * speculatively created {@link DomainHistory}, specifically for the transaction records. Both the
+ * {@link BillingEvent} and {@link DomainHistory} will only be used (and cancelled out) when the
+ * billing time becomes effective, which is after the grace period, when the cancellations would
+ * have been written, if need be. This is no different from what we do with manual renewals or
+ * normal creates, where entities are always created for the action regardless of whether their
+ * effects will be negated later due to subsequent actions within respective grace periods.
  *
  * <p>To stage this template locally, run {@code ./nom_build :core:sBP --environment=alpha \
  * --pipeline=expandBilling}.
  *
  * <p>Then, you can run the staged template via the API client library, gCloud or a raw REST call.
  *
- * @see Cancellation#forGracePeriod
+ * @see BillingCancellation#forGracePeriod
  * @see google.registry.flows.domain.DomainFlowUtils#createCancelingRecords
  * @see <a href="https://cloud.google.com/dataflow/docs/guides/templates/using-flex-templates">Using
  *     Flex Templates</a>
  */
-public class ExpandRecurringBillingEventsPipeline implements Serializable {
+public class ExpandBillingRecurrencesPipeline implements Serializable {
 
   private static final long serialVersionUID = -5827984301386630194L;
 
@@ -128,7 +129,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
 
   static {
     PipelineComponent pipelineComponent =
-        DaggerExpandRecurringBillingEventsPipeline_PipelineComponent.create();
+        DaggerExpandBillingRecurrencesPipeline_PipelineComponent.create();
     domainPricingLogic = pipelineComponent.domainPricingLogic();
     batchSize = pipelineComponent.batchSize();
   }
@@ -139,8 +140,8 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
   private final DateTime endTime;
   private final boolean isDryRun;
   private final boolean advanceCursor;
-  private final Counter recurringsInScopeCounter =
-      Metrics.counter("ExpandBilling", "Recurrings in scope for expansion");
+  private final Counter recurrencesInScopeCounter =
+      Metrics.counter("ExpandBilling", "Recurrences in scope for expansion");
   // Note that this counter is only accurate when running in dry run mode. Because SQL persistence
   // is a side effect and not idempotent, a transaction to save OneTimes could be successful but the
   // transform that contains it could be still be retried, rolling back the counter increment. The
@@ -150,8 +151,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
   private final Counter oneTimesToExpandCounter =
       Metrics.counter("ExpandBilling", "OneTimes that would be expanded");
 
-  ExpandRecurringBillingEventsPipeline(
-      ExpandRecurringBillingEventsPipelineOptions options, Clock clock) {
+  ExpandBillingRecurrencesPipeline(ExpandBillingRecurrencesPipelineOptions options, Clock clock) {
     startTime = DateTime.parse(options.getStartTime());
     endTime = DateTime.parse(options.getEndTime());
     checkArgument(
@@ -170,16 +170,16 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
   }
 
   void setupPipeline(Pipeline pipeline) {
-    PCollection<KV<Integer, Long>> recurringIds = getRecurringsInScope(pipeline);
-    PCollection<Void> expanded = expandRecurrings(recurringIds);
+    PCollection<KV<Integer, Long>> recurrenceIds = getRecurrencesInScope(pipeline);
+    PCollection<Void> expanded = expandRecurrences(recurrenceIds);
     if (!isDryRun && advanceCursor) {
       advanceCursor(expanded);
     }
   }
 
-  PCollection<KV<Integer, Long>> getRecurringsInScope(Pipeline pipeline) {
+  PCollection<KV<Integer, Long>> getRecurrencesInScope(Pipeline pipeline) {
     return pipeline.apply(
-        "Read all Recurrings in scope",
+        "Read all Recurrences in scope",
         // Use native query because JPQL does not support timestamp arithmetics.
         RegistryJpaIO.read(
                 "SELECT billing_recurrence_id "
@@ -203,7 +203,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
                     endTime.minusYears(1)),
                 true,
                 (BigInteger id) -> {
-                  recurringsInScopeCounter.inc();
+                  recurrencesInScopeCounter.inc();
                   // Note that because all elements are mapped to the same dummy key, the next
                   // batching transform will effectively be serial. This however does not matter for
                   // our use case because the elements were obtained from a SQL read query, which
@@ -222,13 +222,13 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
             .withCoder(KvCoder.of(VarIntCoder.of(), VarLongCoder.of())));
   }
 
-  private PCollection<Void> expandRecurrings(PCollection<KV<Integer, Long>> recurringIds) {
-    return recurringIds
+  private PCollection<Void> expandRecurrences(PCollection<KV<Integer, Long>> recurrenceIds) {
+    return recurrenceIds
         .apply(
             "Group into batches",
             GroupIntoBatches.<Integer, Long>ofSize(batchSize).withShardedKey())
         .apply(
-            "Expand and save Recurrings into OneTimes and corresponding DomainHistories",
+            "Expand and save Recurrences into OneTimes and corresponding DomainHistories",
             MapElements.into(voids())
                 .via(
                     element -> {
@@ -237,7 +237,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
                               () -> {
                                 ImmutableSet.Builder<ImmutableObject> results =
                                     new ImmutableSet.Builder<>();
-                                ids.forEach(id -> expandOneRecurring(id, results));
+                                ids.forEach(id -> expandOneRecurrence(id, results));
                                 if (!isDryRun) {
                                   tm().putAll(results.build());
                                 }
@@ -246,14 +246,16 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
                     }));
   }
 
-  private void expandOneRecurring(Long recurringId, ImmutableSet.Builder<ImmutableObject> results) {
-    Recurring recurring = tm().loadByKey(Recurring.createVKey(recurringId));
+  private void expandOneRecurrence(
+      Long recurrenceId, ImmutableSet.Builder<ImmutableObject> results) {
+    BillingRecurrence billingRecurrence =
+        tm().loadByKey(BillingRecurrence.createVKey(recurrenceId));
 
-    // Determine the complete set of EventTimes this recurring event should expand to within
+    // Determine the complete set of EventTimes this recurrence event should expand to within
     // [max(recurrenceLastExpansion + 1 yr, startTime), min(recurrenceEndTime, endTime)).
     //
-    // This range should always be legal for recurrings that are returned from the query. However,
-    // it is possible that the recurring has changed between when the read transformation occurred
+    // This range should always be legal for recurrences that are returned from the query. However,
+    // it is possible that the recurrence has changed between when the read transformation occurred
     // and now. This could be caused by some out-of-process mutations (such as a domain deletion
     // closing out a previously open-ended recurrence), or more subtly, Beam could execute the same
     // work multiple times due to transient communication issues between workers and the scheduler.
@@ -264,24 +266,26 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
     // to work on the same batch. The second worker would see a new recurrence_last_expansion that
     // causes the range to be illegal.
     //
-    // The best way to handle any unexpected behavior is to simply drop the recurring from
+    // The best way to handle any unexpected behavior is to simply drop the recurrence from
     // expansion, if its new state still calls for an expansion, it would be picked up the next time
     // the pipeline runs.
     ImmutableSet<DateTime> eventTimes;
     try {
       eventTimes =
           ImmutableSet.copyOf(
-              recurring
+              billingRecurrence
                   .getRecurrenceTimeOfYear()
                   .getInstancesInRange(
                       Range.closedOpen(
-                          latestOf(recurring.getRecurrenceLastExpansion().plusYears(1), startTime),
-                          earliestOf(recurring.getRecurrenceEndTime(), endTime))));
+                          latestOf(
+                              billingRecurrence.getRecurrenceLastExpansion().plusYears(1),
+                              startTime),
+                          earliestOf(billingRecurrence.getRecurrenceEndTime(), endTime))));
     } catch (IllegalArgumentException e) {
       return;
     }
-    Domain domain = tm().loadByKey(Domain.createVKey(recurring.getDomainRepoId()));
-    Registry tld = Registry.get(domain.getTld());
+    Domain domain = tm().loadByKey(Domain.createVKey(billingRecurrence.getDomainRepoId()));
+    Tld tld = Tld.get(domain.getTld());
 
     // Find the times for which the OneTime billing event are already created, making this expansion
     // idempotent. There is no need to match to the domain repo ID as the cancellation matching
@@ -292,7 +296,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
                     "SELECT eventTime FROM BillingEvent WHERE cancellationMatchingBillingEvent ="
                         + " :key",
                     DateTime.class)
-                .setParameter("key", recurring.createVKey())
+                .setParameter("key", billingRecurrence.createVKey())
                 .getResultList());
 
     Set<DateTime> eventTimesToExpand = difference(eventTimes, existingEventTimes);
@@ -301,7 +305,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
       return;
     }
 
-    DateTime recurrenceLastExpansionTime = recurring.getRecurrenceLastExpansion();
+    DateTime recurrenceLastExpansionTime = billingRecurrence.getRecurrenceLastExpansion();
 
     // Create new OneTime and DomainHistory for EventTimes that needs to be expanded.
     for (DateTime eventTime : eventTimesToExpand) {
@@ -333,7 +337,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
       DomainHistory historyEntry =
           new DomainHistory.Builder()
               .setBySuperuser(false)
-              .setRegistrarId(recurring.getRegistrarId())
+              .setRegistrarId(billingRecurrence.getRegistrarId())
               .setModificationTime(tm().getTransactionTime())
               .setDomain(domain)
               .setPeriod(Period.create(1, YEARS))
@@ -385,35 +389,43 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
       // It is OK to always create a OneTime, even though the domain might be deleted or transferred
       // later during autorenew grace period, as a cancellation will always be written out in those
       // instances.
-      OneTime oneTime = null;
+      BillingEvent billingEvent = null;
       try {
-        oneTime =
-            new OneTime.Builder()
+        billingEvent =
+            new BillingEvent.Builder()
                 .setBillingTime(billingTime)
-                .setRegistrarId(recurring.getRegistrarId())
+                .setRegistrarId(billingRecurrence.getRegistrarId())
                 // Determine the cost for a one-year renewal.
                 .setCost(
                     domainPricingLogic
                         .getRenewPrice(
-                            tld, recurring.getTargetId(), eventTime, 1, recurring, Optional.empty())
+                            tld,
+                            billingRecurrence.getTargetId(),
+                            eventTime,
+                            1,
+                            billingRecurrence,
+                            Optional.empty())
                         .getRenewCost())
                 .setEventTime(eventTime)
-                .setFlags(union(recurring.getFlags(), Flag.SYNTHETIC))
+                .setFlags(union(billingRecurrence.getFlags(), Flag.SYNTHETIC))
                 .setDomainHistory(historyEntry)
                 .setPeriodYears(1)
-                .setReason(recurring.getReason())
+                .setReason(billingRecurrence.getReason())
                 .setSyntheticCreationTime(endTime)
-                .setCancellationMatchingBillingEvent(recurring)
-                .setTargetId(recurring.getTargetId())
+                .setCancellationMatchingBillingEvent(billingRecurrence)
+                .setTargetId(billingRecurrence.getTargetId())
                 .build();
       } catch (AllocationTokenInvalidForPremiumNameException e) {
         // This should not be reached since we are not using an allocation token
         return;
       }
-      results.add(oneTime);
+      results.add(billingEvent);
     }
     results.add(
-        recurring.asBuilder().setRecurrenceLastExpansion(recurrenceLastExpansionTime).build());
+        billingRecurrence
+            .asBuilder()
+            .setRecurrenceLastExpansion(recurrenceLastExpansionTime)
+            .build());
   }
 
   private PDone advanceCursor(PCollection<Void> persisted) {
@@ -456,11 +468,11 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
   }
 
   public static void main(String[] args) {
-    PipelineOptionsFactory.register(ExpandRecurringBillingEventsPipelineOptions.class);
-    ExpandRecurringBillingEventsPipelineOptions options =
+    PipelineOptionsFactory.register(ExpandBillingRecurrencesPipelineOptions.class);
+    ExpandBillingRecurrencesPipelineOptions options =
         PipelineOptionsFactory.fromArgs(args)
             .withValidation()
-            .as(ExpandRecurringBillingEventsPipelineOptions.class);
+            .as(ExpandBillingRecurrencesPipelineOptions.class);
     // Hardcode the transaction level to be at serializable we do not want concurrent runs of the
     // pipeline for the same window to create duplicate OneTimes. This ensures that the set of
     // existing OneTimes do not change by the time new OneTimes are inserted within a transaction.
@@ -468,7 +480,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
     // Per PostgreSQL, serializable isolation level does not introduce any blocking beyond that
     // present in  repeatable read other than some overhead related to monitoring possible
     // serializable anomalies. Therefore, in most cases, since each worker of the same job works on
-    // a different set of recurrings, it is not possible for their execution order to affect
+    // a different set of recurrences, it is not possible for their execution order to affect
     // serialization outcome, and the performance penalty should be minimum when using serializable
     // compared to using repeatable read.
     //
@@ -480,7 +492,7 @@ public class ExpandRecurringBillingEventsPipeline implements Serializable {
     // See: https://www.postgresql.org/docs/current/transaction-iso.html
     options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_SERIALIZABLE);
     Pipeline pipeline = Pipeline.create(options);
-    new ExpandRecurringBillingEventsPipeline(options, new SystemClock()).run(pipeline);
+    new ExpandBillingRecurrencesPipeline(options, new SystemClock()).run(pipeline);
   }
 
   @Singleton

core/src/main/java/google/registry/beam/billing/ExpandBillingRecurrencesPipelineOptions.java

@@ -18,7 +18,7 @@ import google.registry.beam.common.RegistryPipelineOptions;
 import org.apache.beam.sdk.options.Default;
 import org.apache.beam.sdk.options.Description;
 
-public interface ExpandRecurringBillingEventsPipelineOptions extends RegistryPipelineOptions {
+public interface ExpandBillingRecurrencesPipelineOptions extends RegistryPipelineOptions {
   @Description(
       "The inclusive lower bound of on the range of event times that will be expanded, in ISO 8601"
           + " format")

core/src/main/java/google/registry/beam/billing/InvoicingPipeline.java

@@ -22,8 +22,8 @@ import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey;
 import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
 import google.registry.beam.common.RegistryJpaIO;
 import google.registry.beam.common.RegistryJpaIO.Read;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.OneTime;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingEvent;
 import google.registry.model.registrar.Registrar;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.reporting.billing.BillingModule;
@@ -86,29 +86,30 @@ public class InvoicingPipeline implements Serializable {
 
   void setupPipeline(Pipeline pipeline) {
     options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_READ_COMMITTED);
-    PCollection<BillingEvent> billingEvents = readFromCloudSql(options, pipeline);
+    PCollection<google.registry.beam.billing.BillingEvent> billingEvents =
+        readFromCloudSql(options, pipeline);
     saveInvoiceCsv(billingEvents, options);
     saveDetailedCsv(billingEvents, options);
   }
 
-  static PCollection<BillingEvent> readFromCloudSql(
+  static PCollection<google.registry.beam.billing.BillingEvent> readFromCloudSql(
       InvoicingPipelineOptions options, Pipeline pipeline) {
-    Read<Object[], BillingEvent> read =
-        RegistryJpaIO.<Object[], BillingEvent>read(
+    Read<Object[], google.registry.beam.billing.BillingEvent> read =
+        RegistryJpaIO.<Object[], google.registry.beam.billing.BillingEvent>read(
                 makeCloudSqlQuery(options.getYearMonth()), false, row -> parseRow(row).orElse(null))
-            .withCoder(SerializableCoder.of(BillingEvent.class));
+            .withCoder(SerializableCoder.of(google.registry.beam.billing.BillingEvent.class));
 
-    PCollection<BillingEvent> billingEventsWithNulls =
+    PCollection<google.registry.beam.billing.BillingEvent> billingEventsWithNulls =
         pipeline.apply("Read BillingEvents from Cloud SQL", read);
 
     // Remove null billing events
     return billingEventsWithNulls.apply(Filter.by(Objects::nonNull));
   }
 
-  private static Optional<BillingEvent> parseRow(Object[] row) {
-    OneTime oneTime = (OneTime) row[0];
+  private static Optional<google.registry.beam.billing.BillingEvent> parseRow(Object[] row) {
+    BillingEvent billingEvent = (BillingEvent) row[0];
     Registrar registrar = (Registrar) row[1];
-    CurrencyUnit currency = oneTime.getCost().getCurrencyUnit();
+    CurrencyUnit currency = billingEvent.getCost().getCurrencyUnit();
     if (!registrar.getBillingAccountMap().containsKey(currency)) {
       logger.atSevere().log(
           "Registrar %s does not have a product account key for the currency unit: %s",
@@ -117,37 +118,40 @@ public class InvoicingPipeline implements Serializable {
     }
 
     return Optional.of(
-        BillingEvent.create(
-            oneTime.getId(),
-            oneTime.getBillingTime(),
-            oneTime.getEventTime(),
+        google.registry.beam.billing.BillingEvent.create(
+            billingEvent.getId(),
+            billingEvent.getBillingTime(),
+            billingEvent.getEventTime(),
             registrar.getRegistrarId(),
             registrar.getBillingAccountMap().get(currency),
             registrar.getPoNumber().orElse(""),
-            DomainNameUtils.getTldFromDomainName(oneTime.getTargetId()),
-            oneTime.getReason().toString(),
-            oneTime.getTargetId(),
-            oneTime.getDomainRepoId(),
-            Optional.ofNullable(oneTime.getPeriodYears()).orElse(0),
-            oneTime.getCost().getCurrencyUnit().toString(),
-            oneTime.getCost().getAmount().doubleValue(),
+            DomainNameUtils.getTldFromDomainName(billingEvent.getTargetId()),
+            billingEvent.getReason().toString(),
+            billingEvent.getTargetId(),
+            billingEvent.getDomainRepoId(),
+            Optional.ofNullable(billingEvent.getPeriodYears()).orElse(0),
+            billingEvent.getCost().getCurrencyUnit().toString(),
+            billingEvent.getCost().getAmount().doubleValue(),
             String.join(
-                " ", oneTime.getFlags().stream().map(Flag::toString).collect(toImmutableSet()))));
+                " ",
+                billingEvent.getFlags().stream().map(Flag::toString).collect(toImmutableSet()))));
   }
 
   /** Transform that converts a {@code BillingEvent} into an invoice CSV row. */
   private static class GenerateInvoiceRows
-      extends PTransform<PCollection<BillingEvent>, PCollection<String>> {
+      extends PTransform<
+          PCollection<google.registry.beam.billing.BillingEvent>, PCollection<String>> {
 
     private static final long serialVersionUID = -8090619008258393728L;
 
     @Override
-    public PCollection<String> expand(PCollection<BillingEvent> input) {
+    public PCollection<String> expand(
+        PCollection<google.registry.beam.billing.BillingEvent> input) {
       return input
           .apply(
               "Map to invoicing key",
               MapElements.into(TypeDescriptor.of(InvoiceGroupingKey.class))
-                  .via(BillingEvent::getInvoiceGroupingKey))
+                  .via(google.registry.beam.billing.BillingEvent::getInvoiceGroupingKey))
           .apply(
               "Filter out free events", Filter.by((InvoiceGroupingKey key) -> key.unitPrice() != 0))
           .setCoder(new InvoiceGroupingKeyCoder())
@@ -161,7 +165,8 @@ public class InvoicingPipeline implements Serializable {
 
   /** Saves the billing events to a single overall invoice CSV file. */
   static void saveInvoiceCsv(
-      PCollection<BillingEvent> billingEvents, InvoicingPipelineOptions options) {
+      PCollection<google.registry.beam.billing.BillingEvent> billingEvents,
+      InvoicingPipelineOptions options) {
     billingEvents
         .apply("Generate overall invoice rows", new GenerateInvoiceRows())
         .apply(
@@ -182,16 +187,17 @@ public class InvoicingPipeline implements Serializable {
 
   /** Saves the billing events to detailed report CSV files keyed by registrar-tld pairs. */
   static void saveDetailedCsv(
-      PCollection<BillingEvent> billingEvents, InvoicingPipelineOptions options) {
+      PCollection<google.registry.beam.billing.BillingEvent> billingEvents,
+      InvoicingPipelineOptions options) {
     String yearMonth = options.getYearMonth();
     billingEvents.apply(
         "Write detailed report for each registrar-tld pair",
-        FileIO.<String, BillingEvent>writeDynamic()
+        FileIO.<String, google.registry.beam.billing.BillingEvent>writeDynamic()
             .to(
                 String.format(
                     "%s/%s/%s",
                     options.getBillingBucketUrl(), BillingModule.INVOICES_DIRECTORY, yearMonth))
-            .by(BillingEvent::getDetailedReportGroupingKey)
+            .by(google.registry.beam.billing.BillingEvent::getDetailedReportGroupingKey)
             .withNumShards(1)
             .withDestinationCoder(StringUtf8Coder.of())
             .withNaming(
@@ -200,8 +206,8 @@ public class InvoicingPipeline implements Serializable {
                         String.format(
                             "%s_%s_%s.csv", BillingModule.DETAIL_REPORT_PREFIX, yearMonth, key))
             .via(
-                Contextful.fn(BillingEvent::toCsv),
-                TextIO.sink().withHeader(BillingEvent.getHeader())));
+                Contextful.fn(google.registry.beam.billing.BillingEvent::toCsv),
+                TextIO.sink().withHeader(google.registry.beam.billing.BillingEvent.getHeader())));
   }
 
   /** Create the Cloud SQL query for a given yearMonth at runtime. */

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -33,7 +33,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.rde.RdeNamingUtils;
 import google.registry.model.rde.RdeRevision;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.rde.BrdaCopyAction;
 import google.registry.rde.DepositFragment;
 import google.registry.rde.Ghostryde;
@@ -272,12 +272,12 @@ public class RdeIO {
       tm().transact(
               () -> {
                 PendingDeposit key = input.getKey();
-                Registry registry = Registry.get(key.tld());
+                Tld tld = Tld.get(key.tld());
                 Optional<Cursor> cursor =
                     tm().transact(
                             () ->
                                 tm().loadByKeyIfPresent(
-                                        Cursor.createScopedVKey(key.cursor(), registry)));
+                                        Cursor.createScopedVKey(key.cursor(), tld)));
                 DateTime position = getCursorTimeOrStartOfTime(cursor);
                 checkState(key.interval() != null, "Interval must be present");
                 DateTime newPosition = key.watermark().plus(key.interval());
@@ -290,7 +290,7 @@ public class RdeIO {
                     "Partial ordering of RDE deposits broken: %s %s",
                     position,
                     key);
-                tm().put(Cursor.createScoped(key.cursor(), newPosition, registry));
+                tm().put(Cursor.createScoped(key.cursor(), newPosition, tld));
                 logger.atInfo().log(
                     "Rolled forward %s on %s cursor to %s.", key.cursor(), key.tld(), newPosition);
                 RdeRevision.saveRevision(key.tld(), key.watermark(), key.mode(), input.getValue());

core/src/main/java/google/registry/beam/wipeout/WipeOutContactHistoryPiiPipeline.java

@@ -0,0 +1,166 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.wipeout;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static org.apache.beam.sdk.values.TypeDescriptors.voids;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Streams;
+import google.registry.beam.common.RegistryJpaIO;
+import google.registry.model.contact.ContactHistory;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import google.registry.persistence.VKey;
+import java.io.Serializable;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.PipelineResult;
+import org.apache.beam.sdk.coders.KvCoder;
+import org.apache.beam.sdk.coders.StringUtf8Coder;
+import org.apache.beam.sdk.coders.VarLongCoder;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.join.CoGroupByKey;
+import org.apache.beam.sdk.transforms.join.KeyedPCollectionTuple;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.TupleTag;
+import org.joda.time.DateTime;
+
+/**
+ * Definition of a Dataflow Flex pipeline template, which finds out {@link ContactHistory} entries
+ * that are older than a given age (excluding the most recent one, even if it falls with the range)
+ * and wipe out PII information in them.
+ *
+ * <p>To stage this template locally, run {@code ./nom_build :core:sBP --environment=alpha \
+ * --pipeline=wipeOutContactHistoryPii}.
+ *
+ * <p>Then, you can run the staged template via the API client library, gCloud or a raw REST call.
+ */
+public class WipeOutContactHistoryPiiPipeline implements Serializable {
+
+  private static final long serialVersionUID = -4111052675715913820L;
+  private static final TupleTag<Long> REVISIONS_TO_WIPE = new TupleTag<>();
+  private static final TupleTag<Long> MOST_RECENT_REVISION = new TupleTag<>();
+
+  private final DateTime cutoffTime;
+  private final boolean dryRun;
+  private final Counter contactsInScope =
+      Metrics.counter("WipeOutContactHistoryPii", "contacts in scope");
+  private final Counter historiesToWipe =
+      Metrics.counter("WipeOutContactHistoryPii", "contact histories to wipe PII from");
+  private final Counter historiesWiped =
+      Metrics.counter("WipeOutContactHistoryPii", "contact histories actually updated");
+
+  WipeOutContactHistoryPiiPipeline(WipeOutContactHistoryPiiPipelineOptions options) {
+    dryRun = options.getIsDryRun();
+    cutoffTime = DateTime.parse(options.getCutoffTime());
+  }
+
+  void setup(Pipeline pipeline) {
+    KeyedPCollectionTuple.of(REVISIONS_TO_WIPE, getHistoryEntriesToWipe(pipeline))
+        .and(MOST_RECENT_REVISION, getMostRecentHistoryEntries(pipeline))
+        .apply("Group by contact", CoGroupByKey.create())
+        .apply(
+            "Wipe out PII",
+            MapElements.into(voids())
+                .via(
+                    kv -> {
+                      String repoId = kv.getKey();
+                      long mostRecentRevision = kv.getValue().getOnly(MOST_RECENT_REVISION);
+                      ImmutableList<Long> revisionsToWipe =
+                          Streams.stream(kv.getValue().getAll(REVISIONS_TO_WIPE))
+                              .filter(e -> e != mostRecentRevision)
+                              .collect(toImmutableList());
+                      if (revisionsToWipe.isEmpty()) {
+                        return null;
+                      }
+                      contactsInScope.inc();
+                      tm().transact(
+                              () -> {
+                                for (long revisionId : revisionsToWipe) {
+                                  historiesToWipe.inc();
+                                  ContactHistory history =
+                                      tm().loadByKey(
+                                              VKey.create(
+                                                  ContactHistory.class,
+                                                  new HistoryEntryId(repoId, revisionId)));
+                                  // In the unlikely case where multiple pipelines run at the
+                                  // same time, or where the runner decides to rerun a particular
+                                  // transform, we might have a history entry that has already been
+                                  // wiped at this point. There's no need to wipe it again.
+                                  if (!dryRun
+                                      && history.getContactBase().isPresent()
+                                      && history.getContactBase().get().getEmailAddress() != null) {
+                                    historiesWiped.inc();
+                                    tm().update(history.asBuilder().wipeOutPii().build());
+                                  }
+                                }
+                              });
+                      return null;
+                    }));
+  }
+
+  PCollection<KV<String, Long>> getHistoryEntriesToWipe(Pipeline pipeline) {
+    return pipeline.apply(
+        "Find contact histories to wipee",
+        // Email is one of the required fields in EPP, meaning it's initially not null when it
+        // is set by EPP flows (even though it is nullalbe in the SQL schema). Therefore,
+        // checking if it's null is one way to avoid processing contact history entities that
+        // have been processed previously. Refer to RFC 5733 for more information.
+        RegistryJpaIO.read(
+                "SELECT repoId, revisionId FROM ContactHistory WHERE email IS NOT NULL AND"
+                    + " modificationTime < :cutoffTime",
+                ImmutableMap.of("cutoffTime", cutoffTime),
+                Object[].class,
+                row -> KV.of((String) row[0], (long) row[1]))
+            .withCoder(KvCoder.of(StringUtf8Coder.of(), VarLongCoder.of())));
+  }
+
+  PCollection<KV<String, Long>> getMostRecentHistoryEntries(Pipeline pipeline) {
+    return pipeline.apply(
+        "Find the most recent historiy entry for each contact",
+        RegistryJpaIO.read(
+                "SELECT repoId, revisionId FROM ContactHistory"
+                    + " WHERE (repoId, modificationTime) IN"
+                    + " (SELECT repoId, MAX(modificationTime) FROM ContactHistory GROUP BY repoId)",
+                ImmutableMap.of(),
+                Object[].class,
+                row -> KV.of((String) row[0], (long) row[1]))
+            .withCoder(KvCoder.of(StringUtf8Coder.of(), VarLongCoder.of())));
+  }
+
+  PipelineResult run(Pipeline pipeline) {
+    setup(pipeline);
+    return pipeline.run();
+  }
+
+  public static void main(String[] args) {
+    PipelineOptionsFactory.register(WipeOutContactHistoryPiiPipelineOptions.class);
+    WipeOutContactHistoryPiiPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args)
+            .withValidation()
+            .as(WipeOutContactHistoryPiiPipelineOptions.class);
+    // Repeatable read should be more than enough since we are dealing with old history entries that
+    // are otherwise immutable.
+    options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ);
+    Pipeline pipeline = Pipeline.create(options);
+    new WipeOutContactHistoryPiiPipeline(options).run(pipeline);
+  }
+}

core/src/main/java/google/registry/beam/wipeout/WipeOutContactHistoryPiiPipelineOptions.java

@@ -0,0 +1,37 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.wipeout;
+
+import google.registry.beam.common.RegistryPipelineOptions;
+import org.apache.beam.sdk.options.Default;
+import org.apache.beam.sdk.options.Description;
+
+public interface WipeOutContactHistoryPiiPipelineOptions extends RegistryPipelineOptions {
+
+  @Description(
+      "A contact history entry with a history modification time before this time will have its PII"
+          + " wiped, unless it is the most entry for the contact.")
+  String getCutoffTime();
+
+  void setCutoffTime(String value);
+
+  @Description(
+      "If true, the wiped out billing events will not be saved but the pipeline metrics counter"
+          + " will still be updated.")
+  @Default.Boolean(false)
+  boolean getIsDryRun();
+
+  void setIsDryRun(boolean value);
+}

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -63,7 +63,7 @@ import org.joda.time.Duration;
  * <p>This class does not represent the total configuration of the Nomulus service. It's <b>only
  * meant for settings that need to be configured <i>once</i></b>. Settings which may be subject to
  * change in the future, should instead be retrieved from the database. The {@link
- * google.registry.model.tld.Registry Registry} class is one such example of this.
+ * google.registry.model.tld.Tld Tld} class is one such example of this.
  *
  * <p>Note: Only settings that are actually configurable belong in this file. It's not a catch-all
  * for anything widely used throughout the code base.
@@ -1325,12 +1325,6 @@ public final class RegistryConfig {
       return config.contactHistory.minMonthsBeforeWipeOut;
     }
 
-    @Provides
-    @Config("wipeOutQueryBatchSize")
-    public static int provideWipeOutQueryBatchSize(RegistryConfigSettings config) {
-      return config.contactHistory.wipeOutQueryBatchSize;
-    }
-
     @Provides
     @Config("jdbcBatchSize")
     public static int provideHibernateJdbcBatchSize(RegistryConfigSettings config) {

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -243,7 +243,6 @@ public class RegistryConfigSettings {
   /** Configuration for contact history. */
   public static class ContactHistory {
     public int minMonthsBeforeWipeOut;
-    public int wipeOutQueryBatchSize;
   }
 
   /** Configuration for dns update. */

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -474,8 +474,6 @@ registryTool:
 contactHistory:
   # The number of months that a ContactHistory entity should be stored in the database.
   minMonthsBeforeWipeOut: 18
-  # The batch size for querying ContactHistory table in the database.
-  wipeOutQueryBatchSize: 500
 
 # Configuration options relevant to the DNS update functionality.
 dnsUpdate:

core/src/main/java/google/registry/cron/TldFanoutAction.java

@@ -28,8 +28,8 @@ import static google.registry.cron.CronModule.JITTER_SECONDS_PARAM;
 import static google.registry.cron.CronModule.QUEUE_PARAM;
 import static google.registry.cron.CronModule.RUN_IN_EMPTY_PARAM;
 import static google.registry.model.tld.Registries.getTldsOfType;
-import static google.registry.model.tld.Registry.TldType.REAL;
-import static google.registry.model.tld.Registry.TldType.TEST;
+import static google.registry.model.tld.Tld.TldType.REAL;
+import static google.registry.model.tld.Tld.TldType.TEST;
 
 import com.google.cloud.tasks.v2.Task;
 import com.google.common.collect.ArrayListMultimap;

core/src/main/java/google/registry/dns/DnsModule.java

@@ -19,6 +19,7 @@ import static google.registry.dns.DnsConstants.DNS_PULL_QUEUE_NAME;
 import static google.registry.dns.RefreshDnsOnHostRenameAction.PARAM_HOST_KEY;
 import static google.registry.request.RequestParameters.extractEnumParameter;
 import static google.registry.request.RequestParameters.extractIntParameter;
+import static google.registry.request.RequestParameters.extractOptionalIntParameter;
 import static google.registry.request.RequestParameters.extractOptionalParameter;
 import static google.registry.request.RequestParameters.extractRequiredParameter;
 import static google.registry.request.RequestParameters.extractSetOfParameters;
@@ -34,6 +35,7 @@ import google.registry.dns.DnsConstants.TargetType;
 import google.registry.dns.writer.DnsWriterZone;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
+import java.util.Optional;
 import java.util.Set;
 import javax.inject.Named;
 import javax.servlet.http.HttpServletRequest;
@@ -50,6 +52,9 @@ public abstract class DnsModule {
   public static final String PARAM_HOSTS = "hosts";
   public static final String PARAM_PUBLISH_TASK_ENQUEUED = "enqueued";
   public static final String PARAM_REFRESH_REQUEST_TIME = "requestTime";
+  // This parameter cannot be named "jitterSeconds", which will be read by TldFanoutAction and not
+  // be passed down to actions.
+  public static final String PARAM_DNS_JITTER_SECONDS = "dnsJitterSeconds";
 
   @Binds
   @DnsWriterZone
@@ -129,6 +134,12 @@ public abstract class DnsModule {
     return extractRequiredParameter(req, PARAM_HOST_KEY);
   }
 
+  @Provides
+  @Parameter(PARAM_DNS_JITTER_SECONDS)
+  static Optional<Integer> provideJitterSeconds(HttpServletRequest req) {
+    return extractOptionalIntParameter(req, PARAM_DNS_JITTER_SECONDS);
+  }
+
   @Provides
   @Parameter("domainOrHostName")
   static String provideName(HttpServletRequest req) {

core/src/main/java/google/registry/dns/DnsUtils.java

@@ -24,7 +24,9 @@ import google.registry.model.common.DatabaseMigrationStateSchedule;
 import google.registry.model.common.DatabaseMigrationStateSchedule.MigrationState;
 import google.registry.model.common.DnsRefreshRequest;
 import google.registry.model.tld.Registries;
+import google.registry.model.tld.Tld;
 import java.util.Collection;
+import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -126,6 +128,18 @@ public class DnsUtils {
                             .collect(toImmutableList())));
   }
 
+  public static long getDnsAPlusAAAATtlForHost(String host, Duration dnsDefaultATtl) {
+    Optional<InternetDomainName> tldName = Registries.findTldForName(InternetDomainName.from(host));
+    Duration dnsAPlusAaaaTtl = dnsDefaultATtl;
+    if (tldName.isPresent()) {
+      Tld tld = Tld.get(tldName.get().toString());
+      if (tld.getDnsAPlusAaaaTtl().isPresent()) {
+        dnsAPlusAaaaTtl = tld.getDnsAPlusAaaaTtl().get();
+      }
+    }
+    return dnsAPlusAaaaTtl.getStandardSeconds();
+  }
+
   private boolean usePullQueue() {
     return !DatabaseMigrationStateSchedule.getValueAtTime(dnsQueue.getClock().nowUtc())
         .equals(MigrationState.DNS_SQL);

core/src/main/java/google/registry/dns/DnsWriterProxy.java

@@ -19,7 +19,7 @@ import static com.google.common.base.Preconditions.checkState;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
 import google.registry.dns.writer.DnsWriter;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.Map;
 import javax.inject.Inject;
 
@@ -41,7 +41,7 @@ public final class DnsWriterProxy {
    * If the DnsWriter doesn't belong to this TLD, will return null.
    */
   public DnsWriter getByClassNameForTld(String className, String tld) {
-    if (!Registry.get(tld).getDnsWriters().contains(className)) {
+    if (!Tld.get(tld).getDnsWriters().contains(className)) {
       logger.atWarning().log(
           "Loaded potentially stale DNS writer %s which is not active on TLD %s.", className, tld);
       return null;

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -45,7 +45,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
 import google.registry.request.Header;
@@ -96,8 +96,8 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
    *
    * <p>This comes from the fanout in {@link ReadDnsQueueAction} which dispatches each batch to be
    * published by each DNS writer on the TLD. So this field contains the value of one of the DNS
-   * writers configured in {@link Registry#getDnsWriters()}, as of the time the batch was written
-   * out (and not necessarily currently).
+   * writers configured in {@link Tld#getDnsWriters()}, as of the time the batch was written out
+   * (and not necessarily currently).
    */
   private final String dnsWriter;
 
@@ -372,11 +372,11 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
       return false;
     }
     // Check if the Registry object's num locks has changed since this task was batched
-    int registryNumPublishLocks = Registry.get(tld).getNumDnsPublishLocks();
-    if (registryNumPublishLocks != numPublishLocks) {
+    int tldNumPublishLocks = Tld.get(tld).getNumDnsPublishLocks();
+    if (tldNumPublishLocks != numPublishLocks) {
       logger.atWarning().log(
           "Registry numDnsPublishLocks %d out of sync with parameter %d.",
-          registryNumPublishLocks, numPublishLocks);
+          tldNumPublishLocks, numPublishLocks);
       return false;
     }
     return true;

core/src/main/java/google/registry/dns/ReadDnsQueueAction.java

@@ -48,7 +48,7 @@ import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.dns.DnsConstants.TargetType;
 import google.registry.model.tld.Registries;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
 import google.registry.request.Parameter;
@@ -292,7 +292,7 @@ public final class ReadDnsQueueAction implements Runnable {
         } else if (!tlds.contains(tld)) {
           classifiedTasksBuilder.tasksToKeepBuilder().add(task);
           classifiedTasksBuilder.unknownTldsBuilder().add(tld);
-        } else if (Registry.get(tld).getDnsPaused()) {
+        } else if (Tld.get(tld).getDnsPaused()) {
           classifiedTasksBuilder.tasksToKeepBuilder().add(task);
           classifiedTasksBuilder.pausedTldsBuilder().add(tld);
         } else {
@@ -330,7 +330,7 @@ public final class ReadDnsQueueAction implements Runnable {
     for (Map.Entry<String, Collection<RefreshItem>> tldRefreshItemsEntry
         : refreshItemsByTld.asMap().entrySet()) {
       String tld = tldRefreshItemsEntry.getKey();
-      int numPublishLocks = Registry.get(tld).getNumDnsPublishLocks();
+      int numPublishLocks = Tld.get(tld).getNumDnsPublishLocks();
       // 1 lock or less implies no TLD-wide locks, simply enqueue everything under lock 1 of 1
       if (numPublishLocks <= 1) {
         enqueueUpdates(tld, 1, 1, tldRefreshItemsEntry.getValue());
@@ -368,7 +368,7 @@ public final class ReadDnsQueueAction implements Runnable {
     for (List<RefreshItem> chunk : Iterables.partition(items, tldUpdateBatchSize)) {
       DateTime earliestCreateTime =
           chunk.stream().map(RefreshItem::creationTime).min(Comparator.naturalOrder()).get();
-      for (String dnsWriter : Registry.get(tld).getDnsWriters()) {
+      for (String dnsWriter : Tld.get(tld).getDnsWriters()) {
         Task task =
             cloudTasksUtils.createPostTaskWithJitter(
                 PublishDnsUpdatesAction.PATH,

core/src/main/java/google/registry/dns/ReadDnsRefreshRequestsAction.java

@@ -16,6 +16,7 @@ package google.registry.dns;
 
 import static com.google.common.collect.ImmutableSetMultimap.toImmutableSetMultimap;
 import static google.registry.dns.DnsConstants.DNS_PUBLISH_PUSH_QUEUE_NAME;
+import static google.registry.dns.DnsModule.PARAM_DNS_JITTER_SECONDS;
 import static google.registry.dns.DnsModule.PARAM_DNS_WRITER;
 import static google.registry.dns.DnsModule.PARAM_DOMAINS;
 import static google.registry.dns.DnsModule.PARAM_HOSTS;
@@ -23,6 +24,7 @@ import static google.registry.dns.DnsModule.PARAM_LOCK_INDEX;
 import static google.registry.dns.DnsModule.PARAM_NUM_PUBLISH_LOCKS;
 import static google.registry.dns.DnsModule.PARAM_PUBLISH_TASK_ENQUEUED;
 import static google.registry.dns.DnsModule.PARAM_REFRESH_REQUEST_TIME;
+import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_TLD;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.DomainNameUtils.getSecondLevelDomain;
@@ -39,7 +41,7 @@ import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.dns.DnsConstants.TargetType;
 import google.registry.model.common.DnsRefreshRequest;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
 import google.registry.request.Parameter;
@@ -59,12 +61,10 @@ import org.joda.time.Duration;
     service = Service.BACKEND,
     path = "/_dr/task/readDnsRefreshRequests",
     automaticallyPrintOk = true,
+    method = POST,
     auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ReadDnsRefreshRequestsAction implements Runnable {
 
-  // This parameter cannot be named "jitterSeconds", which will be read by TldFanoutAction and not
-  // be passed to this action.
-  private static final String PARAM_JITTER_SECONDS = "dnsJitterSeconds";
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   private final int tldUpdateBatchSize;
@@ -80,7 +80,7 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
   ReadDnsRefreshRequestsAction(
       @Config("dnsTldUpdateBatchSize") int tldUpdateBatchSize,
       @Config("readDnsRefreshRequestsActionRuntime") Duration requestedMaximumDuration,
-      @Parameter(PARAM_JITTER_SECONDS) Optional<Integer> jitterSeconds,
+      @Parameter(PARAM_DNS_JITTER_SECONDS) Optional<Integer> jitterSeconds,
       @Parameter(PARAM_TLD) String tld,
       Clock clock,
       DnsUtils dnsUtils,
@@ -102,14 +102,14 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
    */
   @Override
   public void run() {
-    if (Registry.get(tld).getDnsPaused()) {
+    if (Tld.get(tld).getDnsPaused()) {
       logger.atInfo().log("The queue updated is paused for TLD: %s.", tld);
       return;
     }
     DateTime requestedEndTime = clock.nowUtc().plus(requestedMaximumDuration);
     // See getLockIndex(), requests are evenly distributed to [1, numDnsPublishLocks], so each
     // bucket would be roughly the size of tldUpdateBatchSize.
-    int processBatchSize = tldUpdateBatchSize * Registry.get(tld).getNumDnsPublishLocks();
+    int processBatchSize = tldUpdateBatchSize * Tld.get(tld).getNumDnsPublishLocks();
     while (requestedEndTime.isAfter(clock.nowUtc())) {
       ImmutableList<DnsRefreshRequest> requests =
           dnsUtils.readAndUpdateRequestsWithLatestProcessTime(
@@ -128,7 +128,7 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
    * bucket, and then delete the requests in each bucket.
    */
   void processRequests(Collection<DnsRefreshRequest> requests) {
-    int numPublishLocks = Registry.get(tld).getNumDnsPublishLocks();
+    int numPublishLocks = Tld.get(tld).getNumDnsPublishLocks();
     requests.stream()
         .collect(
             toImmutableSetMultimap(
@@ -181,7 +181,7 @@ public final class ReadDnsRefreshRequestsAction implements Runnable {
     }
     ImmutableList<String> domains = domainsBuilder.build();
     ImmutableList<String> hosts = hostsBuilder.build();
-    for (String dnsWriter : Registry.get(tld).getDnsWriters()) {
+    for (String dnsWriter : Tld.get(tld).getDnsWriters()) {
       Task task =
           cloudTasksUtils.createPostTaskWithJitter(
               PublishDnsUpdatesAction.PATH,

core/src/main/java/google/registry/dns/writer/clouddns/CloudDnsWriter.java

@@ -16,6 +16,7 @@ package google.registry.dns.writer.clouddns;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static google.registry.dns.DnsUtils.getDnsAPlusAAAATtlForHost;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.util.DomainNameUtils.getSecondLevelDomain;
 
@@ -40,6 +41,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.secdns.DomainDsData;
 import google.registry.model.host.Host;
 import google.registry.model.tld.Registries;
+import google.registry.model.tld.Tld;
 import google.registry.util.Clock;
 import google.registry.util.Concurrent;
 import google.registry.util.Retrier;
@@ -131,6 +133,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
       return;
     }
 
+    Tld tld = Tld.get(domain.get().getTld());
     ImmutableSet.Builder<ResourceRecordSet> domainRecords = new ImmutableSet.Builder<>();
 
     // Construct DS records (if any).
@@ -145,7 +148,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
         domainRecords.add(
             new ResourceRecordSet()
                 .setName(absoluteDomainName)
-                .setTtl((int) defaultDsTtl.getStandardSeconds())
+                .setTtl((int) tld.getDnsDsTtl().orElse(defaultDsTtl).getStandardSeconds())
                 .setType("DS")
                 .setKind("dns#resourceRecordSet")
                 .setRrdatas(ImmutableList.copyOf(dsRrData)));
@@ -170,7 +173,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
         domainRecords.add(
             new ResourceRecordSet()
                 .setName(absoluteDomainName)
-                .setTtl((int) defaultNsTtl.getStandardSeconds())
+                .setTtl((int) tld.getDnsNsTtl().orElse(defaultNsTtl).getStandardSeconds())
                 .setType("NS")
                 .setKind("dns#resourceRecordSet")
                 .setRrdatas(ImmutableList.copyOf(nsRrData)));
@@ -216,7 +219,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
       domainRecords.add(
           new ResourceRecordSet()
               .setName(absoluteHostName)
-              .setTtl((int) defaultATtl.getStandardSeconds())
+              .setTtl((int) getDnsAPlusAAAATtlForHost(hostName, defaultATtl))
               .setType("A")
               .setKind("dns#resourceRecordSet")
               .setRrdatas(ImmutableList.copyOf(aRrData)));
@@ -226,7 +229,7 @@ public class CloudDnsWriter extends BaseDnsWriter {
       domainRecords.add(
           new ResourceRecordSet()
               .setName(absoluteHostName)
-              .setTtl((int) defaultATtl.getStandardSeconds())
+              .setTtl((int) getDnsAPlusAAAATtlForHost(hostName, defaultATtl))
               .setType("AAAA")
               .setKind("dns#resourceRecordSet")
               .setRrdatas(ImmutableList.copyOf(aaaaRrData)));
@@ -276,11 +279,12 @@ public class CloudDnsWriter extends BaseDnsWriter {
   }
 
   /** Returns the glue records for in-bailiwick nameservers for the given domain+records. */
-  private Stream<String> filterGlueRecords(String domainName, Stream<ResourceRecordSet> records) {
+  private static Stream<String> filterGlueRecords(
+      String domainName, Stream<ResourceRecordSet> records) {
     return records
-        .filter(record -> record.getType().equals("NS"))
+        .filter(record -> "NS".equals(record.getType()))
         .flatMap(record -> record.getRrdatas().stream())
-        .filter(hostName -> hostName.endsWith("." + domainName) && !hostName.equals(domainName));
+        .filter(hostName -> hostName.endsWith('.' + domainName) && !hostName.equals(domainName));
   }
 
   /** Mutate the zone with the provided map of hostnames to desired DNS records. */
@@ -363,8 +367,8 @@ public class CloudDnsWriter extends BaseDnsWriter {
    * <p>This call should be used in conjunction with {@link #getResourceRecordsForDomains} in a
    * get-and-set retry loop.
    *
-   * <p>See {@link "https://cloud.google.com/dns/troubleshooting"} for a list of errors produced by
-   * the Google Cloud DNS API.
+   * <p>See {@link "<a href="https://cloud.google.com/dns/troubleshooting">Troubleshoot Cloud
+   * DNS</a>"} for a list of errors produced by the Google Cloud DNS API.
    *
    * @throws ZoneStateException if the operation could not be completely successfully because the
    *     records to delete do not exist, already exist or have been modified with different
@@ -417,12 +421,12 @@ public class CloudDnsWriter extends BaseDnsWriter {
    * @param hostName the fully qualified hostname
    */
   private static String getAbsoluteHostName(String hostName) {
-    return hostName.endsWith(".") ? hostName : hostName + ".";
+    return hostName.endsWith(".") ? hostName : hostName + '.';
   }
 
   /** Zone state on Cloud DNS does not match the expected state. */
   static class ZoneStateException extends RuntimeException {
-    public ZoneStateException(String reason) {
+    ZoneStateException(String reason) {
       super("Zone state on Cloud DNS does not match the expected state: " + reason);
     }
   }

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateWriter.java

@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Verify.verify;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
+import static google.registry.dns.DnsUtils.getDnsAPlusAAAATtlForHost;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 
 import com.google.common.base.Joiner;
@@ -31,6 +32,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.secdns.DomainDsData;
 import google.registry.model.host.Host;
 import google.registry.model.tld.Registries;
+import google.registry.model.tld.Tld;
 import google.registry.util.Clock;
 import java.io.IOException;
 import java.net.Inet4Address;
@@ -185,12 +187,13 @@ public class DnsUpdateWriter extends BaseDnsWriter {
 
   private RRset makeDelegationSignerSet(Domain domain) {
     RRset signerSet = new RRset();
+    Tld tld = Tld.get(domain.getTld());
     for (DomainDsData signerData : domain.getDsData()) {
       DSRecord dsRecord =
           new DSRecord(
               toAbsoluteName(domain.getDomainName()),
               DClass.IN,
-              dnsDefaultDsTtl.getStandardSeconds(),
+              tld.getDnsDsTtl().orElse(dnsDefaultDsTtl).getStandardSeconds(),
               signerData.getKeyTag(),
               signerData.getAlgorithm(),
               signerData.getDigestType(),
@@ -224,12 +227,13 @@ public class DnsUpdateWriter extends BaseDnsWriter {
 
   private RRset makeNameServerSet(Domain domain) {
     RRset nameServerSet = new RRset();
+    Tld tld = Tld.get(domain.getTld());
     for (String hostName : domain.loadNameserverHostNames()) {
       NSRecord record =
           new NSRecord(
               toAbsoluteName(domain.getDomainName()),
               DClass.IN,
-              dnsDefaultNsTtl.getStandardSeconds(),
+              tld.getDnsNsTtl().orElse(dnsDefaultNsTtl).getStandardSeconds(),
               toAbsoluteName(hostName));
       nameServerSet.addRR(record);
     }
@@ -244,7 +248,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
             new ARecord(
                 toAbsoluteName(host.getHostName()),
                 DClass.IN,
-                dnsDefaultATtl.getStandardSeconds(),
+                getDnsAPlusAAAATtlForHost(host.getHostName(), dnsDefaultATtl),
                 address);
         addressSet.addRR(record);
       }
@@ -260,7 +264,7 @@ public class DnsUpdateWriter extends BaseDnsWriter {
             new AAAARecord(
                 toAbsoluteName(host.getHostName()),
                 DClass.IN,
-                dnsDefaultATtl.getStandardSeconds(),
+                getDnsAPlusAAAATtlForHost(host.getHostName(), dnsDefaultATtl),
                 address);
         addressSet.addRR(record);
       }

core/src/main/java/google/registry/env/alpha/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -80,12 +80,13 @@
   </task>
 
   <task>
-    <url><![CDATA[/_dr/task/expandRecurringBillingEvents?advanceCursor]]></url>
-    <name>expandRecurringBillingEvents</name>
+    <url><![CDATA[/_dr/task/expandBillingRecurrences?advanceCursor]]></url>
+    <name>expandBillingRecurrences</name>
     <description>
-      This job runs an action that creates synthetic OneTime billing events from Recurring billing
-      events. Events are created for all instances of Recurring billing events that should exist
-      between the RECURRING_BILLING cursor's time and the execution time of the action.
+      This job runs an action that creates synthetic one-time billing events
+      from billing recurrences. Events are created for all recurrences that
+      should exist between the RECURRING_BILLING cursor's time and the execution
+      time of the action.
     </description>
     <schedule>0 3 * * *</schedule>
   </task>
@@ -140,7 +141,7 @@
 
   <task>
     <url>
-      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&ForEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
+      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&forEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
     <name>readDnsRefreshRequests</name>
     <description>
       Enqueue a ReadDnsRefreshRequestAction for each TLD.

core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml

@@ -157,6 +157,12 @@
     <url-pattern>/_dr/cron/readDnsQueue</url-pattern>
   </servlet-mapping>
 
+  <!-- Reads the DNS refresh requests and kick off the appropriate tasks to update zone. -->
+  <servlet-mapping>
+    <servlet-name>backend-servlet</servlet-name>
+    <url-pattern>/_dr/task/readDnsRefreshRequests</url-pattern>
+  </servlet-mapping>
+
   <!-- Publishes DNS updates. -->
   <servlet-mapping>
     <servlet-name>backend-servlet</servlet-name>
@@ -240,10 +246,10 @@
     <url-pattern>/_dr/task/refreshDnsOnHostRename</url-pattern>
   </servlet-mapping>
 
-  <!-- Action to expand recurring billing events into OneTimes. -->
+  <!-- Action to expand BillingRecurrences into BillingEvents. -->
   <servlet-mapping>
     <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/expandRecurringBillingEvents</url-pattern>
+    <url-pattern>/_dr/task/expandBillingRecurrences</url-pattern>
   </servlet-mapping>
 
   <!-- Background action to delete domains past end of autorenewal. -->

core/src/main/java/google/registry/env/crash/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -141,7 +141,7 @@
 
   <task>
     <url>
-      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&ForEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
+      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&forEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
     <name>readDnsRefreshRequests</name>
     <description>
       Enqueue a ReadDnsRefreshRequestAction for each TLD.

core/src/main/java/google/registry/env/production/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -122,12 +122,13 @@
   </task>
 
   <task>
-    <url><![CDATA[/_dr/task/expandRecurringBillingEvents?advanceCursor]]></url>
-    <name>expandRecurringBillingEvents</name>
+    <url><![CDATA[/_dr/task/expandBillingRecurrences?advanceCursor]]></url>
+    <name>expandBillingRecurrences</name>
     <description>
-      This job runs an action that creates synthetic OneTime billing events from Recurring billing
-      events. Events are created for all instances of Recurring billing events that should exist
-      between the RECURRING_BILLING cursor's time and the execution time of the action.
+      This job runs an action that creates synthetic one-time billing events
+      from billing recurrences. Events are created for all recurrences that
+      should exist between the RECURRING_BILLING cursor's time and the execution
+      time of the action.
     </description>
     <schedule>0 3 * * *</schedule>
   </task>
@@ -212,7 +213,7 @@
 
   <task>
     <url>
-      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&ForEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
+      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&forEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
     <name>readDnsRefreshRequests</name>
     <description>
       Enqueue a ReadDnsRefreshRequestAction for each TLD.
@@ -253,7 +254,7 @@
       reports to the associated registrars' drive folders.
       See GenerateInvoicesAction for more details.
     </description>
-    <!--WARNING: This must occur AFTER expandRecurringBillingEvents and AFTER exportSnapshot, as
+    <!--WARNING: This must occur AFTER expandBillingRecurrences and AFTER exportSnapshot, as
     it uses Bigquery as the source of truth for billable events. ExportSnapshot usually takes
     about 2 hours to complete, so we give 11 hours to be safe. Normally, we give 24+ hours (see
     icannReportingStaging), but the invoicing team prefers receiving the e-mail on the first of
@@ -280,6 +281,6 @@
       This job runs weekly to wipe out PII fields of ContactHistory entities
       that have been in the database for a certain period of time.
     </description>
-    <schedule>0 15 * 12 1</schedule>
+    <schedule>0 15 * * 1</schedule>
   </task>
 </taskentries>

core/src/main/java/google/registry/env/qa/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -23,7 +23,7 @@
 
   <task>
     <url>
-      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&ForEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
+      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&forEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
     <name>readDnsRefreshRequests</name>
     <description>
       Enqueue a ReadDnsRefreshRequestAction for each TLD.

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -82,12 +82,13 @@
   </task>
 
   <task>
-    <url><![CDATA[/_dr/task/expandRecurringBillingEvents?advanceCursor]]></url>
-    <name>expandRecurringBillingEvents</name>
+    <url><![CDATA[/_dr/task/expandBillingRecurrences?advanceCursor]]></url>
+    <name>expandBillingRecurrences</name>
     <description>
-      This job runs an action that creates synthetic OneTime billing events from Recurring billing
-      events. Events are created for all instances of Recurring billing events that should exist
-      between the RECURRING_BILLING cursor's time and the execution time of the action.
+      This job runs an action that creates synthetic one-time billing events
+      from billing recurrences. Events are created for all recurrences that
+      should exist between the RECURRING_BILLING cursor's time and the execution
+      time of the action.
     </description>
     <schedule>0 3 * * *</schedule>
   </task>
@@ -154,7 +155,7 @@
 
   <task>
     <url>
-      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&ForEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
+      <![CDATA[/_dr/cron/fanout?queue=dns-refresh&forEachRealTld&forEachTestTld&endpoint=/_dr/task/readDnsRefreshRequests&dnsJitterSeconds=45]]></url>
     <name>readDnsRefreshRequests</name>
     <description>
       Enqueue a ReadDnsRefreshRequestAction for each TLD.

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -27,8 +27,8 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.gcs.GcsUtils;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
 import google.registry.request.auth.Auth;
 import google.registry.storage.drive.DriveConnection;
@@ -106,27 +106,28 @@ public class ExportDomainListsAction implements Runnable {
   }
 
   protected static boolean exportToDrive(
-      String tld, String domains, DriveConnection driveConnection) {
+      String tldStr, String domains, DriveConnection driveConnection) {
     verifyNotNull(driveConnection, "Expecting non-null driveConnection");
     try {
-      Registry registry = Registry.get(tld);
-      if (registry.getDriveFolderId() == null) {
+      Tld tld = Tld.get(tldStr);
+      if (tld.getDriveFolderId() == null) {
         logger.atInfo().log(
             "Skipping registered domains export for TLD %s because Drive folder isn't specified.",
-            tld);
+            tldStr);
       } else {
         String resultMsg =
             driveConnection.createOrUpdateFile(
                 REGISTERED_DOMAINS_FILENAME,
                 MediaType.PLAIN_TEXT_UTF_8,
-                registry.getDriveFolderId(),
+                tld.getDriveFolderId(),
                 domains.getBytes(UTF_8));
         logger.atInfo().log(
-            "Exporting registered domains succeeded for TLD %s, response was: %s", tld, resultMsg);
+            "Exporting registered domains succeeded for TLD %s, response was: %s",
+            tldStr, resultMsg);
       }
     } catch (Throwable e) {
       logger.atSevere().withCause(e).log(
-          "Error exporting registered domains for TLD %s to Drive, skipping...", tld);
+          "Error exporting registered domains for TLD %s to Drive, skipping...", tldStr);
       return false;
     }
     return true;

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -29,7 +29,7 @@ import com.google.common.collect.Iterables;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.request.Action;
@@ -61,7 +61,10 @@ public class ExportPremiumTermsAction implements Runnable {
   @Config("premiumTermsExportDisclaimer")
   String exportDisclaimer;
 
-  @Inject @Parameter(RequestParameters.PARAM_TLD) String tld;
+  @Inject
+  @Parameter(RequestParameters.PARAM_TLD)
+  String tldStr;
+
   @Inject Response response;
 
   @Inject
@@ -88,59 +91,59 @@ public class ExportPremiumTermsAction implements Runnable {
   public void run() {
     response.setContentType(PLAIN_TEXT_UTF_8);
     try {
-      Registry registry = Registry.get(tld);
-      String resultMsg = checkConfig(registry).orElseGet(() -> exportPremiumTerms(registry));
+      Tld tld = Tld.get(tldStr);
+      String resultMsg = checkConfig(tld).orElseGet(() -> exportPremiumTerms(tld));
       response.setStatus(SC_OK);
       response.setPayload(resultMsg);
     } catch (Throwable e) {
       response.setStatus(SC_INTERNAL_SERVER_ERROR);
       response.setPayload(e.getMessage());
       throw new RuntimeException(
-          String.format("Exception occurred while exporting premium terms for TLD %s.", tld), e);
+          String.format("Exception occurred while exporting premium terms for TLD %s.", tldStr), e);
     }
   }
 
   /**
-   * Checks if {@code registry} is properly configured to export premium terms.
+   * Checks if {@link Tld} is properly configured to export premium terms.
    *
-   * @return {@link Optional#empty()} if {@code registry} export may proceed. Otherwise returns an
-   *     error message
+   * @return {@link Optional#empty()} if {@link Tld} export may proceed. Otherwise returns an error
+   *     message
    */
-  private Optional<String> checkConfig(Registry registry) {
-    if (isNullOrEmpty(registry.getDriveFolderId())) {
+  private Optional<String> checkConfig(Tld tld) {
+    if (isNullOrEmpty(tld.getDriveFolderId())) {
       logger.atInfo().log(
-          "Skipping premium terms export for TLD %s because Drive folder isn't specified.", tld);
+          "Skipping premium terms export for TLD %s because Drive folder isn't specified.", tldStr);
       return Optional.of("Skipping export because no Drive folder is associated with this TLD");
     }
-    if (!registry.getPremiumListName().isPresent()) {
-      logger.atInfo().log("No premium terms to export for TLD '%s'.", tld);
+    if (!tld.getPremiumListName().isPresent()) {
+      logger.atInfo().log("No premium terms to export for TLD '%s'.", tldStr);
       return Optional.of("No premium lists configured");
     }
     return Optional.empty();
   }
 
-  private String exportPremiumTerms(Registry registry) {
+  private String exportPremiumTerms(Tld tld) {
     try {
       String fileId =
           driveConnection.createOrUpdateFile(
               PREMIUM_TERMS_FILENAME,
               EXPORT_MIME_TYPE,
-              registry.getDriveFolderId(),
-              getFormattedPremiumTerms(registry).getBytes(UTF_8));
+              tld.getDriveFolderId(),
+              getFormattedPremiumTerms(tld).getBytes(UTF_8));
       logger.atInfo().log(
-          "Exporting premium terms succeeded for TLD %s, file ID is: %s", tld, fileId);
+          "Exporting premium terms succeeded for TLD %s, file ID is: %s", tldStr, fileId);
       return fileId;
     } catch (IOException e) {
       throw new RuntimeException("Error exporting premium terms file to Drive.", e);
     }
   }
 
-  private String getFormattedPremiumTerms(Registry registry) {
-    checkState(registry.getPremiumListName().isPresent(), "%s does not have a premium list", tld);
-    String premiumListName = registry.getPremiumListName().get();
+  private String getFormattedPremiumTerms(Tld tld) {
+    checkState(tld.getPremiumListName().isPresent(), "%s does not have a premium list", tldStr);
+    String premiumListName = tld.getPremiumListName().get();
     checkState(
         PremiumListDao.getLatestRevision(premiumListName).isPresent(),
-        "Could not load premium list for " + tld);
+        "Could not load premium list for " + tldStr);
     SortedSet<String> premiumTerms =
         PremiumListDao.loadAllPremiumEntries(premiumListName).stream()
             .map(PremiumEntry::toString)

core/src/main/java/google/registry/export/ExportReservedTermsAction.java

@@ -23,7 +23,7 @@ import static javax.servlet.http.HttpServletResponse.SC_OK;
 
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
@@ -46,7 +46,11 @@ public class ExportReservedTermsAction implements Runnable {
 
   @Inject DriveConnection driveConnection;
   @Inject ExportUtils exportUtils;
-  @Inject @Parameter(RequestParameters.PARAM_TLD) String tld;
+
+  @Inject
+  @Parameter(RequestParameters.PARAM_TLD)
+  String tldStr;
+
   @Inject Response response;
   @Inject ExportReservedTermsAction() {}
 
@@ -61,23 +65,25 @@ public class ExportReservedTermsAction implements Runnable {
   public void run() {
     response.setContentType(PLAIN_TEXT_UTF_8);
     try {
-      Registry registry = Registry.get(tld);
+      Tld tld = Tld.get(tldStr);
       String resultMsg;
-      if (registry.getReservedListNames().isEmpty() && isNullOrEmpty(registry.getDriveFolderId())) {
+      if (tld.getReservedListNames().isEmpty() && isNullOrEmpty(tld.getDriveFolderId())) {
         resultMsg = "No reserved lists configured";
-        logger.atInfo().log("No reserved terms to export for TLD '%s'.", tld);
-      } else if (registry.getDriveFolderId() == null) {
+        logger.atInfo().log("No reserved terms to export for TLD '%s'.", tldStr);
+      } else if (tld.getDriveFolderId() == null) {
         resultMsg = "Skipping export because no Drive folder is associated with this TLD";
         logger.atInfo().log(
-            "Skipping reserved terms export for TLD %s because Drive folder isn't specified.", tld);
+            "Skipping reserved terms export for TLD %s because Drive folder isn't specified.",
+            tldStr);
       } else {
-        resultMsg = driveConnection.createOrUpdateFile(
-            RESERVED_TERMS_FILENAME,
-            EXPORT_MIME_TYPE,
-            registry.getDriveFolderId(),
-            exportUtils.exportReservedTerms(registry).getBytes(UTF_8));
+        resultMsg =
+            driveConnection.createOrUpdateFile(
+                RESERVED_TERMS_FILENAME,
+                EXPORT_MIME_TYPE,
+                tld.getDriveFolderId(),
+                exportUtils.exportReservedTerms(tld).getBytes(UTF_8));
         logger.atInfo().log(
-            "Exporting reserved terms succeeded for TLD %s, response was: %s", tld, resultMsg);
+            "Exporting reserved terms succeeded for TLD %s, response was: %s", tldStr, resultMsg);
       }
       response.setStatus(SC_OK);
       response.setPayload(resultMsg);
@@ -85,7 +91,8 @@ public class ExportReservedTermsAction implements Runnable {
       response.setStatus(SC_INTERNAL_SERVER_ERROR);
       response.setPayload(e.getMessage());
       throw new RuntimeException(
-          String.format("Exception occurred while exporting reserved terms for TLD %s.", tld), e);
+          String.format("Exception occurred while exporting reserved terms for TLD %s.", tldStr),
+          e);
     }
   }
 }

core/src/main/java/google/registry/export/ExportUtils.java

@@ -16,7 +16,7 @@ package google.registry.export;
 
 import com.google.common.base.Joiner;
 import google.registry.config.RegistryConfig.Config;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.model.tld.label.ReservedList.ReservedListEntry;
 import google.registry.model.tld.label.ReservedListDao;
@@ -36,10 +36,10 @@ public final class ExportUtils {
   }
 
   /** Returns the file contents of the auto-export reserved terms document for the given TLD. */
-  public String exportReservedTerms(Registry registry) {
+  public String exportReservedTerms(Tld tld) {
     StringBuilder termsBuilder = new StringBuilder(reservedTermsExportDisclaimer).append("\n");
     Set<String> reservedTerms = new TreeSet<>();
-    for (String reservedListName : registry.getReservedListNames()) {
+    for (String reservedListName : tld.getReservedListNames()) {
       ReservedList reservedList =
           ReservedListDao.getLatestRevision(reservedListName)
               .orElseThrow(

core/src/main/java/google/registry/flows/CheckApiAction.java

@@ -46,7 +46,7 @@ import google.registry.flows.domain.DomainFlowUtils.BadCommandForRegistryPhaseEx
 import google.registry.flows.domain.DomainFlowUtils.InvalidIdnDomainLabelException;
 import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.ReservationType;
 import google.registry.monitoring.whitebox.CheckApiMetric;
 import google.registry.monitoring.whitebox.CheckApiMetric.Availability;
@@ -116,9 +116,9 @@ public class CheckApiAction implements Runnable {
       validateDomainNameWithIdnTables(domainName);
 
       DateTime now = clock.nowUtc();
-      Registry registry = Registry.get(domainName.parent().toString());
+      Tld tld = Tld.get(domainName.parent().toString());
       try {
-        verifyNotInPredelegation(registry, now);
+        verifyNotInPredelegation(tld, now);
       } catch (BadCommandForRegistryPhaseException e) {
         metricBuilder.status(INVALID_REGISTRY_PHASE);
         return fail("Check in this TLD is not allowed in the current registry phase");

core/src/main/java/google/registry/flows/custom/DomainPricingCustomLogic.java

@@ -23,7 +23,7 @@ import google.registry.flows.domain.DomainPricingLogic;
 import google.registry.flows.domain.FeesAndCredits;
 import google.registry.model.ImmutableObject;
 import google.registry.model.eppinput.EppInput;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 
@@ -81,7 +81,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
     public abstract FeesAndCredits feesAndCredits();
 
-    public abstract Registry registry();
+    public abstract Tld tld();
 
     public abstract InternetDomainName domainName();
 
@@ -99,7 +99,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setRegistry(Registry registry);
+      public abstract Builder setTld(Tld tld);
 
       public abstract Builder setDomainName(InternetDomainName domainName);
 
@@ -117,7 +117,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
     public abstract FeesAndCredits feesAndCredits();
 
-    public abstract Registry registry();
+    public abstract Tld tld();
 
     public abstract InternetDomainName domainName();
 
@@ -135,7 +135,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setRegistry(Registry registry);
+      public abstract Builder setTld(Tld tld);
 
       public abstract Builder setDomainName(InternetDomainName domainName);
 
@@ -153,7 +153,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
     public abstract FeesAndCredits feesAndCredits();
 
-    public abstract Registry registry();
+    public abstract Tld tld();
 
     public abstract InternetDomainName domainName();
 
@@ -169,7 +169,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setRegistry(Registry registry);
+      public abstract Builder setTld(Tld tld);
 
       public abstract Builder setDomainName(InternetDomainName domainName);
 
@@ -185,7 +185,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
     public abstract FeesAndCredits feesAndCredits();
 
-    public abstract Registry registry();
+    public abstract Tld tld();
 
     public abstract InternetDomainName domainName();
 
@@ -201,7 +201,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setRegistry(Registry registry);
+      public abstract Builder setTld(Tld tld);
 
       public abstract Builder setDomainName(InternetDomainName domainName);
 
@@ -217,7 +217,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
     public abstract FeesAndCredits feesAndCredits();
 
-    public abstract Registry registry();
+    public abstract Tld tld();
 
     public abstract InternetDomainName domainName();
 
@@ -233,7 +233,7 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
 
       public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setRegistry(Registry registry);
+      public abstract Builder setTld(Tld tld);
 
       public abstract Builder setDomainName(InternetDomainName domainName);
 

core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java

@@ -30,7 +30,7 @@ import static google.registry.flows.domain.DomainFlowUtils.isValidReservedCreate
 import static google.registry.flows.domain.DomainFlowUtils.validateDomainName;
 import static google.registry.flows.domain.DomainFlowUtils.validateDomainNameWithIdnTables;
 import static google.registry.flows.domain.DomainFlowUtils.verifyNotInPredelegation;
-import static google.registry.model.tld.Registry.TldState.START_DATE_SUNRISE;
+import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.getTypeOfHighestSeverity;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
@@ -50,6 +50,7 @@ import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.custom.DomainCheckFlowCustomLogic;
 import google.registry.flows.custom.DomainCheckFlowCustomLogic.BeforeResponseParameters;
 import google.registry.flows.custom.DomainCheckFlowCustomLogic.BeforeResponseReturnData;
+import google.registry.flows.domain.DomainPricingLogic.AllocationTokenInvalidForPremiumNameException;
 import google.registry.flows.domain.token.AllocationTokenDomainCheckResults;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotInPromotionException;
@@ -59,7 +60,7 @@ import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTok
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForTldException;
 import google.registry.model.EppResource;
 import google.registry.model.ForeignKeyUtils;
-import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Check;
 import google.registry.model.domain.fee.FeeCheckCommandExtension;
@@ -77,10 +78,11 @@ import google.registry.model.eppoutput.CheckData.DomainCheckData;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
 import google.registry.model.tld.label.ReservationType;
 import google.registry.persistence.VKey;
+import google.registry.pricing.PricingEngineProxy;
 import google.registry.util.Clock;
 import java.util.HashSet;
 import java.util.Optional;
@@ -164,7 +166,7 @@ public final class DomainCheckFlow implements Flow {
       if (tldFirstTimeSeen && !isSuperuser) {
         checkAllowedAccessToTld(registrarId, tld);
         checkHasBillingAccount(registrarId, tld);
-        verifyNotInPredelegation(Registry.get(tld), now);
+        verifyNotInPredelegation(Tld.get(tld), now);
       }
     }
     ImmutableMap<String, InternetDomainName> parsedDomains = parsedDomainsBuilder.build();
@@ -190,7 +192,7 @@ public final class DomainCheckFlow implements Flow {
     ImmutableList.Builder<DomainCheck> checksBuilder = new ImmutableList.Builder<>();
     ImmutableSet.Builder<String> availableDomains = new ImmutableSet.Builder<>();
     ImmutableMap<String, TldState> tldStates =
-        Maps.toMap(seenTlds, tld -> Registry.get(tld).getTldState(now));
+        Maps.toMap(seenTlds, tld -> Tld.get(tld).getTldState(now));
     ImmutableMap<InternetDomainName, String> domainCheckResults =
         tokenDomainCheckResults
             .map(AllocationTokenDomainCheckResults::domainCheckResults)
@@ -271,14 +273,13 @@ public final class DomainCheckFlow implements Flow {
         new ImmutableList.Builder<>();
     ImmutableMap<String, Domain> domainObjs =
         loadDomainsForRestoreChecks(feeCheck, domainNames, existingDomains);
-    ImmutableMap<String, BillingEvent.Recurring> recurrences =
-        loadRecurrencesForDomains(domainObjs);
+    ImmutableMap<String, BillingRecurrence> recurrences = loadRecurrencesForDomains(domainObjs);
 
     for (FeeCheckCommandExtensionItem feeCheckItem : feeCheck.getItems()) {
       for (String domainName : getDomainNamesToCheckForFee(feeCheckItem, domainNames.keySet())) {
         Optional<AllocationToken> defaultToken =
             DomainFlowUtils.checkForDefaultToken(
-                Registry.get(InternetDomainName.from(domainName).parent().toString()),
+                Tld.get(InternetDomainName.from(domainName).parent().toString()),
                 domainName,
                 feeCheckItem.getCommandName(),
                 registrarId,
@@ -292,6 +293,7 @@ public final class DomainCheckFlow implements Flow {
                 allocationToken.get(),
                 feeCheckItem.getCommandName(),
                 registrarId,
+                PricingEngineProxy.isDomainPremium(domainName, now),
                 now);
           }
           handleFeeRequest(
@@ -306,14 +308,15 @@ public final class DomainCheckFlow implements Flow {
               availableDomains.contains(domainName),
               recurrences.getOrDefault(domainName, null));
           responseItems.add(builder.setDomainNameIfSupported(domainName).build());
-        } catch (AllocationTokenNotValidForCommandException
+        } catch (AllocationTokenInvalidForPremiumNameException
+            | AllocationTokenNotValidForCommandException
             | AllocationTokenNotValidForDomainException
             | AllocationTokenNotValidForRegistrarException
             | AllocationTokenNotValidForTldException
             | AllocationTokenNotInPromotionException e) {
           // Allocation token is either not an active token or it is not valid for the EPP command,
           // registrar, domain, or TLD.
-          Registry registry = Registry.get(InternetDomainName.from(domainName).parent().toString());
+          Tld tld = Tld.get(InternetDomainName.from(domainName).parent().toString());
           responseItems.add(
               builder
                   .setDomainNameIfSupported(domainName)
@@ -322,7 +325,7 @@ public final class DomainCheckFlow implements Flow {
                       feeCheckItem.getCommandName(),
                       feeCheckItem.getPhase(),
                       feeCheckItem.getSubphase())
-                  .setCurrencyIfSupported(registry.getCurrency())
+                  .setCurrencyIfSupported(tld.getCurrency())
                   .setClass("token-not-supported")
                   .build());
         }
@@ -377,16 +380,15 @@ public final class DomainCheckFlow implements Flow {
         Maps.transformEntries(existingDomainsToLoad, (k, v) -> (Domain) loadedDomains.get(v)));
   }
 
-  private ImmutableMap<String, BillingEvent.Recurring> loadRecurrencesForDomains(
+  private ImmutableMap<String, BillingRecurrence> loadRecurrencesForDomains(
       ImmutableMap<String, Domain> domainObjs) {
     return tm().transact(
             () -> {
-              ImmutableMap<VKey<? extends BillingEvent.Recurring>, BillingEvent.Recurring>
-                  recurrences =
-                      tm().loadByKeys(
-                              domainObjs.values().stream()
-                                  .map(Domain::getAutorenewBillingEvent)
-                                  .collect(toImmutableSet()));
+              ImmutableMap<VKey<? extends BillingRecurrence>, BillingRecurrence> recurrences =
+                  tm().loadByKeys(
+                          domainObjs.values().stream()
+                              .map(Domain::getAutorenewBillingEvent)
+                              .collect(toImmutableSet()));
               return ImmutableMap.copyOf(
                   Maps.transformValues(
                       domainObjs, d -> recurrences.get(d.getAutorenewBillingEvent())));

core/src/main/java/google/registry/flows/domain/DomainClaimsCheckFlow.java

@@ -45,7 +45,7 @@ import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppinput.ResourceCommand;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.util.Clock;
 import java.util.HashSet;
@@ -96,16 +96,16 @@ public final class DomainClaimsCheckFlow implements Flow {
     for (String domainName : ImmutableSet.copyOf(domainNames)) {
       InternetDomainName parsedDomain = validateDomainName(domainName);
       validateDomainNameWithIdnTables(parsedDomain);
-      String tld = parsedDomain.parent().toString();
+      String tldStr = parsedDomain.parent().toString();
       // Only validate access to a TLD the first time it is encountered.
-      if (seenTlds.add(tld)) {
+      if (seenTlds.add(tldStr)) {
         if (!isSuperuser) {
-          checkAllowedAccessToTld(registrarId, tld);
-          checkHasBillingAccount(registrarId, tld);
-          Registry registry = Registry.get(tld);
+          checkAllowedAccessToTld(registrarId, tldStr);
+          checkHasBillingAccount(registrarId, tldStr);
+          Tld tld = Tld.get(tldStr);
           DateTime now = clock.nowUtc();
-          verifyNotInPredelegation(registry, now);
-          verifyClaimsPeriodNotEnded(registry, now);
+          verifyNotInPredelegation(tld, now);
+          verifyClaimsPeriodNotEnded(tld, now);
         }
       }
       Optional<String> claimKey = ClaimsListDao.get().getClaimKey(parsedDomain.parts().get(0));

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -47,9 +47,9 @@ import static google.registry.model.EppResourceUtils.createDomainRepoId;
 import static google.registry.model.IdService.allocateId;
 import static google.registry.model.eppcommon.StatusValue.SERVER_HOLD;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_CREATE;
-import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
-import static google.registry.model.tld.Registry.TldState.QUIET_PERIOD;
-import static google.registry.model.tld.Registry.TldState.START_DATE_SUNRISE;
+import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
+import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
+import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.NAME_COLLISION;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
@@ -77,11 +77,11 @@ import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.flows.exceptions.ResourceAlreadyExistsForThisClientException;
 import google.registry.flows.exceptions.ResourceCreateContentionException;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingBase.Reason;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.Reason;
-import google.registry.model.billing.BillingEvent.Recurring;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand;
 import google.registry.model.domain.DomainCommand.Create;
@@ -112,9 +112,9 @@ import google.registry.model.reporting.DomainTransactionRecord.TransactionReport
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.ReservationType;
 import google.registry.model.tmch.ClaimsList;
 import google.registry.model.tmch.ClaimsListDao;
@@ -253,9 +253,9 @@ public final class DomainCreateFlow implements TransactionalFlow {
     // Validate that this is actually a legal domain name on a TLD that the registrar has access to.
     InternetDomainName domainName = validateDomainName(command.getDomainName());
     String domainLabel = domainName.parts().get(0);
-    Registry registry = Registry.get(domainName.parent().toString());
-    validateCreateCommandContactsAndNameservers(command, registry, domainName);
-    TldState tldState = registry.getTldState(now);
+    Tld tld = Tld.get(domainName.parent().toString());
+    validateCreateCommandContactsAndNameservers(command, tld, domainName);
+    TldState tldState = tld.getTldState(now);
     Optional<LaunchCreateExtension> launchCreate =
         eppInput.getSingleExtension(LaunchCreateExtension.class);
     boolean hasSignedMarks =
@@ -270,7 +270,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
     Optional<AllocationToken> allocationToken =
         allocationTokenFlowUtils.verifyAllocationTokenCreateIfPresent(
             command,
-            registry,
+            tld,
             registrarId,
             now,
             eppInput.getSingleExtension(AllocationTokenExtension.class));
@@ -278,7 +278,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
     if (!allocationToken.isPresent()) {
       allocationToken =
           DomainFlowUtils.checkForDefaultToken(
-              registry, command.getDomainName(), CommandName.CREATE, registrarId, now);
+              tld, command.getDomainName(), CommandName.CREATE, registrarId, now);
       if (allocationToken.isPresent()) {
         defaultTokenUsed = true;
       }
@@ -291,12 +291,12 @@ public final class DomainCreateFlow implements TransactionalFlow {
     // notice without specifying a claims key, ignore the registry phase, and override blocks on
     // registering premium domains.
     if (!isSuperuser) {
-      checkAllowedAccessToTld(registrarId, registry.getTldStr());
-      checkHasBillingAccount(registrarId, registry.getTldStr());
+      checkAllowedAccessToTld(registrarId, tld.getTldStr());
+      checkHasBillingAccount(registrarId, tld.getTldStr());
       boolean isValidReservedCreate = isValidReservedCreate(domainName, allocationToken);
       ClaimsList claimsList = ClaimsListDao.get();
       verifyIsGaOrSpecialCase(
-          registry,
+          tld,
           claimsList,
           now,
           domainLabel,
@@ -305,15 +305,15 @@ public final class DomainCreateFlow implements TransactionalFlow {
           isValidReservedCreate,
           hasSignedMarks);
       if (launchCreate.isPresent()) {
-        verifyLaunchPhaseMatchesRegistryPhase(registry, launchCreate.get(), now);
+        verifyLaunchPhaseMatchesRegistryPhase(tld, launchCreate.get(), now);
       }
       if (!isAnchorTenant && !isValidReservedCreate) {
         verifyNotReserved(domainName, isSunriseCreate);
       }
       if (hasClaimsNotice) {
-        verifyClaimsPeriodNotEnded(registry, now);
+        verifyClaimsPeriodNotEnded(tld, now);
       }
-      if (now.isBefore(registry.getClaimsPeriodEnd())) {
+      if (now.isBefore(tld.getClaimsPeriodEnd())) {
         verifyClaimsNoticeIfAndOnlyIfNeeded(
             domainName, claimsList, hasSignedMarks, hasClaimsNotice);
       }
@@ -338,20 +338,19 @@ public final class DomainCreateFlow implements TransactionalFlow {
     Optional<FeeCreateCommandExtension> feeCreate =
         eppInput.getSingleExtension(FeeCreateCommandExtension.class);
     FeesAndCredits feesAndCredits =
-        pricingLogic.getCreatePrice(
-            registry, targetId, now, years, isAnchorTenant, allocationToken);
+        pricingLogic.getCreatePrice(tld, targetId, now, years, isAnchorTenant, allocationToken);
     validateFeeChallenge(feeCreate, feesAndCredits, defaultTokenUsed);
     Optional<SecDnsCreateExtension> secDnsCreate =
         validateSecDnsExtension(eppInput.getSingleExtension(SecDnsCreateExtension.class));
     DateTime registrationExpirationTime = leapSafeAddYears(now, years);
-    String repoId = createDomainRepoId(allocateId(), registry.getTldStr());
+    String repoId = createDomainRepoId(allocateId(), tld.getTldStr());
     long historyRevisionId = allocateId();
     HistoryEntryId domainHistoryId = new HistoryEntryId(repoId, historyRevisionId);
     historyBuilder.setRevisionId(historyRevisionId);
     // Bill for the create.
-    BillingEvent.OneTime createBillingEvent =
-        createOneTimeBillingEvent(
-            registry,
+    BillingEvent createBillingEvent =
+        createBillingEvent(
+            tld,
             isAnchorTenant,
             isSunriseCreate,
             isReserved(domainName, isSunriseCreate),
@@ -361,7 +360,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
             allocationToken,
             now);
     // Create a new autorenew billing event and poll message starting at the expiration time.
-    BillingEvent.Recurring autorenewBillingEvent =
+    BillingRecurrence autorenewBillingEvent =
         createAutorenewBillingEvent(
             domainHistoryId,
             registrationExpirationTime,
@@ -414,7 +413,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
           domain.asBuilder().setCurrentPackageToken(allocationToken.get().createVKey()).build();
     }
     DomainHistory domainHistory =
-        buildDomainHistory(domain, registry, now, period, registry.getAddGracePeriodLength());
+        buildDomainHistory(domain, tld, now, period, tld.getAddGracePeriodLength());
     if (reservationTypes.contains(NAME_COLLISION)) {
       entitiesToSave.add(
           createNameCollisionOneTimePollMessage(targetId, domainHistory, registrarId, now));
@@ -493,7 +492,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
    * non-superusers.
    */
   private void verifyIsGaOrSpecialCase(
-      Registry registry,
+      Tld tld,
       ClaimsList claimsList,
       DateTime now,
       String domainLabel,
@@ -505,7 +504,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
           MustHaveSignedMarksInCurrentPhaseException,
           NoTrademarkedRegistrationsBeforeSunriseException {
     // We allow general registration during GA.
-    TldState currentState = registry.getTldState(now);
+    TldState currentState = tld.getTldState(now);
     if (currentState.equals(GENERAL_AVAILABILITY)) {
       return;
     }
@@ -526,7 +525,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
         // Trademarked domains cannot be registered until after the sunrise period has ended, unless
         // a valid signed mark is provided. Signed marks can only be provided during sunrise.
         // Thus, when bypassing TLD state checks, a post-sunrise state is always fine.
-        if (registry.getTldStateTransitions().headMap(now).containsValue(START_DATE_SUNRISE)) {
+        if (tld.getTldStateTransitions().headMap(now).containsValue(START_DATE_SUNRISE)) {
           return;
         } else {
           // If sunrise hasn't happened yet, trademarked domains are unavailable
@@ -559,23 +558,22 @@ public final class DomainCreateFlow implements TransactionalFlow {
   }
 
   private DomainHistory buildDomainHistory(
-      Domain domain, Registry registry, DateTime now, Period period, Duration addGracePeriod) {
+      Domain domain, Tld tld, DateTime now, Period period, Duration addGracePeriod) {
     // We ignore prober transactions
-    if (registry.getTldType() == TldType.REAL) {
-      historyBuilder
-          .setDomainTransactionRecords(
-              ImmutableSet.of(
-                  DomainTransactionRecord.create(
-                      registry.getTldStr(),
-                      now.plus(addGracePeriod),
-                      TransactionReportField.netAddsFieldFromYears(period.getValue()),
-                      1)));
+    if (tld.getTldType() == TldType.REAL) {
+      historyBuilder.setDomainTransactionRecords(
+          ImmutableSet.of(
+              DomainTransactionRecord.create(
+                  tld.getTldStr(),
+                  now.plus(addGracePeriod),
+                  TransactionReportField.netAddsFieldFromYears(period.getValue()),
+                  1)));
     }
     return historyBuilder.setType(DOMAIN_CREATE).setPeriod(period).setDomain(domain).build();
   }
 
-  private BillingEvent.OneTime createOneTimeBillingEvent(
-      Registry registry,
+  private BillingEvent createBillingEvent(
+      Tld tld,
       boolean isAnchorTenant,
       boolean isSunriseCreate,
       boolean isReserved,
@@ -596,7 +594,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
       // it if it's reserved for other reasons.
       flagsBuilder.add(Flag.RESERVED);
     }
-    return new BillingEvent.OneTime.Builder()
+    return new BillingEvent.Builder()
         .setReason(Reason.CREATE)
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
@@ -607,18 +605,18 @@ public final class DomainCreateFlow implements TransactionalFlow {
         .setBillingTime(
             now.plus(
                 isAnchorTenant
-                    ? registry.getAnchorTenantAddGracePeriodLength()
-                    : registry.getAddGracePeriodLength()))
+                    ? tld.getAnchorTenantAddGracePeriodLength()
+                    : tld.getAddGracePeriodLength()))
         .setFlags(flagsBuilder.build())
         .setDomainHistoryId(domainHistoryId)
         .build();
   }
 
-  private Recurring createAutorenewBillingEvent(
+  private BillingRecurrence createAutorenewBillingEvent(
       HistoryEntryId domainHistoryId,
       DateTime registrationExpirationTime,
       RenewalPriceInfo renewalpriceInfo) {
-    return new BillingEvent.Recurring.Builder()
+    return new BillingRecurrence.Builder()
         .setReason(Reason.RENEW)
         .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
         .setTargetId(targetId)
@@ -642,9 +640,9 @@ public final class DomainCreateFlow implements TransactionalFlow {
         .build();
   }
 
-  private static BillingEvent.OneTime createEapBillingEvent(
-      FeesAndCredits feesAndCredits, BillingEvent.OneTime createBillingEvent) {
-    return new BillingEvent.OneTime.Builder()
+  private static BillingEvent createEapBillingEvent(
+      FeesAndCredits feesAndCredits, BillingEvent createBillingEvent) {
+    return new BillingEvent.Builder()
         .setReason(Reason.FEE_EARLY_ACCESS)
         .setTargetId(createBillingEvent.getTargetId())
         .setRegistrarId(createBillingEvent.getRegistrarId())
@@ -673,7 +671,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
 
   /**
    * Determines the {@link RenewalPriceBehavior} and the renewal price that needs be stored in the
-   * {@link Recurring} billing events.
+   * {@link BillingRecurrence} billing events.
    *
    * <p>By default, the renewal price is calculated during the process of renewal. Renewal price
    * should be the createCost if and only if the renewal price behavior in the {@link
@@ -699,7 +697,7 @@ public final class DomainCreateFlow implements TransactionalFlow {
     }
   }
 
-  /** A class to store renewal info used in {@link Recurring} billing events. */
+  /** A class to store renewal info used in {@link BillingRecurrence} billing events. */
   @AutoValue
   public abstract static class RenewalPriceInfo {
     static DomainCreateFlow.RenewalPriceInfo create(

core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java

@@ -61,8 +61,9 @@ import google.registry.flows.custom.DomainDeleteFlowCustomLogic.BeforeResponseRe
 import google.registry.flows.custom.DomainDeleteFlowCustomLogic.BeforeSaveParameters;
 import google.registry.flows.custom.EntityChanges;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -88,8 +89,8 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Collections;
 import java.util.Optional;
@@ -146,8 +147,8 @@ public final class DomainDeleteFlow implements TransactionalFlow {
     DateTime now = tm().getTransactionTime();
     // Loads the target resource if it exists
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
-    Registry registry = Registry.get(existingDomain.getTld());
-    verifyDeleteAllowed(existingDomain, registry, now);
+    Tld tld = Tld.get(existingDomain.getTld());
+    verifyDeleteAllowed(existingDomain, tld, now);
     flowCustomLogic.afterValidation(
         AfterValidationParameters.newBuilder().setExistingDomain(existingDomain).build());
     ImmutableSet.Builder<ImmutableObject> entitiesToSave = new ImmutableSet.Builder<>();
@@ -160,8 +161,8 @@ public final class DomainDeleteFlow implements TransactionalFlow {
       builder = existingDomain.asBuilder();
     }
     builder.setLastEppUpdateTime(now).setLastEppUpdateRegistrarId(registrarId);
-    Duration redemptionGracePeriodLength = registry.getRedemptionGracePeriodLength();
-    Duration pendingDeleteLength = registry.getPendingDeleteLength();
+    Duration redemptionGracePeriodLength = tld.getRedemptionGracePeriodLength();
+    Duration pendingDeleteLength = tld.getPendingDeleteLength();
     Optional<DomainDeleteSuperuserExtension> domainDeleteSuperuserExtension =
         eppInput.getSingleExtension(DomainDeleteSuperuserExtension.class);
     if (domainDeleteSuperuserExtension.isPresent()) {
@@ -232,15 +233,15 @@ public final class DomainDeleteFlow implements TransactionalFlow {
       // No cancellation is written if the grace period was not for a billable event.
       if (gracePeriod.hasBillingEvent()) {
         entitiesToSave.add(
-            BillingEvent.Cancellation.forGracePeriod(gracePeriod, now, domainHistoryId, targetId));
-        if (gracePeriod.getOneTimeBillingEvent() != null) {
+            BillingCancellation.forGracePeriod(gracePeriod, now, domainHistoryId, targetId));
+        if (gracePeriod.getBillingEvent() != null) {
           // Take the amount of registration time being refunded off the expiration time.
           // This can be either add grace periods or renew grace periods.
-          BillingEvent.OneTime oneTime = tm().loadByKey(gracePeriod.getOneTimeBillingEvent());
-          newExpirationTime = newExpirationTime.minusYears(oneTime.getPeriodYears());
-        } else if (gracePeriod.getRecurringBillingEvent() != null) {
+          BillingEvent billingEvent = tm().loadByKey(gracePeriod.getBillingEvent());
+          newExpirationTime = newExpirationTime.minusYears(billingEvent.getPeriodYears());
+        } else if (gracePeriod.getBillingRecurrence() != null) {
           // Take 1 year off the registration if in the autorenew grace period (no need to load the
-          // recurring billing event; all autorenews are for 1 year).
+          // recurrence billing event; all autorenews are for 1 year).
           newExpirationTime = newExpirationTime.minusYears(1);
         }
       }
@@ -249,14 +250,15 @@ public final class DomainDeleteFlow implements TransactionalFlow {
 
     Domain newDomain = builder.build();
     DomainHistory domainHistory =
-        buildDomainHistory(newDomain, registry, now, durationUntilDelete, inAddGracePeriod);
+        buildDomainHistory(newDomain, tld, now, durationUntilDelete, inAddGracePeriod);
     handlePendingTransferOnDelete(existingDomain, newDomain, now, domainHistory);
     // Close the autorenew billing event and poll message. This may delete the poll message.  Store
-    // the updated recurring billing event, we'll need it later and can't reload it.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
-    BillingEvent.Recurring recurringBillingEvent =
+    // the updated recurrence billing event, we'll need it later and can't reload it.
+    BillingRecurrence existingBillingRecurrence =
+        tm().loadByKey(existingDomain.getAutorenewBillingEvent());
+    BillingRecurrence billingRecurrence =
         updateAutorenewRecurrenceEndTime(
-            existingDomain, existingRecurring, now, domainHistory.getHistoryEntryId());
+            existingDomain, existingBillingRecurrence, now, domainHistory.getHistoryEntryId());
     // If there's a pending transfer, the gaining client's autorenew billing
     // event and poll message will already have been deleted in
     // ResourceDeleteFlow since it's listed in serverApproveEntities.
@@ -280,7 +282,7 @@ public final class DomainDeleteFlow implements TransactionalFlow {
                         ? SUCCESS_WITH_ACTION_PENDING
                         : SUCCESS)
                 .setResponseExtensions(
-                    getResponseExtensions(recurringBillingEvent, existingDomain, now))
+                    getResponseExtensions(billingRecurrence, existingDomain, now))
                 .build());
     persistEntityChanges(entityChanges);
     return responseBuilder
@@ -289,14 +291,14 @@ public final class DomainDeleteFlow implements TransactionalFlow {
         .build();
   }
 
-  private void verifyDeleteAllowed(Domain existingDomain, Registry registry, DateTime now)
+  private void verifyDeleteAllowed(Domain existingDomain, Tld tld, DateTime now)
       throws EppException {
     verifyNoDisallowedStatuses(existingDomain, DISALLOWED_STATUSES);
     verifyOptionalAuthInfo(authInfo, existingDomain);
     if (!isSuperuser) {
       verifyResourceOwnership(registrarId, existingDomain);
-      verifyNotInPredelegation(registry, now);
-      checkAllowedAccessToTld(registrarId, registry.getTld().toString());
+      verifyNotInPredelegation(tld, now);
+      checkAllowedAccessToTld(registrarId, tld.getTld().toString());
     }
     if (!existingDomain.getSubordinateHosts().isEmpty()) {
       throw new DomainToDeleteHasHostsException();
@@ -305,17 +307,18 @@ public final class DomainDeleteFlow implements TransactionalFlow {
 
   private DomainHistory buildDomainHistory(
       Domain domain,
-      Registry registry,
+      Tld tld,
       DateTime now,
       Duration durationUntilDelete,
       boolean inAddGracePeriod) {
     // We ignore prober transactions
-    if (registry.getTldType() == TldType.REAL) {
-      Duration maxGracePeriod = Collections.max(
-          ImmutableSet.of(
-              registry.getAddGracePeriodLength(),
-              registry.getAutoRenewGracePeriodLength(),
-              registry.getRenewGracePeriodLength()));
+    if (tld.getTldType() == TldType.REAL) {
+      Duration maxGracePeriod =
+          Collections.max(
+              ImmutableSet.of(
+                  tld.getAddGracePeriodLength(),
+                  tld.getAutoRenewGracePeriodLength(),
+                  tld.getRenewGracePeriodLength()));
       ImmutableSet<DomainTransactionRecord> cancelledRecords =
           createCancelingRecords(
               domain,
@@ -379,7 +382,7 @@ public final class DomainDeleteFlow implements TransactionalFlow {
 
   @Nullable
   private ImmutableList<FeeTransformResponseExtension> getResponseExtensions(
-      BillingEvent.Recurring recurringBillingEvent, Domain existingDomain, DateTime now) {
+      BillingRecurrence billingRecurrence, Domain existingDomain, DateTime now) {
     FeeTransformResponseExtension.Builder feeResponseBuilder = getDeleteResponseBuilder();
     if (feeResponseBuilder == null) {
       return ImmutableList.of();
@@ -387,7 +390,7 @@ public final class DomainDeleteFlow implements TransactionalFlow {
     ImmutableList.Builder<Credit> creditsBuilder = new ImmutableList.Builder<>();
     for (GracePeriod gracePeriod : existingDomain.getGracePeriods()) {
       if (gracePeriod.hasBillingEvent()) {
-        Money cost = getGracePeriodCost(recurringBillingEvent, gracePeriod, now);
+        Money cost = getGracePeriodCost(billingRecurrence, gracePeriod, now);
         creditsBuilder.add(Credit.create(
             cost.negated().getAmount(), FeeType.CREDIT, gracePeriod.getType().getXmlName()));
         feeResponseBuilder.setCurrency(checkNotNull(cost.getCurrencyUnit()));
@@ -401,14 +404,14 @@ public final class DomainDeleteFlow implements TransactionalFlow {
   }
 
   private Money getGracePeriodCost(
-      BillingEvent.Recurring recurringBillingEvent, GracePeriod gracePeriod, DateTime now) {
+      BillingRecurrence billingRecurrence, GracePeriod gracePeriod, DateTime now) {
     if (gracePeriod.getType() == GracePeriodStatus.AUTO_RENEW) {
       // If we updated the autorenew billing event, reuse it.
       DateTime autoRenewTime =
-          recurringBillingEvent.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now);
+          billingRecurrence.getRecurrenceTimeOfYear().getLastInstanceBeforeOrAt(now);
       return getDomainRenewCost(targetId, autoRenewTime, 1);
     }
-    return tm().loadByKey(checkNotNull(gracePeriod.getOneTimeBillingEvent())).getCost();
+    return tm().loadByKey(checkNotNull(gracePeriod.getBillingEvent())).getCost();
   }
 
   @Nullable

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -28,10 +28,10 @@ import static com.google.common.collect.Sets.union;
 import static google.registry.model.domain.Domain.MAX_REGISTRATION_YEARS;
 import static google.registry.model.tld.Registries.findTldForName;
 import static google.registry.model.tld.Registries.getTlds;
-import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
-import static google.registry.model.tld.Registry.TldState.PREDELEGATION;
-import static google.registry.model.tld.Registry.TldState.QUIET_PERIOD;
-import static google.registry.model.tld.Registry.TldState.START_DATE_SUNRISE;
+import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
+import static google.registry.model.tld.Tld.TldState.PREDELEGATION;
+import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
+import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.ALLOWED_IN_SUNRISE;
 import static google.registry.model.tld.label.ReservationType.FULLY_BLOCKED;
 import static google.registry.model.tld.label.ReservationType.NAME_COLLISION;
@@ -74,13 +74,13 @@ import google.registry.flows.EppException.ParameterValueSyntaxErrorException;
 import google.registry.flows.EppException.RequiredParameterMissingException;
 import google.registry.flows.EppException.StatusProhibitsOperationException;
 import google.registry.flows.EppException.UnimplementedOptionException;
+import google.registry.flows.domain.DomainPricingLogic.AllocationTokenInvalidForPremiumNameException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException;
 import google.registry.model.EppResource;
-import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.Reason;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingBase.Reason;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.DesignatedContact.Type;
@@ -124,9 +124,9 @@ import google.registry.model.registrar.Registrar.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.ReservationType;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.model.tmch.ClaimsList;
@@ -302,17 +302,17 @@ public class DomainFlowUtils {
   }
 
   /** Check if the registrar has the correct billing account map configured. */
-  public static void checkHasBillingAccount(String registrarId, String tld) throws EppException {
-    Registry registry = Registry.get(tld);
+  public static void checkHasBillingAccount(String registrarId, String tldStr) throws EppException {
+    Tld tld = Tld.get(tldStr);
     // Don't enforce the billing account check on test (i.e. prober/OT&E) TLDs.
-    if (registry.getTldType() == TldType.TEST) {
+    if (tld.getTldType() == TldType.TEST) {
       return;
     }
     if (!Registrar.loadByRegistrarIdCached(registrarId)
         .get()
         .getBillingAccountMap()
-        .containsKey(registry.getCurrency())) {
-      throw new DomainFlowUtils.MissingBillingAccountMapException(registry.getCurrency());
+        .containsKey(tld.getCurrency())) {
+      throw new DomainFlowUtils.MissingBillingAccountMapException(tld.getCurrency());
     }
   }
 
@@ -412,8 +412,7 @@ public class DomainFlowUtils {
   static void validateNameserversCountForTld(String tld, InternetDomainName domainName, int count)
       throws EppException {
     // For TLDs with a nameserver allow list, all domains must have at least 1 nameserver.
-    ImmutableSet<String> tldNameserversAllowList =
-        Registry.get(tld).getAllowedFullyQualifiedHostNames();
+    ImmutableSet<String> tldNameserversAllowList = Tld.get(tld).getAllowedFullyQualifiedHostNames();
     if (!tldNameserversAllowList.isEmpty() && count == 0) {
       throw new NameserversNotSpecifiedForTldWithNameserverAllowListException(
           domainName.toString());
@@ -470,7 +469,7 @@ public class DomainFlowUtils {
 
   static void validateRegistrantAllowedOnTld(String tld, String registrantContactId)
       throws RegistrantNotAllowedException {
-    ImmutableSet<String> allowedRegistrants = Registry.get(tld).getAllowedRegistrantContactIds();
+    ImmutableSet<String> allowedRegistrants = Tld.get(tld).getAllowedRegistrantContactIds();
     // Empty allow list or null registrantContactId are ignored.
     if (registrantContactId != null
         && !allowedRegistrants.isEmpty()
@@ -481,7 +480,7 @@ public class DomainFlowUtils {
 
   static void validateNameserversAllowedOnTld(String tld, Set<String> fullyQualifiedHostNames)
       throws EppException {
-    ImmutableSet<String> allowedHostNames = Registry.get(tld).getAllowedFullyQualifiedHostNames();
+    ImmutableSet<String> allowedHostNames = Tld.get(tld).getAllowedFullyQualifiedHostNames();
     Set<String> hostnames = nullToEmpty(fullyQualifiedHostNames);
     if (!allowedHostNames.isEmpty()) { // Empty allow list is ignored.
       Set<String> disallowedNameservers = difference(hostnames, allowedHostNames);
@@ -514,13 +513,13 @@ public class DomainFlowUtils {
         domainName.parts().get(0), domainName.parent().toString());
   }
 
-  /** Verifies that a launch extension's specified phase matches the specified registry's phase. */
+  /** Verifies that a launch extension's specified phase matches the specified tld's phase. */
   static void verifyLaunchPhaseMatchesRegistryPhase(
-      Registry registry, LaunchExtension launchExtension, DateTime now) throws EppException {
+      Tld tld, LaunchExtension launchExtension, DateTime now) throws EppException {
     if (!LAUNCH_PHASE_TO_TLD_STATES.containsKey(launchExtension.getPhase())
         || !LAUNCH_PHASE_TO_TLD_STATES
             .get(launchExtension.getPhase())
-            .contains(registry.getTldState(now))) {
+            .contains(tld.getTldState(now))) {
       // No launch operations are allowed during the quiet period or predelegation.
       throw new LaunchPhaseMismatchException();
     }
@@ -557,8 +556,8 @@ public class DomainFlowUtils {
    * Fills in a builder with the data needed for an autorenew billing event for this domain. This
    * does not copy over the id of the current autorenew billing event.
    */
-  public static BillingEvent.Recurring.Builder newAutorenewBillingEvent(Domain domain) {
-    return new BillingEvent.Recurring.Builder()
+  public static BillingRecurrence.Builder newAutorenewBillingEvent(Domain domain) {
+    return new BillingRecurrence.Builder()
         .setReason(Reason.RENEW)
         .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
         .setTargetId(domain.getDomainName())
@@ -585,11 +584,11 @@ public class DomainFlowUtils {
    * (if opening the message interval). This may cause an autorenew billing event to have an end
    * time earlier than its event time (i.e. if it's being ended before it was ever triggered).
    *
-   * <p>Returns the new autorenew recurring billing event.
+   * <p>Returns the new autorenew recurrence billing event.
    */
-  public static Recurring updateAutorenewRecurrenceEndTime(
+  public static BillingRecurrence updateAutorenewRecurrenceEndTime(
       Domain domain,
-      Recurring existingRecurring,
+      BillingRecurrence existingBillingRecurrence,
       DateTime newEndTime,
       @Nullable HistoryEntryId historyId) {
     Optional<PollMessage.Autorenew> autorenewPollMessage =
@@ -624,9 +623,10 @@ public class DomainFlowUtils {
       tm().put(updatedAutorenewPollMessage);
     }
 
-    Recurring newRecurring = existingRecurring.asBuilder().setRecurrenceEndTime(newEndTime).build();
-    tm().put(newRecurring);
-    return newRecurring;
+    BillingRecurrence newBillingRecurrence =
+        existingBillingRecurrence.asBuilder().setRecurrenceEndTime(newEndTime).build();
+    tm().put(newBillingRecurrence);
+    return newBillingRecurrence;
   }
 
   /**
@@ -643,7 +643,7 @@ public class DomainFlowUtils {
       DomainPricingLogic pricingLogic,
       Optional<AllocationToken> allocationToken,
       boolean isAvailable,
-      @Nullable Recurring recurringBillingEvent)
+      @Nullable BillingRecurrence billingRecurrence)
       throws EppException {
     DateTime now = currentDate;
     // Use the custom effective date specified in the fee check request, if there is one.
@@ -652,9 +652,9 @@ public class DomainFlowUtils {
       builder.setEffectiveDateIfSupported(now);
     }
     String domainNameString = domainName.toString();
-    Registry registry = Registry.get(domainName.parent().toString());
+    Tld tld = Tld.get(domainName.parent().toString());
     int years = verifyUnitIsYears(feeRequest.getPeriod()).getValue();
-    boolean isSunrise = (registry.getTldState(now) == START_DATE_SUNRISE);
+    boolean isSunrise = (tld.getTldState(now) == START_DATE_SUNRISE);
 
     if (feeRequest.getPhase() != null || feeRequest.getSubphase() != null) {
       throw new FeeChecksDontSupportPhasesException();
@@ -662,13 +662,13 @@ public class DomainFlowUtils {
 
     CurrencyUnit currency =
         feeRequest.getCurrency() != null ? feeRequest.getCurrency() : topLevelCurrency;
-    if ((currency != null) && !currency.equals(registry.getCurrency())) {
+    if ((currency != null) && !currency.equals(tld.getCurrency())) {
       throw new CurrencyUnitMismatchException();
     }
 
     builder
         .setCommand(feeRequest.getCommandName(), feeRequest.getPhase(), feeRequest.getSubphase())
-        .setCurrencyIfSupported(registry.getCurrency())
+        .setCurrencyIfSupported(tld.getCurrency())
         .setPeriod(feeRequest.getPeriod());
 
     String feeClass = null;
@@ -685,7 +685,7 @@ public class DomainFlowUtils {
           fees =
               pricingLogic
                   .getCreatePrice(
-                      registry,
+                      tld,
                       domainNameString,
                       now,
                       years,
@@ -699,7 +699,7 @@ public class DomainFlowUtils {
         fees =
             pricingLogic
                 .getRenewPrice(
-                    registry, domainNameString, now, years, recurringBillingEvent, allocationToken)
+                    tld, domainNameString, now, years, billingRecurrence, allocationToken)
                 .getFees();
         break;
       case RESTORE:
@@ -717,7 +717,7 @@ public class DomainFlowUtils {
         // restore because they can't be restored in the first place.
         boolean isExpired =
             domain.isPresent() && domain.get().getRegistrationExpirationTime().isBefore(now);
-        fees = pricingLogic.getRestorePrice(registry, domainNameString, now, isExpired).getFees();
+        fees = pricingLogic.getRestorePrice(tld, domainNameString, now, isExpired).getFees();
         break;
       case TRANSFER:
         if (years != 1) {
@@ -725,13 +725,11 @@ public class DomainFlowUtils {
         }
         builder.setAvailIfSupported(true);
         fees =
-            pricingLogic
-                .getTransferPrice(registry, domainNameString, now, recurringBillingEvent)
-                .getFees();
+            pricingLogic.getTransferPrice(tld, domainNameString, now, billingRecurrence).getFees();
         break;
       case UPDATE:
         builder.setAvailIfSupported(true);
-        fees = pricingLogic.getUpdatePrice(registry, domainNameString, now).getFees();
+        fees = pricingLogic.getUpdatePrice(tld, domainNameString, now).getFees();
         break;
       default:
         throw new UnknownFeeCommandException(feeRequest.getUnparsedCommandName());
@@ -742,7 +740,7 @@ public class DomainFlowUtils {
       // are returning any premium fees, but only if the fee class isn't already set (i.e. because
       // the domain is reserved, which overrides any other classes).
       boolean isNameCollisionInSunrise =
-          registry.getTldState(now).equals(START_DATE_SUNRISE)
+          tld.getTldState(now).equals(START_DATE_SUNRISE)
               && getReservationTypes(domainName).contains(NAME_COLLISION);
       boolean isPremium = fees.stream().anyMatch(BaseFee::isPremium);
       feeClass =
@@ -993,7 +991,7 @@ public class DomainFlowUtils {
   }
 
   /** Check that the registry phase is not predelegation, during which some flows are forbidden. */
-  public static void verifyNotInPredelegation(Registry registry, DateTime now)
+  public static void verifyNotInPredelegation(Tld registry, DateTime now)
       throws BadCommandForRegistryPhaseException {
     if (registry.getTldState(now) == PREDELEGATION) {
       throw new BadCommandForRegistryPhaseException();
@@ -1002,17 +1000,17 @@ public class DomainFlowUtils {
 
   /** Validate the contacts and nameservers specified in a domain create command. */
   static void validateCreateCommandContactsAndNameservers(
-      Create command, Registry registry, InternetDomainName domainName) throws EppException {
+      Create command, Tld tld, InternetDomainName domainName) throws EppException {
     verifyNotInPendingDelete(
         command.getContacts(), command.getRegistrant(), command.getNameservers());
     validateContactsHaveTypes(command.getContacts());
-    String tld = registry.getTldStr();
-    validateRegistrantAllowedOnTld(tld, command.getRegistrantContactId());
+    String tldStr = tld.getTldStr();
+    validateRegistrantAllowedOnTld(tldStr, command.getRegistrantContactId());
     validateNoDuplicateContacts(command.getContacts());
     validateRequiredContactsPresent(command.getRegistrant(), command.getContacts());
     ImmutableSet<String> hostNames = command.getNameserverHostNames();
-    validateNameserversCountForTld(tld, domainName, hostNames.size());
-    validateNameserversAllowedOnTld(tld, hostNames);
+    validateNameserversCountForTld(tldStr, domainName, hostNames.size());
+    validateNameserversAllowedOnTld(tldStr, hostNames);
   }
 
   /** Validate the secDNS extension, if present. */
@@ -1061,10 +1059,9 @@ public class DomainFlowUtils {
   }
 
   /** Check that the claims period hasn't ended. */
-  static void verifyClaimsPeriodNotEnded(Registry registry, DateTime now)
-      throws ClaimsPeriodEndedException {
-    if (isAtOrAfter(now, registry.getClaimsPeriodEnd())) {
-      throw new ClaimsPeriodEndedException(registry.getTldStr());
+  static void verifyClaimsPeriodNotEnded(Tld tld, DateTime now) throws ClaimsPeriodEndedException {
+    if (isAtOrAfter(now, tld.getClaimsPeriodEnd())) {
+      throw new ClaimsPeriodEndedException(tld.getTldStr());
     }
   }
 
@@ -1202,19 +1199,15 @@ public class DomainFlowUtils {
    * token found on the TLD's default token list will be returned.
    */
   public static Optional<AllocationToken> checkForDefaultToken(
-      Registry registry,
-      String domainName,
-      CommandName commandName,
-      String registrarId,
-      DateTime now)
+      Tld tld, String domainName, CommandName commandName, String registrarId, DateTime now)
       throws EppException {
-    if (isNullOrEmpty(registry.getDefaultPromoTokens())) {
+    if (isNullOrEmpty(tld.getDefaultPromoTokens())) {
       return Optional.empty();
     }
     Map<VKey<AllocationToken>, Optional<AllocationToken>> tokens =
-        AllocationToken.getAll(registry.getDefaultPromoTokens());
+        AllocationToken.getAll(tld.getDefaultPromoTokens());
     ImmutableList<Optional<AllocationToken>> tokenList =
-        registry.getDefaultPromoTokens().stream()
+        tld.getDefaultPromoTokens().stream()
             .map(tokens::get)
             .filter(Optional::isPresent)
             .collect(toImmutableList());
@@ -1225,8 +1218,15 @@ public class DomainFlowUtils {
     for (Optional<AllocationToken> token : tokenList) {
       try {
         AllocationTokenFlowUtils.validateToken(
-            InternetDomainName.from(domainName), token.get(), commandName, registrarId, now);
-      } catch (AssociationProhibitsOperationException | StatusProhibitsOperationException e) {
+            InternetDomainName.from(domainName),
+            token.get(),
+            commandName,
+            registrarId,
+            isDomainPremium(domainName, now),
+            now);
+      } catch (AssociationProhibitsOperationException
+          | StatusProhibitsOperationException
+          | AllocationTokenInvalidForPremiumNameException e) {
         // Allocation token was not valid for this registration, continue to check the next token in
         // the list
         continue;

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -16,6 +16,7 @@ package google.registry.flows.domain;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.flows.domain.DomainFlowUtils.zeroInCurrency;
+import static google.registry.flows.domain.token.AllocationTokenFlowUtils.validateTokenForPossiblePremiumName;
 import static google.registry.pricing.PricingEngineProxy.getPricesForDomainName;
 import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;
@@ -29,14 +30,14 @@ import google.registry.flows.custom.DomainPricingCustomLogic.RenewPriceParameter
 import google.registry.flows.custom.DomainPricingCustomLogic.RestorePriceParameters;
 import google.registry.flows.custom.DomainPricingCustomLogic.TransferPriceParameters;
 import google.registry.flows.custom.DomainPricingCustomLogic.UpdatePriceParameters;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.fee.BaseFee;
 import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenBehavior;
 import google.registry.model.pricing.PremiumPricingEngine.DomainPrices;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.math.RoundingMode;
 import java.util.Optional;
 import javax.annotation.Nullable;
@@ -66,14 +67,14 @@ public final class DomainPricingLogic {
    * applied to the first year.
    */
   FeesAndCredits getCreatePrice(
-      Registry registry,
+      Tld tld,
       String domainName,
       DateTime dateTime,
       int years,
       boolean isAnchorTenant,
       Optional<AllocationToken> allocationToken)
       throws EppException {
-    CurrencyUnit currency = registry.getCurrency();
+    CurrencyUnit currency = tld.getCurrency();
 
     BaseFee createFeeOrCredit;
     // Domain create cost is always zero for anchor tenants
@@ -88,7 +89,7 @@ public final class DomainPricingLogic {
     }
 
     // Create fees for the cost and the EAP fee, if any.
-    Fee eapFee = registry.getEapFeeFor(dateTime);
+    Fee eapFee = tld.getEapFeeFor(dateTime);
     FeesAndCredits.Builder feesBuilder =
         new FeesAndCredits.Builder().setCurrency(currency).addFeeOrCredit(createFeeOrCredit);
     // Don't charge anchor tenants EAP fees.
@@ -100,7 +101,7 @@ public final class DomainPricingLogic {
     return customLogic.customizeCreatePrice(
         CreatePriceParameters.newBuilder()
             .setFeesAndCredits(feesBuilder.build())
-            .setRegistry(registry)
+            .setTld(tld)
             .setDomainName(InternetDomainName.from(domainName))
             .setAsOfDate(dateTime)
             .setYears(years)
@@ -109,24 +110,24 @@ public final class DomainPricingLogic {
 
   /** Returns a new renewal cost for the pricer. */
   public FeesAndCredits getRenewPrice(
-      Registry registry,
+      Tld tld,
       String domainName,
       DateTime dateTime,
       int years,
-      @Nullable Recurring recurringBillingEvent,
+      @Nullable BillingRecurrence billingRecurrence,
       Optional<AllocationToken> allocationToken)
       throws AllocationTokenInvalidForPremiumNameException {
     checkArgument(years > 0, "Number of years must be positive");
     Money renewCost;
     DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
     boolean isRenewCostPremiumPrice;
-    // recurring billing event is null if the domain is still available. Billing events are created
+    // recurrence is null if the domain is still available. Billing events are created
     // in the process of domain creation.
-    if (recurringBillingEvent == null) {
+    if (billingRecurrence == null) {
       renewCost = getDomainRenewCostWithDiscount(domainPrices, years, allocationToken);
       isRenewCostPremiumPrice = domainPrices.isPremium();
     } else {
-      switch (recurringBillingEvent.getRenewalPriceBehavior()) {
+      switch (billingRecurrence.getRenewalPriceBehavior()) {
         case DEFAULT:
           renewCost = getDomainRenewCostWithDiscount(domainPrices, years, allocationToken);
           isRenewCostPremiumPrice = domainPrices.isPremium();
@@ -135,11 +136,11 @@ public final class DomainPricingLogic {
           // as the creation price, which is stored in the billing event as the renewal price
         case SPECIFIED:
           checkArgumentPresent(
-              recurringBillingEvent.getRenewalPrice(),
+              billingRecurrence.getRenewalPrice(),
               "Unexpected behavior: renewal price cannot be null when renewal behavior is"
                   + " SPECIFIED");
           // Don't apply allocation token to renewal price when SPECIFIED
-          renewCost = recurringBillingEvent.getRenewalPrice().get().multipliedBy(years);
+          renewCost = billingRecurrence.getRenewalPrice().get().multipliedBy(years);
           isRenewCostPremiumPrice = false;
           break;
           // if the renewal price behavior is nonpremium, it means that the domain should be renewed
@@ -150,14 +151,14 @@ public final class DomainPricingLogic {
                   false,
                   years,
                   allocationToken,
-                  Registry.get(getTldFromDomainName(domainName)).getStandardRenewCost(dateTime));
+                  Tld.get(getTldFromDomainName(domainName)).getStandardRenewCost(dateTime));
           isRenewCostPremiumPrice = false;
           break;
         default:
           throw new IllegalArgumentException(
               String.format(
                   "Unknown RenewalPriceBehavior enum value: %s",
-                  recurringBillingEvent.getRenewalPriceBehavior()));
+                  billingRecurrence.getRenewalPriceBehavior()));
       }
     }
     return customLogic.customizeRenewPrice(
@@ -168,7 +169,7 @@ public final class DomainPricingLogic {
                     .addFeeOrCredit(
                         Fee.create(renewCost.getAmount(), FeeType.RENEW, isRenewCostPremiumPrice))
                     .build())
-            .setRegistry(registry)
+            .setTld(tld)
             .setDomainName(InternetDomainName.from(domainName))
             .setAsOfDate(dateTime)
             .setYears(years)
@@ -176,15 +177,14 @@ public final class DomainPricingLogic {
   }
 
   /** Returns a new restore price for the pricer. */
-  FeesAndCredits getRestorePrice(
-      Registry registry, String domainName, DateTime dateTime, boolean isExpired)
+  FeesAndCredits getRestorePrice(Tld tld, String domainName, DateTime dateTime, boolean isExpired)
       throws EppException {
     DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
     FeesAndCredits.Builder feesAndCredits =
         new FeesAndCredits.Builder()
-            .setCurrency(registry.getCurrency())
+            .setCurrency(tld.getCurrency())
             .addFeeOrCredit(
-                Fee.create(registry.getStandardRestoreCost().getAmount(), FeeType.RESTORE, false));
+                Fee.create(tld.getStandardRestoreCost().getAmount(), FeeType.RESTORE, false));
     if (isExpired) {
       feesAndCredits.addFeeOrCredit(
           Fee.create(
@@ -193,7 +193,7 @@ public final class DomainPricingLogic {
     return customLogic.customizeRestorePrice(
         RestorePriceParameters.newBuilder()
             .setFeesAndCredits(feesAndCredits.build())
-            .setRegistry(registry)
+            .setTld(tld)
             .setDomainName(InternetDomainName.from(domainName))
             .setAsOfDate(dateTime)
             .build());
@@ -201,34 +201,30 @@ public final class DomainPricingLogic {
 
   /** Returns a new transfer price for the pricer. */
   FeesAndCredits getTransferPrice(
-      Registry registry,
-      String domainName,
-      DateTime dateTime,
-      @Nullable Recurring recurringBillingEvent)
+      Tld tld, String domainName, DateTime dateTime, @Nullable BillingRecurrence billingRecurrence)
       throws EppException {
     FeesAndCredits renewPrice =
-        getRenewPrice(registry, domainName, dateTime, 1, recurringBillingEvent, Optional.empty());
+        getRenewPrice(tld, domainName, dateTime, 1, billingRecurrence, Optional.empty());
     return customLogic.customizeTransferPrice(
         TransferPriceParameters.newBuilder()
             .setFeesAndCredits(
                 new FeesAndCredits.Builder()
-                    .setCurrency(registry.getCurrency())
+                    .setCurrency(tld.getCurrency())
                     .addFeeOrCredit(
                         Fee.create(
                             renewPrice.getRenewCost().getAmount(),
                             FeeType.RENEW,
                             renewPrice.hasAnyPremiumFees()))
                     .build())
-            .setRegistry(registry)
+            .setTld(tld)
             .setDomainName(InternetDomainName.from(domainName))
             .setAsOfDate(dateTime)
             .build());
   }
 
   /** Returns a new update price for the pricer. */
-  FeesAndCredits getUpdatePrice(Registry registry, String domainName, DateTime dateTime)
-      throws EppException {
-    CurrencyUnit currency = registry.getCurrency();
+  FeesAndCredits getUpdatePrice(Tld tld, String domainName, DateTime dateTime) throws EppException {
+    CurrencyUnit currency = tld.getCurrency();
     BaseFee feeOrCredit = Fee.create(zeroInCurrency(currency), FeeType.UPDATE, false);
     return customLogic.customizeUpdatePrice(
         UpdatePriceParameters.newBuilder()
@@ -237,7 +233,7 @@ public final class DomainPricingLogic {
                     .setCurrency(currency)
                     .setFeesAndCredits(feeOrCredit)
                     .build())
-            .setRegistry(registry)
+            .setTld(tld)
             .setDomainName(InternetDomainName.from(domainName))
             .setAsOfDate(dateTime)
             .build());
@@ -262,12 +258,7 @@ public final class DomainPricingLogic {
   private Money getDomainCostWithDiscount(
       boolean isPremium, int years, Optional<AllocationToken> allocationToken, Money oneYearCost)
       throws AllocationTokenInvalidForPremiumNameException {
-    if (allocationToken.isPresent()
-        && allocationToken.get().getDiscountFraction() != 0.0
-        && isPremium
-        && !allocationToken.get().shouldDiscountPremiums()) {
-      throw new AllocationTokenInvalidForPremiumNameException();
-    }
+    validateTokenForPossiblePremiumName(allocationToken, isPremium);
     Money totalDomainFlowCost = oneYearCost.multipliedBy(years);
 
     // Apply the allocation token discount, if applicable.
@@ -286,8 +277,8 @@ public final class DomainPricingLogic {
   /** An allocation token was provided that is invalid for premium domains. */
   public static class AllocationTokenInvalidForPremiumNameException
       extends CommandUseErrorException {
-    AllocationTokenInvalidForPremiumNameException() {
-      super("A nonzero discount code cannot be applied to premium domains");
+    public AllocationTokenInvalidForPremiumNameException() {
+      super("Token not valid for premium name");
     }
   }
 }

core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java

@@ -54,10 +54,9 @@ import google.registry.flows.custom.DomainRenewFlowCustomLogic.BeforeSaveParamet
 import google.registry.flows.custom.EntityChanges;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.OneTime;
-import google.registry.model.billing.BillingEvent.Reason;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Renew;
 import google.registry.model.domain.DomainHistory;
@@ -84,7 +83,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.money.Money;
@@ -173,12 +172,12 @@ public final class DomainRenewFlow implements TransactionalFlow {
     Renew command = (Renew) resourceCommand;
     // Loads the target resource if it exists
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
-    String tld = existingDomain.getTld();
-    Registry registry = Registry.get(tld);
+    String tldStr = existingDomain.getTld();
+    Tld tld = Tld.get(tldStr);
     Optional<AllocationToken> allocationToken =
         allocationTokenFlowUtils.verifyAllocationTokenIfPresent(
             existingDomain,
-            registry,
+            tld,
             registrarId,
             now,
             CommandName.RENEW,
@@ -187,7 +186,7 @@ public final class DomainRenewFlow implements TransactionalFlow {
     if (!allocationToken.isPresent()) {
       allocationToken =
           DomainFlowUtils.checkForDefaultToken(
-              registry, existingDomain.getDomainName(), CommandName.RENEW, registrarId, now);
+              tld, existingDomain.getDomainName(), CommandName.RENEW, registrarId, now);
       if (allocationToken.isPresent()) {
         defaultTokenUsed = true;
       }
@@ -203,15 +202,15 @@ public final class DomainRenewFlow implements TransactionalFlow {
     validateRegistrationPeriod(now, newExpirationTime);
     Optional<FeeRenewCommandExtension> feeRenew =
         eppInput.getSingleExtension(FeeRenewCommandExtension.class);
-    Recurring existingRecurringBillingEvent =
+    BillingRecurrence existingBillingRecurrence =
         tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     FeesAndCredits feesAndCredits =
         pricingLogic.getRenewPrice(
-            Registry.get(existingDomain.getTld()),
+            Tld.get(existingDomain.getTld()),
             targetId,
             now,
             years,
-            existingRecurringBillingEvent,
+            existingBillingRecurrence,
             allocationToken);
     validateFeeChallenge(feeRenew, feesAndCredits, defaultTokenUsed);
     flowCustomLogic.afterValidation(
@@ -223,15 +222,15 @@ public final class DomainRenewFlow implements TransactionalFlow {
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
     // Bill for this explicit renew itself.
-    BillingEvent.OneTime explicitRenewEvent =
+    BillingEvent explicitRenewEvent =
         createRenewBillingEvent(
-            tld, feesAndCredits.getTotalCost(), years, domainHistoryId, allocationToken, now);
+            tldStr, feesAndCredits.getTotalCost(), years, domainHistoryId, allocationToken, now);
     // Create a new autorenew billing event and poll message starting at the new expiration time.
-    BillingEvent.Recurring newAutorenewEvent =
+    BillingRecurrence newAutorenewEvent =
         newAutorenewBillingEvent(existingDomain)
             .setEventTime(newExpirationTime)
-            .setRenewalPrice(existingRecurringBillingEvent.getRenewalPrice().orElse(null))
-            .setRenewalPriceBehavior(existingRecurringBillingEvent.getRenewalPriceBehavior())
+            .setRenewalPrice(existingBillingRecurrence.getRenewalPrice().orElse(null))
+            .setRenewalPriceBehavior(existingBillingRecurrence.getRenewalPriceBehavior())
             .setDomainHistoryId(domainHistoryId)
             .build();
     PollMessage.Autorenew newAutorenewPollMessage =
@@ -240,8 +239,8 @@ public final class DomainRenewFlow implements TransactionalFlow {
             .setDomainHistoryId(domainHistoryId)
             .build();
     // End the old autorenew billing event and poll message now. This may delete the poll message.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
-    updateAutorenewRecurrenceEndTime(existingDomain, existingRecurring, now, domainHistoryId);
+    updateAutorenewRecurrenceEndTime(
+        existingDomain, existingBillingRecurrence, now, domainHistoryId);
     Domain newDomain =
         existingDomain
             .asBuilder()
@@ -255,8 +254,7 @@ public final class DomainRenewFlow implements TransactionalFlow {
                     GracePeriodStatus.RENEW, existingDomain.getRepoId(), explicitRenewEvent))
             .build();
     DomainHistory domainHistory =
-        buildDomainHistory(
-            newDomain, now, command.getPeriod(), registry.getRenewGracePeriodLength());
+        buildDomainHistory(newDomain, now, command.getPeriod(), tld.getRenewGracePeriodLength());
     ImmutableSet.Builder<ImmutableObject> entitiesToSave = new ImmutableSet.Builder<>();
     entitiesToSave.add(
         newDomain, domainHistory, explicitRenewEvent, newAutorenewEvent, newAutorenewPollMessage);
@@ -339,14 +337,14 @@ public final class DomainRenewFlow implements TransactionalFlow {
     }
   }
 
-  private OneTime createRenewBillingEvent(
+  private BillingEvent createRenewBillingEvent(
       String tld,
       Money renewCost,
       int years,
       HistoryEntryId domainHistoryId,
       Optional<AllocationToken> allocationToken,
       DateTime now) {
-    return new BillingEvent.OneTime.Builder()
+    return new BillingEvent.Builder()
         .setReason(Reason.RENEW)
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
@@ -358,7 +356,7 @@ public final class DomainRenewFlow implements TransactionalFlow {
                 .filter(t -> AllocationToken.TokenBehavior.DEFAULT.equals(t.getTokenBehavior()))
                 .map(AllocationToken::createVKey)
                 .orElse(null))
-        .setBillingTime(now.plus(Registry.get(tld).getRenewGracePeriodLength()))
+        .setBillingTime(now.plus(Tld.get(tld).getRenewGracePeriodLength()))
         .setDomainHistoryId(domainHistoryId)
         .build();
   }

core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java

@@ -45,9 +45,9 @@ import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.OneTime;
-import google.registry.model.billing.BillingEvent.Reason;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Update;
 import google.registry.model.domain.DomainHistory;
@@ -67,7 +67,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.money.Money;
@@ -141,8 +141,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow {
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     boolean isExpired = existingDomain.getRegistrationExpirationTime().isBefore(now);
     FeesAndCredits feesAndCredits =
-        pricingLogic.getRestorePrice(
-            Registry.get(existingDomain.getTld()), targetId, now, isExpired);
+        pricingLogic.getRestorePrice(Tld.get(existingDomain.getTld()), targetId, now, isExpired);
     Optional<FeeUpdateCommandExtension> feeUpdate =
         eppInput.getSingleExtension(FeeUpdateCommandExtension.class);
     verifyRestoreAllowed(command, existingDomain, feeUpdate, feesAndCredits, now);
@@ -162,7 +161,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow {
     entitiesToSave.add(
         createRestoreBillingEvent(domainHistoryId, feesAndCredits.getRestoreCost(), now));
 
-    BillingEvent.Recurring autorenewEvent =
+    BillingRecurrence autorenewEvent =
         newAutorenewBillingEvent(existingDomain)
             .setEventTime(newExpirationTime)
             .setRecurrenceEndTime(END_OF_TIME)
@@ -232,7 +231,7 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow {
   private static Domain performRestore(
       Domain existingDomain,
       DateTime newExpirationTime,
-      BillingEvent.Recurring autorenewEvent,
+      BillingRecurrence autorenewEvent,
       PollMessage.Autorenew autorenewPollMessage,
       DateTime now,
       String registrarId) {
@@ -253,19 +252,19 @@ public final class DomainRestoreRequestFlow implements TransactionalFlow {
         .build();
   }
 
-  private OneTime createRenewBillingEvent(
+  private BillingEvent createRenewBillingEvent(
       HistoryEntryId domainHistoryId, Money renewCost, DateTime now) {
     return prepareBillingEvent(domainHistoryId, renewCost, now).setReason(Reason.RENEW).build();
   }
 
-  private BillingEvent.OneTime createRestoreBillingEvent(
+  private BillingEvent createRestoreBillingEvent(
       HistoryEntryId domainHistoryId, Money restoreCost, DateTime now) {
     return prepareBillingEvent(domainHistoryId, restoreCost, now).setReason(Reason.RESTORE).build();
   }
 
-  private OneTime.Builder prepareBillingEvent(
+  private BillingEvent.Builder prepareBillingEvent(
       HistoryEntryId domainHistoryId, Money cost, DateTime now) {
-    return new BillingEvent.OneTime.Builder()
+    return new BillingEvent.Builder()
         .setTargetId(targetId)
         .setRegistrarId(registrarId)
         .setEventTime(now)

core/src/main/java/google/registry/flows/domain/DomainTransferApproveFlow.java

@@ -45,11 +45,12 @@ import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingBase.Reason;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
+import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.Reason;
-import google.registry.model.billing.BillingEvent.Recurring;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -64,7 +65,7 @@ import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Optional;
@@ -133,7 +134,7 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     allocationTokenFlowUtils.verifyAllocationTokenIfPresent(
         existingDomain,
-        Registry.get(existingDomain.getTld()),
+        Tld.get(existingDomain.getTld()),
         registrarId,
         now,
         CommandName.TRANSFER,
@@ -141,24 +142,26 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     verifyHasPendingTransfer(existingDomain);
     verifyResourceOwnership(registrarId, existingDomain);
-    String tld = existingDomain.getTld();
+    String tldStr = existingDomain.getTld();
     if (!isSuperuser) {
-      checkAllowedAccessToTld(registrarId, tld);
+      checkAllowedAccessToTld(registrarId, tldStr);
     }
     DomainTransferData transferData = existingDomain.getTransferData();
     String gainingRegistrarId = transferData.getGainingRegistrarId();
     // Create a transfer billing event for 1 year, unless the superuser extension was used to set
     // the transfer period to zero. There is not a transfer cost if the transfer period is zero.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
+    BillingRecurrence existingBillingRecurrence =
+        tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder.setRevisionId(domainHistoryId.getRevisionId());
     boolean hasPackageToken = existingDomain.getCurrentPackageToken().isPresent();
-    Money renewalPrice = hasPackageToken ? null : existingRecurring.getRenewalPrice().orElse(null);
-    Optional<BillingEvent.OneTime> billingEvent =
+    Money renewalPrice =
+        hasPackageToken ? null : existingBillingRecurrence.getRenewalPrice().orElse(null);
+    Optional<BillingEvent> billingEvent =
         transferData.getTransferPeriod().getValue() == 0
             ? Optional.empty()
             : Optional.of(
-                new BillingEvent.OneTime.Builder()
+                new BillingEvent.Builder()
                     .setReason(Reason.TRANSFER)
                     .setTargetId(targetId)
                     .setRegistrarId(gainingRegistrarId)
@@ -166,16 +169,16 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
                     .setCost(
                         pricingLogic
                             .getTransferPrice(
-                                Registry.get(tld),
+                                Tld.get(tldStr),
                                 targetId,
                                 transferData.getTransferRequestTime(),
                                 // When removing a domain from a package it should return to the
-                                // default recurring billing behavior so the existing recurring
+                                // default recurrence billing behavior so the existing recurrence
                                 // billing event should not be passed in.
-                                hasPackageToken ? null : existingRecurring)
+                                hasPackageToken ? null : existingBillingRecurrence)
                             .getRenewCost())
                     .setEventTime(now)
-                    .setBillingTime(now.plus(Registry.get(tld).getTransferGracePeriodLength()))
+                    .setBillingTime(now.plus(Tld.get(tldStr).getTransferGracePeriodLength()))
                     .setDomainHistoryId(domainHistoryId)
                     .build());
 
@@ -192,18 +195,18 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
       // still needs to be charged for the auto-renew.
       if (billingEvent.isPresent()) {
         entitiesToSave.add(
-            BillingEvent.Cancellation.forGracePeriod(
-                autorenewGrace, now, domainHistoryId, targetId));
+            BillingCancellation.forGracePeriod(autorenewGrace, now, domainHistoryId, targetId));
       }
     }
     // Close the old autorenew event and poll message at the transfer time (aka now). This may end
     // up deleting the poll message.
-    updateAutorenewRecurrenceEndTime(existingDomain, existingRecurring, now, domainHistoryId);
+    updateAutorenewRecurrenceEndTime(
+        existingDomain, existingBillingRecurrence, now, domainHistoryId);
     DateTime newExpirationTime =
         computeExDateForApprovalTime(existingDomain, now, transferData.getTransferPeriod());
     // Create a new autorenew event starting at the expiration time.
-    BillingEvent.Recurring autorenewEvent =
-        new BillingEvent.Recurring.Builder()
+    BillingRecurrence autorenewEvent =
+        new BillingRecurrence.Builder()
             .setReason(Reason.RENEW)
             .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
             .setTargetId(targetId)
@@ -212,7 +215,7 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
             .setRenewalPriceBehavior(
                 hasPackageToken
                     ? RenewalPriceBehavior.DEFAULT
-                    : existingRecurring.getRenewalPriceBehavior())
+                    : existingBillingRecurrence.getRenewalPriceBehavior())
             .setRenewalPrice(renewalPrice)
             .setRecurrenceEndTime(END_OF_TIME)
             .setDomainHistoryId(domainHistoryId)
@@ -248,12 +251,10 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
             .setGracePeriods(
                 billingEvent
                     .map(
-                        oneTime ->
+                        event ->
                             ImmutableSet.of(
                                 GracePeriod.forBillingEvent(
-                                    GracePeriodStatus.TRANSFER,
-                                    existingDomain.getRepoId(),
-                                    oneTime)))
+                                    GracePeriodStatus.TRANSFER, existingDomain.getRepoId(), event)))
                     .orElseGet(ImmutableSet::of))
             .setLastEppUpdateTime(now)
             .setLastEppUpdateRegistrarId(registrarId)
@@ -262,8 +263,8 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
             .setCurrentPackageToken(null)
             .build();
 
-    Registry registry = Registry.get(existingDomain.getTld());
-    DomainHistory domainHistory = buildDomainHistory(newDomain, registry, now, gainingRegistrarId);
+    Tld tld = Tld.get(existingDomain.getTld());
+    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now, gainingRegistrarId);
     // Create a poll message for the gaining client.
     PollMessage gainingClientPollMessage =
         createGainingTransferPollMessage(
@@ -286,12 +287,12 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
   }
 
   private DomainHistory buildDomainHistory(
-      Domain newDomain, Registry registry, DateTime now, String gainingRegistrarId) {
+      Domain newDomain, Tld tld, DateTime now, String gainingRegistrarId) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,
             now,
-            registry.getAutomaticTransferLength().plus(registry.getTransferGracePeriodLength()),
+            tld.getAutomaticTransferLength().plus(tld.getTransferGracePeriodLength()),
             ImmutableSet.of(TRANSFER_SUCCESSFUL));
     return historyBuilder
         .setType(DOMAIN_TRANSFER_APPROVE)
@@ -302,7 +303,7 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
                 cancelingRecords,
                 DomainTransactionRecord.create(
                     newDomain.getTld(),
-                    now.plus(registry.getTransferGracePeriodLength()),
+                    now.plus(tld.getTransferGracePeriodLength()),
                     TRANSFER_SUCCESSFUL,
                     1)))
         .build();

core/src/main/java/google/registry/flows/domain/DomainTransferCancelFlow.java

@@ -39,7 +39,7 @@ import google.registry.flows.FlowModule.Superuser;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.metadata.MetadataExtension;
@@ -48,7 +48,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -100,7 +100,7 @@ public final class DomainTransferCancelFlow implements TransactionalFlow {
     if (!isSuperuser) {
       checkAllowedAccessToTld(registrarId, existingDomain.getTld());
     }
-    Registry registry = Registry.get(existingDomain.getTld());
+    Tld tld = Tld.get(existingDomain.getTld());
 
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder
@@ -109,7 +109,7 @@ public final class DomainTransferCancelFlow implements TransactionalFlow {
 
     Domain newDomain =
         denyPendingTransfer(existingDomain, TransferStatus.CLIENT_CANCELLED, now, registrarId);
-    DomainHistory domainHistory = buildDomainHistory(newDomain, registry, now);
+    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now);
     tm().putAll(
             newDomain,
             domainHistory,
@@ -117,9 +117,10 @@ public final class DomainTransferCancelFlow implements TransactionalFlow {
                 targetId, newDomain.getTransferData(), null, domainHistoryId));
     // Reopen the autorenew event and poll message that we closed for the implicit transfer. This
     // may recreate the autorenew poll message if it was deleted when the transfer request was made.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
+    BillingRecurrence existingBillingRecurrence =
+        tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     updateAutorenewRecurrenceEndTime(
-        existingDomain, existingRecurring, END_OF_TIME, domainHistory.getHistoryEntryId());
+        existingDomain, existingBillingRecurrence, END_OF_TIME, domainHistory.getHistoryEntryId());
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.
     tm().delete(existingDomain.getTransferData().getServerApproveEntities());
@@ -128,12 +129,12 @@ public final class DomainTransferCancelFlow implements TransactionalFlow {
         .build();
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, Registry registry, DateTime now) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,
             now,
-            registry.getAutomaticTransferLength().plus(registry.getTransferGracePeriodLength()),
+            tld.getAutomaticTransferLength().plus(tld.getTransferGracePeriodLength()),
             ImmutableSet.of(TRANSFER_SUCCESSFUL));
     return historyBuilder
         .setType(DOMAIN_TRANSFER_CANCEL)

core/src/main/java/google/registry/flows/domain/DomainTransferRejectFlow.java

@@ -41,7 +41,7 @@ import google.registry.flows.FlowModule.Superuser;
 import google.registry.flows.FlowModule.TargetId;
 import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.metadata.MetadataExtension;
@@ -50,7 +50,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.TransferStatus;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -94,7 +94,7 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
     extensionManager.validate();
     DateTime now = tm().getTransactionTime();
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
-    Registry registry = Registry.get(existingDomain.getTld());
+    Tld tld = Tld.get(existingDomain.getTld());
     HistoryEntryId domainHistoryId = createHistoryEntryId(existingDomain);
     historyBuilder
         .setRevisionId(domainHistoryId.getRevisionId())
@@ -108,7 +108,7 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
     }
     Domain newDomain =
         denyPendingTransfer(existingDomain, TransferStatus.CLIENT_REJECTED, now, registrarId);
-    DomainHistory domainHistory = buildDomainHistory(newDomain, registry, now);
+    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now);
     tm().putAll(
             newDomain,
             domainHistory,
@@ -116,9 +116,10 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
                 targetId, newDomain.getTransferData(), null, now, domainHistoryId));
     // Reopen the autorenew event and poll message that we closed for the implicit transfer. This
     // may end up recreating the poll message if it was deleted upon the transfer request.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
+    BillingRecurrence existingBillingRecurrence =
+        tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     updateAutorenewRecurrenceEndTime(
-        existingDomain, existingRecurring, END_OF_TIME, domainHistory.getHistoryEntryId());
+        existingDomain, existingBillingRecurrence, END_OF_TIME, domainHistory.getHistoryEntryId());
     // Delete the billing event and poll messages that were written in case the transfer would have
     // been implicitly server approved.
     tm().delete(existingDomain.getTransferData().getServerApproveEntities());
@@ -127,12 +128,12 @@ public final class DomainTransferRejectFlow implements TransactionalFlow {
         .build();
   }
 
-  private DomainHistory buildDomainHistory(Domain newDomain, Registry registry, DateTime now) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now) {
     ImmutableSet<DomainTransactionRecord> cancelingRecords =
         createCancelingRecords(
             newDomain,
             now,
-            registry.getAutomaticTransferLength().plus(registry.getTransferGracePeriodLength()),
+            tld.getAutomaticTransferLength().plus(tld.getTransferGracePeriodLength()),
             ImmutableSet.of(TRANSFER_SUCCESSFUL));
     return historyBuilder
         .setType(DOMAIN_TRANSFER_REJECT)

core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java

@@ -52,7 +52,7 @@ import google.registry.flows.exceptions.InvalidTransferPeriodValueException;
 import google.registry.flows.exceptions.ObjectAlreadySponsoredException;
 import google.registry.flows.exceptions.TransferPeriodMustBeOneYearException;
 import google.registry.flows.exceptions.TransferPeriodZeroAndFeeTransferExtensionException;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Transfer;
 import google.registry.model.domain.DomainHistory;
@@ -74,7 +74,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
 import google.registry.model.transfer.TransferResponse.DomainTransferResponse;
@@ -171,7 +171,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
     Domain existingDomain = loadAndVerifyExistence(Domain.class, targetId, now);
     allocationTokenFlowUtils.verifyAllocationTokenIfPresent(
         existingDomain,
-        Registry.get(existingDomain.getTld()),
+        Tld.get(existingDomain.getTld()),
         gainingClientId,
         now,
         CommandName.TRANSFER,
@@ -184,8 +184,8 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
             : ((Transfer) resourceCommand).getPeriod();
     verifyTransferAllowed(existingDomain, period, now, superuserExtension);
 
-    String tld = existingDomain.getTld();
-    Registry registry = Registry.get(tld);
+    String tldStr = existingDomain.getTld();
+    Tld tld = Tld.get(tldStr);
     // An optional extension from the client specifying what they think the transfer should cost.
     Optional<FeeTransferCommandExtension> feeTransfer =
         eppInput.getSingleExtension(FeeTransferCommandExtension.class);
@@ -195,20 +195,21 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
       throw new TransferPeriodZeroAndFeeTransferExtensionException();
     }
     // If the period is zero, then there is no fee for the transfer.
-    Recurring existingRecurring = tm().loadByKey(existingDomain.getAutorenewBillingEvent());
+    BillingRecurrence existingBillingRecurrence =
+        tm().loadByKey(existingDomain.getAutorenewBillingEvent());
     Optional<FeesAndCredits> feesAndCredits;
     if (period.getValue() == 0) {
       feesAndCredits = Optional.empty();
     } else if (!existingDomain.getCurrentPackageToken().isPresent()) {
       feesAndCredits =
-          Optional.of(pricingLogic.getTransferPrice(registry, targetId, now, existingRecurring));
+          Optional.of(pricingLogic.getTransferPrice(tld, targetId, now, existingBillingRecurrence));
     } else {
       // If existing domain is in a package, calculate the transfer price with default renewal price
       // behavior
       feesAndCredits =
           period.getValue() == 0
               ? Optional.empty()
-              : Optional.of(pricingLogic.getTransferPrice(registry, targetId, now, null));
+              : Optional.of(pricingLogic.getTransferPrice(tld, targetId, now, null));
     }
 
     if (feesAndCredits.isPresent()) {
@@ -224,7 +225,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
                 domainTransferRequestSuperuserExtension ->
                     now.plusDays(
                         domainTransferRequestSuperuserExtension.getAutomaticTransferLength()))
-            .orElseGet(() -> now.plus(registry.getAutomaticTransferLength()));
+            .orElseGet(() -> now.plus(tld.getAutomaticTransferLength()));
     // If the domain will be in the auto-renew grace period at the moment of transfer, the transfer
     // will subsume the autorenew, so we don't add the normal extra year from the transfer.
     // The gaining registrar is still billed for the extra year; the losing registrar will get a
@@ -243,7 +244,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
             serverApproveNewExpirationTime,
             domainHistoryId,
             existingDomain,
-            existingRecurring,
+            existingBillingRecurrence,
             trid,
             gainingClientId,
             feesAndCredits.map(FeesAndCredits::getTotalCost),
@@ -274,7 +275,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
     // cloneProjectedAtTime() will replace these old autorenew entities with the server approve ones
     // that we've created in this flow and stored in pendingTransferData.
     updateAutorenewRecurrenceEndTime(
-        existingDomain, existingRecurring, automaticTransferTime, domainHistoryId);
+        existingDomain, existingBillingRecurrence, automaticTransferTime, domainHistoryId);
     Domain newDomain =
         existingDomain
             .asBuilder()
@@ -283,7 +284,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
             .setLastEppUpdateTime(now)
             .setLastEppUpdateRegistrarId(gainingClientId)
             .build();
-    DomainHistory domainHistory = buildDomainHistory(newDomain, registry, now, period);
+    DomainHistory domainHistory = buildDomainHistory(newDomain, tld, now, period);
 
     asyncTaskEnqueuer.enqueueAsyncResave(newDomain.createVKey(), now, automaticTransferTime);
     tm().putAll(
@@ -363,8 +364,7 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
     }
   }
 
-  private DomainHistory buildDomainHistory(
-      Domain newDomain, Registry registry, DateTime now, Period period) {
+  private DomainHistory buildDomainHistory(Domain newDomain, Tld tld, DateTime now, Period period) {
     return historyBuilder
         .setType(DOMAIN_TRANSFER_REQUEST)
         .setPeriod(period)
@@ -372,9 +372,9 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
         .setDomainTransactionRecords(
             ImmutableSet.of(
                 DomainTransactionRecord.create(
-                    registry.getTldStr(),
-                    now.plus(registry.getAutomaticTransferLength())
-                        .plus(registry.getTransferGracePeriodLength()),
+                    tld.getTldStr(),
+                    now.plus(tld.getAutomaticTransferLength())
+                        .plus(tld.getTransferGracePeriodLength()),
                     TransactionReportField.TRANSFER_SUCCESSFUL,
                     1)))
         .build();

core/src/main/java/google/registry/flows/domain/DomainTransferUtils.java

@@ -20,11 +20,12 @@ import static google.registry.util.DateTimeUtils.END_OF_TIME;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import google.registry.model.billing.BillingBase.Flag;
+import google.registry.model.billing.BillingBase.Reason;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
+import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Flag;
-import google.registry.model.billing.BillingEvent.Reason;
-import google.registry.model.billing.BillingEvent.Recurring;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.domain.Period;
@@ -33,7 +34,7 @@ import google.registry.model.eppcommon.Trid;
 import google.registry.model.poll.PendingActionNotificationResponse.DomainPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferData;
 import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
@@ -66,8 +67,8 @@ public final class DomainTransferUtils {
       // Unless superuser sets period to 0, add a transfer billing event.
       transferDataBuilder.setServerApproveBillingEvent(
           serverApproveEntities.stream()
-              .filter(BillingEvent.OneTime.class::isInstance)
-              .map(BillingEvent.OneTime.class::cast)
+              .filter(BillingEvent.class::isInstance)
+              .map(BillingEvent.class::cast)
               .collect(onlyElement())
               .createVKey());
     }
@@ -75,8 +76,8 @@ public final class DomainTransferUtils {
         .setTransferStatus(TransferStatus.PENDING)
         .setServerApproveAutorenewEvent(
             serverApproveEntities.stream()
-                .filter(BillingEvent.Recurring.class::isInstance)
-                .map(BillingEvent.Recurring.class::cast)
+                .filter(BillingRecurrence.class::isInstance)
+                .map(BillingRecurrence.class::cast)
                 .collect(onlyElement())
                 .createVKey())
         .setServerApproveAutorenewPollMessage(
@@ -110,7 +111,7 @@ public final class DomainTransferUtils {
       DateTime serverApproveNewExpirationTime,
       HistoryEntryId domainHistoryId,
       Domain existingDomain,
-      Recurring existingRecurring,
+      BillingRecurrence existingBillingRecurrence,
       Trid trid,
       String gainingRegistrarId,
       Optional<Money> transferCost,
@@ -127,7 +128,7 @@ public final class DomainTransferUtils {
             .setTransferredRegistrationExpirationTime(serverApproveNewExpirationTime)
             .setTransferStatus(TransferStatus.SERVER_APPROVED)
             .build();
-    Registry registry = Registry.get(existingDomain.getTld());
+    Tld tld = Tld.get(existingDomain.getTld());
     ImmutableSet.Builder<TransferServerApproveEntity> builder = new ImmutableSet.Builder<>();
     transferCost.ifPresent(
         cost ->
@@ -137,7 +138,7 @@ public final class DomainTransferUtils {
                     domainHistoryId,
                     targetId,
                     gainingRegistrarId,
-                    registry,
+                    tld,
                     cost)));
     createOptionalAutorenewCancellation(
             automaticTransferTime, now, domainHistoryId, targetId, existingDomain, transferCost)
@@ -146,12 +147,12 @@ public final class DomainTransferUtils {
         .add(
             createGainingClientAutorenewEvent(
                 existingDomain.getCurrentPackageToken().isPresent()
-                    ? existingRecurring
+                    ? existingBillingRecurrence
                         .asBuilder()
                         .setRenewalPriceBehavior(RenewalPriceBehavior.DEFAULT)
                         .setRenewalPrice(null)
                         .build()
-                    : existingRecurring,
+                    : existingBillingRecurrence,
                 serverApproveNewExpirationTime,
                 domainHistoryId,
                 targetId,
@@ -246,21 +247,21 @@ public final class DomainTransferUtils {
         .build();
   }
 
-  private static BillingEvent.Recurring createGainingClientAutorenewEvent(
-      Recurring existingRecurring,
+  private static BillingRecurrence createGainingClientAutorenewEvent(
+      BillingRecurrence existingBillingRecurrence,
       DateTime serverApproveNewExpirationTime,
       HistoryEntryId domainHistoryId,
       String targetId,
       String gainingRegistrarId) {
-    return new BillingEvent.Recurring.Builder()
+    return new BillingRecurrence.Builder()
         .setReason(Reason.RENEW)
         .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
         .setTargetId(targetId)
         .setRegistrarId(gainingRegistrarId)
         .setEventTime(serverApproveNewExpirationTime)
         .setRecurrenceEndTime(END_OF_TIME)
-        .setRenewalPriceBehavior(existingRecurring.getRenewalPriceBehavior())
-        .setRenewalPrice(existingRecurring.getRenewalPrice().orElse(null))
+        .setRenewalPriceBehavior(existingBillingRecurrence.getRenewalPriceBehavior())
+        .setRenewalPrice(existingBillingRecurrence.getRenewalPrice().orElse(null))
         .setDomainHistoryId(domainHistoryId)
         .build();
   }
@@ -281,7 +282,7 @@ public final class DomainTransferUtils {
    * <p>For details on the policy justification, see b/19430703#comment17 and <a
    * href="https://www.icann.org/news/advisory-2002-06-06-en">this ICANN advisory</a>.
    */
-  private static Optional<BillingEvent.Cancellation> createOptionalAutorenewCancellation(
+  private static Optional<BillingCancellation> createOptionalAutorenewCancellation(
       DateTime automaticTransferTime,
       DateTime now,
       HistoryEntryId domainHistoryId,
@@ -294,8 +295,7 @@ public final class DomainTransferUtils {
             domainAtTransferTime.getGracePeriodsOfType(GracePeriodStatus.AUTO_RENEW), null);
     if (autorenewGracePeriod != null && transferCost.isPresent()) {
       return Optional.of(
-          BillingEvent.Cancellation.forGracePeriod(
-                  autorenewGracePeriod, now, domainHistoryId, targetId)
+          BillingCancellation.forGracePeriod(autorenewGracePeriod, now, domainHistoryId, targetId)
               .asBuilder()
               .setEventTime(automaticTransferTime)
               .build());
@@ -303,14 +303,14 @@ public final class DomainTransferUtils {
     return Optional.empty();
   }
 
-  private static BillingEvent.OneTime createTransferBillingEvent(
+  private static BillingEvent createTransferBillingEvent(
       DateTime automaticTransferTime,
       HistoryEntryId domainHistoryId,
       String targetId,
       String gainingRegistrarId,
-      Registry registry,
+      Tld registry,
       Money transferCost) {
-    return new BillingEvent.OneTime.Builder()
+    return new BillingEvent.Builder()
         .setReason(Reason.TRANSFER)
         .setTargetId(targetId)
         .setRegistrarId(gainingRegistrarId)

core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java

@@ -64,8 +64,8 @@ import google.registry.flows.custom.EntityChanges;
 import google.registry.flows.domain.DomainFlowUtils.MissingRegistrantException;
 import google.registry.flows.domain.DomainFlowUtils.NameserversNotSpecifiedForTldWithNameserverAllowListException;
 import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Reason;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Update;
@@ -86,7 +86,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.PendingActionNotificationResponse.DomainPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.Objects;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -187,7 +187,7 @@ public final class DomainUpdateFlow implements TransactionalFlow {
     }
     ImmutableSet.Builder<ImmutableObject> entitiesToSave = new ImmutableSet.Builder<>();
     entitiesToSave.add(newDomain, domainHistory);
-    Optional<BillingEvent.OneTime> statusUpdateBillingEvent =
+    Optional<BillingEvent> statusUpdateBillingEvent =
         createBillingEventForStatusUpdates(existingDomain, newDomain, domainHistory, now);
     statusUpdateBillingEvent.ifPresent(entitiesToSave::add);
     Optional<PollMessage.OneTime> serverStatusUpdatePollMessage =
@@ -219,18 +219,18 @@ public final class DomainUpdateFlow implements TransactionalFlow {
     verifyOptionalAuthInfo(authInfo, existingDomain);
     AddRemove add = command.getInnerAdd();
     AddRemove remove = command.getInnerRemove();
-    String tld = existingDomain.getTld();
+    String tldStr = existingDomain.getTld();
     if (!isSuperuser) {
       verifyNoDisallowedStatuses(existingDomain, UPDATE_DISALLOWED_STATUSES);
       verifyResourceOwnership(registrarId, existingDomain);
       verifyClientUpdateNotProhibited(command, existingDomain);
       verifyAllStatusesAreClientSettable(union(add.getStatusValues(), remove.getStatusValues()));
-      checkAllowedAccessToTld(registrarId, tld);
+      checkAllowedAccessToTld(registrarId, tldStr);
     }
-    Registry registry = Registry.get(tld);
+    Tld tld = Tld.get(tldStr);
     Optional<FeeUpdateCommandExtension> feeUpdate =
         eppInput.getSingleExtension(FeeUpdateCommandExtension.class);
-    FeesAndCredits feesAndCredits = pricingLogic.getUpdatePrice(registry, targetId, now);
+    FeesAndCredits feesAndCredits = pricingLogic.getUpdatePrice(tld, targetId, now);
     validateFeesAckedIfPresent(feeUpdate, feesAndCredits, false);
     verifyNotInPendingDelete(
         add.getContacts(),
@@ -238,8 +238,8 @@ public final class DomainUpdateFlow implements TransactionalFlow {
         add.getNameservers());
     validateContactsHaveTypes(add.getContacts());
     validateContactsHaveTypes(remove.getContacts());
-    validateRegistrantAllowedOnTld(tld, command.getInnerChange().getRegistrantContactId());
-    validateNameserversAllowedOnTld(tld, add.getNameserverHostNames());
+    validateRegistrantAllowedOnTld(tldStr, command.getInnerChange().getRegistrantContactId());
+    validateNameserversAllowedOnTld(tldStr, add.getNameserverHostNames());
   }
 
   private Domain performUpdate(Update command, Domain domain, DateTime now) throws EppException {
@@ -324,7 +324,7 @@ public final class DomainUpdateFlow implements TransactionalFlow {
   }
 
   /** Some status updates cost money. Bill only once no matter how many of them are changed. */
-  private Optional<BillingEvent.OneTime> createBillingEventForStatusUpdates(
+  private Optional<BillingEvent> createBillingEventForStatusUpdates(
       Domain existingDomain, Domain newDomain, DomainHistory historyEntry, DateTime now) {
     Optional<MetadataExtension> metadataExtension =
         eppInput.getSingleExtension(MetadataExtension.class);
@@ -334,11 +334,11 @@ public final class DomainUpdateFlow implements TransactionalFlow {
         if (statusValue.isChargedStatus()) {
           // Only charge once.
           return Optional.of(
-              new BillingEvent.OneTime.Builder()
+              new BillingEvent.Builder()
                   .setReason(Reason.SERVER_STATUS)
                   .setTargetId(targetId)
                   .setRegistrarId(registrarId)
-                  .setCost(Registry.get(existingDomain.getTld()).getServerStatusChangeCost())
+                  .setCost(Tld.get(existingDomain.getTld()).getServerStatusChangeCost())
                   .setEventTime(now)
                   .setBillingTime(now)
                   .setDomainHistory(historyEntry)

core/src/main/java/google/registry/flows/domain/token/AllocationTokenCustomLogic.java

@@ -22,7 +22,7 @@ import google.registry.flows.EppException;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand;
 import google.registry.model.domain.token.AllocationToken;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import org.joda.time.DateTime;
 
 /**
@@ -36,7 +36,7 @@ public class AllocationTokenCustomLogic {
   public AllocationToken validateToken(
       DomainCommand.Create command,
       AllocationToken token,
-      Registry registry,
+      Tld tld,
       String registrarId,
       DateTime now)
       throws EppException {
@@ -46,7 +46,7 @@ public class AllocationTokenCustomLogic {
 
   /** Performs additional custom logic for validating a token on an existing domain. */
   public AllocationToken validateToken(
-      Domain domain, AllocationToken token, Registry registry, String registrarId, DateTime now)
+      Domain domain, AllocationToken token, Tld tld, String registrarId, DateTime now)
       throws EppException {
     // Do nothing.
     return token;

core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java

@@ -16,6 +16,7 @@ package google.registry.flows.domain.token;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.pricing.PricingEngineProxy.isDomainPremium;
 
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
@@ -26,8 +27,9 @@ import google.registry.flows.EppException;
 import google.registry.flows.EppException.AssociationProhibitsOperationException;
 import google.registry.flows.EppException.AuthorizationErrorException;
 import google.registry.flows.EppException.StatusProhibitsOperationException;
-import google.registry.model.billing.BillingEvent.Recurring;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.flows.domain.DomainPricingLogic.AllocationTokenInvalidForPremiumNameException;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand;
 import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
@@ -37,7 +39,7 @@ import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.domain.token.AllocationTokenExtension;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.persistence.VKey;
 import java.util.List;
 import java.util.Optional;
@@ -79,7 +81,13 @@ public class AllocationTokenFlowUtils {
     ImmutableMap.Builder<InternetDomainName, String> resultsBuilder = new ImmutableMap.Builder<>();
     for (InternetDomainName domainName : domainNames) {
       try {
-        validateToken(domainName, tokenEntity, CommandName.CREATE, registrarId, now);
+        validateToken(
+            domainName,
+            tokenEntity,
+            CommandName.CREATE,
+            registrarId,
+            isDomainPremium(domainName.toString(), now),
+            now);
         validDomainNames.add(domainName);
       } catch (EppException e) {
         resultsBuilder.put(domainName, e.getMessage());
@@ -105,7 +113,7 @@ public class AllocationTokenFlowUtils {
   /**
    * Validates a given token. The token could be invalid if it has allowed client IDs or TLDs that
    * do not include this client ID / TLD, or if the token has a promotion that is not currently
-   * running.
+   * running, or the token is not valid for a premium name when necessary.
    *
    * @throws EppException if the token is invalid in any way
    */
@@ -114,33 +122,48 @@ public class AllocationTokenFlowUtils {
       AllocationToken token,
       CommandName commandName,
       String registrarId,
+      boolean isPremium,
       DateTime now)
       throws EppException {
 
     // Only tokens with default behavior require validation
-    if (TokenBehavior.DEFAULT.equals(token.getTokenBehavior())) {
-      if (!token.getAllowedEppActions().isEmpty()
-          && !token.getAllowedEppActions().contains(commandName)) {
-        throw new AllocationTokenNotValidForCommandException();
-      }
-      if (!token.getAllowedRegistrarIds().isEmpty()
-          && !token.getAllowedRegistrarIds().contains(registrarId)) {
-        throw new AllocationTokenNotValidForRegistrarException();
-      }
-      if (!token.getAllowedTlds().isEmpty()
-          && !token.getAllowedTlds().contains(domainName.parent().toString())) {
-        throw new AllocationTokenNotValidForTldException();
-      }
-      if (token.getDomainName().isPresent()
-          && !token.getDomainName().get().equals(domainName.toString())) {
-        throw new AllocationTokenNotValidForDomainException();
-      }
-      // Tokens without status transitions will just have a single-entry NOT_STARTED map, so only
-      // check the status transitions map if it's non-trivial.
-      if (token.getTokenStatusTransitions().size() > 1
-          && !TokenStatus.VALID.equals(token.getTokenStatusTransitions().getValueAtTime(now))) {
-        throw new AllocationTokenNotInPromotionException();
-      }
+    if (!TokenBehavior.DEFAULT.equals(token.getTokenBehavior())) {
+      return;
+    }
+    validateTokenForPossiblePremiumName(Optional.of(token), isPremium);
+    if (!token.getAllowedEppActions().isEmpty()
+        && !token.getAllowedEppActions().contains(commandName)) {
+      throw new AllocationTokenNotValidForCommandException();
+    }
+    if (!token.getAllowedRegistrarIds().isEmpty()
+        && !token.getAllowedRegistrarIds().contains(registrarId)) {
+      throw new AllocationTokenNotValidForRegistrarException();
+    }
+    if (!token.getAllowedTlds().isEmpty()
+        && !token.getAllowedTlds().contains(domainName.parent().toString())) {
+      throw new AllocationTokenNotValidForTldException();
+    }
+    if (token.getDomainName().isPresent()
+        && !token.getDomainName().get().equals(domainName.toString())) {
+      throw new AllocationTokenNotValidForDomainException();
+    }
+    // Tokens without status transitions will just have a single-entry NOT_STARTED map, so only
+    // check the status transitions map if it's non-trivial.
+    if (token.getTokenStatusTransitions().size() > 1
+        && !TokenStatus.VALID.equals(token.getTokenStatusTransitions().getValueAtTime(now))) {
+      throw new AllocationTokenNotInPromotionException();
+    }
+  }
+
+  /** Validates that the given token is valid for a premium name if the name is premium. */
+  public static void validateTokenForPossiblePremiumName(
+      Optional<AllocationToken> token, boolean isPremium)
+      throws AllocationTokenInvalidForPremiumNameException {
+    if (token.isPresent()
+        && token.get().getDiscountFraction() != 0.0
+        && isPremium
+        && !token.get().shouldDiscountPremiums()) {
+      throw new AllocationTokenInvalidForPremiumNameException();
     }
   }
 
@@ -173,7 +196,7 @@ public class AllocationTokenFlowUtils {
   /** Verifies and returns the allocation token if one is specified, otherwise does nothing. */
   public Optional<AllocationToken> verifyAllocationTokenCreateIfPresent(
       DomainCommand.Create command,
-      Registry registry,
+      Tld tld,
       String registrarId,
       DateTime now,
       Optional<AllocationTokenExtension> extension)
@@ -187,15 +210,15 @@ public class AllocationTokenFlowUtils {
         tokenEntity,
         CommandName.CREATE,
         registrarId,
+        isDomainPremium(command.getDomainName(), now),
         now);
-    return Optional.of(
-        tokenCustomLogic.validateToken(command, tokenEntity, registry, registrarId, now));
+    return Optional.of(tokenCustomLogic.validateToken(command, tokenEntity, tld, registrarId, now));
   }
 
   /** Verifies and returns the allocation token if one is specified, otherwise does nothing. */
   public Optional<AllocationToken> verifyAllocationTokenIfPresent(
       Domain existingDomain,
-      Registry registry,
+      Tld tld,
       String registrarId,
       DateTime now,
       CommandName commandName,
@@ -210,9 +233,10 @@ public class AllocationTokenFlowUtils {
         tokenEntity,
         commandName,
         registrarId,
+        isDomainPremium(existingDomain.getDomainName(), now),
         now);
     return Optional.of(
-        tokenCustomLogic.validateToken(existingDomain, tokenEntity, registry, registrarId, now));
+        tokenCustomLogic.validateToken(existingDomain, tokenEntity, tld, registrarId, now));
   }
 
   public static void verifyTokenAllowedOnDomain(
@@ -237,16 +261,16 @@ public class AllocationTokenFlowUtils {
       return domain;
     }
 
-    Recurring newRecurringBillingEvent =
+    BillingRecurrence newBillingRecurrence =
         tm().loadByKey(domain.getAutorenewBillingEvent())
             .asBuilder()
             .setRenewalPriceBehavior(RenewalPriceBehavior.DEFAULT)
             .setRenewalPrice(null)
             .build();
 
-    // the Recurring billing event is reloaded later in the renew flow, so we synchronize changed
-    // RecurringBillingEvent with storage manually
-    tm().put(newRecurringBillingEvent);
+    // the Recurrence is reloaded later in the renew flow, so we synchronize changed
+    // Recurrences with storage manually
+    tm().put(newBillingRecurrence);
     tm().getEntityManager().flush();
     tm().getEntityManager().clear();
 
@@ -254,7 +278,7 @@ public class AllocationTokenFlowUtils {
     return domain
         .asBuilder()
         .setCurrentPackageToken(null)
-        .setAutorenewBillingEvent(newRecurringBillingEvent.createVKey())
+        .setAutorenewBillingEvent(newBillingRecurrence.createVKey())
         .build();
   }
 

core/src/main/java/google/registry/idn/Latin-IDN.txt

@@ -1,21 +1,23 @@
 # Registry: Charleston Road Registry Inc.
-#
 # Script: Latn
-#
-# Version: 1.0
-#
-# Effective Date: 04-12-2012
-#
-# Address: 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
-#
+# Version: 2.0
+# Effective Date: 2023-04-04
+# URL: https://www.iana.org/domains/idn-tables/tables/google_latn_2.0.txt
+# Policy: https://www.registry.google/about/policies/domainabuse/
+# Contact Name: CRR Tech
+# Email address: crr-tech@google.com
 # Telephone: +1 (650) 253-0000
 #
-# Website: www.charlestonroadregistry.com
+# Code points requiring context rules
+#
+# Code point                        Description of rule/Reference
+#
+# U+002D                            Label must neither start nor end with U+002D. Label
+#    HYPHEN-MINUS                   must not have U+002D in both third and fourth
+#                                   position. RFC 5891 (sec 4.2.3.1)
 #
-# Notes: This table describes codepoints allowed for the Latin script.
 
 U+002D                         # HYPHEN-MINUS
-#
 U+0030                         # DIGIT ZERO
 U+0031                         # DIGIT ONE
 U+0032                         # DIGIT TWO
@@ -26,12 +28,7 @@ U+0036                         # DIGIT SIX
 U+0037                         # DIGIT SEVEN
 U+0038                         # DIGIT EIGHT
 U+0039                         # DIGIT NINE
-#
-# The following code points are listed according to the
-# European Ordering Rules (ENV 13710).
-#
 U+0061                         # LATIN SMALL LETTER A
-U+00E1                         # LATIN SMALL LETTER A WITH ACUTE
 U+00E0                         # LATIN SMALL LETTER A WITH GRAVE
 U+0103                         # LATIN SMALL LETTER A WITH BREVE
 U+00E2                         # LATIN SMALL LETTER A WITH CIRCUMFLEX
@@ -39,14 +36,11 @@ U+00E5                         # LATIN SMALL LETTER A WITH RING ABOVE
 U+00E4                         # LATIN SMALL LETTER A WITH DIAERESIS
 U+00E3                         # LATIN SMALL LETTER A WITH TILDE
 U+0105                         # LATIN SMALL LETTER A WITH OGONEK
-U+0101                         # LATIN SMALL LETTER A WITH MACRON
-U+01CE                         # LATIN SMALL LETTER A WITH CARON
 U+00E6                         # LATIN SMALL LETTER AE
 U+0062                         # LATIN SMALL LETTER B
 U+0063                         # LATIN SMALL LETTER C
 U+0107                         # LATIN SMALL LETTER C WITH ACUTE
 U+010D                         # LATIN SMALL LETTER C WITH CARON
-U+010B                         # LATIN SMALL LETTER C WITH DOT ABOVE
 U+00E7                         # LATIN SMALL LETTER C WITH CEDILLA
 U+0064                         # LATIN SMALL LETTER D
 U+010F                         # LATIN SMALL LETTER D WITH CARON
@@ -65,21 +59,14 @@ U+0259                         # LATIN SMALL LETTER SCHWA
 U+0066                         # LATIN SMALL LETTER F
 U+0067                         # LATIN SMALL LETTER G
 U+011F                         # LATIN SMALL LETTER G WITH BREVE
-U+01E7                         # LATIN SMALL LETTER G WITH CARON
 U+0121                         # LATIN SMALL LETTER G WITH DOT ABOVE
-U+0123                         # LATIN SMALL LETTER G WITH CEDILLA
-U+01E5                         # LATIN SMALL LETTER G WITH STROKE
 U+0068                         # LATIN SMALL LETTER H
 U+0127                         # LATIN SMALL LETTER H WITH STROKE
 U+0069                         # LATIN SMALL LETTER I
-U+0131                         # LATIN SMALL LETTER DOTLESS I
-U+00ED                         # LATIN SMALL LETTER I WITH ACUTE
 U+00EC                         # LATIN SMALL LETTER I WITH GRAVE
 U+00EE                         # LATIN SMALL LETTER I WITH CIRCUMFLEX
-U+00EF                         # LATIN SMALL LETTER I WITH DIAERESIS
 U+012F                         # LATIN SMALL LETTER I WITH OGONEK
 U+012B                         # LATIN SMALL LETTER I WITH MACRON
-U+01D0                         # LATIN SMALL LETTER I WITH CARON
 U+006A                         # LATIN SMALL LETTER J
 U+006B                         # LATIN SMALL LETTER K
 U+01E9                         # LATIN SMALL LETTER K WITH CARON
@@ -91,20 +78,15 @@ U+013C                         # LATIN SMALL LETTER L WITH CEDILLA
 U+0142                         # LATIN SMALL LETTER L WITH STROKE
 U+006D                         # LATIN SMALL LETTER M
 U+006E                         # LATIN SMALL LETTER N
-U+0144                         # LATIN SMALL LETTER N WITH ACUTE
 U+0148                         # LATIN SMALL LETTER N WITH CARON
 U+00F1                         # LATIN SMALL LETTER N WITH TILDE
 U+0146                         # LATIN SMALL LETTER N WITH CEDILLA
-U+014B                         # LATIN SMALL LETTER ENG
 U+006F                         # LATIN SMALL LETTER O
-U+00F3                         # LATIN SMALL LETTER O WITH ACUTE
 U+00F2                         # LATIN SMALL LETTER O WITH GRAVE
 U+00F4                         # LATIN SMALL LETTER O WITH CIRCUMFLEX
 U+00F6                         # LATIN SMALL LETTER O WITH DIAERESIS
 U+0151                         # LATIN SMALL LETTER O WITH DOUBLE ACUTE
 U+00F5                         # LATIN SMALL LETTER O WITH TILDE
-U+014D                         # LATIN SMALL LETTER O WITH MACRON
-U+01D2                         # LATIN SMALL LETTER O WITH CARON
 U+00F8                         # LATIN SMALL LETTER O WITH STROKE
 U+0153                         # LATIN SMALL LIGATURE OE
 U+0070                         # LATIN SMALL LETTER P
@@ -112,41 +94,31 @@ U+0071                         # LATIN SMALL LETTER Q
 U+0072                         # LATIN SMALL LETTER R
 U+0155                         # LATIN SMALL LETTER R WITH ACUTE
 U+0159                         # LATIN SMALL LETTER R WITH CARON
-U+0157                         # LATIN SMALL LETTER R WITH CEDILLA
 U+0073                         # LATIN SMALL LETTER S
 U+015B                         # LATIN SMALL LETTER S WITH ACUTE
 U+0161                         # LATIN SMALL LETTER S WITH CARON
 U+015F                         # LATIN SMALL LETTER S WITH CEDILLA
 U+0074                         # LATIN SMALL LETTER T
 U+0165                         # LATIN SMALL LETTER T WITH CARON
-U+0163                         # LATIN SMALL LETTER T WITH CEDILLA
 U+0167                         # LATIN SMALL LETTER T WITH STROKE
 U+0075                         # LATIN SMALL LETTER U
-U+00FA                         # LATIN SMALL LETTER U WITH ACUTE
 U+00F9                         # LATIN SMALL LETTER U WITH GRAVE
 U+00FB                         # LATIN SMALL LETTER U WITH CIRCUMFLEX
 U+016F                         # LATIN SMALL LETTER U WITH RING ABOVE
-U+00FC                         # LATIN SMALL LETTER U WITH DIAERESIS
 U+0171                         # LATIN SMALL LETTER U WITH DOUBLE ACUTE
 U+0173                         # LATIN SMALL LETTER U WITH OGONEK
 U+016B                         # LATIN SMALL LETTER U WITH MACRON
-U+01D4                         # LATIN SMALL LETTER U WITH CARON
 U+0076                         # LATIN SMALL LETTER V
 U+0077                         # LATIN SMALL LETTER W
-U+1E83                         # LATIN SMALL LETTER W WITH ACUTE
-U+1E81                         # LATIN SMALL LETTER W WITH GRAVE
 U+0175                         # LATIN SMALL LETTER W WITH CIRCUMFLEX
-U+1E85                         # LATIN SMALL LETTER W WITH DIAERESIS
 U+0078                         # LATIN SMALL LETTER X
 U+0079                         # LATIN SMALL LETTER Y
 U+00FD                         # LATIN SMALL LETTER Y WITH ACUTE
-U+1EF3                         # LATIN SMALL LETTER Y WITH GRAVE
 U+0177                         # LATIN SMALL LETTER Y WITH CIRCUMFLEX
 U+00FF                         # LATIN SMALL LETTER Y WITH DIAERESIS
 U+007A                         # LATIN SMALL LETTER Z
 U+017A                         # LATIN SMALL LETTER Z WITH ACUTE
 U+017E                         # LATIN SMALL LETTER Z WITH CARON
-U+017C                         # LATIN SMALL LETTER Z WITH DOT ABOVE
 U+0292                         # LATIN SMALL LETTER EZH
 U+01EF                         # LATIN SMALL LETTER EZH WITH CARON
 U+00FE                         # LATIN SMALL LETTER THORN

core/src/main/java/google/registry/idn/README.md

@@ -0,0 +1,7 @@
+# IDN tables
+
+This directory contains the most recent version of our approved IDN tables. They
+should match what is published (or will be published soon) by IANA. In the case
+of IDN tables that have had multiple revisions over time, this directory should
+contain only the latest version, not previous ones, even when said previous ones
+might still be in use by previously launched TLDs.

core/src/main/java/google/registry/model/EppResourceUtils.java

@@ -35,7 +35,7 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.Host;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntryDao;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferData;
 import google.registry.model.transfer.TransferStatus;
@@ -73,7 +73,7 @@ public final class EppResourceUtils {
 
   /** Returns the full domain repoId in the format HEX-TLD for the specified long id and tld. */
   public static String createDomainRepoId(long repoId, String tld) {
-    return createRepoId(repoId, Registry.get(tld).getRoidSuffix());
+    return createRepoId(repoId, Tld.get(tld).getRoidSuffix());
   }
 
   /** Returns the full repoId in the format HEX-TLD for the specified long id and ROID suffix. */

core/src/main/java/google/registry/model/OteAccountBuilder.java

@@ -17,8 +17,8 @@ package google.registry.model;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
-import static google.registry.model.tld.Registry.TldState.START_DATE_SUNRISE;
+import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
+import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -33,9 +33,9 @@ import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.persistence.VKey;
@@ -121,9 +121,9 @@ public final class OteAccountBuilder {
       ImmutableMap.of(CurrencyUnit.USD, "123", CurrencyUnit.JPY, "456");
 
   private final ImmutableMap<String, String> registrarIdToTld;
-  private final Registry sunriseTld;
-  private final Registry gaTld;
-  private final Registry eapTld;
+  private final Tld sunriseTld;
+  private final Tld gaTld;
+  private final Tld eapTld;
   private final ImmutableList.Builder<RegistrarPoc> contactsBuilder = new ImmutableList.Builder<>();
 
   private ImmutableList<Registrar> registrars;
@@ -247,7 +247,7 @@ public final class OteAccountBuilder {
   /** Saves all the OT&amp;E entities we created. */
   private void saveAllEntities() {
     // use ImmutableObject instead of Registry so that the Key generation doesn't break
-    ImmutableList<Registry> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
+    ImmutableList<Tld> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
     ImmutableList<RegistrarPoc> contacts = contactsBuilder.build();
 
     tm().transact(
@@ -255,8 +255,7 @@ public final class OteAccountBuilder {
               if (!replaceExisting) {
                 ImmutableList<VKey<? extends ImmutableObject>> keys =
                     Streams.concat(
-                            registries.stream()
-                                .map(registry -> Registry.createVKey(registry.getTldStr())),
+                            registries.stream().map(tld -> Tld.createVKey(tld.getTldStr())),
                             registrars.stream().map(Registrar::createVKey),
                             contacts.stream().map(RegistrarPoc::createVKey))
                         .collect(toImmutableList());
@@ -291,16 +290,13 @@ public final class OteAccountBuilder {
         .build();
   }
 
-  private static Registry createTld(
-      String tldName,
-      TldState initialTldState,
-      boolean isEarlyAccess,
-      int roidSuffix) {
+  private static Tld createTld(
+      String tldName, TldState initialTldState, boolean isEarlyAccess, int roidSuffix) {
     String tldNameAlphaNumerical = tldName.replaceAll("[^a-z\\d]", "");
     Optional<PremiumList> premiumList = PremiumListDao.getLatestRevision(DEFAULT_PREMIUM_LIST);
     checkState(premiumList.isPresent(), "Couldn't find premium list %s.", DEFAULT_PREMIUM_LIST);
-    Registry.Builder builder =
-        new Registry.Builder()
+    Tld.Builder builder =
+        new Tld.Builder()
             .setTldStr(tldName)
             .setPremiumPricingEngine(StaticPremiumListPricingEngine.NAME)
             .setTldStateTransitions(ImmutableSortedMap.of(START_OF_TIME, initialTldState))

core/src/main/java/google/registry/model/billing/BillingBase.java

@@ -0,0 +1,264 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.billing;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.util.CollectionUtils.forceEmptyToNull;
+import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import com.google.common.collect.ImmutableSet;
+import google.registry.model.Buildable;
+import google.registry.model.ImmutableObject;
+import google.registry.model.UnsafeSerializable;
+import google.registry.model.annotations.IdAllocation;
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
+import google.registry.persistence.VKey;
+import java.util.Set;
+import javax.annotation.Nullable;
+import javax.persistence.Column;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.MappedSuperclass;
+import org.joda.time.DateTime;
+
+/** A billable event in a domain's lifecycle. */
+@MappedSuperclass
+public abstract class BillingBase extends ImmutableObject
+    implements Buildable, TransferServerApproveEntity, UnsafeSerializable {
+
+  /** The reason for the bill, which maps 1:1 to skus in go/registry-billing-skus. */
+  public enum Reason {
+    CREATE(true),
+    @Deprecated // DO NOT USE THIS REASON. IT REMAINS BECAUSE OF HISTORICAL DATA. SEE b/31676071.
+    ERROR(false),
+    FEE_EARLY_ACCESS(true),
+    RENEW(true),
+    RESTORE(true),
+    SERVER_STATUS(false),
+    TRANSFER(true);
+
+    private final boolean requiresPeriod;
+
+    Reason(boolean requiresPeriod) {
+      this.requiresPeriod = requiresPeriod;
+    }
+
+    /**
+     * Returns whether billing events with this reason have a period years associated with them.
+     *
+     * <p>Note that this is an "if an only if" condition.
+     */
+    public boolean hasPeriodYears() {
+      return requiresPeriod;
+    }
+  }
+
+  /** Set of flags that can be applied to billing events. */
+  public enum Flag {
+    ALLOCATION,
+    ANCHOR_TENANT,
+    AUTO_RENEW,
+    /** Landrush billing events are historical only and are no longer created. */
+    LANDRUSH,
+    /**
+     * This flag is used on create {@link BillingEvent} billing events for domains that were
+     * reserved.
+     *
+     * <p>This can happen when allocation tokens are used or superusers override a domain
+     * reservation. These cases can need special handling in billing/invoicing. Anchor tenants will
+     * never have this flag applied; they will have ANCHOR_TENANT instead.
+     */
+    RESERVED,
+    SUNRISE,
+    /**
+     * This flag will be added to any {@link BillingEvent} events that are created via, e.g., an
+     * automated process to expand {@link BillingRecurrence} events.
+     */
+    SYNTHETIC
+  }
+
+  /**
+   * Sets of renewal price behaviors that can be applied to billing recurrences.
+   *
+   * <p>When a client renews a domain, they could be charged differently, depending on factors such
+   * as the client type and the domain itself.
+   */
+  public enum RenewalPriceBehavior {
+    /**
+     * This indicates the renewal price is the default price.
+     *
+     * <p>By default, if the domain is premium, then premium price will be used. Otherwise, the
+     * standard price of the TLD will be used.
+     */
+    DEFAULT,
+    /**
+     * This indicates the domain will be renewed at standard price even if it's a premium domain.
+     *
+     * <p>We chose to name this "NONPREMIUM" rather than simply "STANDARD" to avoid confusion
+     * between "STANDARD" and "DEFAULT".
+     *
+     * <p>This price behavior is used with anchor tenants.
+     */
+    NONPREMIUM,
+    /**
+     * This indicates that the renewalPrice in {@link BillingRecurrence} will be used for domain
+     * renewal.
+     *
+     * <p>The renewalPrice has a non-null value iff the price behavior is set to "SPECIFIED". This
+     * behavior is used with internal registrations.
+     */
+    SPECIFIED
+  }
+
+  /** Entity id. */
+  @IdAllocation @Id Long id;
+
+  /** The registrar to bill. */
+  @Column(name = "registrarId", nullable = false)
+  String clientId;
+
+  /** Revision id of the entry in DomainHistory table that ths bill belongs to. */
+  @Column(nullable = false)
+  Long domainHistoryRevisionId;
+
+  /** ID of the EPP resource that the bill is for. */
+  @Column(nullable = false)
+  String domainRepoId;
+
+  /** When this event was created. For recurrence events, this is also the recurrence start time. */
+  @Column(nullable = false)
+  DateTime eventTime;
+
+  /** The reason for the bill. */
+  @Enumerated(EnumType.STRING)
+  @Column(nullable = false)
+  Reason reason;
+
+  /** The fully qualified domain name of the domain that the bill is for. */
+  @Column(name = "domain_name", nullable = false)
+  String targetId;
+
+  @Nullable Set<Flag> flags;
+
+  public String getRegistrarId() {
+    return clientId;
+  }
+
+  public long getDomainHistoryRevisionId() {
+    return domainHistoryRevisionId;
+  }
+
+  public String getDomainRepoId() {
+    return domainRepoId;
+  }
+
+  public DateTime getEventTime() {
+    return eventTime;
+  }
+
+  public long getId() {
+    return id;
+  }
+
+  public Reason getReason() {
+    return reason;
+  }
+
+  public String getTargetId() {
+    return targetId;
+  }
+
+  public HistoryEntryId getHistoryEntryId() {
+    return new HistoryEntryId(domainRepoId, domainHistoryRevisionId);
+  }
+
+  public ImmutableSet<Flag> getFlags() {
+    return nullToEmptyImmutableCopy(flags);
+  }
+
+  @Override
+  public abstract VKey<? extends BillingBase> createVKey();
+
+  /** Override Buildable.asBuilder() to give this method stronger typing. */
+  @Override
+  public abstract Builder<?, ?> asBuilder();
+
+  /** An abstract builder for {@link BillingBase}. */
+  public abstract static class Builder<T extends BillingBase, B extends Builder<?, ?>>
+      extends GenericBuilder<T, B> {
+
+    protected Builder() {}
+
+    protected Builder(T instance) {
+      super(instance);
+    }
+
+    public B setReason(Reason reason) {
+      getInstance().reason = reason;
+      return thisCastToDerived();
+    }
+
+    public B setId(long id) {
+      getInstance().id = id;
+      return thisCastToDerived();
+    }
+
+    public B setRegistrarId(String registrarId) {
+      getInstance().clientId = registrarId;
+      return thisCastToDerived();
+    }
+
+    public B setEventTime(DateTime eventTime) {
+      getInstance().eventTime = eventTime;
+      return thisCastToDerived();
+    }
+
+    public B setTargetId(String targetId) {
+      getInstance().targetId = targetId;
+      return thisCastToDerived();
+    }
+
+    public B setFlags(ImmutableSet<Flag> flags) {
+      getInstance().flags = forceEmptyToNull(checkArgumentNotNull(flags, "flags"));
+      return thisCastToDerived();
+    }
+
+    public B setDomainHistoryId(HistoryEntryId domainHistoryId) {
+      getInstance().domainHistoryRevisionId = domainHistoryId.getRevisionId();
+      getInstance().domainRepoId = domainHistoryId.getRepoId();
+      return thisCastToDerived();
+    }
+
+    public B setDomainHistory(DomainHistory domainHistory) {
+      return setDomainHistoryId(domainHistory.getHistoryEntryId());
+    }
+
+    @Override
+    public T build() {
+      T instance = getInstance();
+      checkNotNull(instance.reason, "Reason must be set");
+      checkNotNull(instance.clientId, "Registrar ID must be set");
+      checkNotNull(instance.eventTime, "Event time must be set");
+      checkNotNull(instance.targetId, "Target ID must be set");
+      checkNotNull(instance.domainHistoryRevisionId, "Domain History Revision ID must be set");
+      checkNotNull(instance.domainRepoId, "Domain Repo ID must be set");
+      return super.build();
+    }
+  }
+}

core/src/main/java/google/registry/model/billing/BillingCancellation.java

@@ -0,0 +1,166 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.billing;
+
+import static com.google.common.base.MoreObjects.firstNonNull;
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkState;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.domain.GracePeriod;
+import google.registry.model.domain.rgp.GracePeriodStatus;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.persistence.VKey;
+import google.registry.persistence.WithVKey;
+import javax.persistence.AttributeOverride;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.Table;
+import org.joda.time.DateTime;
+
+/**
+ * An event representing a cancellation of one of the other two billable event types.
+ *
+ * <p>This is implemented as a separate event rather than a bit on BillingEvent in order to preserve
+ * the immutability of billing events.
+ */
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "registrarId"),
+      @Index(columnList = "eventTime"),
+      @Index(columnList = "domainRepoId"),
+      @Index(columnList = "billingTime"),
+      @Index(columnList = "billing_event_id"),
+      @Index(columnList = "billing_recurrence_id")
+    })
+@AttributeOverride(name = "id", column = @Column(name = "billing_cancellation_id"))
+@WithVKey(Long.class)
+public class BillingCancellation extends BillingBase {
+
+  /** The billing time of the charge that is being cancelled. */
+  DateTime billingTime;
+
+  /** The one-time billing event to cancel, or null for autorenew cancellations. */
+  @Column(name = "billing_event_id")
+  VKey<BillingEvent> billingEvent;
+
+  /** The Recurrence to cancel, or null for non-autorenew cancellations. */
+  @Column(name = "billing_recurrence_id")
+  VKey<BillingRecurrence> billingRecurrence;
+
+  public DateTime getBillingTime() {
+    return billingTime;
+  }
+
+  public VKey<? extends BillingBase> getEventKey() {
+    return firstNonNull(billingEvent, billingRecurrence);
+  }
+
+  /** The mapping from billable grace period types to originating billing event reasons. */
+  static final ImmutableMap<GracePeriodStatus, Reason> GRACE_PERIOD_TO_REASON =
+      ImmutableMap.of(
+          GracePeriodStatus.ADD, Reason.CREATE,
+          GracePeriodStatus.AUTO_RENEW, Reason.RENEW,
+          GracePeriodStatus.RENEW, Reason.RENEW,
+          GracePeriodStatus.TRANSFER, Reason.TRANSFER);
+
+  /**
+   * Creates a cancellation billing event (parented on the provided history key, and with the
+   * corresponding event time) that will cancel out the provided grace period's billing event, using
+   * the supplied targetId and deriving other metadata (clientId, billing time, and the cancellation
+   * reason) from the grace period.
+   */
+  public static google.registry.model.billing.BillingCancellation forGracePeriod(
+      GracePeriod gracePeriod,
+      DateTime eventTime,
+      HistoryEntryId domainHistoryId,
+      String targetId) {
+    checkArgument(
+        gracePeriod.hasBillingEvent(),
+        "Cannot create cancellation for grace period without billing event");
+    Builder builder =
+        new Builder()
+            .setReason(checkNotNull(GRACE_PERIOD_TO_REASON.get(gracePeriod.getType())))
+            .setTargetId(targetId)
+            .setRegistrarId(gracePeriod.getRegistrarId())
+            .setEventTime(eventTime)
+            // The charge being cancelled will take place at the grace period's expiration time.
+            .setBillingTime(gracePeriod.getExpirationTime())
+            .setDomainHistoryId(domainHistoryId);
+    // Set the grace period's billing event using the appropriate Cancellation builder method.
+    if (gracePeriod.getBillingEvent() != null) {
+      builder.setBillingEvent(gracePeriod.getBillingEvent());
+    } else if (gracePeriod.getBillingRecurrence() != null) {
+      builder.setBillingRecurrence(gracePeriod.getBillingRecurrence());
+    }
+    return builder.build();
+  }
+
+  @Override
+  public VKey<google.registry.model.billing.BillingCancellation> createVKey() {
+    return createVKey(getId());
+  }
+
+  public static VKey<google.registry.model.billing.BillingCancellation> createVKey(long id) {
+    return VKey.create(google.registry.model.billing.BillingCancellation.class, id);
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /**
+   * A builder for {@link google.registry.model.billing.BillingCancellation} since it is immutable.
+   */
+  public static class Builder
+      extends BillingBase.Builder<google.registry.model.billing.BillingCancellation, Builder> {
+
+    public Builder() {}
+
+    private Builder(google.registry.model.billing.BillingCancellation instance) {
+      super(instance);
+    }
+
+    public Builder setBillingTime(DateTime billingTime) {
+      getInstance().billingTime = billingTime;
+      return this;
+    }
+
+    public Builder setBillingEvent(VKey<BillingEvent> billingEvent) {
+      getInstance().billingEvent = billingEvent;
+      return this;
+    }
+
+    public Builder setBillingRecurrence(VKey<BillingRecurrence> billingRecurrence) {
+      getInstance().billingRecurrence = billingRecurrence;
+      return this;
+    }
+
+    @Override
+    public google.registry.model.billing.BillingCancellation build() {
+      google.registry.model.billing.BillingCancellation instance = getInstance();
+      checkNotNull(instance.billingTime, "Must set billing time");
+      checkNotNull(instance.reason, "Must set reason");
+      checkState(
+          (instance.billingEvent == null) != (instance.billingRecurrence == null),
+          "Cancellations must have exactly one billing event key set");
+      return super.build();
+    }
+  }
+}

core/src/main/java/google/registry/model/billing/BillingEvent.java

@@ -1,4 +1,4 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -14,740 +14,197 @@
 
 package google.registry.model.billing;
 
-import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
-import static google.registry.util.CollectionUtils.forceEmptyToNull;
-import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
-import static google.registry.util.DateTimeUtils.END_OF_TIME;
-import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
-import google.registry.model.Buildable;
-import google.registry.model.ImmutableObject;
-import google.registry.model.UnsafeSerializable;
-import google.registry.model.annotations.IdAllocation;
-import google.registry.model.common.TimeOfYear;
 import google.registry.model.domain.DomainHistory;
-import google.registry.model.domain.GracePeriod;
-import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.token.AllocationToken;
-import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
-import google.registry.model.transfer.TransferData.TransferServerApproveEntity;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithVKey;
 import google.registry.persistence.converter.JodaMoneyType;
 import java.util.Optional;
-import java.util.Set;
 import javax.annotation.Nullable;
 import javax.persistence.AttributeOverride;
-import javax.persistence.AttributeOverrides;
 import javax.persistence.Column;
-import javax.persistence.Embedded;
 import javax.persistence.Entity;
-import javax.persistence.EnumType;
-import javax.persistence.Enumerated;
-import javax.persistence.Id;
 import javax.persistence.Index;
-import javax.persistence.MappedSuperclass;
 import javax.persistence.Table;
 import org.hibernate.annotations.Columns;
 import org.hibernate.annotations.Type;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 
-/** A billable event in a domain's lifecycle. */
-@MappedSuperclass
-public abstract class BillingEvent extends ImmutableObject
-    implements Buildable, TransferServerApproveEntity, UnsafeSerializable {
+/** A one-time billable event. */
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "registrarId"),
+      @Index(columnList = "eventTime"),
+      @Index(columnList = "billingTime"),
+      @Index(columnList = "syntheticCreationTime"),
+      @Index(columnList = "domainRepoId"),
+      @Index(columnList = "allocationToken"),
+      @Index(columnList = "cancellation_matching_billing_recurrence_id")
+    })
+@AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
+@WithVKey(Long.class)
+public class BillingEvent extends BillingBase {
 
-  /** The reason for the bill, which maps 1:1 to skus in go/registry-billing-skus. */
-  public enum Reason {
-    CREATE(true),
-    @Deprecated // DO NOT USE THIS REASON. IT REMAINS BECAUSE OF HISTORICAL DATA. SEE b/31676071.
-    ERROR(false),
-    FEE_EARLY_ACCESS(true),
-    RENEW(true),
-    RESTORE(true),
-    SERVER_STATUS(false),
-    TRANSFER(true);
+  /** The billable value. */
+  @Type(type = JodaMoneyType.TYPE_NAME)
+  @Columns(columns = {@Column(name = "cost_amount"), @Column(name = "cost_currency")})
+  Money cost;
 
-    private final boolean requiresPeriod;
-
-    Reason(boolean requiresPeriod) {
-      this.requiresPeriod = requiresPeriod;
-    }
-
-    /**
-     * Returns whether billing events with this reason have a period years associated with them.
-     *
-     * <p>Note that this is an "if an only if" condition.
-     */
-    public boolean hasPeriodYears() {
-      return requiresPeriod;
-    }
-  }
-
-  /** Set of flags that can be applied to billing events. */
-  public enum Flag {
-    ALLOCATION,
-    ANCHOR_TENANT,
-    AUTO_RENEW,
-    /** Landrush billing events are historical only and are no longer created. */
-    LANDRUSH,
-    /**
-     * This flag is used on create {@link OneTime} billing events for domains that were reserved.
-     *
-     * <p>This can happen when allocation tokens are used or superusers override a domain
-     * reservation. These cases can need special handling in billing/invoicing. Anchor tenants will
-     * never have this flag applied; they will have ANCHOR_TENANT instead.
-     */
-    RESERVED,
-    SUNRISE,
-    /**
-     * This flag will be added to any {@link OneTime} events that are created via, e.g., an
-     * automated process to expand {@link Recurring} events.
-     */
-    SYNTHETIC
-  }
+  /** When the cost should be billed. */
+  DateTime billingTime;
 
   /**
-   * Sets of renewal price behaviors that can be applied to billing recurrences.
-   *
-   * <p>When a client renews a domain, they could be charged differently, depending on factors such
-   * as the client type and the domain itself.
+   * The period in years of the action being billed for, if applicable, otherwise null. Used for
+   * financial reporting.
    */
-  public enum RenewalPriceBehavior {
-    /**
-     * This indicates the renewal price is the default price.
-     *
-     * <p>By default, if the domain is premium, then premium price will be used. Otherwise, the
-     * standard price of the TLD will be used.
-     */
-    DEFAULT,
-    /**
-     * This indicates the domain will be renewed at standard price even if it's a premium domain.
-     *
-     * <p>We chose to name this "NONPREMIUM" rather than simply "STANDARD" to avoid confusion
-     * between "STANDARD" and "DEFAULT".
-     *
-     * <p>This price behavior is used with anchor tenants.
-     */
-    NONPREMIUM,
-    /**
-     * This indicates that the renewalPrice in {@link Recurring} will be used for domain renewal.
-     *
-     * <p>The renewalPrice has a non-null value iff the price behavior is set to "SPECIFIED". This
-     * behavior is used with internal registrations.
-     */
-    SPECIFIED
+  Integer periodYears;
+
+  /**
+   * For {@link Flag#SYNTHETIC} events, when this event was persisted to the database (i.e. the
+   * cursor position at the time the recurrence expansion job was last run). In the event a job
+   * needs to be undone, a query on this field will return the complete set of potentially bad
+   * events.
+   */
+  DateTime syntheticCreationTime;
+
+  /**
+   * For {@link Flag#SYNTHETIC} events, a {@link VKey} to the {@link BillingRecurrence} from which
+   * this {@link google.registry.model.billing.BillingEvent} was created. This is needed in order to
+   * properly match billing events against {@link BillingCancellation}s.
+   */
+  @Column(name = "cancellation_matching_billing_recurrence_id")
+  VKey<BillingRecurrence> cancellationMatchingBillingEvent;
+
+  /**
+   * For {@link Flag#SYNTHETIC} events, the {@link DomainHistory} revision ID of the {@link
+   * BillingRecurrence} from which this {@link google.registry.model.billing.BillingEvent} was
+   * created. This is needed in order to recreate the {@link VKey} when reading from SQL.
+   */
+  @Column(name = "recurrence_history_revision_id")
+  Long recurrenceHistoryRevisionId;
+
+  /**
+   * The {@link AllocationToken} used in the creation of this event, or null if one was not used.
+   */
+  @Nullable VKey<AllocationToken> allocationToken;
+
+  public Money getCost() {
+    return cost;
   }
 
-  /** Entity id. */
-  @IdAllocation @Id Long id;
-
-  /** The registrar to bill. */
-  @Column(name = "registrarId", nullable = false)
-  String clientId;
-
-  /** Revision id of the entry in DomainHistory table that ths bill belongs to. */
-  @Column(nullable = false)
-  Long domainHistoryRevisionId;
-
-  /** ID of the EPP resource that the bill is for. */
-  @Column(nullable = false)
-  String domainRepoId;
-
-  /** When this event was created. For recurring events, this is also the recurrence start time. */
-  @Column(nullable = false)
-  DateTime eventTime;
-
-  /** The reason for the bill. */
-  @Enumerated(EnumType.STRING)
-  @Column(nullable = false)
-  Reason reason;
-
-  /** The fully qualified domain name of the domain that the bill is for. */
-  @Column(name = "domain_name", nullable = false)
-  String targetId;
-
-  @Nullable Set<Flag> flags;
-
-  public String getRegistrarId() {
-    return clientId;
+  public DateTime getBillingTime() {
+    return billingTime;
   }
 
-  public long getDomainHistoryRevisionId() {
-    return domainHistoryRevisionId;
+  public Integer getPeriodYears() {
+    return periodYears;
   }
 
-  public String getDomainRepoId() {
-    return domainRepoId;
+  public DateTime getSyntheticCreationTime() {
+    return syntheticCreationTime;
   }
 
-  public DateTime getEventTime() {
-    return eventTime;
+  public VKey<BillingRecurrence> getCancellationMatchingBillingEvent() {
+    return cancellationMatchingBillingEvent;
   }
 
-  public long getId() {
-    return id;
+  public Long getRecurrenceHistoryRevisionId() {
+    return recurrenceHistoryRevisionId;
   }
 
-  public Reason getReason() {
-    return reason;
-  }
-
-  public String getTargetId() {
-    return targetId;
-  }
-
-  public HistoryEntryId getHistoryEntryId() {
-    return new HistoryEntryId(domainRepoId, domainHistoryRevisionId);
-  }
-
-  public ImmutableSet<Flag> getFlags() {
-    return nullToEmptyImmutableCopy(flags);
+  public Optional<VKey<AllocationToken>> getAllocationToken() {
+    return Optional.ofNullable(allocationToken);
   }
 
   @Override
-  public abstract VKey<? extends BillingEvent> createVKey();
+  public VKey<google.registry.model.billing.BillingEvent> createVKey() {
+    return createVKey(getId());
+  }
+
+  public static VKey<google.registry.model.billing.BillingEvent> createVKey(long id) {
+    return VKey.create(google.registry.model.billing.BillingEvent.class, id);
+  }
 
-  /** Override Buildable.asBuilder() to give this method stronger typing. */
   @Override
-  public abstract Builder<?, ?> asBuilder();
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
 
-  /** An abstract builder for {@link BillingEvent}. */
-  public abstract static class Builder<T extends BillingEvent, B extends Builder<?, ?>>
-      extends GenericBuilder<T, B> {
+  /** A builder for {@link google.registry.model.billing.BillingEvent} since it is immutable. */
+  public static class Builder
+      extends BillingBase.Builder<google.registry.model.billing.BillingEvent, Builder> {
 
-    protected Builder() {}
+    public Builder() {}
 
-    protected Builder(T instance) {
+    private Builder(google.registry.model.billing.BillingEvent instance) {
       super(instance);
     }
 
-    public B setReason(Reason reason) {
-      getInstance().reason = reason;
-      return thisCastToDerived();
+    public Builder setCost(Money cost) {
+      getInstance().cost = cost;
+      return this;
     }
 
-    public B setId(long id) {
-      getInstance().id = id;
-      return thisCastToDerived();
+    public Builder setPeriodYears(Integer periodYears) {
+      checkNotNull(periodYears);
+      checkArgument(periodYears > 0);
+      getInstance().periodYears = periodYears;
+      return this;
     }
 
-    public B setRegistrarId(String registrarId) {
-      getInstance().clientId = registrarId;
-      return thisCastToDerived();
+    public Builder setBillingTime(DateTime billingTime) {
+      getInstance().billingTime = billingTime;
+      return this;
     }
 
-    public B setEventTime(DateTime eventTime) {
-      getInstance().eventTime = eventTime;
-      return thisCastToDerived();
+    public Builder setSyntheticCreationTime(DateTime syntheticCreationTime) {
+      getInstance().syntheticCreationTime = syntheticCreationTime;
+      return this;
     }
 
-    public B setTargetId(String targetId) {
-      getInstance().targetId = targetId;
-      return thisCastToDerived();
+    public Builder setCancellationMatchingBillingEvent(
+        BillingRecurrence cancellationMatchingBillingEvent) {
+      getInstance().cancellationMatchingBillingEvent =
+          cancellationMatchingBillingEvent.createVKey();
+      getInstance().recurrenceHistoryRevisionId =
+          cancellationMatchingBillingEvent.getDomainHistoryRevisionId();
+      return this;
     }
 
-    public B setFlags(ImmutableSet<Flag> flags) {
-      getInstance().flags = forceEmptyToNull(checkArgumentNotNull(flags, "flags"));
-      return thisCastToDerived();
-    }
-
-    public B setDomainHistoryId(HistoryEntryId domainHistoryId) {
-      getInstance().domainHistoryRevisionId = domainHistoryId.getRevisionId();
-      getInstance().domainRepoId = domainHistoryId.getRepoId();
-      return thisCastToDerived();
-    }
-
-    public B setDomainHistory(DomainHistory domainHistory) {
-      return setDomainHistoryId(domainHistory.getHistoryEntryId());
+    public Builder setAllocationToken(@Nullable VKey<AllocationToken> allocationToken) {
+      getInstance().allocationToken = allocationToken;
+      return this;
     }
 
     @Override
-    public T build() {
-      T instance = getInstance();
-      checkNotNull(instance.reason, "Reason must be set");
-      checkNotNull(instance.clientId, "Registrar ID must be set");
-      checkNotNull(instance.eventTime, "Event time must be set");
-      checkNotNull(instance.targetId, "Target ID must be set");
-      checkNotNull(instance.domainHistoryRevisionId, "Domain History Revision ID must be set");
-      checkNotNull(instance.domainRepoId, "Domain Repo ID must be set");
+    public google.registry.model.billing.BillingEvent build() {
+      google.registry.model.billing.BillingEvent instance = getInstance();
+      checkNotNull(instance.billingTime);
+      checkNotNull(instance.cost);
+      checkState(!instance.cost.isNegative(), "Costs should be non-negative.");
+      // TODO(mcilwain): Enforce this check on all billing events (not just more recent ones)
+      //                 post-migration after we add the missing period years values in SQL.
+      if (instance.eventTime.isAfter(DateTime.parse("2019-01-01T00:00:00Z"))) {
+        checkState(
+            instance.reason.hasPeriodYears() == (instance.periodYears != null),
+            "Period years must be set if and only if reason is "
+                + "CREATE, FEE_EARLY_ACCESS, RENEW, RESTORE or TRANSFER.");
+      }
+      checkState(
+          instance.getFlags().contains(Flag.SYNTHETIC) == (instance.syntheticCreationTime != null),
+          "Synthetic creation time must be set if and only if the SYNTHETIC flag is set.");
+      checkState(
+          instance.getFlags().contains(Flag.SYNTHETIC)
+              == (instance.cancellationMatchingBillingEvent != null),
+          "Cancellation matching billing event must be set if and only if the SYNTHETIC flag "
+              + "is set.");
       return super.build();
     }
   }
-
-  /** A one-time billable event. */
-  @Entity(name = "BillingEvent")
-  @Table(
-      indexes = {
-        @Index(columnList = "registrarId"),
-        @Index(columnList = "eventTime"),
-        @Index(columnList = "billingTime"),
-        @Index(columnList = "syntheticCreationTime"),
-        @Index(columnList = "domainRepoId"),
-        @Index(columnList = "allocationToken"),
-        @Index(columnList = "cancellation_matching_billing_recurrence_id")
-      })
-  @AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
-  @WithVKey(Long.class)
-  public static class OneTime extends BillingEvent {
-
-    /** The billable value. */
-    @Type(type = JodaMoneyType.TYPE_NAME)
-    @Columns(columns = {@Column(name = "cost_amount"), @Column(name = "cost_currency")})
-    Money cost;
-
-    /** When the cost should be billed. */
-    DateTime billingTime;
-
-    /**
-     * The period in years of the action being billed for, if applicable, otherwise null. Used for
-     * financial reporting.
-     */
-    Integer periodYears;
-
-    /**
-     * For {@link Flag#SYNTHETIC} events, when this event was persisted to the database (i.e. the
-     * cursor position at the time the recurrence expansion job was last run). In the event a job
-     * needs to be undone, a query on this field will return the complete set of potentially bad
-     * events.
-     */
-    DateTime syntheticCreationTime;
-
-    /**
-     * For {@link Flag#SYNTHETIC} events, a {@link VKey} to the {@link Recurring} from which this
-     * {@link OneTime} was created. This is needed in order to properly match billing events against
-     * {@link Cancellation}s.
-     */
-    @Column(name = "cancellation_matching_billing_recurrence_id")
-    VKey<Recurring> cancellationMatchingBillingEvent;
-
-    /**
-     * For {@link Flag#SYNTHETIC} events, the {@link DomainHistory} revision ID of the {@link
-     * Recurring} from which this {@link OneTime} was created. This is needed in order to recreate
-     * the {@link VKey} when reading from SQL.
-     */
-    @Column(name = "recurrence_history_revision_id")
-    Long recurringEventHistoryRevisionId;
-
-    /**
-     * The {@link AllocationToken} used in the creation of this event, or null if one was not used.
-     */
-    @Nullable VKey<AllocationToken> allocationToken;
-
-    public Money getCost() {
-      return cost;
-    }
-
-    public DateTime getBillingTime() {
-      return billingTime;
-    }
-
-    public Integer getPeriodYears() {
-      return periodYears;
-    }
-
-    public DateTime getSyntheticCreationTime() {
-      return syntheticCreationTime;
-    }
-
-    public VKey<Recurring> getCancellationMatchingBillingEvent() {
-      return cancellationMatchingBillingEvent;
-    }
-
-    public Long getRecurringEventHistoryRevisionId() {
-      return recurringEventHistoryRevisionId;
-    }
-
-    public Optional<VKey<AllocationToken>> getAllocationToken() {
-      return Optional.ofNullable(allocationToken);
-    }
-
-    @Override
-    public VKey<OneTime> createVKey() {
-      return createVKey(getId());
-    }
-
-    public static VKey<OneTime> createVKey(long id) {
-      return VKey.create(OneTime.class, id);
-    }
-
-    @Override
-    public Builder asBuilder() {
-      return new Builder(clone(this));
-    }
-
-    /** A builder for {@link OneTime} since it is immutable. */
-    public static class Builder extends BillingEvent.Builder<OneTime, Builder> {
-
-      public Builder() {}
-
-      private Builder(OneTime instance) {
-        super(instance);
-      }
-
-      public Builder setCost(Money cost) {
-        getInstance().cost = cost;
-        return this;
-      }
-
-      public Builder setPeriodYears(Integer periodYears) {
-        checkNotNull(periodYears);
-        checkArgument(periodYears > 0);
-        getInstance().periodYears = periodYears;
-        return this;
-      }
-
-      public Builder setBillingTime(DateTime billingTime) {
-        getInstance().billingTime = billingTime;
-        return this;
-      }
-
-      public Builder setSyntheticCreationTime(DateTime syntheticCreationTime) {
-        getInstance().syntheticCreationTime = syntheticCreationTime;
-        return this;
-      }
-
-      public Builder setCancellationMatchingBillingEvent(
-          Recurring cancellationMatchingBillingEvent) {
-        getInstance().cancellationMatchingBillingEvent =
-            cancellationMatchingBillingEvent.createVKey();
-        getInstance().recurringEventHistoryRevisionId =
-            cancellationMatchingBillingEvent.getDomainHistoryRevisionId();
-        return this;
-      }
-
-      public Builder setAllocationToken(@Nullable VKey<AllocationToken> allocationToken) {
-        getInstance().allocationToken = allocationToken;
-        return this;
-      }
-
-      @Override
-      public OneTime build() {
-        OneTime instance = getInstance();
-        checkNotNull(instance.billingTime);
-        checkNotNull(instance.cost);
-        checkState(!instance.cost.isNegative(), "Costs should be non-negative.");
-        // TODO(mcilwain): Enforce this check on all billing events (not just more recent ones)
-        //                 post-migration after we add the missing period years values in SQL.
-        if (instance.eventTime.isAfter(DateTime.parse("2019-01-01T00:00:00Z"))) {
-          checkState(
-              instance.reason.hasPeriodYears() == (instance.periodYears != null),
-              "Period years must be set if and only if reason is "
-                  + "CREATE, FEE_EARLY_ACCESS, RENEW, RESTORE or TRANSFER.");
-        }
-        checkState(
-            instance.getFlags().contains(Flag.SYNTHETIC)
-                == (instance.syntheticCreationTime != null),
-            "Synthetic creation time must be set if and only if the SYNTHETIC flag is set.");
-        checkState(
-            instance.getFlags().contains(Flag.SYNTHETIC)
-                == (instance.cancellationMatchingBillingEvent != null),
-            "Cancellation matching billing event must be set if and only if the SYNTHETIC flag "
-                + "is set.");
-        return super.build();
-      }
-    }
-  }
-
-  /**
-   * A recurring billable event.
-   *
-   * <p>Unlike {@link OneTime} events, these do not store an explicit cost, since the cost of the
-   * recurring event might change and each time we bill for it, we need to bill at the current cost,
-   * not the value that was in use at the time the recurrence was created.
-   */
-  @Entity(name = "BillingRecurrence")
-  @Table(
-      indexes = {
-        @Index(columnList = "registrarId"),
-        @Index(columnList = "eventTime"),
-        @Index(columnList = "domainRepoId"),
-        @Index(columnList = "recurrenceEndTime"),
-        @Index(columnList = "recurrenceLastExpansion"),
-        @Index(columnList = "recurrence_time_of_year")
-      })
-  @AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
-  @WithVKey(Long.class)
-  public static class Recurring extends BillingEvent {
-
-    /**
-     * The billing event recurs every year between {@link #eventTime} and this time on the [month,
-     * day, time] specified in {@link #recurrenceTimeOfYear}.
-     */
-    DateTime recurrenceEndTime;
-
-    /**
-     * The most recent {@link DateTime} when this recurrence was expanded.
-     *
-     * <p>We only bother checking recurrences for potential expansion if this is at least one year
-     * in the past. If it's more recent than that, it means that the recurrence was already expanded
-     * too recently to need to be checked again (as domains autorenew each year).
-     */
-    @Column(nullable = false)
-    DateTime recurrenceLastExpansion;
-
-    /**
-     * The eventTime recurs every year on this [month, day, time] between {@link #eventTime} and
-     * {@link #recurrenceEndTime}, inclusive of the start but not of the end.
-     *
-     * <p>This field is denormalized from {@link #eventTime} to allow for an efficient index, but it
-     * always has the same data as that field.
-     *
-     * <p>Note that this is a recurrence of the event time, not the billing time. The billing time
-     * can be calculated by adding the relevant grace period length to this date. The reason for
-     * this requirement is that the event time recurs on a {@link org.joda.time.Period} schedule
-     * (same day of year, which can be 365 or 366 days later) which is what {@link TimeOfYear} can
-     * model, whereas the billing time is a fixed {@link org.joda.time.Duration} later.
-     */
-    @Embedded
-    @AttributeOverrides(
-        @AttributeOverride(name = "timeString", column = @Column(name = "recurrence_time_of_year")))
-    TimeOfYear recurrenceTimeOfYear;
-
-    /**
-     * The renewal price for domain renewal if and only if it's specified.
-     *
-     * <p>This price column remains null except when the renewal price behavior of the billing is
-     * SPECIFIED. This column is used for internal registrations.
-     */
-    @Nullable
-    @Type(type = JodaMoneyType.TYPE_NAME)
-    @Columns(
-        columns = {@Column(name = "renewalPriceAmount"), @Column(name = "renewalPriceCurrency")})
-    Money renewalPrice;
-
-    @Enumerated(EnumType.STRING)
-    @Column(name = "renewalPriceBehavior", nullable = false)
-    RenewalPriceBehavior renewalPriceBehavior = RenewalPriceBehavior.DEFAULT;
-
-    public DateTime getRecurrenceEndTime() {
-      return recurrenceEndTime;
-    }
-
-    public DateTime getRecurrenceLastExpansion() {
-      return recurrenceLastExpansion;
-    }
-
-    public TimeOfYear getRecurrenceTimeOfYear() {
-      return recurrenceTimeOfYear;
-    }
-
-    public RenewalPriceBehavior getRenewalPriceBehavior() {
-      return renewalPriceBehavior;
-    }
-
-    public Optional<Money> getRenewalPrice() {
-      return Optional.ofNullable(renewalPrice);
-    }
-
-    @Override
-    public VKey<Recurring> createVKey() {
-      return createVKey(getId());
-    }
-
-    public static VKey<Recurring> createVKey(Long id) {
-      return VKey.create(Recurring.class, id);
-    }
-
-    @Override
-    public Builder asBuilder() {
-      return new Builder(clone(this));
-    }
-
-    /** A builder for {@link Recurring} since it is immutable. */
-    public static class Builder extends BillingEvent.Builder<Recurring, Builder> {
-
-      public Builder() {}
-
-      private Builder(Recurring instance) {
-        super(instance);
-      }
-
-      public Builder setRecurrenceEndTime(DateTime recurrenceEndTime) {
-        getInstance().recurrenceEndTime = recurrenceEndTime;
-        return this;
-      }
-
-      public Builder setRecurrenceLastExpansion(DateTime recurrenceLastExpansion) {
-        getInstance().recurrenceLastExpansion = recurrenceLastExpansion;
-        return this;
-      }
-
-      public Builder setRenewalPriceBehavior(RenewalPriceBehavior renewalPriceBehavior) {
-        getInstance().renewalPriceBehavior = renewalPriceBehavior;
-        return this;
-      }
-
-      public Builder setRenewalPrice(@Nullable Money renewalPrice) {
-        getInstance().renewalPrice = renewalPrice;
-        return this;
-      }
-
-      @Override
-      public Recurring build() {
-        Recurring instance = getInstance();
-        checkNotNull(instance.eventTime);
-        checkNotNull(instance.reason);
-        // Don't require recurrenceLastExpansion to be individually set on every new Recurrence.
-        // The correct default value if not otherwise set is the event time of the recurrence minus
-        // 1 year.
-        instance.recurrenceLastExpansion =
-            Optional.ofNullable(instance.recurrenceLastExpansion)
-                .orElse(instance.eventTime.minusYears(1));
-        checkArgument(
-            instance.renewalPriceBehavior == RenewalPriceBehavior.SPECIFIED
-                ^ instance.renewalPrice == null,
-            "Renewal price can have a value if and only if the renewal price behavior is"
-                + " SPECIFIED");
-        instance.recurrenceTimeOfYear = TimeOfYear.fromDateTime(instance.eventTime);
-        instance.recurrenceEndTime =
-            Optional.ofNullable(instance.recurrenceEndTime).orElse(END_OF_TIME);
-        return super.build();
-      }
-    }
-  }
-
-  /**
-   * An event representing a cancellation of one of the other two billable event types.
-   *
-   * <p>This is implemented as a separate event rather than a bit on BillingEvent in order to
-   * preserve the immutability of billing events.
-   */
-  @Entity(name = "BillingCancellation")
-  @Table(
-      indexes = {
-        @Index(columnList = "registrarId"),
-        @Index(columnList = "eventTime"),
-        @Index(columnList = "domainRepoId"),
-        @Index(columnList = "billingTime"),
-        @Index(columnList = "billing_event_id"),
-        @Index(columnList = "billing_recurrence_id")
-      })
-  @AttributeOverride(name = "id", column = @Column(name = "billing_cancellation_id"))
-  @WithVKey(Long.class)
-  public static class Cancellation extends BillingEvent {
-
-    /** The billing time of the charge that is being cancelled. */
-    DateTime billingTime;
-
-    /**
-     * The one-time billing event to cancel, or null for autorenew cancellations.
-     *
-     * <p>Although the type is {@link VKey} the name "ref" is preserved for historical reasons.
-     */
-    @Column(name = "billing_event_id")
-    VKey<OneTime> refOneTime;
-
-    /**
-     * The recurring billing event to cancel, or null for non-autorenew cancellations.
-     *
-     * <p>Although the type is {@link VKey} the name "ref" is preserved for historical reasons.
-     */
-    @Column(name = "billing_recurrence_id")
-    VKey<Recurring> refRecurring;
-
-    public DateTime getBillingTime() {
-      return billingTime;
-    }
-
-    public VKey<? extends BillingEvent> getEventKey() {
-      return firstNonNull(refOneTime, refRecurring);
-    }
-
-    /** The mapping from billable grace period types to originating billing event reasons. */
-    static final ImmutableMap<GracePeriodStatus, Reason> GRACE_PERIOD_TO_REASON =
-        ImmutableMap.of(
-            GracePeriodStatus.ADD, Reason.CREATE,
-            GracePeriodStatus.AUTO_RENEW, Reason.RENEW,
-            GracePeriodStatus.RENEW, Reason.RENEW,
-            GracePeriodStatus.TRANSFER, Reason.TRANSFER);
-
-    /**
-     * Creates a cancellation billing event (parented on the provided history key, and with the
-     * corresponding event time) that will cancel out the provided grace period's billing event,
-     * using the supplied targetId and deriving other metadata (clientId, billing time, and the
-     * cancellation reason) from the grace period.
-     */
-    public static Cancellation forGracePeriod(
-        GracePeriod gracePeriod,
-        DateTime eventTime,
-        HistoryEntryId domainHistoryId,
-        String targetId) {
-      checkArgument(
-          gracePeriod.hasBillingEvent(),
-          "Cannot create cancellation for grace period without billing event");
-      Builder builder =
-          new Builder()
-              .setReason(checkNotNull(GRACE_PERIOD_TO_REASON.get(gracePeriod.getType())))
-              .setTargetId(targetId)
-              .setRegistrarId(gracePeriod.getRegistrarId())
-              .setEventTime(eventTime)
-              // The charge being cancelled will take place at the grace period's expiration time.
-              .setBillingTime(gracePeriod.getExpirationTime())
-              .setDomainHistoryId(domainHistoryId);
-      // Set the grace period's billing event using the appropriate Cancellation builder method.
-      if (gracePeriod.getOneTimeBillingEvent() != null) {
-        builder.setOneTimeEventKey(gracePeriod.getOneTimeBillingEvent());
-      } else if (gracePeriod.getRecurringBillingEvent() != null) {
-        builder.setRecurringEventKey(gracePeriod.getRecurringBillingEvent());
-      }
-      return builder.build();
-    }
-
-    @Override
-    public VKey<Cancellation> createVKey() {
-      return createVKey(getId());
-    }
-
-    public static VKey<Cancellation> createVKey(long id) {
-      return VKey.create(Cancellation.class, id);
-    }
-
-    @Override
-    public Builder asBuilder() {
-      return new Builder(clone(this));
-    }
-
-    /** A builder for {@link Cancellation} since it is immutable. */
-    public static class Builder extends BillingEvent.Builder<Cancellation, Builder> {
-
-      public Builder() {}
-
-      private Builder(Cancellation instance) {
-        super(instance);
-      }
-
-      public Builder setBillingTime(DateTime billingTime) {
-        getInstance().billingTime = billingTime;
-        return this;
-      }
-
-      public Builder setOneTimeEventKey(VKey<OneTime> eventKey) {
-        getInstance().refOneTime = eventKey;
-        return this;
-      }
-
-      public Builder setRecurringEventKey(VKey<Recurring> eventKey) {
-        getInstance().refRecurring = eventKey;
-        return this;
-      }
-
-      @Override
-      public Cancellation build() {
-        Cancellation instance = getInstance();
-        checkNotNull(instance.billingTime, "Must set billing time");
-        checkNotNull(instance.reason, "Must set reason");
-        checkState(
-            (instance.refOneTime == null) != (instance.refRecurring == null),
-            "Cancellations must have exactly one billing event key set");
-        return super.build();
-      }
-    }
-  }
 }

core/src/main/java/google/registry/model/billing/BillingRecurrence.java

@@ -0,0 +1,199 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.billing;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.util.DateTimeUtils.END_OF_TIME;
+
+import google.registry.model.common.TimeOfYear;
+import google.registry.persistence.VKey;
+import google.registry.persistence.WithVKey;
+import google.registry.persistence.converter.JodaMoneyType;
+import java.util.Optional;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeOverride;
+import javax.persistence.AttributeOverrides;
+import javax.persistence.Column;
+import javax.persistence.Embedded;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Index;
+import javax.persistence.Table;
+import org.hibernate.annotations.Columns;
+import org.hibernate.annotations.Type;
+import org.joda.money.Money;
+import org.joda.time.DateTime;
+
+/**
+ * A recurring billable event.
+ *
+ * <p>Unlike {@link BillingEvent} events, these do not store an explicit cost, since the cost of the
+ * recurring event might change and each time we bill for it, we need to bill at the current cost,
+ * not the value that was in use at the time the recurrence was created.
+ */
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "registrarId"),
+      @Index(columnList = "eventTime"),
+      @Index(columnList = "domainRepoId"),
+      @Index(columnList = "recurrenceEndTime"),
+      @Index(columnList = "recurrenceLastExpansion"),
+      @Index(columnList = "recurrence_time_of_year")
+    })
+@AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
+@WithVKey(Long.class)
+public class BillingRecurrence extends BillingBase {
+
+  /**
+   * The billing event recurs every year between {@link #eventTime} and this time on the [month,
+   * day, time] specified in {@link #recurrenceTimeOfYear}.
+   */
+  DateTime recurrenceEndTime;
+
+  /**
+   * The most recent {@link DateTime} when this recurrence was expanded.
+   *
+   * <p>We only bother checking recurrences for potential expansion if this is at least one year in
+   * the past. If it's more recent than that, it means that the recurrence was already expanded too
+   * recently to need to be checked again (as domains autorenew each year).
+   */
+  @Column(nullable = false)
+  DateTime recurrenceLastExpansion;
+
+  /**
+   * The eventTime recurs every year on this [month, day, time] between {@link #eventTime} and
+   * {@link #recurrenceEndTime}, inclusive of the start but not of the end.
+   *
+   * <p>This field is denormalized from {@link #eventTime} to allow for an efficient index, but it
+   * always has the same data as that field.
+   *
+   * <p>Note that this is a recurrence of the event time, not the billing time. The billing time can
+   * be calculated by adding the relevant grace period length to this date. The reason for this
+   * requirement is that the event time recurs on a {@link org.joda.time.Period} schedule (same day
+   * of year, which can be 365 or 366 days later) which is what {@link TimeOfYear} can model,
+   * whereas the billing time is a fixed {@link org.joda.time.Duration} later.
+   */
+  @Embedded
+  @AttributeOverrides(
+      @AttributeOverride(name = "timeString", column = @Column(name = "recurrence_time_of_year")))
+  TimeOfYear recurrenceTimeOfYear;
+
+  /**
+   * The renewal price for domain renewal if and only if it's specified.
+   *
+   * <p>This price column remains null except when the renewal price behavior of the billing is
+   * SPECIFIED. This column is used for internal registrations.
+   */
+  @Nullable
+  @Type(type = JodaMoneyType.TYPE_NAME)
+  @Columns(columns = {@Column(name = "renewalPriceAmount"), @Column(name = "renewalPriceCurrency")})
+  Money renewalPrice;
+
+  @Enumerated(EnumType.STRING)
+  @Column(name = "renewalPriceBehavior", nullable = false)
+  RenewalPriceBehavior renewalPriceBehavior = RenewalPriceBehavior.DEFAULT;
+
+  public DateTime getRecurrenceEndTime() {
+    return recurrenceEndTime;
+  }
+
+  public DateTime getRecurrenceLastExpansion() {
+    return recurrenceLastExpansion;
+  }
+
+  public TimeOfYear getRecurrenceTimeOfYear() {
+    return recurrenceTimeOfYear;
+  }
+
+  public RenewalPriceBehavior getRenewalPriceBehavior() {
+    return renewalPriceBehavior;
+  }
+
+  public Optional<Money> getRenewalPrice() {
+    return Optional.ofNullable(renewalPrice);
+  }
+
+  @Override
+  public VKey<google.registry.model.billing.BillingRecurrence> createVKey() {
+    return createVKey(getId());
+  }
+
+  public static VKey<google.registry.model.billing.BillingRecurrence> createVKey(Long id) {
+    return VKey.create(google.registry.model.billing.BillingRecurrence.class, id);
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /**
+   * A builder for {@link google.registry.model.billing.BillingRecurrence} since it is immutable.
+   */
+  public static class Builder
+      extends BillingBase.Builder<google.registry.model.billing.BillingRecurrence, Builder> {
+
+    public Builder() {}
+
+    private Builder(google.registry.model.billing.BillingRecurrence instance) {
+      super(instance);
+    }
+
+    public Builder setRecurrenceEndTime(DateTime recurrenceEndTime) {
+      getInstance().recurrenceEndTime = recurrenceEndTime;
+      return this;
+    }
+
+    public Builder setRecurrenceLastExpansion(DateTime recurrenceLastExpansion) {
+      getInstance().recurrenceLastExpansion = recurrenceLastExpansion;
+      return this;
+    }
+
+    public Builder setRenewalPriceBehavior(RenewalPriceBehavior renewalPriceBehavior) {
+      getInstance().renewalPriceBehavior = renewalPriceBehavior;
+      return this;
+    }
+
+    public Builder setRenewalPrice(@Nullable Money renewalPrice) {
+      getInstance().renewalPrice = renewalPrice;
+      return this;
+    }
+
+    @Override
+    public google.registry.model.billing.BillingRecurrence build() {
+      google.registry.model.billing.BillingRecurrence instance = getInstance();
+      checkNotNull(instance.eventTime);
+      checkNotNull(instance.reason);
+      // Don't require recurrenceLastExpansion to be individually set on every new Recurrence.
+      // The correct default value if not otherwise set is the event time of the recurrence minus
+      // 1 year.
+      instance.recurrenceLastExpansion =
+          Optional.ofNullable(instance.recurrenceLastExpansion)
+              .orElse(instance.eventTime.minusYears(1));
+      checkArgument(
+          instance.renewalPriceBehavior == RenewalPriceBehavior.SPECIFIED
+              ^ instance.renewalPrice == null,
+          "Renewal price can have a value if and only if the renewal price behavior is"
+              + " SPECIFIED");
+      instance.recurrenceTimeOfYear = TimeOfYear.fromDateTime(instance.eventTime);
+      instance.recurrenceEndTime =
+          Optional.ofNullable(instance.recurrenceEndTime).orElse(END_OF_TIME);
+      return super.build();
+    }
+  }
+}

core/src/main/java/google/registry/model/common/Cursor.java

@@ -22,7 +22,7 @@ import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import google.registry.model.UpdateAutoTimestampEntity;
 import google.registry.model.common.Cursor.CursorId;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.persistence.VKey;
 import java.util.Optional;
 import javax.persistence.AttributeOverride;
@@ -134,7 +134,7 @@ public class Cursor extends UpdateAutoTimestampEntity {
     return createVKey(type, GLOBAL);
   }
 
-  public static VKey<Cursor> createScopedVKey(CursorType type, Registry tld) {
+  public static VKey<Cursor> createScopedVKey(CursorType type, Tld tld) {
     return createVKey(type, tld.getTldStr());
   }
 
@@ -172,8 +172,8 @@ public class Cursor extends UpdateAutoTimestampEntity {
     return create(cursorType, cursorTime, GLOBAL);
   }
 
-  /** Creates a new cursor instance with a given {@link Registry} scope. */
-  public static Cursor createScoped(CursorType cursorType, DateTime cursorTime, Registry scope) {
+  /** Creates a new cursor instance with a given {@link Tld} scope. */
+  public static Cursor createScoped(CursorType cursorType, DateTime cursorTime, Tld scope) {
     checkNotNull(scope, "Cursor scope cannot be null");
     return create(cursorType, cursorTime, scope.getTldStr());
   }

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -44,7 +44,7 @@ import com.google.gson.annotations.Expose;
 import google.registry.flows.ResourceFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.launch.LaunchNotice;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -56,7 +56,7 @@ import google.registry.model.host.Host;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.poll.PollMessage.Autorenew;
 import google.registry.model.poll.PollMessage.OneTime;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
@@ -200,7 +200,7 @@ public class DomainBase extends EppResource
    * should be created, and this field should be updated to point to the new one.
    */
   @Column(name = "billing_recurrence_id")
-  VKey<Recurring> autorenewBillingEvent;
+  VKey<BillingRecurrence> autorenewBillingEvent;
 
   /**
    * The recurring poll message associated with this domain's autorenewals.
@@ -286,7 +286,7 @@ public class DomainBase extends EppResource
     return deletePollMessage;
   }
 
-  public VKey<Recurring> getAutorenewBillingEvent() {
+  public VKey<BillingRecurrence> getAutorenewBillingEvent() {
     return autorenewBillingEvent;
   }
 
@@ -488,7 +488,7 @@ public class DomainBase extends EppResource
                     GracePeriodStatus.TRANSFER,
                     domain.getRepoId(),
                     transferExpirationTime.plus(
-                        Registry.get(domain.getTld()).getTransferGracePeriodLength()),
+                        Tld.get(domain.getTld()).getTransferGracePeriodLength()),
                     transferData.getGainingRegistrarId(),
                     transferData.getServerApproveBillingEvent())));
       } else {
@@ -520,11 +520,10 @@ public class DomainBase extends EppResource
       builder
           .setRegistrationExpirationTime(newExpirationTime)
           .addGracePeriod(
-              GracePeriod.createForRecurring(
+              GracePeriod.createForRecurrence(
                   GracePeriodStatus.AUTO_RENEW,
                   domain.getRepoId(),
-                  lastAutorenewTime.plus(
-                      Registry.get(domain.getTld()).getAutoRenewGracePeriodLength()),
+                  lastAutorenewTime.plus(Tld.get(domain.getTld()).getAutoRenewGracePeriodLength()),
                   domain.getCurrentSponsorRegistrarId(),
                   domain.getAutorenewBillingEvent()));
       newLastEppUpdateTime = Optional.of(lastAutorenewTime);
@@ -848,7 +847,7 @@ public class DomainBase extends EppResource
       return thisCastToDerived();
     }
 
-    public B setAutorenewBillingEvent(VKey<Recurring> autorenewBillingEvent) {
+    public B setAutorenewBillingEvent(VKey<BillingRecurrence> autorenewBillingEvent) {
       getInstance().autorenewBillingEvent = autorenewBillingEvent;
       return thisCastToDerived();
     }

core/src/main/java/google/registry/model/domain/GracePeriod.java

@@ -20,7 +20,7 @@ import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.annotations.VisibleForTesting;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.persistence.VKey;
@@ -60,23 +60,23 @@ public class GracePeriod extends GracePeriodBase {
       String domainRepoId,
       DateTime expirationTime,
       String registrarId,
-      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
-      @Nullable VKey<BillingEvent.Recurring> billingEventRecurring,
+      @Nullable VKey<BillingEvent> billingEvent,
+      @Nullable VKey<BillingRecurrence> billingRecurrence,
       @Nullable Long gracePeriodId) {
     checkArgument(
-        billingEventOneTime == null || billingEventRecurring == null,
+        billingEvent == null || billingRecurrence == null,
         "A grace period can have at most one billing event");
     checkArgument(
-        (billingEventRecurring != null) == GracePeriodStatus.AUTO_RENEW.equals(type),
-        "Recurring billing events must be present on (and only on) autorenew grace periods");
+        (billingRecurrence != null) == GracePeriodStatus.AUTO_RENEW.equals(type),
+        "BillingRecurrences must be present on (and only on) autorenew grace periods");
     GracePeriod instance = new GracePeriod();
     instance.gracePeriodId = gracePeriodId == null ? allocateId() : gracePeriodId;
     instance.type = checkArgumentNotNull(type);
     instance.domainRepoId = checkArgumentNotNull(domainRepoId);
     instance.expirationTime = checkArgumentNotNull(expirationTime);
     instance.clientId = checkArgumentNotNull(registrarId);
-    instance.billingEventOneTime = billingEventOneTime;
-    instance.billingEventRecurring = billingEventRecurring;
+    instance.billingEvent = billingEvent;
+    instance.billingRecurrence = billingRecurrence;
     return instance;
   }
 
@@ -92,7 +92,7 @@ public class GracePeriod extends GracePeriodBase {
       String domainRepoId,
       DateTime expirationTime,
       String registrarId,
-      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime) {
+      @Nullable VKey<BillingEvent> billingEventOneTime) {
     return createInternal(
         type, domainRepoId, expirationTime, registrarId, billingEventOneTime, null, null);
   }
@@ -111,7 +111,7 @@ public class GracePeriod extends GracePeriodBase {
       String domainRepoId,
       DateTime expirationTime,
       String registrarId,
-      @Nullable VKey<BillingEvent.OneTime> billingEventOneTime,
+      @Nullable VKey<BillingEvent> billingEventOneTime,
       @Nullable Long gracePeriodId) {
     return createInternal(
         type, domainRepoId, expirationTime, registrarId, billingEventOneTime, null, gracePeriodId);
@@ -123,40 +123,40 @@ public class GracePeriod extends GracePeriodBase {
         history.domainRepoId,
         history.expirationTime,
         history.clientId,
-        history.billingEventOneTime,
-        history.billingEventRecurring,
+        history.billingEvent,
+        history.billingRecurrence,
         history.gracePeriodId);
   }
 
-  /** Creates a GracePeriod for a Recurring billing event. */
-  public static GracePeriod createForRecurring(
+  /** Creates a GracePeriod for a Recurrence billing event. */
+  public static GracePeriod createForRecurrence(
       GracePeriodStatus type,
       String domainRepoId,
       DateTime expirationTime,
       String registrarId,
-      VKey<Recurring> billingEventRecurring) {
-    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
+      VKey<BillingRecurrence> billingEventRecurrence) {
+    checkArgumentNotNull(billingEventRecurrence, "billingEventRecurrence cannot be null");
     return createInternal(
-        type, domainRepoId, expirationTime, registrarId, null, billingEventRecurring, null);
+        type, domainRepoId, expirationTime, registrarId, null, billingEventRecurrence, null);
   }
 
-  /** Creates a GracePeriod for a Recurring billing event and a given {@link #gracePeriodId}. */
+  /** Creates a GracePeriod for a Recurrence billing event and a given {@link #gracePeriodId}. */
   @VisibleForTesting
-  public static GracePeriod createForRecurring(
+  public static GracePeriod createForRecurrence(
       GracePeriodStatus type,
       String domainRepoId,
       DateTime expirationTime,
       String registrarId,
-      VKey<Recurring> billingEventRecurring,
+      VKey<BillingRecurrence> billingEventRecurrence,
       @Nullable Long gracePeriodId) {
-    checkArgumentNotNull(billingEventRecurring, "billingEventRecurring cannot be null");
+    checkArgumentNotNull(billingEventRecurrence, "billingEventRecurrence cannot be null");
     return createInternal(
         type,
         domainRepoId,
         expirationTime,
         registrarId,
         null,
-        billingEventRecurring,
+        billingEventRecurrence,
         gracePeriodId);
   }
 
@@ -168,7 +168,7 @@ public class GracePeriod extends GracePeriodBase {
 
   /** Constructs a GracePeriod of the given type from the provided one-time BillingEvent. */
   public static GracePeriod forBillingEvent(
-      GracePeriodStatus type, String domainRepoId, BillingEvent.OneTime billingEvent) {
+      GracePeriodStatus type, String domainRepoId, BillingEvent billingEvent) {
     return create(
         type,
         domainRepoId,
@@ -205,8 +205,8 @@ public class GracePeriod extends GracePeriodBase {
       instance.domainRepoId = gracePeriod.domainRepoId;
       instance.expirationTime = gracePeriod.expirationTime;
       instance.clientId = gracePeriod.clientId;
-      instance.billingEventOneTime = gracePeriod.billingEventOneTime;
-      instance.billingEventRecurring = gracePeriod.billingEventRecurring;
+      instance.billingEvent = gracePeriod.billingEvent;
+      instance.billingRecurrence = gracePeriod.billingRecurrence;
       return instance;
     }
   }

core/src/main/java/google/registry/model/domain/GracePeriodBase.java

@@ -17,6 +17,7 @@ package google.registry.model.domain;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.persistence.VKey;
 import javax.persistence.Access;
@@ -56,21 +57,21 @@ public class GracePeriodBase extends ImmutableObject implements UnsafeSerializab
   /**
    * The one-time billing event corresponding to the action that triggered this grace period, or
    * null if not applicable. Not set for autorenew grace periods (which instead use the field {@code
-   * billingEventRecurring}) or for redemption grace periods (since deletes have no cost).
+   * billingEventRecurrence}) or for redemption grace periods (since deletes have no cost).
    */
   // NB: Would @IgnoreSave(IfNull.class), but not allowed for @Embed collections.
   @Access(AccessType.FIELD)
   @Column(name = "billing_event_id")
-  VKey<BillingEvent.OneTime> billingEventOneTime = null;
+  VKey<BillingEvent> billingEvent = null;
 
   /**
-   * The recurring billing event corresponding to the action that triggered this grace period, if
-   * applicable - i.e. if the action was an autorenew - or null in all other cases.
+   * The Recurrence corresponding to the action that triggered this grace period, if applicable -
+   * i.e. if the action was an autorenew - or null in all other cases.
    */
   // NB: Would @IgnoreSave(IfNull.class), but not allowed for @Embed collections.
   @Access(AccessType.FIELD)
   @Column(name = "billing_recurrence_id")
-  VKey<BillingEvent.Recurring> billingEventRecurring = null;
+  VKey<BillingRecurrence> billingRecurrence = null;
 
   public long getGracePeriodId() {
     return gracePeriodId;
@@ -100,22 +101,22 @@ public class GracePeriodBase extends ImmutableObject implements UnsafeSerializab
 
   /** Returns true if this GracePeriod has an associated BillingEvent; i.e. if it's refundable. */
   public boolean hasBillingEvent() {
-    return billingEventOneTime != null || billingEventRecurring != null;
+    return billingEvent != null || billingRecurrence != null;
   }
 
   /**
    * Returns the one time billing event. The value will only be non-null if the type of this grace
    * period is not AUTO_RENEW.
    */
-  public VKey<BillingEvent.OneTime> getOneTimeBillingEvent() {
-    return billingEventOneTime;
+  public VKey<BillingEvent> getBillingEvent() {
+    return billingEvent;
   }
 
   /**
-   * Returns the recurring billing event. The value will only be non-null if the type of this grace
-   * period is AUTO_RENEW.
+   * Returns the Recurrence. The value will only be non-null if the type of this grace period is
+   * AUTO_RENEW.
    */
-  public VKey<BillingEvent.Recurring> getRecurringBillingEvent() {
-    return billingEventRecurring;
+  public VKey<BillingRecurrence> getBillingRecurrence() {
+    return billingRecurrence;
   }
 }

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -43,7 +43,7 @@ import google.registry.model.Buildable;
 import google.registry.model.CacheUtils;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.UpdateAutoTimestampEntity;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;

core/src/main/java/google/registry/model/pricing/StaticPremiumListPricingEngine.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 
 import com.google.common.net.InternetDomainName;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumListDao;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -35,14 +35,14 @@ public final class StaticPremiumListPricingEngine implements PremiumPricingEngin
 
   @Override
   public DomainPrices getDomainPrices(String domainName, DateTime priceTime) {
-    String tld = getTldFromDomainName(domainName);
+    String tldStr = getTldFromDomainName(domainName);
     String label = InternetDomainName.from(domainName).parts().get(0);
-    Registry registry = Registry.get(checkNotNull(tld, "tld"));
+    Tld tld = Tld.get(checkNotNull(tldStr, "tld"));
     Optional<Money> premiumPrice =
-        registry.getPremiumListName().flatMap(pl -> PremiumListDao.getPremiumPrice(pl, label));
+        tld.getPremiumListName().flatMap(pl -> PremiumListDao.getPremiumPrice(pl, label));
     return DomainPrices.create(
         premiumPrice.isPresent(),
-        premiumPrice.orElse(registry.getStandardCreateCost()),
-        premiumPrice.orElse(registry.getStandardRenewCost(priceTime)));
+        premiumPrice.orElse(tld.getStandardCreateCost()),
+        premiumPrice.orElse(tld.getStandardRenewCost(priceTime)));
   }
 }

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -57,8 +57,8 @@ import google.registry.model.JsonMapBuilder;
 import google.registry.model.Jsonifiable;
 import google.registry.model.UpdateAutoTimestamp;
 import google.registry.model.UpdateAutoTimestampEntity;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.persistence.VKey;
 import google.registry.util.CidrAddressBlock;
 import java.security.cert.CertificateParsingException;
@@ -723,11 +723,11 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
      * to set the allowed TLDs.
      */
     public Builder setAllowedTldsUncached(Set<String> allowedTlds) {
-      ImmutableSet<VKey<Registry>> newTldKeys =
+      ImmutableSet<VKey<Tld>> newTldKeys =
           Sets.difference(allowedTlds, getInstance().getAllowedTlds()).stream()
-              .map(Registry::createVKey)
+              .map(Tld::createVKey)
               .collect(toImmutableSet());
-      Set<VKey<Registry>> missingTldKeys =
+      Set<VKey<Tld>> missingTldKeys =
           Sets.difference(
               newTldKeys, tm().transact(() -> tm().loadByKeysIfPresent(newTldKeys)).keySet());
       checkArgument(missingTldKeys.isEmpty(), "Trying to set nonexistent TLDs: %s", missingTldKeys);
@@ -903,10 +903,10 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
       // In order to grant access to real TLDs, the registrar must have a corresponding billing
       // account ID for that TLD's billing currency.
       ImmutableSet<String> nonBillableTlds =
-          Registry.get(getInstance().getAllowedTlds()).stream()
+          Tld.get(getInstance().getAllowedTlds()).stream()
               .filter(r -> r.getTldType() == TldType.REAL)
               .filter(r -> !getInstance().getBillingAccountMap().containsKey(r.getCurrency()))
-              .map(Registry::getTldStr)
+              .map(Tld::getTldStr)
               .collect(toImmutableSet());
       checkArgument(
           nonBillableTlds.isEmpty(),

core/src/main/java/google/registry/model/reporting/HistoryEntry.java

@@ -17,6 +17,7 @@ package google.registry.model.reporting;
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
+import google.registry.batch.ExpandBillingRecurrencesAction;
 import google.registry.model.Buildable;
 import google.registry.model.EppResource;
 import google.registry.model.ImmutableObject;
@@ -81,7 +82,7 @@ public abstract class HistoryEntry extends ImmutableObject
     DOMAIN_ALLOCATE,
     /**
      * Used for domain registration autorenews explicitly logged by {@link
-     * google.registry.batch.ExpandRecurringBillingEventsAction}.
+     * ExpandBillingRecurrencesAction}.
      */
     DOMAIN_AUTORENEW,
     DOMAIN_CREATE,

core/src/main/java/google/registry/model/tld/Registries.java

@@ -32,14 +32,14 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Maps;
 import com.google.common.collect.Streams;
 import com.google.common.net.InternetDomainName;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.util.DomainNameUtils;
 import java.util.Optional;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 import javax.persistence.EntityManager;
 
-/** Utilities for finding and listing {@link Registry} entities. */
+/** Utilities for finding and listing {@link Tld} entities. */
 public final class Registries {
 
   private Registries() {}
@@ -85,8 +85,8 @@ public final class Registries {
   }
 
   /** Returns the Registry entities themselves of the given type loaded fresh from the database. */
-  public static ImmutableSet<Registry> getTldEntitiesOfType(TldType type) {
-    return Registry.get(filterValues(cache.get(), equalTo(type)).keySet());
+  public static ImmutableSet<Tld> getTldEntitiesOfType(TldType type) {
+    return Tld.get(filterValues(cache.get(), equalTo(type)).keySet());
   }
 
   /** Pass-through check that the specified TLD exists, otherwise throw an IAE. */

core/src/main/java/google/registry/model/tld/Tld.java

@@ -76,12 +76,12 @@ import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
 /** Persisted per-TLD configuration data. */
-@Entity(name = "Tld")
-public class Registry extends ImmutableObject implements Buildable, UnsafeSerializable {
+@Entity
+public class Tld extends ImmutableObject implements Buildable, UnsafeSerializable {
 
   /**
-   * The canonical string representation of the TLD associated with this {@link Registry}, which is
-   * the standard ASCII for regular TLDs and punycoded ASCII for IDN TLDs.
+   * The canonical string representation of the TLD associated with this {@link Tld}, which is the
+   * standard ASCII for regular TLDs and punycoded ASCII for IDN TLDs.
    */
   @Id
   @Column(name = "tld_name", nullable = false)
@@ -132,7 +132,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    */
   public enum TldState {
 
-    /** The state of not yet being delegated to this registry in the root zone by IANA. */
+    /** The state of not yet being delegated to this TLD in the root zone by IANA. */
     PREDELEGATION,
 
     /**
@@ -158,19 +158,19 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     PDT
   }
 
-  /** Returns the registry for a given TLD, throwing if none exists. */
-  public static Registry get(String tld) {
-    Registry maybeRegistry = CACHE.get(tld);
-    if (maybeRegistry == null) {
-      throw new RegistryNotFoundException(tld);
+  /** Returns the TLD for a given TLD, throwing if none exists. */
+  public static Tld get(String tld) {
+    Tld maybeTld = CACHE.get(tld);
+    if (maybeTld == null) {
+      throw new TldNotFoundException(tld);
     } else {
-      return maybeRegistry;
+      return maybeTld;
     }
   }
 
-  /** Returns the registry entities for the given TLD strings, throwing if any don't exist. */
-  public static ImmutableSet<Registry> get(Set<String> tlds) {
-    Map<String, Registry> registries = CACHE.getAll(tlds);
+  /** Returns the TLD entities for the given TLD strings, throwing if any don't exist. */
+  public static ImmutableSet<Tld> get(Set<String> tlds) {
+    Map<String, Tld> registries = CACHE.getAll(tlds);
     ImmutableSet<String> missingRegistries =
         registries.entrySet().stream()
             .filter(e -> e.getValue() == null)
@@ -179,48 +179,48 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     if (missingRegistries.isEmpty()) {
       return registries.values().stream().collect(toImmutableSet());
     } else {
-      throw new RegistryNotFoundException(missingRegistries);
+      throw new TldNotFoundException(missingRegistries);
     }
   }
 
   /**
    * Invalidates the cache entry.
    *
-   * <p>This is called automatically when the registry is saved. One should also call it when a
-   * registry is deleted.
+   * <p>This is called automatically when the tld is saved. One should also call it when a tld is
+   * deleted.
    */
   @PostPersist
   public void invalidateInCache() {
     CACHE.invalidate(tldStr);
   }
 
-  /** A cache that loads the {@link Registry} for a given tld. */
-  private static final LoadingCache<String, Registry> CACHE =
+  /** A cache that loads the {@link Tld} for a given tld. */
+  private static final LoadingCache<String, Tld> CACHE =
       CacheUtils.newCacheBuilder(getSingletonCacheRefreshDuration())
           .build(
-              new CacheLoader<String, Registry>() {
+              new CacheLoader<String, Tld>() {
                 @Override
-                public Registry load(final String tld) {
+                public Tld load(final String tld) {
                   return tm().transact(() -> tm().loadByKeyIfPresent(createVKey(tld))).orElse(null);
                 }
 
                 @Override
-                public Map<String, Registry> loadAll(Iterable<? extends String> tlds) {
-                  ImmutableMap<String, VKey<Registry>> keysMap =
-                      toMap(ImmutableSet.copyOf(tlds), Registry::createVKey);
-                  Map<VKey<? extends Registry>, Registry> entities =
+                public Map<String, Tld> loadAll(Iterable<? extends String> tlds) {
+                  ImmutableMap<String, VKey<Tld>> keysMap =
+                      toMap(ImmutableSet.copyOf(tlds), Tld::createVKey);
+                  Map<VKey<? extends Tld>, Tld> entities =
                       tm().transact(() -> tm().loadByKeysIfPresent(keysMap.values()));
                   return Maps.transformEntries(keysMap, (k, v) -> entities.getOrDefault(v, null));
                 }
               });
 
-  public static VKey<Registry> createVKey(String tld) {
-    return VKey.create(Registry.class, tld);
+  public static VKey<Tld> createVKey(String tld) {
+    return VKey.create(Tld.class, tld);
   }
 
   @Override
-  public VKey<Registry> createVKey() {
-    return VKey.create(Registry.class, tldStr);
+  public VKey<Tld> createVKey() {
+    return VKey.create(Tld.class, tldStr);
   }
 
   /**
@@ -248,7 +248,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
   /**
    * The number of locks we allow at once for {@link google.registry.dns.PublishDnsUpdatesAction}.
    *
-   * <p>This should always be a positive integer -- use 1 for TLD-wide locks. All {@link Registry}
+   * <p>This should always be a positive integer -- use 1 for TLD-wide locks. All {@link Tld}
    * objects have this value default to 1.
    *
    * <p>WARNING: changing this parameter changes the lock name for subsequent DNS updates, and thus
@@ -259,7 +259,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    * <ol>
    *   <li>Pause the DNS queue via {@link google.registry.tools.UpdateTldCommand}
    *   <li>Change this number
-   *   <li>Let the Registry caches expire (currently 5 minutes) and drain the DNS publish queue
+   *   <li>Let the Tld caches expire (currently 5 minutes) and drain the DNS publish queue
    *   <li>Unpause the DNS queue
    * </ol>
    *
@@ -297,7 +297,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    */
   Duration dnsDsTtl;
   /**
-   * The unicode-aware representation of the TLD associated with this {@link Registry}.
+   * The unicode-aware representation of the TLD associated with this {@link Tld}.
    *
    * <p>This will be equal to {@link #tldStr} for ASCII TLDs, but will be non-ASCII for IDN TLDs. We
    * store this in a field so that it will be retained upon import into BigQuery.
@@ -335,7 +335,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
   @Column(nullable = false)
   CreateAutoTimestamp creationTime = CreateAutoTimestamp.create(null);
 
-  /** The set of reserved list names that are applicable to this registry. */
+  /** The set of reserved list names that are applicable to this tld. */
   @Column(name = "reserved_list_names")
   Set<String> reservedListNames;
 
@@ -344,8 +344,8 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    *
    * <p>This set contains only the names of the list and not a reference to the lists. Updates to a
    * reserved list in Cloud SQL are saved as a new ReservedList entity. When using the ReservedList
-   * for a registry, the database should be queried for the entity with this name that has the
-   * largest revision ID.
+   * for a tld, the database should be queried for the entity with this name that has the largest
+   * revision ID.
    */
   public ImmutableSet<String> getReservedListNames() {
     return nullToEmptyImmutableCopy(reservedListNames);
@@ -355,9 +355,8 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
    * The name of the {@link PremiumList} for this TLD, if there is one.
    *
    * <p>This is only the name of the list and not a reference to the list. Updates to the premium
-   * list in Cloud SQL are saved as a new PremiumList entity. When using the PremiumList for a
-   * registry, the database should be queried for the entity with this name that has the largest
-   * revision ID.
+   * list in Cloud SQL are saved as a new PremiumList entity. When using the PremiumList for a tld,
+   * the database should be queried for the entity with this name that has the largest revision ID.
    */
   @Column(name = "premium_list_name")
   String premiumListName;
@@ -591,8 +590,8 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
   }
 
   /**
-   * Returns the add-on cost of a domain restore (the flat registry-wide fee charged in addition to
-   * one year of renewal for that name).
+   * Returns the add-on cost of a domain restore (the flat tld-wide fee charged in addition to one
+   * year of renewal for that name).
    */
   public Money getStandardRestoreCost() {
     return restoreBillingCost;
@@ -625,7 +624,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     return renewBillingCostTransitions.toValueMap();
   }
 
-  /** Returns the EAP fee for the registry at the given time. */
+  /** Returns the EAP fee for the tld at the given time. */
   public Fee getEapFeeFor(DateTime now) {
     ImmutableSortedMap<DateTime, Money> valueMap = getEapFeeScheduleAsMap();
     DateTime periodStart = valueMap.floorKey(now);
@@ -672,18 +671,18 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
   }
 
   /** Returns the time to live for A and AAAA records. */
-  public Duration getDnsAPlusAaaaTtl() {
-    return dnsAPlusAaaaTtl;
+  public Optional<Duration> getDnsAPlusAaaaTtl() {
+    return Optional.ofNullable(dnsAPlusAaaaTtl);
   }
 
   /** Returns the time to live for NS records. */
-  public Duration getDnsNsTtl() {
-    return dnsNsTtl;
+  public Optional<Duration> getDnsNsTtl() {
+    return Optional.ofNullable(dnsNsTtl);
   }
 
   /** Returns the time to live for DS records. */
-  public Duration getDnsDsTtl() {
-    return dnsDsTtl;
+  public Optional<Duration> getDnsDsTtl() {
+    return Optional.ofNullable(dnsDsTtl);
   }
 
   public ImmutableSet<String> getAllowedRegistrantContactIds() {
@@ -707,11 +706,11 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     return new Builder(clone(this));
   }
 
-  /** A builder for constructing {@link Registry} objects, since they are immutable. */
-  public static class Builder extends Buildable.Builder<Registry> {
+  /** A builder for constructing {@link Tld} objects, since they are immutable. */
+  public static class Builder extends Buildable.Builder<Tld> {
     public Builder() {}
 
-    private Builder(Registry instance) {
+    private Builder(Tld instance) {
       super(instance);
     }
 
@@ -1006,8 +1005,8 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     }
 
     @Override
-    public Registry build() {
-      final Registry instance = getInstance();
+    public Tld build() {
+      final Tld instance = getInstance();
       // Pick up the name of the associated TLD from the instance object.
       String tldName = instance.tldStr;
       checkArgument(tldName != null, "No registry TLD specified");
@@ -1019,7 +1018,7 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
       // Check the validity of all TimedTransitionProperties to ensure that they have values for
       // START_OF_TIME.  The setters above have already checked this for new values, but also check
       // here to catch cases where we loaded an invalid TimedTransitionProperty from the database
-      // and cloned it into a new builder, to block re-building a Registry in an invalid state.
+      // and cloned it into a new builder, to block re-building a Tld in an invalid state.
       instance.tldStateTransitions.checkValidity();
       instance.renewBillingCostTransitions.checkValidity();
       instance.eapFeeSchedule.checkValidity();
@@ -1027,24 +1026,24 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
       checkArgumentNotNull(instance.getCurrency(), "Currency must be set");
       checkArgument(
           instance.getStandardCreateCost().getCurrencyUnit().equals(instance.currency),
-          "Create cost must be in the registry's currency");
+          "Create cost must be in the tld's currency");
       checkArgument(
           instance.getStandardRestoreCost().getCurrencyUnit().equals(instance.currency),
-          "Restore cost must be in the registry's currency");
+          "Restore cost must be in the TLD's currency");
       checkArgument(
           instance.getServerStatusChangeCost().getCurrencyUnit().equals(instance.currency),
-          "Server status change cost must be in the registry's currency");
+          "Server status change cost must be in the TLD's currency");
       checkArgument(
           instance.getRegistryLockOrUnlockBillingCost().getCurrencyUnit().equals(instance.currency),
-          "Registry lock/unlock cost must be in the registry's currency");
+          "Registry lock/unlock cost must be in the TLD's currency");
       Predicate<Money> currencyCheck =
           (Money money) -> money.getCurrencyUnit().equals(instance.currency);
       checkArgument(
           instance.getRenewBillingCostTransitions().values().stream().allMatch(currencyCheck),
-          "Renew cost must be in the registry's currency");
+          "Renew cost must be in the TLD's currency");
       checkArgument(
           instance.eapFeeSchedule.toValueMap().values().stream().allMatch(currencyCheck),
-          "All EAP fees must be in the registry's currency");
+          "All EAP fees must be in the TLD's currency");
       checkArgumentNotNull(
           instance.pricingEngineClassName, "All registries must have a configured pricing engine");
       checkArgument(
@@ -1062,14 +1061,14 @@ public class Registry extends ImmutableObject implements Buildable, UnsafeSerial
     }
   }
 
-  /** Exception to throw when no Registry entity is found for given TLD string(s). */
-  public static class RegistryNotFoundException extends RuntimeException {
+  /** Exception to throw when no Tld entity is found for given TLD string(s). */
+  public static class TldNotFoundException extends RuntimeException {
 
-    RegistryNotFoundException(ImmutableSet<String> tlds) {
-      super("No registry object(s) found for " + Joiner.on(", ").join(tlds));
+    TldNotFoundException(ImmutableSet<String> tlds) {
+      super("No TLD object(s) found for " + Joiner.on(", ").join(tlds));
     }
 
-    RegistryNotFoundException(String tld) {
+    TldNotFoundException(String tld) {
       this(ImmutableSet.of(tld));
     }
   }

core/src/main/java/google/registry/model/tld/label/BaseDomainLabelList.java

@@ -27,7 +27,7 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Multiset;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -138,11 +138,11 @@ public abstract class BaseDomainLabelList<T extends Comparable<?>, R extends Dom
   /** Gets the names of the tlds that reference this list. */
   public final ImmutableSet<String> getReferencingTlds() {
     return getTlds().stream()
-        .filter((tld) -> refersToList(Registry.get(tld), name))
+        .filter((tld) -> refersToList(Tld.get(tld), name))
         .collect(toImmutableSet());
   }
 
-  protected abstract boolean refersToList(Registry registry, String name);
+  protected abstract boolean refersToList(Tld tld, String name);
 
   /** Base builder for derived classes of {@link BaseDomainLabelList}. */
   public abstract static class Builder<T extends BaseDomainLabelList<?, ?>, B extends Builder<T, ?>>

core/src/main/java/google/registry/model/tld/label/PremiumList.java

@@ -23,7 +23,7 @@ import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.hash.BloomFilter;
 import google.registry.model.Buildable;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import java.io.Serializable;
 import java.math.BigDecimal;
@@ -200,8 +200,8 @@ public final class PremiumList extends BaseDomainLabelList<BigDecimal, PremiumEn
   }
 
   @Override
-  public boolean refersToList(Registry registry, String name) {
-    return Objects.equals(registry.getPremiumListName().orElse(null), name);
+  public boolean refersToList(Tld tld, String name) {
+    return Objects.equals(tld.getPremiumListName().orElse(null), name);
   }
 
   @Override

core/src/main/java/google/registry/model/tld/label/ReservedList.java

@@ -33,7 +33,7 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.util.concurrent.UncheckedExecutionException;
 import google.registry.model.Buildable;
 import google.registry.model.CacheUtils;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.DomainLabelMetrics.MetricsReservedListMatch;
 import java.io.Serializable;
 import java.util.List;
@@ -173,8 +173,8 @@ public final class ReservedList
   }
 
   @Override
-  protected boolean refersToList(Registry registry, String name) {
-    return registry.getReservedListNames().contains(name);
+  protected boolean refersToList(Tld tld, String name) {
+    return tld.getReservedListNames().contains(name);
   }
 
   /** Determines whether the ReservedList is in use on any Registry */
@@ -243,15 +243,16 @@ public final class ReservedList
    * Helper function to retrieve the entries associated with this label and TLD, or an empty set if
    * no such entry exists.
    */
-  private static ImmutableSet<ReservedListEntry> getReservedListEntries(String label, String tld) {
+  private static ImmutableSet<ReservedListEntry> getReservedListEntries(
+      String label, String tldStr) {
     DateTime startTime = DateTime.now(UTC);
-    Registry registry = Registry.get(checkNotNull(tld, "tld must not be null"));
+    Tld tld = Tld.get(checkNotNull(tldStr, "tld must not be null"));
     ImmutableSet.Builder<ReservedListEntry> entriesBuilder = new ImmutableSet.Builder<>();
     ImmutableSet.Builder<MetricsReservedListMatch> metricMatchesBuilder =
         new ImmutableSet.Builder<>();
 
     // Loop through all reservation lists and add each of them.
-    for (ReservedList rl : loadReservedLists(registry.getReservedListNames())) {
+    for (ReservedList rl : loadReservedLists(tld.getReservedListNames())) {
       if (rl.getReservedListEntries().containsKey(label)) {
         ReservedListEntry entry = rl.getReservedListEntries().get(label);
         entriesBuilder.add(entry);
@@ -261,7 +262,9 @@ public final class ReservedList
     }
     ImmutableSet<ReservedListEntry> entries = entriesBuilder.build();
     DomainLabelMetrics.recordReservedListCheckOutcome(
-        tld, metricMatchesBuilder.build(), DateTime.now(UTC).getMillis() - startTime.getMillis());
+        tldStr,
+        metricMatchesBuilder.build(),
+        DateTime.now(UTC).getMillis() - startTime.getMillis());
     return entries;
   }
 

core/src/main/java/google/registry/model/transfer/DomainTransferData.java

@@ -17,7 +17,9 @@ package google.registry.model.transfer;
 import static google.registry.util.CollectionUtils.isNullOrEmpty;
 
 import com.google.common.collect.ImmutableSet;
+import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.Period;
 import google.registry.model.domain.Period.Unit;
 import google.registry.model.poll.PollMessage;
@@ -69,7 +71,7 @@ public class DomainTransferData extends TransferData {
   DateTime transferredRegistrationExpirationTime;
 
   @Column(name = "transfer_billing_cancellation_id")
-  public VKey<BillingEvent.Cancellation> billingCancellationId;
+  public VKey<BillingCancellation> billingCancellationId;
 
   /**
    * The regular one-time billing event that will be charged for a server-approved transfer.
@@ -78,7 +80,7 @@ public class DomainTransferData extends TransferData {
    * being transferred is not a domain.
    */
   @Column(name = "transfer_billing_event_id")
-  VKey<BillingEvent.OneTime> serverApproveBillingEvent;
+  VKey<BillingEvent> serverApproveBillingEvent;
 
   /**
    * The autorenew billing event that should be associated with this resource after the transfer.
@@ -87,7 +89,7 @@ public class DomainTransferData extends TransferData {
    * being transferred is not a domain.
    */
   @Column(name = "transfer_billing_recurrence_id")
-  VKey<BillingEvent.Recurring> serverApproveAutorenewEvent;
+  VKey<BillingRecurrence> serverApproveAutorenewEvent;
 
   /**
    * The autorenew poll message that should be associated with this resource after the transfer.
@@ -120,12 +122,12 @@ public class DomainTransferData extends TransferData {
   }
 
   @Nullable
-  public VKey<BillingEvent.OneTime> getServerApproveBillingEvent() {
+  public VKey<BillingEvent> getServerApproveBillingEvent() {
     return serverApproveBillingEvent;
   }
 
   @Nullable
-  public VKey<BillingEvent.Recurring> getServerApproveAutorenewEvent() {
+  public VKey<BillingRecurrence> getServerApproveAutorenewEvent() {
     return serverApproveAutorenewEvent;
   }
 
@@ -176,9 +178,9 @@ public class DomainTransferData extends TransferData {
       domainTransferData.billingCancellationId = null;
     } else {
       domainTransferData.billingCancellationId =
-          (VKey<BillingEvent.Cancellation>)
+          (VKey<BillingCancellation>)
               serverApproveEntities.stream()
-                  .filter(k -> k.getKind().equals(BillingEvent.Cancellation.class))
+                  .filter(k -> k.getKind().equals(BillingCancellation.class))
                   .findFirst()
                   .orElse(null);
     }
@@ -204,14 +206,13 @@ public class DomainTransferData extends TransferData {
       return this;
     }
 
-    public Builder setServerApproveBillingEvent(
-        VKey<BillingEvent.OneTime> serverApproveBillingEvent) {
+    public Builder setServerApproveBillingEvent(VKey<BillingEvent> serverApproveBillingEvent) {
       getInstance().serverApproveBillingEvent = serverApproveBillingEvent;
       return this;
     }
 
     public Builder setServerApproveAutorenewEvent(
-        VKey<BillingEvent.Recurring> serverApproveAutorenewEvent) {
+        VKey<BillingRecurrence> serverApproveAutorenewEvent) {
       getInstance().serverApproveAutorenewEvent = serverApproveAutorenewEvent;
       return this;
     }

core/src/main/java/google/registry/module/backend/BackendRequestComponent.java

@@ -21,7 +21,7 @@ import google.registry.batch.CannedScriptExecutionAction;
 import google.registry.batch.DeleteExpiredDomainsAction;
 import google.registry.batch.DeleteLoadTestDataAction;
 import google.registry.batch.DeleteProberDataAction;
-import google.registry.batch.ExpandRecurringBillingEventsAction;
+import google.registry.batch.ExpandBillingRecurrencesAction;
 import google.registry.batch.RelockDomainAction;
 import google.registry.batch.ResaveAllEppResourcesPipelineAction;
 import google.registry.batch.ResaveEntityAction;
@@ -33,6 +33,7 @@ import google.registry.cron.TldFanoutAction;
 import google.registry.dns.DnsModule;
 import google.registry.dns.PublishDnsUpdatesAction;
 import google.registry.dns.ReadDnsQueueAction;
+import google.registry.dns.ReadDnsRefreshRequestsAction;
 import google.registry.dns.RefreshDnsAction;
 import google.registry.dns.RefreshDnsOnHostRenameAction;
 import google.registry.dns.writer.VoidDnsWriterModule;
@@ -114,7 +115,7 @@ interface BackendRequestComponent {
 
   DeleteProberDataAction deleteProberDataAction();
 
-  ExpandRecurringBillingEventsAction expandRecurringBillingEventsAction();
+  ExpandBillingRecurrencesAction expandBillingRecurrencesAction();
 
   ExportDomainListsAction exportDomainListsAction();
 
@@ -144,6 +145,8 @@ interface BackendRequestComponent {
 
   ReadDnsQueueAction readDnsQueueAction();
 
+  ReadDnsRefreshRequestsAction readDnsRefreshRequestsAction();
+
   RdeReportAction rdeReportAction();
 
   RdeStagingAction rdeStagingAction();

core/src/main/java/google/registry/persistence/converter/BillingEventFlagSetConverter.java

@@ -14,7 +14,7 @@
 
 package google.registry.persistence.converter;
 
-import google.registry.model.billing.BillingEvent.Flag;
+import google.registry.model.billing.BillingBase.Flag;
 import java.util.Set;
 import javax.persistence.AttributeConverter;
 import javax.persistence.Converter;

core/src/main/java/google/registry/persistence/converter/TldStateTransitionConverter.java

@@ -14,7 +14,7 @@
 
 package google.registry.persistence.converter;
 
-import google.registry.model.tld.Registry.TldState;
+import google.registry.model.tld.Tld.TldState;
 import javax.persistence.Converter;
 
 /** JPA converter for storing/retrieving {@code TimedTransitionProperty<TldState>} objects. */

core/src/main/java/google/registry/pricing/PricingEngineProxy.java

@@ -20,7 +20,7 @@ import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 
 import google.registry.model.pricing.PremiumPricingEngine;
 import google.registry.model.pricing.PremiumPricingEngine.DomainPrices;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.Map;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
@@ -58,7 +58,7 @@ public final class PricingEngineProxy {
    */
   public static DomainPrices getPricesForDomainName(String domainName, DateTime priceTime) {
     String tld = getTldFromDomainName(domainName);
-    String clazz = Registry.get(tld).getPremiumPricingEngineClassName();
+    String clazz = Tld.get(tld).getPremiumPricingEngineClassName();
     PremiumPricingEngine engine = premiumPricingEngines.get(clazz);
     checkState(engine != null, "Could not load pricing engine %s for TLD %s", clazz, tld);
     return engine.getDomainPrices(domainName, priceTime);

core/src/main/java/google/registry/rde/BrdaCopyAction.java

@@ -30,7 +30,7 @@ import google.registry.keyring.api.KeyModule.Key;
 import google.registry.model.common.Cursor;
 import google.registry.model.rde.RdeNamingUtils;
 import google.registry.model.rde.RdeRevision;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.HttpException.NoContentException;
 import google.registry.request.Parameter;
@@ -97,8 +97,7 @@ public final class BrdaCopyAction implements Runnable {
     // TODO(b/217772483): consider guarding this action with a lock and check if there is work.
     // Not urgent since file writes on GCS are atomic.
     Optional<Cursor> cursor =
-        tm().transact(
-                () -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(BRDA, Registry.get(tld))));
+        tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(BRDA, Tld.get(tld))));
     DateTime brdaCursorTime = getCursorTimeOrStartOfTime(cursor);
     if (isBeforeOrAt(brdaCursorTime, watermark)) {
       throw new NoContentException(

core/src/main/java/google/registry/rde/EscrowTaskRunner.java

@@ -19,7 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.flogger.FluentLogger;
 import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.HttpException.NoContentException;
 import google.registry.request.HttpException.ServiceUnavailableException;
 import google.registry.request.lock.LockHandler;
@@ -74,24 +74,23 @@ class EscrowTaskRunner {
    * Acquires lock, checks cursor, invokes {@code task}, and advances cursor.
    *
    * @param task the task to run
-   * @param registry the {@link Registry} that we are performing escrow for
+   * @param tld the {@link Tld} that we are performing escrow for
    * @param timeout time when we assume failure, kill the task (and instance) and release the lock
    * @param cursorType the cursor to advance on success, indicating the next required runtime
    * @param interval how far to advance the cursor (e.g. a day for RDE, a week for BRDA)
    */
   void lockRunAndRollForward(
       final EscrowTask task,
-      final Registry registry,
+      final Tld tld,
       Duration timeout,
       final CursorType cursorType,
       final Duration interval) {
     Callable<Void> lockRunner =
         () -> {
-          logger.atInfo().log("Performing escrow for TLD '%s'.", registry.getTld());
+          logger.atInfo().log("Performing escrow for TLD '%s'.", tld.getTld());
           DateTime startOfToday = clock.nowUtc().withTimeAtStartOfDay();
           DateTime nextRequiredRun =
-              tm().transact(
-                      () -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, registry)))
+              tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, tld)))
                   .map(Cursor::getCursorTime)
                   .orElse(startOfToday);
           if (nextRequiredRun.isAfter(startOfToday)) {
@@ -101,16 +100,16 @@ class EscrowTaskRunner {
           task.runWithLock(nextRequiredRun);
           DateTime nextRun = nextRequiredRun.plus(interval);
           logger.atInfo().log("Rolling cursor forward to %s.", nextRun);
-          tm().transact(() -> tm().put(Cursor.createScoped(cursorType, nextRun, registry)));
+          tm().transact(() -> tm().put(Cursor.createScoped(cursorType, nextRun, tld)));
           return null;
         };
     String lockName = String.format("EscrowTaskRunner %s", task.getClass().getSimpleName());
-    if (!lockHandler.executeWithLocks(lockRunner, registry.getTldStr(), timeout, lockName)) {
+    if (!lockHandler.executeWithLocks(lockRunner, tld.getTldStr(), timeout, lockName)) {
       // This will happen if either: a) the task is double-executed; b) the task takes a long time
       // to run and the retry task got executed while the first one is still running. In both
       // situations the safest thing to do is to just return 503 so the task gets retried later.
       throw new ServiceUnavailableException(
-          String.format("Lock in use: %s for TLD: %s", lockName, registry.getTldStr()));
+          String.format("Lock in use: %s for TLD: %s", lockName, tld.getTldStr()));
     }
   }
 }

core/src/main/java/google/registry/rde/PendingDepositChecker.java

@@ -24,8 +24,8 @@ import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.tld.Registries;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.util.Clock;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -83,23 +83,22 @@ public final class PendingDepositChecker {
     ImmutableSetMultimap.Builder<String, PendingDeposit> builder =
         new ImmutableSetMultimap.Builder<>();
     DateTime now = clock.nowUtc();
-    for (String tld : Registries.getTldsOfType(TldType.REAL)) {
-      Registry registry = Registry.get(tld);
-      if (!registry.getEscrowEnabled()) {
+    for (String tldStr : Registries.getTldsOfType(TldType.REAL)) {
+      Tld tld = Tld.get(tldStr);
+      if (!tld.getEscrowEnabled()) {
         continue;
       }
       // Avoid creating a transaction unless absolutely necessary.
       Optional<Cursor> maybeCursor =
-          tm().transact(
-                  () -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, registry)));
+          tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, tld)));
       DateTime cursorValue = maybeCursor.map(Cursor::getCursorTime).orElse(startingPoint);
       if (isBeforeOrAt(cursorValue, now)) {
         DateTime watermark =
             maybeCursor
                 .map(Cursor::getCursorTime)
-                .orElse(transactionallyInitializeCursor(registry, cursorType, startingPoint));
+                .orElse(transactionallyInitializeCursor(tld, cursorType, startingPoint));
         if (isBeforeOrAt(watermark, now)) {
-          builder.put(tld, PendingDeposit.create(tld, watermark, mode, cursorType, interval));
+          builder.put(tldStr, PendingDeposit.create(tldStr, watermark, mode, cursorType, interval));
         }
       }
     }
@@ -107,15 +106,15 @@ public final class PendingDepositChecker {
   }
 
   private DateTime transactionallyInitializeCursor(
-      final Registry registry, final CursorType cursorType, final DateTime initialValue) {
+      final Tld tld, final CursorType cursorType, final DateTime initialValue) {
     return tm().transact(
             () -> {
               Optional<Cursor> maybeCursor =
-                  tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, registry));
+                  tm().loadByKeyIfPresent(Cursor.createScopedVKey(cursorType, tld));
               if (maybeCursor.isPresent()) {
                 return maybeCursor.get().getCursorTime();
               }
-              tm().put(Cursor.createScoped(cursorType, initialValue, registry));
+              tm().put(Cursor.createScoped(cursorType, initialValue, tld));
               return initialValue;
             });
   }

core/src/main/java/google/registry/rde/RdeReportAction.java

@@ -32,7 +32,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.rde.RdeNamingUtils;
 import google.registry.model.rde.RdeRevision;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.rde.EscrowTaskRunner.EscrowTask;
 import google.registry.request.Action;
 import google.registry.request.HttpException.NoContentException;
@@ -76,7 +76,7 @@ public final class RdeReportAction implements Runnable, EscrowTask {
 
   @Override
   public void run() {
-    runner.lockRunAndRollForward(this, Registry.get(tld), timeout, CursorType.RDE_REPORT, interval);
+    runner.lockRunAndRollForward(this, Tld.get(tld), timeout, CursorType.RDE_REPORT, interval);
   }
 
   @Override
@@ -85,7 +85,7 @@ public final class RdeReportAction implements Runnable, EscrowTask {
         tm().transact(
                 () ->
                     tm().loadByKeyIfPresent(
-                            Cursor.createScopedVKey(CursorType.RDE_UPLOAD, Registry.get(tld))));
+                            Cursor.createScopedVKey(CursorType.RDE_UPLOAD, Tld.get(tld))));
     DateTime cursorTime = getCursorTimeOrStartOfTime(cursor);
     if (isBeforeOrAt(cursorTime, watermark)) {
       throw new NoContentException(

core/src/main/java/google/registry/rde/RdeUploadAction.java

@@ -46,7 +46,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.rde.RdeNamingUtils;
 import google.registry.model.rde.RdeRevision;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.rde.EscrowTaskRunner.EscrowTask;
 import google.registry.rde.JSchSshSession.JSchSshSessionFactory;
 import google.registry.request.Action;
@@ -125,7 +125,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
   @Override
   public void run() {
     logger.atInfo().log("Attempting to acquire RDE upload lock for TLD '%s'.", tld);
-    runner.lockRunAndRollForward(this, Registry.get(tld), timeout, CursorType.RDE_UPLOAD, interval);
+    runner.lockRunAndRollForward(this, Tld.get(tld), timeout, CursorType.RDE_UPLOAD, interval);
     HashMultimap<String, String> params = HashMultimap.create();
     params.put(RequestParameters.PARAM_TLD, tld);
     prefix.ifPresent(s -> params.put(RdeModule.PARAM_PREFIX, s));
@@ -160,9 +160,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
     logger.atInfo().log("Verifying readiness to upload the RDE deposit.");
     Optional<Cursor> cursor =
         tm().transact(
-                () ->
-                    tm().loadByKeyIfPresent(
-                            Cursor.createScopedVKey(RDE_STAGING, Registry.get(tld))));
+                () -> tm().loadByKeyIfPresent(Cursor.createScopedVKey(RDE_STAGING, Tld.get(tld))));
     DateTime stagingCursorTime = getCursorTimeOrStartOfTime(cursor);
     if (isBeforeOrAt(stagingCursorTime, watermark)) {
       throw new NoContentException(
@@ -174,8 +172,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
     DateTime sftpCursorTime =
         tm().transact(
                 () ->
-                    tm().loadByKeyIfPresent(
-                            Cursor.createScopedVKey(RDE_UPLOAD_SFTP, Registry.get(tld))))
+                    tm().loadByKeyIfPresent(Cursor.createScopedVKey(RDE_UPLOAD_SFTP, Tld.get(tld))))
             .map(Cursor::getCursorTime)
             .orElse(START_OF_TIME);
     Duration timeSinceLastSftp = new Duration(sftpCursorTime, clock.nowUtc());
@@ -214,7 +211,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
             () ->
                 tm().put(
                         Cursor.createScoped(
-                            RDE_UPLOAD_SFTP, tm().getTransactionTime(), Registry.get(tld))));
+                            RDE_UPLOAD_SFTP, tm().getTransactionTime(), Tld.get(tld))));
     response.setContentType(PLAIN_TEXT_UTF_8);
     response.setPayload(String.format("OK %s %s\n", tld, watermark));
   }

core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java

@@ -30,8 +30,8 @@ import google.registry.gcs.GcsUtils;
 import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.tld.Registries;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import google.registry.request.HttpException.ServiceUnavailableException;
@@ -169,7 +169,7 @@ public final class IcannReportingUploadAction implements Runnable {
           Cursor.createScoped(
               cursorType,
               cursorTime.withTimeAtStartOfDay().withDayOfMonth(1).plusMonths(1),
-              Registry.get(tldStr));
+              Tld.get(tldStr));
       // In order to keep the transactions short-lived, we load all of the cursors in a single
       // transaction then later use per-cursor transactions when checking + saving the cursors. We
       // run behind a lock so the cursors shouldn't be changed, but double check to be sure.
@@ -203,11 +203,11 @@ public final class IcannReportingUploadAction implements Runnable {
   /** Returns a map of each cursor to the tld. */
   private ImmutableMap<Cursor, String> loadCursors() {
 
-    ImmutableSet<Registry> registries = Registries.getTldEntitiesOfType(TldType.REAL);
+    ImmutableSet<Tld> registries = Registries.getTldEntitiesOfType(TldType.REAL);
 
-    ImmutableMap<VKey<? extends Cursor>, Registry> activityKeyMap =
+    ImmutableMap<VKey<? extends Cursor>, Tld> activityKeyMap =
         loadKeyMap(registries, CursorType.ICANN_UPLOAD_ACTIVITY);
-    ImmutableMap<VKey<? extends Cursor>, Registry> transactionKeyMap =
+    ImmutableMap<VKey<? extends Cursor>, Tld> transactionKeyMap =
         loadKeyMap(registries, CursorType.ICANN_UPLOAD_TX);
 
     ImmutableSet.Builder<VKey<? extends Cursor>> keys = new ImmutableSet.Builder<>();
@@ -225,8 +225,8 @@ public final class IcannReportingUploadAction implements Runnable {
     return cursors.build();
   }
 
-  private ImmutableMap<VKey<? extends Cursor>, Registry> loadKeyMap(
-      ImmutableSet<Registry> registries, CursorType type) {
+  private ImmutableMap<VKey<? extends Cursor>, Tld> loadKeyMap(
+      ImmutableSet<Tld> registries, CursorType type) {
     return Maps.uniqueIndex(registries, r -> Cursor.createScopedVKey(type, r));
   }
 
@@ -236,7 +236,7 @@ public final class IcannReportingUploadAction implements Runnable {
    * next month.
    */
   private ImmutableMap<Cursor, String> defaultNullCursorsToNextMonthAndAddToMap(
-      Map<VKey<? extends Cursor>, Registry> keyMap,
+      Map<VKey<? extends Cursor>, Tld> keyMap,
       CursorType type,
       Map<VKey<? extends Cursor>, Cursor> cursorMap) {
     ImmutableMap.Builder<Cursor, String> cursors = new ImmutableMap.Builder<>();

core/src/main/java/google/registry/tldconfig/idn/IdnLabelValidator.java

@@ -18,7 +18,7 @@ import static google.registry.tldconfig.idn.IdnTableEnum.EXTENDED_LATIN;
 import static google.registry.tldconfig.idn.IdnTableEnum.JA;
 
 import com.google.common.collect.ImmutableSet;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.util.Idn;
 import java.util.Optional;
 
@@ -37,7 +37,7 @@ public final class IdnLabelValidator {
    */
   public Optional<String> findValidIdnTableForTld(String label, String tldStr) {
     String unicodeString = Idn.toUnicode(label);
-    Registry tld = Registry.get(tldStr); // uses the cache
+    Tld tld = Tld.get(tldStr); // uses the cache
     ImmutableSet<IdnTableEnum> idnTablesForTld = tld.getIdnTables();
     ImmutableSet<IdnTableEnum> idnTables =
         idnTablesForTld.isEmpty() ? DEFAULT_IDN_TABLES : idnTablesForTld;

core/src/main/java/google/registry/tldconfig/idn/README.txt

@@ -0,0 +1,6 @@
+# IDN tables
+
+This directory contains the IDN tables that are actually in use by our running
+system (and the Java code to enable such). This will include older versions of
+IDN tables that are no longer published by IANA so long as those tables are
+still in use.

core/src/main/java/google/registry/tmch/LordnRequestInitializer.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Verify.verifyNotNull;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.keyring.api.KeyModule.Key;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import google.registry.request.UrlConnectionUtils;
 import java.net.HttpURLConnection;
 import java.util.Optional;
@@ -45,8 +45,11 @@ final class LordnRequestInitializer {
   /** Returns the username and password for the current TLD to login to the MarksDB server. */
   private Optional<String> getMarksDbLordnCredentials(String tld) {
     if (marksdbLordnPassword.isPresent()) {
-      String lordnUsername = verifyNotNull(Registry.get(tld).getLordnUsername(),
-          "lordnUsername is not set for %s.", Registry.get(tld).getTld());
+      String lordnUsername =
+          verifyNotNull(
+              Tld.get(tld).getLordnUsername(),
+              "lordnUsername is not set for %s.",
+              Tld.get(tld).getTld());
       return Optional.of(String.format("%s:%s", lordnUsername, marksdbLordnPassword.get()));
     } else {
       logger.atWarning().log(

core/src/main/java/google/registry/tools/CreateOrUpdateDomainCommand.java

@@ -21,6 +21,7 @@ import com.beust.jcommander.Parameter;
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableSet;
 import google.registry.tools.params.NameserversParameter;
+import google.registry.tools.params.StringListParameter;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
@@ -53,15 +54,15 @@ abstract class CreateOrUpdateDomainCommand extends MutatingEppToolCommand {
   String registrant;
 
   @Parameter(
-    names = {"-a", "--admins"},
-    description = "Comma-separated list of admin contacts."
-  )
+      names = {"-a", "--admins"},
+      description = "Comma-separated list of admin contacts.",
+      listConverter = StringListParameter.class)
   List<String> admins = new ArrayList<>();
 
   @Parameter(
-    names = {"-t", "--techs"},
-    description = "Comma-separated list of technical contacts."
-  )
+      names = {"-t", "--techs"},
+      description = "Comma-separated list of technical contacts.",
+      listConverter = StringListParameter.class)
   List<String> techs = new ArrayList<>();
 
   @Parameter(

core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java

@@ -17,6 +17,8 @@ package google.registry.tools;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Predicates.isNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.base.Verify.verify;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 import static google.registry.util.RegistrarUtils.normalizeRegistrarName;
@@ -34,6 +36,7 @@ import google.registry.tools.params.OptionalLongParameter;
 import google.registry.tools.params.OptionalPhoneNumberParameter;
 import google.registry.tools.params.OptionalStringParameter;
 import google.registry.tools.params.PathParameter;
+import google.registry.tools.params.StringListParameter;
 import google.registry.util.CidrAddressBlock;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -69,12 +72,14 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
 
   @Parameter(
       names = "--allowed_tlds",
-      description = "Comma-delimited list of TLDs which the registrar is allowed to use")
+      description = "Comma-delimited list of TLDs which the registrar is allowed to use",
+      listConverter = StringListParameter.class)
   List<String> allowedTlds = new ArrayList<>();
 
   @Parameter(
       names = "--add_allowed_tlds",
-      description = "Comma-delimited list of TLDs to add to TLDs a registrar is allowed to use")
+      description = "Comma-delimited list of TLDs to add to TLDs a registrar is allowed to use",
+      listConverter = StringListParameter.class)
   List<String> addAllowedTlds = new ArrayList<>();
 
   @Nullable
@@ -130,6 +135,13 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
       validateWith = PathParameter.InputFile.class)
   Path clientCertificateFilename;
 
+  @Parameter(
+      names = "--rotate_primary_cert",
+      description =
+          "Used together with --cert_file when updating an registrar. "
+              + "If set, current cert is saved as failover.")
+  private Boolean rotatePrimaryCert = Boolean.FALSE;
+
   @Nullable
   @Parameter(
       names = "--failover_cert_file",
@@ -139,8 +151,9 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
 
   @Parameter(
       names = "--ip_allow_list",
-      description = "Comma-delimited list of IP ranges. An empty string clears the allow list.")
-  List<String> ipAllowList = new ArrayList<>();
+      description = "Comma-delimited list of IP ranges. An empty string clears the allow list.",
+      listConverter = StringListParameter.class)
+  List<String> ipAllowList;
 
   @Nullable
   @Parameter(
@@ -248,7 +261,8 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
       description =
           "Comma-delimited list of RDAP servers. An empty argument clears the list."
               + " Note that for real registrars this could get overridden periodically by"
-              + " ICANN-registered values.")
+              + " ICANN-registered values.",
+      listConverter = StringListParameter.class)
   List<String> rdapServers = new ArrayList<>();
 
   /** Returns the existing registrar (for update) or null (for creates). */
@@ -322,16 +336,9 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
         }
         builder.setAllowedTlds(allowedTldsBuilder.build());
       }
-      if (!ipAllowList.isEmpty()) {
-        ImmutableList.Builder<CidrAddressBlock> ipAllowListBuilder = new ImmutableList.Builder<>();
-        if (!(ipAllowList.size() == 1 && ipAllowList.get(0).contains("null"))) {
-          for (String ipRange : ipAllowList) {
-            if (!ipRange.isEmpty()) {
-              ipAllowListBuilder.add(CidrAddressBlock.create(ipRange));
-            }
-          }
-        }
-        builder.setIpAddressAllowList(ipAllowListBuilder.build());
+      if (ipAllowList != null) {
+        builder.setIpAddressAllowList(
+            ipAllowList.stream().map(CidrAddressBlock::create).collect(toImmutableList()));
       }
       if (clientCertificateFilename != null) {
         String asciiCert = new String(Files.readAllBytes(clientCertificateFilename), US_ASCII);
@@ -341,8 +348,20 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
         if (!asciiCert.equals("")) {
           certificateChecker.validateCertificate(asciiCert);
         }
+        if (rotatePrimaryCert) {
+          verify(
+              oldRegistrar != null,
+              "--rotate_primary_cert cannot be set by create_registrar command.");
+          verify(
+              oldRegistrar.getClientCertificate().isPresent(),
+              "Primary cert is absent. Rotation may remove a failover certificate still in use.");
+          builder.setFailoverClientCertificate(oldRegistrar.getClientCertificate().get(), now);
+        }
         builder.setClientCertificate(asciiCert, now);
       }
+      if (rotatePrimaryCert && clientCertificateFilename == null) {
+        throw new IllegalArgumentException("--rotate_primary_cert must be used with --cert_file.");
+      }
 
       if (failoverClientCertificateFilename != null) {
         String asciiCert =

core/src/main/java/google/registry/tools/CreateOrUpdateTldCommand.java

@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.tools.UpdateOrDeleteAllocationTokensCommand.getTokenKeys;
 import static google.registry.util.CollectionUtils.findDuplicates;
-import static google.registry.util.CollectionUtils.isNullOrEmpty;
 import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 
 import com.beust.jcommander.Parameter;
@@ -30,13 +29,14 @@ import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Sets;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.tld.Registries;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.tldconfig.idn.IdnTableEnum;
 import google.registry.tools.params.OptionalStringParameter;
+import google.registry.tools.params.StringListParameter;
 import google.registry.tools.params.TransitionListParameter.BillingCostTransitions;
 import google.registry.tools.params.TransitionListParameter.TldStateTransitions;
 import java.util.Arrays;
@@ -195,19 +195,22 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
   @Nullable
   @Parameter(
       names = "--reserved_lists",
-      description = "A comma-separated list of reserved list names to be applied to the TLD")
+      description = "A comma-separated list of reserved list names to be applied to the TLD",
+      listConverter = StringListParameter.class)
   List<String> reservedListNames;
 
   @Nullable
   @Parameter(
       names = "--allowed_registrants",
-      description = "A comma-separated list of allowed registrants for the TLD")
+      description = "A comma-separated list of allowed registrants for the TLD",
+      listConverter = StringListParameter.class)
   List<String> allowedRegistrants;
 
   @Nullable
   @Parameter(
       names = "--allowed_nameservers",
-      description = "A comma-separated list of allowed nameservers for the TLD")
+      description = "A comma-separated list of allowed nameservers for the TLD",
+      listConverter = StringListParameter.class)
   List<String> allowedNameservers;
 
   @Parameter(
@@ -223,8 +226,9 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
 
   @Nullable
   @Parameter(
-    names = "--dns_writers",
-    description = "A comma-separated list of DnsWriter implementations to use")
+      names = "--dns_writers",
+      description = "A comma-separated list of DnsWriter implementations to use",
+      listConverter = StringListParameter.class)
   List<String> dnsWriters;
 
   @Nullable
@@ -262,7 +266,8 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
           "A comma-separated list of default allocation tokens to be applied to the TLD. The"
               + " ordering of this list will determine which token is used in the case where"
               + " multiple tokens are valid for a registration. Use an empty string to clear all"
-              + " present default tokens.")
+              + " present default tokens.",
+      listConverter = StringListParameter.class)
   List<String> defaultTokens;
 
   @Nullable
@@ -271,23 +276,24 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
       description =
           "A comma-separated list of the IDN tables to use for this TLD. Specify an empty list to"
               + " remove any previously-set tables and to use the default. All elements must be"
-              + " IdnTableEnum values")
+              + " IdnTableEnum values",
+      listConverter = StringListParameter.class)
   List<String> idnTables;
 
-  /** Returns the existing registry (for update) or null (for creates). */
+  /** Returns the existing tld (for update) or null (for creates). */
   @Nullable
-  abstract Registry getOldRegistry(String tld);
+  abstract Tld getOldTld(String tld);
 
-  abstract ImmutableSet<String> getAllowedRegistrants(Registry oldRegistry);
+  abstract ImmutableSet<String> getAllowedRegistrants(Tld oldTld);
 
-  abstract ImmutableSet<String> getAllowedNameservers(Registry oldRegistry);
+  abstract ImmutableSet<String> getAllowedNameservers(Tld oldTld);
 
-  abstract ImmutableSet<String> getReservedLists(Registry oldRegistry);
+  abstract ImmutableSet<String> getReservedLists(Tld oldTld);
 
   abstract Optional<Map.Entry<DateTime, TldState>> getTldStateTransitionToAdd();
 
   /** Subclasses can override this to set their own properties. */
-  void setCommandSpecificProperties(@SuppressWarnings("unused") Registry.Builder builder) {}
+  void setCommandSpecificProperties(@SuppressWarnings("unused") Tld.Builder builder) {}
 
   /** Subclasses can override this to assert that the command can be run in this environment. */
   void assertAllowedEnvironment() {}
@@ -312,14 +318,14 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
       checkArgument(
           !Character.isDigit(tld.charAt(0)),
           "TLDs cannot begin with a number");
-      Registry oldRegistry = getOldRegistry(tld);
+      Tld oldTld = getOldTld(tld);
       // TODO(b/26901539): Add a flag to set the pricing engine once we have more than one option.
-      Registry.Builder builder =
-          oldRegistry == null
-              ? new Registry.Builder()
+      Tld.Builder builder =
+          oldTld == null
+              ? new Tld.Builder()
                   .setTldStr(tld)
                   .setPremiumPricingEngine(StaticPremiumListPricingEngine.NAME)
-              : oldRegistry.asBuilder();
+              : oldTld.asBuilder();
 
       if (escrow != null) {
         builder.setEscrowEnabled(escrow);
@@ -336,14 +342,16 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
       } else if (tldStateTransitionToAdd.isPresent()) {
         ImmutableSortedMap.Builder<DateTime, TldState> newTldStateTransitions =
             ImmutableSortedMap.naturalOrder();
-        if (oldRegistry != null) {
+        if (oldTld != null) {
           checkArgument(
-              oldRegistry.getTldStateTransitions().lastKey().isBefore(
-                  tldStateTransitionToAdd.get().getKey()),
+              oldTld
+                  .getTldStateTransitions()
+                  .lastKey()
+                  .isBefore(tldStateTransitionToAdd.get().getKey()),
               "Cannot add %s at %s when there is a later transition already scheduled",
               tldStateTransitionToAdd.get().getValue(),
               tldStateTransitionToAdd.get().getKey());
-          newTldStateTransitions.putAll(oldRegistry.getTldStateTransitions());
+          newTldStateTransitions.putAll(oldTld.getTldStateTransitions());
         }
         builder.setTldStateTransitions(
             newTldStateTransitions.put(getTldStateTransitionToAdd().get()).build());
@@ -410,20 +418,16 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
         builder.setDnsWriters(dnsWritersSet);
       }
 
-      ImmutableSet<String> newReservedListNames = getReservedLists(oldRegistry);
+      ImmutableSet<String> newReservedListNames = getReservedLists(oldTld);
       checkReservedListValidityForTld(tld, newReservedListNames);
       builder.setReservedListsByName(newReservedListNames);
 
-      builder.setAllowedRegistrantContactIds(getAllowedRegistrants(oldRegistry));
+      builder.setAllowedRegistrantContactIds(getAllowedRegistrants(oldTld));
 
-      builder.setAllowedFullyQualifiedHostNames(getAllowedNameservers(oldRegistry));
+      builder.setAllowedFullyQualifiedHostNames(getAllowedNameservers(oldTld));
 
-      if (!isNullOrEmpty(defaultTokens)) {
-        if (defaultTokens.equals(ImmutableList.of(""))) {
-          builder.setDefaultPromoTokens(ImmutableList.of());
-        } else {
-          builder.setDefaultPromoTokens(getTokenKeys(defaultTokens, null));
-        }
+      if (defaultTokens != null) {
+        builder.setDefaultPromoTokens(getTokenKeys(defaultTokens, null));
       }
       if (idnTables != null) {
         if (idnTables.equals(ImmutableList.of(""))) {
@@ -444,7 +448,7 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
       }
       // Update the Registry object.
       setCommandSpecificProperties(builder);
-      stageEntityChange(oldRegistry, builder.build());
+      stageEntityChange(oldTld, builder.build());
     }
   }
 

core/src/main/java/google/registry/tools/CreateTldCommand.java

@@ -26,8 +26,8 @@ import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Maps;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldState;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldState;
 import java.util.Map;
 import java.util.Optional;
 import javax.annotation.Nullable;
@@ -68,40 +68,39 @@ class CreateTldCommand extends CreateOrUpdateTldCommand {
   }
 
   @Override
-  void setCommandSpecificProperties(Registry.Builder builder) {
+  void setCommandSpecificProperties(Tld.Builder builder) {
     // Pick up the currency from the create cost. Since all costs must be in one currency, and that
     // condition is enforced by the builder, it doesn't matter which cost we choose it from.
-    CurrencyUnit currency = createBillingCost != null
-        ? createBillingCost.getCurrencyUnit()
-        : Registry.DEFAULT_CURRENCY;
+    CurrencyUnit currency =
+        createBillingCost != null ? createBillingCost.getCurrencyUnit() : Tld.DEFAULT_CURRENCY;
 
     builder.setCurrency(currency);
 
     // If this is a non-default currency and the user hasn't specified an EAP fee schedule, set the
     // EAP fee schedule to a matching currency.
-    if (!currency.equals(Registry.DEFAULT_CURRENCY) && eapFeeSchedule.isEmpty()) {
+    if (!currency.equals(Tld.DEFAULT_CURRENCY) && eapFeeSchedule.isEmpty()) {
       builder.setEapFeeSchedule(ImmutableSortedMap.of(START_OF_TIME, Money.zero(currency)));
     }
   }
 
   @Override
-  Registry getOldRegistry(String tld) {
+  Tld getOldTld(String tld) {
     checkState(!getTlds().contains(tld), "TLD '%s' already exists", tld);
     return null;
   }
 
   @Override
-  ImmutableSet<String> getAllowedRegistrants(Registry oldRegistry) {
+  ImmutableSet<String> getAllowedRegistrants(Tld oldTld) {
     return ImmutableSet.copyOf(nullToEmpty(allowedRegistrants));
   }
 
   @Override
-  ImmutableSet<String> getAllowedNameservers(Registry oldRegistry) {
+  ImmutableSet<String> getAllowedNameservers(Tld oldTld) {
     return ImmutableSet.copyOf(nullToEmpty(allowedNameservers));
   }
 
   @Override
-  ImmutableSet<String> getReservedLists(Registry oldRegistry) {
+  ImmutableSet<String> getReservedLists(Tld oldTld) {
     return ImmutableSet.copyOf(nullToEmpty(reservedListNames));
   }
 

core/src/main/java/google/registry/tools/DeleteTldCommand.java

@@ -21,25 +21,25 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import google.registry.model.domain.Domain;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.persistence.transaction.QueryComposer.Comparator;
 
 /**
- * Command to delete the {@link Registry} associated with the specified TLD in the database.
+ * Command to delete the {@link Tld} associated with the specified TLD in the database.
  *
  * <p>This command will fail if any domains are currently registered on the TLD.
  */
 @Parameters(separators = " =", commandDescription = "Delete a TLD from the database.")
 final class DeleteTldCommand extends ConfirmingCommand {
 
-  private Registry registry;
+  private Tld tld;
 
   @Parameter(
       names = {"-t", "--tld"},
       description = "The TLD to delete.",
       required = true)
-  private String tld;
+  private String tldStr;
 
   /**
    * Perform the command by deleting the TLD.
@@ -52,28 +52,28 @@ final class DeleteTldCommand extends ConfirmingCommand {
    */
   @Override
   protected void init() {
-    registry = Registry.get(tld);
-    checkState(registry.getTldType().equals(TldType.TEST), "Cannot delete a real TLD");
+    tld = Tld.get(tldStr);
+    checkState(tld.getTldType().equals(TldType.TEST), "Cannot delete a real TLD");
 
     for (Registrar registrar : Registrar.loadAll()) {
       checkState(
-          !registrar.getAllowedTlds().contains(tld),
+          !registrar.getAllowedTlds().contains(tldStr),
           "Cannot delete TLD because registrar %s lists it as an allowed TLD",
           registrar.getRegistrarId());
     }
-    checkState(!tldContainsDomains(tld), "Cannot delete TLD because a domain is defined on it");
+    checkState(!tldContainsDomains(tldStr), "Cannot delete TLD because a domain is defined on it");
   }
 
   @Override
   protected String prompt() {
-    return "You are about to delete TLD: " + tld;
+    return "You are about to delete TLD: " + tldStr;
   }
 
   @Override
   protected String execute() {
-    tm().transact(() -> tm().delete(registry));
-    registry.invalidateInCache();
-    return String.format("Deleted TLD '%s'.\n", tld);
+    tm().transact(() -> tm().delete(tld));
+    tld.invalidateInCache();
+    return String.format("Deleted TLD '%s'.\n", tldStr);
   }
 
   private boolean tldContainsDomains(String tld) {

core/src/main/java/google/registry/tools/DomainLockUtils.java

@@ -26,14 +26,14 @@ import com.google.common.collect.Sets;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.batch.RelockDomainAction;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.billing.BillingEvent.Reason;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.RegistryLock;
 import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.tld.Registry;
 import google.registry.model.tld.RegistryLockDao;
+import google.registry.model.tld.Tld;
 import google.registry.request.Action.Service;
 import google.registry.util.StringGenerator;
 import java.util.Optional;
@@ -397,17 +397,17 @@ public final class DomainLockUtils {
     tm().update(domain);
     tm().insert(domainHistory);
     if (!lock.isSuperuser()) { // admin actions shouldn't affect billing
-      BillingEvent.OneTime oneTime =
-          new BillingEvent.OneTime.Builder()
+      BillingEvent billingEvent =
+          new BillingEvent.Builder()
               .setReason(Reason.SERVER_STATUS)
               .setTargetId(domain.getForeignKey())
               .setRegistrarId(domain.getCurrentSponsorRegistrarId())
-              .setCost(Registry.get(domain.getTld()).getRegistryLockOrUnlockBillingCost())
+              .setCost(Tld.get(domain.getTld()).getRegistryLockOrUnlockBillingCost())
               .setEventTime(now)
               .setBillingTime(now)
               .setDomainHistory(domainHistory)
               .build();
-      tm().insert(oneTime);
+      tm().insert(billingEvent);
     }
   }
 }

core/src/main/java/google/registry/tools/GenerateAllocationTokensCommand.java

@@ -17,7 +17,8 @@ package google.registry.tools;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Sets.difference;
-import static google.registry.model.billing.BillingEvent.RenewalPriceBehavior.DEFAULT;
+import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.DEFAULT;
+import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.domain.token.AllocationToken.TokenType.PACKAGE;
 import static google.registry.model.domain.token.AllocationToken.TokenType.SINGLE_USE;
 import static google.registry.model.domain.token.AllocationToken.TokenType.UNLIMITED_USE;
@@ -38,7 +39,7 @@ import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Streams;
 import com.google.common.io.Files;
-import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.RegistrationBehavior;
@@ -102,7 +103,9 @@ class GenerateAllocationTokensCommand implements Command {
 
   @Parameter(
       names = {"-t", "--type"},
-      description = "Type of type token, either SINGLE_USE (default) or UNLIMITED_USE")
+      description =
+          "Type of type token, either DEFAULT_PROMO, PACKAGE, SINGLE_USE (default) or"
+              + " UNLIMITED_USE")
   private TokenType tokenType;
 
   @Parameter(
@@ -257,6 +260,10 @@ class GenerateAllocationTokensCommand implements Command {
         !(UNLIMITED_USE.equals(tokenType) && CollectionUtils.isNullOrEmpty(tokenStatusTransitions)),
         "For UNLIMITED_USE tokens, must specify --token_status_transitions");
 
+    checkArgument(
+        !(DEFAULT_PROMO.equals(tokenType) && CollectionUtils.isNullOrEmpty(tokenStatusTransitions)),
+        "For DEFAULT_PROMO tokens, must specify --token_status_transitions");
+
     // A list consisting solely of the empty string means user error when formatting parameters
     checkArgument(
         !ImmutableList.of("").equals(allowedClientIds),

core/src/main/java/google/registry/tools/GetTldCommand.java

@@ -18,7 +18,7 @@ import static google.registry.model.tld.Registries.assertTldsExist;
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
-import google.registry.model.tld.Registry;
+import google.registry.model.tld.Tld;
 import java.util.List;
 
 /** Command to show a TLD record. */
@@ -33,7 +33,7 @@ final class GetTldCommand implements Command {
   @Override
   public void run() {
     for (String tld : assertTldsExist(mainParameters)) {
-      System.out.println(Registry.get(tld));
+      System.out.println(Tld.get(tld));
     }
   }
 }

core/src/main/java/google/registry/tools/ListCursorsCommand.java

@@ -24,8 +24,8 @@ import com.google.common.collect.ImmutableMap;
 import google.registry.model.common.Cursor;
 import google.registry.model.common.Cursor.CursorType;
 import google.registry.model.tld.Registries;
-import google.registry.model.tld.Registry;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.persistence.VKey;
 import java.util.Map;
 import java.util.Optional;
@@ -54,7 +54,7 @@ final class ListCursorsCommand implements Command {
     Map<String, VKey<Cursor>> cursorKeys =
         cursorType.isScoped()
             ? Registries.getTlds().stream()
-                .map(Registry::get)
+                .map(Tld::get)
                 .filter(r -> r.getTldType() == filterTldType)
                 .filter(r -> !filterEscrowEnabled || r.getEscrowEnabled())
                 .collect(

core/src/main/java/google/registry/tools/ListDomainsCommand.java

@@ -22,7 +22,7 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableMap;
-import google.registry.model.tld.Registry.TldType;
+import google.registry.model.tld.Tld.TldType;
 import google.registry.tools.server.ListDomainsAction;
 import java.util.List;
 

core/src/main/java/google/registry/tools/RegistrarPocCommand.java

@@ -32,6 +32,7 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.tools.params.OptionalPhoneNumberParameter;
 import google.registry.tools.params.PathParameter;
+import google.registry.tools.params.StringListParameter;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -72,8 +73,10 @@ final class RegistrarPocCommand extends MutatingCommand {
   @Nullable
   @Parameter(
       names = "--contact_type",
-      description = "Type of communications for this contact; separate multiple with commas."
-          + " Allowed values are ABUSE, ADMIN, BILLING, LEGAL, MARKETING, TECH, WHOIS.")
+      description =
+          "Type of communications for this contact; separate multiple with commas."
+              + " Allowed values are ABUSE, ADMIN, BILLING, LEGAL, MARKETING, TECH, WHOIS.",
+      listConverter = StringListParameter.class)
   private List<String> contactTypeNames;
 
   @Nullable
@@ -177,15 +180,6 @@ final class RegistrarPocCommand extends MutatingCommand {
     // If the contact_type parameter is not specified, we should not make any changes.
     if (contactTypeNames == null) {
       contactTypes = null;
-      // It appears that when the user specifies "--contact_type=" with no types following,
-      // JCommander sets contactTypeNames to a one-element list containing the empty string. This is
-      // strange, but we need to handle this by setting the contact types to the empty set. Also do
-      // this if contactTypeNames is empty, which is what I would hope JCommander would return in
-      // some future, better world.
-    } else //noinspection UnnecessaryParentheses
-    if (contactTypeNames.isEmpty()
-        || (contactTypeNames.size() == 1 && contactTypeNames.get(0).isEmpty())) {
-      contactTypes = ImmutableSet.of();
     } else {
       contactTypes =
           contactTypeNames.stream()

core/src/main/java/google/registry/tools/RegistryTool.java

@@ -15,7 +15,7 @@
 package google.registry.tools;
 
 import com.google.common.collect.ImmutableMap;
-import google.registry.tools.javascrap.CreateCancellationsForOneTimesCommand;
+import google.registry.tools.javascrap.CreateCancellationsForBillingEventsCommand;
 
 /** Container class to create and run remote commands against a server instance. */
 public final class RegistryTool {
@@ -35,7 +35,9 @@ public final class RegistryTool {
           .put("convert_idn", ConvertIdnCommand.class)
           .put("count_domains", CountDomainsCommand.class)
           .put("create_anchor_tenant", CreateAnchorTenantCommand.class)
-          .put("create_cancellations_for_one_times", CreateCancellationsForOneTimesCommand.class)
+          .put(
+              "create_cancellations_for_billing_events",
+              CreateCancellationsForBillingEventsCommand.class)
           .put("create_cdns_tld", CreateCdnsTld.class)
           .put("create_contact", CreateContactCommand.class)
           .put("create_domain", CreateDomainCommand.class)
@@ -97,7 +99,6 @@ public final class RegistryTool {
           .put("save_sql_credential", SaveSqlCredentialCommand.class)
           .put("send_escrow_report_to_icann", SendEscrowReportToIcannCommand.class)
           .put("set_database_migration_state", SetDatabaseMigrationStateCommand.class)
-          .put("set_num_instances", SetNumInstancesCommand.class)
           .put("setup_ote", SetupOteCommand.class)
           .put("uniform_rapid_suspension", UniformRapidSuspensionCommand.class)
           .put("unlock_domain", UnlockDomainCommand.class)
@@ -108,6 +109,7 @@ public final class RegistryTool {
           .put("update_keyring_secret", UpdateKeyringSecretCommand.class)
           .put("update_package_promotion", UpdatePackagePromotionCommand.class)
           .put("update_premium_list", UpdatePremiumListCommand.class)
+          .put("update_recurrence", UpdateRecurrenceCommand.class)
           .put("update_registrar", UpdateRegistrarCommand.class)
           .put("update_reserved_list", UpdateReservedListCommand.class)
           .put("update_server_locks", UpdateServerLocksCommand.class)