Allow console access for all not NONE-type global users (#2441)

This is fairly simple, similar to most of the other Get*Command classes

appengine_war.gradle

@@ -47,10 +47,6 @@ war {
 
 if (project.path == ":services:default") {
     war {
-        from("${rootDir}/console-webapp/dist/console-webapp") {
-            include "**/*"
-            into("console")
-        }
         from("${coreResourcesDir}/google/registry/ui") {
             include "registrar_bin.js"
             if (environment != "production") {
@@ -103,10 +99,11 @@ explodeWar.doLast {
     file("${it.explodedAppDirectory}/WEB-INF/lib/tools.jar").setWritable(true)
 }
 
+appengineDeployAll.mustRunAfter ':console-webapp:deploy'
 appengineDeployAll.finalizedBy ':deployCloudSchedulerAndQueue'
 rootProject.deploy.dependsOn appengineDeployAll
+
 rootProject.stage.dependsOn appengineStage
-tasks['war'].dependsOn ':console-webapp:buildConsoleWebappProd'
 tasks['war'].dependsOn ':core:compileProdJS'
 tasks['war'].dependsOn ':core:processResources'
 tasks['war'].dependsOn ':core:jar'

build.gradle

@@ -539,8 +539,6 @@ task coreDev {
   dependsOn 'javadoc'
   dependsOn 'checkDependenciesDotGradle'
   dependsOn 'checkLicense'
-  // TODO: @ptkach reenable after console design merged
-  // dependsOn ':console-webapp:runConsoleWebappUnitTests'
   dependsOn ':core:check'
   dependsOn 'assemble'
 }

common/gradle.lockfile

@@ -54,11 +54,11 @@ org.jacoco:org.jacoco.ant:0.8.11=jacocoAnt
 org.jacoco:org.jacoco.core:0.8.11=jacocoAnt
 org.jacoco:org.jacoco.report:0.8.11=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
-org.junit.jupiter:junit-jupiter-api:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.10.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.6=jacocoAnt
 org.ow2.asm:asm-tree:9.6=jacocoAnt

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -175,14 +175,7 @@ public class TextDiffSubject extends Subject {
         .orElse(0);
   }
 
-  private static class SideBySideRowFormatter {
-    private final int maxExpectedLineLength;
-    private final int maxActualLineLength;
-
-    private SideBySideRowFormatter(int maxExpectedLineLength, int maxActualLineLength) {
-      this.maxExpectedLineLength = maxExpectedLineLength;
-      this.maxActualLineLength = maxActualLineLength;
-    }
+  private record SideBySideRowFormatter(int maxExpectedLineLength, int maxActualLineLength) {
 
     public String formatRow(String expected, String actual, char padChar) {
       return String.format(

config/dependency-license/allowed_licenses.json

@@ -262,6 +262,9 @@
     {
       "moduleLicense": "Unicode/ICU License"
     },
+    {
+      "moduleLicense": "Unicode-3.0"
+    },
     {
       "moduleLicense": "Public Domain",
       "moduleName": "aopalliance:aopalliance"

config/presubmits.py

@@ -178,6 +178,18 @@ PRESUBMITS = {
         {"/node_modules/"},
     ):
         "Do not use shaded dependencies from testcontainers.",
+    PresubmitCheck(
+        r".*autovalue\.shaded.*",
+        "java",
+        {"/node_modules/"},
+    ):
+        "Do not use shaded dependencies from autovalue.",
+    PresubmitCheck(
+        r".*avro\.shaded.*",
+        "java",
+        {"/node_modules/"},
+    ):
+        "Do not use shaded dependencies from avro.",
     PresubmitCheck(
         r".*com\.google\.common\.truth\.Truth8.*",
         "java",

console-webapp/.gitignore

@@ -36,7 +36,11 @@ yarn-error.log
 /libpeerconnection.log
 testem.log
 /typings
+.nx/
 
 # System files
 .DS_Store
 Thumbs.db
+
+# Build artifact
+/staged/dist

console-webapp/angular.json

@@ -122,6 +122,9 @@
     }
   },
   "cli": {
+    "cache": {
+      "enabled": false
+    },
     "analytics": false,
     "schematicCollections": [
       "@angular-eslint/schematics"

console-webapp/build.gradle

@@ -11,12 +11,12 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-
 def consoleDir = "${rootDir}/console-webapp"
+def projectParam = "--project=${rootProject.gcpProject}"
 
 clean {
   delete "${consoleDir}/node_modules"
-  delete "${consoleDir}/dist"
+  delete "${consoleDir}/staged/dist"
 }
 
 task npmInstallDeps(type: Exec) {
@@ -62,8 +62,14 @@ task checkFormatting(type: Exec) {
   args 'run', 'prettify:check'
 }
 
-tasks.runConsoleWebappUnitTests.dependsOn(tasks.npmInstallDeps)
+task deploy(type: Exec) {
+  workingDir "${consoleDir}/staged"
+  executable 'gcloud'
+  args 'app', 'deploy', "${projectParam}", '--quiet'
+}
+
 tasks.buildConsoleWebappProd.dependsOn(tasks.npmInstallDeps)
 tasks.applyFormatting.dependsOn(tasks.npmInstallDeps)
 tasks.checkFormatting.dependsOn(tasks.npmInstallDeps)
 tasks.build.dependsOn(tasks.checkFormatting)
+tasks.deploy.dependsOn(tasks.buildConsoleWebappProd)

console-webapp/package.json

@@ -4,7 +4,7 @@
   "scripts": {
     "ng": "ng",
     "start": "ng serve --proxy-config dev-proxy.config.json",
-    "build": "ng build --base-href=/console/",
+    "build": "ng build --base-href=/console/ --output-path=staged/dist",
     "build:local": "ng build --base-href=/default/console/",
     "watch": "ng build --watch --configuration development",
     "test": "ng test --browsers=ChromeHeadless --watch=false",
@@ -16,35 +16,35 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "^17.0.7",
-    "@angular/cdk": "^17.0.4",
-    "@angular/common": "^17.0.7",
-    "@angular/compiler": "^17.0.7",
-    "@angular/core": "^17.0.7",
-    "@angular/forms": "^17.0.7",
-    "@angular/material": "^17.0.4",
-    "@angular/platform-browser": "^17.0.7",
-    "@angular/platform-browser-dynamic": "^17.0.7",
-    "@angular/router": "^17.0.7",
+    "@angular/animations": "^17.3.5",
+    "@angular/cdk": "^17.3.5",
+    "@angular/common": "^17.3.5",
+    "@angular/compiler": "^17.3.5",
+    "@angular/core": "^17.3.5",
+    "@angular/forms": "^17.3.5",
+    "@angular/material": "^17.3.5",
+    "@angular/platform-browser": "^17.3.5",
+    "@angular/platform-browser-dynamic": "^17.3.5",
+    "@angular/router": "^17.3.5",
     "rxjs": "~7.5.0",
     "tslib": "^2.3.0",
     "zone.js": "~0.14.2"
   },
   "devDependencies": {
-    "@angular-devkit/build-angular": "^17.0.7",
-    "@angular-eslint/builder": "17.1.1",
-    "@angular-eslint/eslint-plugin": "17.1.1",
-    "@angular-eslint/eslint-plugin-template": "17.1.1",
-    "@angular-eslint/schematics": "17.1.1",
-    "@angular-eslint/template-parser": "17.1.1",
-    "@angular/cli": "~17.0.7",
-    "@angular/compiler-cli": "^17.0.7",
+    "@angular-devkit/build-angular": "^17.3.5",
+    "@angular-eslint/builder": "17.3.0",
+    "@angular-eslint/eslint-plugin": "17.3.0",
+    "@angular-eslint/eslint-plugin-template": "17.3.0",
+    "@angular-eslint/schematics": "17.3.0",
+    "@angular-eslint/template-parser": "17.3.0",
+    "@angular/cli": "~17.3.5",
+    "@angular/compiler-cli": "^17.3.5",
     "@types/jasmine": "~4.0.0",
     "@types/node": "^18.11.18",
-    "@typescript-eslint/eslint-plugin": "^5.59.2",
-    "@typescript-eslint/parser": "^5.59.2",
+    "@typescript-eslint/eslint-plugin": "^7.2.0",
+    "@typescript-eslint/parser": "^7.2.0",
     "concurrently": "^7.6.0",
-    "eslint": "^8.39.0",
+    "eslint": "^8.57.0",
     "jasmine-core": "~4.3.0",
     "karma": "~6.4.0",
     "karma-chrome-launcher": "~3.1.0",
@@ -54,4 +54,4 @@
     "prettier": "2.8.7",
     "typescript": "~5.2.2"
   }
-}
+}

console-webapp/src/app/domains/domainList.component.html

@@ -1,6 +1,6 @@
 <app-selected-registrar-wrapper>
-  <h1 class="mat-headline-4">Domains</h1>
   <div class="console-domains">
+    <h1 class="mat-headline-4">Domains</h1>
     @if (totalResults === 0) {
     <div class="console-app__empty-domains">
       <h1>
@@ -13,6 +13,17 @@
     } @else if(isLoading) {
     <mat-progress-bar mode="indeterminate"></mat-progress-bar>
     } @else {
+    <a
+      mat-stroked-button
+      color="primary"
+      href="/console-api/dum-download?registrarId={{
+        registrarService.registrarId()
+      }}"
+      class="console-app-domains__download"
+    >
+      <mat-icon>download</mat-icon>
+      Download domains (.csv)
+    </a>
     <mat-form-field class="console-app__domains-filter">
       <mat-label>Filter</mat-label>
       <input

console-webapp/src/app/domains/domainList.component.scss

@@ -12,6 +12,15 @@
     }
   }
 
+  &-domains {
+    position: relative;
+    &__download {
+      position: absolute;
+      top: 0;
+      right: 0;
+    }
+  }
+
   &__domains {
     width: 100%;
     overflow: auto;

console-webapp/src/app/domains/domainList.component.ts

@@ -54,7 +54,7 @@ export class DomainListComponent {
   constructor(
     private backendService: BackendService,
     private domainListService: DomainListService,
-    private registrarService: RegistrarService,
+    protected registrarService: RegistrarService,
     private _snackBar: MatSnackBar
   ) {
     effect(() => {

console-webapp/src/app/home/home.component.html

@@ -10,7 +10,7 @@
           <mat-icon class="secondary-text">view_list</mat-icon>
           DUMs
         </h3>
-        <p class="secondary-text">View Domains</p>
+        <p class="secondary-text">View Domains Under Management</p>
       </mat-card-content>
       <mat-card-actions>
         <button mat-button color="primary" (click)="viewDums()">

console-webapp/src/app/navigation/navigation.component.html

@@ -7,7 +7,7 @@
     *matTreeNodeDef="let node"
     matTreeNodeToggle
     (click)="onClick(node)"
-    [class.active]="router.url.endsWith(node.path)"
+    [class.active]="router.url.includes(node.path)"
   >
     <mat-icon class="console-app__nav-icon" *ngIf="node.iconName">
       {{ node.iconName }}

console-webapp/src/app/resources/resources.component.html

@@ -1,4 +1,4 @@
-<h1 class="mat-headline-4">Resource</h1>
+<h1 class="mat-headline-4">Resources</h1>
 <div class="console-app__resources">
   <div>
     <div class="console-app__resources-subhead">Technical resources</div>
@@ -6,7 +6,8 @@
       class="text-l"
       href="{{ userDataService.userData.technicalDocsUrl }}"
       target="_blank"
-      >View on Google Drive</a
+      >View onboarding FAQs, TLD information, and technical documentation on
+      Google Drive</a
     >
   </div>
   <div>

console-webapp/src/app/settings/security/eppPasswordEdit.component.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import { HttpErrorResponse } from '@angular/common/http';
 import { Component } from '@angular/core';
 import {
   AbstractControl,
@@ -68,9 +69,12 @@ export default class EppPasswordEditComponent {
     ) {
       this.passwordUpdateForm?.get('newPasswordRepeat')?.setErrors(null);
     } else {
-      this.passwordUpdateForm
-        ?.get('newPasswordRepeat')
-        ?.setErrors({ passwordsDontMatch: control.value });
+      // latest angular just won't detect the error without setTimeout
+      setTimeout(() => {
+        this.passwordUpdateForm
+          ?.get('newPasswordRepeat')
+          ?.setErrors({ passwordsDontMatch: control.value });
+      });
     }
     return null;
   };
@@ -92,15 +96,24 @@ export default class EppPasswordEditComponent {
   });
 
   save() {
-    debugger;
-    // this.securityService.saveEppPassword().subscribe({
-    //   complete: () => {
-    //     this.goBack();
-    //   },
-    //   error: (err: HttpErrorResponse) => {
-    //     this._snackBar.open(err.error);
-    //   },
-    // });
+    const { oldPassword, newPassword, newPasswordRepeat } =
+      this.passwordUpdateForm.value;
+    if (!oldPassword || !newPassword || !newPasswordRepeat) return;
+    this.securityService
+      .saveEppPassword({
+        registrarId: this.registrarService.registrarId(),
+        oldPassword,
+        newPassword,
+        newPasswordRepeat,
+      })
+      .subscribe({
+        complete: () => {
+          this.goBack();
+        },
+        error: (err: HttpErrorResponse) => {
+          this._snackBar.open(err.error);
+        },
+      });
   }
 
   goBack() {

console-webapp/src/app/settings/security/security.component.html

@@ -24,7 +24,7 @@
         </mat-list-item>
         <mat-list-item role="listitem" lines="3">
           <span class="console-app__list-value"
-            >todo: come up with a text here</span
+            >Change the password used for EPP logins</span
           >
         </mat-list-item>
         <mat-list-item role="listitem">

console-webapp/src/app/settings/security/security.service.ts

@@ -22,6 +22,13 @@ import {
 } from 'src/app/registrar/registrar.service';
 import { BackendService } from 'src/app/shared/services/backend.service';
 
+export interface EppPasswordBackendModel {
+  registrarId: string;
+  oldPassword: string;
+  newPassword: string;
+  newPasswordRepeat: string;
+}
+
 export function apiToUiConverter(
   securitySettings: SecuritySettingsBackendModel = {}
 ): SecuritySettings {
@@ -68,5 +75,11 @@ export class SecurityService {
       );
   }
 
-  saveEppPassword() {}
+  saveEppPassword(data: EppPasswordBackendModel) {
+    return this.backend.postEppPasswordUpdate(data).pipe(
+      switchMap(() => {
+        return this.registrarService.loadRegistrars();
+      })
+    );
+  }
 }

console-webapp/src/app/shared/services/backend.service.ts

@@ -23,6 +23,7 @@ import {
   WhoisRegistrarFields,
 } from '../../registrar/registrar.service';
 import { Contact } from '../../settings/contact/contact.service';
+import { EppPasswordBackendModel } from '../../settings/security/security.service';
 import { UserData } from './userData.service';
 
 @Injectable()
@@ -33,6 +34,11 @@ export class BackendService {
     error: HttpErrorResponse,
     mockData?: Type
   ): Observable<Type> {
+    // This is a temporary redirect to the old console until the new console
+    // is fully released and enabled
+    if (error.url && new URL(error.url).pathname === '/registrar') {
+      window.location.href = error.url;
+    }
     if (error.error instanceof Error) {
       // A client-side or network error occurred. Handle it accordingly.
       console.error('An error occurred:', error.error.message);
@@ -134,6 +140,15 @@ export class BackendService {
     );
   }
 
+  postEppPasswordUpdate(
+    data: EppPasswordBackendModel
+  ): Observable<EppPasswordBackendModel> {
+    return this.http.post<EppPasswordBackendModel>(
+      `/console-api/eppPassword`,
+      data
+    );
+  }
+
   getUserData(): Observable<UserData> {
     return this.http
       .get<UserData>('/console-api/userdata')

console-webapp/src/app/shared/services/globalLoader.service.ts

@@ -30,7 +30,7 @@ export interface GlobalLoader {
   providedIn: 'root',
 })
 export class GlobalLoaderService {
-  private static readonly TIMEOUT_MS = 3000;
+  private static readonly TIMEOUT_MS = 10000;
   private loaders = new Map<GlobalLoader, Subscription>();
   public isLoading: boolean = false;
 

console-webapp/staged/app.yaml

@@ -0,0 +1,4 @@
+runtime: nodejs20
+service: console
+build_env_variables:
+  GOOGLE_NODE_RUN_SCRIPTS: ''

console-webapp/staged/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "console-webapp-static-server",
+  "version": "0.0.0",
+  "scripts": {
+    "start": "node server.js",
+    "gcp-build":""
+  },
+  "private": true,
+  "dependencies": {
+    "express": "^4.16.4"
+  }
+}

console-webapp/staged/server.js

@@ -0,0 +1,34 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const express = require('express');
+
+const app = express();
+const PORT = process.env.PORT || 8080;
+
+app.use("/console", express.static('dist', {
+  etag: false,
+  lastModified: false,
+  maxAge: '1d',
+  setHeaders: setCustomCacheControl
+}));
+
+function setCustomCacheControl (res, path) {
+  // Custom Cache-Control for HTML files - we don't want to cache them
+  if (express.static.mime.lookup(path) === 'text/html') {
+    res.setHeader('Cache-Control', 'public, max-age=0');
+  }
+}
+
+app.listen(PORT);

core/build.gradle

@@ -149,6 +149,7 @@ dependencies {
   implementation deps['com.google.apis:google-api-services-drive']
   implementation deps['com.google.apis:google-api-services-gmail']
   implementation deps['com.google.apis:google-api-services-groupssettings']
+  implementation deps['com.google.apis:google-api-services-iam']
   implementation deps['com.google.apis:google-api-services-monitoring']
   implementation deps['com.google.apis:google-api-services-sheets']
   implementation deps['com.google.apis:google-api-services-storage']
@@ -158,6 +159,7 @@ dependencies {
   implementation deps['com.google.cloud.bigdataoss:util']
   implementation deps['com.google.cloud.sql:jdbc-socket-factory-core']
   runtimeOnly deps['com.google.cloud.sql:postgres-socket-factory']
+  implementation deps['com.google.cloud:google-cloud-logging']
   implementation deps['com.google.cloud:google-cloud-secretmanager']
   implementation deps['com.google.code.gson:gson']
   implementation deps['com.google.auto.service:auto-service-annotations']

core/gradle.lockfile

@@ -8,14 +8,22 @@ args4j:args4j:2.0.26=css
 args4j:args4j:2.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 cglib:cglib-nodep:2.2=css
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.17.0=testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.16.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.fasterxml.jackson:jackson-bom:2.17.0=testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -32,12 +40,13 @@ com.github.jnr:jnr-unixsocket:0.38.22=compileClasspath,deploy_jar,nonprodCompile
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-appengine:2.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-appengine:2.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.4.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client:1.35.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.37.0-alpha=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.173.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.173.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -47,8 +56,9 @@ com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.12.22=compileClasspath,dep
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-spanner-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.37.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.37.0-alpha=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.173.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.173.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -56,42 +66,46 @@ com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.33.0=compileClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.109.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.16.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-logging-v2:0.106.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:1.64.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.36.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsub-v1:1.108.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.12.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-spanner-v1:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.131.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.131.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-common-protos:2.37.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.32.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.29.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.46.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.46.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.46.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev20240304-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-appengine:v1-rev20240226-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.37.0-alpha=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.132.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.132.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-common-protos:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.30.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev20240429-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-appengine:v1-rev20240415-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20240124-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240128-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dataflow:v1b3-rev20240113-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dns:v2beta1-rev99-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-gmail:v1-rev20240422-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240423-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20240319-2.0.0=testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-remote-api:2.0.26=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -111,24 +125,27 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodComp
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.32.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.32.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-http:2.37.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-firestore:3.16.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-logging:3.17.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-monitoring:1.82.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.cloud:google-cloud-monitoring:3.36.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.127.15=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.16=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsub:1.126.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-pubsublite:1.12.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-spanner:6.58.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.32.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.32.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-storage:2.37.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:grpc-gcp:1.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.16.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.1=css
@@ -166,10 +183,12 @@ com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:33.1.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.44.1=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-gson:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-jackson2:1.44.1=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject.extensions:guice-multibindings:4.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -191,11 +210,11 @@ com.google.oauth-client:google-oauth-client-java6:1.35.0=compileClasspath,deploy
 com.google.oauth-client:google-oauth-client-jetty:1.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client-servlet:1.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.oauth-client:google-oauth-client:1.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.protobuf:protobuf-java-util:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java-util:3.25.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:2.5.0=css
 com.google.protobuf:protobuf-java:3.13.0=soy
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:3.25.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:3.25.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.re2j:re2j:1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.template:soy:2021-02-01=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -264,7 +283,8 @@ io.grpc:grpc-netty-shaded:1.62.2=compileClasspath,deploy_jar,nonprodCompileClass
 io.grpc:grpc-netty:1.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.61.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.62.2=testRuntimeClasspath
 io.grpc:grpc-services:1.61.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 io.grpc:grpc-services:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -297,8 +317,8 @@ io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,depl
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 jakarta-regexp:jakarta-regexp:1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -360,9 +380,9 @@ org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,non
 org.apache.commons:commons-compress:1.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.13.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.14.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.9=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-org.apache.commons:commons-text:1.11.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-text:1.12.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -372,12 +392,12 @@ org.apache.sshd:sshd-common:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:2.12.1=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.0-M18=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.0-M19=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -401,8 +421,8 @@ org.eclipse.jetty:jetty-server:12.0.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-session:12.0.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-util:12.0.8=testCompileClasspath,testRuntimeClasspath
 org.eclipse.jetty:jetty-xml:12.0.8=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:10.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:10.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:10.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:10.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.gwtproject:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -441,23 +461,23 @@ org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,nonprodRun
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.26.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:1.0.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20160212=soy
 org.json:json:20231013=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.17.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.2.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-migrationsupport:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-runner:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.10.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.10.2=testRuntimeClasspath
-org.junit:junit-bom:5.10.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-migrationsupport:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-runner:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.11.0-M1=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.11.0-M1=testRuntimeClasspath
+org.junit:junit-bom:5.11.0-M1=testCompileClasspath,testRuntimeClasspath
 org.jvnet.staxex:stax-ex:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:1.10.19=css
 org.mockito:mockito-core:5.11.0=testCompileClasspath,testRuntimeClasspath
@@ -494,7 +514,7 @@ org.seleniumhq.selenium:selenium-safari-driver:3.141.59=testCompileClasspath,tes
 org.seleniumhq.selenium:selenium-support:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.32=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
-org.slf4j:slf4j-api:2.0.12=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
+org.slf4j:slf4j-api:2.0.13=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
 org.slf4j:slf4j-api:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-jdk14:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -504,7 +524,7 @@ org.testcontainers:junit-jupiter:1.19.7=testCompileClasspath,testRuntimeClasspat
 org.testcontainers:postgresql:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.testcontainers:selenium:1.19.7=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:testcontainers:1.19.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.threeten:threetenbp:1.6.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.threeten:threetenbp:1.6.9=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.tukaani:xz:1.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath

core/src/main/java/google/registry/batch/CheckBulkComplianceAction.java

@@ -187,18 +187,12 @@ public class CheckBulkComplianceAction implements Runnable {
               .getLastNotificationSent()
               .map(sentDate -> Days.daysBetween(sentDate, clock.nowUtc()).getDays())
               .orElse(Integer.MAX_VALUE);
-      if (daysSinceLastNotification < THIRTY_DAYS) {
-        // Don't send an email if notification was already sent within the last 30
-        // days
-        continue;
-      } else if (daysSinceLastNotification < FORTY_DAYS) {
-        // Send an upgrade email if last email was between 30 and 40 days ago
+      // Send a warning email if 30-39 days since last notification and an upgrade email if 40+ days
+      if (daysSinceLastNotification >= THIRTY_DAYS) {
         sendActiveDomainOverageEmail(
-            /* warning= */ false, bulkPricingPackage, overageList.get(bulkPricingPackage));
-      } else {
-        // Send a warning email
-        sendActiveDomainOverageEmail(
-            /* warning= */ true, bulkPricingPackage, overageList.get(bulkPricingPackage));
+            /* warning= */ daysSinceLastNotification >= FORTY_DAYS,
+            bulkPricingPackage,
+            overageList.get(bulkPricingPackage));
       }
     }
   }

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -66,11 +66,15 @@ public class RelockDomainAction implements Runnable {
   private static final Duration ONE_HOUR = Duration.standardHours(1);
 
   private static final String RELOCK_SUCCESS_EMAIL_TEMPLATE =
-      "The domain %s was successfully re-locked.\n\nPlease contact support at %s if you have any "
-          + "questions.";
+      """
+          The domain %s was successfully re-locked.
+
+          Please contact support at %s if you have any questions.""";
   private static final String RELOCK_NON_RETRYABLE_FAILURE_EMAIL_TEMPLATE =
-      "There was an error when automatically re-locking %s. Error message: %s\n\nPlease contact "
-          + "support at %s if you have any questions.";
+      """
+          There was an error when automatically re-locking %s. Error message: %s
+
+          Please contact support at %s if you have any questions.""";
   private static final String RELOCK_TRANSIENT_FAILURE_EMAIL_TEMPLATE =
       "There was an unexpected error when automatically re-locking %s. We will continue retrying "
           + "the lock for five hours. Please contact support at %s if you have any questions";

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -33,7 +33,7 @@ import google.registry.flows.certs.CertificateChecker;
 import google.registry.groups.GmailClient;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -206,7 +206,7 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
               () -> {
                 Registrar.Builder newRegistrar = tm().loadByEntity(registrar).asBuilder();
                 switch (certificateType) {
-                  case PRIMARY:
+                  case PRIMARY -> {
                     newRegistrar.setLastExpiringCertNotificationSentDate(now);
                     tm().put(newRegistrar.build());
                     logger.atInfo().log(
@@ -215,8 +215,8 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                         DATE_FORMATTER.print(now),
                         certificateType.getDisplayName(),
                         registrar.getRegistrarName());
-                    break;
-                  case FAILOVER:
+                  }
+                  case FAILOVER -> {
                     newRegistrar.setLastExpiringFailoverCertNotificationSentDate(now);
                     tm().put(newRegistrar.build());
                     logger.atInfo().log(
@@ -225,13 +225,13 @@ public class SendExpiringCertificateNotificationEmailAction implements Runnable
                         DATE_FORMATTER.print(now),
                         certificateType.getDisplayName(),
                         registrar.getRegistrarName());
-                    break;
-                  default:
-                    throw new IllegalArgumentException(
-                        String.format(
-                            "Unsupported certificate type: %s being passed in when updating "
-                                + "the last notification sent date to registrar %s.",
-                            certificateType.toString(), registrar.getRegistrarName()));
+                  }
+                  default ->
+                      throw new IllegalArgumentException(
+                          String.format(
+                              "Unsupported certificate type: %s being passed in when updating "
+                                  + "the last notification sent date to registrar %s.",
+                              certificateType.toString(), registrar.getRegistrarName()));
                 }
               });
     } catch (Exception e) {

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -14,7 +14,6 @@
 
 package google.registry.beam.billing;
 
-import com.google.auto.value.AutoValue;
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import google.registry.reporting.billing.BillingModule;
@@ -34,9 +33,39 @@ import org.joda.time.DateTime;
 import org.joda.time.format.DateTimeFormat;
 import org.joda.time.format.DateTimeFormatter;
 
-/** A POJO representing a single billable event, parsed from a {@code SchemaAndRecord}. */
-@AutoValue
-public abstract class BillingEvent {
+/**
+ * A record representing a single billable event, parsed from a {@code SchemaAndRecord}.
+ *
+ * @param id The unique ID for the {@code BillingEvent} associated with this event.
+ * @param billingTime The DateTime (in UTC) this event becomes billable.
+ * @param eventTime The DateTime (in UTC) this event was generated.
+ * @param registrarId The billed registrar's name.
+ * @param billingId The billed registrar's billing account key.
+ * @param poNumber The Purchase Order number.
+ * @param tld The TLD this event was generated for.
+ * @param action The billable action this event was generated for (CREATE, RENEW, TRANSFER...).
+ * @param domain The fully qualified domain name this event was generated for.
+ * @param repositoryId The unique RepoID associated with the billed domain.
+ * @param years The number of years this billing event is made out for.
+ * @param currency The 3-letter currency code for the billing event (USD or JPY).
+ * @param amount The total cost associated with this billing event.
+ * @param flags A list of space-delimited flags associated with the event.
+ */
+public record BillingEvent(
+    long id,
+    DateTime billingTime,
+    DateTime eventTime,
+    String registrarId,
+    String billingId,
+    String poNumber,
+    String tld,
+    String action,
+    String domain,
+    String repositoryId,
+    int years,
+    String currency,
+    double amount,
+    String flags) {
 
   private static final DateTimeFormatter DATE_TIME_FORMATTER =
       DateTimeFormat.forPattern("yyyy-MM-dd HH:mm:ss zzz");
@@ -60,48 +89,6 @@ public abstract class BillingEvent {
           "amount",
           "flags");
 
-  /** Returns the unique ID for the {@code BillingEvent} associated with this event. */
-  abstract long id();
-
-  /** Returns the UTC DateTime this event becomes billable. */
-  abstract DateTime billingTime();
-
-  /** Returns the UTC DateTime this event was generated. */
-  abstract DateTime eventTime();
-
-  /** Returns the billed registrar's name. */
-  abstract String registrarId();
-
-  /** Returns the billed registrar's billing account key. */
-  abstract String billingId();
-
-  /** Returns the Purchase Order number. */
-  abstract String poNumber();
-
-  /** Returns the tld this event was generated for. */
-  abstract String tld();
-
-  /** Returns the billable action this event was generated for (i.e., RENEW, CREATE, TRANSFER...) */
-  abstract String action();
-
-  /** Returns the fully qualified domain name this event was generated for. */
-  abstract String domain();
-
-  /** Returns the unique RepoID associated with the billed domain. */
-  abstract String repositoryId();
-
-  /** Returns the number of years this billing event is made out for. */
-  abstract int years();
-
-  /** Returns the 3-letter currency code for the billing event (i.e., USD or JPY.) */
-  abstract String currency();
-
-  /** Returns the cost associated with this billing event. */
-  abstract double amount();
-
-  /** Returns a list of space-delimited flags associated with the event. */
-  abstract String flags();
-
   /** Creates a concrete {@link BillingEvent}. */
   static BillingEvent create(
       long id,
@@ -118,7 +105,7 @@ public abstract class BillingEvent {
       String currency,
       double amount,
       String flags) {
-    return new AutoValue_BillingEvent(
+    return new BillingEvent(
         id,
         billingTime,
         eventTime,
@@ -338,7 +325,7 @@ public abstract class BillingEvent {
 
     @Override
     public BillingEvent decode(InputStream inStream) throws IOException {
-      return new AutoValue_BillingEvent(
+      return new BillingEvent(
           longCoder.decode(inStream),
           DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),
           DATE_TIME_FORMATTER.parseDateTime(stringCoder.decode(inStream)),

core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java

@@ -50,16 +50,17 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
     environment.setup();
     RegistryPipelineComponent registryPipelineComponent =
         toRegistryPipelineComponent(registryOptions);
-    Lazy<JpaTransactionManager> transactionManagerLazy;
-    switch (registryOptions.getJpaTransactionManagerType()) {
-      case READ_ONLY_REPLICA:
-        transactionManagerLazy =
-            registryPipelineComponent.getReadOnlyReplicaJpaTransactionManager();
-        break;
-      case REGULAR:
-      default:
-        transactionManagerLazy = registryPipelineComponent.getJpaTransactionManager();
-    }
+    Lazy<JpaTransactionManager> transactionManagerLazy =
+        switch (registryOptions.getJpaTransactionManagerType()) {
+          case READ_ONLY_REPLICA ->
+              registryPipelineComponent.getReadOnlyReplicaJpaTransactionManager();
+          case REGULAR -> registryPipelineComponent.getJpaTransactionManager();
+          default ->
+              throw new IllegalStateException(
+                  String.format(
+                      "Unknown JPA transaction manager type: %s",
+                      registryOptions.getJpaTransactionManagerType()));
+        };
     TransactionManagerFactory.setJpaTmOnBeamWorker(transactionManagerLazy::get);
     SystemPropertySetter.PRODUCTION_IMPL.setProperty(PROPERTY, "true");
   }

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -58,7 +58,7 @@ import google.registry.model.host.Host;
 import google.registry.model.host.HostHistory;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
@@ -688,27 +688,26 @@ public class RdePipeline implements Serializable {
   protected abstract static class TupleTags {
 
     protected static final TupleTag<KV<PendingDeposit, DepositFragment>> DOMAIN_FRAGMENTS =
-        new TupleTag<KV<PendingDeposit, DepositFragment>>() {};
+        new TupleTag<>() {};
 
     protected static final TupleTag<KV<String, PendingDeposit>> REFERENCED_CONTACTS =
-        new TupleTag<KV<String, PendingDeposit>>() {};
+        new TupleTag<>() {};
 
     protected static final TupleTag<KV<String, PendingDeposit>> REFERENCED_HOSTS =
-        new TupleTag<KV<String, PendingDeposit>>() {};
+        new TupleTag<>() {};
 
     protected static final TupleTag<KV<String, KV<String, CoGbkResult>>> SUPERORDINATE_DOMAINS =
-        new TupleTag<KV<String, KV<String, CoGbkResult>>>() {};
+        new TupleTag<>() {};
 
     protected static final TupleTag<KV<PendingDeposit, DepositFragment>> EXTERNAL_HOST_FRAGMENTS =
-        new TupleTag<KV<PendingDeposit, DepositFragment>>() {};
+        new TupleTag<>() {};
 
-    protected static final TupleTag<PendingDeposit> PENDING_DEPOSIT =
-        new TupleTag<PendingDeposit>() {};
+    protected static final TupleTag<PendingDeposit> PENDING_DEPOSIT = new TupleTag<>() {};
 
     protected static final TupleTag<KV<String, CoGbkResult>> HOST_TO_PENDING_DEPOSIT =
-        new TupleTag<KV<String, CoGbkResult>>() {};
+        new TupleTag<>() {};
 
-    protected static final TupleTag<Long> REVISION_ID = new TupleTag<Long>() {};
+    protected static final TupleTag<Long> REVISION_ID = new TupleTag<>() {};
   }
 
   @Singleton

core/src/main/java/google/registry/beam/spec11/DomainNameInfo.java

@@ -14,30 +14,23 @@
 
 package google.registry.beam.spec11;
 
-import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
 import java.io.Serializable;
 
 /**
- * A POJO representing a domain name and associated info, parsed from a {@code SchemaAndRecord}.
+ * A record representing a domain name and associated info, parsed from a {@code SchemaAndRecord}.
  *
  * <p>This is a trivially serializable class that allows Beam to transform the results of a SQL
  * query into a standard Java representation.
+ *
+ * @param domainName The fully qualified domain name.
+ * @param domainRepoId The domain repo ID (the primary key of the domain table).
+ * @param registrarId The registrar ID of the associated registrar for this domain.
+ * @param registrarEmailAddress The email address of the registrar associated with this domain.
  */
-@AutoValue
-public abstract class DomainNameInfo implements Serializable {
-
-  /** Returns the fully qualified domain name. */
-  abstract String domainName();
-
-  /** Returns the domain repo ID (the primary key of the domain table). */
-  abstract String domainRepoId();
-
-  /** Returns the registrar ID of the associated registrar for this domain. */
-  abstract String registrarId();
-
-  /** Returns the email address of the registrar associated with this domain. */
-  abstract String registrarEmailAddress();
+public record DomainNameInfo(
+    String domainName, String domainRepoId, String registrarId, String registrarEmailAddress)
+    implements Serializable {
 
   /**
    * Creates a concrete {@link DomainNameInfo}.
@@ -45,7 +38,6 @@ public abstract class DomainNameInfo implements Serializable {
   @VisibleForTesting
   static DomainNameInfo create(
       String domainName, String domainRepoId, String registrarId, String registrarEmailAddress) {
-    return new AutoValue_DomainNameInfo(
-        domainName, domainRepoId, registrarId, registrarEmailAddress);
+    return new DomainNameInfo(domainName, domainRepoId, registrarId, registrarEmailAddress);
   }
 }

core/src/main/java/google/registry/beam/spec11/ThreatMatch.java

@@ -14,28 +14,26 @@
 
 package google.registry.beam.spec11;
 
-import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
 import java.io.Serializable;
 import org.json.JSONException;
 import org.json.JSONObject;
 
-/** A POJO representing a threat match response from the {@code SafeBrowsing API}. */
-@AutoValue
-public abstract class ThreatMatch implements Serializable {
+/**
+ * A record representing a threat match response from the {@code SafeBrowsing API}.
+ *
+ * @param threatType What kind of threat this is (malware, phishing, etc.).
+ * @param domainName The fully qualified domain name of the matched threat.
+ */
+public record ThreatMatch(String threatType, String domainName) implements Serializable {
 
   private static final String THREAT_TYPE_FIELD = "threatType";
   private static final String DOMAIN_NAME_FIELD = "domainName";
   private static final String OUTDATED_NAME_FIELD = "fullyQualifiedDomainName";
 
-  /** Returns what kind of threat it is (malware, phishing etc.) */
-  public abstract String threatType();
-  /** Returns the fully qualified domain name [SLD].[TLD] of the matched threat. */
-  public abstract String domainName();
-
   @VisibleForTesting
   static ThreatMatch create(String threatType, String domainName) {
-    return new AutoValue_ThreatMatch(threatType, domainName);
+    return new ThreatMatch(threatType, domainName);
   }
 
   /** Returns a {@link JSONObject} representing a subset of this object's data. */
@@ -49,7 +47,7 @@ public abstract class ThreatMatch implements Serializable {
   public static ThreatMatch fromJSON(JSONObject threatMatch) throws JSONException {
     // TODO: delete OUTDATED_NAME_FIELD once we no longer process reports saved with
     // fullyQualifiedDomainName in them, likely 2023
-    return new AutoValue_ThreatMatch(
+    return new ThreatMatch(
         threatMatch.getString(THREAT_TYPE_FIELD),
         threatMatch.has(OUTDATED_NAME_FIELD)
             ? threatMatch.getString(OUTDATED_NAME_FIELD)

core/src/main/java/google/registry/bsa/BsaDiffCreator.java

@@ -62,7 +62,7 @@ class BsaDiffCreator {
     this.gcsClient = gcsClient;
   }
 
-  private <K, V extends Comparable> Multimap<K, V> listBackedMultiMap() {
+  private <K, V extends Comparable<?>> Multimap<K, V> listBackedMultiMap() {
     return newListMultimap(newHashMap(), Lists::newArrayList);
   }
 

core/src/main/java/google/registry/bsa/IdnChecker.java

@@ -80,7 +80,7 @@ public class IdnChecker {
   }
 
   private static ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> getIdnToTldMap(DateTime now) {
-    ImmutableMultimap.Builder<IdnTableEnum, Tld> idnToTldMap = new ImmutableMultimap.Builder();
+    var idnToTldMap = new ImmutableMultimap.Builder<IdnTableEnum, Tld>();
     Tlds.getTldEntitiesOfType(TldType.REAL).stream()
         .filter(tld -> isEnrolledWithBsa(tld, now))
         .forEach(

core/src/main/java/google/registry/bsa/api/BlockOrder.java

@@ -34,7 +34,7 @@ public record BlockOrder(long orderId, OrderType orderType) {
   public static BlockOrder deserialize(String text) {
     List<String> items = SPLITTER.splitToList(text);
     try {
-      return create(Long.valueOf(items.get(0)), OrderType.valueOf(items.get(1)));
+      return create(Long.parseLong(items.get(0)), OrderType.valueOf(items.get(1)));
     } catch (NumberFormatException ne) {
       throw new IllegalArgumentException(text);
     }

core/src/main/java/google/registry/bsa/persistence/BsaDomainRefresh.java

@@ -96,10 +96,9 @@ class BsaDomainRefresh {
     if (this == o) {
       return true;
     }
-    if (!(o instanceof BsaDomainRefresh)) {
+    if (!(o instanceof BsaDomainRefresh that)) {
       return false;
     }
-    BsaDomainRefresh that = (BsaDomainRefresh) o;
     return Objects.equal(jobId, that.jobId)
         && Objects.equal(creationTime, that.creationTime)
         && Objects.equal(updateTime, that.updateTime)

core/src/main/java/google/registry/bsa/persistence/BsaDownload.java

@@ -120,10 +120,9 @@ class BsaDownload {
     if (this == o) {
       return true;
     }
-    if (!(o instanceof BsaDownload)) {
+    if (!(o instanceof BsaDownload that)) {
       return false;
     }
-    BsaDownload that = (BsaDownload) o;
     return Objects.equal(creationTime, that.creationTime)
         && Objects.equal(updateTime, that.updateTime)
         && Objects.equal(blockListChecksums, that.blockListChecksums)
@@ -136,6 +135,6 @@ class BsaDownload {
   }
 
   static VKey<BsaDownload> vKey(long jobId) {
-    return VKey.create(BsaDownload.class, Long.valueOf(jobId));
+    return VKey.create(BsaDownload.class, jobId);
   }
 }

core/src/main/java/google/registry/bsa/persistence/BsaLabel.java

@@ -61,10 +61,9 @@ final class BsaLabel {
     if (this == o) {
       return true;
     }
-    if (!(o instanceof BsaLabel)) {
+    if (!(o instanceof BsaLabel label1)) {
       return false;
     }
-    BsaLabel label1 = (BsaLabel) o;
     return Objects.equal(label, label1.label) && Objects.equal(creationTime, label1.creationTime);
   }
 

core/src/main/java/google/registry/bsa/persistence/BsaUnblockableDomain.java

@@ -84,10 +84,9 @@ class BsaUnblockableDomain {
     if (this == o) {
       return true;
     }
-    if (!(o instanceof BsaUnblockableDomain)) {
+    if (!(o instanceof BsaUnblockableDomain that)) {
       return false;
     }
-    BsaUnblockableDomain that = (BsaUnblockableDomain) o;
     return Objects.equal(label, that.label)
         && Objects.equal(tld, that.tld)
         && reason == that.reason
@@ -142,10 +141,9 @@ class BsaUnblockableDomain {
       if (this == o) {
         return true;
       }
-      if (!(o instanceof BsaUnblockableDomainId)) {
+      if (!(o instanceof BsaUnblockableDomainId that)) {
         return false;
       }
-      BsaUnblockableDomainId that = (BsaUnblockableDomainId) o;
       return Objects.equal(label, that.label) && Objects.equal(tld, that.tld);
     }
 

core/src/main/java/google/registry/bsa/persistence/LabelDiffUpdates.java

@@ -72,7 +72,7 @@ public final class LabelDiffUpdates {
               for (Map.Entry<LabelType, ImmutableList<BlockLabel>> entry :
                   labelsByType.entrySet()) {
                 switch (entry.getKey()) {
-                  case CREATE:
+                  case CREATE -> {
                     // With current Cloud SQL, label upsert throughput is about 200/second. If
                     // better performance is needed, consider bulk insert in native SQL.
                     tm().putAll(
@@ -86,8 +86,8 @@ public final class LabelDiffUpdates {
                     // cached BsaLabels. Eventually will be consistent.
                     nonBlockedDomains.addAll(
                         tallyUnblockableDomainsForNewLabels(entry.getValue(), idnChecker, now));
-                    break;
-                  case DELETE:
+                  }
+                  case DELETE -> {
                     ImmutableSet<String> deletedLabels =
                         entry.getValue().stream()
                             .filter(label -> isValidInAtLeastOneTld(label, idnChecker))
@@ -100,8 +100,8 @@ public final class LabelDiffUpdates {
                           "Only found %s entities among the %s labels: [%s]",
                           nDeleted, deletedLabels.size(), deletedLabels);
                     }
-                    break;
-                  case NEW_ORDER_ASSOCIATION:
+                  }
+                  case NEW_ORDER_ASSOCIATION -> {
                     ImmutableSet<String> affectedLabels =
                         entry.getValue().stream()
                             .filter(label -> isValidInAtLeastOneTld(label, idnChecker))
@@ -120,13 +120,12 @@ public final class LabelDiffUpdates {
                     Queries.queryBsaUnblockableDomainByLabels(affectedLabels)
                         .map(BsaUnblockableDomain::toUnblockableDomain)
                         .forEach(nonBlockedDomains::add);
-
                     for (BlockLabel label : entry.getValue()) {
                       getInvalidTldsForLabel(label, idnChecker)
                           .map(tld -> UnblockableDomain.of(label.label(), tld, Reason.INVALID))
                           .forEach(nonBlockedDomains::add);
                     }
-                    break;
+                  }
                 }
               }
             });

core/src/main/java/google/registry/bsa/persistence/Queries.java

@@ -103,7 +103,7 @@ public final class Queries {
 
   static ImmutableList<BsaUnblockableDomain> batchReadUnblockables(
       Optional<BsaUnblockableDomain> lastRead, int batchSize) {
-    return ImmutableList.copyOf(
+    return ImmutableList.<BsaUnblockableDomain>copyOf(
         bsaQuery(
             () ->
                 tm().getEntityManager()

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -203,6 +203,17 @@ public final class RegistryConfig {
       return config.registrarConsole.announcementsEmailAddress;
     }
 
+    /**
+     * The DUM file name, used as a file name base for DUM csv file
+     *
+     * @see google.registry.ui.server.console.ConsoleDumDownloadAction
+     */
+    @Provides
+    @Config("dumFileName")
+    public static String provideDumFileName(RegistryConfigSettings config) {
+      return config.registrarConsole.dumFileName;
+    }
+
     /**
      * The contact phone number. Used in the "contact-us" section of the registrar console.
      *

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -185,6 +185,7 @@ public class RegistryConfigSettings {
 
   /** Configuration for the web-based registrar console. */
   public static class RegistrarConsole {
+    public String dumFileName;
     public String logoFilename;
     public String supportPhoneNumber;
     public String supportEmailAddress;

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -396,6 +396,9 @@ rde:
   sshIdentityEmailAddress: rde@example.com
 
 registrarConsole:
+  # DUM download file name, excluding the extension
+  dumFileName: dum_file_name
+
   # Filename of the logo to use in the header of the console. This filename is
   # relative to ui/assets/images/
   logoFilename: logo.png

core/src/main/java/google/registry/dns/DnsUtils.java

@@ -15,6 +15,7 @@
 package google.registry.dns;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableCollection;
@@ -98,7 +99,9 @@ public final class DnsUtils {
    */
   public static ImmutableList<DnsRefreshRequest> readAndUpdateRequestsWithLatestProcessTime(
       String tld, Duration cooldown, int batchSize) {
+    // It is critical that below query use repeatable-read. See b/337894387.
     return tm().transact(
+            TRANSACTION_REPEATABLE_READ,
             () -> {
               DateTime transactionTime = tm().getTransactionTime();
               ImmutableList<DnsRefreshRequest> requests =
@@ -131,7 +134,9 @@ public final class DnsUtils {
    * error because all we care about is that it no longer exists after the method runs.
    */
   public static void deleteRequests(Collection<DnsRefreshRequest> requests) {
+    // It is critical that below query use repeatable-read. See b/337894387.
     tm().transact(
+            TRANSACTION_REPEATABLE_READ,
             () ->
                 tm().delete(
                         requests.stream()

core/src/main/java/google/registry/dns/DnsWriterProxy.java

@@ -38,7 +38,7 @@ public final class DnsWriterProxy {
   /**
    * Returns the instance of {@link DnsWriter} by class name.
    *
-   * If the DnsWriter doesn't belong to this TLD, will return null.
+   * <p>If the DnsWriter doesn't belong to this TLD, will return null.
    */
   public DnsWriter getByClassNameForTld(String className, String tld) {
     if (!Tld.get(tld).getDnsWriters().contains(className)) {

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -50,6 +50,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
@@ -295,7 +296,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
 
       ImmutableList<InternetAddress> recipients =
           registrar.get().getContacts().stream()
-              .filter(c -> c.getTypes().contains(RegistrarPoc.Type.ADMIN))
+              .filter(c -> c.getTypes().contains(RegistrarPocBase.Type.ADMIN))
               .map(RegistrarPoc::getEmailAddress)
               .map(PublishDnsUpdatesAction::emailToInternetAddress)
               .collect(toImmutableList());

core/src/main/java/google/registry/dns/RefreshDnsAction.java

@@ -63,16 +63,15 @@ public final class RefreshDnsAction implements Runnable {
     tm().transact(
             () -> {
               switch (type) {
-                case DOMAIN:
+                case DOMAIN -> {
                   loadAndVerifyExistence(Domain.class, domainOrHostName);
                   requestDomainDnsRefresh(domainOrHostName);
-                  break;
-                case HOST:
+                }
+                case HOST -> {
                   verifyHostIsSubordinate(loadAndVerifyExistence(Host.class, domainOrHostName));
                   requestHostDnsRefresh(domainOrHostName);
-                  break;
-                default:
-                  throw new BadRequestException("Unsupported type: " + type);
+                }
+                default -> throw new BadRequestException("Unsupported type: " + type);
               }
             });
   }

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsUpdateWriter.java

@@ -55,14 +55,14 @@ import org.xbill.DNS.Type;
 import org.xbill.DNS.Update;
 
 /**
- * A DnsWriter that implements the DNS UPDATE protocol as specified in
- * <a href="https://tools.ietf.org/html/rfc2136">RFC 2136</a>. Publishes changes in the
- * domain-registry to a (capable) external DNS server, sometimes called a "hidden master". DNS
- * UPDATE messages are sent via a supplied "transport" class.
+ * A DnsWriter that implements the DNS UPDATE protocol as specified in <a
+ * href="https://tools.ietf.org/html/rfc2136">RFC 2136</a>. Publishes changes in the domain-registry
+ * to a (capable) external DNS server, sometimes called a "hidden master". DNS UPDATE messages are
+ * sent via a supplied "transport" class.
  *
- * On call to {@link #commit()}, a single UPDATE message is created containing the records required
- * to "synchronize" the DNS with the current (at the time of processing) state of the registry, for
- * the supplied domain/host.
+ * <p>On call to {@link #commit()}, a single UPDATE message is created containing the records
+ * required to "synchronize" the DNS with the current (at the time of processing) state of the
+ * registry, for the supplied domain/host.
  *
  * <p>The general strategy of the publish methods is to delete <em>all</em> resource records of any
  * <em>type</em> that match the exact domain/host name supplied. And then for create/update cases,
@@ -73,8 +73,8 @@ import org.xbill.DNS.Update;
  * <p>Only NS, DS, A, and AAAA records are published, and in particular no DNSSEC signing is done
  * assuming that this will be done by a third party DNS provider.
  *
- * <p>Each commit call is treated as an atomic update to the DNS. If a commit fails an exception
- * is thrown. The SOA record serial number is implicitly incremented by the server on each UPDATE
+ * <p>Each commit call is treated as an atomic update to the DNS. If a commit fails an exception is
+ * thrown. The SOA record serial number is implicitly incremented by the server on each UPDATE
  * message, as required by RFC 2136. Care must be taken to make sure the SOA serial number does not
  * go backwards if the entire TLD (zone) is "reset" to empty and republished.
  */

core/src/main/java/google/registry/env/common/default/WEB-INF/dispatch.xml

@@ -17,4 +17,12 @@
     <url>*/check</url>
     <module>pubapi</module>
   </dispatch>
+  <dispatch>
+    <url>*/console/*</url>
+    <module>console</module>
+  </dispatch>
+  <dispatch>
+    <url>*/console</url>
+    <module>console</module>
+  </dispatch>
 </dispatch-entries>

core/src/main/java/google/registry/env/production/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -178,9 +178,9 @@
     <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/deleteProberData&runInEmpty]]></url>
     <name>deleteProberData</name>
     <description>
-      This job clears out data from probers and runs once a week.
+      This job clears out data from probers and runs daily.
     </description>
-    <schedule>0 14 * * 1</schedule>
+    <schedule>0 14 * * *</schedule>
   </task>
 
   <task>

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -120,9 +120,9 @@
     <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/deleteProberData&runInEmpty]]></url>
     <name>deleteProberData</name>
     <description>
-      This job clears out data from probers and runs once a week.
+      This job clears out data from probers and runs daily.
     </description>
-    <schedule>0 14 * * 1</schedule>
+    <schedule>0 14 * * *</schedule>
   </task>
 
   <task>

core/src/main/java/google/registry/export/SyncGroupMembersAction.java

@@ -33,6 +33,7 @@ import google.registry.groups.GroupsConnection;
 import google.registry.groups.GroupsConnection.Role;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -99,7 +100,7 @@ public final class SyncGroupMembersAction implements Runnable {
    * Returns the Google Groups email address for the given registrar ID and RegistrarContact.Type.
    */
   public static String getGroupEmailAddressForContactType(
-      String registrarId, RegistrarPoc.Type type, String gSuiteDomainName) {
+      String registrarId, RegistrarPocBase.Type type, String gSuiteDomainName) {
     // Take the registrar's ID, make it lowercase, and remove all characters that aren't
     // alphanumeric, hyphens, or underscores.
     return String.format(
@@ -174,7 +175,7 @@ public final class SyncGroupMembersAction implements Runnable {
       Set<RegistrarPoc> registrarPocs = registrar.getContacts();
       long totalAdded = 0;
       long totalRemoved = 0;
-      for (final RegistrarPoc.Type type : RegistrarPoc.Type.values()) {
+      for (final RegistrarPocBase.Type type : RegistrarPocBase.Type.values()) {
         groupKey =
             getGroupEmailAddressForContactType(registrar.getRegistrarId(), type, gSuiteDomainName);
         Set<String> currentMembers = groupsConnection.getMembersOfGroup(groupKey);

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java

@@ -17,13 +17,13 @@ package google.registry.export.sheet;
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.model.common.Cursor.CursorType.SYNC_REGISTRAR_SHEET;
-import static google.registry.model.registrar.RegistrarPoc.Type.ABUSE;
-import static google.registry.model.registrar.RegistrarPoc.Type.ADMIN;
-import static google.registry.model.registrar.RegistrarPoc.Type.BILLING;
-import static google.registry.model.registrar.RegistrarPoc.Type.LEGAL;
-import static google.registry.model.registrar.RegistrarPoc.Type.MARKETING;
-import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
-import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ABUSE;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ADMIN;
+import static google.registry.model.registrar.RegistrarPocBase.Type.BILLING;
+import static google.registry.model.registrar.RegistrarPocBase.Type.LEGAL;
+import static google.registry.model.registrar.RegistrarPocBase.Type.MARKETING;
+import static google.registry.model.registrar.RegistrarPocBase.Type.TECH;
+import static google.registry.model.registrar.RegistrarPocBase.Type.WHOIS;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -36,6 +36,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.util.Clock;
 import google.registry.util.DateTimeUtils;
 import java.io.IOException;
@@ -173,7 +174,7 @@ class SyncRegistrarsSheet {
     return result.toString();
   }
 
-  private static Predicate<RegistrarPoc> byType(final RegistrarPoc.Type type) {
+  private static Predicate<RegistrarPoc> byType(final RegistrarPocBase.Type type) {
     return contact -> contact.getTypes().contains(type);
   }
 

core/src/main/java/google/registry/flows/TransportCredentials.java

@@ -22,9 +22,9 @@ public interface TransportCredentials {
   /**
    * Check that these credentials are valid for the registrar and optionally check the password.
    *
-   * Called by {@link google.registry.flows.session.LoginFlow LoginFlow} to check the transport
-   * credentials against the stored registrar's credentials. If they do not match, throw an
-   * {@link AuthenticationErrorException}.
+   * <p>Called by {@link google.registry.flows.session.LoginFlow LoginFlow} to check the transport
+   * credentials against the stored registrar's credentials. If they do not match, throw an {@link
+   * AuthenticationErrorException}.
    */
   void validate(Registrar registrar, String password) throws AuthenticationErrorException;
 

core/src/main/java/google/registry/flows/custom/DomainCheckFlowCustomLogic.java

@@ -14,7 +14,7 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.net.InternetDomainName;
@@ -22,7 +22,6 @@ import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainCheckFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.CheckData.DomainCheck;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
@@ -67,91 +66,83 @@ public class DomainCheckFlowCustomLogic extends BaseFlowCustomLogic {
         .build();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  @AutoValue
-  public abstract static class AfterValidationParameters extends ImmutableObject {
-
-    public abstract ImmutableMap<String, InternetDomainName> domainNames();
-
-    /**
-     * The time to perform the domain check as of. This defaults to the current time, but can be
-     * overridden in v&gt;=0.12 of the fee extension.
-     */
-    public abstract DateTime asOfDate();
+  /**
+   * A record to encapsulate parameters for a call to {@link #afterValidation}.
+   *
+   * @param domainNames A map of the domain names being checked, from domain name as string to
+   *     parsed value.
+   * @param asOfDate The time to perform the domain check as of. This defaults to the current time,
+   *     but can be overridden in v&gt;=0.12 of the fee extension.
+   */
+  public record AfterValidationParameters(
+      ImmutableMap<String, InternetDomainName> domainNames, DateTime asOfDate) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainCheckFlowCustomLogic_AfterValidationParameters.Builder();
+      return new AutoBuilder_DomainCheckFlowCustomLogic_AfterValidationParameters_Builder();
     }
 
     /** Builder for {@link AfterValidationParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setDomainNames(ImmutableMap<String, InternetDomainName> domainNames);
+      Builder setDomainNames(ImmutableMap<String, InternetDomainName> domainNames);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract AfterValidationParameters build();
-    }
-  }
-
-  /** A class to encapsulate parameters for a call to {@link #beforeResponse}. */
-  @AutoValue
-  public abstract static class BeforeResponseParameters extends ImmutableObject {
-
-    public abstract ImmutableList<DomainCheck> domainChecks();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
-
-    /**
-     * The time to perform the domain check as of. This defaults to the current time, but can be
-     * overridden in v&gt;=0.12 of the fee extension.
-     */
-    public abstract DateTime asOfDate();
-
-    public static Builder newBuilder() {
-      return new AutoValue_DomainCheckFlowCustomLogic_BeforeResponseParameters.Builder();
-    }
-
-    /** Builder for {@link BeforeResponseParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
-
-      public abstract Builder setDomainChecks(ImmutableList<DomainCheck> domainChecks);
-
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
-
-      public abstract Builder setAsOfDate(DateTime asOfDate);
-
-      public abstract BeforeResponseParameters build();
+      AfterValidationParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for the return values from a call to {@link #beforeResponse}.
+   * A record to encapsulate parameters for a call to {@link #beforeResponse}.
+   *
+   * @param asOfDate The time to perform the domain check as of. This defaults to the current time,
+   *     but can be overridden in v&gt;=0.12 of the fee extension.
    */
-  @AutoValue
-  public abstract static class BeforeResponseReturnData extends ImmutableObject {
-
-    public abstract ImmutableList<DomainCheck> domainChecks();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  public record BeforeResponseParameters(
+      ImmutableList<DomainCheck> domainChecks,
+      ImmutableList<? extends ResponseExtension> responseExtensions,
+      DateTime asOfDate) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainCheckFlowCustomLogic_BeforeResponseReturnData.Builder();
+      return new AutoBuilder_DomainCheckFlowCustomLogic_BeforeResponseParameters_Builder();
+    }
+
+    /** Builder for {@link BeforeResponseParameters}. */
+    @AutoBuilder
+    public interface Builder {
+
+      Builder setDomainChecks(ImmutableList<DomainCheck> domainChecks);
+
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
+
+      Builder setAsOfDate(DateTime asOfDate);
+
+      BeforeResponseParameters build();
+    }
+  }
+
+  /**
+   * A record to encapsulate parameters for the return values from a call to {@link
+   * #beforeResponse}.
+   */
+  public record BeforeResponseReturnData(
+      ImmutableList<DomainCheck> domainChecks,
+      ImmutableList<? extends ResponseExtension> responseExtensions) {
+
+    public static Builder newBuilder() {
+      return new AutoBuilder_DomainCheckFlowCustomLogic_BeforeResponseReturnData_Builder();
     }
 
     /** Builder for {@link BeforeResponseReturnData}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setDomainChecks(ImmutableList<DomainCheck> domainChecks);
+      Builder setDomainChecks(ImmutableList<DomainCheck> domainChecks);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseReturnData build();
+      BeforeResponseReturnData build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainCreateFlowCustomLogic.java

@@ -14,14 +14,13 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.collect.ImmutableList;
 import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainCreateFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppResponse.ResponseData;
@@ -81,147 +80,114 @@ public class DomainCreateFlowCustomLogic extends BaseFlowCustomLogic {
         .build();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  @AutoValue
-  public abstract static class AfterValidationParameters extends ImmutableObject {
-
-    /** The parsed domain name of the domain that is requested to be created. */
-    public abstract InternetDomainName domainName();
-
-    /**
-     * The number of years that the domain name will be registered for.
-     *
-     * <p>On standard TLDs, this is usually 1.
-     */
-    public abstract int years();
-
-    /**
-     * The ID of the validated signed mark.
-     *
-     * <p>If a signed mark was not supplied, this value will be absent.
-     */
-    public abstract Optional<String> signedMarkId();
+  /**
+   * A record to encapsulate parameters for a call to {@link #afterValidation}.
+   *
+   * @param domainName The parsed domain name of the domain that is requested to be created.
+   * @param years The number of years that the domain name will be registered for (typically 1).
+   * @param signedMarkId The ID of the validated signed mark, or absent if not supplied.
+   */
+  public record AfterValidationParameters(
+      InternetDomainName domainName, int years, Optional<String> signedMarkId) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainCreateFlowCustomLogic_AfterValidationParameters.Builder();
+      return new AutoBuilder_DomainCreateFlowCustomLogic_AfterValidationParameters_Builder();
     }
 
     /** Builder for {@link AfterValidationParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setYears(int years);
+      Builder setYears(int years);
 
-      public abstract Builder setSignedMarkId(Optional<String> signedMarkId);
+      Builder setSignedMarkId(Optional<String> signedMarkId);
 
-      public abstract AfterValidationParameters build();
-    }
-  }
-
-  /** A class to encapsulate parameters for a call to {@link #beforeSave}. */
-  @AutoValue
-  public abstract static class BeforeSaveParameters extends ImmutableObject {
-
-    /**
-     * The new {@link Domain} entity that is going to be persisted at the end of the transaction.
-     */
-    public abstract Domain newDomain();
-
-    /**
-     * The new {@link HistoryEntry} entity for the domain's creation that is going to be persisted
-     * at the end of the transaction.
-     */
-    public abstract HistoryEntry historyEntry();
-
-    /**
-     * The collection of {@link EntityChanges} (including new entities and those to delete) that
-     * will be persisted at the end of the transaction.
-     *
-     * <p>Note that the new domain and history entry are also included as saves in this collection,
-     * and are separated out above solely for convenience, as they are most likely to need to be
-     * changed. Removing them from the collection will cause them not to be saved, which is most
-     * likely not what you intended.
-     */
-    public abstract EntityChanges entityChanges();
-
-    /**
-     * The number of years that the domain name will be registered for.
-     *
-     * <p>On standard TLDs, this is usually 1.
-     */
-    public abstract int years();
-
-    public static Builder newBuilder() {
-      return new AutoValue_DomainCreateFlowCustomLogic_BeforeSaveParameters.Builder();
-    }
-
-    /** Builder for {@link BeforeSaveParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
-
-      public abstract Builder setNewDomain(Domain newDomain);
-
-      public abstract Builder setHistoryEntry(HistoryEntry historyEntry);
-
-      public abstract Builder setEntityChanges(EntityChanges entityChanges);
-
-      public abstract Builder setYears(int years);
-
-      public abstract BeforeSaveParameters build();
-    }
-  }
-
-  /** A class to encapsulate parameters for a call to {@link #beforeResponse}. */
-  @AutoValue
-  public abstract static class BeforeResponseParameters extends ImmutableObject {
-
-    public abstract ResponseData resData();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
-
-    public static BeforeResponseParameters.Builder newBuilder() {
-      return new AutoValue_DomainCreateFlowCustomLogic_BeforeResponseParameters.Builder();
-    }
-
-    /** Builder for {@link DomainCreateFlowCustomLogic.BeforeResponseParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
-
-      public abstract BeforeResponseParameters.Builder setResData(ResponseData resData);
-
-      public abstract BeforeResponseParameters.Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
-
-      public abstract BeforeResponseParameters build();
+      AfterValidationParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for the return values from a call to {@link #beforeResponse}.
+   * A record to encapsulate parameters for a call to {@link #beforeSave}.
+   *
+   * @param newDomain The new {@link Domain} entity that is going to be persisted at the end of the
+   *     transaction.
+   * @param historyEntry The new {@link HistoryEntry} entity for the domain's creation that is going
+   *     to be persisted at the end of the transaction.
+   * @param entityChanges The collection of {@link EntityChanges} (including new entities and those
+   *     to delete) that will be persisted at the end of the transaction.
+   *     <p>Note that the new domain and history entry are also included as saves in this
+   *     collection, and are separated out above solely for convenience, as they are most likely to
+   *     need to be changed. Removing them from the collection will cause them not to be saved,
+   *     which is most likely not what you intended.
+   * @param years The number of years that the domain name will be registered for (typically 1).
    */
-  @AutoValue
-  public abstract static class BeforeResponseReturnData extends ImmutableObject {
+  public record BeforeSaveParameters(
+      Domain newDomain, HistoryEntry historyEntry, EntityChanges entityChanges, int years) {
 
-    public abstract ResponseData resData();
+    public static Builder newBuilder() {
+      return new AutoBuilder_DomainCreateFlowCustomLogic_BeforeSaveParameters_Builder();
+    }
 
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+    /** Builder for {@link BeforeSaveParameters}. */
+    @AutoBuilder
+    public interface Builder {
+
+      Builder setNewDomain(Domain newDomain);
+
+      Builder setHistoryEntry(HistoryEntry historyEntry);
+
+      Builder setEntityChanges(EntityChanges entityChanges);
+
+      Builder setYears(int years);
+
+      BeforeSaveParameters build();
+    }
+  }
+
+  /** A record to encapsulate parameters for a call to {@link #beforeResponse}. */
+  public record BeforeResponseParameters(
+      ResponseData resData, ImmutableList<? extends ResponseExtension> responseExtensions) {
+
+    public static BeforeResponseParameters.Builder newBuilder() {
+      return new AutoBuilder_DomainCreateFlowCustomLogic_BeforeResponseParameters_Builder();
+    }
+
+    /** Builder for {@link DomainCreateFlowCustomLogic.BeforeResponseParameters}. */
+    @AutoBuilder
+    public interface Builder {
+
+      BeforeResponseParameters.Builder setResData(ResponseData resData);
+
+      BeforeResponseParameters.Builder setResponseExtensions(
+          ImmutableList<? extends ResponseExtension> responseExtensions);
+
+      BeforeResponseParameters build();
+    }
+  }
+
+  /**
+   * A record to encapsulate parameters for the return values from a call to {@link
+   * #beforeResponse}.
+   */
+  public record BeforeResponseReturnData(
+      ResponseData resData, ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static BeforeResponseReturnData.Builder newBuilder() {
-      return new AutoValue_DomainCreateFlowCustomLogic_BeforeResponseReturnData.Builder();
+      return new AutoBuilder_DomainCreateFlowCustomLogic_BeforeResponseReturnData_Builder();
     }
 
     /** Builder for {@link DomainCreateFlowCustomLogic.BeforeResponseReturnData}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract BeforeResponseReturnData.Builder setResData(ResponseData resData);
+      BeforeResponseReturnData.Builder setResData(ResponseData resData);
 
-      public abstract BeforeResponseReturnData.Builder setResponseExtensions(
+      BeforeResponseReturnData.Builder setResponseExtensions(
           ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseReturnData build();
+      BeforeResponseReturnData build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainDeleteFlowCustomLogic.java

@@ -14,13 +14,12 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.collect.ImmutableList;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainDeleteFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
@@ -79,112 +78,96 @@ public class DomainDeleteFlowCustomLogic extends BaseFlowCustomLogic {
         .build();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  @AutoValue
-  public abstract static class AfterValidationParameters extends ImmutableObject {
-
-    public abstract Domain existingDomain();
+  /** A record to encapsulate parameters for a call to {@link #afterValidation}. */
+  public record AfterValidationParameters(Domain existingDomain) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainDeleteFlowCustomLogic_AfterValidationParameters.Builder();
+      return new AutoBuilder_DomainDeleteFlowCustomLogic_AfterValidationParameters_Builder();
     }
 
     /** Builder for {@link AfterValidationParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setExistingDomain(Domain existingDomain);
+      Builder setExistingDomain(Domain existingDomain);
 
-      public abstract AfterValidationParameters build();
+      AfterValidationParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for a call to {@link #beforeSave}.
+   * A record to encapsulate parameters for a call to {@link #beforeSave}.
    *
    * <p>Note that both newDomain and historyEntry are included in entityChanges. They are also
    * passed separately for convenience, but they are the same instance, and changes to them will
    * also affect what is persisted from entityChanges.
    */
-  @AutoValue
-  public abstract static class BeforeSaveParameters extends ImmutableObject {
-
-    public abstract Domain existingDomain();
-
-    public abstract Domain newDomain();
-
-    public abstract HistoryEntry historyEntry();
-
-    public abstract EntityChanges entityChanges();
+  public record BeforeSaveParameters(
+      Domain existingDomain,
+      Domain newDomain,
+      HistoryEntry historyEntry,
+      EntityChanges entityChanges) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainDeleteFlowCustomLogic_BeforeSaveParameters.Builder();
+      return new AutoBuilder_DomainDeleteFlowCustomLogic_BeforeSaveParameters_Builder();
     }
 
     /** Builder for {@link BeforeSaveParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setExistingDomain(Domain existingDomain);
+      Builder setExistingDomain(Domain existingDomain);
 
-      public abstract Builder setNewDomain(Domain newDomain);
+      Builder setNewDomain(Domain newDomain);
 
-      public abstract Builder setHistoryEntry(HistoryEntry historyEntry);
+      Builder setHistoryEntry(HistoryEntry historyEntry);
 
-      public abstract Builder setEntityChanges(EntityChanges entityChanges);
+      Builder setEntityChanges(EntityChanges entityChanges);
 
-      public abstract BeforeSaveParameters build();
+      BeforeSaveParameters build();
     }
   }
-  /** A class to encapsulate parameters for a call to {@link #beforeResponse}. */
-  @AutoValue
-  public abstract static class BeforeResponseParameters extends ImmutableObject {
 
-    public abstract Result.Code resultCode();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  /** A record to encapsulate parameters for a call to {@link #beforeResponse}. */
+  public record BeforeResponseParameters(
+      Result.Code resultCode, ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainDeleteFlowCustomLogic_BeforeResponseParameters.Builder();
+      return new AutoBuilder_DomainDeleteFlowCustomLogic_BeforeResponseParameters_Builder();
     }
 
     /** Builder for {@link BeforeResponseParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setResultCode(Result.Code resultCode);
+      Builder setResultCode(Result.Code resultCode);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseParameters build();
+      BeforeResponseParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for the return values from a call to {@link #beforeResponse}.
+   * A record to encapsulate parameters for the return values from a call to {@link
+   * #beforeResponse}.
    */
-  @AutoValue
-  public abstract static class BeforeResponseReturnData extends ImmutableObject {
-
-    public abstract Result.Code resultCode();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  public record BeforeResponseReturnData(
+      Result.Code resultCode, ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainDeleteFlowCustomLogic_BeforeResponseReturnData.Builder();
+      return new AutoBuilder_DomainDeleteFlowCustomLogic_BeforeResponseReturnData_Builder();
     }
 
     /** Builder for {@link BeforeResponseReturnData}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setResultCode(Result.Code resultCode);
+      Builder setResultCode(Result.Code resultCode);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseReturnData build();
+      BeforeResponseReturnData build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainInfoFlowCustomLogic.java

@@ -14,13 +14,12 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.collect.ImmutableList;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainInfoFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainInfoData;
 import google.registry.model.eppinput.EppInput;
@@ -65,79 +64,67 @@ public class DomainInfoFlowCustomLogic extends BaseFlowCustomLogic {
         .build();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  @AutoValue
-  public abstract static class AfterValidationParameters extends ImmutableObject {
-
-    public abstract Domain domain();
+  /** A record to encapsulate parameters for a call to {@link #afterValidation}. */
+  public record AfterValidationParameters(Domain domain) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainInfoFlowCustomLogic_AfterValidationParameters.Builder();
+      return new AutoBuilder_DomainInfoFlowCustomLogic_AfterValidationParameters_Builder();
     }
 
     /** Builder for {@link AfterValidationParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setDomain(Domain domain);
+      Builder setDomain(Domain domain);
 
-      public abstract AfterValidationParameters build();
+      AfterValidationParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #beforeResponse}. */
-  @AutoValue
-  public abstract static class BeforeResponseParameters extends ImmutableObject {
-
-    public abstract Domain domain();
-
-    public abstract DomainInfoData resData();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  /** A record to encapsulate parameters for a call to {@link #beforeResponse}. */
+  public record BeforeResponseParameters(
+      Domain domain,
+      DomainInfoData resData,
+      ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainInfoFlowCustomLogic_BeforeResponseParameters.Builder();
+      return new AutoBuilder_DomainInfoFlowCustomLogic_BeforeResponseParameters_Builder();
     }
 
     /** Builder for {@link BeforeResponseParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setDomain(Domain domain);
+      Builder setDomain(Domain domain);
 
-      public abstract Builder setResData(DomainInfoData resData);
+      Builder setResData(DomainInfoData resData);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseParameters build();
+      BeforeResponseParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for the return values from a call to {@link #beforeResponse}.
+   * A record to encapsulate parameters for the return values from a call to {@link
+   * #beforeResponse}.
    */
-  @AutoValue
-  public abstract static class BeforeResponseReturnData extends ImmutableObject {
-
-    public abstract DomainInfoData resData();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  public record BeforeResponseReturnData(
+      DomainInfoData resData, ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainInfoFlowCustomLogic_BeforeResponseReturnData.Builder();
+      return new AutoBuilder_DomainInfoFlowCustomLogic_BeforeResponseReturnData_Builder();
     }
 
     /** Builder for {@link BeforeResponseReturnData}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setResData(DomainInfoData resData);
+      Builder setResData(DomainInfoData resData);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseReturnData build();
+      BeforeResponseReturnData build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainPricingCustomLogic.java

@@ -14,14 +14,13 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainPricingLogic;
 import google.registry.flows.domain.FeesAndCredits;
-import google.registry.model.ImmutableObject;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.tld.Tld;
 import javax.annotation.Nullable;
@@ -75,171 +74,135 @@ public class DomainPricingCustomLogic extends BaseFlowCustomLogic {
     return priceParameters.feesAndCredits();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #customizeCreatePrice} . */
-  @AutoValue
-  public abstract static class CreatePriceParameters extends ImmutableObject {
-
-    public abstract FeesAndCredits feesAndCredits();
-
-    public abstract Tld tld();
-
-    public abstract InternetDomainName domainName();
-
-    public abstract DateTime asOfDate();
-
-    public abstract int years();
+  /** A record to encapsulate parameters for a call to {@link #customizeCreatePrice} . */
+  public record CreatePriceParameters(
+      FeesAndCredits feesAndCredits,
+      Tld tld,
+      InternetDomainName domainName,
+      DateTime asOfDate,
+      int years) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainPricingCustomLogic_CreatePriceParameters.Builder();
+      return new AutoBuilder_DomainPricingCustomLogic_CreatePriceParameters_Builder();
     }
 
     /** Builder for {@link CreatePriceParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
+      Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setTld(Tld tld);
+      Builder setTld(Tld tld);
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract Builder setYears(int years);
+      Builder setYears(int years);
 
-      public abstract CreatePriceParameters build();
+      CreatePriceParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #customizeRenewPrice} . */
-  @AutoValue
-  public abstract static class RenewPriceParameters extends ImmutableObject {
-
-    public abstract FeesAndCredits feesAndCredits();
-
-    public abstract Tld tld();
-
-    public abstract InternetDomainName domainName();
-
-    public abstract DateTime asOfDate();
-
-    public abstract int years();
+  /** A record to encapsulate parameters for a call to {@link #customizeRenewPrice} . */
+  public record RenewPriceParameters(
+      FeesAndCredits feesAndCredits,
+      Tld tld,
+      InternetDomainName domainName,
+      DateTime asOfDate,
+      int years) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainPricingCustomLogic_RenewPriceParameters.Builder();
+      return new AutoBuilder_DomainPricingCustomLogic_RenewPriceParameters_Builder();
     }
 
     /** Builder for {@link RenewPriceParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
+      Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setTld(Tld tld);
+      Builder setTld(Tld tld);
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract Builder setYears(int years);
+      Builder setYears(int years);
 
-      public abstract RenewPriceParameters build();
+      RenewPriceParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #customizeRestorePrice} . */
-  @AutoValue
-  public abstract static class RestorePriceParameters extends ImmutableObject {
-
-    public abstract FeesAndCredits feesAndCredits();
-
-    public abstract Tld tld();
-
-    public abstract InternetDomainName domainName();
-
-    public abstract DateTime asOfDate();
+  /** A record to encapsulate parameters for a call to {@link #customizeRestorePrice} . */
+  public record RestorePriceParameters(
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainPricingCustomLogic_RestorePriceParameters.Builder();
+      return new AutoBuilder_DomainPricingCustomLogic_RestorePriceParameters_Builder();
     }
 
     /** Builder for {@link RestorePriceParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
+      Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setTld(Tld tld);
+      Builder setTld(Tld tld);
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract RestorePriceParameters build();
+      RestorePriceParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #customizeTransferPrice} . */
-  @AutoValue
-  public abstract static class TransferPriceParameters extends ImmutableObject {
-
-    public abstract FeesAndCredits feesAndCredits();
-
-    public abstract Tld tld();
-
-    public abstract InternetDomainName domainName();
-
-    public abstract DateTime asOfDate();
+  /** A record to encapsulate parameters for a call to {@link #customizeTransferPrice} . */
+  public record TransferPriceParameters(
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainPricingCustomLogic_TransferPriceParameters.Builder();
+      return new AutoBuilder_DomainPricingCustomLogic_TransferPriceParameters_Builder();
     }
 
     /** Builder for {@link TransferPriceParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
+      Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setTld(Tld tld);
+      Builder setTld(Tld tld);
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract TransferPriceParameters build();
+      TransferPriceParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #customizeUpdatePrice} . */
-  @AutoValue
-  public abstract static class UpdatePriceParameters extends ImmutableObject {
-
-    public abstract FeesAndCredits feesAndCredits();
-
-    public abstract Tld tld();
-
-    public abstract InternetDomainName domainName();
-
-    public abstract DateTime asOfDate();
+  /** A record to encapsulate parameters for a call to {@link #customizeUpdatePrice} . */
+  public record UpdatePriceParameters(
+      FeesAndCredits feesAndCredits, Tld tld, InternetDomainName domainName, DateTime asOfDate) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainPricingCustomLogic_UpdatePriceParameters.Builder();
+      return new AutoBuilder_DomainPricingCustomLogic_UpdatePriceParameters_Builder();
     }
 
     /** Builder for {@link UpdatePriceParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
+      Builder setFeesAndCredits(FeesAndCredits feesAndCredits);
 
-      public abstract Builder setTld(Tld tld);
+      Builder setTld(Tld tld);
 
-      public abstract Builder setDomainName(InternetDomainName domainName);
+      Builder setDomainName(InternetDomainName domainName);
 
-      public abstract Builder setAsOfDate(DateTime asOfDate);
+      Builder setAsOfDate(DateTime asOfDate);
 
-      public abstract UpdatePriceParameters build();
+      UpdatePriceParameters build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainRenewFlowCustomLogic.java

@@ -15,13 +15,11 @@
 package google.registry.flows.custom;
 
 import com.google.auto.value.AutoBuilder;
-import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableList;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainRenewFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppResponse.ResponseData;
@@ -103,103 +101,89 @@ public class DomainRenewFlowCustomLogic extends BaseFlowCustomLogic {
   }
 
   /**
-   * A class to encapsulate parameters for a call to {@link #beforeSave}.
+   * A record to encapsulate parameters for a call to {@link #beforeSave}.
    *
    * <p>Note that both newDomain and historyEntry are included in entityChanges. They are also
    * passed separately for convenience, but they are the same instance, and changes to them will
    * also affect what is persisted from entityChanges.
    */
-  @AutoValue
-  public abstract static class BeforeSaveParameters extends ImmutableObject {
-
-    public abstract Domain existingDomain();
-
-    public abstract Domain newDomain();
-
-    public abstract HistoryEntry historyEntry();
-
-    public abstract EntityChanges entityChanges();
-
-    public abstract int years();
-
-    public abstract DateTime now();
+  public record BeforeSaveParameters(
+      Domain existingDomain,
+      Domain newDomain,
+      HistoryEntry historyEntry,
+      EntityChanges entityChanges,
+      int years,
+      DateTime now) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainRenewFlowCustomLogic_BeforeSaveParameters.Builder();
+      return new AutoBuilder_DomainRenewFlowCustomLogic_BeforeSaveParameters_Builder();
     }
 
     /** Builder for {@link BeforeSaveParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setExistingDomain(Domain existingDomain);
+      Builder setExistingDomain(Domain existingDomain);
 
-      public abstract Builder setNewDomain(Domain newDomain);
+      Builder setNewDomain(Domain newDomain);
 
-      public abstract Builder setHistoryEntry(HistoryEntry historyEntry);
+      Builder setHistoryEntry(HistoryEntry historyEntry);
 
-      public abstract Builder setEntityChanges(EntityChanges entityChanges);
+      Builder setEntityChanges(EntityChanges entityChanges);
 
-      public abstract Builder setYears(int years);
+      Builder setYears(int years);
 
-      public abstract Builder setNow(DateTime now);
+      Builder setNow(DateTime now);
 
-      public abstract BeforeSaveParameters build();
+      BeforeSaveParameters build();
     }
   }
 
-  /** A class to encapsulate parameters for a call to {@link #beforeResponse}. */
-  @AutoValue
-  public abstract static class BeforeResponseParameters extends ImmutableObject {
-
-    public abstract Domain domain();
-
-    public abstract ResponseData resData();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  /** A record to encapsulate parameters for a call to {@link #beforeResponse}. */
+  public record BeforeResponseParameters(
+      Domain domain,
+      ResponseData resData,
+      ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static BeforeResponseParameters.Builder newBuilder() {
-      return new AutoValue_DomainRenewFlowCustomLogic_BeforeResponseParameters.Builder();
+      return new AutoBuilder_DomainRenewFlowCustomLogic_BeforeResponseParameters_Builder();
     }
 
     /** Builder for {@link BeforeResponseParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract BeforeResponseParameters.Builder setDomain(Domain domain);
+      BeforeResponseParameters.Builder setDomain(Domain domain);
 
-      public abstract BeforeResponseParameters.Builder setResData(ResponseData resData);
+      BeforeResponseParameters.Builder setResData(ResponseData resData);
 
-      public abstract BeforeResponseParameters.Builder setResponseExtensions(
+      BeforeResponseParameters.Builder setResponseExtensions(
           ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseParameters build();
+      BeforeResponseParameters build();
     }
   }
+
   /**
-   * A class to encapsulate parameters for the return values from a call to {@link #beforeResponse}.
+   * A record to encapsulate parameters for the return values from a call to {@link
+   * #beforeResponse}.
    */
-  @AutoValue
-  public abstract static class BeforeResponseReturnData extends ImmutableObject {
-
-    public abstract ResponseData resData();
-
-    public abstract ImmutableList<? extends ResponseExtension> responseExtensions();
+  public record BeforeResponseReturnData(
+      ResponseData resData, ImmutableList<? extends ResponseExtension> responseExtensions) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainRenewFlowCustomLogic_BeforeResponseReturnData.Builder();
+      return new AutoBuilder_DomainRenewFlowCustomLogic_BeforeResponseReturnData_Builder();
     }
 
     /** Builder for {@link BeforeResponseReturnData}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setResData(ResponseData resData);
+      Builder setResData(ResponseData resData);
 
-      public abstract Builder setResponseExtensions(
-          ImmutableList<? extends ResponseExtension> responseExtensions);
+      Builder setResponseExtensions(ImmutableList<? extends ResponseExtension> responseExtensions);
 
-      public abstract BeforeResponseReturnData build();
+      BeforeResponseReturnData build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/DomainUpdateFlowCustomLogic.java

@@ -14,12 +14,11 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowMetadata;
 import google.registry.flows.SessionMetadata;
 import google.registry.flows.domain.DomainUpdateFlow;
-import google.registry.model.ImmutableObject;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.reporting.HistoryEntry;
@@ -61,61 +60,53 @@ public class DomainUpdateFlowCustomLogic extends BaseFlowCustomLogic {
     return parameters.entityChanges();
   }
 
-  /** A class to encapsulate parameters for a call to {@link #afterValidation}. */
-  @AutoValue
-  public abstract static class AfterValidationParameters extends ImmutableObject {
-
-    public abstract Domain existingDomain();
+  /** A record to encapsulate parameters for a call to {@link #afterValidation}. */
+  public record AfterValidationParameters(Domain existingDomain) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainUpdateFlowCustomLogic_AfterValidationParameters.Builder();
+      return new AutoBuilder_DomainUpdateFlowCustomLogic_AfterValidationParameters_Builder();
     }
 
     /** Builder for {@link AfterValidationParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setExistingDomain(Domain existingDomain);
+      Builder setExistingDomain(Domain existingDomain);
 
-      public abstract AfterValidationParameters build();
+      AfterValidationParameters build();
     }
   }
 
   /**
-   * A class to encapsulate parameters for a call to {@link #beforeSave}.
+   * A record to encapsulate parameters for a call to {@link #beforeSave}.
    *
    * <p>Note that both newDomain and historyEntry are included in entityChanges. They are also
    * passed separately for convenience, but they are the same instance, and changes to them will
    * also affect what is persisted from entityChanges.
    */
-  @AutoValue
-  public abstract static class BeforeSaveParameters extends ImmutableObject {
-
-    public abstract Domain existingDomain();
-
-    public abstract Domain newDomain();
-
-    public abstract HistoryEntry historyEntry();
-
-    public abstract EntityChanges entityChanges();
+  public record BeforeSaveParameters(
+      Domain existingDomain,
+      Domain newDomain,
+      HistoryEntry historyEntry,
+      EntityChanges entityChanges) {
 
     public static Builder newBuilder() {
-      return new AutoValue_DomainUpdateFlowCustomLogic_BeforeSaveParameters.Builder();
+      return new AutoBuilder_DomainUpdateFlowCustomLogic_BeforeSaveParameters_Builder();
     }
 
     /** Builder for {@link BeforeSaveParameters}. */
-    @AutoValue.Builder
-    public abstract static class Builder {
+    @AutoBuilder
+    public interface Builder {
 
-      public abstract Builder setExistingDomain(Domain existingDomain);
+      Builder setExistingDomain(Domain existingDomain);
 
-      public abstract Builder setNewDomain(Domain newDomain);
+      Builder setNewDomain(Domain newDomain);
 
-      public abstract Builder setHistoryEntry(HistoryEntry historyEntry);
+      Builder setHistoryEntry(HistoryEntry historyEntry);
 
-      public abstract Builder setEntityChanges(EntityChanges entityChanges);
+      Builder setEntityChanges(EntityChanges entityChanges);
 
-      public abstract BeforeSaveParameters build();
+      BeforeSaveParameters build();
     }
   }
 }

core/src/main/java/google/registry/flows/custom/EntityChanges.java

@@ -14,49 +14,55 @@
 
 package google.registry.flows.custom;
 
-import com.google.auto.value.AutoValue;
+import com.google.auto.value.AutoBuilder;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.ImmutableObject;
 import google.registry.persistence.VKey;
 
-/** A wrapper class that encapsulates database entities to both save and delete. */
-@AutoValue
-public abstract class EntityChanges {
+/** A record that encapsulates database entities to both save and delete. */
+public record EntityChanges(
+    ImmutableSet<ImmutableObject> saves, ImmutableSet<VKey<ImmutableObject>> deletes) {
 
-  public abstract ImmutableSet<ImmutableObject> getSaves();
+  public ImmutableSet<ImmutableObject> getSaves() {
+    return saves;
+  }
+  ;
 
-  public abstract ImmutableSet<VKey<ImmutableObject>> getDeletes();
+  public ImmutableSet<VKey<ImmutableObject>> getDeletes() {
+    return deletes;
+  }
+  ;
 
   public static Builder newBuilder() {
     // Default both entities to save and entities to delete to empty sets, so that the build()
     // method won't subsequently throw an exception if one doesn't end up being applicable.
-    return new AutoValue_EntityChanges.Builder()
+    return new AutoBuilder_EntityChanges_Builder()
         .setSaves(ImmutableSet.of())
         .setDeletes(ImmutableSet.of());
   }
 
   /** Builder for {@link EntityChanges}. */
-  @AutoValue.Builder
-  public abstract static class Builder {
+  @AutoBuilder
+  public interface Builder {
 
-    public abstract Builder setSaves(ImmutableSet<ImmutableObject> entitiesToSave);
+    Builder setSaves(ImmutableSet<ImmutableObject> entitiesToSave);
 
-    public abstract ImmutableSet.Builder<ImmutableObject> savesBuilder();
+    ImmutableSet.Builder<ImmutableObject> savesBuilder();
 
-    public Builder addSave(ImmutableObject entityToSave) {
+    default Builder addSave(ImmutableObject entityToSave) {
       savesBuilder().add(entityToSave);
       return this;
     }
 
-    public abstract Builder setDeletes(ImmutableSet<VKey<ImmutableObject>> entitiesToDelete);
+    Builder setDeletes(ImmutableSet<VKey<ImmutableObject>> entitiesToDelete);
 
-    public abstract ImmutableSet.Builder<VKey<ImmutableObject>> deletesBuilder();
+    ImmutableSet.Builder<VKey<ImmutableObject>> deletesBuilder();
 
-    public Builder addDelete(VKey<ImmutableObject> entityToDelete) {
+    default Builder addDelete(VKey<ImmutableObject> entityToDelete) {
       deletesBuilder().add(entityToDelete);
       return this;
     }
 
-    public abstract EntityChanges build();
+    EntityChanges build();
   }
 }

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -16,12 +16,10 @@ package google.registry.flows.domain;
 
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.base.Predicates.equalTo;
 import static com.google.common.base.Strings.emptyToNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSetMultimap.toImmutableSetMultimap;
-import static com.google.common.collect.Iterables.any;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
@@ -95,6 +93,7 @@ import google.registry.model.domain.DomainCommand.Update;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.ForeignKeyedDesignatedContact;
 import google.registry.model.domain.Period;
+import google.registry.model.domain.Period.Unit;
 import google.registry.model.domain.fee.BaseFee;
 import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Credit;
@@ -121,9 +120,9 @@ import google.registry.model.domain.token.AllocationToken.RegistrationBehavior;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
 import google.registry.model.host.Host;
-import google.registry.model.poll.PollMessage;
+import google.registry.model.poll.PollMessage.Autorenew;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
@@ -206,7 +205,7 @@ public class DomainFlowUtils {
     if (parts.size() <= 1) {
       throw new BadDomainNamePartsCountException();
     }
-    if (any(parts, equalTo(""))) {
+    if (parts.stream().anyMatch(String::isEmpty)) {
       throw new EmptyDomainNamePartException();
     }
     validateFirstLabel(parts.get(0));
@@ -329,7 +328,7 @@ public class DomainFlowUtils {
   /** Check if the registrar running the flow has access to the TLD in question. */
   public static void checkAllowedAccessToTld(String registrarId, String tld) throws EppException {
     if (!Registrar.loadByRegistrarIdCached(registrarId).get().getAllowedTlds().contains(tld)) {
-      throw new DomainFlowUtils.NotAuthorizedForTldException(tld);
+      throw new NotAuthorizedForTldException(tld);
     }
   }
 
@@ -344,7 +343,7 @@ public class DomainFlowUtils {
         .get()
         .getBillingAccountMap()
         .containsKey(tld.getCurrency())) {
-      throw new DomainFlowUtils.MissingBillingAccountMapException(tld.getCurrency());
+      throw new MissingBillingAccountMapException(tld.getCurrency());
     }
   }
 
@@ -405,7 +404,7 @@ public class DomainFlowUtils {
 
   /** We only allow specifying years in a period. */
   static Period verifyUnitIsYears(Period period) throws EppException {
-    if (!checkNotNull(period).getUnit().equals(Period.Unit.YEARS)) {
+    if (!checkNotNull(period).getUnit().equals(Unit.YEARS)) {
       throw new BadPeriodUnitException();
     }
     return period;
@@ -534,7 +533,7 @@ public class DomainFlowUtils {
 
   public static boolean isReserved(InternetDomainName domainName, boolean isSunrise) {
     ImmutableSet<ReservationType> types = getReservationTypes(domainName);
-    return !Sets.intersection(types, RESERVED_TYPES).isEmpty()
+    return !intersection(types, RESERVED_TYPES).isEmpty()
         || !(isSunrise || intersection(TYPES_ALLOWED_FOR_CREATE_ONLY_IN_SUNRISE, types).isEmpty());
   }
 
@@ -601,8 +600,8 @@ public class DomainFlowUtils {
    * Fills in a builder with the data needed for an autorenew poll message for this domain. This
    * does not copy over the id of the current autorenew poll message.
    */
-  public static PollMessage.Autorenew.Builder newAutorenewPollMessage(Domain domain) {
-    return new PollMessage.Autorenew.Builder()
+  public static Autorenew.Builder newAutorenewPollMessage(Domain domain) {
+    return new Autorenew.Builder()
         .setTargetId(domain.getDomainName())
         .setRegistrarId(domain.getCurrentSponsorRegistrarId())
         .setEventTime(domain.getRegistrationExpirationTime())
@@ -623,7 +622,7 @@ public class DomainFlowUtils {
       BillingRecurrence existingBillingRecurrence,
       DateTime newEndTime,
       @Nullable HistoryEntryId historyId) {
-    Optional<PollMessage.Autorenew> autorenewPollMessage =
+    Optional<Autorenew> autorenewPollMessage =
         tm().loadByKeyIfPresent(domain.getAutorenewPollMessage());
 
     // Construct an updated autorenew poll message. If the autorenew poll message no longer exists,
@@ -632,7 +631,7 @@ public class DomainFlowUtils {
     // message to be deleted), and then subsequently the transfer was canceled, rejected, or deleted
     // (which would cause the poll message to be recreated here). In the latter case, the history id
     // of the event that created the new poll message will also be used.
-    PollMessage.Autorenew updatedAutorenewPollMessage;
+    Autorenew updatedAutorenewPollMessage;
     if (autorenewPollMessage.isPresent()) {
       updatedAutorenewPollMessage =
           autorenewPollMessage.get().asBuilder().setAutorenewEndTime(newEndTime).build();
@@ -706,7 +705,7 @@ public class DomainFlowUtils {
     String feeClass = null;
     ImmutableList<Fee> fees = ImmutableList.of();
     switch (feeRequest.getCommandName()) {
-      case CREATE:
+      case CREATE -> {
         // Don't return a create price for reserved names.
         if (isReserved(domainName, isSunrise) && !isAvailable) {
           feeClass = "reserved";
@@ -726,16 +725,16 @@ public class DomainFlowUtils {
                       allocationToken)
                   .getFees();
         }
-        break;
-      case RENEW:
+      }
+      case RENEW -> {
         builder.setAvailIfSupported(true);
         fees =
             pricingLogic
                 .getRenewPrice(
                     tld, domainNameString, now, years, billingRecurrence, allocationToken)
                 .getFees();
-        break;
-      case RESTORE:
+      }
+      case RESTORE -> {
         // The minimum allowable period per the EPP spec is 1, so, strangely, 1 year still has to be
         // passed in as the period for a restore even if the domain would *not* be renewed as part
         // of a restore. This is fixed in RFC 8748 (which is a more recent version of the fee
@@ -751,21 +750,20 @@ public class DomainFlowUtils {
         boolean isExpired =
             domain.isPresent() && domain.get().getRegistrationExpirationTime().isBefore(now);
         fees = pricingLogic.getRestorePrice(tld, domainNameString, now, isExpired).getFees();
-        break;
-      case TRANSFER:
+      }
+      case TRANSFER -> {
         if (years != 1) {
           throw new TransfersAreAlwaysForOneYearException();
         }
         builder.setAvailIfSupported(true);
         fees =
             pricingLogic.getTransferPrice(tld, domainNameString, now, billingRecurrence).getFees();
-        break;
-      case UPDATE:
+      }
+      case UPDATE -> {
         builder.setAvailIfSupported(true);
         fees = pricingLogic.getUpdatePrice(tld, domainNameString, now).getFees();
-        break;
-      default:
-        throw new UnknownFeeCommandException(feeRequest.getUnparsedCommandName());
+      }
+      default -> throw new UnknownFeeCommandException(feeRequest.getUnparsedCommandName());
     }
 
     if (feeClass == null) {

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -138,14 +138,14 @@ public final class DomainPricingLogic {
       isRenewCostPremiumPrice = domainPrices.isPremium();
     } else {
       switch (billingRecurrence.getRenewalPriceBehavior()) {
-        case DEFAULT:
+        case DEFAULT -> {
           renewCost =
               getDomainRenewCostWithDiscount(tld, domainPrices, dateTime, years, allocationToken);
           isRenewCostPremiumPrice = domainPrices.isPremium();
-          break;
+        }
           // if the renewal price behavior is specified, then the renewal price should be the same
           // as the creation price, which is stored in the billing event as the renewal price
-        case SPECIFIED:
+        case SPECIFIED -> {
           checkArgumentPresent(
               billingRecurrence.getRenewalPrice(),
               "Unexpected behavior: renewal price cannot be null when renewal behavior is"
@@ -153,20 +153,20 @@ public final class DomainPricingLogic {
           // Don't apply allocation token to renewal price when SPECIFIED
           renewCost = billingRecurrence.getRenewalPrice().get().multipliedBy(years);
           isRenewCostPremiumPrice = false;
-          break;
+        }
           // if the renewal price behavior is nonpremium, it means that the domain should be renewed
           // at standard price of domains at the time, even if the domain is premium
-        case NONPREMIUM:
+        case NONPREMIUM -> {
           renewCost =
               getDomainCostWithDiscount(
                   false, years, allocationToken, tld.getStandardRenewCost(dateTime));
           isRenewCostPremiumPrice = false;
-          break;
-        default:
-          throw new IllegalArgumentException(
-              String.format(
-                  "Unknown RenewalPriceBehavior enum value: %s",
-                  billingRecurrence.getRenewalPriceBehavior()));
+        }
+        default ->
+            throw new IllegalArgumentException(
+                String.format(
+                    "Unknown RenewalPriceBehavior enum value: %s",
+                    billingRecurrence.getRenewalPriceBehavior()));
       }
     }
     return customLogic.customizeRenewPrice(

core/src/main/java/google/registry/flows/domain/token/AllocationTokenDomainCheckResults.java

@@ -14,23 +14,11 @@
 
 package google.registry.flows.domain.token;
 
-import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.net.InternetDomainName;
 import google.registry.model.domain.token.AllocationToken;
 import java.util.Optional;
 
-/** Value class to represent the result of loading a token and checking domains with it. */
-@AutoValue
-public abstract class AllocationTokenDomainCheckResults {
-
-  public abstract Optional<AllocationToken> token();
-
-  public abstract ImmutableMap<InternetDomainName, String> domainCheckResults();
-
-  public static AllocationTokenDomainCheckResults create(
-      Optional<AllocationToken> allocationToken,
-      ImmutableMap<InternetDomainName, String> domainCheckResults) {
-    return new AutoValue_AllocationTokenDomainCheckResults(allocationToken, domainCheckResults);
-  }
-}
+/** Record to represent the result of loading a token and checking domains with it. */
+public record AllocationTokenDomainCheckResults(
+    Optional<AllocationToken> token, ImmutableMap<InternetDomainName, String> domainCheckResults) {}

core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java

@@ -69,9 +69,8 @@ public class AllocationTokenFlowUtils {
     try {
       tokenEntity = loadToken(token);
     } catch (EppException e) {
-      return AllocationTokenDomainCheckResults.create(
-          Optional.empty(),
-          ImmutableMap.copyOf(Maps.toMap(domainNames, ignored -> e.getMessage())));
+      return new AllocationTokenDomainCheckResults(
+          Optional.empty(), Maps.toMap(domainNames, ignored -> e.getMessage()));
     }
 
     // If the token is only invalid for some domain names (e.g. an invalid TLD), include those error
@@ -97,8 +96,7 @@ public class AllocationTokenFlowUtils {
     resultsBuilder.putAll(
         tokenCustomLogic.checkDomainsWithToken(
             validDomainNames.build(), tokenEntity, registrarId, now));
-    return AllocationTokenDomainCheckResults.create(
-        Optional.of(tokenEntity), resultsBuilder.build());
+    return new AllocationTokenDomainCheckResults(Optional.of(tokenEntity), resultsBuilder.build());
   }
 
   /** Redeems a SINGLE_USE {@link AllocationToken}, returning the redeemed copy. */

core/src/main/java/google/registry/flows/picker/FlowPicker.java

@@ -124,22 +124,21 @@ public class FlowPicker {
     }};
 
   /** Poll flows have an {@link InnerCommand} of type {@link Poll}. */
-  private static final FlowProvider POLL_FLOW_PROVIDER = new FlowProvider() {
-    @Override
-    Class<? extends Flow> get(
-        EppInput eppInput, InnerCommand innerCommand, ResourceCommand resourceCommand) {
-      if (!(innerCommand instanceof Poll)) {
-        return null;
-      }
-      switch (((Poll) innerCommand).getPollOp()) {
-        case ACK:
-          return PollAckFlow.class;
-        case REQUEST:
-          return PollRequestFlow.class;
-        default:
-          return UnimplementedFlow.class;
-      }
-    }};
+  private static final FlowProvider POLL_FLOW_PROVIDER =
+      new FlowProvider() {
+        @Override
+        Class<? extends Flow> get(
+            EppInput eppInput, InnerCommand innerCommand, ResourceCommand resourceCommand) {
+          if (!(innerCommand instanceof Poll)) {
+            return null;
+          }
+          return switch (((Poll) innerCommand).getPollOp()) {
+            case ACK -> PollAckFlow.class;
+            case REQUEST -> PollRequestFlow.class;
+            default -> UnimplementedFlow.class;
+          };
+        }
+      };
 
   /**
    * The domain restore command is technically a domain {@literal <update>}, but logically a totally

core/src/main/java/google/registry/flows/poll/PollFlowUtils.java

@@ -54,8 +54,7 @@ public final class PollFlowUtils {
     if (pollMessage instanceof PollMessage.OneTime) {
       // One-time poll messages are deleted once acked.
       tm().delete(pollMessage.createVKey());
-    } else if (pollMessage instanceof PollMessage.Autorenew) {
-      PollMessage.Autorenew autorenewPollMessage = (PollMessage.Autorenew) pollMessage;
+    } else if (pollMessage instanceof PollMessage.Autorenew autorenewPollMessage) {
 
       // Move the eventTime of this autorenew poll message forward by a year.
       DateTime nextEventTime = autorenewPollMessage.getEventTime().plusYears(1);

core/src/main/java/google/registry/keyring/api/PgpHelper.java

@@ -130,23 +130,22 @@ public final class PgpHelper {
     while (keys.hasNext()) {
       PGPPublicKey key = keys.next();
       switch (want) {
-        case ENCRYPT:
+        case ENCRYPT -> {
           if (key.isEncryptionKey()) {
             return Optional.of(key);
           }
-          break;
-        case SIGN:
+        }
+        case SIGN -> {
           if (isSigningKey(key)) {
             return Optional.of(key);
           }
-          break;
-        case ENCRYPT_SIGN:
+        }
+        case ENCRYPT_SIGN -> {
           if (key.isEncryptionKey() && isSigningKey(key)) {
             return Optional.of(key);
           }
-          break;
-        default:
-          throw new AssertionError();
+        }
+        default -> throw new AssertionError();
       }
     }
     return Optional.empty();
@@ -154,14 +153,9 @@ public final class PgpHelper {
 
   /** Returns {@code true} if this key can be used for signing. */
   public static boolean isSigningKey(PGPPublicKey key) {
-    switch (key.getAlgorithm()) {
-      case RSA_GENERAL:
-      case RSA_SIGN:
-      case DSA:
-      case ELGAMAL_GENERAL:
-        return true;
-      default:
-        return false;
-    }
+    return switch (key.getAlgorithm()) {
+      case RSA_GENERAL, RSA_SIGN, DSA, ELGAMAL_GENERAL -> true;
+      default -> false;
+    };
   }
 }

core/src/main/java/google/registry/model/ForeignKeyUtils.java

@@ -23,7 +23,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 
 import com.github.benmanes.caffeine.cache.CacheLoader;
 import com.github.benmanes.caffeine.cache.LoadingCache;
-import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
@@ -221,15 +220,10 @@ public final class ForeignKeyUtils {
                 e -> VKey.create(clazz, e.getValue().get().repoId())));
   }
 
-  @AutoValue
-  abstract static class MostRecentResource {
-
-    abstract String repoId();
-
-    abstract DateTime deletionTime();
+  record MostRecentResource(String repoId, DateTime deletionTime) {
 
     static MostRecentResource create(String repoId, DateTime deletionTime) {
-      return new AutoValue_ForeignKeyUtils_MostRecentResource(repoId, deletionTime);
+      return new MostRecentResource(repoId, deletionTime);
     }
   }
 }

core/src/main/java/google/registry/model/ModelUtils.java

@@ -109,16 +109,18 @@ public class ModelUtils {
       if (value != null && value.getClass().isArray()) {
         // It's surprisingly difficult to convert arrays into lists if the array might be primitive.
         final Object arrayValue = value;
-        value = new AbstractList<Object>() {
-            @Override
-            public Object get(int index) {
-              return Array.get(arrayValue, index);
-            }
+        value =
+            new AbstractList<>() {
+              @Override
+              public Object get(int index) {
+                return Array.get(arrayValue, index);
+              }
 
-            @Override
-            public int size() {
-              return Array.getLength(arrayValue);
-            }};
+              @Override
+              public int size() {
+                return Array.getLength(arrayValue);
+              }
+            };
       }
       values.put(field, value);
     }

core/src/main/java/google/registry/model/console/ConsoleEppActionHistory.java

@@ -0,0 +1,99 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.reporting.HistoryEntry;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.AttributeOverride;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an EPP action via the console.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a reference to the
+ * history entry so that we can refer to it if necessary.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "historyActingUser"),
+      @Index(columnList = "repoId"),
+      @Index(columnList = "revisionId")
+    })
+public class ConsoleEppActionHistory extends ConsoleUpdateHistory {
+
+  @AttributeOverride(name = "repoId", column = @Column(nullable = false))
+  HistoryEntryId historyEntryId;
+
+  @Column(nullable = false)
+  Class<? extends HistoryEntry> historyEntryClass;
+
+  public HistoryEntryId getHistoryEntryId() {
+    return historyEntryId;
+  }
+
+  public Class<? extends HistoryEntry> getHistoryEntryClass() {
+    return historyEntryClass;
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<ConsoleEppActionHistory> createVKey() {
+    return VKey.create(ConsoleEppActionHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<ConsoleEppActionHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(ConsoleEppActionHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public ConsoleEppActionHistory build() {
+      checkArgumentNotNull(getInstance().historyEntryId, "History entry ID must be specified");
+      checkArgumentNotNull(
+          getInstance().historyEntryClass, "History entry class must be specified");
+      return super.build();
+    }
+
+    public Builder setHistoryEntryId(HistoryEntryId historyEntryId) {
+      getInstance().historyEntryId = historyEntryId;
+      return this;
+    }
+
+    public Builder setHistoryEntryClass(Class<? extends HistoryEntry> historyEntryClass) {
+      getInstance().historyEntryClass = historyEntryClass;
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/ConsoleUpdateHistory.java

@@ -0,0 +1,168 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.ImmutableObject;
+import google.registry.model.annotations.IdAllocation;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.MappedSuperclass;
+import org.joda.time.DateTime;
+
+/**
+ * A record of a resource that was updated through the console.
+ *
+ * <p>This abstract class has several subclasses that (mostly) include the modified resource itself
+ * so that the entire object history is persisted to SQL.
+ */
+@Access(AccessType.FIELD)
+@MappedSuperclass
+public abstract class ConsoleUpdateHistory extends ImmutableObject implements Buildable {
+
+  public enum Type {
+    EPP_ACTION,
+    POC_CREATE,
+    POC_UPDATE,
+    POC_DELETE,
+    REGISTRAR_UPDATE,
+    USER_CREATE,
+    USER_DELETE,
+    USER_UPDATE
+  }
+
+  /** Autogenerated ID of this event. */
+  @Id
+  @IdAllocation
+  @Column(nullable = false, name = "historyRevisionId")
+  protected Long revisionId;
+
+  /** The user that performed the modification. */
+  @JoinColumn(name = "historyActingUser", referencedColumnName = "emailAddress", nullable = false)
+  @ManyToOne
+  User actingUser;
+
+  /** The URL of the action that was used to make the modification. */
+  @Column(nullable = false, name = "historyUrl")
+  String url;
+
+  /** The HTTP method (e.g. POST, PUT) used to make this modification. */
+  @Column(nullable = false, name = "historyMethod")
+  String method;
+
+  /** The raw body of the request that was used to make this modification. */
+  @Column(name = "historyRequestBody")
+  String requestBody;
+
+  /** The time at which the modification was mode. */
+  @Column(nullable = false, name = "historyModificationTime")
+  DateTime modificationTime;
+
+  /** The type of modification. */
+  @Column(nullable = false, name = "historyType")
+  @Enumerated(EnumType.STRING)
+  Type type;
+
+  public long getRevisionId() {
+    return revisionId;
+  }
+
+  public User getActingUser() {
+    return actingUser;
+  }
+
+  public String getUrl() {
+    return url;
+  }
+
+  public String getMethod() {
+    return method;
+  }
+
+  public String getRequestBody() {
+    return requestBody;
+  }
+
+  public DateTime getModificationTime() {
+    return modificationTime;
+  }
+
+  public Type getType() {
+    return type;
+  }
+
+  @Override
+  public abstract Builder<? extends ConsoleUpdateHistory, ?> asBuilder();
+
+  /** Builder for the immutable ConsoleUpdateHistory. */
+  public abstract static class Builder<
+          T extends ConsoleUpdateHistory, B extends ConsoleUpdateHistory.Builder<?, ?>>
+      extends GenericBuilder<T, B> {
+
+    protected Builder() {}
+
+    protected Builder(T instance) {
+      super(instance);
+    }
+
+    @Override
+    public T build() {
+      checkArgumentNotNull(getInstance().actingUser, "Acting user must be specified");
+      checkArgumentNotNull(getInstance().url, "URL must be specified");
+      checkArgumentNotNull(getInstance().method, "HTTP method must be specified");
+      checkArgumentNotNull(getInstance().modificationTime, "modificationTime must be specified");
+      checkArgumentNotNull(getInstance().type, "Console History type must be specified");
+      return super.build();
+    }
+
+    public B setActingUser(User actingUser) {
+      getInstance().actingUser = actingUser;
+      return thisCastToDerived();
+    }
+
+    public B setUrl(String url) {
+      getInstance().url = url;
+      return thisCastToDerived();
+    }
+
+    public B setMethod(String method) {
+      getInstance().method = method;
+      return thisCastToDerived();
+    }
+
+    public B setRequestBody(String requestBody) {
+      getInstance().requestBody = requestBody;
+      return thisCastToDerived();
+    }
+
+    public B setModificationTime(DateTime modificationTime) {
+      getInstance().modificationTime = modificationTime;
+      return thisCastToDerived();
+    }
+
+    public B setType(Type type) {
+      getInstance().type = type;
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/model/console/RegistrarPocUpdateHistory.java

@@ -0,0 +1,99 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a RegistrarPoc.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified RegistrarPoc object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "historyActingUser"),
+      @Index(columnList = "emailAddress"),
+      @Index(columnList = "registrarId")
+    })
+public class RegistrarPocUpdateHistory extends ConsoleUpdateHistory {
+
+  RegistrarPocBase registrarPoc;
+
+  // These fields exist so that they can be populated in the SQL table
+  @Column(nullable = false)
+  String emailAddress;
+
+  @Column(nullable = false)
+  String registrarId;
+
+  public RegistrarPocBase getRegistrarPoc() {
+    return registrarPoc;
+  }
+
+  @PostLoad
+  void postLoad() {
+    registrarPoc.setEmailAddress(emailAddress);
+    registrarPoc.setRegistrarId(registrarId);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<RegistrarPocUpdateHistory> createVKey() {
+    return VKey.create(RegistrarPocUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<RegistrarPocUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(RegistrarPocUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistrarPocUpdateHistory build() {
+      checkArgumentNotNull(getInstance().registrarPoc, "Registrar POC must be specified");
+      return super.build();
+    }
+
+    public Builder setRegistrarPoc(RegistrarPoc registrarPoc) {
+      getInstance().registrarPoc = registrarPoc;
+      getInstance().registrarId = registrarPoc.getRegistrarId();
+      getInstance().emailAddress = registrarPoc.getEmailAddress();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/RegistrarUpdateHistory.java

@@ -0,0 +1,89 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.registrar.RegistrarBase;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a Registrar.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified Registrar object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(indexes = {@Index(columnList = "historyActingUser"), @Index(columnList = "registrarId")})
+public class RegistrarUpdateHistory extends ConsoleUpdateHistory {
+
+  RegistrarBase registrar;
+
+  // This field exists so that it exists in the SQL table
+  @Column(nullable = false)
+  @SuppressWarnings("unused")
+  private String registrarId;
+
+  public RegistrarBase getRegistrar() {
+    return registrar;
+  }
+
+  @PostLoad
+  void postLoad() {
+    registrar.setRegistrarId(registrarId);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<RegistrarUpdateHistory> createVKey() {
+    return VKey.create(RegistrarUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new RegistrarUpdateHistory.Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<RegistrarUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(RegistrarUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistrarUpdateHistory build() {
+      checkArgumentNotNull(getInstance().registrar, "Registrar must be specified");
+      return super.build();
+    }
+
+    public Builder setRegistrar(RegistrarBase registrar) {
+      getInstance().registrar = registrar;
+      getInstance().registrarId = registrar.getRegistrarId();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/User.java

@@ -14,19 +14,10 @@
 
 package google.registry.model.console;
 
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Strings.isNullOrEmpty;
-import static com.google.common.io.BaseEncoding.base64;
-import static google.registry.model.registrar.Registrar.checkValidEmail;
-import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
-import static google.registry.util.PasswordUtils.hashPassword;
-import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
-
-import google.registry.model.Buildable;
-import google.registry.model.UpdateAutoTimestampEntity;
 import google.registry.persistence.VKey;
-import google.registry.util.PasswordUtils;
-import javax.persistence.Column;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Embeddable;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
@@ -35,74 +26,17 @@ import javax.persistence.Index;
 import javax.persistence.Table;
 
 /** A console user, either a registry employee or a registrar partner. */
+@Embeddable
 @Entity
 @Table(indexes = {@Index(columnList = "emailAddress", name = "user_email_address_idx")})
-public class User extends UpdateAutoTimestampEntity implements Buildable {
+public class User extends UserBase {
 
-  private static final long serialVersionUID = 6936728603828566721L;
-
-  /** Autogenerated unique ID of this user. */
+  @Override
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
-  private Long id;
-
-  /** Email address of the user in question. */
-  @Column(nullable = false)
-  private String emailAddress;
-
-  /** Roles (which grant permissions) associated with this user. */
-  @Column(nullable = false)
-  private UserRoles userRoles;
-
-  /**
-   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
-   * encoded SHA256 string.
-   */
-  String registryLockPasswordHash;
-
-  /** Randomly generated hash salt. */
-  String registryLockPasswordSalt;
-
+  @Access(AccessType.PROPERTY)
   public Long getId() {
-    return id;
-  }
-
-  public String getEmailAddress() {
-    return emailAddress;
-  }
-
-  public UserRoles getUserRoles() {
-    return userRoles;
-  }
-
-  public boolean hasRegistryLockPassword() {
-    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
-  }
-
-  public boolean verifyRegistryLockPassword(String registryLockPassword) {
-    if (isNullOrEmpty(registryLockPassword)
-        || isNullOrEmpty(registryLockPasswordSalt)
-        || isNullOrEmpty(registryLockPasswordHash)) {
-      return false;
-    }
-    return PasswordUtils.verifyPassword(
-        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
-  }
-
-  /**
-   * Whether the user has the registry lock permission on any registrar or globally.
-   *
-   * <p>If so, they should be allowed to (re)set their registry lock password.
-   */
-  public boolean hasAnyRegistryLockPermission() {
-    if (userRoles == null) {
-      return false;
-    }
-    if (userRoles.isAdmin() || userRoles.hasGlobalPermission(ConsolePermission.REGISTRY_LOCK)) {
-      return true;
-    }
-    return userRoles.getRegistrarRoles().values().stream()
-        .anyMatch(role -> role.hasPermission(ConsolePermission.REGISTRY_LOCK));
+    return super.getId();
   }
 
   @Override
@@ -116,49 +50,12 @@ public class User extends UpdateAutoTimestampEntity implements Buildable {
   }
 
   /** Builder for constructing immutable {@link User} objects. */
-  public static class Builder extends Buildable.Builder<User> {
+  public static class Builder extends UserBase.Builder<User, Builder> {
 
     public Builder() {}
 
     public Builder(User user) {
       super(user);
     }
-
-    @Override
-    public User build() {
-      checkArgumentNotNull(getInstance().emailAddress, "Email address cannot be null");
-      checkArgumentNotNull(getInstance().userRoles, "User roles cannot be null");
-      return super.build();
-    }
-
-    public Builder setEmailAddress(String emailAddress) {
-      getInstance().emailAddress = checkValidEmail(emailAddress);
-      return this;
-    }
-
-    public Builder setUserRoles(UserRoles userRoles) {
-      checkArgumentNotNull(userRoles, "User roles cannot be null");
-      getInstance().userRoles = userRoles;
-      return this;
-    }
-
-    public Builder removeRegistryLockPassword() {
-      getInstance().registryLockPasswordHash = null;
-      getInstance().registryLockPasswordSalt = null;
-      return this;
-    }
-
-    public Builder setRegistryLockPassword(String registryLockPassword) {
-      checkArgument(
-          getInstance().hasAnyRegistryLockPermission(), "User has no registry lock permission");
-      checkArgument(
-          !getInstance().hasRegistryLockPassword(), "User already has a password, remove it first");
-      checkArgument(
-          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
-      byte[] salt = SALT_SUPPLIER.get();
-      getInstance().registryLockPasswordSalt = base64().encode(salt);
-      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
-      return this;
-    }
   }
 }

core/src/main/java/google/registry/model/console/UserBase.java

@@ -0,0 +1,193 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.io.BaseEncoding.base64;
+import static google.registry.model.registrar.Registrar.checkValidEmail;
+import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
+import static google.registry.util.PasswordUtils.hashPassword;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.UpdateAutoTimestampEntity;
+import google.registry.util.PasswordUtils;
+import java.util.Optional;
+import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Embeddable;
+import javax.persistence.Id;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+
+/**
+ * A console user, either a registry employee or a registrar partner.
+ *
+ * <p>This class deliberately does not include an {@link Id} so that any foreign-keyed fields can
+ * refer to the proper parent entity's ID, whether we're storing this in the DB itself or as part of
+ * another entity.
+ */
+@Access(AccessType.FIELD)
+@Embeddable
+@MappedSuperclass
+public class UserBase extends UpdateAutoTimestampEntity implements Buildable {
+
+  private static final long serialVersionUID = 6936728603828566721L;
+
+  /** Autogenerated unique ID of this user. */
+  @Transient private Long id;
+
+  /** Email address of the user in question. */
+  @Column(nullable = false)
+  String emailAddress;
+
+  /** Optional external email address to use for registry lock confirmation emails. */
+  @Column String registryLockEmailAddress;
+
+  /** Roles (which grant permissions) associated with this user. */
+  @Column(nullable = false)
+  UserRoles userRoles;
+
+  /**
+   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
+   * encoded SHA256 string.
+   */
+  String registryLockPasswordHash;
+
+  /** Randomly generated hash salt. */
+  String registryLockPasswordSalt;
+
+  public Long getId() {
+    return id;
+  }
+
+  /**
+   * Sets the user ID.
+   *
+   * <p>This should only be used for restoring the user id of an object being loaded in a PostLoad
+   * method (effectively, when it is still under construction by Hibernate). In all other cases, the
+   * object should be regarded as immutable and changes should go through a Builder.
+   *
+   * <p>In addition to this special case use, this method must exist to satisfy Hibernate.
+   */
+  @SuppressWarnings("unused")
+  void setId(Long id) {
+    this.id = id;
+  }
+
+  public String getEmailAddress() {
+    return emailAddress;
+  }
+
+  public Optional<String> getRegistryLockEmailAddress() {
+    return Optional.ofNullable(registryLockEmailAddress);
+  }
+
+  public UserRoles getUserRoles() {
+    return userRoles;
+  }
+
+  public boolean hasRegistryLockPassword() {
+    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
+  }
+
+  public boolean verifyRegistryLockPassword(String registryLockPassword) {
+    if (isNullOrEmpty(registryLockPassword)
+        || isNullOrEmpty(registryLockPasswordSalt)
+        || isNullOrEmpty(registryLockPasswordHash)) {
+      return false;
+    }
+    return PasswordUtils.verifyPassword(
+        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
+  }
+
+  /**
+   * Whether the user has the registry lock permission on any registrar or globally.
+   *
+   * <p>If so, they should be allowed to (re)set their registry lock password.
+   */
+  public boolean hasAnyRegistryLockPermission() {
+    if (userRoles == null) {
+      return false;
+    }
+    if (userRoles.isAdmin() || userRoles.hasGlobalPermission(ConsolePermission.REGISTRY_LOCK)) {
+      return true;
+    }
+    return userRoles.getRegistrarRoles().values().stream()
+        .anyMatch(role -> role.hasPermission(ConsolePermission.REGISTRY_LOCK));
+  }
+
+  @Override
+  public Builder<? extends UserBase, ?> asBuilder() {
+    return new Builder<>(clone(this));
+  }
+
+  /** Builder for constructing immutable {@link UserBase} objects. */
+  public static class Builder<T extends UserBase, B extends Builder<T, B>>
+      extends GenericBuilder<T, B> {
+
+    public Builder() {}
+
+    public Builder(T abstractUser) {
+      super(abstractUser);
+    }
+
+    @Override
+    public T build() {
+      checkArgumentNotNull(getInstance().emailAddress, "Email address cannot be null");
+      checkArgumentNotNull(getInstance().userRoles, "User roles cannot be null");
+      return super.build();
+    }
+
+    public B setEmailAddress(String emailAddress) {
+      getInstance().emailAddress = checkValidEmail(emailAddress);
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockEmailAddress(@Nullable String registryLockEmailAddress) {
+      getInstance().registryLockEmailAddress =
+          registryLockEmailAddress == null ? null : checkValidEmail(registryLockEmailAddress);
+      return thisCastToDerived();
+    }
+
+    public B setUserRoles(UserRoles userRoles) {
+      checkArgumentNotNull(userRoles, "User roles cannot be null");
+      getInstance().userRoles = userRoles;
+      return thisCastToDerived();
+    }
+
+    public B removeRegistryLockPassword() {
+      getInstance().registryLockPasswordHash = null;
+      getInstance().registryLockPasswordSalt = null;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockPassword(String registryLockPassword) {
+      checkArgument(
+          getInstance().hasAnyRegistryLockPermission(), "User has no registry lock permission");
+      checkArgument(
+          !getInstance().hasRegistryLockPassword(), "User already has a password, remove it first");
+      checkArgument(
+          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
+      byte[] salt = SALT_SUPPLIER.get();
+      getInstance().registryLockPasswordSalt = base64().encode(salt);
+      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/model/console/UserRoles.java

@@ -21,6 +21,8 @@ import com.google.common.collect.ImmutableMap;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import java.util.Map;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.Embeddable;
 import javax.persistence.EnumType;
@@ -32,6 +34,7 @@ import javax.persistence.Enumerated;
  * <p>See <a href="https://go/nomulus-console-authz">go/nomulus-console-authz</a> for more
  * information.
  */
+@Access(AccessType.FIELD)
 @Embeddable
 public class UserRoles extends ImmutableObject implements Buildable {
 

core/src/main/java/google/registry/model/console/UserUpdateHistory.java

@@ -0,0 +1,86 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a User.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified User object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(indexes = {@Index(columnList = "historyActingUser"), @Index(columnList = "emailAddress")})
+public class UserUpdateHistory extends ConsoleUpdateHistory {
+
+  UserBase user;
+
+  // This field exists so that it's populated in the SQL table
+  @Column(nullable = false, name = "userId")
+  Long id;
+
+  public UserBase getUser() {
+    return user;
+  }
+
+  @PostLoad
+  void postLoad() {
+    user.setId(id);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<UserUpdateHistory> createVKey() {
+    return VKey.create(UserUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder extends ConsoleUpdateHistory.Builder<UserUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(UserUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public UserUpdateHistory build() {
+      checkArgumentNotNull(getInstance().user, "User must be specified");
+      return super.build();
+    }
+
+    public Builder setUser(User user) {
+      getInstance().user = user;
+      getInstance().id = user.getId();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/domain/Domain.java

@@ -61,7 +61,8 @@ import org.joda.time.DateTime;
       @Index(columnList = "lordnPhase"),
       @Index(columnList = "billing_recurrence_id"),
       @Index(columnList = "transfer_billing_event_id"),
-      @Index(columnList = "transfer_billing_recurrence_id")
+      @Index(columnList = "transfer_billing_recurrence_id"),
+      @Index(columnList = "transfer_billing_cancellation_id")
     })
 @WithVKey(String.class)
 @ExternalMessagingName("domain")

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -659,22 +659,17 @@ public class DomainBase extends EppResource
           contact.getType());
       contactsDiscovered.add(contact.getType());
       switch (contact.getType()) {
-        case BILLING:
-          billingContact = contact.getContactKey();
-          break;
-        case TECH:
-          techContact = contact.getContactKey();
-          break;
-        case ADMIN:
-          adminContact = contact.getContactKey();
-          break;
-        case REGISTRANT:
+        case BILLING -> billingContact = contact.getContactKey();
+        case TECH -> techContact = contact.getContactKey();
+        case ADMIN -> adminContact = contact.getContactKey();
+        case REGISTRANT -> {
           if (includeRegistrant) {
             registrantContact = contact.getContactKey();
           }
-          break;
-        default:
-          throw new IllegalArgumentException("Unknown contact resource type: " + contact.getType());
+        }
+        default ->
+            throw new IllegalArgumentException(
+                "Unknown contact resource type: " + contact.getType());
       }
     }
   }

core/src/main/java/google/registry/model/domain/RegistryLock.java

@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
+import com.google.gson.annotations.Expose;
 import google.registry.model.Buildable;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.UpdateAutoTimestampEntity;
@@ -90,6 +91,7 @@ public final class RegistryLock extends UpdateAutoTimestampEntity implements Bui
 
   // TODO (b/140568328): remove this when everything is in Cloud SQL and we can join on "domain"
   @Column(nullable = false)
+  @Expose
   private String domainName;
 
   /**
@@ -100,7 +102,7 @@ public final class RegistryLock extends UpdateAutoTimestampEntity implements Bui
   private String registrarId;
 
   /** The POC that performed the action, or null if it was a superuser. */
-  private String registrarPocId;
+  @Expose private String registrarPocId;
 
   /** When the lock is first requested. */
   @AttributeOverrides({
@@ -108,22 +110,23 @@ public final class RegistryLock extends UpdateAutoTimestampEntity implements Bui
         name = "creationTime",
         column = @Column(name = "lockRequestTime", nullable = false))
   })
+  @Expose
   private final CreateAutoTimestamp lockRequestTime = CreateAutoTimestamp.create(null);
 
   /** When the unlock is first requested. */
-  private DateTime unlockRequestTime;
+  @Expose private DateTime unlockRequestTime;
 
   /**
    * When the user has verified the lock. If this field is null, it means the lock has not been
    * verified yet (and thus not been put into effect).
    */
-  private DateTime lockCompletionTime;
+  @Expose private DateTime lockCompletionTime;
 
   /**
    * When the user has verified the unlock of this lock. If this field is null, it means the unlock
    * action has not been verified yet (and has not been put into effect).
    */
-  private DateTime unlockCompletionTime;
+  @Expose private DateTime unlockCompletionTime;
 
   /** The user must provide the random verification code in order to complete the action. */
   @Column(nullable = false)
@@ -134,6 +137,7 @@ public final class RegistryLock extends UpdateAutoTimestampEntity implements Bui
    * this case, the action was performed by a registry admin rather than a registrar.
    */
   @Column(nullable = false)
+  @Expose
   private boolean isSuperuser;
 
   /** The lock that undoes this lock, if this lock has been unlocked and the domain locked again. */

core/src/main/java/google/registry/model/domain/rgp/GracePeriodStatus.java

@@ -103,7 +103,7 @@ public enum GracePeriodStatus implements EppEnum {
   /**
    * Maps from xmlName to {@link GracePeriodStatus}.
    *
-   * If no match is found for xmlName, null is returned.
+   * <p>If no match is found for xmlName, null is returned.
    */
   @Nullable
   public static GracePeriodStatus fromXmlName(String xmlName) {

core/src/main/java/google/registry/model/eppoutput/Result.java

@@ -34,7 +34,7 @@ public class Result extends ImmutableObject {
    * [RFC5321]. EPP uses four decimal digits to describe the success or failure of each EPP command.
    * Each of the digits of the reply have special significance."
    *
-   * "The first digit denotes command success or failure. The second digit denotes the response
+   * <p>"The first digit denotes command success or failure. The second digit denotes the response
    * category, such as command syntax or security. The third and fourth digits provide explicit
    * response detail within each response category."
    */

core/src/main/java/google/registry/model/host/Host.java

@@ -49,6 +49,7 @@ import javax.persistence.Table;
       @Index(columnList = "creationTime"),
       @Index(columnList = "deletionTime"),
       @Index(columnList = "currentSponsorRegistrarId"),
+      @Index(columnList = "superordinateDomain")
     })
 @ExternalMessagingName("host")
 @WithVKey(String.class)

core/src/main/java/google/registry/model/poll/PollMessage.java

@@ -529,8 +529,7 @@ public abstract class PollMessage extends ImmutableObject
         // Set the identifier according to the TransferResponse type.
         if (instance.transferResponse instanceof ContactTransferResponse) {
           instance.contactId = ((ContactTransferResponse) instance.transferResponse).getContactId();
-        } else if (instance.transferResponse instanceof DomainTransferResponse) {
-          DomainTransferResponse response = (DomainTransferResponse) instance.transferResponse;
+        } else if (instance.transferResponse instanceof DomainTransferResponse response) {
           instance.domainName = response.getDomainName();
           instance.extendedRegistrationExpirationTime =
               response.getExtendedRegistrationExpirationTime();

core/src/main/java/google/registry/model/registrar/RegistrarPoc.java

@@ -14,35 +14,14 @@
 
 package google.registry.model.registrar;
 
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Preconditions.checkNotNull;
-import static com.google.common.base.Strings.isNullOrEmpty;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.io.BaseEncoding.base64;
-import static google.registry.model.registrar.Registrar.checkValidEmail;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
-import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
-import static google.registry.util.PasswordUtils.hashPassword;
-import static java.util.stream.Collectors.joining;
 
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.ImmutableSortedSet;
-import com.google.gson.annotations.Expose;
-import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
-import google.registry.model.JsonMapBuilder;
-import google.registry.model.Jsonifiable;
-import google.registry.model.UnsafeSerializable;
 import google.registry.model.registrar.RegistrarPoc.RegistrarPocId;
 import google.registry.persistence.VKey;
-import google.registry.util.PasswordUtils;
 import java.io.Serializable;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Entity;
 import javax.persistence.Id;
 import javax.persistence.IdClass;
@@ -60,258 +39,20 @@ import javax.persistence.Table;
 @Entity
 @Table(indexes = @Index(columnList = "loginEmailAddress", name = "registrarpoc_login_email_idx"))
 @IdClass(RegistrarPocId.class)
-public class RegistrarPoc extends ImmutableObject implements Jsonifiable, UnsafeSerializable {
-
-  /**
-   * Registrar contacts types for partner communication tracking.
-   *
-   * <p><b>Note:</b> These types only matter to the registry. They are not meant to be used for
-   * WHOIS or RDAP results.
-   */
-  public enum Type {
-    ABUSE("abuse", true),
-    ADMIN("primary", true),
-    BILLING("billing", true),
-    LEGAL("legal", true),
-    MARKETING("marketing", false),
-    TECH("technical", true),
-    WHOIS("whois-inquiry", true);
-
-    private final String displayName;
-
-    private final boolean required;
-
-    public String getDisplayName() {
-      return displayName;
-    }
-
-    public boolean isRequired() {
-      return required;
-    }
-
-    Type(String display, boolean required) {
-      displayName = display;
-      this.required = required;
-    }
-  }
-
-  /** The name of the contact. */
-  @Expose String name;
-
-  /**
-   * The contact email address of the contact.
-   *
-   * <p>This is different from the login email which is assgined to the regstrar and cannot be
-   * changed.
-   */
-  @Expose @Id String emailAddress;
-
-  @Expose @Id public String registrarId;
-
-  /** External email address of this contact used for registry lock confirmations. */
-  String registryLockEmailAddress;
-
-  /** The voice number of the contact. */
-  @Expose String phoneNumber;
-
-  /** The fax number of the contact. */
-  @Expose String faxNumber;
-
-  /**
-   * Multiple types are used to associate the registrar contact with various mailing groups. This
-   * data is internal to the registry.
-   */
-  @Expose Set<Type> types;
-
-  /** A GAIA email address that was assigned to the registrar for console login purpose. */
-  String loginEmailAddress;
-
-  /**
-   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
-   */
-  @Expose boolean visibleInWhoisAsAdmin = false;
-
-  /**
-   * Whether this contact is publicly visible in WHOIS registrar query results as a Technical
-   * contact.
-   */
-  @Expose boolean visibleInWhoisAsTech = false;
-
-  /**
-   * Whether this contact's phone number and email address is publicly visible in WHOIS domain query
-   * results as registrar abuse contact info.
-   */
-  @Expose boolean visibleInDomainWhoisAsAbuse = false;
-
-  /**
-   * Whether the contact is allowed to set their registry lock password through the registrar
-   * console. This will be set to false on contact creation and when the user sets a password.
-   */
-  boolean allowedToSetRegistryLockPassword = false;
-
-  /**
-   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
-   * encoded SHA256 string.
-   */
-  String registryLockPasswordHash;
-
-  /** Randomly generated hash salt. */
-  String registryLockPasswordSalt;
-
-  /**
-   * Helper to update the contacts associated with a Registrar. This requires querying for the
-   * existing contacts, deleting existing contacts that are not part of the given {@code contacts}
-   * set, and then saving the given {@code contacts}.
-   *
-   * <p>IMPORTANT NOTE: If you call this method then it is your responsibility to also persist the
-   * relevant Registrar entity with the {@link Registrar#contactsRequireSyncing} field set to true.
-   */
-  public static void updateContacts(
-      final Registrar registrar, final ImmutableSet<RegistrarPoc> contacts) {
-    tm().transact(
-            () -> {
-              ImmutableSet<String> emailAddressesToKeep =
-                  contacts.stream().map(RegistrarPoc::getEmailAddress).collect(toImmutableSet());
-              tm().query(
-                      "DELETE FROM RegistrarPoc WHERE registrarId = :registrarId AND "
-                          + "emailAddress NOT IN :emailAddressesToKeep")
-                  .setParameter("registrarId", registrar.getRegistrarId())
-                  .setParameter("emailAddressesToKeep", emailAddressesToKeep)
-                  .executeUpdate();
-
-              tm().putAll(contacts);
-            });
-  }
-
-  public String getName() {
-    return name;
-  }
+@Access(AccessType.FIELD)
+public class RegistrarPoc extends RegistrarPocBase {
 
+  @Id
+  @Access(AccessType.PROPERTY)
+  @Override
   public String getEmailAddress() {
     return emailAddress;
   }
 
-  public Optional<String> getRegistryLockEmailAddress() {
-    return Optional.ofNullable(registryLockEmailAddress);
-  }
-
-  public String getPhoneNumber() {
-    return phoneNumber;
-  }
-
-  public String getFaxNumber() {
-    return faxNumber;
-  }
-
-  public ImmutableSortedSet<Type> getTypes() {
-    return nullToEmptyImmutableSortedCopy(types);
-  }
-
-  public boolean getVisibleInWhoisAsAdmin() {
-    return visibleInWhoisAsAdmin;
-  }
-
-  public boolean getVisibleInWhoisAsTech() {
-    return visibleInWhoisAsTech;
-  }
-
-  public boolean getVisibleInDomainWhoisAsAbuse() {
-    return visibleInDomainWhoisAsAbuse;
-  }
-
-  public String getLoginEmailAddress() {
-    return loginEmailAddress;
-  }
-
-  public Builder asBuilder() {
-    return new Builder(clone(this));
-  }
-
-  public boolean isAllowedToSetRegistryLockPassword() {
-    return allowedToSetRegistryLockPassword;
-  }
-
-  public boolean isRegistryLockAllowed() {
-    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
-  }
-
-  public boolean verifyRegistryLockPassword(String registryLockPassword) {
-    if (isNullOrEmpty(registryLockPassword)
-        || isNullOrEmpty(registryLockPasswordSalt)
-        || isNullOrEmpty(registryLockPasswordHash)) {
-      return false;
-    }
-    return PasswordUtils.verifyPassword(
-        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
-  }
-
-  /**
-   * Returns a string representation that's human friendly.
-   *
-   * <p>The output will look something like this:
-   *
-   * <pre>{@code
-   * Some Person
-   * person@example.com
-   * Tel: +1.2125650666
-   * Types: [ADMIN, WHOIS]
-   * Visible in WHOIS as Admin contact: Yes
-   * Visible in WHOIS as Technical contact: No
-   * Registrar-Console access: Yes
-   * Login Email Address: person@registry.example
-   * }</pre>
-   */
-  public String toStringMultilinePlainText() {
-    StringBuilder result = new StringBuilder(256);
-    result.append(getName()).append('\n');
-    result.append(getEmailAddress()).append('\n');
-    if (phoneNumber != null) {
-      result.append("Tel: ").append(getPhoneNumber()).append('\n');
-    }
-    if (faxNumber != null) {
-      result.append("Fax: ").append(getFaxNumber()).append('\n');
-    }
-    result.append("Types: ").append(getTypes()).append('\n');
-    result
-        .append("Visible in registrar WHOIS query as Admin contact: ")
-        .append(getVisibleInWhoisAsAdmin() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append("Visible in registrar WHOIS query as Technical contact: ")
-        .append(getVisibleInWhoisAsTech() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append(
-            "Phone number and email visible in domain WHOIS query as "
-                + "Registrar Abuse contact info: ")
-        .append(getVisibleInDomainWhoisAsAbuse() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append("Registrar-Console access: ")
-        .append(getLoginEmailAddress() != null ? "Yes" : "No")
-        .append('\n');
-    if (getLoginEmailAddress() != null) {
-      result.append("Login Email Address: ").append(getLoginEmailAddress()).append('\n');
-    }
-    return result.toString();
-  }
-
-  @Override
-  public Map<String, Object> toJsonMap() {
-    return new JsonMapBuilder()
-        .put("name", name)
-        .put("emailAddress", emailAddress)
-        .put("registryLockEmailAddress", registryLockEmailAddress)
-        .put("phoneNumber", phoneNumber)
-        .put("faxNumber", faxNumber)
-        .put("types", getTypes().stream().map(Object::toString).collect(joining(",")))
-        .put("visibleInWhoisAsAdmin", visibleInWhoisAsAdmin)
-        .put("visibleInWhoisAsTech", visibleInWhoisAsTech)
-        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
-        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
-        .put("registryLockAllowed", isRegistryLockAllowed())
-        .put("loginEmailAddress", loginEmailAddress)
-        .build();
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getRegistrarId() {
+    return registrarId;
   }
 
   @Override
@@ -319,6 +60,11 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
     return VKey.create(RegistrarPoc.class, new RegistrarPocId(emailAddress, registrarId));
   }
 
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
   /** Class to represent the composite primary key for {@link RegistrarPoc} entity. */
   @VisibleForTesting
   public static class RegistrarPocId extends ImmutableObject implements Serializable {
@@ -336,112 +82,24 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
       this.emailAddress = emailAddress;
       this.registrarId = registrarId;
     }
+
+    @Id
+    public String getEmailAddress() {
+      return emailAddress;
+    }
+
+    @Id
+    public String getRegistrarId() {
+      return registrarId;
+    }
   }
 
-  /** A builder for constructing a {@link RegistrarPoc}, since it is immutable. */
-  public static class Builder extends Buildable.Builder<RegistrarPoc> {
+  public static class Builder extends RegistrarPocBase.Builder<RegistrarPoc, Builder> {
+
     public Builder() {}
 
-    private Builder(RegistrarPoc instance) {
-      super(instance);
-    }
-
-    /** Build the registrar, nullifying empty fields. */
-    @Override
-    public RegistrarPoc build() {
-      checkNotNull(getInstance().registrarId, "Registrar ID cannot be null");
-      checkValidEmail(getInstance().emailAddress);
-      // Check allowedToSetRegistryLockPassword here because if we want to allow the user to set
-      // a registry lock password, we must also set up the correct registry lock email concurrently
-      // or beforehand.
-      if (getInstance().allowedToSetRegistryLockPassword) {
-        checkArgument(
-            !isNullOrEmpty(getInstance().registryLockEmailAddress),
-            "Registry lock email must not be null if allowing registry lock access");
-      }
-      return cloneEmptyToNull(super.build());
-    }
-
-    public Builder setName(String name) {
-      getInstance().name = name;
-      return this;
-    }
-
-    public Builder setEmailAddress(String emailAddress) {
-      getInstance().emailAddress = emailAddress;
-      return this;
-    }
-
-    public Builder setRegistryLockEmailAddress(@Nullable String registryLockEmailAddress) {
-      getInstance().registryLockEmailAddress = registryLockEmailAddress;
-      return this;
-    }
-
-    public Builder setPhoneNumber(String phoneNumber) {
-      getInstance().phoneNumber = phoneNumber;
-      return this;
-    }
-
-    public Builder setRegistrarId(String registrarId) {
-      getInstance().registrarId = registrarId;
-      return this;
-    }
-
-    public Builder setRegistrar(Registrar registrar) {
-      getInstance().registrarId = registrar.getRegistrarId();
-      return this;
-    }
-
-    public Builder setFaxNumber(String faxNumber) {
-      getInstance().faxNumber = faxNumber;
-      return this;
-    }
-
-    public Builder setTypes(Iterable<Type> types) {
-      getInstance().types = ImmutableSet.copyOf(types);
-      return this;
-    }
-
-    public Builder setVisibleInWhoisAsAdmin(boolean visible) {
-      getInstance().visibleInWhoisAsAdmin = visible;
-      return this;
-    }
-
-    public Builder setVisibleInWhoisAsTech(boolean visible) {
-      getInstance().visibleInWhoisAsTech = visible;
-      return this;
-    }
-
-    public Builder setVisibleInDomainWhoisAsAbuse(boolean visible) {
-      getInstance().visibleInDomainWhoisAsAbuse = visible;
-      return this;
-    }
-
-    public Builder setLoginEmailAddress(String loginEmailAddress) {
-      getInstance().loginEmailAddress = loginEmailAddress;
-      return this;
-    }
-
-    public Builder setAllowedToSetRegistryLockPassword(boolean allowedToSetRegistryLockPassword) {
-      if (allowedToSetRegistryLockPassword) {
-        getInstance().registryLockPasswordSalt = null;
-        getInstance().registryLockPasswordHash = null;
-      }
-      getInstance().allowedToSetRegistryLockPassword = allowedToSetRegistryLockPassword;
-      return this;
-    }
-
-    public Builder setRegistryLockPassword(String registryLockPassword) {
-      checkArgument(
-          getInstance().allowedToSetRegistryLockPassword,
-          "Not allowed to set registry lock password for this contact");
-      checkArgument(
-          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
-      byte[] salt = SALT_SUPPLIER.get();
-      getInstance().registryLockPasswordSalt = base64().encode(salt);
-      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
-      getInstance().allowedToSetRegistryLockPassword = false;
-      return this;
+    public Builder(RegistrarPoc registrarPoc) {
+      super(registrarPoc);
     }
   }
 }

core/src/main/java/google/registry/model/registrar/RegistrarPocBase.java

@@ -0,0 +1,441 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registrar;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.io.BaseEncoding.base64;
+import static google.registry.model.registrar.RegistrarBase.checkValidEmail;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
+import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
+import static google.registry.util.PasswordUtils.hashPassword;
+import static java.util.stream.Collectors.joining;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.gson.annotations.Expose;
+import google.registry.model.Buildable.GenericBuilder;
+import google.registry.model.ImmutableObject;
+import google.registry.model.JsonMapBuilder;
+import google.registry.model.Jsonifiable;
+import google.registry.model.UnsafeSerializable;
+import google.registry.util.PasswordUtils;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Embeddable;
+import javax.persistence.Id;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+
+/**
+ * A contact for a Registrar. Note, equality, hashCode and comparable have been overridden to only
+ * enable key equality.
+ *
+ * <p>IMPORTANT NOTE: Any time that you change, update, or delete RegistrarContact entities, you
+ * *MUST* also modify the persisted Registrar entity with {@link Registrar#contactsRequireSyncing}
+ * set to true.
+ *
+ * <p>This class deliberately does not include an {@link Id} so that any foreign-keyed fields can
+ * refer to the proper parent entity's ID, whether we're storing this in the DB itself or as part of
+ * another entity.
+ */
+@Access(AccessType.FIELD)
+@Embeddable
+@MappedSuperclass
+public class RegistrarPocBase extends ImmutableObject implements Jsonifiable, UnsafeSerializable {
+  /**
+   * Registrar contacts types for partner communication tracking.
+   *
+   * <p><b>Note:</b> These types only matter to the registry. They are not meant to be used for
+   * WHOIS or RDAP results.
+   */
+  public enum Type {
+    ABUSE("abuse", true),
+    ADMIN("primary", true),
+    BILLING("billing", true),
+    LEGAL("legal", true),
+    MARKETING("marketing", false),
+    TECH("technical", true),
+    WHOIS("whois-inquiry", true);
+
+    private final String displayName;
+
+    private final boolean required;
+
+    public String getDisplayName() {
+      return displayName;
+    }
+
+    public boolean isRequired() {
+      return required;
+    }
+
+    Type(String display, boolean required) {
+      displayName = display;
+      this.required = required;
+    }
+  }
+
+  /** The name of the contact. */
+  @Expose String name;
+
+  /**
+   * The contact email address of the contact.
+   *
+   * <p>This is different from the login email which is assgined to the regstrar and cannot be
+   * changed.
+   */
+  @Expose @Transient String emailAddress;
+
+  @Expose @Transient public String registrarId;
+
+  /** External email address of this contact used for registry lock confirmations. */
+  String registryLockEmailAddress;
+
+  /** The voice number of the contact. */
+  @Expose String phoneNumber;
+
+  /** The fax number of the contact. */
+  @Expose String faxNumber;
+
+  /**
+   * Multiple types are used to associate the registrar contact with various mailing groups. This
+   * data is internal to the registry.
+   */
+  @Expose Set<Type> types;
+
+  /** A GAIA email address that was assigned to the registrar for console login purpose. */
+  String loginEmailAddress;
+
+  /**
+   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
+   */
+  @Expose boolean visibleInWhoisAsAdmin = false;
+
+  /**
+   * Whether this contact is publicly visible in WHOIS registrar query results as a Technical
+   * contact.
+   */
+  @Expose boolean visibleInWhoisAsTech = false;
+
+  /**
+   * Whether this contact's phone number and email address is publicly visible in WHOIS domain query
+   * results as registrar abuse contact info.
+   */
+  @Expose boolean visibleInDomainWhoisAsAbuse = false;
+
+  /**
+   * Whether the contact is allowed to set their registry lock password through the registrar
+   * console. This will be set to false on contact creation and when the user sets a password.
+   */
+  boolean allowedToSetRegistryLockPassword = false;
+
+  /**
+   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
+   * encoded SHA256 string.
+   */
+  String registryLockPasswordHash;
+
+  /** Randomly generated hash salt. */
+  String registryLockPasswordSalt;
+
+  /**
+   * Helper to update the contacts associated with a Registrar. This requires querying for the
+   * existing contacts, deleting existing contacts that are not part of the given {@code contacts}
+   * set, and then saving the given {@code contacts}.
+   *
+   * <p>IMPORTANT NOTE: If you call this method then it is your responsibility to also persist the
+   * relevant Registrar entity with the {@link Registrar#contactsRequireSyncing} field set to true.
+   */
+  public static void updateContacts(
+      final Registrar registrar, final ImmutableSet<RegistrarPoc> contacts) {
+    tm().transact(
+            () -> {
+              ImmutableSet<String> emailAddressesToKeep =
+                  contacts.stream().map(RegistrarPoc::getEmailAddress).collect(toImmutableSet());
+              tm().query(
+                      "DELETE FROM RegistrarPoc WHERE registrarId = :registrarId AND "
+                          + "emailAddress NOT IN :emailAddressesToKeep")
+                  .setParameter("registrarId", registrar.getRegistrarId())
+                  .setParameter("emailAddressesToKeep", emailAddressesToKeep)
+                  .executeUpdate();
+
+              tm().putAll(contacts);
+            });
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public String getEmailAddress() {
+    return emailAddress;
+  }
+
+  public Optional<String> getRegistryLockEmailAddress() {
+    return Optional.ofNullable(registryLockEmailAddress);
+  }
+
+  public String getPhoneNumber() {
+    return phoneNumber;
+  }
+
+  public String getFaxNumber() {
+    return faxNumber;
+  }
+
+  public ImmutableSortedSet<Type> getTypes() {
+    return nullToEmptyImmutableSortedCopy(types);
+  }
+
+  public boolean getVisibleInWhoisAsAdmin() {
+    return visibleInWhoisAsAdmin;
+  }
+
+  public boolean getVisibleInWhoisAsTech() {
+    return visibleInWhoisAsTech;
+  }
+
+  public boolean getVisibleInDomainWhoisAsAbuse() {
+    return visibleInDomainWhoisAsAbuse;
+  }
+
+  public String getLoginEmailAddress() {
+    return loginEmailAddress;
+  }
+
+  public Builder<? extends RegistrarPocBase, ?> asBuilder() {
+    return new Builder<>(clone(this));
+  }
+
+  public boolean isAllowedToSetRegistryLockPassword() {
+    return allowedToSetRegistryLockPassword;
+  }
+
+  public boolean isRegistryLockAllowed() {
+    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
+  }
+
+  public boolean verifyRegistryLockPassword(String registryLockPassword) {
+    if (isNullOrEmpty(registryLockPassword)
+        || isNullOrEmpty(registryLockPasswordSalt)
+        || isNullOrEmpty(registryLockPasswordHash)) {
+      return false;
+    }
+    return PasswordUtils.verifyPassword(
+        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
+  }
+
+  /**
+   * Returns a string representation that's human friendly.
+   *
+   * <p>The output will look something like this:
+   *
+   * <pre>{@code
+   * Some Person
+   * person@example.com
+   * Tel: +1.2125650666
+   * Types: [ADMIN, WHOIS]
+   * Visible in WHOIS as Admin contact: Yes
+   * Visible in WHOIS as Technical contact: No
+   * Registrar-Console access: Yes
+   * Login Email Address: person@registry.example
+   * }</pre>
+   */
+  public String toStringMultilinePlainText() {
+    StringBuilder result = new StringBuilder(256);
+    result.append(getName()).append('\n');
+    result.append(getEmailAddress()).append('\n');
+    if (phoneNumber != null) {
+      result.append("Tel: ").append(getPhoneNumber()).append('\n');
+    }
+    if (faxNumber != null) {
+      result.append("Fax: ").append(getFaxNumber()).append('\n');
+    }
+    result.append("Types: ").append(getTypes()).append('\n');
+    result
+        .append("Visible in registrar WHOIS query as Admin contact: ")
+        .append(getVisibleInWhoisAsAdmin() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append("Visible in registrar WHOIS query as Technical contact: ")
+        .append(getVisibleInWhoisAsTech() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append(
+            "Phone number and email visible in domain WHOIS query as "
+                + "Registrar Abuse contact info: ")
+        .append(getVisibleInDomainWhoisAsAbuse() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append("Registrar-Console access: ")
+        .append(getLoginEmailAddress() != null ? "Yes" : "No")
+        .append('\n');
+    if (getLoginEmailAddress() != null) {
+      result.append("Login Email Address: ").append(getLoginEmailAddress()).append('\n');
+    }
+    return result.toString();
+  }
+
+  @Override
+  public Map<String, Object> toJsonMap() {
+    return new JsonMapBuilder()
+        .put("name", name)
+        .put("emailAddress", emailAddress)
+        .put("registryLockEmailAddress", registryLockEmailAddress)
+        .put("phoneNumber", phoneNumber)
+        .put("faxNumber", faxNumber)
+        .put("types", getTypes().stream().map(Object::toString).collect(joining(",")))
+        .put("visibleInWhoisAsAdmin", visibleInWhoisAsAdmin)
+        .put("visibleInWhoisAsTech", visibleInWhoisAsTech)
+        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
+        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
+        .put("registryLockAllowed", isRegistryLockAllowed())
+        .put("loginEmailAddress", loginEmailAddress)
+        .build();
+  }
+
+  /**
+   * These methods set the email address and registrar ID
+   *
+   * <p>This should only be used for restoring the fields of an object being loaded in a PostLoad
+   * method (effectively, when it is still under construction by Hibernate). In all other cases, the
+   * object should be regarded as immutable and changes should go through a Builder.
+   *
+   * <p>In addition to this special case use, this method must exist to satisfy Hibernate.
+   */
+  public void setEmailAddress(String emailAddress) {
+    this.emailAddress = emailAddress;
+  }
+
+  public void setRegistrarId(String registrarId) {
+    this.registrarId = registrarId;
+  }
+
+  /** A builder for constructing a {@link RegistrarPoc}, since it is immutable. */
+  public static class Builder<T extends RegistrarPocBase, B extends Builder<T, B>>
+      extends GenericBuilder<T, B> {
+    public Builder() {}
+
+    protected Builder(T instance) {
+      super(instance);
+    }
+
+    /** Build the registrar, nullifying empty fields. */
+    @Override
+    public T build() {
+      checkNotNull(getInstance().registrarId, "Registrar ID cannot be null");
+      checkValidEmail(getInstance().emailAddress);
+      // Check allowedToSetRegistryLockPassword here because if we want to allow the user to set
+      // a registry lock password, we must also set up the correct registry lock email concurrently
+      // or beforehand.
+      if (getInstance().allowedToSetRegistryLockPassword) {
+        checkArgument(
+            !isNullOrEmpty(getInstance().registryLockEmailAddress),
+            "Registry lock email must not be null if allowing registry lock access");
+      }
+      return cloneEmptyToNull(super.build());
+    }
+
+    public B setName(String name) {
+      getInstance().name = name;
+      return thisCastToDerived();
+    }
+
+    public B setEmailAddress(String emailAddress) {
+      getInstance().emailAddress = emailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockEmailAddress(@Nullable String registryLockEmailAddress) {
+      getInstance().registryLockEmailAddress = registryLockEmailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setPhoneNumber(String phoneNumber) {
+      getInstance().phoneNumber = phoneNumber;
+      return thisCastToDerived();
+    }
+
+    public B setRegistrarId(String registrarId) {
+      getInstance().registrarId = registrarId;
+      return thisCastToDerived();
+    }
+
+    public B setRegistrar(Registrar registrar) {
+      getInstance().registrarId = registrar.getRegistrarId();
+      return thisCastToDerived();
+    }
+
+    public B setFaxNumber(String faxNumber) {
+      getInstance().faxNumber = faxNumber;
+      return thisCastToDerived();
+    }
+
+    public B setTypes(Iterable<Type> types) {
+      getInstance().types = ImmutableSet.copyOf(types);
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInWhoisAsAdmin(boolean visible) {
+      getInstance().visibleInWhoisAsAdmin = visible;
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInWhoisAsTech(boolean visible) {
+      getInstance().visibleInWhoisAsTech = visible;
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInDomainWhoisAsAbuse(boolean visible) {
+      getInstance().visibleInDomainWhoisAsAbuse = visible;
+      return thisCastToDerived();
+    }
+
+    public B setLoginEmailAddress(String loginEmailAddress) {
+      getInstance().loginEmailAddress = loginEmailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setAllowedToSetRegistryLockPassword(boolean allowedToSetRegistryLockPassword) {
+      if (allowedToSetRegistryLockPassword) {
+        getInstance().registryLockPasswordSalt = null;
+        getInstance().registryLockPasswordHash = null;
+      }
+      getInstance().allowedToSetRegistryLockPassword = allowedToSetRegistryLockPassword;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockPassword(String registryLockPassword) {
+      checkArgument(
+          getInstance().allowedToSetRegistryLockPassword,
+          "Not allowed to set registry lock password for this contact");
+      checkArgument(
+          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
+      byte[] salt = SALT_SUPPLIER.get();
+      getInstance().registryLockPasswordSalt = base64().encode(salt);
+      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
+      getInstance().allowedToSetRegistryLockPassword = false;
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/model/server/Lock.java

@@ -15,6 +15,7 @@
 package google.registry.model.server;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isAtOrAfter;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
@@ -196,7 +197,20 @@ public class Lock extends ImmutableObject implements Serializable {
 
           return new AcquireResult(now, lock, newLock, lockState);
         };
-    AcquireResult acquireResult = tm().transact(lockAcquirer);
+    /*
+     * Use REPEATABLE READ to avoid write conflicts with other locks.
+     *
+     * <p>Since the Lock table is small, Postgresql may choose table scan instead of PK lookup. At
+     * the SERIALIZABLE level this can cause conflicts with other locks. There is no way to forbid
+     * table scan on a per-query or per-table basis.
+     *
+     * <p>Using REPEATABLE READ is safe since Lock acquire/release only accesses one row. Note that
+     * passing the isolation level to the `transact` method requires that it is not a nested
+     * transaction. As of the time of this change this is the case.
+     *
+     * <p>See b/333537928 for more information.
+     */
+    AcquireResult acquireResult = tm().transact(TRANSACTION_REPEATABLE_READ, lockAcquirer);
 
     logAcquireResult(acquireResult);
     lockMetrics.recordAcquire(resourceName, scope, acquireResult.lockState());
@@ -232,7 +246,8 @@ public class Lock extends ImmutableObject implements Serializable {
                 "Not deleting lock: %s - someone else has it: %s", lockId, loadedLock);
           }
         };
-    tm().transact(lockReleaser);
+    // See comments in the `acquire` method for this isolation level.
+    tm().transact(TRANSACTION_REPEATABLE_READ, lockReleaser);
   }
 
   static class LockId extends ImmutableObject implements Serializable {

core/src/main/java/google/registry/model/tld/Tld.java

@@ -458,22 +458,8 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   @JsonDeserialize(using = CurrencyDeserializer.class)
   CurrencyUnit currency = DEFAULT_CURRENCY;
 
-  // TODO(sarahbot@): Remove this field and make createBillingCostTransitions not-null once all TLDs
-  // are populated with a create cost transition map
-  /** The per-year billing cost for registering a new domain name. */
-  @Deprecated
-  @Type(type = JodaMoneyType.TYPE_NAME)
-  @Columns(
-      columns = {
-        @Column(name = "create_billing_cost_amount"),
-        @Column(name = "create_billing_cost_currency")
-      })
-  Money createBillingCost = DEFAULT_CREATE_BILLING_COST;
-
-  // TODO(sarahbot@): Make this field not null in the database
-  // TODO(sarahbot@): Rename this field to createBillingCost once the old createBillingCost has been
-  // removed
   /** A property that transitions to different create billing costs at different times. */
+  @Column(nullable = false)
   @JsonDeserialize(using = TimedTransitionPropertyMoneyDeserializer.class)
   TimedTransitionProperty<Money> createBillingCostTransitions =
       TimedTransitionProperty.withInitialValue(DEFAULT_CREATE_BILLING_COST);
@@ -682,19 +668,10 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
    * Use {@code PricingEngineProxy.getDomainCreateCost} instead of this to find the cost for a
    * domain create.
    */
-  @VisibleForTesting
   public Money getCreateBillingCost(DateTime now) {
     return createBillingCostTransitions.getValueAtTime(now);
   }
 
-  // This getter is still necessary for the Jackson deserialization in the ConfigureTldCommand
-  // TODO(sarahbot@): Remove this getter once the deprecated createBillingCost field is removed from
-  // the schema
-  @Deprecated
-  public Money getCreateBillingCost() {
-    return createBillingCost;
-  }
-
   public ImmutableSortedMap<DateTime, Money> getCreateBillingCostTransitions() {
     return createBillingCostTransitions.toValueMap();
   }
@@ -976,12 +953,6 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
       return this;
     }
 
-    public Builder setCreateBillingCost(Money amount) {
-      checkArgument(amount.isPositiveOrZero(), "createBillingCost cannot be negative");
-      getInstance().createBillingCost = amount;
-      return this;
-    }
-
     public Builder setCreateBillingCostTransitions(
         ImmutableSortedMap<DateTime, Money> createCostsMap) {
       checkArgumentNotNull(createCostsMap, "Create billing costs map cannot be null");
@@ -1165,10 +1136,6 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
       // here to catch cases where we loaded an invalid TimedTransitionProperty from the database
       // and cloned it into a new builder, to block re-building a Tld in an invalid state.
       instance.tldStateTransitions.checkValidity();
-      // TODO(sarahbot@): Remove null check when createBillingCostTransitions field is made not-null
-      checkArgumentNotNull(
-          instance.getCreateBillingCostTransitions(),
-          "CreateBillingCostTransitions cannot be null");
       instance.createBillingCostTransitions.checkValidity();
       instance.renewBillingCostTransitions.checkValidity();
       instance.eapFeeSchedule.checkValidity();

core/src/main/java/google/registry/model/tld/label/DomainLabelMetrics.java

@@ -14,7 +14,6 @@
 
 package google.registry.model.tld.label;
 
-import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableSet;
 import com.google.monitoring.metrics.EventMetric;
@@ -43,16 +42,11 @@ class DomainLabelMetrics {
     UNCACHED_POSITIVE
   }
 
-  @AutoValue
-  abstract static class MetricsReservedListMatch {
+  record MetricsReservedListMatch(String reservedListName, ReservationType reservationType) {
     static MetricsReservedListMatch create(
         String reservedListName, ReservationType reservationType) {
-      return new AutoValue_DomainLabelMetrics_MetricsReservedListMatch(
-          reservedListName, reservationType);
+      return new MetricsReservedListMatch(reservedListName, reservationType);
     }
-
-    abstract String reservedListName();
-    abstract ReservationType reservationType();
   }
 
   /**

core/src/main/java/google/registry/model/tld/label/PremiumListDao.java

@@ -23,7 +23,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.util.CollectionUtils.isNullOrEmpty;
 
 import com.github.benmanes.caffeine.cache.LoadingCache;
-import com.google.auto.value.AutoValue;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -236,14 +235,10 @@ public final class PremiumListDao {
         .collect(toImmutableList());
   }
 
-  @AutoValue
-  abstract static class RevisionIdAndLabel {
-    abstract long revisionId();
-
-    abstract String label();
+  record RevisionIdAndLabel(long revisionId, String label) {
 
     static RevisionIdAndLabel create(long revisionId, String label) {
-      return new AutoValue_PremiumListDao_RevisionIdAndLabel(revisionId, label);
+      return new RevisionIdAndLabel(revisionId, label);
     }
   }
 

core/src/main/java/google/registry/model/tld/label/ReservationType.java

@@ -67,12 +67,13 @@ public enum ReservationType {
     return messageForCheck;
   }
 
-  private static final Ordering<ReservationType> ORDERING = new Ordering<ReservationType>() {
-    @Override
-    public int compare(ReservationType left, ReservationType right) {
-      return Integer.compare(left.ordinal(), right.ordinal());
-    }
-  };
+  private static final Ordering<ReservationType> ORDERING =
+      new Ordering<>() {
+        @Override
+        public int compare(ReservationType left, ReservationType right) {
+          return Integer.compare(left.ordinal(), right.ordinal());
+        }
+      };
 
   /**
    * Returns the {@code ReservationType} with the highest severity, used when a label has multiple

core/src/main/java/google/registry/model/tmch/TmchCrl.java

@@ -60,17 +60,17 @@ public final class TmchCrl extends CrossTldSingleton {
   }
 
   /** ASCII-armored X.509 certificate revocation list. */
-  public final String getCrl() {
+  public String getCrl() {
     return crl;
   }
 
   /** Returns the URL that the CRL was downloaded from. */
-  public final String getUrl() {
+  public String getUrl() {
     return crl;
   }
 
   /** Time we last updated the Database with a newer ICANN CRL. */
-  public final DateTime getUpdated() {
+  public DateTime getUpdated() {
     return updated;
   }
 }