Add the ability to specify per-transaction isolation level (#2104)

A config file field is added to control if per-transaction isolation
level is actually used. If set to true, nested transactions will throw
a runtime exception as the enclosing transaction may run at a different
isolation level.

In this PR we only add the ability to specify the isolation level,
without enabling it in any environment (including unit tests), or
actually specifying one for any query. This should allow us to set up
the system without impacting anything currently working.

.gitignore

@@ -79,6 +79,7 @@ autogenerated/
 **/*.iml
 nomulus.ipr
 nomulus.iws
+**/classpath.index
 
 # Auto-generated java classes by Intellij
 */src/main/generated/

buildSrc/gradle.lockfile

@@ -3,31 +3,31 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0=buildScriptClasspath,compileClasspath
 args4j:args4j:2.0.23=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=buildScriptClasspath,compileClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=buildScriptClasspath,compileClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=buildScriptClasspath,compileClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor
 com.google.android:annotations:4.1.1.4=buildScriptClasspath
 com.google.api-client:google-api-client:2.2.0=buildScriptClasspath,compileClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.25.0-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.25.0-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.25.0-alpha=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-common-protos:2.22.1=buildScriptClasspath,compileClasspath
-com.google.api.grpc:proto-google-iam-v1:1.17.1=buildScriptClasspath,compileClasspath
-com.google.api:api-common:2.14.1=buildScriptClasspath,compileClasspath
-com.google.api:gax-grpc:2.31.1=buildScriptClasspath,compileClasspath
-com.google.api:gax-httpjson:2.31.1=buildScriptClasspath,compileClasspath
-com.google.api:gax:2.31.1=buildScriptClasspath,compileClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-common-protos:2.22.0=buildScriptClasspath,compileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.17.0=buildScriptClasspath,compileClasspath
+com.google.api:api-common:2.14.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-grpc:2.31.0=buildScriptClasspath,compileClasspath
+com.google.api:gax-httpjson:2.31.0=buildScriptClasspath,compileClasspath
+com.google.api:gax:2.31.0=buildScriptClasspath,compileClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=buildScriptClasspath,compileClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=buildScriptClasspath,compileClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=buildScriptClasspath,compileClasspath
-com.google.auto.value:auto-value-annotations:1.10.2=buildScriptClasspath,compileClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=buildScriptClasspath,compileClasspath
 com.google.auto.value:auto-value:1.10.2=annotationProcessor
 com.google.auto:auto-common:0.10=annotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.21.1=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core-http:2.21.1=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-core:2.21.1=buildScriptClasspath,compileClasspath
-com.google.cloud:google-cloud-storage:2.25.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-core:2.21.0=buildScriptClasspath,compileClasspath
+com.google.cloud:google-cloud-storage:2.22.6=buildScriptClasspath,compileClasspath
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,buildScriptClasspath,compileClasspath
 com.google.code.gson:gson:2.10.1=buildScriptClasspath,compileClasspath
@@ -58,26 +58,26 @@ com.google.oauth-client:google-oauth-client:1.34.1=buildScriptClasspath,compileC
 com.google.protobuf:protobuf-java-util:3.23.2=buildScriptClasspath,compileClasspath
 com.google.protobuf:protobuf-java:3.23.2=buildScriptClasspath,compileClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor
-com.google.re2j:re2j:1.7=buildScriptClasspath
+com.google.re2j:re2j:1.6=buildScriptClasspath
 com.google.template:soy:2021-02-01=buildScriptClasspath,compileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor
 com.ibm.icu:icu4j:57.1=buildScriptClasspath,compileClasspath
 commons-codec:commons-codec:1.15=buildScriptClasspath,compileClasspath
 commons-logging:commons-logging:1.2=buildScriptClasspath,compileClasspath
-io.grpc:grpc-alts:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-api:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-auth:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-context:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-core:1.56.1=buildScriptClasspath
-io.grpc:grpc-googleapis:1.56.1=buildScriptClasspath
-io.grpc:grpc-grpclb:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-netty-shaded:1.56.1=buildScriptClasspath
-io.grpc:grpc-protobuf-lite:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-protobuf:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-rls:1.56.1=buildScriptClasspath
-io.grpc:grpc-services:1.56.1=buildScriptClasspath
-io.grpc:grpc-stub:1.56.1=buildScriptClasspath,compileClasspath
-io.grpc:grpc-xds:1.56.1=buildScriptClasspath
+io.grpc:grpc-alts:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-api:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-auth:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-context:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-core:1.55.3=buildScriptClasspath
+io.grpc:grpc-googleapis:1.55.3=buildScriptClasspath
+io.grpc:grpc-grpclb:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-netty-shaded:1.55.3=buildScriptClasspath
+io.grpc:grpc-protobuf-lite:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-protobuf:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-rls:1.55.3=buildScriptClasspath
+io.grpc:grpc-services:1.55.3=buildScriptClasspath
+io.grpc:grpc-stub:1.55.3=buildScriptClasspath,compileClasspath
+io.grpc:grpc-xds:1.55.3=buildScriptClasspath
 io.opencensus:opencensus-api:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=buildScriptClasspath,compileClasspath
 io.opencensus:opencensus-proto:0.2.0=buildScriptClasspath

common/gradle.lockfile

@@ -4,12 +4,12 @@
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.auto.value:auto-value-annotations:1.8.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.errorprone:error_prone_annotations:2.19.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
@@ -17,16 +17,16 @@ com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,test
 com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle
-com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+com.google.guava:guava:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
 com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath,testingCompileClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-com.google.truth:truth:1.1.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+com.google.truth:truth:1.1.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
@@ -42,7 +42,7 @@ org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.checkerframework:checker-qual:3.12.0=checkstyle
-org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
+org.checkerframework:checker-qual:3.35.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
@@ -60,8 +60,7 @@ org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:9.5=jacocoAnt
-org.ow2.asm:asm:9.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.ow2.asm:asm:9.5=jacocoAnt
+org.ow2.asm:asm:9.5=compileClasspath,deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor

config/presubmits.py

@@ -109,13 +109,6 @@ PRESUBMITS = {
         "System.(out|err).println is only allowed in tools/ packages. Please "
         "use a logger instead.",
 
-    # PostgreSQLContainer instantiation must specify docker tag
-    # TODO(b/204572437): Fix the pattern to pass DatabaseSnapshotTest.java
-    PresubmitCheck(
-        r"[\s\S]*new\s+PostgreSQLContainer(<[\s\S]*>)?\(\s*\)[\s\S]*",
-        "java", {"DatabaseSnapshotTest.java"}):
-      "PostgreSQLContainer instantiation must specify docker tag.",
-
     # Various Soy linting checks
     PresubmitCheck(
         r".* (/\*)?\* {?@param ",

console-webapp/src/app/shared/services/backend.service.ts

@@ -12,12 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { Injectable } from '@angular/core';
 import { HttpClient, HttpErrorResponse } from '@angular/common/http';
-import { Observable, catchError, of } from 'rxjs';
-import { Contact } from '../../settings/contact/contact.service';
+import { Injectable } from '@angular/core';
+import { catchError, Observable, of } from 'rxjs';
 import { SecuritySettingsBackendModel } from 'src/app/settings/security/security.service';
 
+import { Contact } from '../../settings/contact/contact.service';
+
 @Injectable()
 export class BackendService {
   constructor(private http: HttpClient) {}
@@ -55,7 +56,7 @@ export class BackendService {
   ): Observable<Contact[]> {
     return this.http.post<Contact[]>(
       `/console-api/settings/contacts?registrarId=${registrarId}`,
-      { contacts }
+      contacts
     );
   }
 
@@ -85,7 +86,7 @@ export class BackendService {
   ): Observable<SecuritySettingsBackendModel> {
     return this.http.post<SecuritySettingsBackendModel>(
       `/console-api/settings/security?registrarId=${registrarId}`,
-      { registrar: securitySettings }
+      securitySettings
     );
   }
 }

core/gradle.lockfile

@@ -8,22 +8,14 @@ args4j:args4j:2.0.26=css
 cglib:cglib-nodep:2.2=css
 com.101tec:zkclient:0.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.fasterxml.jackson:jackson-bom:2.14.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -45,8 +37,7 @@ com.google.api-client:google-api-client-jackson2:1.32.2=compileClasspath,deploy_
 com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -56,8 +47,7 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.8=compileClasspath,depl
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.20.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -75,8 +65,7 @@ com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.22.0=compileClass
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.112.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.112.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -101,7 +90,8 @@ com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=compileClass
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20230526-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20230607-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.16=testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.16=testCompileClasspath,testRuntimeClasspath
@@ -125,12 +115,9 @@ com.google.cloud.sql:postgres-socket-factory:1.13.1=deploy_jar,runtimeClasspath,
 com.google.cloud:google-cloud-bigquerystorage:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.23.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.21.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core:2.21.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-monitoring:3.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -139,8 +126,7 @@ com.google.cloud:google-cloud-pubsub:1.123.14=compileClasspath,deploy_jar,nonpro
 com.google.cloud:google-cloud-pubsublite:1.12.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.22.6=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.22.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -171,13 +157,15 @@ com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,nonprodCompileClass
 com.google.flogger:google-extensions:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-testlib:32.1.1-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=annotationProcessor,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:32.1.2-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:20.0=css
 com.google.guava:guava:27.0.1-jre=errorprone,nonprodAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle,soy
-com.google.guava:guava:32.1.1-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,errorprone,nonprodAnnotationProcessor,soy
+com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.guava:guava:32.1.2-jre=annotationProcessor,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,nonprodAnnotationProcessor,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -212,7 +200,7 @@ com.google.protobuf:protobuf-java:4.0.0-rc-2=soy
 com.google.re2j:re2j:1.6=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.re2j:re2j:1.7=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.template:soy:2021-02-01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-com.google.truth.extensions:truth-java8-extension:1.1.3=testCompileClasspath,testRuntimeClasspath
+com.google.truth.extensions:truth-java8-extension:1.1.5=testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.1.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 com.google.truth:truth:1.1.5=testCompileClasspath,testRuntimeClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -269,8 +257,7 @@ io.grpc:grpc-netty-shaded:1.56.1=compileClasspath,deploy_jar,nonprodCompileClass
 io.grpc:grpc-netty:1.55.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.55.3=testRuntimeClasspath
-io.grpc:grpc-rls:1.56.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.55.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-services:1.55.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 io.grpc:grpc-services:1.56.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.56.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -319,8 +306,7 @@ javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodComp
 javax.xml.bind:jaxb-api:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.xml.bind:jaxb-api:2.4.0-b180830.0359=jaxb
 jline:jline:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.10.10=testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.10.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+joda-time:joda-time:2.10.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=nonprodRuntime,runtime,testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.14.5=testCompileClasspath,testRuntimeClasspath
@@ -358,7 +344,8 @@ org.apache.beam:beam-vendor-guava-26_0-jre:0.1=compileClasspath,deploy_jar,nonpr
 org.apache.commons:commons-compress:1.23.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=nonprodRuntime,runtime,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.12.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 org.apache.commons:commons-text:1.10.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClasspath
@@ -396,7 +383,7 @@ org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,deploy_jar,nonp
 org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.3=nonprodRuntime,runtime
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:4.0.3=nonprodRuntime,runtime
@@ -500,8 +487,7 @@ org.tukaani:xz:1.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRu
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=nonprodRuntime,runtime,testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:1.33=testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.yaml:snakeyaml:1.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java

@@ -71,7 +71,7 @@ public class CannedScriptExecutionAction implements Runnable {
       GmailClient gmailClient,
       @Config("projectId") String projectId,
       @Config("gSuiteDomainName") String gSuiteDomainName,
-      @Config("alertRecipientEmailAddress") InternetAddress recipientAddress) {
+      @Config("newAlertRecipientEmailAddress") InternetAddress recipientAddress) {
     this.groupsConnection = groupsConnection;
     this.gmailClient = gmailClient;
     this.gSuiteDomainName = gSuiteDomainName;
@@ -116,6 +116,8 @@ public class CannedScriptExecutionAction implements Runnable {
         try {
           Set<String> currentMembers = groupsConnection.getMembersOfGroup(groupKey);
           logger.atInfo().log("%s has %s members.", groupKey, currentMembers.size());
+          // One success is enough for validation.
+          return;
         } catch (IOException e) {
           logger.atWarning().withCause(e).log("Failed to check %s", groupKey);
         }

core/src/main/java/google/registry/beam/common/DatabaseSnapshot.java

@@ -1,88 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.beam.common;
-
-import static com.google.common.base.Preconditions.checkState;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-
-import com.google.common.flogger.FluentLogger;
-import java.util.List;
-import javax.persistence.EntityManager;
-import javax.persistence.EntityTransaction;
-
-/**
- * A database snapshot shareable by concurrent queries from multiple database clients. A snapshot is
- * uniquely identified by its {@link #getSnapshotId snapshotId}, and must stay open until all
- * concurrent queries to this snapshot have attached to it by calling {@link
- * google.registry.persistence.transaction.JpaTransactionManager#setDatabaseSnapshot}. However, it
- * can be closed before those queries complete.
- *
- * <p>This feature is <em>Postgresql-only</em>.
- *
- * <p>To support large queries, transaction isolation level is fixed at the REPEATABLE_READ to avoid
- * exhausting predicate locks at the SERIALIZABLE level.
- */
-// TODO(b/193662898): vendor-independent support for richer transaction semantics.
-public class DatabaseSnapshot implements AutoCloseable {
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private String snapshotId;
-  private EntityManager entityManager;
-  private EntityTransaction transaction;
-
-  private DatabaseSnapshot() {}
-
-  public String getSnapshotId() {
-    checkState(entityManager != null, "Snapshot not opened yet.");
-    checkState(entityManager.isOpen(), "Snapshot already closed.");
-    return snapshotId;
-  }
-
-  private DatabaseSnapshot open() {
-    entityManager = tm().getStandaloneEntityManager();
-    transaction = entityManager.getTransaction();
-    transaction.setRollbackOnly();
-    transaction.begin();
-
-    entityManager
-        .createNativeQuery("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
-        .executeUpdate();
-
-    List<?> snapshotIds =
-        entityManager.createNativeQuery("SELECT pg_export_snapshot();").getResultList();
-    checkState(snapshotIds.size() == 1, "Unexpected number of snapshots: %s", snapshotIds.size());
-    snapshotId = (String) snapshotIds.get(0);
-    return this;
-  }
-
-  @Override
-  public void close() {
-    if (transaction != null && transaction.isActive()) {
-      try {
-        transaction.rollback();
-      } catch (Exception e) {
-        logger.atWarning().withCause(e).log("Failed to close a Database Snapshot");
-      }
-    }
-    if (entityManager != null && entityManager.isOpen()) {
-      entityManager.close();
-    }
-  }
-
-  public static DatabaseSnapshot createSnapshot() {
-    return new DatabaseSnapshot().open();
-  }
-}

core/src/main/java/google/registry/beam/common/RegistryJpaIO.java

@@ -122,6 +122,7 @@ public final class RegistryJpaIO {
   @AutoValue
   public abstract static class Read<R, T> extends PTransform<PBegin, PCollection<T>> {
 
+    private static final long serialVersionUID = 6906842877429561700L;
     public static final String DEFAULT_NAME = "RegistryJpaIO.Read";
 
     abstract String name();
@@ -133,9 +134,6 @@ public final class RegistryJpaIO {
     @Nullable
     abstract Coder<T> coder();
 
-    @Nullable
-    abstract String snapshotId();
-
     abstract Builder<R, T> toBuilder();
 
     @Override
@@ -145,8 +143,7 @@ public final class RegistryJpaIO {
           input
               .apply("Starting " + name(), Create.of((Void) null))
               .apply(
-                  "Run query for " + name(),
-                  ParDo.of(new QueryRunner<>(query(), resultMapper(), snapshotId())));
+                  "Run query for " + name(), ParDo.of(new QueryRunner<>(query(), resultMapper())));
       if (coder() != null) {
         output = output.setCoder(coder());
       }
@@ -165,18 +162,6 @@ public final class RegistryJpaIO {
       return toBuilder().coder(coder).build();
     }
 
-    /**
-     * Specifies the database snapshot to use for this query.
-     *
-     * <p>This feature is <em>Postgresql-only</em>. User is responsible for keeping the snapshot
-     * available until all JVM workers have started using it by calling {@link
-     * JpaTransactionManager#setDatabaseSnapshot}.
-     */
-    // TODO(b/193662898): vendor-independent support for richer transaction semantics.
-    public Read<R, T> withSnapshot(@Nullable String snapshotId) {
-      return toBuilder().snapshotId(snapshotId).build();
-    }
-
     static <R, T> Builder<R, T> builder() {
       return new AutoValue_RegistryJpaIO_Read.Builder<R, T>().name(DEFAULT_NAME);
     }
@@ -192,8 +177,6 @@ public final class RegistryJpaIO {
 
       abstract Builder<R, T> coder(Coder<T> coder);
 
-      abstract Builder<R, T> snapshotId(@Nullable String sharedSnapshotId);
-
       abstract Read<R, T> build();
 
       Builder<R, T> criteriaQuery(CriteriaQuerySupplier<R> criteriaQuery) {
@@ -214,27 +197,20 @@ public final class RegistryJpaIO {
     }
 
     static class QueryRunner<R, T> extends DoFn<Void, T> {
+
+      private static final long serialVersionUID = 7293891513058653334L;
       private final RegistryQuery<R> query;
       private final SerializableFunction<R, T> resultMapper;
-      // java.util.Optional is not serializable. Use of Guava Optional is discouraged.
-      @Nullable private final String snapshotId;
 
-      QueryRunner(
-          RegistryQuery<R> query,
-          SerializableFunction<R, T> resultMapper,
-          @Nullable String snapshotId) {
+      QueryRunner(RegistryQuery<R> query, SerializableFunction<R, T> resultMapper) {
         this.query = query;
         this.resultMapper = resultMapper;
-        this.snapshotId = snapshotId;
       }
 
       @ProcessElement
       public void processElement(OutputReceiver<T> outputReceiver) {
         tm().transactNoRetry(
                 () -> {
-                  if (snapshotId != null) {
-                    tm().setDatabaseSnapshot(snapshotId);
-                  }
                   query.stream().map(resultMapper::apply).forEach(outputReceiver::output);
                 });
       }
@@ -256,8 +232,8 @@ public final class RegistryJpaIO {
   @AutoValue
   public abstract static class Write<T> extends PTransform<PCollection<T>, PCollection<Void>> {
 
+    private static final long serialVersionUID = -4023583243078410323L;
     public static final String DEFAULT_NAME = "RegistryJpaIO.Write";
-
     public static final int DEFAULT_BATCH_SIZE = 1;
 
     public abstract String name();
@@ -321,6 +297,8 @@ public final class RegistryJpaIO {
 
   /** Writes a batch of entities to a SQL database through a {@link JpaTransactionManager}. */
   private static class SqlBatchWriter<T> extends DoFn<KV<ShardedKey<Integer>, Iterable<T>>, Void> {
+
+    private static final long serialVersionUID = -7519944406319472690L;
     private final Counter counter;
     private final SerializableFunction<T, Object> jpaConverter;
 
@@ -337,7 +315,7 @@ public final class RegistryJpaIO {
     private void actuallyProcessElement(@Element KV<ShardedKey<Integer>, Iterable<T>> kv) {
       ImmutableList<Object> entities =
           Streams.stream(kv.getValue())
-              .map(this.jpaConverter::apply)
+              .map(jpaConverter::apply)
               // TODO(b/177340730): post migration delete the line below.
               .filter(Objects::nonNull)
               .collect(ImmutableList.toImmutableList());
@@ -373,7 +351,7 @@ public final class RegistryJpaIO {
     }
 
     /** Returns this entity's primary key field(s) in a string. */
-    private String toEntityKeyString(Object entity) {
+    private static String toEntityKeyString(Object entity) {
       try {
         return tm().transact(
                 () ->

core/src/main/java/google/registry/config/CredentialModule.java

@@ -93,13 +93,56 @@ public abstract class CredentialModule {
   @AdcDelegatedCredential
   @Provides
   @Singleton
-  public static GoogleCredentialsBundle provideSelfSignedDelegatedCredential(
+  public static GoogleCredentialsBundle provideSelfSignedAdminDelegatedCredential(
       @Config("defaultCredentialOauthScopes") ImmutableList<String> defaultScopes,
       @Config("delegatedCredentialOauthScopes") ImmutableList<String> delegationScopes,
       @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
       @Config("gSuiteAdminAccountEmailAddress") String gSuiteAdminAccountEmailAddress,
       @Config("tokenRefreshDelay") Duration tokenRefreshDelay,
       Clock clock) {
+    return createSelfSignedDelegatedCredential(
+        defaultScopes,
+        delegationScopes,
+        credentialsBundle,
+        gSuiteAdminAccountEmailAddress,
+        tokenRefreshDelay,
+        clock);
+  }
+
+  /**
+   * Provides a {@link GoogleCredentialsBundle} for sending emails through Google Workspace.
+   *
+   * <p>The Workspace domain must grant delegated admin access to the default service account user
+   * (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in {@code defaultScopes}
+   * and {@code delegationScopes}. In addition, the user {@code gSuiteOutgoingEmailAddress} must
+   * have the permission to send emails.
+   */
+  @GmailDelegatedCredential
+  @Provides
+  @Singleton
+  public static GoogleCredentialsBundle provideSelfSignedGmailDelegatedCredential(
+      @Config("defaultCredentialOauthScopes") ImmutableList<String> defaultScopes,
+      @Config("delegatedCredentialOauthScopes") ImmutableList<String> delegationScopes,
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("gSuiteNewOutgoingEmailAddress") String gSuiteOutgoingEmailAddress,
+      @Config("tokenRefreshDelay") Duration tokenRefreshDelay,
+      Clock clock) {
+    return createSelfSignedDelegatedCredential(
+        defaultScopes,
+        delegationScopes,
+        credentialsBundle,
+        gSuiteOutgoingEmailAddress,
+        tokenRefreshDelay,
+        clock);
+  }
+
+  public static GoogleCredentialsBundle createSelfSignedDelegatedCredential(
+      ImmutableList<String> defaultScopes,
+      ImmutableList<String> delegationScopes,
+      GoogleCredentialsBundle credentialsBundle,
+      String gSuiteUserEmailAddress,
+      Duration tokenRefreshDelay,
+      Clock clock) {
     GoogleCredentials signer = credentialsBundle.getGoogleCredentials();
 
     checkArgument(
@@ -118,7 +161,7 @@ public abstract class CredentialModule {
         DelegatedCredentials.createSelfSignedDelegatedCredential(
             (ServiceAccountSigner) signer,
             ImmutableList.<String>builder().addAll(defaultScopes).addAll(delegationScopes).build(),
-            gSuiteAdminAccountEmailAddress,
+            gSuiteUserEmailAddress,
             clock,
             tokenRefreshDelay);
     return GoogleCredentialsBundle.create(credential);
@@ -136,6 +179,15 @@ public abstract class CredentialModule {
   @Retention(RetentionPolicy.RUNTIME)
   public @interface GoogleWorkspaceCredential {}
 
+  /**
+   * Dagger qualifier for a credential with delegated Email-sending permission for a dasher domain
+   * (for Google Workspace) backed by the application default credential (ADC).
+   */
+  @Qualifier
+  @Documented
+  @Retention(RetentionPolicy.RUNTIME)
+  public @interface GmailDelegatedCredential {}
+
   /**
    * Dagger qualifier for a credential with delegated admin access for a dasher domain (for Google
    * Workspace) backed by the application default credential (ADC).

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -158,6 +158,12 @@ public final class RegistryConfig {
       return config.registryPolicy.contactAndHostRoidSuffix;
     }
 
+    @Provides
+    @Config("isEmailSendingEnabled")
+    public static boolean provideIsEmailSendingEnabled(RegistryConfigSettings config) {
+      return config.misc.isEmailSendingEnabled;
+    }
+
     /**
      * The e-mail address for questions about integrating with the registry. Used in the
      * "contact-us" section of the registrar console.
@@ -538,6 +544,13 @@ public final class RegistryConfig {
       return parseEmailAddress(config.gSuite.outgoingEmailAddress);
     }
 
+    // TODO(b/279671974): reuse the 'gSuiteOutgoingEmailAddress' annotation after migration
+    @Provides
+    @Config("gSuiteNewOutgoingEmailAddress")
+    public static String provideGSuiteNewOutgoingEmailAddress(RegistryConfigSettings config) {
+      return config.gSuite.newOutgoingEmailAddress;
+    }
+
     /**
      * The display name that is used on outgoing emails sent by Nomulus.
      *
@@ -549,6 +562,16 @@ public final class RegistryConfig {
       return config.gSuite.outgoingEmailDisplayName;
     }
 
+    /**
+     * Provides the `reply-to` address for outgoing email messages. This address may be outside the
+     * GSuite domain.
+     */
+    @Provides
+    @Config("replyToEmailAddress")
+    public static InternetAddress provideReplyToEmailAddress(RegistryConfigSettings config) {
+      return parseEmailAddress(config.gSuite.replyToEmailAddress);
+    }
+
     /**
      * Returns whether an SSL certificate hash is required to log in via EPP and run flows.
      *
@@ -859,6 +882,14 @@ public final class RegistryConfig {
       return parseEmailAddress(config.misc.alertRecipientEmailAddress);
     }
 
+    // TODO(b/279671974): remove below method after migration
+    @Provides
+    @Config("newAlertRecipientEmailAddress")
+    public static InternetAddress provideNewAlertRecipientEmailAddress(
+        RegistryConfigSettings config) {
+      return parseEmailAddress(config.misc.newAlertRecipientEmailAddress);
+    }
+
     /**
      * Returns the email address to which spec 11 email should be replied.
      *
@@ -1516,6 +1547,11 @@ public final class RegistryConfig {
     return CONFIG_SETTINGS.get().hibernate.connectionIsolation;
   }
 
+  /** Returns true if per-transaction isolation level is enabled. */
+  public static boolean getHibernatePerTransactionIsolationEnabled() {
+    return CONFIG_SETTINGS.get().hibernate.perTransactionIsolation;
+  }
+
   /** Returns true if hibernate.show_sql is enabled. */
   public static String getHibernateLogSqlQueries() {
     return CONFIG_SETTINGS.get().hibernate.logSqlQueries;

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -77,6 +77,9 @@ public class RegistryConfigSettings {
   public static class GSuite {
     public String domainName;
     public String outgoingEmailAddress;
+    // TODO(b/279671974): remove below field after migration
+    public String newOutgoingEmailAddress;
+    public String replyToEmailAddress;
     public String outgoingEmailDisplayName;
     public String adminAccountEmailAddress;
     public String supportGroupEmailAddress;
@@ -112,6 +115,7 @@ public class RegistryConfigSettings {
 
   /** Configuration for Hibernate. */
   public static class Hibernate {
+    public boolean perTransactionIsolation;
     public String connectionIsolation;
     public String logSqlQueries;
     public String hikariConnectionTimeout;
@@ -202,7 +206,10 @@ public class RegistryConfigSettings {
   /** Miscellaneous configuration that doesn't quite fit in anywhere else. */
   public static class Misc {
     public String sheetExportId;
+    public boolean isEmailSendingEnabled;
     public String alertRecipientEmailAddress;
+    // TODO(b/279671974): remove below field after migration
+    public String newAlertRecipientEmailAddress;
     public String spec11OutgoingEmailAddress;
     public List<String> spec11BccEmailAddresses;
     public int transientFailureRetries;

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -33,6 +33,9 @@ gSuite:
   # https://cloud.google.com/appengine/docs/standard/java/mail/#who_can_send_mail
   outgoingEmailDisplayName: Example Registry
   outgoingEmailAddress: noreply@project-id.appspotmail.com
+  # TODO(b/279671974): reuse `outgoingEmailAddress` after migration
+  newOutgoingEmailAddress: noreply@example.com
+  replyToEmailAddress: reply-to@example.com
 
   # Email address of the admin account on the G Suite app. This is used for
   # logging in to perform administrative actions, not sending emails.
@@ -186,6 +189,12 @@ registryPolicy:
   sunriseDomainCreateDiscount: 0.15
 
 hibernate:
+  # Make it possible to specify the isolation level for each transaction. If set
+  # to true, nested transactions will throw an exception. If set to false, a
+  # transaction with the isolation override specified will still execute at the
+  # default level (specified below).
+  perTransactionIsolation: false
+
   # Make 'SERIALIZABLE' the default isolation level to ensure correctness.
   #
   # Entities that are never involved in multi-table transactions may use optimistic
@@ -429,9 +438,15 @@ misc:
   # to. Leave this null to disable syncing.
   sheetExportId: null
 
+  # Whether emails may be sent. For Prod and Sandbox this should be true.
+  isEmailSendingEnabled: false
+
   # Address we send alert summary emails to.
   alertRecipientEmailAddress: email@example.com
 
+  # TODO(b/279671974): reuse `alertRecipientEmailAddress` after migration
+  newAlertRecipientEmailAddress: email@example.com
+
   # Address from which Spec 11 emails to registrars are sent. This needs
   # to be a deliverable email address to handle replies from registrars as well.
   spec11OutgoingEmailAddress: abuse@example.com
@@ -470,7 +485,7 @@ keyring:
 
 # Configuration options relevant to the "nomulus" registry tool.
 registryTool:
-  # OAuth client Id used by the tool.
+  # OAuth client ID used by the tool.
   clientId: YOUR_CLIENT_ID
   # OAuth client secret used by the tool.
   clientSecret: YOUR_CLIENT_SECRET

core/src/main/java/google/registry/config/files/nomulus-config-unittest.yaml

@@ -26,3 +26,6 @@ gSuite:
 misc:
   # We would rather have failures than timeouts, so reduce the number of retries
   transientFailureRetries: 3
+
+hibernate:
+  perTransactionIsolation: false

core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml

@@ -7,7 +7,7 @@
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <manual-scaling>
-    <instances>12</instances>
+    <instances>24</instances>
   </manual-scaling>
 
   <system-properties>

core/src/main/java/google/registry/flows/FlowModule.java

@@ -35,6 +35,8 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.eppoutput.Result;
 import google.registry.model.host.HostHistory;
 import google.registry.model.reporting.HistoryEntry;
+import google.registry.persistence.IsolationLevel;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import java.lang.annotation.Documented;
 import java.util.Optional;
 import javax.inject.Qualifier;
@@ -135,6 +137,14 @@ public class FlowModule {
     return TransactionalFlow.class.isAssignableFrom(flowClass);
   }
 
+  @Provides
+  @FlowScope
+  Optional<TransactionIsolationLevel> provideIsolationLevelOverride(
+      Class<? extends Flow> flowClass) {
+    return Optional.ofNullable(flowClass.getAnnotation(IsolationLevel.class))
+        .map(IsolationLevel::value);
+  }
+
   @Provides
   @FlowScope
   @Superuser
@@ -166,7 +176,7 @@ public class FlowModule {
   @FlowScope
   @RegistrarId
   static String provideRegistrarId(SessionMetadata sessionMetadata) {
-    // Treat a missing registrarId as null so we can always inject a non-null value. All we do with
+    // Treat a missing registrarId as null, so we can always inject a non-null value. All we do with
     // the registrarId is log it (as "") or detect its absence, both of which work fine with empty.
     return Strings.nullToEmpty(sessionMetadata.getRegistrarId());
   }

core/src/main/java/google/registry/flows/FlowRunner.java

@@ -28,6 +28,8 @@ import google.registry.flows.session.LoginFlow;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.monitoring.whitebox.EppMetric;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import java.util.Optional;
 import javax.inject.Inject;
 import javax.inject.Provider;
 
@@ -42,6 +44,7 @@ public class FlowRunner {
   @Inject TransportCredentials credentials;
   @Inject EppRequestSource eppRequestSource;
   @Inject Provider<Flow> flowProvider;
+  @Inject Optional<TransactionIsolationLevel> isolationLevelOverride;
   @Inject Class<? extends Flow> flowClass;
   @Inject @InputXml byte[] inputXmlBytes;
   @Inject @DryRun boolean isDryRun;
@@ -91,7 +94,8 @@ public class FlowRunner {
                 } catch (EppException e) {
                   throw new EppRuntimeException(e);
                 }
-              });
+              },
+              isolationLevelOverride.orElse(null));
     } catch (DryRunException e) {
       return e.output;
     } catch (EppRuntimeException e) {

core/src/main/java/google/registry/flows/domain/DomainInfoFlow.java

@@ -41,10 +41,10 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Info;
 import google.registry.model.domain.DomainCommand.Info.HostsRequest;
 import google.registry.model.domain.DomainInfoData;
+import google.registry.model.domain.bulktoken.BulkTokenExtension;
+import google.registry.model.domain.bulktoken.BulkTokenResponseExtension;
 import google.registry.model.domain.fee06.FeeInfoCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeInfoResponseExtensionV06;
-import google.registry.model.domain.packagetoken.PackageTokenExtension;
-import google.registry.model.domain.packagetoken.PackageTokenResponseExtension;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.rgp.RgpInfoExtension;
 import google.registry.model.eppcommon.AuthInfo;
@@ -95,7 +95,7 @@ public final class DomainInfoFlow implements Flow {
 
   @Override
   public EppResponse run() throws EppException {
-    extensionManager.register(FeeInfoCommandExtensionV06.class, PackageTokenExtension.class);
+    extensionManager.register(FeeInfoCommandExtensionV06.class, BulkTokenExtension.class);
     flowCustomLogic.beforeValidation();
     validateRegistrarIsLoggedIn(registrarId);
     extensionManager.validate();
@@ -155,13 +155,13 @@ public final class DomainInfoFlow implements Flow {
     if (!gracePeriodStatuses.isEmpty()) {
       extensions.add(RgpInfoExtension.create(gracePeriodStatuses));
     }
-    Optional<PackageTokenExtension> packageInfo =
-        eppInput.getSingleExtension(PackageTokenExtension.class);
+    Optional<BulkTokenExtension> packageInfo =
+        eppInput.getSingleExtension(BulkTokenExtension.class);
     if (packageInfo.isPresent()) {
       // Package info was requested.
       if (isSuperuser || registrarId.equals(domain.getCurrentSponsorRegistrarId())) {
         // Only show package info to owning registrar or superusers
-        extensions.add(PackageTokenResponseExtension.create(domain.getCurrentPackageToken()));
+        extensions.add(BulkTokenResponseExtension.create(domain.getCurrentPackageToken()));
       }
     }
     Optional<FeeInfoCommandExtensionV06> feeInfo =

core/src/main/java/google/registry/flows/domain/DomainRenewFlow.java

@@ -53,6 +53,8 @@ import google.registry.flows.custom.DomainRenewFlowCustomLogic.BeforeResponseRet
 import google.registry.flows.custom.DomainRenewFlowCustomLogic.BeforeSaveParameters;
 import google.registry.flows.custom.EntityChanges;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemoveDomainTokenOnPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemoveDomainTokenOnNonPackageDomainException;
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
@@ -119,10 +121,8 @@ import org.joda.time.Duration;
  * @error {@link DomainFlowUtils.RegistrarMustBeActiveForThisOperationException}
  * @error {@link DomainFlowUtils.UnsupportedFeeAttributeException}
  * @error {@link DomainRenewFlow.IncorrectCurrentExpirationDateException}
- * @error {@link
- *     google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemovePackageTokenOnPackageDomainException}
- * @error {@link
- *     google.registry.flows.domain.token.AllocationTokenFlowUtils.RemovePackageTokenOnNonPackageDomainException}
+ * @error {@link MissingRemoveDomainTokenOnPackageDomainException}
+ * @error {@link RemoveDomainTokenOnNonPackageDomainException}
  * @error {@link
  *     google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForDomainException}
  * @error {@link

core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java

@@ -243,21 +243,21 @@ public class AllocationTokenFlowUtils {
       Domain domain, Optional<AllocationToken> allocationToken) throws EppException {
 
     boolean domainHasPackageToken = domain.getCurrentPackageToken().isPresent();
-    boolean hasRemovePackageToken =
+    boolean hasRemoveDomainToken =
         allocationToken.isPresent()
-            && TokenBehavior.REMOVE_PACKAGE.equals(allocationToken.get().getTokenBehavior());
+            && TokenBehavior.REMOVE_DOMAIN.equals(allocationToken.get().getTokenBehavior());
 
-    if (hasRemovePackageToken && !domainHasPackageToken) {
-      throw new RemovePackageTokenOnNonPackageDomainException();
-    } else if (!hasRemovePackageToken && domainHasPackageToken) {
-      throw new MissingRemovePackageTokenOnPackageDomainException();
+    if (hasRemoveDomainToken && !domainHasPackageToken) {
+      throw new RemoveDomainTokenOnNonPackageDomainException();
+    } else if (!hasRemoveDomainToken && domainHasPackageToken) {
+      throw new MissingRemoveDomainTokenOnPackageDomainException();
     }
   }
 
   public static Domain maybeApplyPackageRemovalToken(
       Domain domain, Optional<AllocationToken> allocationToken) {
     if (!allocationToken.isPresent()
-        || !TokenBehavior.REMOVE_PACKAGE.equals(allocationToken.get().getTokenBehavior())) {
+        || !TokenBehavior.REMOVE_DOMAIN.equals(allocationToken.get().getTokenBehavior())) {
       return domain;
     }
 
@@ -338,19 +338,19 @@ public class AllocationTokenFlowUtils {
     }
   }
 
-  /** The __REMOVEPACKAGE__ token is missing on a package domain command */
-  public static class MissingRemovePackageTokenOnPackageDomainException
+  /** The __REMOVEDOMAIN__ token is missing on a package domain command */
+  public static class MissingRemoveDomainTokenOnPackageDomainException
       extends AssociationProhibitsOperationException {
-    MissingRemovePackageTokenOnPackageDomainException() {
+    MissingRemoveDomainTokenOnPackageDomainException() {
       super("Domains that are inside packages cannot be explicitly renewed or transferred");
     }
   }
 
-  /** The __REMOVEPACKAGE__ token is not allowed on non package domains */
-  public static class RemovePackageTokenOnNonPackageDomainException
+  /** The __REMOVEDOMAIN__ token is not allowed on non package domains */
+  public static class RemoveDomainTokenOnNonPackageDomainException
       extends AssociationProhibitsOperationException {
-    RemovePackageTokenOnNonPackageDomainException() {
-      super("__REMOVEPACKAGE__ token is not allowed on non package domains");
+    RemoveDomainTokenOnNonPackageDomainException() {
+      super("__REMOVEDOMAIN__ token is not allowed on non package domains");
     }
   }
 }

core/src/main/java/google/registry/groups/GmailClient.java

@@ -14,17 +14,24 @@
 
 package google.registry.groups;
 
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Iterables.toArray;
 
+import com.google.api.client.http.HttpResponseException;
 import com.google.api.services.gmail.Gmail;
 import com.google.api.services.gmail.model.Message;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
-import com.google.errorprone.annotations.CanIgnoreReturnValue;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.util.EmailMessage;
 import google.registry.util.EmailMessage.Attachment;
+import google.registry.util.Retrier;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.UnsupportedEncodingException;
 import java.util.Properties;
+import java.util.function.Predicate;
 import javax.inject.Inject;
 import javax.mail.Address;
 import javax.mail.BodyPart;
@@ -36,16 +43,37 @@ import javax.mail.internet.InternetAddress;
 import javax.mail.internet.MimeBodyPart;
 import javax.mail.internet.MimeMessage;
 import javax.mail.internet.MimeMultipart;
-import org.apache.commons.codec.binary.Base64;
 
 /** Sends {@link EmailMessage EmailMessages} through Google Workspace using {@link Gmail}. */
 public final class GmailClient {
 
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
   private final Gmail gmail;
+  private final Retrier retrier;
+  private final boolean isEmailSendingEnabled;
+  private final InternetAddress outgoingEmailAddressWithUsername;
+  private final InternetAddress replyToEmailAddress;
 
   @Inject
-  GmailClient(Gmail gmail) {
+  GmailClient(
+      Gmail gmail,
+      Retrier retrier,
+      @Config("isEmailSendingEnabled") boolean isEmailSendingEnabled,
+      @Config("gSuiteNewOutgoingEmailAddress") String gSuiteOutgoingEmailAddress,
+      @Config("gSuiteOutgoingEmailDisplayName") String gSuiteOutgoingEmailDisplayName,
+      @Config("replyToEmailAddress") InternetAddress replyToEmailAddress) {
+
     this.gmail = gmail;
+    this.retrier = retrier;
+    this.isEmailSendingEnabled = isEmailSendingEnabled;
+    this.replyToEmailAddress = replyToEmailAddress;
+    try {
+      this.outgoingEmailAddressWithUsername =
+          new InternetAddress(gSuiteOutgoingEmailAddress, gSuiteOutgoingEmailDisplayName);
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
   }
 
   /**
@@ -54,14 +82,25 @@ public final class GmailClient {
    * <p>If the sender as specified by {@link EmailMessage#from} differs from the caller's identity,
    * the caller must have delegated `send` authority to the sender.
    */
-  @CanIgnoreReturnValue
-  public Message sendEmail(EmailMessage emailMessage) {
-    Message message = toGmailMessage(toMimeMessage(emailMessage));
-    try {
-      return gmail.users().messages().send("me", message).execute();
-    } catch (IOException e) {
-      throw new EmailException(e);
+  public void sendEmail(EmailMessage emailMessage) {
+    if (!isEmailSendingEnabled) {
+      logger.atInfo().log(
+          String.format(
+              "Email with subject %s would have been sent to recipients %s",
+              emailMessage.subject().substring(0, Math.min(emailMessage.subject().length(), 15)),
+              String.join(
+                  " , ",
+                  emailMessage.recipients().stream()
+                      .map(ia -> ia.toString())
+                      .collect(toImmutableSet()))));
+      return;
     }
+    Message message = toGmailMessage(toMimeMessage(emailMessage));
+    // Unlike other Cloud APIs such as GCS and SecretManager, Gmail does not retry on errors.
+    retrier.callWithRetry(
+        // "me" is reserved word for the authorized user of the Gmail API.
+        () -> this.gmail.users().messages().send("me", message).execute(),
+        RetriableGmailExceptionPredicate.INSTANCE);
   }
 
   static Message toGmailMessage(MimeMessage message) {
@@ -69,20 +108,18 @@ public final class GmailClient {
       ByteArrayOutputStream buffer = new ByteArrayOutputStream();
       message.writeTo(buffer);
       byte[] rawMessageBytes = buffer.toByteArray();
-      String encodedEmail = Base64.encodeBase64URLSafeString(rawMessageBytes);
-      Message gmailMessage = new Message();
-      gmailMessage.setRaw(encodedEmail);
-      return gmailMessage;
+      return new Message().encodeRaw(rawMessageBytes);
     } catch (MessagingException | IOException e) {
       throw new EmailException(e);
     }
   }
 
-  static MimeMessage toMimeMessage(EmailMessage emailMessage) {
+  MimeMessage toMimeMessage(EmailMessage emailMessage) {
     try {
       MimeMessage msg =
           new MimeMessage(Session.getDefaultInstance(new Properties(), /* authenticator= */ null));
-      msg.setFrom(emailMessage.from());
+      msg.setFrom(this.outgoingEmailAddressWithUsername);
+      msg.setReplyTo(new InternetAddress[] {replyToEmailAddress});
       msg.addRecipients(
           RecipientType.TO, toArray(emailMessage.recipients(), InternetAddress.class));
       msg.setSubject(emailMessage.subject());
@@ -117,4 +154,41 @@ public final class GmailClient {
       super(cause);
     }
   }
+
+  /**
+   * Determines if a Gmail API exception may be retried.
+   *
+   * <p>See <a href="https://developers.google.com/gmail/api/guides/handle-errors">online doc</a>
+   * for details.
+   */
+  static class RetriableGmailExceptionPredicate implements Predicate<Throwable> {
+
+    static RetriableGmailExceptionPredicate INSTANCE = new RetriableGmailExceptionPredicate();
+
+    private static final int USAGE_LIMIT_EXCEEDED = 403;
+    private static final int TOO_MANY_REQUESTS = 429;
+    private static final int BACKEND_ERROR = 500;
+
+    private static final ImmutableSet<String> TRANSIENT_OVERAGE_REASONS =
+        ImmutableSet.of("userRateLimitExceeded", "rateLimitExceeded");
+
+    @Override
+    public boolean test(Throwable e) {
+      if (e instanceof HttpResponseException) {
+        return testHttpResponse((HttpResponseException) e);
+      }
+      return true;
+    }
+
+    private boolean testHttpResponse(HttpResponseException e) {
+      int statusCode = e.getStatusCode();
+      if (statusCode == TOO_MANY_REQUESTS || statusCode == BACKEND_ERROR) {
+        return true;
+      }
+      if (statusCode == USAGE_LIMIT_EXCEEDED) {
+        return TRANSIENT_OVERAGE_REASONS.contains(e.getStatusMessage());
+      }
+      return false;
+    }
+  }
 }

core/src/main/java/google/registry/groups/GmailModule.java

@@ -17,7 +17,7 @@ package google.registry.groups;
 import com.google.api.services.gmail.Gmail;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.config.CredentialModule.AdcDelegatedCredential;
+import google.registry.config.CredentialModule.GmailDelegatedCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
 import javax.inject.Singleton;
@@ -29,7 +29,7 @@ public class GmailModule {
   @Provides
   @Singleton
   Gmail provideGmail(
-      @AdcDelegatedCredential GoogleCredentialsBundle credentialsBundle,
+      @GmailDelegatedCredential GoogleCredentialsBundle credentialsBundle,
       @Config("projectId") String projectId) {
     return new Gmail.Builder(
             credentialsBundle.getHttpTransport(),

core/src/main/java/google/registry/model/EntityYamlUtils.java

@@ -11,7 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-package google.registry.model.tld;
+package google.registry.model;
 
 import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static com.google.common.collect.Ordering.natural;
@@ -27,7 +27,6 @@ import com.fasterxml.jackson.databind.module.SimpleModule;
 import com.fasterxml.jackson.databind.ser.std.StdSerializer;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
 import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator.Feature;
-import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.tld.Tld.TldState;
@@ -44,14 +43,13 @@ import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
-/** A collection of static utility classes and functions for TLD YAML conversions. */
-public class TldYamlUtils {
+/** A collection of static utility classes/functions to convert entities to/from YAML files. */
+public class EntityYamlUtils {
 
   /**
-   * Returns an {@link ObjectMapper} object that can be used to convert a {@link Tld} object to and
-   * from YAML.
+   * Returns a new {@link ObjectMapper} object that can be used to convert an entity to/from YAML.
    */
-  public static ObjectMapper getObjectMapper() {
+  public static ObjectMapper createObjectMapper() {
     SimpleModule module = new SimpleModule();
     module.addSerializer(Money.class, new MoneySerializer());
     module.addDeserializer(Money.class, new MoneyDeserializer());
@@ -86,6 +84,7 @@ public class TldYamlUtils {
 
   /** A custom JSON deserializer for {@link Money}. */
   public static class MoneyDeserializer extends StdDeserializer<Money> {
+
     public MoneyDeserializer() {
       this(null);
     }
@@ -127,6 +126,7 @@ public class TldYamlUtils {
 
   /** A custom JSON deserializer for {@link CurrencyUnit}. */
   public static class CurrencyDeserializer extends StdDeserializer<CurrencyUnit> {
+
     public CurrencyDeserializer() {
       this(null);
     }

core/src/main/java/google/registry/model/ModelModule.java

@@ -0,0 +1,30 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import dagger.Module;
+import dagger.Provides;
+
+/** Dagger module for the entity (model) classes. */
+@Module
+public final class ModelModule {
+
+  /** Returns an {@link ObjectMapper} object that can be used to convert an entity to/from YAML. */
+  @Provides
+  public static ObjectMapper provideObjectMapper() {
+    return EntityYamlUtils.createObjectMapper();
+  }
+}

core/src/main/java/google/registry/model/adapters/CurrencyJsonAdapter.java

@@ -0,0 +1,32 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.adapters;
+
+import google.registry.model.adapters.CurrencyUnitAdapter.UnknownCurrencyException;
+import google.registry.util.StringBaseTypeAdapter;
+import java.io.IOException;
+import org.joda.money.CurrencyUnit;
+
+public class CurrencyJsonAdapter extends StringBaseTypeAdapter<CurrencyUnit> {
+
+  @Override
+  protected CurrencyUnit fromString(String stringValue) throws IOException {
+    try {
+      return CurrencyUnitAdapter.convertFromString(stringValue);
+    } catch (UnknownCurrencyException e) {
+      throw new IOException("Unknown currency");
+    }
+  }
+}

core/src/main/java/google/registry/model/adapters/CurrencyUnitAdapter.java

@@ -1,4 +1,4 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -22,9 +22,7 @@ import org.joda.money.CurrencyUnit;
 /** Adapter to use Joda {@link CurrencyUnit} when marshalling strings. */
 public class CurrencyUnitAdapter extends XmlAdapter<String, CurrencyUnit> {
 
-  /** Parses a string into a {@link CurrencyUnit} object. */
-  @Override
-  public CurrencyUnit unmarshal(String currency) throws UnknownCurrencyException {
+  public static CurrencyUnit convertFromString(String currency) throws UnknownCurrencyException {
     try {
       return CurrencyUnit.of(nullToEmpty(currency).trim());
     } catch (IllegalArgumentException e) {
@@ -32,10 +30,20 @@ public class CurrencyUnitAdapter extends XmlAdapter<String, CurrencyUnit> {
     }
   }
 
+  public static String convertFromCurrency(CurrencyUnit currency) {
+    return currency == null ? null : currency.toString();
+  }
+
+  /** Parses a string into a {@link CurrencyUnit} object. */
+  @Override
+  public CurrencyUnit unmarshal(String currency) throws UnknownCurrencyException {
+    return convertFromString(currency);
+  }
+
   /** Converts {@link CurrencyUnit} to a string. */
   @Override
   public String marshal(CurrencyUnit currency) {
-    return currency == null ? null : currency.toString();
+    return convertFromCurrency(currency);
   }
 
   /** Exception to throw when failing to parse a currency. */

core/src/main/java/google/registry/model/domain/bulktoken/BulkTokenExtension.java

@@ -12,12 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;
 
 import google.registry.model.ImmutableObject;
 import google.registry.model.eppinput.EppInput.CommandExtension;
 import javax.xml.bind.annotation.XmlRootElement;
 
-/** A package token extension that may be present on EPP domain commands. */
+/** A bulk token extension that may be present on EPP domain commands. */
 @XmlRootElement(name = "info")
-public class PackageTokenExtension extends ImmutableObject implements CommandExtension {}
+public class BulkTokenExtension extends ImmutableObject implements CommandExtension {}

core/src/main/java/google/registry/model/domain/bulktoken/BulkTokenResponseExtension.java

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;
 
 import google.registry.model.ImmutableObject;
 import google.registry.model.domain.token.AllocationToken;
@@ -24,18 +24,18 @@ import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 
 /**
- * An XML data object that represents a package token extension that may be present on the response
- * to EPP domain info commands.
+ * An XML data object that represents a bulk token extension that may be present on the response to
+ * EPP domain info commands.
  */
-@XmlRootElement(name = "packageData")
-public class PackageTokenResponseExtension extends ImmutableObject implements ResponseExtension {
+@XmlRootElement(name = "bulkData")
+public class BulkTokenResponseExtension extends ImmutableObject implements ResponseExtension {
 
   /** Token string of the PACKAGE token the name belongs to. */
   @XmlJavaTypeAdapter(TrimWhitespaceAdapter.class)
   String token;
 
-  public static PackageTokenResponseExtension create(Optional<VKey<AllocationToken>> tokenKey) {
-    PackageTokenResponseExtension instance = new PackageTokenResponseExtension();
+  public static BulkTokenResponseExtension create(Optional<VKey<AllocationToken>> tokenKey) {
+    BulkTokenResponseExtension instance = new BulkTokenResponseExtension();
     instance.token = "";
     if (tokenKey.isPresent()) {
       instance.token = tokenKey.get().getKey().toString();

core/src/main/java/google/registry/model/domain/bulktoken/package-info.java

@@ -13,12 +13,11 @@
 // limitations under the License.
 
 @XmlSchema(
-    namespace = "urn:google:params:xml:ns:packageToken-1.0",
-    xmlns =
-        @XmlNs(prefix = "packageToken", namespaceURI = "urn:google:params:xml:ns:packageToken-1.0"),
+    namespace = "urn:google:params:xml:ns:bulkToken-1.0",
+    xmlns = @XmlNs(prefix = "bulkToken", namespaceURI = "urn:google:params:xml:ns:bulkToken-1.0"),
     elementFormDefault = XmlNsForm.QUALIFIED)
 @XmlAccessorType(XmlAccessType.FIELD)
-package google.registry.model.domain.packagetoken;
+package google.registry.model.domain.bulktoken;
 
 import javax.xml.bind.annotation.XmlAccessType;
 import javax.xml.bind.annotation.XmlAccessorType;

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -77,10 +77,10 @@ import org.joda.time.DateTime;
 public class AllocationToken extends UpdateAutoTimestampEntity implements Buildable {
 
   private static final long serialVersionUID = -3954475393220876903L;
-  private static final String REMOVE_PACKAGE = "__REMOVEPACKAGE__";
+  private static final String REMOVE_DOMAIN = "__REMOVEDOMAIN__";
 
   private static final ImmutableMap<String, TokenBehavior> STATIC_TOKEN_BEHAVIORS =
-      ImmutableMap.of(REMOVE_PACKAGE, TokenBehavior.REMOVE_PACKAGE);
+      ImmutableMap.of(REMOVE_DOMAIN, TokenBehavior.REMOVE_DOMAIN);
 
   // Promotions should only move forward, and ENDED / CANCELLED are terminal states.
   private static final ImmutableMultimap<TokenStatus, TokenStatus> VALID_TOKEN_STATUS_TRANSITIONS =
@@ -91,10 +91,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
 
   private static final ImmutableMap<String, AllocationToken> BEHAVIORAL_TOKENS =
       ImmutableMap.of(
-          REMOVE_PACKAGE,
+          REMOVE_DOMAIN,
           new AllocationToken.Builder()
               .setTokenType(TokenType.UNLIMITED_USE)
-              .setToken(REMOVE_PACKAGE)
+              .setToken(REMOVE_DOMAIN)
               .build());
 
   public static Optional<AllocationToken> maybeGetStaticTokenInstance(String name) {
@@ -137,10 +137,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
     /** No special behavior */
     DEFAULT,
     /**
-     * REMOVE_PACKAGE triggers domain removal from promotional package, bypasses DEFAULT token
-     * validations.
+     * REMOVE_DOMAIN triggers domain removal from promotional bulk (package) pricing, bypasses
+     * DEFAULT token validations.
      */
-    REMOVE_PACKAGE
+    REMOVE_DOMAIN
   }
 
   /** The status of this token with regard to any potential promotion. */

core/src/main/java/google/registry/model/eppcommon/Address.java

@@ -20,6 +20,7 @@ import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
+import com.google.gson.annotations.Expose;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import google.registry.model.JsonMapBuilder;
@@ -87,6 +88,7 @@ public class Address extends ImmutableObject implements Jsonifiable, UnsafeSeria
    */
   @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
   @Transient
+  @Expose
   protected List<String> street;
 
   @XmlTransient @IgnoredInDiffableMap protected String streetLine1;
@@ -96,18 +98,22 @@ public class Address extends ImmutableObject implements Jsonifiable, UnsafeSeria
   @XmlTransient @IgnoredInDiffableMap protected String streetLine3;
 
   @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
+  @Expose
   protected String city;
 
   @XmlElement(name = "sp")
   @XmlJavaTypeAdapter(NormalizedStringAdapter.class)
+  @Expose
   protected String state;
 
   @XmlElement(name = "pc")
   @XmlJavaTypeAdapter(CollapsedStringAdapter.class)
+  @Expose
   protected String zip;
 
   @XmlElement(name = "cc")
   @XmlJavaTypeAdapter(CollapsedStringAdapter.class)
+  @Expose
   protected String countryCode;
 
   public ImmutableList<String> getStreet() {

core/src/main/java/google/registry/model/eppcommon/EppXmlTransformer.java

@@ -51,7 +51,7 @@ public class EppXmlTransformer  {
           "allocate.xsd",
           "superuser.xsd",
           "allocationToken-1.0.xsd",
-          "packageToken.xsd");
+          "bulkToken.xsd");
 
   private static final XmlTransformer INPUT_TRANSFORMER =
       new XmlTransformer(SCHEMAS, EppInput.class);

core/src/main/java/google/registry/model/eppinput/EppInput.java

@@ -23,6 +23,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.model.ImmutableObject;
 import google.registry.model.contact.ContactCommand;
 import google.registry.model.domain.DomainCommand;
+import google.registry.model.domain.bulktoken.BulkTokenExtension;
 import google.registry.model.domain.fee06.FeeCheckCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeCreateCommandExtensionV06;
 import google.registry.model.domain.fee06.FeeInfoCommandExtensionV06;
@@ -45,7 +46,6 @@ import google.registry.model.domain.launch.LaunchDeleteExtension;
 import google.registry.model.domain.launch.LaunchInfoExtension;
 import google.registry.model.domain.launch.LaunchUpdateExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.domain.packagetoken.PackageTokenExtension;
 import google.registry.model.domain.rgp.RgpUpdateExtension;
 import google.registry.model.domain.secdns.SecDnsCreateExtension;
 import google.registry.model.domain.secdns.SecDnsUpdateExtension;
@@ -362,8 +362,8 @@ public class EppInput extends ImmutableObject {
 
       // Other extensions
       @XmlElementRef(type = AllocationTokenExtension.class),
+      @XmlElementRef(type = BulkTokenExtension.class),
       @XmlElementRef(type = MetadataExtension.class),
-      @XmlElementRef(type = PackageTokenExtension.class),
       @XmlElementRef(type = RgpUpdateExtension.class),
       @XmlElementRef(type = SecDnsCreateExtension.class),
       @XmlElementRef(type = SecDnsUpdateExtension.class)

core/src/main/java/google/registry/model/eppoutput/EppResponse.java

@@ -23,6 +23,7 @@ import google.registry.model.ImmutableObject;
 import google.registry.model.contact.ContactInfoData;
 import google.registry.model.domain.DomainInfoData;
 import google.registry.model.domain.DomainRenewData;
+import google.registry.model.domain.bulktoken.BulkTokenResponseExtension;
 import google.registry.model.domain.fee06.FeeCheckResponseExtensionV06;
 import google.registry.model.domain.fee06.FeeCreateResponseExtensionV06;
 import google.registry.model.domain.fee06.FeeDeleteResponseExtensionV06;
@@ -43,7 +44,6 @@ import google.registry.model.domain.fee12.FeeRenewResponseExtensionV12;
 import google.registry.model.domain.fee12.FeeTransferResponseExtensionV12;
 import google.registry.model.domain.fee12.FeeUpdateResponseExtensionV12;
 import google.registry.model.domain.launch.LaunchCheckResponseExtension;
-import google.registry.model.domain.packagetoken.PackageTokenResponseExtension;
 import google.registry.model.domain.rgp.RgpInfoExtension;
 import google.registry.model.domain.secdns.SecDnsInfoExtension;
 import google.registry.model.eppcommon.Trid;
@@ -122,6 +122,7 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
 
   /** Zero or more response extensions. */
   @XmlElementRefs({
+    @XmlElementRef(type = BulkTokenResponseExtension.class),
     @XmlElementRef(type = FeeCheckResponseExtensionV06.class),
     @XmlElementRef(type = FeeInfoResponseExtensionV06.class),
     @XmlElementRef(type = FeeCreateResponseExtensionV06.class),
@@ -142,7 +143,6 @@ public class EppResponse extends ImmutableObject implements ResponseOrGreeting {
     @XmlElementRef(type = FeeTransferResponseExtensionV12.class),
     @XmlElementRef(type = FeeUpdateResponseExtensionV12.class),
     @XmlElementRef(type = LaunchCheckResponseExtension.class),
-    @XmlElementRef(type = PackageTokenResponseExtension.class),
     @XmlElementRef(type = RgpInfoExtension.class),
     @XmlElementRef(type = SecDnsInfoExtension.class)
   })

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -211,6 +211,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    */
   @Id
   @Column(nullable = false)
+  @Expose
   String registrarId;
 
   /**
@@ -224,6 +225,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    * @see <a href="http://www.icann.org/registrar-reports/accredited-list.html">ICANN-Accredited
    *     Registrars</a>
    */
+  @Expose
   @Column(nullable = false)
   String registrarName;
 
@@ -237,7 +239,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   State state;
 
   /** The set of TLDs which this registrar is allowed to access. */
-  Set<String> allowedTlds;
+  @Expose Set<String> allowedTlds;
 
   /** Host name of WHOIS server. */
   String whoisServer;
@@ -287,6 +289,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    * unrestricted UTF-8.
    */
   @Embedded
+  @Expose
   @AttributeOverrides({
     @AttributeOverride(
         name = "streetLine1",
@@ -329,7 +332,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   String faxNumber;
 
   /** Email address. */
-  String emailAddress;
+  @Expose String emailAddress;
 
   // External IDs.
 
@@ -345,7 +348,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    * @see <a href="http://www.iana.org/assignments/registrar-ids/registrar-ids.txt">Registrar
    *     IDs</a>
    */
-  @Nullable Long ianaIdentifier;
+  @Expose @Nullable Long ianaIdentifier;
 
   /** Purchase Order number used for invoices in external billing system, if applicable. */
   @Nullable String poNumber;
@@ -358,7 +361,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    * accessed by {@link #getBillingAccountMap}, a sorted map is returned to guarantee deterministic
    * behavior when serializing the map, for display purpose for instance.
    */
-  @Nullable Map<CurrencyUnit, String> billingAccountMap;
+  @Expose @Nullable Map<CurrencyUnit, String> billingAccountMap;
 
   /** URL of registrar's website. */
   String url;
@@ -369,10 +372,10 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
    * <p>This value is specified in the initial registrar contact. It can't be edited in the web GUI,
    * and it must be specified when the registrar account is created.
    */
-  String icannReferralEmail;
+  @Expose String icannReferralEmail;
 
   /** Id of the folder in drive used to publish information for this registrar. */
-  String driveFolderId;
+  @Expose String driveFolderId;
 
   // Metadata.
 
@@ -400,7 +403,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   boolean contactsRequireSyncing = true;
 
   /** Whether or not registry lock is allowed for this registrar. */
-  boolean registryLockAllowed = false;
+  @Expose boolean registryLockAllowed = false;
 
   public String getRegistrarId() {
     return registrarId;

core/src/main/java/google/registry/model/tld/Tld.java

@@ -45,6 +45,15 @@ import com.google.common.net.InternetDomainName;
 import google.registry.model.Buildable;
 import google.registry.model.CacheUtils;
 import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.EntityYamlUtils.CreateAutoTimestampDeserializer;
+import google.registry.model.EntityYamlUtils.CurrencyDeserializer;
+import google.registry.model.EntityYamlUtils.CurrencySerializer;
+import google.registry.model.EntityYamlUtils.OptionalDurationSerializer;
+import google.registry.model.EntityYamlUtils.OptionalStringSerializer;
+import google.registry.model.EntityYamlUtils.TimedTransitionPropertyMoneyDeserializer;
+import google.registry.model.EntityYamlUtils.TimedTransitionPropertyTldStateDeserializer;
+import google.registry.model.EntityYamlUtils.TokenVKeyListDeserializer;
+import google.registry.model.EntityYamlUtils.TokenVKeyListSerializer;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import google.registry.model.common.TimedTransitionProperty;
@@ -52,15 +61,6 @@ import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.TokenType;
-import google.registry.model.tld.TldYamlUtils.CreateAutoTimestampDeserializer;
-import google.registry.model.tld.TldYamlUtils.CurrencyDeserializer;
-import google.registry.model.tld.TldYamlUtils.CurrencySerializer;
-import google.registry.model.tld.TldYamlUtils.OptionalDurationSerializer;
-import google.registry.model.tld.TldYamlUtils.OptionalStringSerializer;
-import google.registry.model.tld.TldYamlUtils.TimedTransitionPropertyMoneyDeserializer;
-import google.registry.model.tld.TldYamlUtils.TimedTransitionPropertyTldStateDeserializer;
-import google.registry.model.tld.TldYamlUtils.TokenVKeyListDeserializer;
-import google.registry.model.tld.TldYamlUtils.TokenVKeyListSerializer;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.persistence.VKey;

core/src/main/java/google/registry/persistence/IsolationLevel.java

@@ -0,0 +1,33 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * Indicates which {@link TransactionIsolationLevel} that a {@link
+ * google.registry.flows.TransactionalFlow} show run at.
+ */
+@Documented
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.TYPE)
+public @interface IsolationLevel {
+  TransactionIsolationLevel value();
+}

core/src/main/java/google/registry/persistence/PersistenceModule.java

@@ -27,9 +27,9 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 
 import com.google.auth.oauth2.GoogleCredentials;
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Ascii;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Maps;
-import com.google.common.flogger.FluentLogger;
 import dagger.BindsOptionalOf;
 import dagger.Module;
 import dagger.Provides;
@@ -65,7 +65,6 @@ import org.hibernate.cfg.Environment;
 /** Dagger module class for the persistence layer. */
 @Module
 public abstract class PersistenceModule {
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   // This name must be the same as the one defined in persistence.xml.
   public static final String PERSISTENCE_UNIT_NAME = "nomulus";
@@ -166,12 +165,10 @@ public abstract class PersistenceModule {
     // Override the default minimum which is tuned for the Registry server. A worker VM should
     // release all connections if it no longer interacts with the database.
     overrides.put(HIKARI_MINIMUM_IDLE, "0");
-    /**
-     * Disable Hikari's maxPoolSize limit check by setting it to an absurdly large number. The
-     * effective (and desirable) limit is the number of pipeline threads on the pipeline worker,
-     * which can be configured using pipeline options. See {@link RegistryPipelineOptions} for more
-     * information.
-     */
+    // Disable Hikari's maxPoolSize limit check by setting it to an absurdly large number. The
+    // effective (and desirable) limit is the number of pipeline threads on the pipeline worker,
+    // which can be configured using pipeline options. See {@link RegistryPipelineOptions} for more
+    // information.
     overrides.put(HIKARI_MAXIMUM_POOL_SIZE, String.valueOf(Integer.MAX_VALUE));
     instanceConnectionNameOverride
         .map(Provider::get)
@@ -303,7 +300,7 @@ public abstract class PersistenceModule {
 
   private static EntityManagerFactory create(Map<String, String> properties) {
     // If there are no annotated classes, we can create the EntityManagerFactory from the generic
-    // method.  Otherwise we have to use a more tailored approach.  Note that this adds to the set
+    // method.  Otherwise, we have to use a more tailored approach.  Note that this adds to the set
     // of annotated classes defined in the configuration, it does not override them.
     EntityManagerFactory emf =
         Persistence.createEntityManagerFactory(
@@ -322,8 +319,7 @@ public abstract class PersistenceModule {
       overrides.put(Environment.USER, credential.login());
       overrides.put(Environment.PASS, credential.password());
     } catch (Throwable e) {
-      // TODO(b/184631990): after SQL becomes primary, throw an exception to fail fast
-      logger.atSevere().withCause(e).log("Failed to get SQL credential from Secret Manager.");
+      throw new RuntimeException("Failed to get SQL credential from Secret Manager.", e);
     }
   }
 
@@ -340,11 +336,13 @@ public abstract class PersistenceModule {
     TRANSACTION_SERIALIZABLE;
 
     private final int value;
+    private final String mode;
 
     TransactionIsolationLevel() {
       try {
         // name() is final in parent class (Enum.java), therefore safe to call in constructor.
         value = Connection.class.getField(name()).getInt(null);
+        mode = name().substring(12).replace('_', ' ');
       } catch (Exception e) {
         throw new IllegalStateException(
             String.format(
@@ -356,6 +354,14 @@ public abstract class PersistenceModule {
     public final int getValue() {
       return value;
     }
+
+    public final String getMode() {
+      return mode;
+    }
+
+    public static TransactionIsolationLevel fromMode(String mode) {
+      return valueOf(String.format("TRANSACTION_%s", Ascii.toUpperCase(mode.replace(' ', '_'))));
+    }
   }
 
   /** Types of {@link JpaTransactionManager JpaTransactionManagers}. */

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManager.java

@@ -14,6 +14,7 @@
 
 package google.registry.persistence.transaction;
 
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import java.util.function.Supplier;
 import javax.persistence.EntityManager;
@@ -31,21 +32,6 @@ public interface JpaTransactionManager extends TransactionManager {
    */
   EntityManager getStandaloneEntityManager();
 
-  /**
-   * Specifies a database snapshot exported by another transaction to use in the current
-   * transaction.
-   *
-   * <p>This is a Postgresql-specific feature. This method must be called before any other SQL
-   * commands in a transaction.
-   *
-   * <p>To support large queries, transaction isolation level is fixed at the REPEATABLE_READ to
-   * avoid exhausting predicate locks at the SERIALIZABLE level.
-   *
-   * @see google.registry.beam.common.DatabaseSnapshot
-   */
-  // TODO(b/193662898): vendor-independent support for richer transaction semantics.
-  JpaTransactionManager setDatabaseSnapshot(String snapshotId);
-
   /**
    * Returns the {@link EntityManager} for the current request.
    *
@@ -56,8 +42,8 @@ public interface JpaTransactionManager extends TransactionManager {
   /**
    * Creates a JPA SQL query for the given query string and result class.
    *
-   * <p>This is a convenience method for the longer <code>
-   * jpaTm().getEntityManager().createQuery(...)</code>.
+   * <p>This is a convenience method for the longer {@code
+   * jpaTm().getEntityManager().createQuery(...)}.
    */
   <T> TypedQuery<T> query(String sqlString, Class<T> resultClass);
 
@@ -67,8 +53,8 @@ public interface JpaTransactionManager extends TransactionManager {
   /**
    * Creates a JPA SQL query for the given query string.
    *
-   * <p>This is a convenience method for the longer <code>
-   * jpaTm().getEntityManager().createQuery(...)</code>.
+   * <p>This is a convenience method for the longer {@code
+   * jpaTm().getEntityManager().createQuery(...)}.
    *
    * <p>Note that while this method can legally be used for queries that return results, <u>it
    * should not be</u>, as it does not correctly detach entities as must be done for nomulus model
@@ -79,9 +65,21 @@ public interface JpaTransactionManager extends TransactionManager {
   /** Executes the work in a transaction with no retries and returns the result. */
   <T> T transactNoRetry(Supplier<T> work);
 
+  /**
+   * Executes the work in a transaction at the given {@link TransactionIsolationLevel} with no
+   * retries and returns the result.
+   */
+  <T> T transactNoRetry(Supplier<T> work, TransactionIsolationLevel isolationLevel);
+
   /** Executes the work in a transaction with no retries. */
   void transactNoRetry(Runnable work);
 
+  /**
+   * Executes the work in a transaction at the given {@link TransactionIsolationLevel} with no
+   * retries.
+   */
+  void transactNoRetry(Runnable work, TransactionIsolationLevel isolationLevel);
+
   /** Deletes the entity by its id, throws exception if the entity is not deleted. */
   <T> void assertDelete(VKey<T> key);
 
@@ -99,4 +97,13 @@ public interface JpaTransactionManager extends TransactionManager {
   static Query setQueryFetchSize(Query query, int fetchSize) {
     return query.setHint("org.hibernate.fetchSize", fetchSize);
   }
+
+  /** Return the default {@link TransactionIsolationLevel} specified via the config file. */
+  TransactionIsolationLevel getDefaultTransactionIsolationLevel();
+
+  /** Return the {@link TransactionIsolationLevel} used in the current transaction. */
+  TransactionIsolationLevel getCurrentTransactionIsolationLevel();
+
+  /** Asserts that the current transaction runs at the given level. */
+  void assertTransactionIsolationLevel(TransactionIsolationLevel expectedLevel);
 }

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static google.registry.config.RegistryConfig.getHibernatePerTransactionIsolationEnabled;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static java.util.AbstractMap.SimpleEntry;
 import static java.util.stream.Collectors.joining;
@@ -31,6 +32,7 @@ import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import google.registry.model.ImmutableObject;
 import google.registry.persistence.JpaRetries;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import google.registry.util.Clock;
 import google.registry.util.Retrier;
@@ -65,6 +67,7 @@ import javax.persistence.TemporalType;
 import javax.persistence.TypedQuery;
 import javax.persistence.criteria.CriteriaQuery;
 import javax.persistence.metamodel.EntityType;
+import org.hibernate.cfg.Environment;
 import org.joda.time.DateTime;
 
 /** Implementation of {@link JpaTransactionManager} for JPA compatible database. */
@@ -77,9 +80,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   private final EntityManagerFactory emf;
   private final Clock clock;
 
-  // TODO(b/177588434): Investigate alternatives for managing transaction information. ThreadLocal
-  // adds an unnecessary restriction that each request has to be processed by one thread
-  // synchronously.
   private static final ThreadLocal<TransactionInfo> transactionInfo =
       ThreadLocal.withInitial(TransactionInfo::new);
 
@@ -109,22 +109,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     return entityManager;
   }
 
-  @Override
-  public JpaTransactionManager setDatabaseSnapshot(String snapshotId) {
-    // Postgresql-specific: 'set transaction' command must be called inside a transaction
-    assertInTransaction();
-
-    EntityManager entityManager = getEntityManager();
-    // Isolation is hardcoded to REPEATABLE READ, as specified by parent's Javadoc.
-    entityManager
-        .createNativeQuery("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
-        .executeUpdate();
-    entityManager
-        .createNativeQuery(String.format("SET TRANSACTION SNAPSHOT '%s'", snapshotId))
-        .executeUpdate();
-    return this;
-  }
-
   @Override
   public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
     return new DetachingTypedQuery<>(getEntityManager().createQuery(sqlString, resultClass));
@@ -153,18 +137,42 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transact(Supplier<T> work) {
-    // This prevents inner transaction from retrying, thus avoiding a cascade retry effect.
-    if (inTransaction()) {
-      return transactNoRetry(work);
+  public void assertTransactionIsolationLevel(TransactionIsolationLevel expectedLevel) {
+    assertInTransaction();
+    TransactionIsolationLevel currentLevel = getCurrentTransactionIsolationLevel();
+    if (currentLevel != expectedLevel) {
+      throw new IllegalStateException(
+          String.format(
+              "Current transaction isolation level (%s) is not as expected (%s)",
+              currentLevel, expectedLevel));
     }
-    return retrier.callWithRetry(() -> transactNoRetry(work), JpaRetries::isFailedTxnRetriable);
   }
 
   @Override
-  public <T> T transactNoRetry(Supplier<T> work) {
+  public <T> T transact(Supplier<T> work, TransactionIsolationLevel isolationLevel) {
+    // This prevents inner transaction from retrying, thus avoiding a cascade retry effect.
     if (inTransaction()) {
-      return work.get();
+      return transactNoRetry(work, isolationLevel);
+    }
+    return retrier.callWithRetry(
+        () -> transactNoRetry(work, isolationLevel), JpaRetries::isFailedTxnRetriable);
+  }
+
+  @Override
+  public <T> T transact(Supplier<T> work) {
+    return transact(work, null);
+  }
+
+  @Override
+  public <T> T transactNoRetry(
+      Supplier<T> work, @Nullable TransactionIsolationLevel isolationLevel) {
+    if (inTransaction()) {
+      if (getHibernatePerTransactionIsolationEnabled()) {
+        throw new IllegalStateException("Nested transaction detected");
+      } else {
+        logger.atWarning().log("Nested transaction detected");
+        return work.get();
+      }
     }
     TransactionInfo txnInfo = transactionInfo.get();
     txnInfo.entityManager = emf.createEntityManager();
@@ -172,6 +180,18 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     try {
       txn.begin();
       txnInfo.start(clock);
+      if (isolationLevel != null) {
+        if (getHibernatePerTransactionIsolationEnabled()) {
+          getEntityManager()
+              .createNativeQuery(
+                  String.format("SET TRANSACTION ISOLATION LEVEL %s", isolationLevel.getMode()))
+              .executeUpdate();
+          logger.atInfo().log("Running transaction at %s", isolationLevel);
+        } else {
+          logger.atWarning().log(
+              "Per-transaction isolation level disabled, but %s was requested", isolationLevel);
+        }
+      }
       T result = work.get();
       txn.commit();
       return result;
@@ -190,21 +210,55 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public void transact(Runnable work) {
+  public <T> T transactNoRetry(Supplier<T> work) {
+    return transactNoRetry(work, null);
+  }
+
+  @Override
+  public void transact(Runnable work, TransactionIsolationLevel isolationLevel) {
     transact(
         () -> {
           work.run();
           return null;
-        });
+        },
+        isolationLevel);
   }
 
   @Override
-  public void transactNoRetry(Runnable work) {
+  public void transact(Runnable work) {
+    transact(work, null);
+  }
+
+  @Override
+  public void transactNoRetry(Runnable work, TransactionIsolationLevel isolationLevel) {
     transactNoRetry(
         () -> {
           work.run();
           return null;
-        });
+        },
+        isolationLevel);
+  }
+
+  @Override
+  public void transactNoRetry(Runnable work) {
+    transactNoRetry(work, null);
+  }
+
+  @Override
+  public TransactionIsolationLevel getDefaultTransactionIsolationLevel() {
+    return TransactionIsolationLevel.valueOf(
+        (String) emf.getProperties().get(Environment.ISOLATION));
+  }
+
+  @Override
+  public TransactionIsolationLevel getCurrentTransactionIsolationLevel() {
+    assertInTransaction();
+    String mode =
+        (String)
+            getEntityManager()
+                .createNativeQuery("SHOW TRANSACTION ISOLATION LEVEL")
+                .getSingleResult();
+    return TransactionIsolationLevel.fromMode(mode);
   }
 
   @Override
@@ -303,7 +357,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
                 Integer.class)
             .setMaxResults(1);
     entityIds.forEach(entityId -> query.setParameter(entityId.name, entityId.value));
-    return query.getResultList().size() > 0;
+    return !query.getResultList().isEmpty();
   }
 
   @Override
@@ -522,7 +576,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
         .collect(toImmutableSet());
   }
 
-  private String getAndClause(ImmutableSet<EntityId> entityIds) {
+  private static String getAndClause(ImmutableSet<EntityId> entityIds) {
     return entityIds.stream()
         .map(entityId -> String.format("%s = :%s", entityId.name, entityId.name))
         .collect(joining(" AND "));
@@ -572,7 +626,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     try {
       getEntityManager().getMetamodel().entity(object.getClass());
     } catch (IllegalArgumentException e) {
-      // The object is not an entity.  Return without detaching.
+      // The object is not an entity. Return without detaching.
       return object;
     }
 
@@ -653,7 +707,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
     TypedQuery<T> delegate;
 
-    public DetachingTypedQuery(TypedQuery<T> delegate) {
+    DetachingTypedQuery(TypedQuery<T> delegate) {
       this.delegate = delegate;
     }
 
@@ -882,7 +936,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     @Override
     public Optional<T> first() {
       List<T> results = buildQuery().setMaxResults(1).getResultList();
-      return results.size() > 0 ? Optional.of(detach(results.get(0))) : Optional.empty();
+      return !results.isEmpty() ? Optional.of(detach(results.get(0))) : Optional.empty();
     }
 
     @Override
@@ -911,7 +965,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     public ImmutableList<T> list() {
       return buildQuery().getResultList().stream()
           .map(JpaTransactionManagerImpl.this::detach)
-          .collect(ImmutableList.toImmutableList());
+          .collect(toImmutableList());
     }
   }
 }

core/src/main/java/google/registry/persistence/transaction/TransactionManager.java

@@ -18,6 +18,7 @@ import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.ImmutableObject;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import java.util.NoSuchElementException;
 import java.util.Optional;
@@ -49,9 +50,18 @@ public interface TransactionManager {
   /** Executes the work in a transaction and returns the result. */
   <T> T transact(Supplier<T> work);
 
+  /**
+   * Executes the work in a transaction at the given {@link TransactionIsolationLevel} and returns
+   * the result.
+   */
+  <T> T transact(Supplier<T> work, TransactionIsolationLevel isolationLevel);
+
   /** Executes the work in a transaction. */
   void transact(Runnable work);
 
+  /** Executes the work in a transaction at the given {@link TransactionIsolationLevel}. */
+  void transact(Runnable work, TransactionIsolationLevel isolationLevel);
+
   /** Returns the time associated with the start of this particular transaction attempt. */
   DateTime getTransactionTime();
 

core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java

@@ -141,7 +141,8 @@ public class GenerateSpec11ReportAction implements Runnable {
                     jobId,
                     ReportingModule.PARAM_DATE,
                     date.toString()),
-                Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES)));
+                // TODO(b/296582836): mitigating retry problem. Remove `+10` when bug is fixed.
+                Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES + 10)));
       }
       response.setStatus(SC_OK);
       response.setPayload(String.format("Launched Spec11 pipeline: %s", jobId));

core/src/main/java/google/registry/reporting/spec11/Spec11EmailUtils.java

@@ -31,12 +31,12 @@ import com.google.template.soy.tofu.SoyTofu;
 import com.google.template.soy.tofu.SoyTofu.Renderer;
 import google.registry.beam.spec11.ThreatMatch;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.groups.GmailClient;
 import google.registry.model.domain.Domain;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.reporting.spec11.soy.Spec11EmailSoyInfo;
 import google.registry.util.EmailMessage;
-import google.registry.util.SendEmailService;
 import java.util.List;
 import java.util.Map;
 import javax.inject.Inject;
@@ -56,8 +56,7 @@ public class Spec11EmailUtils {
                   Spec11EmailSoyInfo.getInstance().getFileName()))
           .build()
           .compileToTofu();
-
-  private final SendEmailService emailService;
+  private final GmailClient gmailClient;
   private final InternetAddress outgoingEmailAddress;
   private final ImmutableList<InternetAddress> spec11BccEmailAddresses;
   private final InternetAddress alertRecipientAddress;
@@ -66,13 +65,13 @@ public class Spec11EmailUtils {
 
   @Inject
   Spec11EmailUtils(
-      SendEmailService emailService,
-      @Config("alertRecipientEmailAddress") InternetAddress alertRecipientAddress,
+      GmailClient gmailClient,
+      @Config("newAlertRecipientEmailAddress") InternetAddress alertRecipientAddress,
       @Config("spec11OutgoingEmailAddress") InternetAddress spec11OutgoingEmailAddress,
       @Config("spec11BccEmailAddresses") ImmutableList<InternetAddress> spec11BccEmailAddresses,
       @Config("spec11WebResources") ImmutableList<String> spec11WebResources,
       @Config("registryName") String registryName) {
-    this.emailService = emailService;
+    this.gmailClient = gmailClient;
     this.outgoingEmailAddress = spec11OutgoingEmailAddress;
     this.spec11BccEmailAddresses = spec11BccEmailAddresses;
     this.alertRecipientAddress = alertRecipientAddress;
@@ -91,6 +90,7 @@ public class Spec11EmailUtils {
       ImmutableSet<RegistrarThreatMatches> registrarThreatMatchesSet) {
     ImmutableMap.Builder<RegistrarThreatMatches, Throwable> failedMatchesBuilder =
         ImmutableMap.builder();
+    int numRegistrarsEmailed = 0;
     for (RegistrarThreatMatches registrarThreatMatches : registrarThreatMatchesSet) {
       RegistrarThreatMatches filteredMatches = filterOutNonPublishedMatches(registrarThreatMatches);
       if (!filteredMatches.threatMatches().isEmpty()) {
@@ -98,11 +98,13 @@ public class Spec11EmailUtils {
           // Handle exceptions individually per registrar so that one failed email doesn't prevent
           // the rest from being sent.
           emailRegistrar(date, soyTemplateInfo, subject, filteredMatches);
+          numRegistrarsEmailed++;
         } catch (Throwable e) {
           failedMatchesBuilder.put(registrarThreatMatches, getRootCause(e));
         }
       }
     }
+    logger.atInfo().log("Emailed daily diffs to %s registrars.", numRegistrarsEmailed);
     ImmutableMap<RegistrarThreatMatches, Throwable> failedMatches = failedMatchesBuilder.build();
     if (!failedMatches.isEmpty()) {
       ImmutableList<Map.Entry<RegistrarThreatMatches, Throwable>> failedMatchesList =
@@ -151,7 +153,7 @@ public class Spec11EmailUtils {
       String subject,
       RegistrarThreatMatches registrarThreatMatches)
       throws MessagingException {
-    emailService.sendEmail(
+    gmailClient.sendEmail(
         EmailMessage.newBuilder()
             .setSubject(subject)
             .setBody(getContent(date, soyTemplateInfo, registrarThreatMatches))
@@ -191,7 +193,7 @@ public class Spec11EmailUtils {
   /** Sends an e-mail indicating the state of the spec11 pipeline, with a given subject and body. */
   void sendAlertEmail(String subject, String body) {
     try {
-      emailService.sendEmail(
+      gmailClient.sendEmail(
           EmailMessage.newBuilder()
               .setFrom(outgoingEmailAddress)
               .addRecipient(alertRecipientAddress)

core/src/main/java/google/registry/request/RequestModule.java

@@ -31,21 +31,28 @@ import com.google.common.io.ByteStreams;
 import com.google.common.io.CharStreams;
 import com.google.common.net.MediaType;
 import com.google.gson.Gson;
-import com.google.gson.JsonObject;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonElement;
 import com.google.protobuf.ByteString;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.model.adapters.CurrencyJsonAdapter;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.UnsupportedMediaTypeException;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.lock.LockHandler;
 import google.registry.request.lock.LockHandlerImpl;
+import google.registry.util.CidrAddressBlock;
+import google.registry.util.CidrAddressBlock.CidrAddressBlockAdapter;
+import google.registry.util.DateTimeTypeAdapter;
 import java.io.IOException;
 import java.util.Map;
 import java.util.Optional;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
+import org.joda.money.CurrencyUnit;
+import org.joda.time.DateTime;
 import org.json.simple.JSONValue;
 import org.json.simple.parser.ParseException;
 
@@ -69,6 +76,18 @@ public final class RequestModule {
     this.authResult = authResult;
   }
 
+  @RequestScope
+  @VisibleForTesting
+  @Provides
+  public static Gson provideGson() {
+    return new GsonBuilder()
+        .registerTypeAdapter(DateTime.class, new DateTimeTypeAdapter())
+        .registerTypeAdapter(CidrAddressBlock.class, new CidrAddressBlockAdapter())
+        .registerTypeAdapter(CurrencyUnit.class, new CurrencyJsonAdapter())
+        .excludeFieldsWithoutExposeAnnotation()
+        .create();
+  }
+
   @Provides
   @Parameter(RequestParameters.PARAM_TLD)
   static String provideTld(HttpServletRequest req) {
@@ -244,11 +263,10 @@ public final class RequestModule {
 
   @Provides
   @OptionalJsonPayload
-  public static Optional<JsonObject> provideJsonBody(HttpServletRequest req, Gson gson) {
+  public static Optional<JsonElement> provideJsonBody(HttpServletRequest req, Gson gson) {
     try {
-      JsonObject body = gson.fromJson(req.getReader(), JsonObject.class);
-      return Optional.of(body);
-    } catch (Exception e) {
+      return Optional.of(gson.fromJson(req.getReader(), JsonElement.class));
+    } catch (IOException e) {
       return Optional.empty();
     }
   }

core/src/main/java/google/registry/tools/GetTldCommand.java

@@ -15,11 +15,17 @@
 package google.registry.tools;
 
 import static google.registry.model.tld.Tlds.assertTldsExist;
+import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import google.registry.model.tld.Tld;
+import java.io.PrintStream;
+import java.io.UnsupportedEncodingException;
 import java.util.List;
+import javax.inject.Inject;
 
 /** Command to show a TLD record. */
 @Parameters(separators = " =", commandDescription = "Show TLD record(s)")
@@ -30,10 +36,14 @@ final class GetTldCommand implements Command {
       required = true)
   private List<String> mainParameters;
 
+  @Inject ObjectMapper objectMapper;
+
   @Override
-  public void run() {
-    for (String tld : assertTldsExist(mainParameters)) {
-      System.out.println(Tld.get(tld));
+  public void run() throws JsonProcessingException, UnsupportedEncodingException {
+    try (PrintStream printStream = new PrintStream(System.out, false, UTF_8.name())) {
+      for (String tld : assertTldsExist(mainParameters)) {
+        printStream.println(objectMapper.writeValueAsString(Tld.get(tld)));
+      }
     }
   }
 }

core/src/main/java/google/registry/tools/RegistryToolComponent.java

@@ -30,10 +30,12 @@ import google.registry.keyring.KeyringModule;
 import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
 import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
+import google.registry.model.ModelModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
 import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.privileges.secretmanager.SecretManagerModule;
 import google.registry.rde.RdeModule;
 import google.registry.request.Modules.GsonModule;
 import google.registry.request.Modules.UrlConnectionServiceModule;
@@ -66,13 +68,14 @@ import javax.inject.Singleton;
       GsonModule.class,
       KeyModule.class,
       KeyringModule.class,
-      SecretManagerKeyringModule.class,
       LocalCredentialModule.class,
+      ModelModule.class,
       PersistenceModule.class,
       RdeModule.class,
       RegistryToolDataflowModule.class,
       RequestFactoryModule.class,
-      google.registry.privileges.secretmanager.SecretManagerModule.class,
+      SecretManagerKeyringModule.class,
+      SecretManagerModule.class,
       UrlConnectionServiceModule.class,
       UrlFetchServiceModule.class,
       UserServiceModule.class,

core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java

@@ -14,7 +14,11 @@
 
 package google.registry.ui.server.console;
 
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.GET;
+import static google.registry.request.Action.Method.POST;
 
 import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.ImmutableList;
@@ -23,46 +27,155 @@ import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
+import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.request.auth.AuthResult;
 import google.registry.ui.server.registrar.JsonGetAction;
+import google.registry.util.StringGenerator;
+import java.util.Optional;
 import javax.inject.Inject;
+import javax.inject.Named;
+import javax.servlet.http.HttpServletRequest;
 
 @Action(
     service = Action.Service.DEFAULT,
     path = RegistrarsAction.PATH,
-    method = {GET},
+    method = {GET, POST},
     auth = Auth.AUTH_PUBLIC_LOGGED_IN)
 public class RegistrarsAction implements JsonGetAction {
+  private static final int PASSWORD_LENGTH = 16;
+  private static final int PASSCODE_LENGTH = 5;
   static final String PATH = "/console-api/registrars";
-
   private final AuthResult authResult;
   private final Response response;
   private final Gson gson;
+  private final HttpServletRequest req;
+  private Optional<Registrar> registrar;
+  private StringGenerator passwordGenerator;
+  private StringGenerator passcodeGenerator;
 
   @Inject
-  public RegistrarsAction(AuthResult authResult, Response response, Gson gson) {
+  public RegistrarsAction(
+      HttpServletRequest req,
+      AuthResult authResult,
+      Response response,
+      Gson gson,
+      @Parameter("registrar") Optional<Registrar> registrar,
+      @Named("base58StringGenerator") StringGenerator passwordGenerator,
+      @Named("digitOnlyStringGenerator") StringGenerator passcodeGenerator) {
     this.authResult = authResult;
     this.response = response;
     this.gson = gson;
+    this.registrar = registrar;
+    this.req = req;
+    this.passcodeGenerator = passcodeGenerator;
+    this.passwordGenerator = passwordGenerator;
   }
 
+
   @Override
   public void run() {
     User user = authResult.userAuthInfo().get().consoleUser().get();
+    if (req.getMethod().equals(GET.toString())) {
+      getHandler(user);
+    } else {
+      postHandler(user);
+    }
+  }
+
+  private void getHandler(User user) {
     if (!user.getUserRoles().hasGlobalPermission(ConsolePermission.VIEW_REGISTRARS)) {
       response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
       return;
     }
-    ImmutableList<String> registrarIds =
+    ImmutableList<Registrar> registrars =
         Streams.stream(Registrar.loadAllCached())
             .filter(r -> r.getType() == Registrar.Type.REAL)
-            .map(Registrar::getRegistrarId)
             .collect(ImmutableList.toImmutableList());
 
-    response.setPayload(gson.toJson(registrarIds));
+    response.setPayload(gson.toJson(registrars));
     response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
   }
+
+  private void postHandler(User user) {
+    if (!user.getUserRoles().isAdmin()) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
+      return;
+    }
+
+    if (!registrar.isPresent()) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+      response.setPayload(gson.toJson("'registrar' parameter is not present"));
+      return;
+    }
+
+    Registrar registrarParam = registrar.get();
+    String errorMsg = "Missing value for %s";
+    try {
+      checkArgument(!isNullOrEmpty(registrarParam.getRegistrarId()), errorMsg, "registrarId");
+      checkArgument(!isNullOrEmpty(registrarParam.getRegistrarName()), errorMsg, "name");
+      checkArgument(!registrarParam.getBillingAccountMap().isEmpty(), errorMsg, "billingAccount");
+      checkArgument(registrarParam.getIanaIdentifier() != null, String.format(errorMsg, "ianaId"));
+      checkArgument(
+          !isNullOrEmpty(registrarParam.getIcannReferralEmail()), errorMsg, "referralEmail");
+      checkArgument(!isNullOrEmpty(registrarParam.getDriveFolderId()), errorMsg, "driveId");
+      checkArgument(!isNullOrEmpty(registrarParam.getEmailAddress()), errorMsg, "consoleUserEmail");
+      checkArgument(
+          registrarParam.getLocalizedAddress() != null
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getState())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getCity())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getZip())
+              && !isNullOrEmpty(registrarParam.getLocalizedAddress().getCountryCode())
+              && !registrarParam.getLocalizedAddress().getStreet().isEmpty(),
+          errorMsg,
+          "address");
+
+      String password = passwordGenerator.createString(PASSWORD_LENGTH);
+      String phonePasscode = passcodeGenerator.createString(PASSCODE_LENGTH);
+
+      Registrar registrar =
+          new Registrar.Builder()
+              .setRegistrarId(registrarParam.getRegistrarId())
+              .setRegistrarName(registrarParam.getRegistrarName())
+              .setBillingAccountMap(registrarParam.getBillingAccountMap())
+              .setIanaIdentifier(Long.valueOf(registrarParam.getIanaIdentifier()))
+              .setIcannReferralEmail(registrarParam.getIcannReferralEmail())
+              .setEmailAddress(registrarParam.getIcannReferralEmail())
+              .setDriveFolderId(registrarParam.getDriveFolderId())
+              .setType(Registrar.Type.REAL)
+              .setPassword(password)
+              .setPhonePasscode(phonePasscode)
+              .setState(State.PENDING)
+              .setLocalizedAddress(registrarParam.getLocalizedAddress())
+              .build();
+
+      RegistrarPoc contact =
+          new RegistrarPoc.Builder()
+              .setRegistrar(registrar)
+              .setName(registrarParam.getEmailAddress())
+              .setEmailAddress(registrarParam.getEmailAddress())
+              .setLoginEmailAddress(registrarParam.getEmailAddress())
+              .build();
+
+      tm().transact(
+              () -> {
+                checkArgument(
+                    !Registrar.loadByRegistrarId(registrar.getRegistrarId()).isPresent(),
+                    "Registrar with registrarId %s already exists",
+                    registrar.getRegistrarId());
+                tm().putAll(registrar, contact);
+              });
+
+    } catch (IllegalArgumentException e) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+      response.setPayload(gson.toJson(e.getMessage()));
+    } catch (Throwable e) {
+      response.setStatus(HttpStatusCodes.STATUS_CODE_SERVER_ERROR);
+      response.setPayload(gson.toJson(e.getMessage()));
+    }
+  }
 }

core/src/main/java/google/registry/ui/server/console/settings/SecurityAction.java

@@ -15,7 +15,6 @@
 package google.registry.ui.server.console.settings;
 
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
 
 import avro.shaded.com.google.common.collect.ImmutableList;
@@ -36,28 +35,25 @@ import google.registry.request.auth.AuthenticatedRegistrarAccessor.RegistrarAcce
 import google.registry.ui.server.registrar.JsonGetAction;
 import java.util.Optional;
 import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
 
 @Action(
     service = Action.Service.DEFAULT,
     path = SecurityAction.PATH,
-    method = {GET, POST},
+    method = {POST},
     auth = Auth.AUTH_PUBLIC_LOGGED_IN)
 public class SecurityAction implements JsonGetAction {
 
   static final String PATH = "/console-api/settings/security";
-  private final HttpServletRequest req;
   private final AuthResult authResult;
   private final Response response;
   private final Gson gson;
   private final String registrarId;
-  private AuthenticatedRegistrarAccessor registrarAccessor;
-  private Optional<Registrar> registrar;
-  private CertificateChecker certificateChecker;
+  private final AuthenticatedRegistrarAccessor registrarAccessor;
+  private final Optional<Registrar> registrar;
+  private final CertificateChecker certificateChecker;
 
   @Inject
   public SecurityAction(
-      HttpServletRequest req,
       AuthResult authResult,
       Response response,
       Gson gson,
@@ -65,7 +61,6 @@ public class SecurityAction implements JsonGetAction {
       AuthenticatedRegistrarAccessor registrarAccessor,
       @Parameter("registrarId") String registrarId,
       @Parameter("registrar") Optional<Registrar> registrar) {
-    this.req = req;
     this.authResult = authResult;
     this.response = response;
     this.gson = gson;
@@ -77,25 +72,6 @@ public class SecurityAction implements JsonGetAction {
 
   @Override
   public void run() {
-    if (req.getMethod().equals(GET.toString())) {
-      getHandler();
-    } else {
-      postHandler();
-    }
-  }
-
-  private void getHandler() {
-    try {
-      Registrar registrar = registrarAccessor.getRegistrar(registrarId);
-      response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
-      response.setPayload(gson.toJson(registrar));
-    } catch (RegistrarAccessDeniedException e) {
-      response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
-      response.setPayload(e.getMessage());
-    }
-  }
-
-  private void postHandler() {
     User user = authResult.userAuthInfo().get().consoleUser().get();
     if (!user.getUserRoles().hasPermission(registrarId, ConsolePermission.EDIT_REGISTRAR_DETAILS)) {
       response.setStatus(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
@@ -153,17 +129,15 @@ public class SecurityAction implements JsonGetAction {
     registrarParameter
         .getClientCertificate()
         .ifPresent(
-            newClientCert -> {
-              updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime());
-            });
+            newClientCert ->
+                updatedRegistrar.setClientCertificate(newClientCert, tm().getTransactionTime()));
 
     registrarParameter
         .getFailoverClientCertificate()
         .ifPresent(
-            failoverCert -> {
-              updatedRegistrar.setFailoverClientCertificate(
-                  failoverCert, tm().getTransactionTime());
-            });
+            failoverCert ->
+                updatedRegistrar.setFailoverClientCertificate(
+                    failoverCert, tm().getTransactionTime()));
 
     tm().put(updatedRegistrar.build());
     response.setStatus(HttpStatusCodes.STATUS_CODE_OK);

core/src/main/java/google/registry/ui/server/registrar/RegistrarConsoleModule.java

@@ -21,7 +21,7 @@ import static google.registry.request.RequestParameters.extractRequiredParameter
 
 import com.google.common.collect.ImmutableSet;
 import com.google.gson.Gson;
-import com.google.gson.JsonObject;
+import com.google.gson.JsonElement;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.model.registrar.Registrar;
@@ -172,15 +172,8 @@ public final class RegistrarConsoleModule {
   @Provides
   @Parameter("contacts")
   public static Optional<ImmutableSet<RegistrarPoc>> provideContacts(
-      Gson gson, @OptionalJsonPayload Optional<JsonObject> payload) {
-
-    if (payload.isPresent() && payload.get().has("contacts")) {
-      return Optional.of(
-          ImmutableSet.copyOf(
-              gson.fromJson(payload.get().get("contacts").getAsJsonArray(), RegistrarPoc[].class)));
-    }
-
-    return Optional.empty();
+      Gson gson, @OptionalJsonPayload Optional<JsonElement> payload) {
+    return payload.map(s -> ImmutableSet.copyOf(gson.fromJson(s, RegistrarPoc[].class)));
   }
 
   @Provides
@@ -192,11 +185,7 @@ public final class RegistrarConsoleModule {
   @Provides
   @Parameter("registrar")
   public static Optional<Registrar> provideRegistrar(
-      Gson gson, @OptionalJsonPayload Optional<JsonObject> payload) {
-    if (payload.isPresent() && payload.get().has("registrar")) {
-      return Optional.of(gson.fromJson(payload.get().get("registrar"), Registrar.class));
-    }
-
-    return Optional.empty();
+      Gson gson, @OptionalJsonPayload Optional<JsonElement> payload) {
+    return payload.map(s -> gson.fromJson(s, Registrar.class));
   }
 }

core/src/main/java/google/registry/xml/xsd/bulkToken.xsd

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<schema targetNamespace="urn:google:params:xml:ns:bulkToken-1.0"
+    xmlns:bulkToken="urn:google:params:xml:ns:bulkToken-1.0"
+    xmlns="http://www.w3.org/2001/XMLSchema"
+    elementFormDefault="qualified">
+
+  <annotation>
+    <documentation>
+      Extensible Provisioning Protocol v1.0
+      Bulk Token Extension.
+    </documentation>
+  </annotation>
+
+  <!-- Element used in info command request to get a bulk pricing token for a domain. -->
+  <element name="info"
+      type="bulkToken:infoType"/>
+
+  <complexType name="infoType"/>
+
+  <!-- Element returned in an info command response with a bulk token for a domain with bulk pricing. -->
+  <element name="bulkData"
+      type="bulkToken:bulkDataType"/>
+
+  <complexType name="bulkDataType">
+    <sequence>
+      <element name="token" type="bulkToken:tokenType" maxOccurs="unbounded"/>
+    </sequence>
+  </complexType>
+
+  <simpleType name="tokenType">
+    <restriction base="string">
+    </restriction>
+  </simpleType>
+
+
+  <!-- End of schema.-->
+</schema>

core/src/main/java/google/registry/xml/xsd/packageToken.xsd

@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<schema targetNamespace="urn:google:params:xml:ns:packageToken-1.0"
-    xmlns:packageToken="urn:google:params:xml:ns:packageToken-1.0"
-    xmlns="http://www.w3.org/2001/XMLSchema"
-    elementFormDefault="qualified">
-
-  <annotation>
-    <documentation>
-      Extensible Provisioning Protocol v1.0
-      Package Token Extension.
-    </documentation>
-  </annotation>
-
-  <!-- Element used in info command request to get a package token for a domain. -->
-  <element name="info"
-      type="packageToken:infoType"/>
-
-  <complexType name="infoType"/>
-
-  <!-- Element returned in an info command response with a package token for a package domain. -->
-  <element name="packageData"
-      type="packageToken:packageDataType"/>
-
-  <complexType name="packageDataType">
-    <sequence>
-      <element name="token" type="packageToken:tokenType" maxOccurs="unbounded"/>
-    </sequence>
-  </complexType>
-
-  <simpleType name="tokenType">
-    <restriction base="string">
-    </restriction>
-  </simpleType>
-
-
-  <!-- End of schema.-->
-</schema>

core/src/test/java/google/registry/beam/common/DatabaseSnapshotTest.java

@@ -1,174 +0,0 @@
-// Copyright 2021 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.beam.common;
-
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-
-import com.google.common.collect.ImmutableMap;
-import com.google.common.truth.Truth;
-import google.registry.beam.TestPipelineExtension;
-import google.registry.beam.common.RegistryJpaIO.Read;
-import google.registry.model.tld.Tld;
-import google.registry.persistence.NomulusPostgreSql;
-import google.registry.persistence.PersistenceModule;
-import google.registry.persistence.transaction.CriteriaQueryBuilder;
-import google.registry.persistence.transaction.JpaTransactionManager;
-import google.registry.persistence.transaction.JpaTransactionManagerImpl;
-import google.registry.persistence.transaction.TransactionManagerFactory;
-import google.registry.testing.DatabaseHelper;
-import google.registry.testing.FakeClock;
-import javax.persistence.Persistence;
-import org.apache.beam.sdk.coders.SerializableCoder;
-import org.apache.beam.sdk.testing.PAssert;
-import org.apache.beam.sdk.values.PCollection;
-import org.hibernate.cfg.Environment;
-import org.junit.jupiter.api.AfterAll;
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.RegisterExtension;
-import org.testcontainers.containers.PostgreSQLContainer;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-/** Unit tests for {@link DatabaseSnapshot}. */
-@Testcontainers
-public class DatabaseSnapshotTest {
-
-  /**
-   * Directly start a PSQL database instead of going through the test extensions.
-   *
-   * <p>For reasons unknown, an EntityManagerFactory created by {@code JpaIntegrationTestExtension}
-   * or {@code JpaUnitTestExtension} enters a bad state after exporting the first snapshot. Starting
-   * with the second attempt, exports alternate between error ("cannot export a snapshot from a
-   * subtransaction") and success. The {@link #createSnapshot_twiceNoRead} test below fails with
-   * either extension. EntityManagerFactory created for production does not have this problem.
-   */
-  @Container
-  private static PostgreSQLContainer sqlContainer =
-      new PostgreSQLContainer<>(NomulusPostgreSql.getDockerTag())
-          .withInitScript("sql/schema/nomulus.golden.sql");
-
-  @RegisterExtension
-  final transient TestPipelineExtension testPipeline =
-      TestPipelineExtension.create().enableAbandonedNodeEnforcement(true);
-
-  static JpaTransactionManager origJpa;
-  static JpaTransactionManager jpa;
-
-  static Tld registry;
-
-  @BeforeAll
-  static void setup() {
-    ImmutableMap<String, String> jpaProperties =
-        new ImmutableMap.Builder<String, String>()
-            .put(Environment.URL, sqlContainer.getJdbcUrl())
-            .put(Environment.USER, sqlContainer.getUsername())
-            .put(Environment.PASS, sqlContainer.getPassword())
-            .putAll(PersistenceModule.provideDefaultDatabaseConfigs())
-            .build();
-    jpa =
-        new JpaTransactionManagerImpl(
-            Persistence.createEntityManagerFactory("nomulus", jpaProperties), new FakeClock());
-    origJpa = tm();
-    TransactionManagerFactory.setJpaTm(() -> jpa);
-
-    Tld tld = DatabaseHelper.newTld("tld", "TLD");
-    tm().transact(() -> tm().put(tld));
-    registry = tm().transact(() -> tm().loadByEntity(tld));
-  }
-
-  @AfterAll
-  static void tearDown() {
-    TransactionManagerFactory.setJpaTm(() -> origJpa);
-
-    if (jpa != null) {
-      jpa.teardown();
-    }
-  }
-
-  @Test
-  void createSnapshot_onceNoRead() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-  }
-
-  @Test
-  void createSnapshot_twiceNoRead() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {}
-  }
-
-  @Test
-  void readSnapshot() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld snapshotRegistry =
-          tm().transact(
-                  () ->
-                      tm().setDatabaseSnapshot(databaseSnapshot.getSnapshotId())
-                          .loadByEntity(registry));
-      Truth.assertThat(snapshotRegistry).isEqualTo(registry);
-    }
-  }
-
-  @Test
-  void readSnapshot_withSubsequentChange() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld updated =
-          registry
-              .asBuilder()
-              .setCreateBillingCost(registry.getCreateBillingCost().plus(1))
-              .build();
-      tm().transact(() -> tm().put(updated));
-
-      Tld persistedUpdate = tm().transact(() -> tm().loadByEntity(registry));
-      Truth.assertThat(persistedUpdate).isNotEqualTo(registry);
-
-      Tld snapshotRegistry =
-          tm().transact(
-                  () ->
-                      tm().setDatabaseSnapshot(databaseSnapshot.getSnapshotId())
-                          .loadByEntity(registry));
-      Truth.assertThat(snapshotRegistry).isEqualTo(registry);
-    } finally {
-      // Revert change to registry in DB, which is shared by all test methods.
-      tm().transact(() -> tm().put(registry));
-    }
-  }
-
-  @Test
-  void readWithRegistryJpaIO() {
-    try (DatabaseSnapshot databaseSnapshot = DatabaseSnapshot.createSnapshot()) {
-      Tld updated =
-          registry
-              .asBuilder()
-              .setCreateBillingCost(registry.getCreateBillingCost().plus(1))
-              .build();
-      tm().transact(() -> tm().put(updated));
-
-      Read<Tld, Tld> read =
-          RegistryJpaIO.read(() -> CriteriaQueryBuilder.create(Tld.class).build(), x -> x)
-              .withCoder(SerializableCoder.of(Tld.class))
-              .withSnapshot(databaseSnapshot.getSnapshotId());
-      PCollection<Tld> registries = testPipeline.apply(read);
-
-      // This assertion depends on Registry being Serializable, which may change if the
-      // UnsafeSerializable interface is removed after migration.
-      PAssert.that(registries).containsInAnyOrder(registry);
-      testPipeline.run();
-    } finally {
-      // Revert change to registry in DB, which is shared by all test methods.
-      tm().transact(() -> tm().put(registry));
-    }
-  }
-}

core/src/test/java/google/registry/flows/FlowRunnerTest.java

@@ -17,6 +17,7 @@ package google.registry.flows;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.testing.TestLogHandlerUtils.findFirstLogMessageByPrefix;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
@@ -30,11 +31,13 @@ import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.testing.TestLogHandler;
+import google.registry.config.RegistryConfig;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppoutput.EppOutput.ResponseOrGreeting;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.monitoring.whitebox.EppMetric;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
@@ -46,7 +49,6 @@ import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
-import org.mockito.Mockito;
 
 /** Unit tests for {@link FlowRunner}. */
 class FlowRunnerTest {
@@ -78,6 +80,21 @@ class FlowRunnerTest {
     }
   }
 
+  static class TestTransactionalFlow implements TransactionalFlow {
+    private final Optional<TransactionIsolationLevel> isolationLevel;
+
+    TestTransactionalFlow(Optional<TransactionIsolationLevel> isolationLevel) {
+      this.isolationLevel = isolationLevel;
+    }
+
+    @Override
+    public ResponseOrGreeting run() {
+      tm().assertTransactionIsolationLevel(
+              isolationLevel.orElse(tm().getDefaultTransactionIsolationLevel()));
+      return mock(EppResponse.class);
+    }
+  }
+
   @BeforeEach
   void beforeEach() {
     JdkLoggerConfig.getConfig(FlowRunner.class).addHandler(handler);
@@ -90,23 +107,39 @@ class FlowRunnerTest {
     flowRunner.isDryRun = false;
     flowRunner.isSuperuser = false;
     flowRunner.isTransactional = false;
+    flowRunner.isolationLevelOverride = Optional.empty();
     flowRunner.sessionMetadata =
         new StatelessRequestSessionMetadata("TheRegistrar", ImmutableSet.of());
     flowRunner.trid = Trid.create("client-123", "server-456");
-    flowRunner.flowReporter = Mockito.mock(FlowReporter.class);
+    flowRunner.flowReporter = mock(FlowReporter.class);
   }
 
   @Test
   void testRun_nonTransactionalCommand_setsCommandNameOnMetric() throws Exception {
-    flowRunner.isTransactional = true;
     flowRunner.run(eppMetricBuilder);
     assertThat(eppMetricBuilder.build().getCommandName()).hasValue("TestCommand");
   }
 
   @Test
   void testRun_transactionalCommand_setsCommandNameOnMetric() throws Exception {
+    flowRunner.isTransactional = true;
+    flowRunner.flowClass = TestTransactionalFlow.class;
+    flowRunner.flowProvider = () -> new TestTransactionalFlow(Optional.empty());
     flowRunner.run(eppMetricBuilder);
-    assertThat(eppMetricBuilder.build().getCommandName()).hasValue("TestCommand");
+    assertThat(eppMetricBuilder.build().getCommandName()).hasValue("TestTransactional");
+  }
+
+  @Test
+  void testRun_transactionalCommand_isolationLevelOverride() throws Exception {
+    flowRunner.isTransactional = true;
+    flowRunner.isolationLevelOverride =
+        Optional.of(TransactionIsolationLevel.TRANSACTION_READ_UNCOMMITTED);
+    flowRunner.flowClass = TestTransactionalFlow.class;
+    flowRunner.flowProvider = () -> new TestTransactionalFlow(flowRunner.isolationLevelOverride);
+    if (RegistryConfig.getHibernatePerTransactionIsolationEnabled()) {
+      flowRunner.run(eppMetricBuilder);
+      assertThat(eppMetricBuilder.build().getCommandName()).hasValue("TestTransactional");
+    }
   }
 
   @Test

core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java

@@ -1085,7 +1085,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
   }
 
   @Test
-  void testPackageInfoExtension_returnsPackageInfo() throws Exception {
+  void testBulkInfoExtension_returnsBulkInfo() throws Exception {
     persistTestEntities(false);
     AllocationToken token =
         persistResource(
@@ -1100,12 +1100,12 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
                 .build());
     domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
     persistResource(domain);
-    setEppInput("domain_info_package.xml");
-    doSuccessfulTest("domain_info_response_package.xml", false);
+    setEppInput("domain_info_bulk.xml");
+    doSuccessfulTest("domain_info_response_bulk.xml", false);
   }
 
   @Test
-  void testPackageInfoExtension_returnsPackageInfoForSuperUser() throws Exception {
+  void testBulkInfoExtension_returnsBulkInfoForSuperUser() throws Exception {
     persistTestEntities(false);
     AllocationToken token =
         persistResource(
@@ -1121,23 +1121,23 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
     domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
     persistResource(domain);
     sessionMetadata.setRegistrarId("TheRegistrar");
-    setEppInput("domain_info_package.xml");
+    setEppInput("domain_info_bulk.xml");
     EppOutput output = runFlowAsSuperuser();
     String expectedOutput =
         loadFile(
-            "domain_info_response_superuser_package.xml",
+            "domain_info_response_superuser_bulk.xml",
             updateSubstitutions(ImmutableMap.of(), "ROID", "2FF-TLD"));
     assertXmlEquals(expectedOutput, new String(marshal(output, ValidationMode.LENIENT), UTF_8));
   }
 
   @Test
-  void testPackageInfoExtension_nameNotInPackage() throws Exception {
-    setEppInput("domain_info_package.xml");
-    doSuccessfulTest("domain_info_response_empty_package.xml");
+  void testBulkInfoExtension_nameNotInBulkPackage() throws Exception {
+    setEppInput("domain_info_bulk.xml");
+    doSuccessfulTest("domain_info_response_empty_bulk_package.xml");
   }
 
   @Test
-  void testPackageInfoExtension_notCurrentSponsorRegistrar() throws Exception {
+  void testBulkInfoExtension_notCurrentSponsorRegistrar() throws Exception {
     persistTestEntities(false);
     AllocationToken token =
         persistResource(
@@ -1153,7 +1153,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
     domain = domain.asBuilder().setCurrentPackageToken(token.createVKey()).build();
     persistResource(domain);
     sessionMetadata.setRegistrarId("TheRegistrar");
-    setEppInput("domain_info_package.xml");
+    setEppInput("domain_info_bulk.xml");
     doSuccessfulTest("domain_info_response_unauthorized.xml", false);
   }
 }

core/src/test/java/google/registry/flows/domain/DomainRenewFlowTest.java

@@ -77,8 +77,8 @@ import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTok
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForTldException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AlreadyRedeemedAllocationTokenException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.InvalidAllocationTokenException;
-import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemovePackageTokenOnPackageDomainException;
-import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemovePackageTokenOnNonPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.MissingRemoveDomainTokenOnPackageDomainException;
+import google.registry.flows.domain.token.AllocationTokenFlowUtils.RemoveDomainTokenOnNonPackageDomainException;
 import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
 import google.registry.model.billing.BillingBase.Flag;
 import google.registry.model.billing.BillingBase.Reason;
@@ -1271,12 +1271,12 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "abc123"));
 
     EppException thrown =
-        assertThrows(MissingRemovePackageTokenOnPackageDomainException.class, this::runFlow);
+        assertThrows(MissingRemoveDomainTokenOnPackageDomainException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
   @Test
-  void testFailsToRenewPackageDomainNoRemovePackageToken() throws Exception {
+  void testFailsToRenewPackageDomainNoRemoveDomainToken() throws Exception {
     AllocationToken token =
         persistResource(
             new AllocationToken.Builder()
@@ -1296,25 +1296,25 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
     setEppInput("domain_renew.xml", ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "5"));
 
     EppException thrown =
-        assertThrows(MissingRemovePackageTokenOnPackageDomainException.class, this::runFlow);
+        assertThrows(MissingRemoveDomainTokenOnPackageDomainException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
   @Test
-  void testFailsToRenewNonPackageDomainWithRemovePackageToken() throws Exception {
+  void testFailsToRenewNonPackageDomainWithRemoveDomainToken() throws Exception {
     persistDomain();
 
     setEppInput(
         "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));
 
     EppException thrown =
-        assertThrows(RemovePackageTokenOnNonPackageDomainException.class, this::runFlow);
+        assertThrows(RemoveDomainTokenOnNonPackageDomainException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
   @Test
-  void testSuccesfullyAppliesRemovePackageToken() throws Exception {
+  void testSuccesfullyAppliesRemoveDomainToken() throws Exception {
     AllocationToken token =
         persistResource(
             new AllocationToken.Builder()
@@ -1332,7 +1332,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
             .build());
     setEppInput(
         "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));
 
     doSuccessfulTest(
         "domain_renew_response.xml",
@@ -1346,7 +1346,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
   }
 
   @Test
-  void testDryRunRemovePackageToken() throws Exception {
+  void testDryRunRemoveDomainToken() throws Exception {
     AllocationToken token =
         persistResource(
             new AllocationToken.Builder()
@@ -1365,7 +1365,7 @@ class DomainRenewFlowTest extends ResourceFlowTestCase<DomainRenewFlow, Domain>
 
     setEppInput(
         "domain_renew_allocationtoken.xml",
-        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEPACKAGE__"));
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2", "TOKEN", "__REMOVEDOMAIN__"));
 
     dryRunFlowAssertResponse(
         loadFile(

core/src/test/java/google/registry/groups/GmailClientTest.java

@@ -0,0 +1,202 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.groups;
+
+import static com.google.common.net.MediaType.CSV_UTF_8;
+import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
+import static com.google.common.truth.Truth.assertThat;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import com.google.api.client.http.HttpResponseException;
+import com.google.api.services.gmail.Gmail;
+import com.google.api.services.gmail.Gmail.Users;
+import com.google.api.services.gmail.Gmail.Users.Messages;
+import com.google.api.services.gmail.Gmail.Users.Messages.Send;
+import com.google.api.services.gmail.model.Message;
+import google.registry.groups.GmailClient.RetriableGmailExceptionPredicate;
+import google.registry.util.EmailMessage;
+import google.registry.util.EmailMessage.Attachment;
+import google.registry.util.Retrier;
+import google.registry.util.SystemSleeper;
+import java.io.OutputStream;
+import javax.mail.Message.RecipientType;
+import javax.mail.Part;
+import javax.mail.internet.InternetAddress;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.stubbing.Answer;
+import org.testcontainers.shaded.com.google.common.collect.ImmutableList;
+
+/** Unit tests for {@link GmailClient}. */
+@ExtendWith(MockitoExtension.class)
+public class GmailClientTest {
+
+  @Mock private Gmail gmail;
+  @Mock private HttpResponseException httpResponseException;
+
+  private GmailClient getGmailClient(boolean isExternalEmailAllowed) throws Exception {
+    return new GmailClient(
+        gmail,
+        new Retrier(new SystemSleeper(), 3),
+        isExternalEmailAllowed,
+        "from@example.com",
+        "My sender",
+        new InternetAddress("replyTo@example.com"));
+  }
+
+  @Test
+  public void sendEmail_sentWhenAllowed() throws Exception {
+    EmailMessage message =
+        EmailMessage.create(
+            "subject",
+            "body",
+            new InternetAddress("from@example.com"),
+            new InternetAddress("to@example.com"));
+    Send gSend = mock(Send.class);
+    Messages gMessages = mock(Messages.class);
+    Users gUsers = mock(Users.class);
+    when(gmail.users()).thenReturn(gUsers);
+    when(gUsers.messages()).thenReturn(gMessages);
+    when(gMessages.send(anyString(), any())).thenReturn(gSend);
+    getGmailClient(true).sendEmail(message);
+    verify(gmail, times(1)).users();
+  }
+
+  @Test
+  public void sendEmail_notSentWhenNotAllowed() throws Exception {
+    EmailMessage message =
+        EmailMessage.create(
+            "subject",
+            "body",
+            new InternetAddress("from@example.com"),
+            new InternetAddress("to@example.com"));
+    getGmailClient(false).sendEmail(message);
+    verifyNoInteractions(gmail);
+  }
+
+  @Test
+  public void toMimeMessage_fullMessage() throws Exception {
+    InternetAddress fromAddr = new InternetAddress("from@example.com", "My sender");
+    InternetAddress toAddr = new InternetAddress("to@example.com");
+    InternetAddress ccAddr = new InternetAddress("cc@example.com");
+    InternetAddress bccAddr = new InternetAddress("bcc@example.com");
+    EmailMessage emailMessage =
+        EmailMessage.newBuilder()
+            .setFrom(fromAddr)
+            .setRecipients(ImmutableList.of(toAddr))
+            .setSubject("My subject")
+            .setBody("My body")
+            .addCc(ccAddr)
+            .addBcc(bccAddr)
+            .setAttachment(
+                Attachment.newBuilder()
+                    .setFilename("filename")
+                    .setContent("foo,bar\nbaz,qux")
+                    .setContentType(CSV_UTF_8)
+                    .build())
+            .build();
+    MimeMessage mimeMessage = getGmailClient(true).toMimeMessage(emailMessage);
+    assertThat(mimeMessage.getFrom()).asList().containsExactly(fromAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.TO)).asList().containsExactly(toAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.CC)).asList().containsExactly(ccAddr);
+    assertThat(mimeMessage.getRecipients(RecipientType.BCC)).asList().containsExactly(bccAddr);
+    assertThat(mimeMessage.getSubject()).isEqualTo("My subject");
+    assertThat(mimeMessage.getContent()).isInstanceOf(MimeMultipart.class);
+    MimeMultipart parts = (MimeMultipart) mimeMessage.getContent();
+    Part body = parts.getBodyPart(0);
+    assertThat(body.getContentType()).isEqualTo(PLAIN_TEXT_UTF_8.toString());
+    assertThat(body.getContent()).isEqualTo("My body");
+    Part attachment = parts.getBodyPart(1);
+    assertThat(attachment.getContentType()).startsWith(CSV_UTF_8.toString());
+    assertThat(attachment.getContentType()).endsWith("name=filename");
+    assertThat(attachment.getContent()).isEqualTo("foo,bar\nbaz,qux");
+  }
+
+  @Test
+  public void toGmailMessage() throws Exception {
+    MimeMessage mimeMessage = mock(MimeMessage.class);
+    byte[] data = "My content".getBytes(UTF_8);
+    doAnswer(
+            new Answer() {
+              @Override
+              public Object answer(InvocationOnMock invocation) throws Throwable {
+                OutputStream os = invocation.getArgument(0);
+                os.write(data);
+                return null;
+              }
+            })
+        .when(mimeMessage)
+        .writeTo(any(OutputStream.class));
+    Message gmailMessage = GmailClient.toGmailMessage(mimeMessage);
+    assertThat(gmailMessage.decodeRaw()).isEqualTo(data);
+  }
+
+  @Test
+  public void isRetriable_trueIfNotHttpResponseException() {
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(new Exception())).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf500() {
+    when(httpResponseException.getStatusCode()).thenReturn(500);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf429() {
+    when(httpResponseException.getStatusCode()).thenReturn(429);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf403WithRateLimitOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("rateLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_trueIf403WithUserRateLimitOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("userRateLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isTrue();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_falseIf403WithLongLastingOverage() {
+    when(httpResponseException.getStatusCode()).thenReturn(403);
+    when(httpResponseException.getStatusMessage()).thenReturn("dailyLimitExceeded");
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isFalse();
+  }
+
+  @Test
+  public void isHttpResponseExceptionRetriable_falseIfBadRequest() {
+    when(httpResponseException.getStatusCode()).thenReturn(400);
+    assertThat(RetriableGmailExceptionPredicate.INSTANCE.test(httpResponseException)).isFalse();
+  }
+}

core/src/test/java/google/registry/model/tld/TldTest.java

@@ -17,6 +17,7 @@ package google.registry.model.tld;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.EntityYamlUtils.createObjectMapper;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.domain.token.AllocationToken.TokenType.SINGLE_USE;
@@ -24,17 +25,16 @@ import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.PREDELEGATION;
 import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
-import static google.registry.model.tld.TldYamlUtils.getObjectMapper;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.newTld;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistReservedList;
 import static google.registry.testing.DatabaseHelper.persistResource;
-import static google.registry.testing.TestDataHelper.filePath;
 import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.ResourceUtils.readResourceBytes;
 import static java.math.RoundingMode.UNNECESSARY;
 import static org.joda.money.CurrencyUnit.EUR;
 import static org.joda.money.CurrencyUnit.USD;
@@ -55,7 +55,6 @@ import google.registry.model.tld.label.ReservedList;
 import google.registry.persistence.VKey;
 import google.registry.tldconfig.idn.IdnTableEnum;
 import google.registry.util.SerializeUtils;
-import java.io.File;
 import java.math.BigDecimal;
 import java.util.Optional;
 import org.joda.money.Money;
@@ -130,7 +129,7 @@ public final class TldTest extends EntityTestCase {
             .setIdnTables(ImmutableSet.of(IdnTableEnum.JA, IdnTableEnum.EXTENDED_LATIN))
             .build();
 
-    ObjectMapper mapper = getObjectMapper();
+    ObjectMapper mapper = createObjectMapper();
     String yaml = mapper.writeValueAsString(existingTld);
     assertThat(yaml).isEqualTo(loadFile(getClass(), "tld.yaml"));
   }
@@ -163,15 +162,16 @@ public final class TldTest extends EntityTestCase {
             .setIdnTables(ImmutableSet.of(IdnTableEnum.JA, IdnTableEnum.EXTENDED_LATIN))
             .build();
 
-    ObjectMapper mapper = getObjectMapper();
-    Tld constructedTld = mapper.readValue(new File(filePath(getClass(), "tld.yaml")), Tld.class);
+    ObjectMapper mapper = createObjectMapper();
+    Tld constructedTld =
+        mapper.readValue(readResourceBytes(getClass(), "tld.yaml").openBufferedStream(), Tld.class);
     compareTlds(existingTld, constructedTld);
   }
 
   @Test
   void testSuccess_tldYamlRoundtrip() throws Exception {
     Tld testTld = createTld("test");
-    ObjectMapper mapper = getObjectMapper();
+    ObjectMapper mapper = createObjectMapper();
     String yaml = mapper.writeValueAsString(testTld);
     Tld constructedTld = mapper.readValue(yaml, Tld.class);
     compareTlds(testTld, constructedTld);

core/src/test/java/google/registry/persistence/transaction/JpaTransactionManagerImplTest.java

@@ -16,6 +16,8 @@ package google.registry.persistence.transaction;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_READ_UNCOMMITTED;
+import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.assertDetachedFromEntityManager;
 import static google.registry.testing.DatabaseHelper.existsInDb;
@@ -31,6 +33,7 @@ import static org.mockito.Mockito.verify;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import google.registry.config.RegistryConfig;
 import google.registry.model.ImmutableObject;
 import google.registry.persistence.VKey;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaUnitTestExtension;
@@ -81,7 +84,7 @@ class JpaTransactionManagerImplTest {
           .buildUnitTestExtension();
 
   @Test
-  void transact_succeeds() {
+  void transact_success() {
     assertPersonEmpty();
     assertCompanyEmpty();
     tm().transact(
@@ -89,6 +92,7 @@ class JpaTransactionManagerImplTest {
               insertPerson(10);
               insertCompany("Foo");
               insertCompany("Bar");
+              tm().assertTransactionIsolationLevel(tm().getDefaultTransactionIsolationLevel());
             });
     assertPersonCount(1);
     assertPersonExist(10);
@@ -97,6 +101,52 @@ class JpaTransactionManagerImplTest {
     assertCompanyExist("Bar");
   }
 
+  @Test
+  void transact_setIsolationLevel() {
+    tm().transact(
+            () -> {
+              tm().assertTransactionIsolationLevel(
+                      RegistryConfig.getHibernatePerTransactionIsolationEnabled()
+                          ? TRANSACTION_READ_UNCOMMITTED
+                          : tm().getDefaultTransactionIsolationLevel());
+              return null;
+            },
+            TRANSACTION_READ_UNCOMMITTED);
+    // Make sure that we can start a new transaction on the same thread with a different isolation
+    // level.
+    tm().transact(
+            () -> {
+              tm().assertTransactionIsolationLevel(
+                      RegistryConfig.getHibernatePerTransactionIsolationEnabled()
+                          ? TRANSACTION_REPEATABLE_READ
+                          : tm().getDefaultTransactionIsolationLevel());
+              return null;
+            },
+            TRANSACTION_REPEATABLE_READ);
+  }
+
+  @Test
+  void transact_nestedTransactions() {
+    // Unit tests always allows for per-transaction isolation level (and therefore throws when a
+    // nested transaction is detected).
+    if (RegistryConfig.getHibernatePerTransactionIsolationEnabled()) {
+      IllegalArgumentException e =
+          assertThrows(
+              IllegalArgumentException.class,
+              () ->
+                  tm().transact(
+                          () -> {
+                            tm().transact(() -> {});
+                          }));
+      assertThat(e).hasMessageThat().isEqualTo("Nested transaction detected");
+    } else {
+      tm().transact(
+              () -> {
+                tm().transact(() -> {});
+              });
+    }
+  }
+
   @Test
   void transact_hasNoEffectWithPartialSuccess() {
     assertPersonEmpty();
@@ -606,19 +656,19 @@ class JpaTransactionManagerImplTest {
     verify(spyJpaTm, times(3)).delete(theEntityKey);
   }
 
-  private void insertPerson(int age) {
+  private static void insertPerson(int age) {
     tm().getEntityManager()
         .createNativeQuery(String.format("INSERT INTO Person (age) VALUES (%d)", age))
         .executeUpdate();
   }
 
-  private void insertCompany(String name) {
+  private static void insertCompany(String name) {
     tm().getEntityManager()
         .createNativeQuery(String.format("INSERT INTO Company (name) VALUES ('%s')", name))
         .executeUpdate();
   }
 
-  private void assertPersonExist(int age) {
+  private static void assertPersonExist(int age) {
     tm().transact(
             () -> {
               EntityManager em = tm().getEntityManager();
@@ -631,7 +681,7 @@ class JpaTransactionManagerImplTest {
             });
   }
 
-  private void assertCompanyExist(String name) {
+  private static void assertCompanyExist(String name) {
     tm().transact(
             () -> {
               String maybeName =
@@ -644,23 +694,23 @@ class JpaTransactionManagerImplTest {
             });
   }
 
-  private void assertPersonCount(int count) {
+  private static void assertPersonCount(int count) {
     assertThat(countTable("Person")).isEqualTo(count);
   }
 
-  private void assertCompanyCount(int count) {
+  private static void assertCompanyCount(int count) {
     assertThat(countTable("Company")).isEqualTo(count);
   }
 
-  private void assertPersonEmpty() {
+  private static void assertPersonEmpty() {
     assertPersonCount(0);
   }
 
-  private void assertCompanyEmpty() {
+  private static void assertCompanyEmpty() {
     assertCompanyCount(0);
   }
 
-  private int countTable(String tableName) {
+  private static int countTable(String tableName) {
     return tm().transact(
             () -> {
               BigInteger colCount =

core/src/test/java/google/registry/persistence/transaction/ReplicaSimulatingJpaTransactionManager.java

@@ -18,6 +18,7 @@ import com.google.common.collect.ImmutableCollection;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.ImmutableObject;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import java.util.Optional;
 import java.util.function.Supplier;
@@ -49,6 +50,21 @@ public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionMan
     delegate.teardown();
   }
 
+  @Override
+  public TransactionIsolationLevel getDefaultTransactionIsolationLevel() {
+    return delegate.getDefaultTransactionIsolationLevel();
+  }
+
+  @Override
+  public TransactionIsolationLevel getCurrentTransactionIsolationLevel() {
+    return delegate.getCurrentTransactionIsolationLevel();
+  }
+
+  @Override
+  public void assertTransactionIsolationLevel(TransactionIsolationLevel expectedLevel) {
+    delegate.assertTransactionIsolationLevel(expectedLevel);
+  }
+
   @Override
   public EntityManager getStandaloneEntityManager() {
     return delegate.getStandaloneEntityManager();
@@ -59,11 +75,6 @@ public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionMan
     return delegate.getEntityManager();
   }
 
-  @Override
-  public JpaTransactionManager setDatabaseSnapshot(String snapshotId) {
-    return delegate.setDatabaseSnapshot(snapshotId);
-  }
-
   @Override
   public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
     return delegate.query(sqlString, resultClass);
@@ -90,7 +101,7 @@ public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionMan
   }
 
   @Override
-  public <T> T transact(Supplier<T> work) {
+  public <T> T transact(Supplier<T> work, TransactionIsolationLevel isolationLevel) {
     if (delegate.inTransaction()) {
       return work.get();
     }
@@ -101,26 +112,48 @@ public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionMan
               .createNativeQuery("SET TRANSACTION READ ONLY")
               .executeUpdate();
           return work.get();
-        });
+        },
+        isolationLevel);
+  }
+
+  @Override
+  public <T> T transact(Supplier<T> work) {
+    return transact(work, null);
+  }
+
+  @Override
+  public <T> T transactNoRetry(Supplier<T> work, TransactionIsolationLevel isolationLevel) {
+    return transact(work, isolationLevel);
   }
 
   @Override
   public <T> T transactNoRetry(Supplier<T> work) {
-    return transact(work);
+    return transactNoRetry(work, null);
   }
 
   @Override
-  public void transact(Runnable work) {
+  public void transact(Runnable work, TransactionIsolationLevel isolationLevel) {
     transact(
         () -> {
           work.run();
           return null;
-        });
+        },
+        isolationLevel);
+  }
+
+  @Override
+  public void transact(Runnable work) {
+    transact(work, null);
+  }
+
+  @Override
+  public void transactNoRetry(Runnable work, TransactionIsolationLevel isolationLevel) {
+    transact(work, isolationLevel);
   }
 
   @Override
   public void transactNoRetry(Runnable work) {
-    transact(work);
+    transactNoRetry(work, null);
   }
 
   @Override

core/src/test/java/google/registry/reporting/spec11/GenerateSpec11ReportActionTest.java

@@ -93,7 +93,8 @@ class GenerateSpec11ReportActionTest extends BeamActionTestBase {
             .scheduleTime(
                 clock
                     .nowUtc()
-                    .plus(Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES))));
+                    // TODO(b/296582836): mitigating retry problem. Remove `+10` when bug is fixed.
+                    .plus(Duration.standardMinutes(ReportingModule.ENQUEUE_DELAY_MINUTES + 10))));
   }
 
   @Test

core/src/test/java/google/registry/reporting/spec11/Spec11EmailUtilsTest.java

@@ -27,14 +27,13 @@ import static google.registry.testing.DatabaseHelper.persistActiveHost;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.doThrow;
-import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.net.MediaType;
+import google.registry.groups.GmailClient;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.persistence.transaction.JpaTestExtensions;
@@ -42,7 +41,6 @@ import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationT
 import google.registry.reporting.spec11.soy.Spec11EmailSoyInfo;
 import google.registry.testing.DatabaseHelper;
 import google.registry.util.EmailMessage;
-import google.registry.util.SendEmailService;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Optional;
@@ -51,10 +49,14 @@ import javax.mail.internet.InternetAddress;
 import org.joda.time.LocalDate;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
 
 /** Unit tests for {@link Spec11EmailUtils}. */
+@ExtendWith(MockitoExtension.class)
 class Spec11EmailUtilsTest {
 
   private static final ImmutableList<String> FAKE_RESOURCES = ImmutableList.of("foo");
@@ -98,9 +100,8 @@ class Spec11EmailUtilsTest {
   final JpaIntegrationTestExtension jpa =
       new JpaTestExtensions.Builder().buildIntegrationTestExtension();
 
-  private SendEmailService emailService;
+  @Mock private GmailClient gmailClient;
   private Spec11EmailUtils emailUtils;
-  private Spec11RegistrarThreatMatchesParser parser;
   private ArgumentCaptor<EmailMessage> contentCaptor;
   private final LocalDate date = new LocalDate(2018, 7, 15);
 
@@ -109,13 +110,10 @@ class Spec11EmailUtilsTest {
 
   @BeforeEach
   void beforeEach() throws Exception {
-    emailService = mock(SendEmailService.class);
-    parser = mock(Spec11RegistrarThreatMatchesParser.class);
-    when(parser.getRegistrarThreatMatches(date)).thenReturn(sampleThreatMatches());
     contentCaptor = ArgumentCaptor.forClass(EmailMessage.class);
     emailUtils =
         new Spec11EmailUtils(
-            emailService,
+            gmailClient,
             new InternetAddress("my-receiver@test.com"),
             new InternetAddress("abuse@test.com"),
             ImmutableList.of(
@@ -138,7 +136,7 @@ class Spec11EmailUtilsTest {
         "Super Cool Registry Monthly Threat Detector [2018-07-15]",
         sampleThreatMatches());
     // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
     List<EmailMessage> capturedContents = contentCaptor.getAllValues();
     validateMessage(
         capturedContents.get(0),
@@ -176,7 +174,7 @@ class Spec11EmailUtilsTest {
         "Super Cool Registry Daily Threat Detector [2018-07-15]",
         sampleThreatMatches());
     // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
     List<EmailMessage> capturedMessages = contentCaptor.getAllValues();
     validateMessage(
         capturedMessages.get(0),
@@ -217,7 +215,7 @@ class Spec11EmailUtilsTest {
         "Super Cool Registry Monthly Threat Detector [2018-07-15]",
         sampleThreatMatches());
     // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(2)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(2)).sendEmail(contentCaptor.capture());
     List<EmailMessage> capturedContents = contentCaptor.getAllValues();
     validateMessage(
         capturedContents.get(0),
@@ -250,7 +248,7 @@ class Spec11EmailUtilsTest {
         "Super Cool Registry Monthly Threat Detector [2018-07-15]",
         sampleThreatMatches());
     // We inspect individual parameters because Message doesn't implement equals().
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
     List<EmailMessage> capturedContents = contentCaptor.getAllValues();
     validateMessage(
         capturedContents.get(0),
@@ -289,7 +287,7 @@ class Spec11EmailUtilsTest {
     doThrow(new RuntimeException(new MessagingException("expected")))
         .doNothing()
         .doNothing()
-        .when(emailService)
+        .when(gmailClient)
         .sendEmail(contentCaptor.capture());
     RuntimeException thrown =
         assertThrows(
@@ -305,7 +303,7 @@ class Spec11EmailUtilsTest {
         .isEqualTo("Emailing Spec11 reports failed, first exception:");
     assertThat(thrown).hasCauseThat().hasMessageThat().isEqualTo("expected");
     // Verify we sent an e-mail alert
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
     List<EmailMessage> capturedMessages = contentCaptor.getAllValues();
     validateMessage(
         capturedMessages.get(0),
@@ -338,7 +336,7 @@ class Spec11EmailUtilsTest {
   @Test
   void testSuccess_sendAlertEmail() throws Exception {
     emailUtils.sendAlertEmail("Spec11 Pipeline Alert: 2018-07", "Alert!");
-    verify(emailService).sendEmail(contentCaptor.capture());
+    verify(gmailClient).sendEmail(contentCaptor.capture());
     validateMessage(
         contentCaptor.getValue(),
         "abuse@test.com",
@@ -363,7 +361,7 @@ class Spec11EmailUtilsTest {
         Spec11EmailSoyInfo.MONTHLY_SPEC_11_EMAIL,
         "Super Cool Registry Monthly Threat Detector [2018-07-15]",
         sampleThreatMatches());
-    verify(emailService, times(3)).sendEmail(contentCaptor.capture());
+    verify(gmailClient, times(3)).sendEmail(contentCaptor.capture());
     assertThat(contentCaptor.getAllValues().get(0).recipients())
         .containsExactly(new InternetAddress("johndoe@theregistrar.com"));
   }

core/src/test/java/google/registry/tools/CommandTestCase.java

@@ -80,11 +80,12 @@ public abstract class CommandTestCase<C extends Command> {
     RegistryToolEnvironment.UNITTEST.setup(systemPropertyExtension);
     command = newCommandInstance();
 
-    // Capture standard output/error.
+    // Capture standard output/error. Use a single-byte encoding to emulate platforms where default
+    // charset is not UTF_8.
     oldStdout = System.out;
-    System.setOut(new PrintStream(new OutputSplitter(System.out, stdout)));
+    System.setOut(new PrintStream(new OutputSplitter(System.out, stdout), false, "US-ASCII"));
     oldStderr = System.err;
-    System.setErr(new PrintStream(new OutputSplitter(System.err, stderr)));
+    System.setErr(new PrintStream(new OutputSplitter(System.err, stderr), false, "US-ASCII"));
   }
 
   @AfterEach

core/src/test/java/google/registry/tools/GetTldCommandTest.java

@@ -16,18 +16,27 @@ package google.registry.tools;
 
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.createTlds;
+import static google.registry.testing.TestDataHelper.loadFile;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.beust.jcommander.ParameterException;
+import google.registry.model.EntityYamlUtils;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 /** Unit tests for {@link GetTldCommand}. */
 class GetTldCommandTest extends CommandTestCase<GetTldCommand> {
 
+  @BeforeEach
+  void beforeEach() {
+    command.objectMapper = EntityYamlUtils.createObjectMapper();
+  }
+
   @Test
   void testSuccess() throws Exception {
     createTld("xn--q9jyb4c");
     runCommand("xn--q9jyb4c");
+    assertInStdout(loadFile(getClass(), "tld.yaml"));
   }
 
   @Test

core/src/test/java/google/registry/ui/server/console/ConsoleDomainGetActionTest.java

@@ -25,12 +25,12 @@ import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeResponse;
-import google.registry.util.UtilsModule;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -38,7 +38,7 @@ import org.junit.jupiter.api.extension.RegisterExtension;
 /** Tests for {@link google.registry.ui.server.console.ConsoleDomainGetAction}. */
 public class ConsoleDomainGetActionTest {
 
-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
   private static final FakeResponse RESPONSE = new FakeResponse();
 
   @RegisterExtension

core/src/test/java/google/registry/ui/server/console/RegistrarsActionTest.java

@@ -15,11 +15,17 @@
 package google.registry.ui.server.console;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.DatabaseHelper.loadAllOf;
+import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistNewRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.SqlHelper.saveRegistrar;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 import com.google.api.client.http.HttpStatusCodes;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.gson.Gson;
 import google.registry.model.console.GlobalRole;
@@ -27,21 +33,69 @@ import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.RegistrarPoc;
 import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.request.Action;
+import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
+import google.registry.testing.DeterministicStringGenerator;
 import google.registry.testing.FakeResponse;
-import google.registry.util.UtilsModule;
+import google.registry.ui.server.registrar.RegistrarConsoleModule;
+import google.registry.util.StringGenerator;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.StringReader;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletRequest;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 
 /** Tests for {@link google.registry.ui.server.console.RegistrarsAction}. */
 class RegistrarsActionTest {
 
-  private static final Gson GSON = UtilsModule.provideGson();
+  private final HttpServletRequest request = mock(HttpServletRequest.class);
+  private static final Gson GSON = RequestModule.provideGson();
   private FakeResponse response;
 
+  private StringGenerator passwordGenerator =
+      new DeterministicStringGenerator("abcdefghijklmnopqrstuvwxyz");
+  private StringGenerator passcodeGenerator = new DeterministicStringGenerator("314159265");
+
+  private ImmutableMap<String, String> userFriendlyKeysToRegistrarKeys =
+      ImmutableMap.of(
+          "registrarId", "registrarId",
+          "registrarName", "name",
+          "billingAccountMap", "billingAccount",
+          "ianaIdentifier", "ianaId",
+          "icannReferralEmail", "referralEmail",
+          "driveFolderId", "driveId",
+          "emailAddress", "consoleUserEmail",
+          "localizedAddress", "address");
+
+  private ImmutableMap<String, String> registrarParamMap =
+      ImmutableMap.of(
+          "registrarId",
+          "regIdTest",
+          "registrarName",
+          "name",
+          "billingAccountMap",
+          "{\"USD\": \"789\"}",
+          "ianaIdentifier",
+          "123",
+          "icannReferralEmail",
+          "cannReferralEmail@gmail.com",
+          "driveFolderId",
+          "testDriveId",
+          "emailAddress",
+          "testEmailAddress@gmail.com",
+          "localizedAddress",
+          "{ \"street\": [\"test street\"], \"city\": \"test city\", \"state\": \"test state\","
+              + " \"zip\": \"00700\", \"countryCode\": \"US\" }");
+
   @RegisterExtension
   final JpaTestExtensions.JpaIntegrationTestExtension jpa =
       new JpaTestExtensions.Builder().buildIntegrationTestExtension();
@@ -53,6 +107,7 @@ class RegistrarsActionTest {
     persistResource(registrar);
     RegistrarsAction action =
         createAction(
+            Action.Method.GET,
             AuthResult.create(
                 AuthLevel.USER,
                 UserAuthInfo.create(
@@ -60,22 +115,98 @@ class RegistrarsActionTest {
                         new UserRoles.Builder().setGlobalRole(GlobalRole.SUPPORT_LEAD).build()))));
     action.run();
     assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
-    assertThat(response.getPayload()).isEqualTo("[\"NewRegistrar\",\"TheRegistrar\"]");
+    String payload = response.getPayload();
+    assertThat(
+            ImmutableList.of("\"registrarId\":\"NewRegistrar\"", "\"registrarId\":\"TheRegistrar\"")
+                .stream()
+                .allMatch(s -> payload.contains(s)))
+        .isTrue();
   }
 
   @Test
-  void testSuccess_getRegistrarIds() {
+  void testSuccess_getRegistrars() {
     saveRegistrar("registrarId");
     RegistrarsAction action =
         createAction(
+            Action.Method.GET,
             AuthResult.create(
                 AuthLevel.USER,
                 UserAuthInfo.create(
                     createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))));
     action.run();
     assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
+    String payload = response.getPayload();
+    assertThat(
+            ImmutableList.of(
+                    "\"registrarId\":\"NewRegistrar\"",
+                    "\"registrarId\":\"TheRegistrar\"",
+                    "\"registrarId\":\"registrarId\"")
+                .stream()
+                .allMatch(s -> payload.contains(s)))
+        .isTrue();
+  }
+
+  @Test
+  void testSuccess_createRegistrar() {
+    RegistrarsAction action =
+        createAction(
+            Action.Method.POST,
+            AuthResult.create(
+                AuthLevel.USER,
+                UserAuthInfo.create(createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
+    Registrar r = loadRegistrar("regIdTest");
+    assertThat(r).isNotNull();
+    assertThat(
+            loadAllOf(RegistrarPoc.class).stream()
+                .filter(rPOC -> rPOC.getEmailAddress().equals("testEmailAddress@gmail.com"))
+                .findAny()
+                .isPresent())
+        .isTrue();
+  }
+
+  @Test
+  void testFailure_createRegistrar_missingValue() {
+    ImmutableMap<String, String> copy = ImmutableMap.copyOf(registrarParamMap);
+    copy.keySet()
+        .forEach(
+            key -> {
+              registrarParamMap =
+                  ImmutableMap.copyOf(
+                      copy.entrySet().stream()
+                          .filter(entry -> !entry.getKey().equals(key))
+                          .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue)));
+              RegistrarsAction action =
+                  createAction(
+                      Action.Method.POST,
+                      AuthResult.create(
+                          AuthLevel.USER,
+                          UserAuthInfo.create(
+                              createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+              action.run();
+              assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
+              assertThat(response.getPayload())
+                  .isEqualTo(
+                      GSON.toJson(
+                          String.format(
+                              "Missing value for %s", userFriendlyKeysToRegistrarKeys.get(key))));
+            });
+  }
+
+  @Test
+  void testFailure_createRegistrar_existingRegistrar() {
+    saveRegistrar("regIdTest");
+    RegistrarsAction action =
+        createAction(
+            Action.Method.POST,
+            AuthResult.create(
+                AuthLevel.USER,
+                UserAuthInfo.create(createUser(new UserRoles.Builder().setIsAdmin(true).build()))));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
     assertThat(response.getPayload())
-        .isEqualTo("[\"NewRegistrar\",\"TheRegistrar\",\"registrarId\"]");
+        .isEqualTo(GSON.toJson("Registrar with registrarId regIdTest already exists"));
   }
 
   @Test
@@ -83,6 +214,7 @@ class RegistrarsActionTest {
     saveRegistrar("registrarId");
     RegistrarsAction action =
         createAction(
+            Action.Method.GET,
             AuthResult.create(
                 AuthLevel.USER,
                 UserAuthInfo.create(
@@ -105,8 +237,44 @@ class RegistrarsActionTest {
         .build();
   }
 
-  private RegistrarsAction createAction(AuthResult authResult) {
+  private RegistrarsAction createAction(Action.Method method, AuthResult authResult) {
     response = new FakeResponse();
-    return new RegistrarsAction(authResult, response, GSON);
+    when(request.getMethod()).thenReturn(method.toString());
+    if (method.equals(Action.Method.GET)) {
+      return new RegistrarsAction(
+          request,
+          authResult,
+          response,
+          GSON,
+          Optional.ofNullable(null),
+          passwordGenerator,
+          passcodeGenerator);
+    } else {
+      try {
+        doReturn(new BufferedReader(new StringReader(registrarParamMap.toString())))
+            .when(request)
+            .getReader();
+      } catch (IOException e) {
+        return new RegistrarsAction(
+            request,
+            authResult,
+            response,
+            GSON,
+            Optional.ofNullable(null),
+            passwordGenerator,
+            passcodeGenerator);
+      }
+      Optional<Registrar> maybeRegistrar =
+          RegistrarConsoleModule.provideRegistrar(
+              GSON, RequestModule.provideJsonBody(request, GSON));
+      return new RegistrarsAction(
+          request,
+          authResult,
+          response,
+          GSON,
+          maybeRegistrar,
+          passwordGenerator,
+          passcodeGenerator);
+    }
   }
 }

core/src/test/java/google/registry/ui/server/console/settings/ContactActionTest.java

@@ -41,7 +41,6 @@ import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
-import google.registry.util.UtilsModule;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.StringReader;
@@ -73,7 +72,7 @@ class ContactActionTest {
   private Registrar testRegistrar;
   private final HttpServletRequest request = mock(HttpServletRequest.class);
   private RegistrarPoc testRegistrarPoc;
-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
   private FakeResponse response;
 
   @RegisterExtension
@@ -239,8 +238,7 @@ class ContactActionTest {
     if (method.equals(Action.Method.GET)) {
       return new ContactAction(request, authResult, response, GSON, registrarId, Optional.empty());
     } else {
-      when(request.getReader())
-          .thenReturn(new BufferedReader(new StringReader("{\"contacts\":" + contacts + "}")));
+      when(request.getReader()).thenReturn(new BufferedReader(new StringReader(contacts)));
       Optional<ImmutableSet<RegistrarPoc>> maybeContacts =
           RegistrarConsoleModule.provideContacts(
               GSON, RequestModule.provideJsonBody(request, GSON));

core/src/test/java/google/registry/ui/server/console/settings/SecurityActionTest.java

@@ -15,21 +15,17 @@
 package google.registry.ui.server.console.settings;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.CertificateSamples.SAMPLE_CERT;
 import static google.registry.testing.CertificateSamples.SAMPLE_CERT2;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.SqlHelper.saveRegistrar;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
 
 import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.ImmutableSortedMap;
-import com.google.common.net.InetAddresses;
 import com.google.gson.Gson;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.model.console.GlobalRole;
@@ -37,7 +33,6 @@ import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
 import google.registry.persistence.transaction.JpaTestExtensions;
-import google.registry.request.Action;
 import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthSettings.AuthLevel;
@@ -46,8 +41,6 @@ import google.registry.request.auth.UserAuthInfo;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
-import google.registry.util.CidrAddressBlock;
-import google.registry.util.UtilsModule;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.StringReader;
@@ -66,7 +59,7 @@ class SecurityActionTest {
           "{\"registrarId\": \"registrarId\", \"clientCertificate\": \"%s\","
               + " \"ipAddressAllowList\": [\"192.168.1.1/32\"]}",
           SAMPLE_CERT2);
-  private static final Gson GSON = UtilsModule.provideGson();
+  private static final Gson GSON = RequestModule.provideGson();
   private final HttpServletRequest request = mock(HttpServletRequest.class);
   private final FakeClock clock = new FakeClock();
   private Registrar testRegistrar;
@@ -94,39 +87,11 @@ class SecurityActionTest {
     testRegistrar = saveRegistrar("registrarId");
   }
 
-  @Test
-  void testSuccess_getRegistrarInfo() throws IOException {
-    persistResource(
-        testRegistrar
-            .asBuilder()
-            .setClientCertificate(SAMPLE_CERT, clock.nowUtc())
-            .setIpAddressAllowList(
-                ImmutableSet.of(
-                    CidrAddressBlock.create(InetAddresses.forString("192.168.1.1"), 32),
-                    CidrAddressBlock.create(InetAddresses.forString("2001:db8::1"), 128)))
-            .build());
-    SecurityAction action =
-        createAction(
-            Action.Method.GET,
-            AuthResult.create(
-                AuthLevel.USER,
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
-            testRegistrar.getRegistrarId());
-    action.run();
-    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
-    String payload = response.getPayload().replace("\\n", "").replace("\\u003d", "=");
-    assertThat(payload).contains(SAMPLE_CERT.replace("\n", ""));
-    assertThat(payload).contains("192.168.1.1/32");
-    assertThat(payload).contains("2001:db8:0:0:0:0:0:1/128");
-  }
-
   @Test
   void testSuccess_postRegistrarInfo() throws IOException {
     clock.setTo(DateTime.parse("2020-11-01T00:00:00Z"));
     SecurityAction action =
         createAction(
-            Action.Method.POST,
             AuthResult.create(
                 AuthLevel.USER,
                 UserAuthInfo.create(
@@ -149,28 +114,12 @@ class SecurityActionTest {
         .build();
   }
 
-  private SecurityAction createAction(
-      Action.Method method, AuthResult authResult, String registrarId) throws IOException {
-    when(request.getMethod()).thenReturn(method.toString());
-    if (method.equals(Action.Method.GET)) {
+  private SecurityAction createAction(AuthResult authResult, String registrarId)
+      throws IOException {
+    doReturn(new BufferedReader(new StringReader(jsonRegistrar1))).when(request).getReader();
+    Optional<Registrar> maybeRegistrar =
+        RegistrarConsoleModule.provideRegistrar(GSON, RequestModule.provideJsonBody(request, GSON));
       return new SecurityAction(
-          request,
-          authResult,
-          response,
-          GSON,
-          certificateChecker,
-          registrarAccessor,
-          registrarId,
-          Optional.empty());
-    } else {
-      doReturn(new BufferedReader(new StringReader("{\"registrar\":" + jsonRegistrar1 + "}")))
-          .when(request)
-          .getReader();
-      Optional<Registrar> maybeRegistrar =
-          RegistrarConsoleModule.provideRegistrar(
-              GSON, RequestModule.provideJsonBody(request, GSON));
-      return new SecurityAction(
-          request,
           authResult,
           response,
           GSON,
@@ -178,6 +127,6 @@ class SecurityActionTest {
           registrarAccessor,
           registrarId,
           maybeRegistrar);
-    }
+
   }
 }

core/src/test/resources/google/registry/flows/domain/domain_delete_response_fee_free_grace.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<epp xmlns:domain="urn:ietf:params:xml:ns:domain-1.0" xmlns:contact="urn:ietf:params:xml:ns:contact-1.0" xmlns:fee="urn:ietf:params:xml:ns:fee-0.6" xmlns:packageToken="urn:google:params:xml:ns:packageToken-1.0" xmlns="urn:ietf:params:xml:ns:epp-1.0" xmlns:rgp="urn:ietf:params:xml:ns:rgp-1.0" xmlns:fee11="urn:ietf:params:xml:ns:fee-0.11" xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12" xmlns:launch="urn:ietf:params:xml:ns:launch-1.0" xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1" xmlns:host="urn:ietf:params:xml:ns:host-1.0">
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12">
   <response>
     <result code="1000">
       <msg>Command completed successfully</msg>

core/src/test/resources/google/registry/flows/domain/domain_info_bulk.xml

@@ -7,9 +7,9 @@
       </domain:info>
     </info>
     <extension>
-      <packageToken:info
-          xmlns:packageToken=
-              "urn:google:params:xml:ns:packageToken-1.0" />
+      <bulkToken:info
+          xmlns:bulkToken=
+              "urn:google:params:xml:ns:bulkToken-1.0" />
     </extension>
     <clTRID>ABC-12345</clTRID>
   </command>

core/src/test/resources/google/registry/flows/domain/domain_info_response_bulk.xml

@@ -32,10 +32,10 @@
       </domain:infData>
     </resData>
     <extension>
-      <packageToken:packageData xmlns:packageToken=
-          "urn:google:params:xml:ns:packageToken-1.0">
-        <packageToken:token></packageToken:token>
-      </packageToken:packageData>
+      <bulkToken:bulkData xmlns:bulkToken=
+          "urn:google:params:xml:ns:bulkToken-1.0">
+        <bulkToken:token>abc123</bulkToken:token>
+      </bulkToken:bulkData>
     </extension>
     <trID>
       <clTRID>ABC-12345</clTRID>

core/src/test/resources/google/registry/flows/domain/domain_info_response_empty_bulk_package.xml

@@ -32,10 +32,10 @@
       </domain:infData>
     </resData>
     <extension>
-      <packageToken:packageData xmlns:packageToken=
-          "urn:google:params:xml:ns:packageToken-1.0">
-        <packageToken:token>abc123</packageToken:token>
-      </packageToken:packageData>
+      <bulkToken:bulkData xmlns:bulkToken=
+          "urn:google:params:xml:ns:bulkToken-1.0">
+        <bulkToken:token></bulkToken:token>
+      </bulkToken:bulkData>
     </extension>
     <trID>
       <clTRID>ABC-12345</clTRID>

core/src/test/resources/google/registry/flows/domain/domain_info_response_superuser_bulk.xml

@@ -22,10 +22,10 @@
       </domain:infData>
     </resData>
     <extension>
-      <packageToken:packageData xmlns:packageToken=
-          "urn:google:params:xml:ns:packageToken-1.0">
-        <packageToken:token>abc123</packageToken:token>
-      </packageToken:packageData>
+      <bulkToken:bulkData xmlns:bulkToken=
+          "urn:google:params:xml:ns:bulkToken-1.0">
+        <bulkToken:token>abc123</bulkToken:token>
+      </bulkToken:bulkData>
     </extension>
     <trID>
       <clTRID>ABC-12345</clTRID>

core/src/test/resources/google/registry/module/frontend/frontend_routing.txt

@@ -1,9 +1,9 @@
 PATH                           CLASS                         METHODS  OK AUTH_METHODS MIN  USER_POLICY
 /_dr/epp                       EppTlsAction                  POST     n  API          APP  PUBLIC
 /console-api/domain            ConsoleDomainGetAction        GET      n  API,LEGACY   USER PUBLIC
-/console-api/registrars        RegistrarsAction              GET      n  API,LEGACY   USER PUBLIC
+/console-api/registrars        RegistrarsAction              GET,POST n  API,LEGACY   USER PUBLIC
 /console-api/settings/contacts ContactAction                 GET,POST n  API,LEGACY   USER PUBLIC
-/console-api/settings/security SecurityAction                GET,POST n  API,LEGACY   USER PUBLIC
+/console-api/settings/security SecurityAction                POST     n  API,LEGACY   USER PUBLIC
 /registrar                     ConsoleUiAction               GET      n  API,LEGACY   NONE PUBLIC
 /registrar-create              ConsoleRegistrarCreatorAction POST,GET n  API,LEGACY   NONE PUBLIC
 /registrar-ote-setup           ConsoleOteSetupAction         POST,GET n  API,LEGACY   NONE PUBLIC

core/src/test/resources/google/registry/tools/tld.yaml

@@ -0,0 +1,55 @@
+tldStr: "xn--q9jyb4c"
+roidSuffix: "Q9JYB4C"
+pricingEngineClassName: "google.registry.model.pricing.StaticPremiumListPricingEngine"
+dnsWriters:
+- "VoidDnsWriter"
+numDnsPublishLocks: 1
+dnsAPlusAaaaTtl: null
+dnsNsTtl: null
+dnsDsTtl: null
+tldUnicode: "みんな"
+driveFolderId: null
+tldType: "REAL"
+invoicingEnabled: false
+tldStateTransitions:
+  "1970-01-01T00:00:00.000Z": "GENERAL_AVAILABILITY"
+creationTime: "2022-09-01T00:00:00.000Z"
+reservedListNames: []
+premiumListName: "xn--q9jyb4c"
+escrowEnabled: false
+dnsPaused: false
+addGracePeriodLength: 432000000
+anchorTenantAddGracePeriodLength: 2592000000
+autoRenewGracePeriodLength: 3888000000
+redemptionGracePeriodLength: 2592000000
+renewGracePeriodLength: 432000000
+transferGracePeriodLength: 432000000
+automaticTransferLength: 432000000
+pendingDeleteLength: 432000000
+currency: "USD"
+createBillingCost:
+  currency: "USD"
+  amount: 13.00
+restoreBillingCost:
+  currency: "USD"
+  amount: 17.00
+serverStatusChangeBillingCost:
+  currency: "USD"
+  amount: 19.00
+registryLockOrUnlockBillingCost:
+  currency: "USD"
+  amount: 0.00
+renewBillingCostTransitions:
+  "1970-01-01T00:00:00.000Z":
+    currency: "USD"
+    amount: 11.00
+lordnUsername: null
+claimsPeriodEnd: "294247-01-10T04:00:54.775Z"
+allowedRegistrantContactIds: []
+allowedFullyQualifiedHostNames: []
+defaultPromoTokens: []
+idnTables: []
+eapFeeSchedule:
+  "1970-01-01T00:00:00.000Z":
+    currency: "USD"
+    amount: 0.00

db/build.gradle

@@ -179,6 +179,14 @@ dependencies {
   testImplementation project(path: ':common', configuration: 'testing')
 }
 
+test {
+  // When set, run FlywayDeadlockTest#validNewScript.
+  def deadlock_check = 'do_flyway_deadlock_check'
+  if (findProperty(deadlock_check)) {
+    systemProperty deadlock_check, findProperty(deadlock_check)
+  }
+}
+
 task generateFlywayIndex {
   def flywayBase = "$projectDir/src/main/resources/sql/flyway"
   def filenamePattern = /V(\d+)__.*\.sql/

db/gradle.lockfile

@@ -25,8 +25,7 @@ com.google.api:gax:2.31.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20230607-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.8.1=testCompileClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.cloud.sql:jdbc-socket-factory-core:1.13.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud.sql:postgres-socket-factory:1.13.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -34,7 +33,8 @@ com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,test
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.18.0=deploy_jar,runtimeClasspath
+com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
@@ -43,12 +43,13 @@ com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,err
 com.google.flogger:flogger-system-backend:0.7.4=testRuntimeClasspath
 com.google.flogger:flogger:0.7.4=testCompileClasspath,testRuntimeClasspath
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=deploy_jar,runtimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle
 com.google.guava:guava:32.1.1-android=deploy_jar,runtimeClasspath
-com.google.guava:guava:32.1.1-jre=testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.guava:guava:32.1.2-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.42.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -57,8 +58,8 @@ com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:2.8=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client:1.34.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.truth.extensions:truth-java8-extension:1.1.3=testCompileClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.3=testCompileClasspath,testRuntimeClasspath
+com.google.truth.extensions:truth-java8-extension:1.1.5=testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.5=testCompileClasspath,testRuntimeClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
@@ -84,11 +85,12 @@ org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.3=testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:checker-qual:3.12.0=checkstyle
-org.checkerframework:checker-qual:3.33.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.33.0=deploy_jar,runtimeClasspath
+org.checkerframework:checker-qual:3.35.0=testCompileClasspath,testRuntimeClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor
-org.flywaydb:flyway-core:9.21.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.21.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
 org.jacoco:org.jacoco.agent:0.8.9=jacocoAgent,jacocoAnt
 org.jacoco:org.jacoco.ant:0.8.9=jacocoAnt
@@ -107,8 +109,7 @@ org.ow2.asm:asm-commons:9.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testRuntimeClasspath
 org.ow2.asm:asm-util:9.5=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.1=testCompileClasspath
-org.ow2.asm:asm:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor

db/src/test/java/google/registry/sql/flyway/FlywayDeadlockTest.java

@@ -37,6 +37,7 @@ import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledIfSystemProperty;
 
 /**
  * Checks if new Flyway scripts may cause Database deadlock.
@@ -102,7 +103,18 @@ public class FlywayDeadlockTest {
               CASE_INSENSITIVE),
           3);
 
+  /**
+   * Validates that new flyway scripts (if exist) do not have deadlock-inducing patterns.
+   *
+   * <p>This test may break if not invoked in a cloned Nomulus repository, therefore it is disabled
+   * by default. User can enable it by setting the {@code do_flyway_deadlock_check} system property
+   * with arbitrary non-empty value.
+   */
   @Test
+  @EnabledIfSystemProperty(
+      named = "do_flyway_deadlock_check",
+      matches = ".+",
+      disabledReason = "Not compatible with the release process on Cloud Build.")
   public void validateNewFlywayScripts() {
     ImmutableList<Path> newScriptPaths = findChangedFlywayScripts();
     ImmutableList<String> scriptAndLockedElements =

dependencies.gradle

@@ -133,8 +133,8 @@ ext {
       'com.google.cloud:google-cloud-core:[1.94.3,)',
       'com.google.cloud:google-cloud-core-http:[1.94.3,)',
       'com.google.cloud:google-cloud-secretmanager:[1.4.0,)',
-      'com.google.cloud:google-cloud-storage:[1.113.12,)',
-      'com.google.cloud:google-cloud-nio:[0.123.4,)',
+      'com.google.cloud:google-cloud-storage:[1.113.12, 2.22.6]!!',
+      'com.google.cloud:google-cloud-nio:[0.123.4, 0.126.19]!!',
       'com.google.cloud:google-cloud-tasks:[1.33.2,)',
       'com.google.code.findbugs:jsr305:[3.0.2,)',
       'com.google.code.gson:gson:[2.8.6,)',

docs/flows.md

@@ -499,8 +499,8 @@ comes in at the exact millisecond that the domain would have expired.
     *   Resource status prohibits this operation.
     *   The allocation token is not currently valid.
 *   2305
-    *   The __REMOVEPACKAGE__ token is missing on a package domain command
-    *   The __REMOVEPACKAGE__ token is not allowed on non package domains
+    *   The __REMOVEDOMAIN__ token is missing on a package domain command
+    *   The __REMOVEDOMAIN__ token is not allowed on non package domains
     *   The allocation token is not valid for this domain.
     *   The allocation token is not valid for this registrar.
     *   The allocation token is not valid for this TLD.

docs/gradle.lockfile

@@ -7,14 +7,14 @@ args4j:args4j:2.0.23=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.101tec:zkclient:0.10=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-annotations:2.10.3=testCompileClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:2.9.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -36,7 +36,7 @@ com.google.api-client:google-api-client-jackson2:1.32.2=deploy_jar,runtimeClassp
 com.google.api-client:google-api-client-java6:1.35.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:1.35.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.25.0-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.38.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.162.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.162.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -46,7 +46,7 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.8=deploy_jar,runtimeCla
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.25.0-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.20.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.38.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.162.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -63,7 +63,7 @@ com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.22.0=deploy_jar,r
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.25.0-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.112.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.112.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -88,14 +88,14 @@ com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=deploy_jar,r
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20230526-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20230607-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-testing:1.9.86=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.1.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=testCompileClasspath
 com.google.auto.value:auto-value-annotations:1.10.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.8.1=testCompileClasspath
 com.google.auto.value:auto-value:1.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.cloud.bigdataoss:gcsio:2.2.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -107,16 +107,16 @@ com.google.cloud.sql:postgres-socket-factory:1.13.1=deploy_jar,runtimeClasspath,
 com.google.cloud:google-cloud-bigquerystorage:2.38.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.23.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.23.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.21.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.21.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.13.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:3.20.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.123.14=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsublite:1.12.8=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.25.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.22.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.4.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.13.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -126,7 +126,8 @@ com.google.code.gson:gson:2.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspat
 com.google.common.html.types:types:1.0.6=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.47=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
@@ -138,11 +139,13 @@ com.google.flogger:flogger-system-backend:0.7.4=deploy_jar,runtimeClasspath,test
 com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:google-extensions:0.7.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,testCompileClasspath
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle
-com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava:32.1.2-jre=compileClasspath,testCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,errorprone,testAnnotationProcessor,testCompileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -168,7 +171,8 @@ com.google.protobuf:protobuf-java:3.23.2=deploy_jar,runtimeClasspath,testRuntime
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2021-02-01=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.5=testCompileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.googlecode.json-simple:json-simple:1.1.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:73.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -205,7 +209,7 @@ io.grpc:grpc-netty-shaded:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspat
 io.grpc:grpc-netty:1.55.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.55.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-services:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-xds:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -246,7 +250,7 @@ javax.servlet:servlet-api:2.5=deploy_jar,runtimeClasspath,testRuntimeClasspath
 javax.validation:validation-api:1.0.0.GA=deploy_jar,runtimeClasspath,testRuntimeClasspath
 javax.xml.bind:jaxb-api:2.3.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 jline:jline:1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-joda-time:joda-time:2.10.14=deploy_jar,runtimeClasspath,testRuntimeClasspath
+joda-time:joda-time:2.10.10=deploy_jar,runtimeClasspath,testRuntimeClasspath
 junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.12.18=deploy_jar,runtimeClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.12.1=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -277,7 +281,7 @@ org.apache.beam:beam-vendor-grpc-1_54_0:0.1=deploy_jar,runtimeClasspath,testRunt
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.apache.commons:commons-compress:1.23.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.12.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.13.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
@@ -288,7 +292,8 @@ org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,testCompileClass
 org.checkerframework:checker-compat-qual:2.5.5=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:checker-qual:3.12.0=checkstyle
-org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.35.0=testCompileClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.jackson:jackson-core-asl:1.9.13=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -303,7 +308,7 @@ org.eclipse.jetty:jetty-server:9.4.49.v20220914=deploy_jar,runtimeClasspath,test
 org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:9.4.49.v20220914=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.21.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.gwtproject:gwt-user:2.10.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -340,8 +345,7 @@ org.ow2.asm:asm-commons:9.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testRuntimeClasspath
 org.ow2.asm:asm-util:9.5=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.1=testCompileClasspath
-org.ow2.asm:asm:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=deploy_jar,jacocoAnt,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor
@@ -364,7 +368,7 @@ org.threeten:threetenbp:1.6.8=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.tukaani:xz:1.5=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:1.33=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=deploy_jar,runtimeClasspath,testRuntimeClasspath

integration/build.gradle

@@ -77,6 +77,10 @@ task extractSqlIntegrationTestSuite (type: Copy) {
   }
   into unpackedTestDir
   includeEmptyDirs = false
+
+  if (nomulus_version == USE_LOCAL) {
+    dependsOn ':core:testUberJar'
+  }
 }
 
 // TODO(weiminyu): inherit from FilteringTest (defined in :core).

java_common.gradle

@@ -193,3 +193,10 @@ jacocoTestCoverageVerification {
     }
   }
 }
+
+project.tasks.withType(Copy) {
+  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+}
+project.tasks.withType(Jar) {
+  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+}

networking/gradle.lockfile

@@ -23,8 +23,8 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.86=deploy_jar,runtimeClasspath,te
 com.google.appengine:appengine-testing:1.9.86=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=testCompileClasspath
 com.google.auto.value:auto-value-annotations:1.10.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.8.1=testCompileClasspath
 com.google.auto.value:auto-value:1.10.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.cloud:google-cloud-tasks:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -37,7 +37,8 @@ com.google.dagger:dagger-spi:2.47=annotationProcessor,testAnnotationProcessor
 com.google.dagger:dagger:2.47=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.devtools.ksp:symbol-processing-api:1.8.0-1.0.9=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=errorprone
 com.google.errorprone:error_prone_annotations:2.7.1=annotationProcessor,checkstyle,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
@@ -48,11 +49,13 @@ com.google.flogger:flogger-system-backend:0.7.4=deploy_jar,runtimeClasspath,test
 com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,testCompileClasspath
 com.google.guava:guava:27.0.1-jre=errorprone
 com.google.guava:guava:31.0.1-jre=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava:32.1.2-jre=compileClasspath,testCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,errorprone,testAnnotationProcessor,testCompileClasspath,runtimeClasspath,deploy_jar,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.42.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -64,7 +67,8 @@ com.google.protobuf:protobuf-java-util:3.23.2=deploy_jar,runtimeClasspath,testRu
 com.google.protobuf:protobuf-java:3.23.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.re2j:re2j:1.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.5=testCompileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.ibm.icu:icu4j:73.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
@@ -124,7 +128,8 @@ org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,testCompileClass
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 org.checkerframework:checker-qual:3.0.0=errorprone
 org.checkerframework:checker-qual:3.12.0=annotationProcessor,checkstyle,testAnnotationProcessor
-org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.35.0=testCompileClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=errorprone
@@ -156,8 +161,8 @@ org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:9.5=jacocoAnt
-org.ow2.asm:asm:9.1=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.5=jacocoAnt
+org.ow2.asm:asm:9.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=jacocoAnt,testCompileClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor
@@ -168,5 +173,5 @@ org.slf4j:slf4j-api:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.6.8=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 empty=errorproneJavac

prober/gradle.lockfile

@@ -23,8 +23,8 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.86=deploy_jar,runtimeClasspath,te
 com.google.appengine:appengine-testing:1.9.86=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=testCompileClasspath
 com.google.auto.value:auto-value-annotations:1.10.2=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.8.1=testCompileClasspath
 com.google.auto.value:auto-value:1.10.2=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.cloud:google-cloud-tasks:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -37,7 +37,8 @@ com.google.dagger:dagger-spi:2.47=annotationProcessor,testAnnotationProcessor
 com.google.dagger:dagger:2.47=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.devtools.ksp:symbol-processing-api:1.8.0-1.0.9=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.18.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.19.1=testCompileClasspath
 com.google.errorprone:error_prone_annotations:2.3.4=errorprone
 com.google.errorprone:error_prone_annotations:2.7.1=annotationProcessor,checkstyle,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
@@ -48,11 +49,13 @@ com.google.flogger:flogger-system-backend:0.7.4=deploy_jar,runtimeClasspath,test
 com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,testCompileClasspath
 com.google.guava:guava:27.0.1-jre=errorprone
 com.google.guava:guava:31.0.1-jre=annotationProcessor,checkstyle,testAnnotationProcessor
-com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.google.guava:guava:32.1.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava:32.1.2-jre=compileClasspath,testCompileClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,errorprone,testAnnotationProcessor,testCompileClasspath,runtimeClasspath,deploy_jar,testRuntimeClasspath
 com.google.http-client:google-http-client-apache-v2:1.42.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -67,7 +70,8 @@ com.google.protobuf:protobuf-java:3.23.2=deploy_jar,runtimeClasspath,testRuntime
 com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.re2j:re2j:1.1=compileClasspath,testCompileClasspath
 com.google.re2j:re2j:1.7=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.truth:truth:1.1.5=testCompileClasspath
 com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.ibm.icu:icu4j:73.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.puppycrawl.tools:checkstyle:9.3=checkstyle
@@ -113,8 +117,10 @@ javax.mail:mail:1.5.0-b01=deploy_jar,runtimeClasspath,testRuntimeClasspath
 javax.xml.bind:jaxb-api:2.4.0-b180830.0359=deploy_jar,runtimeClasspath,testRuntimeClasspath
 joda-time:joda-time:2.12.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.12.19=testCompileClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.12.19=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.12.19=testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.14.5=testCompileClasspath
+net.bytebuddy:byte-buddy:1.12.19=testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.14.5=testCompileClasspath
 net.java.dev.jna:jna:5.12.1=testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:10.6=checkstyle
@@ -129,7 +135,8 @@ org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,testCompileClass
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 org.checkerframework:checker-qual:3.0.0=errorprone
 org.checkerframework:checker-qual:3.12.0=annotationProcessor,checkstyle,testAnnotationProcessor
-org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.33.0=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.35.0=testCompileClasspath
 org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.17=errorprone
@@ -158,13 +165,14 @@ org.junit.platform:junit-platform-runner:1.10.0=testCompileClasspath,testRuntime
 org.junit.platform:junit-platform-suite-api:1.10.0=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-suite-commons:1.10.0=testRuntimeClasspath
 org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-core:4.11.0=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:4.11.0=testRuntimeClasspath
+org.mockito:mockito-core:5.4.0=testCompileClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.5=jacocoAnt
 org.ow2.asm:asm-tree:9.5=jacocoAnt
-org.ow2.asm:asm:9.1=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.5=jacocoAnt
+org.ow2.asm:asm:9.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=jacocoAnt,testCompileClasspath
 org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
 org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor
@@ -175,7 +183,7 @@ org.slf4j:slf4j-api:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.6.8=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xpp3:xpp3:1.1.4c=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=errorproneJavac

processor/gradle.lockfile

@@ -14,11 +14,11 @@ com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone
 com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava-parent:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-parent:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.guava:guava:31.0.1-jre=checkstyle
-com.google.guava:guava:32.1.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.guava:guava:32.1.2-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:2.8=compileClasspath,testCompileClasspath

proxy/gradle.lockfile

@@ -2,9 +2,9 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.beust:jcommander:1.60=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.2=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:2.9.3=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-api:3.3.0=testCompileClasspath,testRuntimeClasspath
@@ -13,32 +13,39 @@ com.github.docker-java:docker-java-transport:3.3.0=testCompileClasspath,testRunt
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.112.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.112.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.22.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.17.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.14.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.31.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.31.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.31.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.22.0=compileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-common-protos:2.22.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.17.0=compileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-iam-v1:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api:api-common:2.14.0=compileClasspath,testCompileClasspath
+com.google.api:api-common:2.14.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.31.0=compileClasspath,testCompileClasspath
+com.google.api:gax-grpc:2.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.31.0=compileClasspath,testCompileClasspath
+com.google.api:gax-httpjson:2.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api:gax:2.31.0=compileClasspath,testCompileClasspath
+com.google.api:gax:2.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudkms:v1-rev20230421-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:1.9.86=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.appengine:appengine-testing:1.9.86=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.19.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value-annotations:1.10.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auto.value:auto-value-annotations:1.10.1=compileClasspath,testCompileClasspath
+com.google.auto.value:auto-value-annotations:1.10.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value:1.10.2=annotationProcessor,deploy_jar,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.cloud:google-cloud-core-grpc:2.21.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.21.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.25.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.21.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.22.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
@@ -94,19 +101,27 @@ commons-collections:commons-collections:3.2.2=checkstyle
 commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 info.picocli:picocli:4.6.2=checkstyle
 io.github.java-diff-utils:java-diff-utils:4.12=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-alts:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-auth:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-context:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-grpclb:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-netty-shaded:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-protobuf-lite:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-protobuf:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.55.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-services:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.56.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.55.3=compileClasspath,testCompileClasspath
+io.grpc:grpc-stub:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-xds:1.56.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-buffer:4.1.59.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-codec-http:4.1.59.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -191,5 +206,5 @@ org.slf4j:slf4j-api:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:1.18.3=testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.6.8=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.1=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=errorproneJavac

release/cloudbuild-delete.yaml

@@ -1,8 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-delete.yaml --dryrun=false \
-# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
-#
 # This will delete all stopped GAE versions (save 3) as there is a limit on how
 # many versions can exist in a project.
 #

release/cloudbuild-deploy.yaml

@@ -1,10 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-deploy.yaml --dryrun=false \
-# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
-#
-# This will deploy the GAE config files and save the deployed tags in GCS.
-#
 # To manually trigger a build on GCB, run:
 # gcloud builds submit --config=cloudbuild-deploy.yaml \
 # --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..

release/cloudbuild-dev-resource.yaml

@@ -1,8 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# In the root of a nomulus source tree, run:
-# cloud-build-local --config=cloudbuild-dev-resource.yaml --dryrun=false ..
-#
 # This will compile javadoc for the FOSS version of the code base and replace
 # the content at gs://${PROJECT_ID}-javadoc with the it. The compiled javadoc
 # can then be accesssed at https://storage.googleapis.com/${PROJECT_ID}-javadoc

release/cloudbuild-kythe.yaml

@@ -1,8 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# In the root of a nomulus source tree, run:
-# cloud-build-local --config=cloudbuild-kythe.yaml --dryrun=false \
-#   --substitutions _KYTHE_VERSION=[kythe_version],COMMIT_SHA=[hash] ..
 # This will download kythe version ${kythe_version} (must be higher than
 # v0.0.39 and build a ${hash}.kzip file for Kythe to enable cross referencing.
 #

release/cloudbuild-nomulus.yaml

@@ -1,15 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# You will need access to a private registry, so be sure to install the docker
-# credential helper.
-# Then, in the root of a nomulus source tree, run:
-# cloud-build-local --config=cloudbuild-nomulus.yaml --dryrun=false \
-#   --substitutions TAG_NAME=[TAG] ..
-# This will build the contents of the current directory and generate the
-# nomulus war-files locally.
-# The PROJECT_ID is the current project name that gcloud uses.
-# You can add "--push true" to have the image pushed to GCR.
-#
 # To manually trigger a build on GCB, run:
 # gcloud builds submit --config cloudbuild-nomulus.yaml --substitutions TAG_NAME=[TAG] ..
 #

release/cloudbuild-proxy.yaml

@@ -1,9 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# You will need access to a private registry, so be sure to install the docker
-# credential helper.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# Then run:
-# cloud-build-local --config=cloudbuild-proxy.yaml --dryrun=false --substitutions TAG_NAME=[TAG] ..
 # This will create a docker image named gcr.io/[PROJECT_ID]/proxy:[TAG] locally.
 # The PROJECT_ID is the current project name that gcloud uses.
 #

release/cloudbuild-release.yaml

@@ -1,11 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# You will need access to a private registry, so be sure to install the docker
-# credential helper.
-# See: https://cloud.google.com/cloud-build/docs/build-debug-locally
-# Then run:
-# cloud-build-local --config=cloudbuild-release.yaml --dryrun=false \
-#   --substitutions TAG_NAME=[TAG],_INTERNAL_REPO_URL=[URL] ..
-#
 # To manually trigger a build on GCB, run:
 # gcloud builds submit --config cloudbuild-release.yaml --substitutions \
 #   TAG_NAME=[TAG],_INTERNAL_REPO_URL=[URL] ..

release/cloudbuild-renew-prober-certs.yaml

@@ -1,8 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-renew-prober-certs.yaml --dryrun=false \
-# --substitutions=_ENV=[ENV] ..
-#
 # This will generate a new SSL certificate and apply it to the probers in the
 # environment specified by ${_ENV}.
 #

release/cloudbuild-schema-deploy.yaml

@@ -1,8 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-schema-deploy.yaml --dryrun=false \
-# --substitutions=TAG_NAME=[TAG],_ENV=[ENV] ..
-#
 # This will deploy Cloud SQL schema release with tag value ${TAG_NAME} to
 # the environment specified by ${_ENV}.
 #

release/cloudbuild-schema-verify.yaml

@@ -2,11 +2,6 @@
 # '_ENV' variable is the same as the golden schema in the current release for
 # that environment.
 #
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-schema-verify.yaml --dryrun=false \
-# --substitutions=_ENV=[ENV] ..
-#
 # To manually trigger a build on GCB, run:
 # gcloud builds submit --config=cloudbuild-schema-verify.yaml \
 # --substitutions=_ENV=[ENV] ..

release/cloudbuild-sync.yaml

@@ -1,6 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-sync.yaml --dryrun=false --substitutions TAG_NAME=[TAG] ..
 # This will sync the folder gs://[PROJECT_ID]-deploy/[TAG] to gs://[PROJECT_ID]-deploy/live.
 # The PROJECT_ID is the current project name that gcloud uses.
 #

release/cloudbuild-tag.yaml

@@ -1,7 +1,3 @@
-# To run the build locally, install cloud-build-local first.
-# Then run:
-# cloud-build-local --config=cloudbuild-tag.yaml --dryrun=false --substitutions \
-#   TAG_NAME=[TAG],_IMAGE=[IMAGE] ..
 # This will add a "live" tag to the image in gcr.io/[PROJECT_ID]/[IMAGE]:[TAG].
 # The PROJECT_ID is the current project name that gcloud uses.
 #

release/update_num_instances.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Copyright 2023 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# This script updates number of instances of the service running on GCP
+# Required parameters are:
+# 1) projectId
+# 2) service name
+#
+# Example:
+# ./update_num_instances.sh domain-registry-sandbox pubapi
+set -e
+project=$1
+service=$2
+[[ -z "$1" || -z "$2" ]] && { echo "2 parameters required - projectId and service" ; exit 1; }
+echo "Project: $project";
+echo "Service: $service";
+
+deployed_version=$(gcloud app versions list --service "${service}" \
+    --project "${project}" \
+    --filter "TRAFFIC_SPLIT>0.00" \
+    --format="csv[no-heading](VERSION.ID)")
+
+service_description=$(curl -H "Authorization: Bearer $(gcloud auth print-access-token)" https://appengine.googleapis.com/v1/apps/${project}/services/${service}/versions/${deployed_version})
+echo "Service configuration: $service_description"
+
+echo "Input new number of instances: "
+
+read num_instances
+
+if [[ -n ${num_instances//[0-9]/} ]]; then
+    echo "Should be an integer"
+    exit 1;
+fi
+
+echo "Settings new number of instances: $num_instances"
+
+curl -X PATCH https://appengine.googleapis.com/v1/apps/${project}/services/${service}/versions/${deployed_version}?updateMask=manualScaling.instances \
+    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
+    -H 'Content-Type: application/json' \
+    -d "{ \"manualScaling\": { \"instances\": $num_instances }}"
+
+service_description=$(curl -H "Authorization: Bearer $(gcloud auth print-access-token)" https://appengine.googleapis.com/v1/apps/${project}/services/${service}/versions/${deployed_version})
+echo "Updated service configuration: $service_description"

services/backend/gradle.lockfile

@@ -6,14 +6,14 @@ aopalliance:aopalliance:1.0=compileClasspath,runtimeClasspath,testCompileClasspa
 args4j:args4j:2.0.23=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.101tec:zkclient:0.10=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.beust:jcommander:1.60=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.15.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.14.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:2.9.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.docker-java:docker-java-api:3.3.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -33,7 +33,7 @@ com.google.api-client:google-api-client-jackson2:1.32.2=compileClasspath,runtime
 com.google.api-client:google-api-client-java6:1.35.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:1.35.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.162.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -43,7 +43,7 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.8=compileClasspath,runt
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-common-protos:2.20.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:2.38.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.162.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -61,7 +61,7 @@ com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.22.0=compileClass
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.25.0-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.22.6-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.22.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.112.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.112.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -86,7 +86,7 @@ com.google.apis:google-api-services-monitoring:v3-rev20230529-2.0.0=compileClass
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sheets:v4-rev20230526-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20230607-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20230617-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20230301-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:1.9.86=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-testing:1.9.86=runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.19.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -103,9 +103,9 @@ com.google.cloud.sql:postgres-socket-factory:1.13.1=compileClasspath,runtimeClas
 com.google.cloud:google-cloud-bigquerystorage:2.38.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.23.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.23.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.13.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-monitoring:3.20.0=runtimeClasspath,testRuntimeClasspath
@@ -113,7 +113,7 @@ com.google.cloud:google-cloud-pubsub:1.123.14=compileClasspath,runtimeClasspath,
 com.google.cloud:google-cloud-pubsublite:1.12.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.22.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.25.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.22.6=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-tasks:2.22.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.4.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.13.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -185,7 +185,7 @@ io.grpc:grpc-netty-shaded:1.56.1=compileClasspath,runtimeClasspath,testCompileCl
 io.grpc:grpc-netty:1.55.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.56.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf:1.56.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.56.1=runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.55.3=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-services:1.55.1=compileClasspath,testCompileClasspath
 io.grpc:grpc-services:1.56.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.56.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -228,7 +228,7 @@ javax.servlet:servlet-api:2.5=compileClasspath,runtimeClasspath,testCompileClass
 javax.validation:validation-api:1.0.0.GA=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 javax.xml.bind:jaxb-api:2.3.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jline:jline:1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-joda-time:joda-time:2.10.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+joda-time:joda-time:2.10.10=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.12.18=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.12.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-format:5.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -256,7 +256,7 @@ org.apache.beam:beam-vendor-grpc-1_54_0:0.1=compileClasspath,runtimeClasspath,te
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-compress:1.23.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.12.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.13.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.bouncycastle:bcpg-jdk15on:1.67=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -276,7 +276,7 @@ org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,runtimeClasspat
 org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:9.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:9.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.gwtproject:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -312,7 +312,7 @@ org.threeten:threetenbp:1.6.8=compileClasspath,runtimeClasspath,testCompileClass
 org.tukaani:xz:1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:1.33=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:16.10.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-diagram:16.10.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:16.10.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath