Record http request parameters in log metadata (#2642)

This allows us to search for logs for a given path using a filter like
this:

jsonPayload.httpRequest.requestUrl="/_dr/blah"

TESTED=tested on crash

common/gradle.lockfile

@@ -36,7 +36,8 @@ commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-collections:commons-collections:3.2.2=checkstyle
 info.picocli:picocli:4.6.2=checkstyle
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,compileClasspath,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
+io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.15=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 jakarta.inject:jakarta.inject-api:1.0.5=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
 javax.inject:javax.inject:1=annotationProcessor,errorprone,testAnnotationProcessor,testingAnnotationProcessor
 joda-time:joda-time:2.13.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
@@ -55,11 +56,11 @@ org.jacoco:org.jacoco.core:0.8.12=jacocoAnt
 org.jacoco:org.jacoco.report:0.8.12=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
 org.jspecify:jspecify:0.3.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,testing,testingCompileClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.11.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.11.4=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.7=jacocoAnt
 org.ow2.asm:asm-tree:9.7=jacocoAnt

config/dependency-license/allowed_licenses.json

@@ -305,7 +305,6 @@
     {
       // "Apache License, Version 2.0".
       "moduleLicense": null,
-      "moduleVersion": "26.26.0",
       "moduleName": "com.google.cloud:libraries-bom"
     },
     {
@@ -370,7 +369,6 @@
     // "Apache License, Version 2.0".
     {
       "moduleLicense": null,
-      "moduleVersion": "1.33.0",
       "moduleName": "io.opentelemetry:opentelemetry-bom"
     },
     {

console-webapp/src/app/shared/services/backend.service.ts

@@ -166,20 +166,26 @@ export class BackendService {
       .pipe(catchError((err) => this.errorCatcher<User[]>(err)));
   }
 
-  createUser(registrarId: string): Observable<User> {
+  createUser(registrarId: string, maybeUser: User | null): Observable<User> {
     return this.http
-      .post<User>(`/console-api/users?registrarId=${registrarId}`, {})
+      .post<User>(`/console-api/users?registrarId=${registrarId}`, maybeUser)
       .pipe(catchError((err) => this.errorCatcher<User>(err)));
   }
 
-  deleteUser(registrarId: string, emailAddress: string): Observable<any> {
+  deleteUser(registrarId: string, user: User): Observable<any> {
     return this.http
       .delete<any>(`/console-api/users?registrarId=${registrarId}`, {
-        body: JSON.stringify({ emailAddress }),
+        body: JSON.stringify(user),
       })
       .pipe(catchError((err) => this.errorCatcher<any>(err)));
   }
 
+  updateUser(registrarId: string, updatedUser: User): Observable<any> {
+    return this.http
+      .put<User>(`/console-api/users?registrarId=${registrarId}`, updatedUser)
+      .pipe(catchError((err) => this.errorCatcher<any>(err)));
+  }
+
   getUserData(): Observable<UserData> {
     return this.http
       .get<UserData>('/console-api/userdata')

console-webapp/src/app/shared/services/userData.service.ts

@@ -27,6 +27,7 @@ export interface UserData {
   supportEmail: string;
   supportPhoneNumber: string;
   technicalDocsUrl: string;
+  userRoles?: Map<string, string>;
 }
 
 @Injectable({

console-webapp/src/app/users/userDetails.component.html

@@ -1,32 +1,57 @@
 <div class="console-app__user-details">
-  @if(isNewUser) {
+  @if(isEditing) {
+  <h1 class="mat-headline-4">Editing {{ userDetails().emailAddress }}</h1>
+  <mat-divider></mat-divider>
+  <div class="console-app__user-details-controls">
+    <button
+      mat-icon-button
+      aria-label="Back to view user"
+      (click)="isEditing = false"
+    >
+      <mat-icon>arrow_back</mat-icon>
+    </button>
+  </div>
+  <app-user-edit-form
+    [user]="userDetails()"
+    (onEditComplete)="saveEdit($event)"
+  />
+  } @else { @if(isNewUser) {
   <h1 class="mat-headline-4">
-    {{ userDetails.emailAddress + " succesfully created" }}
+    {{ userDetails().emailAddress + " successfully created" }}
   </h1>
   } @else {
   <h1 class="mat-headline-4">User details</h1>
   }
   <mat-divider></mat-divider>
-  <div>
-    <div class="console-app__user-details-controls">
-      <button
-        mat-icon-button
-        aria-label="Back to users list"
-        (click)="goBack()"
-      >
-        <mat-icon>arrow_back</mat-icon>
-      </button>
-      <div class="spacer"></div>
-      <button
-        mat-icon-button
-        aria-label="Delete User"
-        (click)="deleteUser()"
-        [disabled]="isLoading"
-      >
-        <mat-icon>delete</mat-icon>
-      </button>
-    </div>
+  <div class="console-app__user-details-controls">
+    <button mat-icon-button aria-label="Back to users list" (click)="goBack()">
+      <mat-icon>arrow_back</mat-icon>
+    </button>
+    <div class="spacer"></div>
+    <button
+      mat-flat-button
+      color="primary"
+      aria-label="Edit User"
+      (click)="isEditing = true"
+    >
+      <mat-icon>edit</mat-icon>
+      Edit
+    </button>
+    <button
+      mat-icon-button
+      aria-label="Delete User"
+      (click)="deleteUser()"
+      [disabled]="isLoading"
+    >
+      <mat-icon>delete</mat-icon>
+    </button>
   </div>
+  <div *ngIf="isNewUser" class="console-app__user-details-save-password">
+    <mat-icon>priority_high</mat-icon>
+    Please save the password. For your security, we do not store passwords in a
+    recoverable format.
+  </div>
+
   <p *ngIf="isLoading">
     <mat-progress-bar mode="query"></mat-progress-bar>
   </p>
@@ -41,17 +66,17 @@
         <mat-list-item role="listitem">
           <span class="console-app__list-key">User email</span>
           <span class="console-app__list-value">{{
-            userDetails.emailAddress
+            userDetails().emailAddress
           }}</span>
         </mat-list-item>
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-key">User role</span>
           <span class="console-app__list-value">{{
-            roleToDescription(userDetails.role)
+            roleToDescription(userDetails().role)
           }}</span>
         </mat-list-item>
-        @if (userDetails.password) {
+        @if (userDetails().password) {
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-key">Password</span>
@@ -60,7 +85,7 @@
           >
             <input
               [type]="isPasswordVisible ? 'text' : 'password'"
-              [value]="userDetails.password"
+              [value]="userDetails().password"
               disabled
             />
             <button
@@ -76,4 +101,5 @@
       </mat-list>
     </mat-card-content>
   </mat-card>
+  }
 </div>

console-webapp/src/app/users/userDetails.component.scss

@@ -25,6 +25,15 @@
         background: transparent;
       }
     }
+    &-save-password {
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      padding: 15px 10px;
+      margin-bottom: 20px;
+      border: 1px solid #ddd;
+      border-radius: 10px;
+    }
     max-width: 616px;
   }
 }

console-webapp/src/app/users/userDetails.component.ts

@@ -13,44 +13,50 @@
 // limitations under the License.
 
 import { CommonModule } from '@angular/common';
-import { Component } from '@angular/core';
+import { Component, computed } from '@angular/core';
 import { MatSnackBar } from '@angular/material/snack-bar';
 import { SelectedRegistrarModule } from '../app.module';
 import { MaterialModule } from '../material.module';
 import { RegistrarService } from '../registrar/registrar.service';
 import { SnackBarModule } from '../snackbar.module';
-import { User, UsersService, roleToDescription } from './users.service';
+import { UsersService, roleToDescription, User } from './users.service';
+import { FormsModule } from '@angular/forms';
+import { UserEditFormComponent } from './userEditForm.component';
 
 @Component({
   selector: 'app-user-edit',
-  templateUrl: './userEdit.component.html',
-  styleUrls: ['./userEdit.component.scss'],
+  templateUrl: './userDetails.component.html',
+  styleUrls: ['./userDetails.component.scss'],
   standalone: true,
   imports: [
+    FormsModule,
     MaterialModule,
     SnackBarModule,
     CommonModule,
     SelectedRegistrarModule,
+    UserEditFormComponent,
   ],
   providers: [],
 })
-export class UserEditComponent {
-  inEdit = false;
+export class UserDetailsComponent {
+  isEditing = false;
   isPasswordVisible = false;
   isNewUser = false;
   isLoading = false;
-  userDetails: User;
+
+  userDetails = computed(() => {
+    return this.usersService
+      .users()
+      .filter(
+        (u) => u.emailAddress === this.usersService.currentlyOpenUserEmail()
+      )[0];
+  });
 
   constructor(
     protected registrarService: RegistrarService,
     protected usersService: UsersService,
     private _snackBar: MatSnackBar
   ) {
-    this.userDetails = this.usersService
-      .users()
-      .filter(
-        (u) => u.emailAddress === this.usersService.currentlyOpenUserEmail()
-      )[0];
     if (this.usersService.isNewUser) {
       this.isNewUser = true;
       this.usersService.isNewUser = false;
@@ -63,7 +69,7 @@ export class UserEditComponent {
 
   deleteUser() {
     this.isLoading = true;
-    this.usersService.deleteUser(this.userDetails.emailAddress).subscribe({
+    this.usersService.deleteUser(this.userDetails()).subscribe({
       error: (err) => {
         this._snackBar.open(err.error || err.message);
         this.isLoading = false;
@@ -78,4 +84,18 @@ export class UserEditComponent {
   goBack() {
     this.usersService.currentlyOpenUserEmail.set('');
   }
+
+  saveEdit(user: User) {
+    this.isLoading = true;
+    this.usersService.updateUser(user).subscribe({
+      error: (err) => {
+        this._snackBar.open(err.error || err.message);
+        this.isLoading = false;
+      },
+      complete: () => {
+        this.isLoading = false;
+        this.isEditing = false;
+      },
+    });
+  }
 }

console-webapp/src/app/users/userEditForm.component.html

@@ -0,0 +1,39 @@
+<form (ngSubmit)="saveEdit($event)" #form>
+  <p *ngIf="isNew()">
+    <mat-form-field appearance="outline">
+      <mat-label
+        >User name prefix:
+        <mat-icon
+          matTooltip="Prefix will be combined with registrar ID to create a unique user name - {prefix}.{registrarId}@registry.google"
+          >help_outline</mat-icon
+        ></mat-label
+      >
+      <input
+        matInput
+        minlength="3"
+        maxlength="3"
+        [required]="true"
+        [(ngModel)]="user().emailAddress"
+        [ngModelOptions]="{ standalone: true }"
+      />
+    </mat-form-field>
+  </p>
+  <p>
+    <mat-form-field appearance="outline">
+      <mat-label
+        >User Role:
+        <mat-icon
+          matTooltip="Viewer role doesn't allow making updates; Editor role allows updates, like Contacts delete or SSL certificate change"
+          >help_outline</mat-icon
+        ></mat-label
+      >
+      <mat-select [(ngModel)]="user().role" name="userRole">
+        <mat-option value="PRIMARY_CONTACT">Editor</mat-option>
+        <mat-option value="ACCOUNT_MANAGER">Viewer</mat-option>
+      </mat-select>
+    </mat-form-field>
+  </p>
+  <button mat-flat-button color="primary" aria-label="Save user" type="submit">
+    Save
+  </button>
+</form>

console-webapp/src/app/users/userEditForm.component.ts

@@ -0,0 +1,58 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { CommonModule } from '@angular/common';
+import {
+  Component,
+  ElementRef,
+  EventEmitter,
+  input,
+  Output,
+  ViewChild,
+} from '@angular/core';
+import { MaterialModule } from '../material.module';
+import { FormsModule } from '@angular/forms';
+import { User } from './users.service';
+
+@Component({
+  selector: 'app-user-edit-form',
+  templateUrl: './userEditForm.component.html',
+  styleUrls: ['./userEditForm.component.scss'],
+  standalone: true,
+  imports: [FormsModule, MaterialModule, CommonModule],
+  providers: [],
+})
+export class UserEditFormComponent {
+  @ViewChild('form') form!: ElementRef;
+  isNew = input<boolean>(false);
+  user = input<User>(
+    {
+      emailAddress: '',
+      role: 'ACCOUNT_MANAGER',
+    },
+    // @ts-ignore - legit option, typescript fails to match it to a proper type
+    { transform: (user: User) => structuredClone(user) }
+  );
+
+  @Output() onEditComplete = new EventEmitter<User>();
+
+  saveEdit(e: SubmitEvent) {
+    e.preventDefault();
+    if (this.form.nativeElement.checkValidity()) {
+      this.onEditComplete.emit(this.user());
+    } else {
+      this.form.nativeElement.reportValidity();
+    }
+  }
+}

console-webapp/src/app/users/users.component.html

@@ -3,46 +3,105 @@
   <div class="console-app__users-spinner">
     <mat-spinner />
   </div>
+  } @else if(selectingExistingUser) {
+  <div class="console-app__users">
+    <h1 class="mat-headline-4">Add existing user</h1>
+    <p>
+      <button
+        mat-icon-button
+        aria-label="Back to users list"
+        (click)="selectingExistingUser = false"
+      >
+        <mat-icon>arrow_back</mat-icon>
+      </button>
+    </p>
+    <h1>Select registrar from which to add a new user</h1>
+    <p>
+      <mat-form-field appearance="outline">
+        <mat-label>Registrar</mat-label>
+        <mat-select
+          [(ngModel)]="selectedRegistrarId"
+          name="selectedRegistrarId"
+          (selectionChange)="onRegistrarSelectionChange($event)"
+        >
+          @for (registrar of registrarService.registrars(); track registrar) {
+          <mat-option [value]="registrar.registrarId">{{
+            registrar.registrarId
+          }}</mat-option>
+          }
+        </mat-select>
+      </mat-form-field>
+    </p>
+    @if(usersSelection.length) {
+    <app-users-list
+      [users]="usersSelection"
+      (onSelect)="existingUserSelected($event)"
+    />
+    <p class="console-app__users-add-existing">
+      <button
+        mat-flat-button
+        color="primary"
+        aria-label="Add user"
+        (click)="submitExistingUser()"
+        [disabled]="!selectedExistingUser"
+      >
+        Add user
+      </button>
+      <button
+        mat-stroked-button
+        aria-label="Cancel adding existing user"
+        (click)="selectingExistingUser = false"
+      >
+        Cancel
+      </button>
+    </p>
+    }
+  </div>
   } @else if(usersService.currentlyOpenUserEmail()) {
   <app-user-edit></app-user-edit>
+  } @else if(isNew) {
+  <h1 class="mat-headline-4">New User Form</h1>
+  <div class="spacer"></div>
+  <p>
+    <button
+      mat-icon-button
+      aria-label="Back to users list"
+      (click)="isNew = false"
+    >
+      <mat-icon>arrow_back</mat-icon>
+    </button>
+  </p>
+  <app-user-edit-form [isNew]="true" (onEditComplete)="createNewUser($event)" />
   } @else {
   <div class="console-app__users">
     <div class="console-app__users-header">
       <h1 class="mat-headline-4">Users</h1>
       <div class="spacer"></div>
-      <button
-        mat-flat-button
-        (click)="createNewUser()"
-        aria-label="Create new user"
-        color="primary"
-      >
-        Create a Viewer User
-      </button>
+      <div class="console-app__users-header-buttons">
+        <button
+          class="console-app__users-header-add"
+          mat-stroked-button
+          (click)="addExistingUser()"
+          aria-label="Create new user"
+          color="primary"
+        >
+          <mat-icon>add</mat-icon>
+          Add existing user
+        </button>
+        <button
+          mat-flat-button
+          (click)="isNew = true"
+          aria-label="Create new user"
+          color="primary"
+        >
+          Create New User
+        </button>
+      </div>
     </div>
-    <mat-table
-      [dataSource]="dataSource"
-      class="mat-elevation-z0"
-      class="console-app__users-table"
-      matSort
-    >
-      <ng-container
-        *ngFor="let column of columns"
-        [matColumnDef]="column.columnDef"
-      >
-        <mat-header-cell *matHeaderCellDef>
-          {{ column.header }}
-        </mat-header-cell>
-        <mat-cell
-          *matCellDef="let row"
-          [innerHTML]="column.cell(row)"
-        ></mat-cell>
-      </ng-container>
-      <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>
-      <mat-row
-        *matRowDef="let row; columns: displayedColumns"
-        (click)="openDetails(row.emailAddress)"
-      ></mat-row>
-    </mat-table>
+    <app-users-list
+      [users]="usersService.users()"
+      (onSelect)="openDetails($event)"
+    />
   </div>
   }
 </app-selected-registrar-wrapper>

console-webapp/src/app/users/users.component.scss

@@ -13,26 +13,37 @@
 // limitations under the License.
 
 .console-app {
+  &__users {
+    max-width: 1024px;
+    overflow-x: auto;
+  }
+
   &__users-spinner {
     align-items: center;
     display: flex;
     justify-content: center;
   }
 
-  $min-width: 756px;
-  $max-width: 1024px;
-
-  &__users-table {
-    min-width: $min-width !important;
-    max-width: $max-width;
-  }
-
   &__users-new {
     margin-left: 20px;
   }
 
+  &__users-add-existing {
+    margin-top: 20px;
+    > button {
+      margin-right: 15px;
+    }
+  }
   &__users-header {
     display: flex;
     justify-content: space-between;
+    flex-wrap: wrap;
+    &-buttons {
+      display: flex;
+      flex-wrap: wrap;
+      button {
+        margin: 0 15px 15px 0;
+      }
+    }
   }
 }

console-webapp/src/app/users/users.component.ts

@@ -14,29 +14,19 @@
 
 import { CommonModule } from '@angular/common';
 import { HttpErrorResponse } from '@angular/common/http';
-import { Component, effect, ViewChild } from '@angular/core';
+import { Component, effect } from '@angular/core';
 import { MatSnackBar } from '@angular/material/snack-bar';
-import { MatSort } from '@angular/material/sort';
-import { MatTableDataSource } from '@angular/material/table';
 import { SelectedRegistrarModule } from '../app.module';
 import { MaterialModule } from '../material.module';
 import { RegistrarService } from '../registrar/registrar.service';
 import { SnackBarModule } from '../snackbar.module';
-import { UserEditComponent } from './userEdit.component';
-import { roleToDescription, User, UsersService } from './users.service';
-
-export const columns = [
-  {
-    columnDef: 'emailAddress',
-    header: 'User email',
-    cell: (record: User) => `${record.emailAddress || ''}`,
-  },
-  {
-    columnDef: 'role',
-    header: 'User role',
-    cell: (record: User) => `${roleToDescription(record.role)}`,
-  },
-];
+import { UserDetailsComponent } from './userDetails.component';
+import { User, UsersService } from './users.service';
+import { UserDataService } from '../shared/services/userData.service';
+import { FormsModule } from '@angular/forms';
+import { UsersListComponent } from './usersList.component';
+import { MatSelectChange } from '@angular/material/select';
+import { UserEditFormComponent } from './userEditForm.component';
 
 @Component({
   selector: 'app-users',
@@ -44,41 +34,47 @@ export const columns = [
   styleUrls: ['./users.component.scss'],
   standalone: true,
   imports: [
+    FormsModule,
     MaterialModule,
     SnackBarModule,
     CommonModule,
     SelectedRegistrarModule,
-    UserEditComponent,
+    UsersListComponent,
+    UserEditFormComponent,
+    UserDetailsComponent,
   ],
   providers: [UsersService],
 })
 export class UsersComponent {
-  dataSource: MatTableDataSource<User>;
-  columns = columns;
-  displayedColumns = this.columns.map((c) => c.columnDef);
   isLoading = false;
-
-  @ViewChild(MatSort) sort!: MatSort;
+  isNew = false;
+  selectingExistingUser = false;
+  selectedRegistrarId = '';
+  usersSelection: User[] = [];
+  selectedExistingUser: User | undefined;
 
   constructor(
     protected registrarService: RegistrarService,
     protected usersService: UsersService,
+    private userDataService: UserDataService,
     private _snackBar: MatSnackBar
   ) {
-    this.dataSource = new MatTableDataSource<User>(usersService.users());
-
     effect(() => {
       if (registrarService.registrarId()) {
         this.loadUsers();
       }
     });
-    effect(() => {
-      this.dataSource.data = usersService.users();
-    });
   }
 
-  ngAfterViewInit() {
-    this.dataSource.sort = this.sort;
+  addExistingUser() {
+    this.selectingExistingUser = true;
+    this.selectedRegistrarId = '';
+    this.usersSelection = [];
+    this.selectedExistingUser = undefined;
+  }
+
+  existingUserSelected(user: User) {
+    this.selectedExistingUser = user;
   }
 
   loadUsers() {
@@ -94,9 +90,9 @@ export class UsersComponent {
     });
   }
 
-  createNewUser() {
+  createNewUser(user: User) {
     this.isLoading = true;
-    this.usersService.createNewUser().subscribe({
+    this.usersService.createOrAddNewUser(user).subscribe({
       error: (err: HttpErrorResponse) => {
         this._snackBar.open(err.error || err.message);
         this.isLoading = false;
@@ -107,7 +103,39 @@ export class UsersComponent {
     });
   }
 
-  openDetails(emailAddress: string) {
-    this.usersService.currentlyOpenUserEmail.set(emailAddress);
+  openDetails(user: User) {
+    this.usersService.currentlyOpenUserEmail.set(user.emailAddress);
+  }
+
+  onRegistrarSelectionChange(e: MatSelectChange) {
+    if (e.value) {
+      this.usersService.fetchUsersForRegistrar(e.value).subscribe({
+        error: (err) => {
+          this._snackBar.open(err.error || err.message);
+        },
+        next: (users) => {
+          this.usersSelection = users;
+        },
+      });
+    }
+  }
+
+  submitExistingUser() {
+    this.isLoading = true;
+    if (this.selectedExistingUser) {
+      this.usersService
+        .createOrAddNewUser(this.selectedExistingUser)
+        .subscribe({
+          error: (err) => {
+            this._snackBar.open(err.error || err.message);
+            this.isLoading = false;
+          },
+          complete: () => {
+            this.isLoading = false;
+            this.selectingExistingUser = false;
+            this.loadUsers();
+          },
+        });
+    }
   }
 }

console-webapp/src/app/users/users.service.ts

@@ -13,13 +13,13 @@
 // limitations under the License.
 
 import { Injectable, signal } from '@angular/core';
-import { tap } from 'rxjs';
+import { switchMap, tap } from 'rxjs';
 import { RegistrarService } from '../registrar/registrar.service';
 import { BackendService } from '../shared/services/backend.service';
 
 export const roleToDescription = (role: string) => {
   if (!role) return 'N/A';
-  else if (role.toLowerCase().startsWith('account_manager')) {
+  else if (role === 'ACCOUNT_MANAGER') {
     return 'Viewer';
   }
   return 'Editor';
@@ -46,6 +46,10 @@ export class UsersService {
     private registrarService: RegistrarService
   ) {}
 
+  fetchUsersForRegistrar(registrarId: string) {
+    return this.backendService.getUsers(registrarId);
+  }
+
   fetchUsers() {
     return this.backendService
       .getUsers(this.registrarService.registrarId())
@@ -56,21 +60,29 @@ export class UsersService {
       );
   }
 
-  createNewUser() {
+  createOrAddNewUser(user: User) {
     return this.backendService
-      .createUser(this.registrarService.registrarId())
+      .createUser(this.registrarService.registrarId(), user)
       .pipe(
         tap((newUser: User) => {
-          this.users.set([...this.users(), newUser]);
-          this.currentlyOpenUserEmail.set(newUser.emailAddress);
-          this.isNewUser = true;
+          if (newUser) {
+            this.users.set([...this.users(), newUser]);
+            this.currentlyOpenUserEmail.set(newUser.emailAddress);
+            this.isNewUser = true;
+          }
         })
       );
   }
 
-  deleteUser(emailAddress: string) {
+  deleteUser(user: User) {
     return this.backendService
-      .deleteUser(this.registrarService.registrarId(), emailAddress)
-      .pipe(tap((_) => this.fetchUsers()));
+      .deleteUser(this.registrarService.registrarId(), user)
+      .pipe(switchMap((_) => this.fetchUsers()));
+  }
+
+  updateUser(updatedUser: User) {
+    return this.backendService
+      .updateUser(this.registrarService.registrarId(), updatedUser)
+      .pipe(switchMap((_) => this.fetchUsers()));
   }
 }

console-webapp/src/app/users/usersList.component.html

@@ -0,0 +1,24 @@
+<div class="console-app__users-table-wrapper">
+  <mat-table
+    [dataSource]="dataSource"
+    class="mat-elevation-z0"
+    class="console-app__users-table"
+    matSort
+  >
+    <ng-container
+      *ngFor="let column of columns"
+      [matColumnDef]="column.columnDef"
+    >
+      <mat-header-cell *matHeaderCellDef>
+        {{ column.header }}
+      </mat-header-cell>
+      <mat-cell *matCellDef="let row" [innerHTML]="column.cell(row)"></mat-cell>
+    </ng-container>
+    <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>
+    <mat-row
+      *matRowDef="let row; columns: displayedColumns"
+      [class.rowSelected]="isRowSelected(row)"
+      (click)="onClick(row)"
+    ></mat-row>
+  </mat-table>
+</div>

console-webapp/src/app/users/usersList.component.scss

@@ -0,0 +1,14 @@
+.console-app {
+  &__users-table {
+    min-width: 616px;
+    .rowSelected {
+      background-color: var(--light-highlight);
+      font-weight: bold;
+    }
+  }
+
+  &__users-table-wrapper {
+    width: 100%;
+    overflow: auto;
+  }
+}

console-webapp/src/app/users/usersList.component.ts

@@ -0,0 +1,78 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { CommonModule } from '@angular/common';
+import {
+  Component,
+  effect,
+  EventEmitter,
+  input,
+  Output,
+  ViewChild,
+} from '@angular/core';
+import { MaterialModule } from '../material.module';
+import { User, roleToDescription } from './users.service';
+import { MatTableDataSource } from '@angular/material/table';
+import { MatSort } from '@angular/material/sort';
+
+export const columns = [
+  {
+    columnDef: 'emailAddress',
+    header: 'User email',
+    cell: (record: User) => `${record.emailAddress || ''}`,
+  },
+  {
+    columnDef: 'role',
+    header: 'User role',
+    cell: (record: User) => `${roleToDescription(record.role)}`,
+  },
+];
+
+@Component({
+  selector: 'app-users-list',
+  templateUrl: './usersList.component.html',
+  styleUrls: ['./usersList.component.scss'],
+  standalone: true,
+  imports: [MaterialModule, CommonModule],
+  providers: [],
+})
+export class UsersListComponent {
+  columns = columns;
+  displayedColumns = this.columns.map((c) => c.columnDef);
+  dataSource: MatTableDataSource<User>;
+  selectedRow!: User;
+  users = input<User[]>([]);
+  @Output() onSelect = new EventEmitter<User>();
+  @ViewChild(MatSort) sort!: MatSort;
+
+  constructor() {
+    this.dataSource = new MatTableDataSource<User>(this.users());
+    effect(() => {
+      this.dataSource.data = this.users();
+    });
+  }
+
+  ngAfterViewInit() {
+    this.dataSource.sort = this.sort;
+  }
+
+  onClick(row: User) {
+    this.selectedRow = row;
+    this.onSelect.emit(row);
+  }
+
+  isRowSelected(row: User) {
+    return row === this.selectedRow;
+  }
+}

core/build.gradle

@@ -17,7 +17,7 @@ import java.util.Optional
 
 plugins {
   id 'java-library'
-  id "org.flywaydb.flyway" version "10.8.1"
+  id "org.flywaydb.flyway" version "11.0.1"
   id 'maven-publish'
 }
 
@@ -166,6 +166,7 @@ dependencies {
   // gradleLint.ignore('unused-dependency') {
   implementation deps['com.google.gwt:gwt-user']
   // }
+  implementation deps['com.google.cloud:google-cloud-compute']
   implementation deps['com.google.cloud:google-cloud-core']
   implementation deps['com.google.cloud:google-cloud-storage']
   implementation deps['com.google.cloud:google-cloud-tasks']

core/buildscript-gradle.lockfile

@@ -5,9 +5,9 @@ com.fasterxml.jackson.core:jackson-annotations:2.15.2=classpath
 com.fasterxml.jackson.core:jackson-core:2.15.2=classpath
 com.fasterxml.jackson.core:jackson-databind:2.15.2=classpath
 com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.15.2=classpath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.2=classpath
 com.fasterxml.jackson:jackson-bom:2.15.2=classpath
-com.google.code.gson:gson:2.10.1=classpath
-gradle.plugin.org.flywaydb:gradle-plugin-publishing:10.8.1=classpath
-org.flywaydb.flyway:org.flywaydb.flyway.gradle.plugin:10.8.1=classpath
-org.flywaydb:flyway-core:10.8.1=classpath
+gradle.plugin.org.flywaydb:gradle-plugin-publishing:11.0.1=classpath
+org.flywaydb.flyway:org.flywaydb.flyway.gradle.plugin:11.0.1=classpath
+org.flywaydb:flyway-core:11.0.1=classpath
 empty=

core/gradle.lockfile

@@ -4,14 +4,14 @@
 aopalliance:aopalliance:1.0=annotationProcessor,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 args4j:args4j:2.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml:classmate:1.5.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:3.1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -21,126 +21,160 @@ com.github.docker-java:docker-java-transport:3.4.0=compileClasspath,deploy_jar,n
 com.github.jnr:jffi:1.3.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-enxio:0.32.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-ffi:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-posix:3.1.19=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.jnr:jnr-unixsocket:0.38.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-enxio:0.32.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-ffi:2.2.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-posix:3.1.20=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.jnr:jnr-unixsocket:0.38.23=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api-client:google-api-client-jackson2:2.2.0=testRuntimeClasspath
+com.google.api-client:google-api-client-jackson2:2.7.0=testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.2.0=testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.0=testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.43.2-beta=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.177.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.177.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.39.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.111.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.13.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.46.0-beta=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.2=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.2=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.181.2=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.44.1=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.114.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.115.0=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-pubsublite-v1:1.14.3=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.77.0=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.77.0=testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.77.0=testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.43.2-beta=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-common-protos:2.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.177.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.177.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.39.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.39.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.110.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.44.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.111.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.13.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.29.0=testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.29.0=testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.46.0-beta=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-common-protos:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:grpc-google-common-protos:2.45.1=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.9.2=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.9.2=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.2=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.2=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.44.1=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.44.1=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.65.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.113.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.26.5=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.52.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.114.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.115.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-pubsublite-v1:1.14.3=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.77.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.77.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-executor-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.77.0=testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.43.2-beta=testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.29.0=testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.119.0=testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.142.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.119.0=testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.142.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-common-protos:2.46.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev20240924-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-bigquery:v2-rev20240919-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.46.0-beta=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.145.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.145.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-common-protos:2.50.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev20241210-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-bigquery:v2-rev20240815-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20240310-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20240817-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20241209-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-dns:v1-rev20240719-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20240914-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20241206-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-gmail:v1-rev20240520-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20241114-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240929-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20241114-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241001-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20240319-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20240924-2.0.0=testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20241108-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20241206-2.0.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.30.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.30.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.auto.value:auto-value:1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auto.value:auto-value:1.11.0=annotationProcessor,testAnnotationProcessor
+com.google.auto.value:auto-value:1.11.0=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.19.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.cloud.opentelemetry:detector-resources-support:0.32.0=testRuntimeClasspath
-com.google.cloud.opentelemetry:exporter-metrics:0.31.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud.opentelemetry:shared-resourcemapping:0.32.0=testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.5.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.39.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.45.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:2.21.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.opentelemetry:detector-resources-support:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud.opentelemetry:detector-resources-support:0.33.0=testRuntimeClasspath
+com.google.cloud.opentelemetry:exporter-metrics:0.33.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.21.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.21.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.9.2=testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-bigtable:2.44.1=testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.65.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.49.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-http:2.45.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core:2.38.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core:2.45.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.44.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.127.25=testCompileClasspath
-com.google.cloud:google-cloud-nio:0.127.6=testRuntimeClasspath
-com.google.cloud:google-cloud-pubsub:1.129.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-pubsublite:1.13.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.29.0=testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.cloud:google-cloud-spanner:6.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.49.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core:2.49.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-firestore:3.26.5=testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-monitoring:3.52.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.24=testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.127.28=testCompileClasspath
+com.google.cloud:google-cloud-pubsub:1.132.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-pubsub:1.133.0=testRuntimeClasspath
+com.google.cloud:google-cloud-pubsublite:1.14.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-pubsublite:1.14.3=testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.51.0=testRuntimeClasspath
+com.google.cloud:google-cloud-secretmanager:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-spanner:6.74.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:google-cloud-spanner:6.77.0=testRuntimeClasspath
 com.google.cloud:google-cloud-storage:2.32.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-storage:2.43.2=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.29.0=testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.52.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.cloud:grpc-gcp:1.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:libraries-bom:26.26.0=testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.21.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.46.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.51.0=testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.55.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:grpc-gcp:1.6.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:libraries-bom:26.48.0=testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.26.5=testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=soy
 com.google.code.gson:gson:2.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -152,7 +186,7 @@ com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.20.0=soy
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -171,21 +205,25 @@ com.google.googlejavaformat:google-java-format:1.5=annotationProcessor,testAnnot
 com.google.guava:failureaccess:1.0.1=checkstyle,errorprone,nonprodAnnotationProcessor,soy
 com.google.guava:failureaccess:1.0.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava-parent:32.1.1-jre=errorprone,nonprodAnnotationProcessor,soy
-com.google.guava:guava-testlib:33.3.1-jre=testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
+com.google.guava:guava-testlib:33.4.0-jre=testCompileClasspath
 com.google.guava:guava:31.0.1-jre=checkstyle
 com.google.guava:guava:32.1.1-jre=errorprone,nonprodAnnotationProcessor,soy
 com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
-com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.guava:guava:33.4.0-jre=testCompileClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.3=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.http-client:google-http-client-appengine:1.45.0=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:1.45.3=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.http-client:google-http-client-jackson2:1.45.0=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-protobuf:1.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:1.45.3=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.http-client:google-http-client-protobuf:1.45.0=testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.inject:guice:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
@@ -195,12 +233,12 @@ com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,deploy_jar,non
 com.google.monitoring-client:contrib:1.0.7=testCompileClasspath,testRuntimeClasspath
 com.google.monitoring-client:metrics:1.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.monitoring-client:stackdriver:1.0.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-java6:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-jetty:1.34.1=testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-jetty:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.oauth-client:google-oauth-client-servlet:1.34.1=testRuntimeClasspath
-com.google.oauth-client:google-oauth-client-servlet:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.oauth-client:google-oauth-client:1.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-java6:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-jetty:1.36.0=testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-jetty:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.oauth-client:google-oauth-client-servlet:1.36.0=testRuntimeClasspath
+com.google.oauth-client:google-oauth-client-servlet:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.oauth-client:google-oauth-client:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:3.25.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:3.19.6=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.protobuf:protobuf-java:3.25.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
@@ -238,11 +276,10 @@ com.sun.istack:istack-commons-tools:4.1.2=jaxb
 com.sun.xml.bind.external:relaxng-datatype:4.0.5=jaxb
 com.sun.xml.bind.external:rngom:4.0.5=jaxb
 com.sun.xml.dtd-parser:dtd-parser:1.5.1=jaxb
-com.zaxxer:HikariCP:6.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:6.2.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-beanutils:commons-beanutils:1.9.4=checkstyle
 commons-codec:commons-codec:1.17.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-collections:commons-collections:3.2.2=checkstyle
-commons-dbutils:commons-dbutils:1.8.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-io:commons-io:2.17.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 commons-logging:commons-logging:1.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 dev.failsafe:failsafe:3.3.2=testCompileClasspath,testRuntimeClasspath
@@ -258,43 +295,57 @@ info.picocli:picocli:4.6.2=checkstyle
 io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.classgraph:classgraph:4.8.162=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-alts:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-auth:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-core:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-googleapis:1.67.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-inprocess:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty-shaded:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.62.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.67.1=testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf-lite:1.67.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-protobuf:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.62.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-rls:1.67.1=testRuntimeClasspath
-io.grpc:grpc-services:1.62.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.67.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-stub:1.67.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.62.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.67.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.62.2=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.67.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-socks:4.1.100.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler-proxy:4.1.100.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
+io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-alts:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-auth:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-census:1.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.grpc:grpc-census:1.68.0=testRuntimeClasspath
+io.grpc:grpc-context:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-core:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-googleapis:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-inprocess:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty-shaded:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty:1.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.grpc:grpc-netty:1.68.0=testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.69.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf-lite:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-protobuf:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.66.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.grpc:grpc-rls:1.69.0=testRuntimeClasspath
+io.grpc:grpc-services:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-services:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-stub:1.69.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-util:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-xds:1.69.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-buffer:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-codec-http2:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-codec-http:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-codec-http:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-codec-socks:4.1.100.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.netty:netty-codec-socks:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-codec:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-codec:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-common:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-common:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-handler-proxy:4.1.100.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.netty:netty-handler-proxy:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-handler:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-handler:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-resolver:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-resolver:4.1.110.Final=testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-transport-native-unix-common:4.1.110.Final=testRuntimeClasspath
+io.netty:netty-transport:4.1.100.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+io.netty:netty-transport:4.1.110.Final=testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
@@ -306,29 +357,35 @@ io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_ja
 io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-proto:0.2.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-proto:0.2.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry.semconv:opentelemetry-semconv:1.25.0-alpha=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api-incubator:1.37.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api-incubator:1.42.1-alpha=testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-bom:1.33.0=testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.42.1=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.42.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry.semconv:opentelemetry-semconv:1.23.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry.semconv:opentelemetry-semconv:1.27.0-alpha=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api-incubator:1.41.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api-incubator:1.45.0-alpha=testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-bom:1.42.1=testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-context:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.44.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.44.1=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.41.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.45.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-semconv:1.26.0-alpha=testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.smallrye:jandex:3.1.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -346,15 +403,14 @@ javax.annotation:javax.annotation-api:1.3.2=compileClasspath,deploy_jar,nonprodC
 javax.annotation:jsr250-api:1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 javax.inject:javax.inject:1=annotationProcessor,compileClasspath,deploy_jar,errorprone,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 javax.jdo:jdo2-api:2.3-20090302111651=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-javax.servlet:servlet-api:2.5=testRuntimeClasspath
 javax.validation:validation-api:1.0.0.GA=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 joda-time:joda-time:2.12.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
-net.bytebuddy:byte-buddy-agent:1.15.3=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy-agent:1.15.11=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.14.12=compileClasspath,nonprodCompileClasspath
 net.bytebuddy:byte-buddy:1.14.15=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-net.bytebuddy:byte-buddy:1.15.3=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testRuntimeClasspath
 net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:10.6=checkstyle
@@ -368,31 +424,32 @@ org.apache.arrow:arrow-format:15.0.2=compileClasspath,deploy_jar,nonprodCompileC
 org.apache.arrow:arrow-memory-core:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-vector:15.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.avro:avro:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-runners-core-construction-java:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.59.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.61.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-sdks-java-fn-execution:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-harness:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-transform-service-launcher:2.59.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-vendor-grpc-1_60_1:0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-transform-service-launcher:2.61.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-vendor-grpc-1_60_1:0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-compress:1.26.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.4.0=testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-text:1.12.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+org.apache.commons:commons-lang3:3.17.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-text:1.13.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -402,37 +459,37 @@ org.apache.sshd:sshd-common:2.14.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:2.14.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:2.14.0=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:2.14.0=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.0=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.2=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.79=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.79=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.79=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.79=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=compileClasspath,nonprodCompileClasspath,soy,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.5=annotationProcessor,testAnnotationProcessor
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.12.0=checkstyle
 org.checkerframework:checker-qual:3.33.0=errorprone,nonprodAnnotationProcessor,soy
 org.checkerframework:checker-qual:3.41.0=annotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.48.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.24=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.angus:angus-activation:2.0.2=deploy_jar,jaxb,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.0.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections-api:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.eclipse.collections:eclipse-collections:11.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-ee:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.0.14=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:10.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:10.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-ee:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.0.alpha1=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:11.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:11.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:codemodel:4.0.5=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.5=jaxb
@@ -476,83 +533,88 @@ org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,nonprodRun
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20230618=soy
 org.json:json:20240303=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.18.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jsoup:jsoup:1.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jspecify:jspecify:0.3.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
 org.jspecify:jspecify:1.0.0=testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.3.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-migrationsupport:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-runner:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:1.11.2=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-commons:1.11.2=testRuntimeClasspath
-org.junit:junit-bom:5.11.2=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-core:5.14.1=testCompileClasspath,testRuntimeClasspath
-org.mockito:mockito-junit-jupiter:5.14.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-migrationsupport:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-runner:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:1.11.4=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-commons:1.11.4=testRuntimeClasspath
+org.junit:junit-bom:5.11.4=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-core:5.15.2=testCompileClasspath,testRuntimeClasspath
+org.mockito:mockito-junit-jupiter:5.15.2=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
 org.ogce:xpp3:1.1.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-analysis:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-commons:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-analysis:9.5=soy
+org.ow2.asm:asm-analysis:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-commons:9.5=soy
 org.ow2.asm:asm-commons:9.7=jacocoAnt
-org.ow2.asm:asm-tree:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-commons:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-tree:9.5=soy
 org.ow2.asm:asm-tree:9.7=jacocoAnt
-org.ow2.asm:asm-util:9.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm:9.5=compileClasspath,nonprodCompileClasspath,soy
-org.ow2.asm:asm:9.7=deploy_jar,jacocoAnt,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-tree:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm-util:9.5=soy
+org.ow2.asm:asm-util:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.ow2.asm:asm:9.5=soy
+org.ow2.asm:asm:9.7=jacocoAnt
+org.ow2.asm:asm:9.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.pcollections:pcollections:3.1.4=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v127:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v128:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v129:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v85:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.25.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.25.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v129:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v130:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v131:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v85:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.27.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.27.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.slf4j:slf4j-jdk14:2.0.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-jdk14:2.0.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:junit-jupiter:1.20.2=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:selenium:1.20.2=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.20.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.20.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.20.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:junit-jupiter:1.20.4=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.20.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:selenium:1.20.4=testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.20.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.w3c.css:sac:1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-api:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-loader:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-tools:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-utility:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:16.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-api:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-loader:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-tools:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-utility:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:16.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,nomulus_test

core/src/main/java/google/registry/batch/CloudTasksUtils.java

@@ -17,6 +17,7 @@ package google.registry.batch;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static google.registry.config.RegistryConfig.CANARY_HEADER;
 import static java.util.concurrent.TimeUnit.SECONDS;
 
 import com.google.api.gax.rpc.ApiException;
@@ -190,6 +191,9 @@ public class CloudTasksUtils implements Serializable {
     requestBuilder.setOidcToken(oidcTokenBuilder.build());
     String totalPath = String.format("%s%s", service.getServiceUrl(), path);
     requestBuilder.setUrl(totalPath);
+    if (RegistryEnvironment.isCanary()) {
+      requestBuilder.putHeaders(CANARY_HEADER, "true");
+    }
     return Task.newBuilder().setHttpRequest(requestBuilder.build()).build();
   }
 
@@ -200,7 +204,7 @@ public class CloudTasksUtils implements Serializable {
    * default service account as the principal. That account must have permission to submit tasks to
    * Cloud Tasks.
    *
-   * <p>Prefer this overload over the one where the path and service are explicit defined, as this
+   * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
    * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
@@ -269,7 +273,7 @@ public class CloudTasksUtils implements Serializable {
   /**
    * Create a {@link Task} to be enqueued with a random delay up to {@code jitterSeconds}.
    *
-   * <p>Prefer this overload over the one where the path and service are explicit defined, as this
+   * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
    * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
@@ -306,7 +310,7 @@ public class CloudTasksUtils implements Serializable {
    * @param service the GAE/GKE service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
-   * @param delay the amount of time that a task needs to delayed for.
+   * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
    * @see <a
    *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
@@ -330,14 +334,14 @@ public class CloudTasksUtils implements Serializable {
   /**
    * Create a {@link Task} to be enqueued with delay of {@code duration}.
    *
-   * <p>Prefer this overload over the one where the path and service are explicit defined, as this
+   * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
    * class will automatically determine the service to use based on the action and the runtime.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
-   * @param delay the amount of time that a task needs to delayed for.
+   * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
    * @see <a
    *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig

core/src/main/java/google/registry/beam/common/RegistryPipelineComponent.java

@@ -20,6 +20,7 @@ import dagger.Lazy;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.keyring.KeyringModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.BeamJpaTm;
 import google.registry.persistence.PersistenceModule.BeamReadOnlyReplicaJpaTm;
@@ -36,6 +37,7 @@ import javax.inject.Singleton;
     modules = {
       ConfigModule.class,
       CredentialModule.class,
+      KeyringModule.class,
       PersistenceModule.class,
       SecretManagerModule.class,
       UtilsModule.class

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -46,7 +46,6 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.net.URI;
 import java.net.URL;
-import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
 import java.util.function.Supplier;
@@ -72,6 +71,7 @@ import org.joda.time.Duration;
  */
 public final class RegistryConfig {
 
+  public static final String CANARY_HEADER = "canary";
   private static final String ENVIRONMENT_CONFIG_FORMAT = "files/nomulus-config-%s.yaml";
   private static final String YAML_CONFIG_PROD =
       readResourceUtf8(RegistryConfig.class, "files/default-config.yaml");
@@ -118,12 +118,6 @@ public final class RegistryConfig {
       return config.gcpProject.projectIdNumber;
     }
 
-    @Provides
-    @Config("backendServiceIds")
-    public static Map<String, Long> provideBackendServiceIds(RegistryConfigSettings config) {
-      return config.gcpProject.backendServiceIds;
-    }
-
     @Provides
     @Config("baseDomain")
     public static String provideBaseDomain(RegistryConfigSettings config) {
@@ -391,27 +385,6 @@ public final class RegistryConfig {
       return config.cloudSql.jdbcUrl;
     }
 
-    @Provides
-    @Config("cloudSqlInstanceConnectionName")
-    public static String provideCloudSqlInstanceConnectionName(RegistryConfigSettings config) {
-      return config.cloudSql.instanceConnectionName;
-    }
-
-    @Provides
-    @Config("cloudSqlReplicaInstanceConnectionName")
-    public static Optional<String> provideCloudSqlReplicaInstanceConnectionName(
-        RegistryConfigSettings config) {
-      return Optional.ofNullable(config.cloudSql.replicaInstanceConnectionName);
-    }
-
-    @Provides
-    @Config("cloudSqlDbInstanceName")
-    public static String provideCloudSqlDbInstance(RegistryConfigSettings config) {
-      // Format of instanceConnectionName: project-id:region:instance-name
-      int lastColonIndex = config.cloudSql.instanceConnectionName.lastIndexOf(':');
-      return config.cloudSql.instanceConnectionName.substring(lastColonIndex + 1);
-    }
-
     @Provides
     @Config("cloudDnsRootUrl")
     public static Optional<String> getCloudDnsRootUrl(RegistryConfigSettings config) {
@@ -1126,12 +1099,6 @@ public final class RegistryConfig {
       return config.registryPolicy.greetingServerId;
     }
 
-    @Provides
-    @Config("activeKeyring")
-    public static String provideKeyring(RegistryConfigSettings config) {
-      return config.keyring.activeKeyring;
-    }
-
     @Provides
     @Config("customLogicFactoryClass")
     public static String provideCustomLogicFactoryClass(RegistryConfigSettings config) {
@@ -1743,6 +1710,17 @@ public final class RegistryConfig {
         CONFIG_SETTINGS.get().registryPolicy.tieredPricingPromotionRegistrarIds);
   }
 
+  /**
+   * Set of registrars for which we do not send poll messages on standard domain deletion.
+   *
+   * <p>For these registrars we won't send a poll message in order to avoid database contention. See
+   * b/379331882 for more details.
+   */
+  public static ImmutableSet<String> getNoPollMessageOnDeletionRegistrarIds() {
+    return ImmutableSet.copyOf(
+        CONFIG_SETTINGS.get().registryPolicy.noPollMessageOnDeletionRegistrarIds);
+  }
+
   /**
    * Memoizes loading of the {@link RegistryConfigSettings} POJO.
    *

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -37,7 +37,6 @@ public class RegistryConfigSettings {
   public Monitoring monitoring;
   public Misc misc;
   public Beam beam;
-  public Keyring keyring;
   public RegistryTool registryTool;
   public SslCertificateValidation sslCertificateValidation;
   public ContactHistory contactHistory;
@@ -56,7 +55,6 @@ public class RegistryConfigSettings {
     public String bsaServiceUrl;
     public String toolsServiceUrl;
     public String pubapiServiceUrl;
-    public Map<String, Long> backendServiceIds;
     public String baseDomain;
   }
 
@@ -115,6 +113,7 @@ public class RegistryConfigSettings {
     public boolean requireSslCertificates;
     public double sunriseDomainCreateDiscount;
     public Set<String> tieredPricingPromotionRegistrarIds;
+    public Set<String> noPollMessageOnDeletionRegistrarIds;
   }
 
   /** Configuration for Hibernate. */
@@ -133,7 +132,7 @@ public class RegistryConfigSettings {
   /** Configuration for Cloud SQL. */
   public static class CloudSql {
     public String jdbcUrl;
-    // TODO(05012021): remove username field after it is removed from all yaml files.
+    // TODO(05012021): remove 3 fields below after they are removed from all yaml files.
     public String username;
     public String instanceConnectionName;
     public String replicaInstanceConnectionName;
@@ -214,11 +213,6 @@ public class RegistryConfigSettings {
     public int transientFailureRetries;
   }
 
-  /** Configuration for keyrings (used to store secrets outside of source). */
-  public static class Keyring {
-    public String activeKeyring;
-  }
-
   /** Configuration options for the registry tool. */
   public static class RegistryTool {
     public String clientId;

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -24,15 +24,6 @@ gcpProject:
   toolsServiceUrl: https://tools.example.com
   pubapiServiceUrl: https://pubapi.example.com
 
-  # The backend service IDs created when setting up GKE routes. They will be included in the
-  # audience field in the JWT that IAP creates.
-  # See: https://cloud.google.com/iap/docs/signed-headers-howto#verifying_the_jwt_payload
-  backendServiceIds:
-    frontend: 12345
-    backend: 12345
-    pubapi: 12345
-    console: 12345
-
   # The base domain name of the registry service. Services are reachable at [service].baseDomain.
   baseDomain: registry.test
 
@@ -220,6 +211,9 @@ registryPolicy:
   # In addition, we will return the non-promotional (i.e. incorrect) price on
   # domain create requests.
   tieredPricingPromotionRegistrarIds: []
+  # List of registrars for which we won't send poll message on standard domain
+  # deletions.
+  noPollMessageOnDeletionRegistrarIds: []
 
 hibernate:
   # If set to false, calls to tm().transact() cannot be nested. If set to true,
@@ -494,11 +488,6 @@ beam:
   initialWorkerCount: 24
   stagingBucketUrl: gcs-bucket-with-staged-templates
 
-keyring:
-  # The name of the active keyring, either "Dummy" or "CSM". The latter stands
-  # for Cloud SecretManager.
-  activeKeyring: Dummy
-
 # Configuration options relevant to the "nomulus" registry tool.
 registryTool:
   # OAuth client ID used by the tool.

core/src/main/java/google/registry/config/files/nomulus-config-unittest.yaml

@@ -11,6 +11,8 @@ registryPolicy:
     Line 2 is this 1.
   tieredPricingPromotionRegistrarIds:
     - NewRegistrar
+  noPollMessageOnDeletionRegistrarIds:
+    - NewRegistrar
 
 caching:
   singletonCacheRefreshSeconds: 0

core/src/main/java/google/registry/flows/ExtensionManager.java

@@ -105,7 +105,7 @@ public final class ExtensionManager {
   }
 
   private static final ImmutableSet<EppRequestSource> ALLOWED_METADATA_EPP_REQUEST_SOURCES =
-      ImmutableSet.of(EppRequestSource.TOOL, EppRequestSource.BACKEND);
+      ImmutableSet.of(EppRequestSource.BACKEND, EppRequestSource.CONSOLE, EppRequestSource.TOOL);
 
   private void checkForRestrictedExtensions(
       ImmutableSet<Class<? extends CommandExtension>> suppliedExtensions)

core/src/main/java/google/registry/flows/FlowRunner.java

@@ -75,7 +75,8 @@ public class FlowRunner {
       flowReporter.recordToLogs();
     }
     eppMetricBuilder.setCommandNameFromFlow(flowClass.getSimpleName());
-    if (!isTransactional) {
+    // We may already be in a transaction, e.g., when invoked by DeleteExpiredDomainsAction.
+    if (!isTransactional || jpaTransactionManager.inTransaction()) {
       return EppOutput.create(flowProvider.get().run());
     }
     try {

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -14,7 +14,6 @@
 
 package google.registry.flows.domain;
 
-import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.dns.DnsUtils.requestDomainDnsRefresh;
 import static google.registry.flows.FlowUtils.persistEntityChanges;
@@ -120,9 +119,7 @@ import google.registry.model.tmch.ClaimsList;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.tmch.LordnTaskUtils.LordnPhase;
 import java.util.Optional;
-import javax.annotation.Nullable;
 import javax.inject.Inject;
-import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
@@ -363,9 +360,7 @@ public final class DomainCreateFlow implements MutatingFlow {
     // Create a new autorenew billing event and poll message starting at the expiration time.
     BillingRecurrence autorenewBillingEvent =
         createAutorenewBillingEvent(
-            domainHistoryId,
-            registrationExpirationTime,
-            getRenewalPriceInfo(isAnchorTenant, allocationToken));
+            domainHistoryId, registrationExpirationTime, isAnchorTenant, allocationToken);
     PollMessage.Autorenew autorenewPollMessage =
         createAutorenewPollMessage(domainHistoryId, registrationExpirationTime);
     ImmutableSet.Builder<ImmutableObject> entitiesToSave = new ImmutableSet.Builder<>();
@@ -625,7 +620,17 @@ public final class DomainCreateFlow implements MutatingFlow {
   private BillingRecurrence createAutorenewBillingEvent(
       HistoryEntryId domainHistoryId,
       DateTime registrationExpirationTime,
-      RenewalPriceInfo renewalpriceInfo) {
+      boolean isAnchorTenant,
+      Optional<AllocationToken> allocationToken) {
+    // Non-standard renewal behaviors can occur for anchor tenants (always NONPREMIUM pricing) or if
+    // explicitly configured in the token (either NONPREMIUM or directly SPECIFIED). Use DEFAULT if
+    // none is configured.
+    RenewalPriceBehavior renewalPriceBehavior =
+        isAnchorTenant
+            ? RenewalPriceBehavior.NONPREMIUM
+            : allocationToken
+                .map(AllocationToken::getRenewalPriceBehavior)
+                .orElse(RenewalPriceBehavior.DEFAULT);
     return new BillingRecurrence.Builder()
         .setReason(Reason.RENEW)
         .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
@@ -634,8 +639,8 @@ public final class DomainCreateFlow implements MutatingFlow {
         .setEventTime(registrationExpirationTime)
         .setRecurrenceEndTime(END_OF_TIME)
         .setDomainHistoryId(domainHistoryId)
-        .setRenewalPriceBehavior(renewalpriceInfo.renewalPriceBehavior())
-        .setRenewalPrice(renewalpriceInfo.renewalPrice())
+        .setRenewalPriceBehavior(renewalPriceBehavior)
+        .setRenewalPrice(allocationToken.flatMap(AllocationToken::getRenewalPrice).orElse(null))
         .build();
   }
 
@@ -679,41 +684,6 @@ public final class DomainCreateFlow implements MutatingFlow {
         .build();
   }
 
-  /**
-   * Determines the {@link RenewalPriceBehavior} and the renewal price that needs be stored in the
-   * {@link BillingRecurrence} billing events.
-   *
-   * <p>By default, the renewal price is calculated during the process of renewal. Renewal price
-   * should be the createCost if and only if the renewal price behavior in the {@link
-   * AllocationToken} is 'SPECIFIED'.
-   */
-  static RenewalPriceInfo getRenewalPriceInfo(
-      boolean isAnchorTenant, Optional<AllocationToken> allocationToken) {
-    if (isAnchorTenant) {
-      allocationToken.ifPresent(
-          token ->
-              checkArgument(
-                  token.getRenewalPriceBehavior() != RenewalPriceBehavior.SPECIFIED,
-                  "Renewal price behavior cannot be SPECIFIED for anchor tenant"));
-      return RenewalPriceInfo.create(RenewalPriceBehavior.NONPREMIUM, null);
-    } else if (allocationToken.isPresent()
-        && allocationToken.get().getRenewalPriceBehavior() == RenewalPriceBehavior.SPECIFIED) {
-      return RenewalPriceInfo.create(
-          RenewalPriceBehavior.SPECIFIED, allocationToken.get().getRenewalPrice().get());
-    } else {
-      return RenewalPriceInfo.create(RenewalPriceBehavior.DEFAULT, null);
-    }
-  }
-
-  /** A record to store renewal info used in {@link BillingRecurrence} billing events. */
-  public record RenewalPriceInfo(
-      RenewalPriceBehavior renewalPriceBehavior, @Nullable Money renewalPrice) {
-    static RenewalPriceInfo create(
-        RenewalPriceBehavior renewalPriceBehavior, @Nullable Money renewalPrice) {
-      return new RenewalPriceInfo(renewalPriceBehavior, renewalPrice);
-    }
-  }
-
   private static ImmutableList<FeeTransformResponseExtension> createResponseExtensions(
       Optional<FeeCreateCommandExtension> feeCreate, FeesAndCredits feesAndCredits) {
     return feeCreate

core/src/main/java/google/registry/flows/domain/DomainDeleteFlow.java

@@ -44,7 +44,9 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Sets;
+import com.google.common.flogger.FluentLogger;
 import google.registry.batch.AsyncTaskEnqueuer;
+import google.registry.config.RegistryConfig;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.AssociationProhibitsOperationException;
 import google.registry.flows.ExtensionManager;
@@ -117,6 +119,8 @@ import org.joda.time.Duration;
 @ReportingSpec(ActivityReportField.DOMAIN_DELETE)
 public final class DomainDeleteFlow implements MutatingFlow {
 
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
   private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
       StatusValue.CLIENT_DELETE_PROHIBITED,
       StatusValue.PENDING_DELETE,
@@ -212,10 +216,17 @@ public final class DomainDeleteFlow implements MutatingFlow {
     // superuser (i.e. the registrar didn't request this delete and thus should be notified even if
     // it is synchronous).
     if (durationUntilDelete.isLongerThan(Duration.ZERO) || isSuperuser) {
-      PollMessage.OneTime deletePollMessage =
-          createDeletePollMessage(existingDomain, domainHistoryId, deletionTime);
-      entitiesToSave.add(deletePollMessage);
-      builder.setDeletePollMessage(deletePollMessage.createVKey());
+      if (RegistryConfig.getNoPollMessageOnDeletionRegistrarIds()
+          .contains(existingDomain.getCurrentSponsorRegistrarId())) {
+        logger.atInfo().log(
+            "Skipping poll message on domain deletion for registrar %s due to configuration",
+            existingDomain.getCurrentSponsorRegistrarId());
+      } else {
+        PollMessage.OneTime deletePollMessage =
+            createDeletePollMessage(existingDomain, domainHistoryId, deletionTime);
+        entitiesToSave.add(deletePollMessage);
+        builder.setDeletePollMessage(deletePollMessage.createVKey());
+      }
     }
 
     // Send a second poll message immediately if the domain is being deleted asynchronously by a

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -85,14 +85,10 @@ public final class DomainPricingLogic {
       createFee = Fee.create(zeroInCurrency(currency), FeeType.CREATE, false);
     } else {
       DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
-      if (allocationToken.isPresent()
-          && allocationToken
-              .get()
-              .getRegistrationBehavior()
-              .equals(RegistrationBehavior.NONPREMIUM_CREATE)) {
+      if (allocationToken.isPresent()) {
+        // Handle any special NONPREMIUM / SPECIFIED cases configured in the token
         domainPrices =
-            DomainPrices.create(
-                false, tld.getCreateBillingCost(dateTime), domainPrices.getRenewCost());
+            applyTokenToDomainPrices(domainPrices, tld, dateTime, years, allocationToken.get());
       }
       Money domainCreateCost =
           getDomainCreateCostWithDiscount(domainPrices, years, allocationToken, tld);
@@ -357,6 +353,27 @@ public final class DomainPricingLogic {
     return totalDomainFlowCost;
   }
 
+  private DomainPrices applyTokenToDomainPrices(
+      DomainPrices domainPrices, Tld tld, DateTime dateTime, int years, AllocationToken token) {
+    // Convert to nonpremium iff no premium charges are included (either in create or any renewal)
+    boolean convertToNonPremium =
+        token.getRegistrationBehavior().equals(RegistrationBehavior.NONPREMIUM_CREATE)
+            && (years == 1
+                || !token.getRenewalPriceBehavior().equals(RenewalPriceBehavior.DEFAULT));
+    boolean isPremium = domainPrices.isPremium() && !convertToNonPremium;
+    Money createCost =
+        token.getRegistrationBehavior().equals(RegistrationBehavior.NONPREMIUM_CREATE)
+            ? tld.getCreateBillingCost(dateTime)
+            : domainPrices.getCreateCost();
+    Money renewCost =
+        token.getRenewalPriceBehavior().equals(RenewalPriceBehavior.NONPREMIUM)
+            ? tld.getStandardRenewCost(dateTime)
+            : token.getRenewalPriceBehavior().equals(RenewalPriceBehavior.SPECIFIED)
+                ? token.getRenewalPrice().get()
+                : domainPrices.getRenewCost();
+    return DomainPrices.create(isPremium, createCost, renewCost);
+  }
+
   /** An allocation token was provided that is invalid for premium domains. */
   public static class AllocationTokenInvalidForPremiumNameException
       extends CommandUseErrorException {

core/src/main/java/google/registry/flows/domain/DomainRestoreRequestFlow.java

@@ -183,7 +183,9 @@ public final class DomainRestoreRequestFlow implements MutatingFlow {
     DomainHistory domainHistory = buildDomainHistory(newDomain, now);
     entitiesToSave.add(newDomain, domainHistory, autorenewEvent, autorenewPollMessage);
     tm().putAll(entitiesToSave.build());
-    tm().delete(existingDomain.getDeletePollMessage());
+    if (existingDomain.getDeletePollMessage() != null) {
+      tm().delete(existingDomain.getDeletePollMessage());
+    }
     requestDomainDnsRefresh(existingDomain.getDomainName());
     return responseBuilder
         .setExtensions(createResponseExtensions(feesAndCredits, feeUpdate, isExpired))

core/src/main/java/google/registry/flows/poll/PollAckFlow.java

@@ -37,6 +37,8 @@ import google.registry.model.poll.MessageQueueInfo;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.poll.PollMessageExternalKeyConverter;
 import google.registry.model.poll.PollMessageExternalKeyConverter.PollMessageExternalKeyParseException;
+import google.registry.persistence.IsolationLevel;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.VKey;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -55,6 +57,7 @@ import org.joda.time.DateTime;
  * @error {@link PollAckFlow.MissingMessageIdException}
  * @error {@link PollAckFlow.NotAuthorizedToAckMessageException}
  */
+@IsolationLevel(value = TransactionIsolationLevel.TRANSACTION_READ_COMMITTED)
 public final class PollAckFlow implements MutatingFlow {
 
   @Inject ExtensionManager extensionManager;

core/src/main/java/google/registry/flows/poll/PollRequestFlow.java

@@ -32,6 +32,8 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.MessageQueueInfo;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.poll.PollMessageExternalKeyConverter;
+import google.registry.persistence.IsolationLevel;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import java.util.Optional;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
@@ -47,6 +49,7 @@ import org.joda.time.DateTime;
  *
  * @error {@link PollRequestFlow.UnexpectedMessageIdException}
  */
+@IsolationLevel(value = TransactionIsolationLevel.TRANSACTION_READ_COMMITTED)
 public final class PollRequestFlow implements TransactionalFlow {
 
   @Inject ExtensionManager extensionManager;

core/src/main/java/google/registry/keyring/KeyringModule.java

@@ -14,28 +14,41 @@
 
 package google.registry.keyring;
 
-import static com.google.common.base.Preconditions.checkState;
-
+import dagger.Binds;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.keyring.api.Keyring;
-import java.util.Map;
+import google.registry.keyring.secretmanager.SecretManagerKeyring;
+import java.util.Optional;
 import javax.inject.Singleton;
 
 /** Dagger module for {@link Keyring} */
 @Module
-public final class KeyringModule {
+public abstract class KeyringModule {
+
+  @Binds
+  @Singleton
+  public abstract Keyring provideKeyring(SecretManagerKeyring keyring);
 
   @Provides
-  @Singleton
-  public static Keyring provideKeyring(
-      Map<String, Keyring> keyrings, @Config("activeKeyring") String activeKeyring) {
-    checkState(
-        keyrings.containsKey(activeKeyring),
-        "Invalid Keyring %s is configured; valid choices are %s",
-        activeKeyring,
-        keyrings.keySet());
-    return keyrings.get(activeKeyring);
+  @Config("cloudSqlInstanceConnectionName")
+  public static String provideCloudSqlInstanceConnectionName(Keyring keyring) {
+    return keyring.getSqlPrimaryConnectionName();
+  }
+
+  @Provides
+  @Config("cloudSqlReplicaInstanceConnectionName")
+  public static Optional<String> provideCloudSqlReplicaInstanceConnectionName(Keyring keyring) {
+    return Optional.ofNullable(keyring.getSqlReplicaConnectionName());
+  }
+
+  @Provides
+  @Config("cloudSqlDbInstanceName")
+  public static String provideCloudSqlDbInstance(
+      @Config("cloudSqlInstanceConnectionName") String instanceConnectionName) {
+    // Format of instanceConnectionName: project-id:region:instance-name
+    int lastColonIndex = instanceConnectionName.lastIndexOf(':');
+    return instanceConnectionName.substring(lastColonIndex + 1);
   }
 }

core/src/main/java/google/registry/keyring/api/ComparatorKeyring.java

@@ -1,205 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.keyring.api;
-
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.base.MoreObjects;
-import com.google.common.flogger.FluentLogger;
-import google.registry.util.ComparingInvocationHandler;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.Objects;
-import javax.annotation.Nullable;
-import org.bouncycastle.bcpg.BCPGKey;
-import org.bouncycastle.bcpg.PublicKeyPacket;
-import org.bouncycastle.openpgp.PGPKeyPair;
-import org.bouncycastle.openpgp.PGPPrivateKey;
-import org.bouncycastle.openpgp.PGPPublicKey;
-
-/**
- * Checks that a second keyring returns the same result as the current one.
- *
- * <p>Will behave exactly like the "actualKeyring" - as in will throw / return the exact same values
- * - no matter what the "secondKeyring" does. But will log a warning if "secondKeyring" acts
- * differently than "actualKeyring".
- *
- * <p>If both keyrings threw exceptions, there is no check whether the exeptions are the same. The
- * assumption is that an error happened in both, but they might report that error differently.
- */
-public final class ComparatorKeyring extends ComparingInvocationHandler<Keyring> {
-
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private ComparatorKeyring(Keyring original, Keyring second) {
-    super(Keyring.class, original, second);
-  }
-
-  /**
-   * Returns an instance of Keyring that is an exact proxy of "original".
-   *
-   * <p>This proxy will log any differences in return value or thrown exceptions with "second".
-   */
-  public static Keyring create(Keyring original, Keyring second) {
-    return new ComparatorKeyring(original, second).makeProxy();
-  }
-
-  @Override
-  protected void log(Method method, String message) {
-    logger.atSevere().log("ComparatorKeyring.%s: %s", method.getName(), message);
-  }
-
-  /** Implements equals for the PGP classes. */
-  @Override
-  protected boolean compareResults(Method method, @Nullable Object a, @Nullable Object b) {
-    Class<?> clazz = method.getReturnType();
-    if (PGPPublicKey.class.equals(clazz)) {
-      return compare((PGPPublicKey) a, (PGPPublicKey) b);
-    }
-    if (PGPPrivateKey.class.equals(clazz)) {
-      return compare((PGPPrivateKey) a, (PGPPrivateKey) b);
-    }
-    if (PGPKeyPair.class.equals(clazz)) {
-      return compare((PGPKeyPair) a, (PGPKeyPair) b);
-    }
-    return super.compareResults(method, a, b);
-  }
-
-  /** Implements toString for the PGP classes. */
-  @Override
-  protected String stringifyResult(Method method, @Nullable Object a) {
-    Class<?> clazz = method.getReturnType();
-    if (PGPPublicKey.class.equals(clazz)) {
-      return stringify((PGPPublicKey) a);
-    }
-    if (PGPPrivateKey.class.equals(clazz)) {
-      return stringify((PGPPrivateKey) a);
-    }
-    if (PGPKeyPair.class.equals(clazz)) {
-      return stringify((PGPKeyPair) a);
-    }
-    return super.stringifyResult(method, a);
-  }
-
-  @Override
-  protected String stringifyThrown(Method method, Throwable throwable) {
-    StringWriter stringWriter = new StringWriter();
-    PrintWriter printWriter = new PrintWriter(stringWriter);
-    throwable.printStackTrace(printWriter);
-    return String.format("%s\nStack trace:\n%s", throwable.toString(), stringWriter.toString());
-  }
-
-  // .equals implementation for PGP types.
-
-  @VisibleForTesting
-  static boolean compare(@Nullable PGPKeyPair a, @Nullable PGPKeyPair b) {
-    if (a == null || b == null) {
-      return a == null && b == null;
-    }
-    return compare(a.getPublicKey(), b.getPublicKey())
-        && compare(a.getPrivateKey(), b.getPrivateKey());
-  }
-
-  @VisibleForTesting
-  static boolean compare(@Nullable PGPPublicKey a, @Nullable PGPPublicKey b) {
-    if (a == null || b == null) {
-      return a == null && b == null;
-    }
-    try {
-      return Arrays.equals(a.getFingerprint(), b.getFingerprint())
-          && Arrays.equals(a.getEncoded(), b.getEncoded());
-    } catch (IOException e) {
-      logger.atSevere().withCause(e).log(
-          "ComparatorKeyring error: PGPPublicKey.getEncoded failed.");
-      return false;
-    }
-  }
-
-  @VisibleForTesting
-  static boolean compare(@Nullable PGPPrivateKey a, @Nullable PGPPrivateKey b) {
-    if (a == null || b == null) {
-      return a == null && b == null;
-    }
-    return a.getKeyID() == b.getKeyID()
-        && compare(a.getPrivateKeyDataPacket(), b.getPrivateKeyDataPacket())
-        && compare(a.getPublicKeyPacket(), b.getPublicKeyPacket());
-  }
-
-  @VisibleForTesting
-  static boolean compare(PublicKeyPacket a, PublicKeyPacket b) {
-    if (a == null || b == null) {
-      return a == null && b == null;
-    }
-    try {
-      return Arrays.equals(a.getEncoded(), b.getEncoded());
-    } catch (IOException e) {
-      logger.atSevere().withCause(e).log(
-          "ComparatorKeyring error: PublicKeyPacket.getEncoded failed.");
-      return false;
-    }
-  }
-
-  @VisibleForTesting
-  static boolean compare(BCPGKey a, BCPGKey b) {
-    if (a == null || b == null) {
-      return a == null && b == null;
-    }
-    return Objects.equals(a.getFormat(), b.getFormat())
-        && Arrays.equals(a.getEncoded(), b.getEncoded());
-  }
-
-  // toString implementations
-
-  @VisibleForTesting
-  static String stringify(PGPKeyPair a) {
-    if (a == null) {
-      return "null";
-    }
-    return MoreObjects.toStringHelper(PGPKeyPair.class)
-        .addValue(stringify(a.getPublicKey()))
-        .addValue(stringify(a.getPrivateKey()))
-        .toString();
-  }
-
-  @VisibleForTesting
-  static String stringify(PGPPublicKey a) {
-    if (a == null) {
-      return "null";
-    }
-
-    StringBuilder builder = new StringBuilder();
-    for (byte b : a.getFingerprint()) {
-      builder.append(String.format("%02x:", b));
-    }
-    return MoreObjects.toStringHelper(PGPPublicKey.class)
-        .add("fingerprint", builder.toString())
-        .toString();
-  }
-
-  @VisibleForTesting
-  static String stringify(PGPPrivateKey a) {
-    if (a == null) {
-      return "null";
-    }
-
-    // We need to be careful what information we output here. The private key should be private, and
-    // I'm not sure what is safe to put in the logs.
-    return MoreObjects.toStringHelper(PGPPrivateKey.class)
-        .add("keyId", a.getKeyID())
-        .toString();
-  }
-}

core/src/main/java/google/registry/keyring/api/DummyKeyringModule.java

@@ -1,131 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.keyring.api;
-
-import static com.google.common.io.Resources.getResource;
-import static google.registry.keyring.api.PgpHelper.KeyRequirement.ENCRYPT_SIGN;
-import static google.registry.keyring.api.PgpHelper.lookupKeyPair;
-
-import com.google.common.base.VerifyException;
-import com.google.common.io.ByteSource;
-import com.google.common.io.Resources;
-import dagger.Binds;
-import dagger.Module;
-import dagger.Provides;
-import dagger.multibindings.IntoMap;
-import dagger.multibindings.StringKey;
-import java.io.IOException;
-import java.io.InputStream;
-import javax.annotation.concurrent.Immutable;
-import javax.inject.Named;
-import org.bouncycastle.openpgp.PGPException;
-import org.bouncycastle.openpgp.PGPKeyPair;
-import org.bouncycastle.openpgp.PGPPublicKeyRingCollection;
-import org.bouncycastle.openpgp.PGPSecretKeyRingCollection;
-import org.bouncycastle.openpgp.PGPUtil;
-import org.bouncycastle.openpgp.bc.BcPGPPublicKeyRingCollection;
-import org.bouncycastle.openpgp.bc.BcPGPSecretKeyRingCollection;
-
-/**
- * Dagger keyring module that provides an {@link InMemoryKeyring} instance populated with dummy
- * values.
- *
- * <p>This dummy module allows the domain registry code to compile and run in an unmodified state,
- * with all attempted outgoing connections failing because the supplied dummy credentials aren't
- * valid. For a real system that needs to connect with external services, you should replace this
- * module with one that loads real credentials from secure sources.
- *
- * <p>The dummy PGP keyrings are created using gnupg1/pgp1 roughly like the following (using
- * gnupg2/pgp2 is an exercise left for the developer):
- *
- * <pre>{@code
- * # mkdir gpg
- * # chmod 700 gpg
- * # gpg1 --homedir gpg --gen-key <<<EOF
- * 1
- * 1024
- * 0
- * Y
- * Test Registry
- * test-registry@example.com
- *
- * O
- * EOF
- * [press enter twice at keyring password prompts]
- * # gpg1 --homedir gpg -a -o pgp-public-keyring.asc --export test-registry@example.com
- * # gpg1 --homedir gpg -a -o pgp-private-keyring.asc --export-secret-keys test-registry@example.com
- * # mv pgp*keyring.asc java/google/registry/keyring/api
- * # rm -rf gpg
- * }</pre>
- */
-@Module
-@Immutable
-public abstract class DummyKeyringModule {
-
-  public static final String NAME = "Dummy";
-
-  /** The contents of a dummy PGP public key stored in a file. */
-  private static final ByteSource PGP_PUBLIC_KEYRING =
-      Resources.asByteSource(getResource(InMemoryKeyring.class, "pgp-public-keyring.asc"));
-
-  /** The contents of a dummy PGP private key stored in a file. */
-  private static final ByteSource PGP_PRIVATE_KEYRING =
-      Resources.asByteSource(getResource(InMemoryKeyring.class, "pgp-private-keyring.asc"));
-
-  /** The email address of the aforementioned PGP key. */
-  private static final String EMAIL_ADDRESS = "test-registry@example.com";
-
-  @Binds
-  @IntoMap
-  @StringKey(NAME)
-  abstract Keyring provideKeyring(@Named("DummyKeyring") InMemoryKeyring keyring);
-
-  /** Always returns a {@link InMemoryKeyring} instance. */
-  @Provides
-  @Named("DummyKeyring")
-  static InMemoryKeyring provideDummyKeyring() {
-    PGPKeyPair dummyKey;
-    try (InputStream publicInput = PGP_PUBLIC_KEYRING.openStream();
-        InputStream privateInput = PGP_PRIVATE_KEYRING.openStream()) {
-      PGPPublicKeyRingCollection publicKeys =
-          new BcPGPPublicKeyRingCollection(PGPUtil.getDecoderStream(publicInput));
-      PGPSecretKeyRingCollection privateKeys =
-          new BcPGPSecretKeyRingCollection(PGPUtil.getDecoderStream(privateInput));
-      dummyKey = lookupKeyPair(publicKeys, privateKeys, EMAIL_ADDRESS, ENCRYPT_SIGN);
-    } catch (PGPException | IOException e) {
-      throw new VerifyException("Failed to load PGP keys from jar", e);
-    }
-    // Use the same dummy PGP keypair for all required PGP keys -- a real production system would
-    // have different values for these keys.  Pass dummy values for all Strings.
-    return new InMemoryKeyring(
-        dummyKey,
-        dummyKey,
-        dummyKey.getPublicKey(),
-        dummyKey,
-        dummyKey.getPublicKey(),
-        "not a real key",
-        "not a real key",
-        "not a real password",
-        "not a real API key",
-        "not a real login",
-        "not a real password",
-        "not a real login",
-        "not a real credential",
-        "not a real password",
-        "not a real password");
-  }
-
-  private DummyKeyringModule() {}
-}

core/src/main/java/google/registry/keyring/api/InMemoryKeyring.java

@@ -1,159 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.keyring.api;
-
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Preconditions.checkNotNull;
-
-import javax.annotation.concurrent.Immutable;
-import org.bouncycastle.openpgp.PGPKeyPair;
-import org.bouncycastle.openpgp.PGPPrivateKey;
-import org.bouncycastle.openpgp.PGPPublicKey;
-
-/** A {@link Keyring} that uses in-memory values for all credentials. */
-@Immutable
-public final class InMemoryKeyring implements Keyring {
-
-  private final PGPKeyPair rdeStagingKey;
-  private final PGPKeyPair rdeSigningKey;
-  private final PGPPublicKey rdeReceiverKey;
-  private final PGPKeyPair brdaSigningKey;
-  private final PGPPublicKey brdaEncryptionKey;
-  private final String rdeSshClientPublicKey;
-  private final String rdeSshClientPrivateKey;
-  private final String icannReportingPassword;
-  private final String safeBrowsingAPIKey;
-  private final String marksdbDnlLoginAndPassword;
-  private final String marksdbLordnPassword;
-  private final String marksdbSmdrlLoginAndPassword;
-  private final String bsaApiKey;
-
-  public InMemoryKeyring(
-      PGPKeyPair rdeStagingKey,
-      PGPKeyPair rdeSigningKey,
-      PGPPublicKey rdeReceiverKey,
-      PGPKeyPair brdaSigningKey,
-      PGPPublicKey brdaEncryptionKey,
-      String rdeSshClientPublicKey,
-      String rdeSshClientPrivateKey,
-      String icannReportingPassword,
-      String safeBrowsingAPIKey,
-      String marksdbDnlLoginAndPassword,
-      String marksdbLordnPassword,
-      String marksdbSmdrlLoginAndPassword,
-      String cloudSqlPassword,
-      String toolsCloudSqlPassword,
-      String bsaApiKey) {
-    checkArgument(PgpHelper.isSigningKey(rdeSigningKey.getPublicKey()),
-        "RDE signing key must support signing: %s", rdeSigningKey.getKeyID());
-    checkArgument(rdeStagingKey.getPublicKey().isEncryptionKey(),
-        "staging key must support encryption: %s", rdeStagingKey.getKeyID());
-    checkArgument(rdeReceiverKey.isEncryptionKey(),
-        "receiver key must support encryption: %s", rdeReceiverKey.getKeyID());
-    checkArgument(PgpHelper.isSigningKey(brdaSigningKey.getPublicKey()),
-        "BRDA signing key must support signing: %s", brdaSigningKey.getKeyID());
-    checkArgument(brdaEncryptionKey.isEncryptionKey(),
-        "encryption key must support encryption: %s", brdaEncryptionKey.getKeyID());
-    this.rdeStagingKey = rdeStagingKey;
-    this.rdeSigningKey = rdeSigningKey;
-    this.rdeReceiverKey = rdeReceiverKey;
-    this.brdaSigningKey = brdaSigningKey;
-    this.brdaEncryptionKey = brdaEncryptionKey;
-    this.rdeSshClientPublicKey = checkNotNull(rdeSshClientPublicKey, "rdeSshClientPublicKey");
-    this.rdeSshClientPrivateKey = checkNotNull(rdeSshClientPrivateKey, "rdeSshClientPrivateKey");
-    this.icannReportingPassword = checkNotNull(icannReportingPassword, "icannReportingPassword");
-    this.safeBrowsingAPIKey = checkNotNull(safeBrowsingAPIKey, "safeBrowsingAPIKey");
-    this.marksdbDnlLoginAndPassword =
-        checkNotNull(marksdbDnlLoginAndPassword, "marksdbDnlLoginAndPassword");
-    this.marksdbLordnPassword = checkNotNull(marksdbLordnPassword, "marksdbLordnPassword");
-    this.marksdbSmdrlLoginAndPassword =
-        checkNotNull(marksdbSmdrlLoginAndPassword, "marksdbSmdrlLoginAndPassword");
-    this.bsaApiKey = checkNotNull(bsaApiKey, "bsaApiKey");
-  }
-
-  @Override
-  public PGPKeyPair getRdeSigningKey() {
-    return rdeSigningKey;
-  }
-
-  @Override
-  public PGPPublicKey getRdeStagingEncryptionKey() {
-    return rdeStagingKey.getPublicKey();
-  }
-
-  @Override
-  public PGPPrivateKey getRdeStagingDecryptionKey() {
-    return rdeStagingKey.getPrivateKey();
-  }
-
-  @Override
-  public PGPPublicKey getRdeReceiverKey() {
-    return rdeReceiverKey;
-  }
-
-  @Override
-  public PGPKeyPair getBrdaSigningKey() {
-    return brdaSigningKey;
-  }
-
-  @Override
-  public PGPPublicKey getBrdaReceiverKey() {
-    return brdaEncryptionKey;
-  }
-
-  @Override
-  public String getRdeSshClientPublicKey() {
-    return rdeSshClientPublicKey;
-  }
-
-  @Override
-  public String getRdeSshClientPrivateKey() {
-    return rdeSshClientPrivateKey;
-  }
-
-  @Override
-  public String getIcannReportingPassword() {
-    return icannReportingPassword;
-  }
-
-  @Override
-  public String getSafeBrowsingAPIKey() {
-    return safeBrowsingAPIKey;
-  }
-
-    @Override
-  public String getMarksdbDnlLoginAndPassword() {
-    return marksdbDnlLoginAndPassword;
-  }
-
-  @Override
-  public String getMarksdbLordnPassword() {
-    return marksdbLordnPassword;
-  }
-
-  @Override
-  public String getMarksdbSmdrlLoginAndPassword() {
-    return marksdbSmdrlLoginAndPassword;
-  }
-
-  @Override
-  public String getBsaApiKey() {
-    return bsaApiKey;
-  }
-
-  /** Does nothing. */
-  @Override
-  public void close() {}
-}

core/src/main/java/google/registry/keyring/api/Keyring.java

@@ -148,6 +148,12 @@ public interface Keyring extends AutoCloseable {
   /** Returns the API_KEY for authentication with the BSA portal. */
   String getBsaApiKey();
 
+  /** Returns the Cloud SQL connection name of the primary database instance. */
+  String getSqlPrimaryConnectionName();
+
+  /** Returns the Cloud SQL connection name of the replica database instance. */
+  String getSqlReplicaConnectionName();
+
   // Don't throw so try-with-resources works better.
   @Override
   void close();

core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyring.java

@@ -57,14 +57,16 @@ public class SecretManagerKeyring implements Keyring {
 
   /** Key labels for string secrets. */
   enum StringKeyLabel {
-    SAFE_BROWSING_API_KEY,
     BSA_API_KEY_STRING,
     ICANN_REPORTING_PASSWORD_STRING,
     MARKSDB_DNL_LOGIN_STRING,
     MARKSDB_LORDN_PASSWORD_STRING,
     MARKSDB_SMDRL_LOGIN_STRING,
     RDE_SSH_CLIENT_PRIVATE_STRING,
-    RDE_SSH_CLIENT_PUBLIC_STRING;
+    RDE_SSH_CLIENT_PUBLIC_STRING,
+    SAFE_BROWSING_API_KEY,
+    SQL_PRIMARY_CONN_NAME,
+    SQL_REPLICA_CONN_NAME;
 
     String getLabel() {
       return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
@@ -148,6 +150,16 @@ public class SecretManagerKeyring implements Keyring {
     return getString(StringKeyLabel.BSA_API_KEY_STRING);
   }
 
+  @Override
+  public String getSqlPrimaryConnectionName() {
+    return getString(StringKeyLabel.SQL_PRIMARY_CONN_NAME);
+  }
+
+  @Override
+  public String getSqlReplicaConnectionName() {
+    return getString(StringKeyLabel.SQL_REPLICA_CONN_NAME);
+  }
+
   /** No persistent resources are maintained for this Keyring implementation. */
   @Override
   public void close() {}

core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringModule.java

@@ -1,40 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.keyring.secretmanager;
-
-import dagger.Binds;
-import dagger.Module;
-import dagger.multibindings.IntoMap;
-import dagger.multibindings.StringKey;
-import google.registry.keyring.api.Keyring;
-
-/** Dagger module for {@link Keyring} backed by the Cloud SecretManager. */
-@Module
-public abstract class SecretManagerKeyringModule {
-
-  public static final String NAME = "CSM";
-  // TODO(b/257276342): Remove after configs in nomulus-internal are updated.
-  public static final String DEPRECATED_NAME = "KMS";
-
-  @Binds
-  @IntoMap
-  @StringKey(DEPRECATED_NAME)
-  abstract Keyring provideDeprecatedKeyring(SecretManagerKeyring keyring);
-
-  @Binds
-  @IntoMap
-  @StringKey(NAME)
-  abstract Keyring provideKeyring(SecretManagerKeyring keyring);
-}

core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdater.java

@@ -32,6 +32,8 @@ import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringK
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.RDE_SSH_CLIENT_PRIVATE_STRING;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.RDE_SSH_CLIENT_PUBLIC_STRING;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SAFE_BROWSING_API_KEY;
+import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_PRIMARY_CONN_NAME;
+import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_REPLICA_CONN_NAME;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
 import com.google.common.flogger.FluentLogger;
@@ -124,6 +126,14 @@ public final class SecretManagerKeyringUpdater {
     return setString(credential, BSA_API_KEY_STRING);
   }
 
+  public SecretManagerKeyringUpdater setSqlPrimaryConnectionName(String name) {
+    return setString(name, SQL_PRIMARY_CONN_NAME);
+  }
+
+  public SecretManagerKeyringUpdater setSqlReplicaConnectionName(String name) {
+    return setString(name, SQL_REPLICA_CONN_NAME);
+  }
+
   /**
    * Persists the secrets in the Secret Manager.
    *

core/src/main/java/google/registry/model/billing/BillingCancellation.java

@@ -45,10 +45,11 @@ import org.joda.time.DateTime;
       @Index(columnList = "eventTime"),
       @Index(columnList = "domainRepoId"),
       @Index(columnList = "billingTime"),
-      @Index(columnList = "billing_event_id"),
-      @Index(columnList = "billing_recurrence_id")
+      @Index(columnList = "billingEventId"),
+      @Index(columnList = "billingRecurrenceId"),
+      @Index(columnList = "domainRepoId,domainHistoryRevisionId")
     })
-@AttributeOverride(name = "id", column = @Column(name = "billing_cancellation_id"))
+@AttributeOverride(name = "id", column = @Column(name = "billingCancellationId"))
 @WithVKey(Long.class)
 public class BillingCancellation extends BillingBase {
 

core/src/main/java/google/registry/model/billing/BillingEvent.java

@@ -42,7 +42,9 @@ import org.joda.time.DateTime;
       @Index(columnList = "syntheticCreationTime"),
       @Index(columnList = "domainRepoId"),
       @Index(columnList = "allocationToken"),
-      @Index(columnList = "cancellation_matching_billing_recurrence_id")
+      @Index(columnList = "cancellationMatchingBillingRecurrenceId"),
+      @Index(columnList = "domainRepoId,domainHistoryRevisionId"),
+      @Index(columnList = "domainRepoId,recurrenceHistoryRevisionId")
     })
 @AttributeOverride(name = "id", column = @Column(name = "billing_event_id"))
 @WithVKey(Long.class)

core/src/main/java/google/registry/model/billing/BillingRecurrence.java

@@ -50,7 +50,8 @@ import org.joda.time.DateTime;
       @Index(columnList = "domainRepoId"),
       @Index(columnList = "recurrenceEndTime"),
       @Index(columnList = "recurrenceLastExpansion"),
-      @Index(columnList = "recurrence_time_of_year")
+      @Index(columnList = "recurrenceTimeOfYear"),
+      @Index(columnList = "domainRepoId,domainHistoryRevisionId")
     })
 @AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
 @WithVKey(Long.class)

core/src/main/java/google/registry/model/domain/GracePeriod.java

@@ -180,7 +180,11 @@ public class GracePeriod extends GracePeriodBase {
 
   /** Entity class to represent a historic {@link GracePeriod}. */
   @Entity(name = "GracePeriodHistory")
-  @Table(indexes = @Index(columnList = "domainRepoId"))
+  @Table(
+      indexes = {
+        @Index(columnList = "domainRepoId"),
+        @Index(columnList = "domainRepoId,domainHistoryRevisionId")
+      })
   public static class GracePeriodHistory extends GracePeriodBase {
     @Id Long gracePeriodHistoryRevisionId;
 

core/src/main/java/google/registry/model/domain/secdns/DomainDsDataHistory.java

@@ -23,9 +23,12 @@ import jakarta.persistence.AccessType;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
+import jakarta.persistence.Index;
+import jakarta.persistence.Table;
 
 /** Entity class to represent a historic {@link DomainDsData}. */
 @Entity
+@Table(indexes = @Index(columnList = "domainRepoId,domainHistoryRevisionId"))
 public class DomainDsDataHistory extends DomainDsDataBase {
 
   @Id Long dsDataHistoryRevisionId;

core/src/main/java/google/registry/model/poll/PollMessage.java

@@ -89,8 +89,9 @@ import org.joda.time.DateTime;
 @Table(
     indexes = {
       @Index(columnList = "domainRepoId"),
-      @Index(columnList = "registrar_id"),
-      @Index(columnList = "eventTime")
+      @Index(columnList = "registrarId"),
+      @Index(columnList = "eventTime"),
+      @Index(columnList = "domainRepoId,domainHistoryRevisionId")
     })
 public abstract class PollMessage extends ImmutableObject
     implements Buildable, TransferServerApproveEntity, UnsafeSerializable {

core/src/main/java/google/registry/model/reporting/DomainTransactionRecord.java

@@ -29,6 +29,8 @@ import jakarta.persistence.Enumerated;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
+import jakarta.persistence.Index;
+import jakarta.persistence.Table;
 import org.joda.time.DateTime;
 
 /**
@@ -42,6 +44,7 @@ import org.joda.time.DateTime;
  * uses HistoryEntry.otherClientId because the losing party in a transfer is always the otherClient.
  */
 @Entity
+@Table(indexes = @Index(columnList = "domainRepoId,historyRevisionId"))
 public class DomainTransactionRecord extends ImmutableObject
     implements Buildable, UnsafeSerializable {
 

core/src/main/java/google/registry/module/RegistryComponent.java

@@ -35,9 +35,7 @@ import google.registry.groups.GmailModule;
 import google.registry.groups.GroupsModule;
 import google.registry.groups.GroupssettingsModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.RegistryComponent.RegistryModule;
 import google.registry.module.RequestComponent.RequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
@@ -69,7 +67,6 @@ import javax.inject.Singleton;
       CustomLogicFactoryModule.class,
       DirectoryModule.class,
       DriveModule.class,
-      DummyKeyringModule.class,
       GmailModule.class,
       GroupsModule.class,
       GroupssettingsModule.class,
@@ -81,7 +78,6 @@ import javax.inject.Singleton;
       PersistenceModule.class,
       RegistryModule.class,
       RequestComponentModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       ServerTridProviderModule.class,
       SheetsServiceModule.class,

core/src/main/java/google/registry/module/RegistryServlet.java

@@ -14,7 +14,9 @@
 
 package google.registry.module;
 
+import static google.registry.util.GcpJsonFormatter.setCurrentRequest;
 import static google.registry.util.GcpJsonFormatter.setCurrentTraceId;
+import static google.registry.util.GcpJsonFormatter.unsetCurrentRequest;
 import static google.registry.util.RandomStringGenerator.insecureRandomStringGenerator;
 import static google.registry.util.StringGenerator.Alphabets.HEX_DIGITS_ONLY;
 
@@ -67,10 +69,16 @@ public class RegistryServlet extends ServletBase {
   @Override
   public void service(HttpServletRequest req, HttpServletResponse rsp) throws IOException {
     setCurrentTraceId(traceId());
+    String requestMethod = req.getMethod();
+    String requestUrl = req.getRequestURI();
+    String userAgent = String.valueOf(req.getHeader("User-Agent"));
+    String protocol = req.getProtocol();
+    setCurrentRequest(requestMethod, requestUrl, userAgent, protocol);
     try {
       super.service(req, rsp);
     } finally {
       setCurrentTraceId(null);
+      unsetCurrentRequest();
     }
   }
 

core/src/main/java/google/registry/module/backend/BackendComponent.java

@@ -32,9 +32,7 @@ import google.registry.groups.GmailModule;
 import google.registry.groups.GroupsModule;
 import google.registry.groups.GroupssettingsModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.backend.BackendRequestComponent.BackendRequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
 import google.registry.persistence.PersistenceModule;
@@ -60,7 +58,6 @@ import javax.inject.Singleton;
       CredentialModule.class,
       CustomLogicFactoryModule.class,
       DirectoryModule.class,
-      DummyKeyringModule.class,
       DriveModule.class,
       GmailModule.class,
       GroupsModule.class,
@@ -71,7 +68,6 @@ import javax.inject.Singleton;
       KeyringModule.class,
       NetHttpTransportModule.class,
       PersistenceModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       ServerTridProviderModule.class,
       SheetsServiceModule.class,

core/src/main/java/google/registry/module/bsa/BsaComponent.java

@@ -21,7 +21,6 @@ import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.groups.GmailModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.bsa.BsaRequestComponent.BsaRequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
 import google.registry.persistence.PersistenceModule;
@@ -43,7 +42,6 @@ import javax.inject.Singleton;
       GsonModule.class,
       PersistenceModule.class,
       KeyringModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       StackdriverModule.class,
       UrlConnectionServiceModule.class,

core/src/main/java/google/registry/module/frontend/FrontendComponent.java

@@ -27,9 +27,7 @@ import google.registry.groups.GmailModule;
 import google.registry.groups.GroupsModule;
 import google.registry.groups.GroupssettingsModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.frontend.FrontendRequestComponent.FrontendRequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
 import google.registry.privileges.secretmanager.SecretManagerModule;
@@ -52,7 +50,6 @@ import javax.inject.Singleton;
       CustomLogicFactoryModule.class,
       CloudTasksUtilsModule.class,
       DirectoryModule.class,
-      DummyKeyringModule.class,
       FrontendRequestComponentModule.class,
       GmailModule.class,
       GroupsModule.class,
@@ -61,7 +58,6 @@ import javax.inject.Singleton;
       KeyModule.class,
       KeyringModule.class,
       NetHttpTransportModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       ServerTridProviderModule.class,
       StackdriverModule.class,

core/src/main/java/google/registry/module/pubapi/PubApiComponent.java

@@ -25,9 +25,7 @@ import google.registry.groups.DirectoryModule;
 import google.registry.groups.GroupsModule;
 import google.registry.groups.GroupssettingsModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.pubapi.PubApiRequestComponent.PubApiRequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
 import google.registry.persistence.PersistenceModule;
@@ -47,7 +45,6 @@ import javax.inject.Singleton;
       CredentialModule.class,
       CustomLogicFactoryModule.class,
       DirectoryModule.class,
-      DummyKeyringModule.class,
       GroupsModule.class,
       GroupssettingsModule.class,
       GsonModule.class,
@@ -56,7 +53,6 @@ import javax.inject.Singleton;
       NetHttpTransportModule.class,
       PersistenceModule.class,
       PubApiRequestComponentModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       ServerTridProviderModule.class,
       StackdriverModule.class,

core/src/main/java/google/registry/module/tools/ToolsComponent.java

@@ -27,9 +27,7 @@ import google.registry.groups.DirectoryModule;
 import google.registry.groups.GroupsModule;
 import google.registry.groups.GroupssettingsModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.module.tools.ToolsRequestComponent.ToolsRequestComponentModule;
 import google.registry.monitoring.whitebox.StackdriverModule;
 import google.registry.privileges.secretmanager.SecretManagerModule;
@@ -49,7 +47,6 @@ import javax.inject.Singleton;
       CustomLogicFactoryModule.class,
       CloudTasksUtilsModule.class,
       DirectoryModule.class,
-      DummyKeyringModule.class,
       DriveModule.class,
       GroupsModule.class,
       GroupssettingsModule.class,
@@ -57,7 +54,6 @@ import javax.inject.Singleton;
       KeyModule.class,
       KeyringModule.class,
       NetHttpTransportModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       ServerTridProviderModule.class,
       StackdriverModule.class,

core/src/main/java/google/registry/monitoring/whitebox/StackdriverModule.java

@@ -21,12 +21,15 @@ import com.google.common.util.concurrent.ThreadFactoryBuilder;
 import com.google.monitoring.metrics.MetricReporter;
 import com.google.monitoring.metrics.MetricWriter;
 import com.google.monitoring.metrics.stackdriver.StackdriverWriter;
+import dagger.Lazy;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.Clock;
 import google.registry.util.GoogleCredentialsBundle;
+import google.registry.util.MetricParameters;
+import google.registry.util.RegistryEnvironment;
 import javax.inject.Named;
 import javax.inject.Singleton;
 import org.joda.time.Duration;
@@ -66,23 +69,28 @@ public final class StackdriverModule {
   @Provides
   static MetricWriter provideMetricWriter(
       Monitoring monitoringClient,
+      Lazy<MetricParameters> gkeParameters,
       @Config("projectId") String projectId,
       @Config("stackdriverMaxQps") int maxQps,
       @Config("stackdriverMaxPointsPerRequest") int maxPointsPerRequest,
       @Named("spoofedGceInstanceId") String instanceId) {
-    // The MonitoredResource for GAE apps is not writable (and missing fields anyway) so we just
-    // use the gce_instance resource type instead.
+    MonitoredResource resource =
+        RegistryEnvironment.isOnJetty()
+            ? new MonitoredResource()
+                .setType("gke_container")
+                .setLabels(gkeParameters.get().makeLabelsMap())
+            :
+            // The MonitoredResource for GAE apps is not writable (and missing fields anyway) so we
+            // just use the gce_instance resource type instead.
+            new MonitoredResource()
+                .setType("gce_instance")
+                .setLabels(
+                    ImmutableMap.of(
+                        // The "zone" field MUST be a valid GCE zone, so we fake one.
+                        "zone", SPOOFED_GCE_ZONE, "instance_id", instanceId));
+
     return new StackdriverWriter(
-        monitoringClient,
-        projectId,
-        new MonitoredResource()
-            .setType("gce_instance")
-            .setLabels(
-                ImmutableMap.of(
-                    // The "zone" field MUST be a valid GCE zone, so we fake one.
-                    "zone", SPOOFED_GCE_ZONE, "instance_id", instanceId)),
-        maxQps,
-        maxPointsPerRequest);
+        monitoringClient, projectId, resource, maxQps, maxPointsPerRequest);
   }
 
   @Provides

core/src/main/java/google/registry/persistence/PersistenceComponent.java

@@ -17,7 +17,7 @@ package google.registry.persistence;
 import dagger.Component;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
+import google.registry.keyring.KeyringModule;
 import google.registry.persistence.PersistenceModule.DefaultJpaTm;
 import google.registry.persistence.PersistenceModule.ReadOnlyReplicaJpaTm;
 import google.registry.persistence.transaction.JpaTransactionManager;
@@ -32,8 +32,8 @@ import javax.inject.Singleton;
     modules = {
       ConfigModule.class,
       CredentialModule.class,
+      KeyringModule.class,
       PersistenceModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       UtilsModule.class
     })

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -71,6 +71,7 @@ import java.util.NoSuchElementException;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.Callable;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
@@ -177,9 +178,9 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       if (!getHibernateAllowNestedTransactions()) {
         throw new IllegalStateException(NESTED_TRANSACTION_MESSAGE);
       }
-      if (RegistryEnvironment.get() != RegistryEnvironment.PRODUCTION
-          && RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
-        logger.atWarning().withStackTrace(StackSize.MEDIUM).log(NESTED_TRANSACTION_MESSAGE);
+      if (RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
+        logger.atWarning().withStackTrace(StackSize.MEDIUM).atMostEvery(1, TimeUnit.MINUTES).log(
+            NESTED_TRANSACTION_MESSAGE);
       }
       // This prevents inner transaction from retrying, thus avoiding a cascade retry effect.
       return transactNoRetry(isolationLevel, work);

core/src/main/java/google/registry/rdap/RdapJsonFormatter.java

@@ -31,18 +31,21 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.Maps;
 import com.google.common.collect.Ordering;
+import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.InetAddresses;
 import com.google.gson.JsonArray;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.EppResource;
+import google.registry.model.adapters.EnumToAttributeAdapter.EppEnum;
 import google.registry.model.contact.Contact;
 import google.registry.model.contact.ContactPhoneNumber;
 import google.registry.model.contact.PostalInfo;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.DesignatedContact.Type;
 import google.registry.model.domain.Domain;
+import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.eppcommon.Address;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.Host;
@@ -175,10 +178,8 @@ public class RdapJsonFormatter {
           + " repoId = '%repoIdValue%' and type is not null group by type)";
 
   /** Map of EPP status values to the RDAP equivalents. */
-  private static final ImmutableMap<StatusValue, RdapStatus> STATUS_TO_RDAP_STATUS_MAP =
-      new ImmutableMap.Builder<StatusValue, RdapStatus>()
-          // RdapStatus.ADD_PERIOD not defined in our system
-          // RdapStatus.AUTO_RENEW_PERIOD not defined in our system
+  private static final ImmutableMap<EppEnum, RdapStatus> STATUS_TO_RDAP_STATUS_MAP =
+      new ImmutableMap.Builder<EppEnum, RdapStatus>()
           .put(StatusValue.CLIENT_DELETE_PROHIBITED, RdapStatus.CLIENT_DELETE_PROHIBITED)
           .put(StatusValue.CLIENT_HOLD, RdapStatus.CLIENT_HOLD)
           .put(StatusValue.CLIENT_RENEW_PROHIBITED, RdapStatus.CLIENT_RENEW_PROHIBITED)
@@ -190,17 +191,21 @@ public class RdapJsonFormatter {
           .put(StatusValue.PENDING_CREATE, RdapStatus.PENDING_CREATE)
           .put(StatusValue.PENDING_DELETE, RdapStatus.PENDING_DELETE)
           // RdapStatus.PENDING_RENEW not defined in our system
-          // RdapStatus.PENDING_RESTORE not defined in our system
           .put(StatusValue.PENDING_TRANSFER, RdapStatus.PENDING_TRANSFER)
           .put(StatusValue.PENDING_UPDATE, RdapStatus.PENDING_UPDATE)
-          // RdapStatus.REDEMPTION_PERIOD not defined in our system
-          // RdapStatus.RENEW_PERIOD not defined in our system
           .put(StatusValue.SERVER_DELETE_PROHIBITED, RdapStatus.SERVER_DELETE_PROHIBITED)
           .put(StatusValue.SERVER_HOLD, RdapStatus.SERVER_HOLD)
           .put(StatusValue.SERVER_RENEW_PROHIBITED, RdapStatus.SERVER_RENEW_PROHIBITED)
           .put(StatusValue.SERVER_TRANSFER_PROHIBITED, RdapStatus.SERVER_TRANSFER_PROHIBITED)
           .put(StatusValue.SERVER_UPDATE_PROHIBITED, RdapStatus.SERVER_UPDATE_PROHIBITED)
-          // RdapStatus.TRANSFER_PERIOD not defined in our system
+          .put(GracePeriodStatus.ADD, RdapStatus.ADD_PERIOD)
+          .put(GracePeriodStatus.AUTO_RENEW, RdapStatus.AUTO_RENEW_PERIOD)
+          .put(GracePeriodStatus.REDEMPTION, RdapStatus.REDEMPTION_PERIOD)
+          .put(GracePeriodStatus.RENEW, RdapStatus.RENEW_PERIOD)
+          .put(GracePeriodStatus.PENDING_DELETE, RdapStatus.PENDING_DELETE)
+          // In practice, PENDING_RESTORE is unused. We just perform the restore immediately
+          .put(GracePeriodStatus.PENDING_RESTORE, RdapStatus.PENDING_RESTORE)
+          .put(GracePeriodStatus.TRANSFER, RdapStatus.TRANSFER_PERIOD)
           .build();
 
   /**
@@ -348,9 +353,11 @@ public class RdapJsonFormatter {
     }
     // RDAP Response Profile 2.6.1: must have at least one status member
     // makeStatusValueList should in theory always contain one of either "active" or "inactive".
+    Set<EppEnum> allStatusValues =
+        Sets.union(domain.getStatusValues(), domain.getGracePeriodStatuses());
     ImmutableSet<RdapStatus> status =
         makeStatusValueList(
-            domain.getStatusValues(),
+            allStatusValues,
             false, // isRedacted
             domain.getDeletionTime().isBefore(getRequestTime()));
     builder.statusBuilder().addAll(status);
@@ -1045,7 +1052,7 @@ public class RdapJsonFormatter {
    * redacted objects.
    */
   private static ImmutableSet<RdapStatus> makeStatusValueList(
-      ImmutableSet<StatusValue> statusValues, boolean isRedacted, boolean isDeleted) {
+      Set<? extends EppEnum> statusValues, boolean isRedacted, boolean isDeleted) {
     Stream<RdapStatus> stream =
         statusValues.stream()
             .map(status -> STATUS_TO_RDAP_STATUS_MAP.getOrDefault(status, RdapStatus.OBSCURED));

core/src/main/java/google/registry/rdap/RdapObjectClasses.java

@@ -51,7 +51,7 @@ final class RdapObjectClasses {
    */
   @RestrictJsonNames({})
   @AutoValue
-  abstract static class Vcard implements Jsonable {
+  public abstract static class Vcard implements Jsonable {
     abstract String property();
     abstract ImmutableMap<String, ImmutableList<String>> parameters();
     abstract String valueType();
@@ -94,7 +94,7 @@ final class RdapObjectClasses {
 
   @RestrictJsonNames("vcardArray")
   @AutoValue
-  abstract static class VcardArray implements Jsonable {
+  public abstract static class VcardArray implements Jsonable {
 
     private static final String VCARD_VERSION_NUMBER = "4.0";
     private static final Vcard VCARD_ENTRY_VERSION =
@@ -148,7 +148,7 @@ final class RdapObjectClasses {
    *
    * <p>All Actions need to return an object of this type.
    */
-  abstract static class ReplyPayloadBase extends AbstractJsonableObject {
+  public abstract static class ReplyPayloadBase extends AbstractJsonableObject {
     final BoilerplateType boilerplateType;
 
     ReplyPayloadBase(BoilerplateType boilerplateType) {
@@ -165,7 +165,7 @@ final class RdapObjectClasses {
    */
   @AutoValue
   @RestrictJsonNames({})
-  abstract static class TopLevelReplyObject extends AbstractJsonableObject {
+  public abstract static class TopLevelReplyObject extends AbstractJsonableObject {
     @JsonableElement("rdapConformance")
     static final RdapConformance RDAP_CONFORMANCE = RdapConformance.INSTANCE;
 
@@ -257,7 +257,7 @@ final class RdapObjectClasses {
    * <p>We're missing the "autnums" and "networks" fields
    */
   @RestrictJsonNames({"entities[]", "entitySearchResults[]"})
-  abstract static class RdapEntity extends RdapObjectBase {
+  public abstract static class RdapEntity extends RdapObjectBase {
 
     /** Role values specified in RFC 9083 § 10.2.4. */
     @RestrictJsonNames("roles[]")
@@ -311,7 +311,7 @@ final class RdapObjectClasses {
    * for each one for type safety.
    */
   @AutoValue
-  abstract static class RdapRegistrarEntity extends RdapEntity {
+  public abstract static class RdapRegistrarEntity extends RdapEntity {
 
     static Builder builder() {
       return new AutoValue_RdapObjectClasses_RdapRegistrarEntity.Builder();
@@ -330,7 +330,7 @@ final class RdapObjectClasses {
    * for each one for type safety.
    */
   @AutoValue
-  abstract static class RdapContactEntity extends RdapEntity {
+  public abstract static class RdapContactEntity extends RdapEntity {
 
     static Builder builder() {
       return new AutoValue_RdapObjectClasses_RdapContactEntity.Builder();
@@ -387,7 +387,7 @@ final class RdapObjectClasses {
   /** The Nameserver Object Class defined in 5.2 of RFC 9083. */
   @RestrictJsonNames({"nameservers[]", "nameserverSearchResults[]"})
   @AutoValue
-  abstract static class RdapNameserver extends RdapNamedObjectBase {
+  public abstract static class RdapNameserver extends RdapNamedObjectBase {
 
     @JsonableElement Optional<IpAddresses> ipAddresses() {
       if (ipv6().isEmpty() && ipv4().isEmpty()) {
@@ -429,7 +429,7 @@ final class RdapObjectClasses {
   /** Object defined in RFC 9083 section 5.3, only used for RdapDomain. */
   @RestrictJsonNames("secureDNS")
   @AutoValue
-  abstract static class SecureDns extends AbstractJsonableObject {
+  public abstract static class SecureDns extends AbstractJsonableObject {
     @RestrictJsonNames("dsData[]")
     @AutoValue
     abstract static class DsData extends AbstractJsonableObject {
@@ -507,7 +507,7 @@ final class RdapObjectClasses {
    */
   @RestrictJsonNames("domainSearchResults[]")
   @AutoValue
-  abstract static class RdapDomain extends RdapNamedObjectBase {
+  public abstract static class RdapDomain extends RdapNamedObjectBase {
 
     @JsonableElement abstract ImmutableList<RdapNameserver> nameservers();
 
@@ -535,7 +535,7 @@ final class RdapObjectClasses {
   /** Error Response Body defined in 6 of RFC 9083. */
   @RestrictJsonNames({})
   @AutoValue
-  abstract static class ErrorResponse extends ReplyPayloadBase {
+  public abstract static class ErrorResponse extends ReplyPayloadBase {
 
     @JsonableElement final LanguageIdentifier lang = LanguageIdentifier.EN;
 
@@ -561,7 +561,7 @@ final class RdapObjectClasses {
    */
   @RestrictJsonNames({})
   @AutoValue
-  abstract static class HelpResponse extends ReplyPayloadBase {
+  public abstract static class HelpResponse extends ReplyPayloadBase {
     @JsonableElement("notices[]") abstract Optional<Notice> helpNotice();
 
     HelpResponse() {

core/src/main/java/google/registry/request/Action.java

@@ -34,6 +34,7 @@ public @interface Action {
     GET,
     HEAD,
     POST,
+    PUT,
     DELETE
   }
 

core/src/main/java/google/registry/request/RequestHandler.java

@@ -143,7 +143,9 @@ public class RequestHandler<C> {
       GkeService service = Action.ServiceGetter.get(route.get().action());
       String expectedDomain = RegistryConfig.getServiceUrl(service).getHost();
       String actualDomain = req.getServerName();
-      if (!Objects.equals(actualDomain, expectedDomain)) {
+      // If the hostname is "localhost", it must have come from the sidecar proxy.
+      if (!Objects.equals("localhost", actualDomain)
+          && !Objects.equals(actualDomain, expectedDomain)) {
         logger.atWarning().log(
             "Actual domain %s does not match expected domain %s", actualDomain, expectedDomain);
         rsp.sendError(SC_NOT_FOUND);

core/src/main/java/google/registry/request/auth/AuthModule.java

@@ -14,19 +14,35 @@
 
 package google.registry.request.auth;
 
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Suppliers.memoizeWithExpiration;
 import static com.google.common.net.HttpHeaders.AUTHORIZATION;
+import static google.registry.util.RegistryEnvironment.UNITTEST;
 
+import com.google.cloud.compute.v1.BackendService;
+import com.google.cloud.compute.v1.BackendServicesClient;
+import com.google.cloud.compute.v1.BackendServicesSettings;
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
+import dagger.Lazy;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.IapOidcAuthenticationMechanism;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.RegularOidcAuthenticationMechanism;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.TokenExtractor;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.TokenVerifier;
+import google.registry.util.GoogleCredentialsBundle;
 import google.registry.util.RegistryEnvironment;
-import java.util.Map;
+import java.io.IOException;
+import java.time.Duration;
+import java.util.function.Supplier;
 import javax.annotation.Nullable;
+import javax.inject.Named;
+import javax.inject.Provider;
 import javax.inject.Qualifier;
 import javax.inject.Singleton;
 
@@ -44,6 +60,13 @@ public class AuthModule {
   private static final String IAP_GKE_AUDIENCE_FORMAT = "/projects/%d/global/backendServices/%d";
   private static final String IAP_ISSUER_URL = "https://cloud.google.com/iap";
   private static final String REGULAR_ISSUER_URL = "https://accounts.google.com";
+  // The backend service IDs created when setting up GKE routes. They will be included in the
+  // audience field in the JWT that IAP creates.
+  // See: https://cloud.google.com/iap/docs/signed-headers-howto#verifying_the_jwt_payload
+  // The automatically generated backend service ID has the following format:
+  // gkemcg1-default-console[-canary]-80-(some random string)
+  private static final Pattern BACKEND_END_PATTERN =
+      Pattern.compile(".*-default-((frontend|backend|console|pubapi)(-canary)?)-80-.*");
 
   /** Provides the custom authentication mechanisms. */
   @Provides
@@ -68,13 +91,18 @@ public class AuthModule {
   TokenVerifier provideIapTokenVerifier(
       @Config("projectId") String projectId,
       @Config("projectIdNumber") long projectIdNumber,
-      @Config("backendServiceIds") Map<String, Long> backendServiceIds) {
+      @Named("backendServiceIdMap") Supplier<ImmutableMap<String, Long>> backendServiceIdMap) {
     com.google.auth.oauth2.TokenVerifier.Builder tokenVerifierBuilder =
         com.google.auth.oauth2.TokenVerifier.newBuilder().setIssuer(IAP_ISSUER_URL);
     return (String service, String token) -> {
       String audience;
       if (RegistryEnvironment.isOnJetty()) {
-        long backendServiceId = backendServiceIds.get(service);
+        Long backendServiceId = backendServiceIdMap.get().get(service);
+        checkNotNull(
+            backendServiceId,
+            "Backend service ID not found for service: %s, available IDs are %s",
+            service,
+            backendServiceIdMap);
         audience = String.format(IAP_GKE_AUDIENCE_FORMAT, projectIdNumber, backendServiceId);
       } else {
         audience = String.format(IAP_GAE_AUDIENCE_FORMAT, projectIdNumber, projectId);
@@ -116,4 +144,48 @@ public class AuthModule {
       return null;
     };
   }
+
+  @Provides
+  @Singleton
+  static BackendServicesClient provideBackendServicesClients(
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle) {
+    try {
+      return BackendServicesClient.create(
+          BackendServicesSettings.newBuilder()
+              .setCredentialsProvider(credentialsBundle::getGoogleCredentials)
+              .build());
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Provides
+  @Named("backendServiceIdMap")
+  static ImmutableMap<String, Long> provideBackendServiceList(
+      Lazy<BackendServicesClient> client, @Config("projectId") String projectId) {
+    if (RegistryEnvironment.isInTestServer() || RegistryEnvironment.get() == UNITTEST) {
+      return ImmutableMap.of();
+    }
+    ImmutableMap.Builder<String, Long> builder = ImmutableMap.builder();
+    for (BackendService service : client.get().list(projectId).iterateAll()) {
+      String name = service.getName();
+      Matcher matcher = BACKEND_END_PATTERN.matcher(name);
+      if (!matcher.matches()) {
+        continue;
+      }
+      builder.put(matcher.group(1), service.getId());
+    }
+    return builder.build();
+  }
+
+  // Use an expiring cache so that the backend service ID map can be refreshed without restarting
+  // the server. The map is very unlikely to change, except for when services are just deployed
+  // for the first time, because some pods might receive traffic before all services are deployed.
+  @Provides
+  @Singleton
+  @Named("backendServiceIdMap")
+  static Supplier<ImmutableMap<String, Long>> provideBackendServiceIdMapSupplier(
+      @Named("backendServiceIdMap") Provider<ImmutableMap<String, Long>> backendServiceIdMap) {
+    return memoizeWithExpiration(backendServiceIdMap::get, Duration.ofMinutes(15));
+  }
 }

core/src/main/java/google/registry/request/auth/OidcTokenAuthenticationMechanism.java

@@ -36,9 +36,9 @@ import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 /**
- * An authenticam mechanism that verifies the OIDC token.
+ * An authentication mechanism that verifies the OIDC token.
  *
- * <p>Currently, two flavors are supported: one that checkes for the OIDC token as a regular bearer
+ * <p>Currently, two flavors are supported: one that checks for the OIDC token as a regular bearer
  * token, and another that checks for the OIDC token passed by IAP. In both cases, the {@link
  * AuthResult} with the highest {@link AuthLevel} possible is returned. So, if the email address for
  * which the token is minted exists both as a {@link User} and as a service account, the returned
@@ -87,6 +87,9 @@ public abstract class OidcTokenAuthenticationMechanism implements Authentication
       if (RegistryEnvironment.isOnJetty()) {
         String hostname = request.getServerName();
         service = Splitter.on('.').split(hostname).iterator().next();
+        if (request.getHeader("canary") != null) {
+          service += "-canary";
+        }
       }
       token = tokenVerifier.verify(service, rawIdToken);
     } catch (Exception e) {

core/src/main/java/google/registry/tools/CreateOrUpdateUserCommand.java

@@ -14,6 +14,7 @@
 
 package google.registry.tools;
 
+import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
@@ -41,6 +42,15 @@ public abstract class CreateOrUpdateUserCommand extends ConfirmingCommand {
               + " to remove the field.")
   private String registryLockEmailAddress;
 
+  @Nullable
+  @Parameter(
+      names = "--registry_lock_password",
+      description =
+          "Sets the registry lock password for this user, or removes it (allowing the user to"
+              + " re-set it). Do not set the password explicitly unless in exceptional"
+              + " circumstances.")
+  private String registryLockPassword;
+
   @Nullable
   @Parameter(
       names = "--admin",
@@ -94,6 +104,25 @@ public abstract class CreateOrUpdateUserCommand extends ConfirmingCommand {
         builder.setRegistryLockEmailAddress(registryLockEmailAddress);
       }
     }
+    // Ditto the registry lock password
+    if (registryLockPassword != null) {
+      if (registryLockEmailAddress != null) {
+        // Edge case, make sure we're not removing an email and setting a password at the same time
+        checkArgument(
+            !registryLockEmailAddress.isEmpty(),
+            "Cannot set/remove registry lock password on a user without a registry lock email"
+                + " address");
+      } else {
+        checkArgument(
+            user != null && user.getRegistryLockEmailAddress().isPresent(),
+            "Cannot set/remove registry lock password on a user without a registry lock email"
+                + " address");
+      }
+      builder.removeRegistryLockPassword();
+      if (!registryLockPassword.isEmpty()) {
+        builder.setRegistryLockPassword(registryLockPassword);
+      }
+    }
     tm().put(builder.build());
   }
 }

core/src/main/java/google/registry/tools/CurlCommand.java

@@ -80,15 +80,14 @@ class CurlCommand implements CommandWithConnection {
       required = true)
   private String serviceName;
 
-  @Parameter(
-      names = {"--canary"},
-      description = "If set, use the canary end-point; otherwise use the regular end-point.")
-  private Boolean canary = Boolean.FALSE;
-
   @Inject
   @Config("useGke")
   boolean useGke;
 
+  @Inject
+  @Config("useCanary")
+  boolean useCanary;
+
   @Override
   public void setConnection(ServiceConnection connection) {
     this.connection = connection;
@@ -109,7 +108,7 @@ class CurlCommand implements CommandWithConnection {
             ? GkeService.valueOf(Ascii.toUpperCase(serviceName))
             : GaeService.valueOf(Ascii.toUpperCase(serviceName));
 
-    ServiceConnection connectionToService = connection.withService(service, canary);
+    ServiceConnection connectionToService = connection.withService(service, useCanary);
     String response =
         (method == Method.GET)
             ? connectionToService.sendGetRequest(path, ImmutableMap.<String, String>of())

core/src/main/java/google/registry/tools/DeleteAllocationTokensCommand.java

@@ -52,7 +52,7 @@ final class DeleteAllocationTokensCommand extends UpdateOrDeleteAllocationTokens
 
   @Override
   public void init() {
-    tokensToDelete = getTokenKeys(tokens, prefix);
+    tokensToDelete = tm().transact(() -> getTokenKeys(tokens, prefix));
   }
 
   @Override

core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java

@@ -64,8 +64,6 @@ final class GetKeyringSecretCommand implements Command {
       case BSA_API_KEY -> out.write(KeySerializer.serializeString(keyring.getBsaApiKey()));
       case ICANN_REPORTING_PASSWORD ->
           out.write(KeySerializer.serializeString(keyring.getIcannReportingPassword()));
-      case SAFE_BROWSING_API_KEY ->
-          out.write(KeySerializer.serializeString(keyring.getSafeBrowsingAPIKey()));
       case MARKSDB_DNL_LOGIN_AND_PASSWORD ->
           out.write(KeySerializer.serializeString(keyring.getMarksdbDnlLoginAndPassword()));
       case MARKSDB_LORDN_PASSWORD ->
@@ -91,6 +89,12 @@ final class GetKeyringSecretCommand implements Command {
                       keyring.getRdeStagingEncryptionKey(), keyring.getRdeStagingDecryptionKey())));
       case RDE_STAGING_PUBLIC_KEY ->
           out.write(KeySerializer.serializePublicKey(keyring.getRdeStagingEncryptionKey()));
+      case SAFE_BROWSING_API_KEY ->
+          out.write(KeySerializer.serializeString(keyring.getSafeBrowsingAPIKey()));
+      case SQL_PRIMARY_CONN_NAME ->
+          out.write(KeySerializer.serializeString(keyring.getSqlPrimaryConnectionName()));
+      case SQL_REPLICA_CONN_NAME ->
+          out.write(KeySerializer.serializeString(keyring.getSqlReplicaConnectionName()));
     }
   }
 }

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -25,6 +25,7 @@ import com.beust.jcommander.Parameters;
 import com.beust.jcommander.ParametersDelegate;
 import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Iterables;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
@@ -41,6 +42,10 @@ import org.postgresql.util.PSQLException;
 @Parameters(separators = " =", commandDescription = "Command-line interface to the registry")
 final class RegistryCli implements CommandRunner {
 
+  private static final ImmutableSet<RegistryToolEnvironment> DEFAULT_GKE_ENVIRONMENTS =
+      ImmutableSet.of(
+          RegistryToolEnvironment.ALPHA, RegistryToolEnvironment.CRASH, RegistryToolEnvironment.QA);
+
   // The environment parameter is parsed twice: once here, and once with {@link
   // RegistryToolEnvironment#parseFromArgs} in the {@link RegistryTool#main} function.
   //
@@ -73,6 +78,12 @@ final class RegistryCli implements CommandRunner {
   @Parameter(names = "--gke", description = "Whether to use GKE runtime, instead of GAE")
   private boolean useGke = false;
 
+  @Parameter(names = "--gae", description = "Whether to use GAE runtime, instead of GKE")
+  private boolean useGae = false;
+
+  @Parameter(names = "--canary", description = "Whether to connect to the canary instances")
+  private boolean useCanary = false;
+
   // Do not make this final - compile-time constant inlining may interfere with JCommander.
   @ParametersDelegate private LoggingParameters loggingParams = new LoggingParameters();
 
@@ -146,6 +157,13 @@ final class RegistryCli implements CommandRunner {
       }
       throw e;
     }
+
+    checkState(!useGke || !useGae, "Cannot specify both --gke and --gae");
+    // Special logic to set the default based on the environment if neither --gae nor --gke is set.
+    if (!useGke && !useGae) {
+      useGke = DEFAULT_GKE_ENVIRONMENTS.contains(environment);
+    }
+
     String parsedCommand = jcommander.getParsedCommand();
     // Show the list of all commands either if requested or if no subcommand name was specified
     // (which does not throw a ParameterException parse error above).
@@ -166,6 +184,7 @@ final class RegistryCli implements CommandRunner {
             .credentialFilePath(credentialJson)
             .sqlAccessInfoFile(sqlAccessInfoFile)
             .useGke(useGke)
+            .useCanary(useCanary)
             .build();
 
     // JCommander stores sub-commands as nested JCommander objects containing a list of user objects
@@ -196,9 +215,9 @@ final class RegistryCli implements CommandRunner {
           System.err.println("===================================================================");
           System.err.println(
               """
-                  This error is likely the result of having another instance of
-                  nomulus running at the same time.  Check your system, shut down
-                  the other instance, and try again.""");
+              This error is likely the result of having another instance of
+              nomulus running at the same time.  Check your system, shut down
+              the other instance, and try again.""");
           System.err.println("===================================================================");
         } else {
           throw e;

core/src/main/java/google/registry/tools/RegistryToolComponent.java

@@ -27,9 +27,7 @@ import google.registry.dns.writer.VoidDnsWriterModule;
 import google.registry.dns.writer.clouddns.CloudDnsWriterModule;
 import google.registry.dns.writer.dnsupdate.DnsUpdateWriterModule;
 import google.registry.keyring.KeyringModule;
-import google.registry.keyring.api.DummyKeyringModule;
 import google.registry.keyring.api.KeyModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.model.ModelModule;
 import google.registry.persistence.PersistenceModule;
 import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
@@ -60,7 +58,6 @@ import javax.inject.Singleton;
       ConfigModule.class,
       CloudDnsWriterModule.class,
       CloudTasksUtilsModule.class,
-      DummyKeyringModule.class,
       DnsUpdateWriterModule.class,
       GsonModule.class,
       KeyModule.class,
@@ -71,7 +68,6 @@ import javax.inject.Singleton;
       RdeModule.class,
       RegistryToolDataflowModule.class,
       RequestFactoryModule.class,
-      SecretManagerKeyringModule.class,
       SecretManagerModule.class,
       UrlConnectionServiceModule.class,
       UtilsModule.class,
@@ -195,6 +191,9 @@ interface RegistryToolComponent {
     @BindsInstance
     Builder useGke(@Config("useGke") boolean useGke);
 
+    @BindsInstance
+    Builder useCanary(@Config("useCanary") boolean useCanary);
+
     RegistryToolComponent build();
   }
 }

core/src/main/java/google/registry/tools/ServiceConnection.java

@@ -20,6 +20,7 @@ import static com.google.common.base.Verify.verify;
 import static com.google.common.net.HttpHeaders.X_REQUESTED_WITH;
 import static com.google.common.net.MediaType.JSON_UTF_8;
 import static google.registry.config.ConfigUtils.makeUrl;
+import static google.registry.config.RegistryConfig.CANARY_HEADER;
 import static google.registry.security.JsonHttp.JSON_SAFETY_PREFIX;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
@@ -58,15 +59,16 @@ public class ServiceConnection {
   /** Pattern to heuristically extract title tag contents in HTML responses. */
   protected static final Pattern HTML_TITLE_TAG_PATTERN = Pattern.compile("<title>(.*?)</title>");
 
-  private static final String CANARY_HEADER = "canary";
-
   private final Service service;
   private final boolean useCanary;
   private final HttpRequestFactory requestFactory;
 
   @Inject
-  ServiceConnection(@Config("useGke") boolean useGke, HttpRequestFactory requestFactory) {
-    this(useGke ? GkeService.BACKEND : GaeService.TOOLS, requestFactory, false);
+  ServiceConnection(
+      @Config("useGke") boolean useGke,
+      @Config("useCanary") boolean useCanary,
+      HttpRequestFactory requestFactory) {
+    this(useGke ? GkeService.BACKEND : GaeService.TOOLS, requestFactory, useCanary);
   }
 
   private ServiceConnection(Service service, HttpRequestFactory requestFactory, boolean useCanary) {

core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java

@@ -90,12 +90,16 @@ final class UpdateKeyringSecretCommand implements Command {
           secretManagerKeyringUpdater.setRdeSshClientPublicKey(deserializeString(input));
       case RDE_STAGING_KEY_PAIR ->
           secretManagerKeyringUpdater.setRdeStagingKey(deserializeKeyPair(input));
-      case SAFE_BROWSING_API_KEY ->
-          secretManagerKeyringUpdater.setSafeBrowsingAPIKey(deserializeString(input));
       case RDE_STAGING_PUBLIC_KEY ->
           throw new IllegalArgumentException(
               "Can't update RDE_STAGING_PUBLIC_KEY directly."
                   + " Must update public and private keys together using RDE_STAGING_KEY_PAIR.");
+      case SAFE_BROWSING_API_KEY ->
+          secretManagerKeyringUpdater.setSafeBrowsingAPIKey(deserializeString(input));
+      case SQL_PRIMARY_CONN_NAME ->
+          secretManagerKeyringUpdater.setSqlPrimaryConnectionName(deserializeString(input));
+      case SQL_REPLICA_CONN_NAME ->
+          secretManagerKeyringUpdater.setSqlReplicaConnectionName(deserializeString(input));
     }
 
     secretManagerKeyringUpdater.update();

core/src/main/java/google/registry/tools/UpdateOrDeleteAllocationTokensCommand.java

@@ -59,21 +59,16 @@ abstract class UpdateOrDeleteAllocationTokensCommand extends ConfirmingCommand {
               .map(token -> VKey.create(AllocationToken.class, token))
               .collect(toImmutableList());
       ImmutableList<VKey<AllocationToken>> nonexistentKeys =
-          tm().transact(
-                  () -> keys.stream().filter(key -> !tm().exists(key)).collect(toImmutableList()));
+          keys.stream().filter(key -> !tm().exists(key)).collect(toImmutableList());
       checkState(nonexistentKeys.isEmpty(), "Tokens with keys %s did not exist", nonexistentKeys);
       return keys;
     } else {
       checkArgument(!prefix.isEmpty(), "Provided prefix should not be blank");
-      return tm().transact(
-              () ->
-                  tm().query(
-                          "SELECT token FROM AllocationToken WHERE token LIKE :prefix",
-                          String.class)
-                      .setParameter("prefix", String.format("%s%%", prefix))
-                      .getResultStream()
-                      .map(token -> VKey.create(AllocationToken.class, token))
-                      .collect(toImmutableList()));
+      return tm().query("SELECT token FROM AllocationToken WHERE token LIKE :prefix", String.class)
+          .setParameter("prefix", String.format("%s%%", prefix))
+          .getResultStream()
+          .map(token -> VKey.create(AllocationToken.class, token))
+          .collect(toImmutableList());
     }
   }
 }

core/src/main/java/google/registry/tools/params/KeyringKeyName.java

@@ -36,5 +36,7 @@ public enum KeyringKeyName {
   RDE_SSH_CLIENT_PUBLIC_KEY,
   RDE_STAGING_KEY_PAIR,
   RDE_STAGING_PUBLIC_KEY,
-  SAFE_BROWSING_API_KEY
+  SAFE_BROWSING_API_KEY,
+  SQL_PRIMARY_CONN_NAME,
+  SQL_REPLICA_CONN_NAME
 }

core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java

@@ -16,10 +16,12 @@ package google.registry.ui.server.console;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.DELETE;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.HEAD;
 import static google.registry.request.Action.Method.POST;
+import static google.registry.request.Action.Method.PUT;
 import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
 import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@@ -35,6 +37,7 @@ import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig;
 import google.registry.export.sheet.SyncRegistrarsSheetAction;
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.ConsoleUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
@@ -87,6 +90,8 @@ public abstract class ConsoleApiAction implements Runnable {
         if (verifyXSRF(user)) {
           if (requestMethod.equals(DELETE.toString())) {
             deleteHandler(user);
+          } else if (requestMethod.equals(PUT.toString())) {
+            putHandler(user);
           } else {
             postHandler(user);
           }
@@ -117,6 +122,10 @@ public abstract class ConsoleApiAction implements Runnable {
     throw new UnsupportedOperationException("Console API POST handler not implemented");
   }
 
+  protected void putHandler(User user) {
+    throw new UnsupportedOperationException("Console API PUT handler not implemented");
+  }
+
   protected void getHandler(User user) {
     throw new UnsupportedOperationException("Console API GET handler not implemented");
   }
@@ -253,6 +262,14 @@ public abstract class ConsoleApiAction implements Runnable {
     }
   }
 
+  protected void finishAndPersistConsoleUpdateHistory(ConsoleUpdateHistory.Builder<?, ?> builder) {
+    builder.setActingUser(consoleApiParams.authResult().user().get());
+    builder.setUrl(consoleApiParams.request().getRequestURI());
+    builder.setMethod(consoleApiParams.request().getMethod());
+    builder.setModificationTime(tm().getTransactionTime());
+    tm().put(builder.build());
+  }
+
   /** Specialized exception class used for failure when a user doesn't have the right permission. */
   private static class ConsolePermissionForbiddenException extends RuntimeException {
     private ConsolePermissionForbiddenException(String message) {

core/src/main/java/google/registry/ui/server/console/ConsoleApiParams.java

@@ -14,6 +14,7 @@
 
 package google.registry.ui.server.console;
 
+import com.google.gson.Gson;
 import google.registry.request.Response;
 import google.registry.request.auth.AuthResult;
 import google.registry.security.XsrfTokenManager;
@@ -26,13 +27,16 @@ public record ConsoleApiParams(
     Response response,
     AuthResult authResult,
     SendEmailUtils sendEmailUtils,
-    XsrfTokenManager xsrfTokenManager) {
+    XsrfTokenManager xsrfTokenManager,
+    Gson gson) {
   public static ConsoleApiParams create(
       HttpServletRequest request,
       Response response,
       AuthResult authResult,
       SendEmailUtils sendEmailUtils,
-      XsrfTokenManager xsrfTokenManager) {
-    return new ConsoleApiParams(request, response, authResult, sendEmailUtils, xsrfTokenManager);
+      XsrfTokenManager xsrfTokenManager,
+      Gson gson) {
+    return new ConsoleApiParams(
+        request, response, authResult, sendEmailUtils, xsrfTokenManager, gson);
   }
 }

core/src/main/java/google/registry/ui/server/console/ConsoleBulkDomainAction.java

@@ -0,0 +1,228 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server.console;
+
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
+import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.escape.Escaper;
+import com.google.common.xml.XmlEscapers;
+import com.google.gson.JsonElement;
+import com.google.gson.annotations.Expose;
+import google.registry.flows.EppController;
+import google.registry.flows.EppRequestSource;
+import google.registry.flows.PasswordOnlyTransportCredentials;
+import google.registry.flows.StatelessRequestSessionMetadata;
+import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.User;
+import google.registry.model.eppcommon.ProtocolDefinition;
+import google.registry.model.eppoutput.EppOutput;
+import google.registry.model.eppoutput.Result;
+import google.registry.request.Action;
+import google.registry.request.OptionalJsonPayload;
+import google.registry.request.Parameter;
+import google.registry.request.auth.Auth;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import javax.inject.Inject;
+
+/**
+ * Console endpoint to perform the same action to a list of domains.
+ *
+ * <p>All requests must include the {@link BulkAction} to perform as well as a {@link
+ * BulkDomainList} of domains on which to apply the action. The remaining contents of the request
+ * body depend on the type of action -- some requests may require more data than others.
+ */
+@Action(
+    service = Action.GaeService.DEFAULT,
+    gkeService = Action.GkeService.CONSOLE,
+    path = ConsoleBulkDomainAction.PATH,
+    auth = Auth.AUTH_PUBLIC_LOGGED_IN)
+public class ConsoleBulkDomainAction extends ConsoleApiAction {
+
+  public static final String PATH = "/console-api/bulk-domain";
+
+  private static Escaper XML_ESCAPER = XmlEscapers.xmlContentEscaper();
+
+  public enum BulkAction {
+    DELETE,
+    SUSPEND
+  }
+
+  /** All requests must include at least a list of domain names on which to perform the action. */
+  public record BulkDomainList(@Expose List<String> domainList) {}
+
+  public record BulkDomainDeleteRequest(@Expose String reason) {}
+
+  public record BulkDomainSuspendRequest(@Expose String reason) {}
+
+  private static final String DOMAIN_DELETE_XML =
+      """
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <delete>
+      <domain:delete
+       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>%DOMAIN_NAME%</domain:name>
+      </domain:delete>
+    </delete>
+    <extension>
+      <metadata:metadata xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>%REASON%</metadata:reason>
+        <metadata:requestedByRegistrar>true</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>RegistryConsole</clTRID>
+  </command>
+</epp>""";
+
+  private static final String DOMAIN_SUSPEND_XML =
+      """
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp
+  xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <update>
+      <domain:update
+        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>%DOMAIN_NAME%</domain:name>
+        <domain:add>
+          <domain:status s="serverDeleteProhibited" lang="en"></domain:status>
+          <domain:status s="serverHold" lang="en"></domain:status>
+          <domain:status s="serverRenewProhibited" lang="en"></domain:status>
+          <domain:status s="serverTransferProhibited" lang="en"></domain:status>
+          <domain:status s="serverUpdateProhibited" lang="en"></domain:status>
+        </domain:add>
+        <domain:rem></domain:rem>
+      </domain:update>
+    </update>
+    <extension>
+      <metadata:metadata
+        xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>Console suspension: %REASON%</metadata:reason>
+        <metadata:requestedByRegistrar>false</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>RegistryTool</clTRID>
+  </command>
+</epp>""";
+
+  private final EppController eppController;
+  private final String registrarId;
+  private final String bulkDomainAction;
+  private final Optional<JsonElement> optionalJsonPayload;
+
+  @Inject
+  public ConsoleBulkDomainAction(
+      ConsoleApiParams consoleApiParams,
+      EppController eppController,
+      @Parameter("registrarId") String registrarId,
+      @Parameter("bulkDomainAction") String bulkDomainAction,
+      @OptionalJsonPayload Optional<JsonElement> optionalJsonPayload) {
+    super(consoleApiParams);
+    this.eppController = eppController;
+    this.registrarId = registrarId;
+    this.bulkDomainAction = bulkDomainAction;
+    this.optionalJsonPayload = optionalJsonPayload;
+  }
+
+  @Override
+  protected void postHandler(User user) {
+    BulkAction bulkAction = BulkAction.valueOf(bulkDomainAction);
+    JsonElement jsonPayload =
+        optionalJsonPayload.orElseThrow(
+            () -> new IllegalArgumentException("Bulk action payload must be present"));
+    BulkDomainList domainList = consoleApiParams.gson().fromJson(jsonPayload, BulkDomainList.class);
+    checkPermission(user, registrarId, ConsolePermission.EXECUTE_EPP_COMMANDS);
+    ImmutableMap<String, ConsoleEppOutput> result =
+        switch (bulkAction) {
+          case DELETE -> handleBulkDelete(jsonPayload, domainList, user);
+          case SUSPEND -> handleBulkSuspend(jsonPayload, domainList, user);
+        };
+    // Front end should parse situations where only some commands worked
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(result));
+    consoleApiParams.response().setStatus(SC_OK);
+  }
+
+  private ImmutableMap<String, ConsoleEppOutput> handleBulkDelete(
+      JsonElement jsonPayload, BulkDomainList domainList, User user) {
+    String reason =
+        consoleApiParams.gson().fromJson(jsonPayload, BulkDomainDeleteRequest.class).reason;
+    return runCommandOverDomains(
+        domainList,
+        DOMAIN_DELETE_XML,
+        new ImmutableMap.Builder<String, String>().put("REASON", reason),
+        user);
+  }
+
+  private ImmutableMap<String, ConsoleEppOutput> handleBulkSuspend(
+      JsonElement jsonPayload, BulkDomainList domainList, User user) {
+    String reason =
+        consoleApiParams.gson().fromJson(jsonPayload, BulkDomainSuspendRequest.class).reason;
+    return runCommandOverDomains(
+        domainList,
+        DOMAIN_SUSPEND_XML,
+        new ImmutableMap.Builder<String, String>().put("REASON", reason),
+        user);
+  }
+
+  /** Runs the provided XML template and substitutions over a provided list of domains. */
+  private ImmutableMap<String, ConsoleEppOutput> runCommandOverDomains(
+      BulkDomainList domainList,
+      String xmlTemplate,
+      ImmutableMap.Builder<String, String> replacements,
+      User user) {
+    return domainList.domainList.stream()
+        .collect(
+            toImmutableMap(
+                d -> d,
+                d ->
+                    executeEpp(
+                        fillSubstitutions(xmlTemplate, replacements.put("DOMAIN_NAME", d)), user)));
+  }
+
+  private ConsoleEppOutput executeEpp(String xml, User user) {
+    return ConsoleEppOutput.fromEppOutput(
+        eppController.handleEppCommand(
+            new StatelessRequestSessionMetadata(
+                registrarId, ProtocolDefinition.getVisibleServiceExtensionUris()),
+            new PasswordOnlyTransportCredentials(),
+            EppRequestSource.CONSOLE,
+            false,
+            user.getUserRoles().isAdmin(),
+            xml.getBytes(UTF_8)));
+  }
+
+  /** Fills the provided XML template with the replacement values, including escaping the values. */
+  private String fillSubstitutions(
+      String xmlTemplate, ImmutableMap.Builder<String, String> replacements) {
+    String xml = xmlTemplate;
+    for (Map.Entry<String, String> entry : replacements.buildKeepingLast().entrySet()) {
+      xml = xml.replaceAll("%" + entry.getKey() + "%", XML_ESCAPER.escape(entry.getValue()));
+    }
+    return xml;
+  }
+
+  public record ConsoleEppOutput(@Expose String message, @Expose int responseCode) {
+    static ConsoleEppOutput fromEppOutput(EppOutput eppOutput) {
+      Result result = eppOutput.getResponse().getResult();
+      return new ConsoleEppOutput(result.getMsg(), result.getCode().code);
+    }
+  }
+}

core/src/main/java/google/registry/ui/server/console/ConsoleDomainGetAction.java

@@ -18,7 +18,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static jakarta.servlet.http.HttpServletResponse.SC_NOT_FOUND;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
-import com.google.gson.Gson;
 import google.registry.model.EppResourceUtils;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.User;
@@ -41,17 +40,14 @@ public class ConsoleDomainGetAction extends ConsoleApiAction {
 
   public static final String PATH = "/console-api/domain";
 
-  private final Gson gson;
   private final String paramDomain;
 
   @Inject
   public ConsoleDomainGetAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       @Parameter("consoleDomain") String paramDomain) {
     super(consoleApiParams);
     this.paramDomain = paramDomain;
-    this.gson = gson;
   }
 
   @Override
@@ -72,6 +68,6 @@ public class ConsoleDomainGetAction extends ConsoleApiAction {
       return;
     }
     consoleApiParams.response().setStatus(SC_OK);
-    consoleApiParams.response().setPayload(gson.toJson(domain));
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(domain));
   }
 }

core/src/main/java/google/registry/ui/server/console/ConsoleDomainListAction.java

@@ -21,7 +21,6 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Ascii;
-import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.console.User;
@@ -55,7 +54,6 @@ public class ConsoleDomainListAction extends ConsoleApiAction {
   private static final String SEARCH_TERM_QUERY = " AND LOWER(domainName) LIKE :searchTerm";
   private static final String ORDER_BY_STATEMENT = " ORDER BY creationTime DESC";
 
-  private final Gson gson;
   private final String registrarId;
   private final Optional<DateTime> checkpointTime;
   private final int pageNumber;
@@ -66,7 +64,6 @@ public class ConsoleDomainListAction extends ConsoleApiAction {
   @Inject
   public ConsoleDomainListAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       @Parameter("registrarId") String registrarId,
       @Parameter("checkpointTime") Optional<DateTime> checkpointTime,
       @Parameter("pageNumber") Optional<Integer> pageNumber,
@@ -74,7 +71,6 @@ public class ConsoleDomainListAction extends ConsoleApiAction {
       @Parameter("totalResults") Optional<Long> totalResults,
       @Parameter("searchTerm") Optional<String> searchTerm) {
     super(consoleApiParams);
-    this.gson = gson;
     this.registrarId = registrarId;
     this.checkpointTime = checkpointTime;
     this.pageNumber = pageNumber.orElse(0);
@@ -120,7 +116,10 @@ public class ConsoleDomainListAction extends ConsoleApiAction {
 
     consoleApiParams
         .response()
-        .setPayload(gson.toJson(new DomainListResult(domains, checkpoint, actualTotalResults)));
+        .setPayload(
+            consoleApiParams
+                .gson()
+                .toJson(new DomainListResult(domains, checkpoint, actualTotalResults)));
     consoleApiParams.response().setStatus(SC_OK);
   }
 

core/src/main/java/google/registry/ui/server/console/ConsoleEppPasswordAction.java

@@ -27,6 +27,8 @@ import com.google.common.collect.ImmutableSet;
 import com.google.gson.annotations.Expose;
 import google.registry.flows.EppException.AuthenticationErrorException;
 import google.registry.flows.PasswordOnlyTransportCredentials;
+import google.registry.model.console.ConsoleUpdateHistory;
+import google.registry.model.console.RegistrarUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
@@ -53,7 +55,6 @@ public class ConsoleEppPasswordAction extends ConsoleApiAction {
   private final PasswordOnlyTransportCredentials credentials =
       new PasswordOnlyTransportCredentials();
   private final AuthenticatedRegistrarAccessor registrarAccessor;
-
   private final Optional<EppPasswordData> eppPasswordChangeRequest;
 
   @Inject
@@ -106,6 +107,14 @@ public class ConsoleEppPasswordAction extends ConsoleApiAction {
               Registrar updatedRegistrar =
                   registrar.asBuilder().setPassword(eppRequestBody.newPassword()).build();
               tm().put(updatedRegistrar);
+              EppPasswordData sanitizedData =
+                  new EppPasswordData(
+                      eppRequestBody.registrarId, "********", "••••••••", "••••••••");
+              finishAndPersistConsoleUpdateHistory(
+                  new RegistrarUpdateHistory.Builder()
+                      .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+                      .setRegistrar(updatedRegistrar)
+                      .setRequestBody(consoleApiParams.gson().toJson(sanitizedData)));
               sendExternalUpdates(
                   ImmutableMap.of("password", new DiffUtils.DiffPair("********", "••••••••")),
                   registrar,

core/src/main/java/google/registry/ui/server/console/ConsoleModule.java

@@ -36,7 +36,7 @@ import google.registry.ui.server.SendEmailUtils;
 import google.registry.ui.server.console.ConsoleEppPasswordAction.EppPasswordData;
 import google.registry.ui.server.console.ConsoleOteAction.OteCreateData;
 import google.registry.ui.server.console.ConsoleRegistryLockAction.ConsoleRegistryLockPostInput;
-import google.registry.ui.server.console.ConsoleUsersAction.UserDeleteData;
+import google.registry.ui.server.console.ConsoleUsersAction.UserData;
 import jakarta.servlet.http.HttpServletRequest;
 import java.util.Optional;
 import org.joda.time.DateTime;
@@ -53,8 +53,10 @@ public final class ConsoleModule {
       Response response,
       AuthResult authResult,
       SendEmailUtils sendEmailUtils,
-      XsrfTokenManager xsrfTokenManager) {
-    return ConsoleApiParams.create(request, response, authResult, sendEmailUtils, xsrfTokenManager);
+      XsrfTokenManager xsrfTokenManager,
+      Gson gson) {
+    return ConsoleApiParams.create(
+        request, response, authResult, sendEmailUtils, xsrfTokenManager, gson);
   }
 
   @Provides
@@ -239,6 +241,12 @@ public final class ConsoleModule {
     return extractOptionalParameter(req, "searchTerm");
   }
 
+  @Provides
+  @Parameter("bulkDomainAction")
+  public static String provideBulkDomainAction(HttpServletRequest req) {
+    return extractRequiredParameter(req, "bulkDomainAction");
+  }
+
   @Provides
   @Parameter("eppPasswordChangeRequest")
   public static Optional<EppPasswordData> provideEppPasswordChangeRequest(
@@ -247,10 +255,10 @@ public final class ConsoleModule {
   }
 
   @Provides
-  @Parameter("userDeleteData")
-  public static Optional<UserDeleteData> provideUserDeleteData(
+  @Parameter("userData")
+  public static Optional<UserData> provideUserData(
       Gson gson, @OptionalJsonPayload Optional<JsonElement> payload) {
-    return payload.map(s -> gson.fromJson(s, UserDeleteData.class));
+    return payload.map(s -> gson.fromJson(s, UserData.class));
   }
 
   @Provides

core/src/main/java/google/registry/ui/server/console/ConsoleOteAction.java

@@ -27,7 +27,6 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableMap;
-import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.OteAccountBuilder;
@@ -62,7 +61,6 @@ public class ConsoleOteAction extends ConsoleApiAction {
   private static final String STAT_TYPE_DESCRIPTION_PARAM = "description";
   private static final String STAT_TYPE_REQUIREMENT_PARAM = "requirement";
   private static final String STAT_TYPE_TIMES_PERFORMED_PARAM = "timesPerformed";
-  private final Gson gson;
   private final StringGenerator passwordGenerator;
   private final Optional<OteCreateData> oteCreateData;
   private final Optional<String> maybeGroupEmailAddress;
@@ -72,14 +70,12 @@ public class ConsoleOteAction extends ConsoleApiAction {
   @Inject
   public ConsoleOteAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       IamClient iamClient,
       @Parameter("registrarId") String registrarId, // Get request param
       @Config("gSuiteConsoleUserGroupEmailAddress") Optional<String> maybeGroupEmailAddress,
       @Named("base58StringGenerator") StringGenerator passwordGenerator,
       @Parameter("oteCreateData") Optional<OteCreateData> oteCreateData) {
     super(consoleApiParams);
-    this.gson = gson;
     this.passwordGenerator = passwordGenerator;
     this.oteCreateData = oteCreateData;
     this.maybeGroupEmailAddress = maybeGroupEmailAddress;
@@ -116,8 +112,13 @@ public class ConsoleOteAction extends ConsoleApiAction {
     consoleApiParams
         .response()
         .setPayload(
-            gson.toJson(
-                ImmutableMap.builder().putAll(registrarIdToTld).put("password", password).build()));
+            consoleApiParams
+                .gson()
+                .toJson(
+                    ImmutableMap.builder()
+                        .putAll(registrarIdToTld)
+                        .put("password", password)
+                        .build()));
   }
 
   @Override
@@ -153,7 +154,7 @@ public class ConsoleOteAction extends ConsoleApiAction {
                               convertSingleRequirement(statType, oteStats.getCount(statType)))
                       .collect(toImmutableList());
               consoleApiParams.response().setStatus(SC_OK);
-              consoleApiParams.response().setPayload(gson.toJson(stats));
+              consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(stats));
             });
   }
 

core/src/main/java/google/registry/ui/server/console/ConsoleRegistryLockAction.java

@@ -23,7 +23,6 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 import static jakarta.servlet.http.HttpServletResponse.SC_UNAUTHORIZED;
 
 import com.google.common.collect.ImmutableList;
-import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.flows.EppException;
 import google.registry.flows.domain.DomainFlowUtils;
@@ -72,7 +71,6 @@ public class ConsoleRegistryLockAction extends ConsoleApiAction {
 
   private final DomainLockUtils domainLockUtils;
   private final GmailClient gmailClient;
-  private final Gson gson;
   private final Optional<ConsoleRegistryLockPostInput> optionalPostInput;
   private final String registrarId;
 
@@ -81,14 +79,12 @@ public class ConsoleRegistryLockAction extends ConsoleApiAction {
       ConsoleApiParams consoleApiParams,
       DomainLockUtils domainLockUtils,
       GmailClient gmailClient,
-      Gson gson,
       @Parameter("consoleRegistryLockPostInput")
           Optional<ConsoleRegistryLockPostInput> optionalPostInput,
       @Parameter("registrarId") String registrarId) {
     super(consoleApiParams);
     this.domainLockUtils = domainLockUtils;
     this.gmailClient = gmailClient;
-    this.gson = gson;
     this.optionalPostInput = optionalPostInput;
     this.registrarId = registrarId;
   }
@@ -96,7 +92,7 @@ public class ConsoleRegistryLockAction extends ConsoleApiAction {
   @Override
   protected void getHandler(User user) {
     checkPermission(user, registrarId, ConsolePermission.REGISTRY_LOCK);
-    consoleApiParams.response().setPayload(gson.toJson(getLockedDomains()));
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(getLockedDomains()));
     consoleApiParams.response().setStatus(SC_OK);
   }
 

core/src/main/java/google/registry/ui/server/console/ConsoleRegistryLockVerifyAction.java

@@ -17,7 +17,6 @@ package google.registry.ui.server.console;
 import static google.registry.request.Action.Method.GET;
 
 import com.google.common.base.Ascii;
-import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.model.console.User;
 import google.registry.model.domain.RegistryLock;
@@ -42,18 +41,15 @@ public class ConsoleRegistryLockVerifyAction extends ConsoleApiAction {
   static final String PATH = "/console-api/registry-lock-verify";
 
   private final DomainLockUtils domainLockUtils;
-  private final Gson gson;
   private final String lockVerificationCode;
 
   @Inject
   public ConsoleRegistryLockVerifyAction(
       ConsoleApiParams consoleApiParams,
       DomainLockUtils domainLockUtils,
-      Gson gson,
       @Parameter("lockVerificationCode") String lockVerificationCode) {
     super(consoleApiParams);
     this.domainLockUtils = domainLockUtils;
-    this.gson = gson;
     this.lockVerificationCode = lockVerificationCode;
   }
 
@@ -68,7 +64,7 @@ public class ConsoleRegistryLockVerifyAction extends ConsoleApiAction {
     RegistryLockVerificationResponse lockResponse =
         new RegistryLockVerificationResponse(
             Ascii.toLowerCase(action.toString()), lock.getDomainName(), lock.getRegistrarId());
-    consoleApiParams.response().setPayload(gson.toJson(lockResponse));
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(lockResponse));
     consoleApiParams.response().setStatus(HttpServletResponse.SC_OK);
   }
 

core/src/main/java/google/registry/ui/server/console/ConsoleUpdateRegistrarAction.java

@@ -23,6 +23,8 @@ import static org.apache.http.HttpStatus.SC_OK;
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.ConsoleUpdateHistory;
+import google.registry.model.console.RegistrarUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
@@ -99,6 +101,11 @@ public class ConsoleUpdateRegistrarAction extends ConsoleApiAction {
                       .build();
 
               tm().put(updatedRegistrar);
+              finishAndPersistConsoleUpdateHistory(
+                  new RegistrarUpdateHistory.Builder()
+                      .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+                      .setRegistrar(updatedRegistrar)
+                      .setRequestBody(consoleApiParams.gson().toJson(registrarParam)));
               sendExternalUpdatesIfNecessary(
                   EmailInfo.create(
                       existingRegistrar.get(),

core/src/main/java/google/registry/ui/server/console/ConsoleUserDataAction.java

@@ -82,6 +82,8 @@ public class ConsoleUserDataAction extends ConsoleApiAction {
                 // auth checks.
                 "isAdmin", user.getUserRoles().isAdmin(),
                 "globalRole", user.getUserRoles().getGlobalRole(),
+                // registrar-specific roles
+                "userRoles", user.getUserRoles().getRegistrarRoles(),
                 // Include static contact resources in this call to minimize round trips
                 "productName", productName,
                 "supportEmail", supportEmail,

core/src/main/java/google/registry/ui/server/console/ConsoleUsersAction.java

@@ -21,6 +21,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.request.Action.Method.DELETE;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
+import static google.registry.request.Action.Method.PUT;
 import static jakarta.servlet.http.HttpServletResponse.SC_CREATED;
 import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@@ -28,13 +29,12 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
 import com.google.api.services.directory.Directory;
 import com.google.api.services.directory.model.UserName;
-import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
-import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.persistence.VKey;
@@ -47,9 +47,11 @@ import google.registry.tools.IamClient;
 import google.registry.util.StringGenerator;
 import java.io.IOException;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
-import java.util.stream.IntStream;
+import javax.annotation.Nullable;
 import javax.inject.Inject;
 import javax.inject.Named;
 
@@ -57,18 +59,17 @@ import javax.inject.Named;
     service = Action.GaeService.DEFAULT,
     gkeService = GkeService.CONSOLE,
     path = ConsoleUsersAction.PATH,
-    method = {GET, POST, DELETE},
+    method = {GET, POST, DELETE, PUT},
     auth = Auth.AUTH_PUBLIC_LOGGED_IN)
 public class ConsoleUsersAction extends ConsoleApiAction {
   static final String PATH = "/console-api/users";
+
   private static final int PASSWORD_LENGTH = 16;
 
-  private static final Splitter EMAIL_SPLITTER = Splitter.on('@').trimResults();
-  private final Gson gson;
   private final String registrarId;
   private final Directory directory;
   private final StringGenerator passwordGenerator;
-  private final Optional<UserDeleteData> userDeleteData;
+  private final Optional<UserData> userData;
   private final Optional<String> maybeGroupEmailAddress;
   private final IamClient iamClient;
   private final String gSuiteDomainName;
@@ -76,20 +77,18 @@ public class ConsoleUsersAction extends ConsoleApiAction {
   @Inject
   public ConsoleUsersAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       Directory directory,
       IamClient iamClient,
       @Config("gSuiteDomainName") String gSuiteDomainName,
       @Config("gSuiteConsoleUserGroupEmailAddress") Optional<String> maybeGroupEmailAddress,
       @Named("base58StringGenerator") StringGenerator passwordGenerator,
-      @Parameter("userDeleteData") Optional<UserDeleteData> userDeleteData,
+      @Parameter("userData") Optional<UserData> userData,
       @Parameter("registrarId") String registrarId) {
     super(consoleApiParams);
-    this.gson = gson;
     this.registrarId = registrarId;
     this.directory = directory;
     this.passwordGenerator = passwordGenerator;
-    this.userDeleteData = userDeleteData;
+    this.userData = userData;
     this.maybeGroupEmailAddress = maybeGroupEmailAddress;
     this.iamClient = iamClient;
     this.gSuiteDomainName = gSuiteDomainName;
@@ -100,7 +99,18 @@ public class ConsoleUsersAction extends ConsoleApiAction {
     // Temporary flag while testing
     if (user.getUserRoles().isAdmin()) {
       checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      tm().transact(() -> runCreateInTransaction());
+      tm().transact(this::runPostInTransaction);
+    } else {
+      consoleApiParams.response().setStatus(SC_FORBIDDEN);
+    }
+  }
+
+  @Override
+  protected void putHandler(User user) {
+    // Temporary flag while testing
+    if (user.getUserRoles().isAdmin()) {
+      checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
+      tm().transact(this::runUpdateInTransaction);
     } else {
       consoleApiParams.response().setStatus(SC_FORBIDDEN);
     }
@@ -109,18 +119,17 @@ public class ConsoleUsersAction extends ConsoleApiAction {
   @Override
   protected void getHandler(User user) {
     checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-    List<ImmutableMap> users =
+    List<UserData> users =
         getAllRegistrarUsers(registrarId).stream()
             .map(
                 u ->
-                    ImmutableMap.of(
-                        "emailAddress",
+                    new UserData(
                         u.getEmailAddress(),
-                        "role",
-                        u.getUserRoles().getRegistrarRoles().get(registrarId)))
+                        u.getUserRoles().getRegistrarRoles().get(registrarId).toString(),
+                        null))
             .collect(Collectors.toList());
 
-    consoleApiParams.response().setPayload(gson.toJson(users));
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(users));
     consoleApiParams.response().setStatus(SC_OK);
   }
 
@@ -129,66 +138,83 @@ public class ConsoleUsersAction extends ConsoleApiAction {
     // Temporary flag while testing
     if (user.getUserRoles().isAdmin()) {
       checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      tm().transact(() -> runDeleteInTransaction());
+      tm().transact(this::runDeleteInTransaction);
     } else {
       consoleApiParams.response().setStatus(SC_FORBIDDEN);
     }
   }
 
-  private void runDeleteInTransaction() throws IOException {
-    if (userDeleteData.isEmpty() || isNullOrEmpty(userDeleteData.get().userEmail)) {
-      throw new BadRequestException("Missing user data param");
+  private void runPostInTransaction() throws IOException {
+    validateRequestParams();
+    if (!tm().exists(VKey.create(User.class, this.userData.get().emailAddress))) {
+      this.runCreate();
+    } else {
+      this.runAppendUserToExistingRegistrar();
     }
-    String email = userDeleteData.get().userEmail;
-    User userToDelete =
-        tm().loadByKeyIfPresent(VKey.create(User.class, email))
-            .orElseThrow(
-                () -> new BadRequestException(String.format("User %s doesn't exist", email)));
+  }
 
-    if (!userToDelete.getUserRoles().getRegistrarRoles().containsKey(registrarId)) {
-      setFailedResponse(
-          String.format("Can't delete user not associated with registrarId %s", registrarId),
-          SC_FORBIDDEN);
+  private void runAppendUserToExistingRegistrar() {
+    ImmutableList<User> allRegistrarUsers = getAllRegistrarUsers(registrarId);
+    if (allRegistrarUsers.size() >= 4) {
+      throw new BadRequestException("Total users amount per registrar is limited to 4");
+    }
+
+    updateUserRegistrarRoles(
+        this.userData.get().emailAddress,
+        registrarId,
+        RegistrarRole.valueOf(this.userData.get().role));
+    consoleApiParams.response().setStatus(SC_OK);
+  }
+
+  private void runDeleteInTransaction() throws IOException {
+    if (!isModifyingRequestValid()) {
       return;
     }
 
-    try {
-      directory.users().delete(email).execute();
-    } catch (IOException e) {
-      setFailedResponse("Failed to delete the user workspace account", SC_INTERNAL_SERVER_ERROR);
-      throw e;
-    }
+    String email = this.userData.get().emailAddress;
+    User updatedUser = updateUserRegistrarRoles(email, registrarId, null);
 
-    VKey<User> key = VKey.create(User.class, email);
-    tm().delete(key);
-    User.revokeIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
+    // User has no registrars assigned
+    if (updatedUser.getUserRoles().getRegistrarRoles().size() == 0) {
+      try {
+        directory.users().delete(email).execute();
+      } catch (IOException e) {
+        setFailedResponse("Failed to delete the user workspace account", SC_INTERNAL_SERVER_ERROR);
+        throw e;
+      }
+
+      VKey<User> key = VKey.create(User.class, email);
+      tm().delete(key);
+      User.revokeIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
+    }
 
     consoleApiParams.response().setStatus(SC_OK);
   }
 
-  private void runCreateInTransaction() throws IOException {
+  private void runCreate() throws IOException {
     ImmutableList<User> allRegistrarUsers = getAllRegistrarUsers(registrarId);
-    if (allRegistrarUsers.size() >= 4)
+    if (allRegistrarUsers.size() >= 4) {
       throw new BadRequestException("Total users amount per registrar is limited to 4");
+    }
 
-    String nextAvailableEmail =
-        IntStream.range(1, 5)
-            .mapToObj(i -> String.format("%s-user%s@%s", registrarId, i, gSuiteDomainName))
-            .filter(email -> tm().loadByKeyIfPresent(VKey.create(User.class, email)).isEmpty())
-            .findFirst()
-            // Can only happen if registrar cycled through 20 users, which is unlikely
-            .orElseThrow(
-                () -> new BadRequestException("Failed to find available increment for new user"));
+    String newEmailPrefix = userData.get().emailAddress.trim();
+
+    if (!newEmailPrefix.matches("^[a-zA-Z0-9]{3}$")) {
+      throw new BadRequestException("Email prefix is invalid");
+    }
+
+    String newEmail = String.format("%s.%s@%s", newEmailPrefix, registrarId, gSuiteDomainName);
+    if (tm().loadByKeyIfPresent(VKey.create(User.class, newEmail)).isPresent()) {
+      throw new BadRequestException("Email prefix is not available");
+    }
 
     com.google.api.services.directory.model.User newUser =
         new com.google.api.services.directory.model.User();
 
     newUser.setName(
-        new UserName()
-            .setFamilyName(registrarId)
-            .setGivenName(EMAIL_SPLITTER.splitToList(nextAvailableEmail).get(0)));
+        new UserName().setFamilyName(registrarId).setGivenName(newEmailPrefix + "." + registrarId));
     newUser.setPassword(passwordGenerator.createString(PASSWORD_LENGTH));
-    newUser.setPrimaryEmail(nextAvailableEmail);
+    newUser.setPrimaryEmail(newEmail);
 
     try {
       directory.users().insert(newUser).execute();
@@ -202,24 +228,82 @@ public class ConsoleUsersAction extends ConsoleApiAction {
             .setRegistrarRoles(ImmutableMap.of(registrarId, ACCOUNT_MANAGER))
             .build();
 
-    User.Builder builder =
-        new User.Builder().setUserRoles(userRoles).setEmailAddress(newUser.getPrimaryEmail());
+    User.Builder builder = new User.Builder().setUserRoles(userRoles).setEmailAddress(newEmail);
     tm().put(builder.build());
-    User.grantIapPermission(
-        nextAvailableEmail, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
+    User.grantIapPermission(newEmail, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
 
     consoleApiParams.response().setStatus(SC_CREATED);
     consoleApiParams
         .response()
         .setPayload(
-            gson.toJson(
-                ImmutableMap.of(
-                    "password",
-                    newUser.getPassword(),
-                    "emailAddress",
-                    newUser.getPrimaryEmail(),
-                    "role",
-                    ACCOUNT_MANAGER)));
+            consoleApiParams
+                .gson()
+                .toJson(new UserData(newEmail, ACCOUNT_MANAGER.toString(), newUser.getPassword())));
+  }
+
+  private void runUpdateInTransaction() {
+    if (!isModifyingRequestValid()) {
+      return;
+    }
+
+    updateUserRegistrarRoles(
+        this.userData.get().emailAddress,
+        registrarId,
+        RegistrarRole.valueOf(this.userData.get().role));
+    consoleApiParams.response().setStatus(SC_OK);
+  }
+
+  private boolean isModifyingRequestValid() {
+    validateRequestParams();
+    User userToUpdate = verifyUserExists(userData.get().emailAddress);
+    return validateUserRegistrarAssociation(userToUpdate);
+  }
+
+  private void validateRequestParams() {
+    if (userData.isEmpty()
+        || isNullOrEmpty(userData.get().emailAddress)
+        || isNullOrEmpty(userData.get().role)) {
+      throw new BadRequestException("User data is missing or incomplete");
+    }
+  }
+
+  private User verifyUserExists(String email) {
+    return tm().loadByKeyIfPresent(VKey.create(User.class, email))
+        .orElseThrow(() -> new BadRequestException(String.format("User %s doesn't exist", email)));
+  }
+
+  private boolean validateUserRegistrarAssociation(User user) {
+    if (user.getUserRoles().getRegistrarRoles().containsKey(registrarId)) {
+      return true;
+    }
+    setFailedResponse(
+        String.format("Can't update user not associated with registrarId %s", registrarId),
+        SC_FORBIDDEN);
+    return false;
+  }
+
+  private User updateUserRegistrarRoles(String email, String registrarId, RegistrarRole newRole) {
+    Map<String, RegistrarRole> updatedRegistrarRoles;
+    User user = verifyUserExists(email);
+    if (newRole == null) {
+      updatedRegistrarRoles =
+          user.getUserRoles().getRegistrarRoles().entrySet().stream()
+              .filter(entry -> !Objects.equals(entry.getKey(), registrarId))
+              .collect(ImmutableMap.toImmutableMap(Map.Entry::getKey, Map.Entry::getValue));
+    } else {
+      updatedRegistrarRoles =
+          ImmutableMap.<String, RegistrarRole>builder()
+              .putAll(user.getUserRoles().getRegistrarRoles())
+              .put(registrarId, newRole)
+              .buildKeepingLast();
+    }
+    var updatedUser =
+        user.asBuilder()
+            .setUserRoles(
+                user.getUserRoles().asBuilder().setRegistrarRoles(updatedRegistrarRoles).build())
+            .build();
+    tm().put(updatedUser);
+    return updatedUser;
   }
 
   private ImmutableList<User> getAllRegistrarUsers(String registrarId) {
@@ -230,5 +314,6 @@ public class ConsoleUsersAction extends ConsoleApiAction {
                     .collect(toImmutableList()));
   }
 
-  public record UserDeleteData(@Expose String userEmail) {}
+  public record UserData(
+      @Expose String emailAddress, @Expose String role, @Expose @Nullable String password) {}
 }

core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java

@@ -26,8 +26,9 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
-import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.ConsoleUpdateHistory;
+import google.registry.model.console.RegistrarUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarBase;
@@ -62,7 +63,6 @@ public class RegistrarsAction extends ConsoleApiAction {
             WHERE registrar_id in :registrarIds
       """;
   static final String PATH = "/console-api/registrars";
-  private final Gson gson;
   private final Optional<Registrar> registrar;
   private final StringGenerator passwordGenerator;
   private final StringGenerator passcodeGenerator;
@@ -70,12 +70,10 @@ public class RegistrarsAction extends ConsoleApiAction {
   @Inject
   public RegistrarsAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       @Parameter("registrar") Optional<Registrar> registrar,
       @Named("base58StringGenerator") StringGenerator passwordGenerator,
       @Named("digitOnlyStringGenerator") StringGenerator passcodeGenerator) {
     super(consoleApiParams);
-    this.gson = gson;
     this.registrar = registrar;
     this.passcodeGenerator = passcodeGenerator;
     this.passwordGenerator = passwordGenerator;
@@ -88,7 +86,7 @@ public class RegistrarsAction extends ConsoleApiAction {
           Streams.stream(Registrar.loadAll())
               .filter(r -> allowedRegistrarTypes.contains(r.getType()))
               .collect(ImmutableList.toImmutableList());
-      consoleApiParams.response().setPayload(gson.toJson(registrars));
+      consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(registrars));
       consoleApiParams.response().setStatus(SC_OK);
     } else if (user.getUserRoles().getRegistrarRoles().values().stream()
         .anyMatch(role -> role.hasPermission(ConsolePermission.VIEW_REGISTRAR_DETAILS))) {
@@ -106,7 +104,7 @@ public class RegistrarsAction extends ConsoleApiAction {
                           .setParameter("registrarIds", accessibleRegistrarIds)
                           .getResultList());
 
-      consoleApiParams.response().setPayload(gson.toJson(registrars));
+      consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(registrars));
       consoleApiParams.response().setStatus(SC_OK);
     } else {
       consoleApiParams.response().setStatus(SC_FORBIDDEN);
@@ -175,6 +173,11 @@ public class RegistrarsAction extends ConsoleApiAction {
                   "Registrar with registrarId %s already exists",
                   registrar.getRegistrarId());
               tm().putAll(registrar, contact);
+              finishAndPersistConsoleUpdateHistory(
+                  new RegistrarUpdateHistory.Builder()
+                      .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+                      .setRegistrar(registrar)
+                      .setRequestBody(consoleApiParams.gson().toJson(registrar)));
             });
   }
 

core/src/main/java/google/registry/ui/server/console/settings/ContactAction.java

@@ -28,7 +28,6 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Multimap;
 import com.google.common.flogger.FluentLogger;
-import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
@@ -60,18 +59,15 @@ import javax.inject.Inject;
 public class ContactAction extends ConsoleApiAction {
   static final String PATH = "/console-api/settings/contacts";
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-  private final Gson gson;
   private final Optional<ImmutableSet<RegistrarPoc>> contacts;
   private final String registrarId;
 
   @Inject
   public ContactAction(
       ConsoleApiParams consoleApiParams,
-      Gson gson,
       @Parameter("registrarId") String registrarId,
       @Parameter("contacts") Optional<ImmutableSet<RegistrarPoc>> contacts) {
     super(consoleApiParams);
-    this.gson = gson;
     this.registrarId = registrarId;
     this.contacts = contacts;
   }
@@ -90,7 +86,7 @@ public class ContactAction extends ConsoleApiAction {
                         .collect(toImmutableList()));
 
     consoleApiParams.response().setStatus(SC_OK);
-    consoleApiParams.response().setPayload(gson.toJson(am));
+    consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(am));
   }
 
   @Override

core/src/main/java/google/registry/ui/server/console/settings/SecurityAction.java

@@ -25,6 +25,8 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.flows.certs.CertificateChecker.InsecureCertificateException;
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.ConsoleUpdateHistory;
+import google.registry.model.console.RegistrarUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
@@ -117,6 +119,11 @@ public class SecurityAction extends ConsoleApiAction {
 
     Registrar updatedRegistrar = updatedRegistrarBuilder.build();
     tm().put(updatedRegistrar);
+    finishAndPersistConsoleUpdateHistory(
+        new RegistrarUpdateHistory.Builder()
+            .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+            .setRegistrar(updatedRegistrar)
+            .setRequestBody(consoleApiParams.gson().toJson(registrar.get())));
 
     sendExternalUpdatesIfNecessary(
         EmailInfo.create(savedRegistrar, updatedRegistrar, ImmutableSet.of(), ImmutableSet.of()));

core/src/main/java/google/registry/ui/server/console/settings/WhoisRegistrarFieldsAction.java

@@ -22,6 +22,8 @@ import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 
 import google.registry.model.console.ConsolePermission;
+import google.registry.model.console.ConsoleUpdateHistory;
+import google.registry.model.console.RegistrarUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
@@ -104,6 +106,11 @@ public class WhoisRegistrarFieldsAction extends ConsoleApiAction {
             .setEmailAddress(providedRegistrar.getEmailAddress())
             .build();
     tm().put(newRegistrar);
+    finishAndPersistConsoleUpdateHistory(
+        new RegistrarUpdateHistory.Builder()
+            .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+            .setRegistrar(newRegistrar)
+            .setRequestBody(consoleApiParams.gson().toJson(registrar.get())));
     sendExternalUpdatesIfNecessary(
         EmailInfo.create(
             savedRegistrar,

core/src/test/java/google/registry/flows/ExtensionManagerTest.java

@@ -121,7 +121,7 @@ class ExtensionManagerTest {
   void testMetadataExtension_forbiddenWhenNotToolSource() {
     ExtensionManager manager =
         new TestInstanceBuilder()
-            .setEppRequestSource(EppRequestSource.CONSOLE)
+            .setEppRequestSource(EppRequestSource.TLS)
             .setDeclaredUris()
             .setSuppliedExtensions(MetadataExtension.class)
             .build();

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -22,7 +22,6 @@ import static google.registry.flows.FlowTestCase.UserPrivileges.SUPERUSER;
 import static google.registry.model.billing.BillingBase.Flag.ANCHOR_TENANT;
 import static google.registry.model.billing.BillingBase.Flag.RESERVED;
 import static google.registry.model.billing.BillingBase.Flag.SUNRISE;
-import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.DEFAULT;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.NONPREMIUM;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.SPECIFIED;
 import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
@@ -87,7 +86,6 @@ import google.registry.flows.domain.DomainCreateFlow.BulkDomainRegisteredForTooM
 import google.registry.flows.domain.DomainCreateFlow.MustHaveSignedMarksInCurrentPhaseException;
 import google.registry.flows.domain.DomainCreateFlow.NoGeneralRegistrationsInCurrentPhaseException;
 import google.registry.flows.domain.DomainCreateFlow.NoTrademarkedRegistrationsBeforeSunriseException;
-import google.registry.flows.domain.DomainCreateFlow.RenewalPriceInfo;
 import google.registry.flows.domain.DomainCreateFlow.SignedMarksOnlyDuringSunriseException;
 import google.registry.flows.domain.DomainFlowTmchUtils.FoundMarkExpiredException;
 import google.registry.flows.domain.DomainFlowTmchUtils.FoundMarkNotYetValidException;
@@ -303,10 +301,8 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
 
     boolean isAnchorTenant = expectedBillingFlags.contains(ANCHOR_TENANT);
     // Set up the creation cost.
-    BigDecimal createCost =
-        isDomainPremium(getUniqueIdFromCommand(), clock.nowUtc())
-            ? BigDecimal.valueOf(200)
-            : BigDecimal.valueOf(24);
+    boolean isDomainPremium = isDomainPremium(getUniqueIdFromCommand(), clock.nowUtc());
+    BigDecimal createCost = isDomainPremium ? BigDecimal.valueOf(200) : BigDecimal.valueOf(24);
     if (isAnchorTenant) {
       createCost = BigDecimal.ZERO;
     }
@@ -315,6 +311,26 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
           createCost.multiply(
               BigDecimal.valueOf(1 - RegistryConfig.getSunriseDomainCreateDiscount()));
     }
+    if (allocationToken != null) {
+      if (allocationToken
+          .getRegistrationBehavior()
+          .equals(RegistrationBehavior.NONPREMIUM_CREATE)) {
+        createCost =
+            createCost.subtract(
+                BigDecimal.valueOf(isDomainPremium ? 87 : 0)); // premium is 100, standard 13
+      }
+      if (allocationToken.getRenewalPriceBehavior().equals(NONPREMIUM)) {
+        createCost =
+            createCost.subtract(
+                BigDecimal.valueOf(isDomainPremium ? 89 : 0)); // premium is 100, standard 11
+      }
+      if (allocationToken.getRenewalPriceBehavior().equals(SPECIFIED)) {
+        createCost =
+            createCost
+                .subtract(BigDecimal.valueOf(isDomainPremium ? 100 : 11))
+                .add(allocationToken.getRenewalPrice().get().getAmount());
+      }
+    }
     FeesAndCredits feesAndCredits =
         new FeesAndCredits.Builder()
             .setCurrency(USD)
@@ -343,8 +359,12 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         .hasType(HistoryEntry.Type.DOMAIN_CREATE)
         .and()
         .hasPeriodYears(2);
-    RenewalPriceInfo renewalPriceInfo =
-        DomainCreateFlow.getRenewalPriceInfo(isAnchorTenant, Optional.ofNullable(allocationToken));
+    RenewalPriceBehavior expectedRenewalPriceBehavior =
+        isAnchorTenant
+            ? RenewalPriceBehavior.NONPREMIUM
+            : Optional.ofNullable(allocationToken)
+                .map(AllocationToken::getRenewalPriceBehavior)
+                .orElse(RenewalPriceBehavior.DEFAULT);
     // There should be one bill for the create and one for the recurrence autorenew event.
     BillingEvent createBillingEvent =
         new BillingEvent.Builder()
@@ -369,8 +389,11 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
             .setEventTime(domain.getRegistrationExpirationTime())
             .setRecurrenceEndTime(END_OF_TIME)
             .setDomainHistory(historyEntry)
-            .setRenewalPriceBehavior(renewalPriceInfo.renewalPriceBehavior())
-            .setRenewalPrice(renewalPriceInfo.renewalPrice())
+            .setRenewalPriceBehavior(expectedRenewalPriceBehavior)
+            .setRenewalPrice(
+                Optional.ofNullable(allocationToken)
+                    .flatMap(AllocationToken::getRenewalPrice)
+                    .orElse(null))
             .build();
 
     ImmutableSet.Builder<BillingBase> expectedBillingEvents =
@@ -3187,85 +3210,62 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
   }
 
   @Test
-  void testGetRenewalPriceInfo_isAnchorTenantWithoutToken_returnsNonPremiumAndNullPrice() {
-    assertThat(DomainCreateFlow.getRenewalPriceInfo(true, Optional.empty()))
-        .isEqualTo(RenewalPriceInfo.create(NONPREMIUM, null));
-  }
-
-  @Test
-  void testGetRenewalPriceInfo_isAnchorTenantWithDefaultToken_returnsNonPremiumAndNullPrice() {
-    assertThat(DomainCreateFlow.getRenewalPriceInfo(true, Optional.of(allocationToken)))
-        .isEqualTo(RenewalPriceInfo.create(NONPREMIUM, null));
-  }
-
-  @Test
-  void testGetRenewalPriceInfo_isNotAnchorTenantWithDefaultToken_returnsDefaultAndNullPrice() {
-    assertThat(DomainCreateFlow.getRenewalPriceInfo(false, Optional.of(allocationToken)))
-        .isEqualTo(RenewalPriceInfo.create(DEFAULT, null));
-  }
-
-  @Test
-  void testGetRenewalPriceInfo_isNotAnchorTenantWithoutToken_returnsDefaultAndNullPrice() {
-    assertThat(DomainCreateFlow.getRenewalPriceInfo(false, Optional.empty()))
-        .isEqualTo(RenewalPriceInfo.create(DEFAULT, null));
-  }
-
-  @Test
-  void
-      testGetRenewalPriceInfo_isNotAnchorTenantWithSpecifiedInToken_returnsSpecifiedAndCreatePrice() {
+  void testSuccess_anchorTenant_nonPremiumRenewal() throws Exception {
     AllocationToken token =
         persistResource(
             new AllocationToken.Builder()
                 .setToken("abc123")
                 .setTokenType(SINGLE_USE)
-                .setRenewalPriceBehavior(SPECIFIED)
-                .setRenewalPrice(Money.of(USD, 5))
+                .setDomainName("example.tld")
+                .setRegistrationBehavior(RegistrationBehavior.ANCHOR_TENANT)
                 .build());
-    assertThat(DomainCreateFlow.getRenewalPriceInfo(false, Optional.of(token)))
-        .isEqualTo(RenewalPriceInfo.create(SPECIFIED, Money.of(USD, 5)));
+    persistContactsAndHosts();
+    setEppInput(
+        "domain_create_allocationtoken.xml",
+        ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
+    runFlow();
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
   }
 
   @Test
-  void testGetRenewalPriceInfo_isAnchorTenantWithSpecifiedStateInToken_throwsError() {
-    IllegalArgumentException thrown =
-        assertThrows(
-            IllegalArgumentException.class,
-            () ->
-                DomainCreateFlow.getRenewalPriceInfo(
-                    true,
-                    Optional.of(
-                        persistResource(
-                            new AllocationToken.Builder()
-                                .setToken("abc123")
-                                .setTokenType(SINGLE_USE)
-                                .setRenewalPriceBehavior(SPECIFIED)
-                                .setRenewalPrice(Money.of(USD, 0))
-                                .build()))));
-    assertThat(thrown)
-        .hasMessageThat()
-        .isEqualTo("Renewal price behavior cannot be SPECIFIED for anchor tenant");
+  void testSuccess_nonAnchorTenant_nonPremiumRenewal() throws Exception {
+    createTld("example");
+    AllocationToken token =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("rich.example")
+                .setRenewalPriceBehavior(NONPREMIUM)
+                .build());
+    persistContactsAndHosts();
+    // Creation is still $100 but it'll create a NONPREMIUM renewal
+    setEppInput(
+        "domain_create_premium_allocationtoken.xml",
+        ImmutableMap.of("YEARS", "2", "FEE", "111.00"));
+    runFlow();
+    assertSuccessfulCreate("example", ImmutableSet.of(), token);
   }
 
   @Test
-  void testGetRenewalPriceInfo_withInvalidRenewalPriceBehavior_throwsError() {
-    IllegalArgumentException thrown =
-        assertThrows(
-            IllegalArgumentException.class,
-            () ->
-                DomainCreateFlow.getRenewalPriceInfo(
-                    true,
-                    Optional.of(
-                        persistResource(
-                            new AllocationToken.Builder()
-                                .setToken("abc123")
-                                .setTokenType(SINGLE_USE)
-                                .setRenewalPriceBehavior(RenewalPriceBehavior.valueOf("INVALID"))
-                                .build()))));
-    assertThat(thrown)
-        .hasMessageThat()
-        .isEqualTo(
-            "No enum constant"
-                + " google.registry.model.billing.BillingBase.RenewalPriceBehavior.INVALID");
+  void testSuccess_specifiedRenewalPriceToken_specifiedRecurrencePrice() throws Exception {
+    createTld("example");
+    AllocationToken token =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("rich.example")
+                .setRenewalPriceBehavior(SPECIFIED)
+                .setRenewalPrice(Money.of(USD, 1))
+                .build());
+    persistContactsAndHosts();
+    // Creation is still $100 but it'll create a $1 renewal
+    setEppInput(
+        "domain_create_premium_allocationtoken.xml",
+        ImmutableMap.of("YEARS", "2", "FEE", "101.00"));
+    runFlow();
+    assertSuccessfulCreate("example", ImmutableSet.of(), token);
   }
 
   @Test

core/src/test/java/google/registry/flows/domain/DomainDeleteFlowTest.java

@@ -1247,4 +1247,15 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
     clock.advanceOneMilli();
     runFlowAssertResponse(loadFile("domain_delete_response_fee_free_grace.xml"));
   }
+
+  @Test
+  void testSuccess_skipsPollMessage_whenConfigured() throws Exception {
+    setUpSuccessfulTest();
+    domain =
+        persistResource(
+            domain.asBuilder().setPersistedCurrentSponsorRegistrarId("NewRegistrar").build());
+    setRegistrarIdForFlow("NewRegistrar");
+    runFlowAssertResponse(loadFile("domain_delete_response_pending.xml"));
+    assertPollMessages();
+  }
 }

core/src/test/java/google/registry/flows/domain/DomainPricingLogicTest.java

@@ -1127,7 +1127,7 @@ public class DomainPricingLogicTest {
                 .setCurrency(USD)
                 .addFeeOrCredit(Fee.create(new BigDecimal("13.00"), CREATE, false))
                 .build());
-    // Two-year create should be 13 (standard price) + 100 (premium price)
+    // Two-year create should be 13 (standard price) + 100 (premium price), and it's premium
     assertThat(
             domainPricingLogic.getCreatePrice(
                 tld,
@@ -1140,7 +1140,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(new BigDecimal("113.00"), CREATE, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("113.00"), CREATE, true))
                 .build());
     assertThat(
             domainPricingLogic.getRenewPrice(
@@ -1156,4 +1156,90 @@ public class DomainPricingLogicTest {
                 .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
+
+  @Test
+  void testGetDomainCreatePrice_premium_multiYear_nonpremiumCreateAndRenewal() throws Exception {
+    AllocationToken allocationToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("premium.example")
+                .setRegistrationBehavior(AllocationToken.RegistrationBehavior.NONPREMIUM_CREATE)
+                .setRenewalPriceBehavior(NONPREMIUM)
+                .build());
+    // Two-year create should be standard create (13) + renewal (10) because both create and renewal
+    // are standard
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("23.00"), CREATE, false))
+                .build());
+    // Similarly, 3 years should be 13 + 10 + 10
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                3,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("33.00"), CREATE, false))
+                .build());
+  }
+
+  @Test
+  void testGetDomainCreatePrice_premium_multiYear_onlyNonpremiumRenewal() throws Exception {
+    AllocationToken allocationToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("premium.example")
+                .setRenewalPriceBehavior(NONPREMIUM)
+                .build());
+    // Two-year create should be 100 (premium 1st year) plus 10 (nonpremium 2nd year)
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("110.00"), CREATE, true))
+                .build());
+    // Similarly, 3 years should be 100 + 10 + 10
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                3,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("120.00"), CREATE, true))
+                .build());
+  }
 }

core/src/test/java/google/registry/flows/domain/DomainRestoreRequestFlowTest.java

@@ -74,6 +74,7 @@ import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.tld.Tld;
+import google.registry.persistence.VKey;
 import google.registry.testing.DatabaseHelper;
 import java.util.Map;
 import java.util.Optional;
@@ -103,12 +104,12 @@ class DomainRestoreRequestFlowTest extends ResourceFlowTestCase<DomainRestoreReq
     setEppInput("domain_update_restore_request.xml", ImmutableMap.of("DOMAIN", "example.tld"));
   }
 
-  void persistPendingDeleteDomain() throws Exception {
+  Domain persistPendingDeleteDomain() throws Exception {
     // The domain is now past what had been its expiration date at the time of deletion.
-    persistPendingDeleteDomain(clock.nowUtc().minusDays(5));
+    return persistPendingDeleteDomain(clock.nowUtc().minusDays(5));
   }
 
-  void persistPendingDeleteDomain(DateTime expirationTime) throws Exception {
+  Domain persistPendingDeleteDomain(DateTime expirationTime) throws Exception {
     Domain domain = persistResource(DatabaseHelper.newDomain(getUniqueIdFromCommand()));
     HistoryEntry historyEntry =
         persistResource(
@@ -118,29 +119,31 @@ class DomainRestoreRequestFlowTest extends ResourceFlowTestCase<DomainRestoreReq
                 .setRegistrarId(domain.getCurrentSponsorRegistrarId())
                 .setDomain(domain)
                 .build());
-    persistResource(
-        domain
-            .asBuilder()
-            .setRegistrationExpirationTime(expirationTime)
-            .setDeletionTime(clock.nowUtc().plusDays(35))
-            .addGracePeriod(
-                GracePeriod.create(
-                    GracePeriodStatus.REDEMPTION,
-                    domain.getRepoId(),
-                    clock.nowUtc().plusDays(1),
-                    "TheRegistrar",
-                    null))
-            .setStatusValues(ImmutableSet.of(StatusValue.PENDING_DELETE))
-            .setDeletePollMessage(
-                persistResource(
-                        new PollMessage.OneTime.Builder()
-                            .setRegistrarId("TheRegistrar")
-                            .setEventTime(clock.nowUtc().plusDays(5))
-                            .setHistoryEntry(historyEntry)
-                            .build())
-                    .createVKey())
-            .build());
+    domain =
+        persistResource(
+            domain
+                .asBuilder()
+                .setRegistrationExpirationTime(expirationTime)
+                .setDeletionTime(clock.nowUtc().plusDays(35))
+                .addGracePeriod(
+                    GracePeriod.create(
+                        GracePeriodStatus.REDEMPTION,
+                        domain.getRepoId(),
+                        clock.nowUtc().plusDays(1),
+                        "TheRegistrar",
+                        null))
+                .setStatusValues(ImmutableSet.of(StatusValue.PENDING_DELETE))
+                .setDeletePollMessage(
+                    persistResource(
+                            new PollMessage.OneTime.Builder()
+                                .setRegistrarId("TheRegistrar")
+                                .setEventTime(clock.nowUtc().plusDays(5))
+                                .setHistoryEntry(historyEntry)
+                                .build())
+                        .createVKey())
+                .build());
     clock.advanceOneMilli();
+    return domain;
   }
 
   @Test
@@ -491,6 +494,15 @@ class DomainRestoreRequestFlowTest extends ResourceFlowTestCase<DomainRestoreReq
         loadFile("domain_update_restore_request_response_premium.xml"));
   }
 
+  @Test
+  void testSuccess_worksWithoutPollMessage() throws Exception {
+    Domain domain = persistPendingDeleteDomain();
+    VKey<PollMessage.OneTime> deletePollMessage = domain.getDeletePollMessage();
+    persistResource(domain.asBuilder().setDeletePollMessage(null).build());
+    DatabaseHelper.deleteByKey(deletePollMessage);
+    runFlowAssertResponse(loadFile("generic_success_response.xml"));
+  }
+
   @Test
   void testFailure_doesNotExist() throws Exception {
     ResourceDoesNotExistException thrown =

core/src/test/java/google/registry/keyring/api/ComparatorKeyringTest.java

@@ -1,335 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.keyring.api;
-
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.LogsSubject.assertAboutLogs;
-import static java.nio.charset.StandardCharsets.UTF_8;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import com.google.common.testing.TestLogHandler;
-import google.registry.util.JdkLoggerConfig;
-import java.io.IOException;
-import java.util.logging.Level;
-import org.bouncycastle.bcpg.BCPGKey;
-import org.bouncycastle.bcpg.PublicKeyPacket;
-import org.bouncycastle.openpgp.PGPKeyPair;
-import org.bouncycastle.openpgp.PGPPrivateKey;
-import org.bouncycastle.openpgp.PGPPublicKey;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-/** Unit tests for {@link ComparatorKeyring}. */
-class ComparatorKeyringTest {
-
-  private static final String PUBLIC_KEY_FINGERPRINT = "fingerprint";
-  private static final String PUBLIC_KEY_TO_STRING =
-      "PGPPublicKey{fingerprint=66:69:6e:67:65:72:70:72:69:6e:74:}";
-  private static final String PRIVATE_KEY_TO_STRING =
-      "PGPPrivateKey{keyId=1}";
-  private static final String KEY_PAIR_TO_STRING =
-      String.format("PGPKeyPair{%s, %s}", PUBLIC_KEY_TO_STRING, PRIVATE_KEY_TO_STRING);
-
-  private static PGPPublicKey mockPublicKey(
-      boolean altFingerprint,
-      boolean altEncoded) throws IOException {
-    PGPPublicKey publicKey = mock(PGPPublicKey.class);
-    String fingerprint = altFingerprint ? "alternate" : PUBLIC_KEY_FINGERPRINT;
-    String encoded = altEncoded ? "alternate" : "publicKeyEncoded";
-    when(publicKey.getFingerprint()).thenReturn(fingerprint.getBytes(UTF_8));
-    when(publicKey.getEncoded()).thenReturn(encoded.getBytes(UTF_8));
-    return publicKey;
-  }
-
-  private static PGPPrivateKey mockPrivateKey(
-      boolean altId,
-      boolean altBcpgKeyFormat,
-      boolean altBcpgKeyEncoded,
-      boolean altPublicKeyPacketEncoded)
-      throws IOException {
-    String bcpgKeyFormat = altBcpgKeyFormat ? "alternate" : "bcpgFormat";
-    String bcpgKeyEncoded = altBcpgKeyEncoded ? "alternate" : "bcpgEncoded";
-    String publicKeyPacketEncoded = altPublicKeyPacketEncoded ? "alternate" : "packetEncoded";
-
-    BCPGKey bcpgKey = mock(BCPGKey.class);
-    PublicKeyPacket publicKeyPacket = mock(PublicKeyPacket.class);
-    when(bcpgKey.getFormat()).thenReturn(bcpgKeyFormat);
-    when(bcpgKey.getEncoded()).thenReturn(bcpgKeyEncoded.getBytes(UTF_8));
-    when(publicKeyPacket.getEncoded()).thenReturn(publicKeyPacketEncoded.getBytes(UTF_8));
-    return new PGPPrivateKey(altId ? 2 : 1, publicKeyPacket, bcpgKey);
-  }
-
-  private final TestLogHandler testLogHandler = new TestLogHandler();
-
-  @BeforeEach
-  void beforeEach() {
-    JdkLoggerConfig.getConfig(ComparatorKeyring.class).addHandler(testLogHandler);
-  }
-
-  @AfterEach
-  void afterEach() {
-    JdkLoggerConfig.getConfig(ComparatorKeyring.class).removeHandler(testLogHandler);
-  }
-
-  @Test
-  void testPublicKeyToString() throws Exception {
-    assertThat(
-            ComparatorKeyring.stringify(
-                mockPublicKey(false, false)))
-        .isEqualTo(PUBLIC_KEY_TO_STRING);
-  }
-
-  @Test
-  void testPublicKeyEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPublicKey(false, false),
-                mockPublicKey(false, false)))
-        .isTrue();
-  }
-
-  @Test
-  void testPublicKeyDifferFingerprint_notEqual() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPublicKey(false, false),
-                mockPublicKey(true, false)))
-        .isFalse();
-  }
-
-  @Test
-  void testPublicKeyDifferEncoded_notEqual() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPublicKey(false, false),
-                mockPublicKey(false, true)))
-        .isFalse();
-  }
-
-  @Test
-  void testPrivateKeyToString() throws Exception {
-    assertThat(
-            ComparatorKeyring.stringify(
-                mockPrivateKey(false, false, false, false)))
-        .isEqualTo(PRIVATE_KEY_TO_STRING);
-  }
-
-  @Test
-  void testPrivateKeyEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPrivateKey(false, false, false, false),
-                mockPrivateKey(false, false, false, false)))
-        .isTrue();
-  }
-
-  @Test
-  void testPrivateKeyDifferId_notEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPrivateKey(false, false, false, false),
-                mockPrivateKey(true, false, false, false)))
-        .isFalse();
-  }
-
-  @Test
-  void testPrivateKeyDifferBcpgFormat_notEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPrivateKey(false, false, false, false),
-                mockPrivateKey(false, true, false, false)))
-        .isFalse();
-  }
-
-  @Test
-  void testPrivateKeyDifferBcpgEncoding_notEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPrivateKey(false, false, false, false),
-                mockPrivateKey(false, false, true, false)))
-        .isFalse();
-  }
-
-  @Test
-  void testPrivateKeyDifferPublicKeyEncoding_notEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                mockPrivateKey(false, false, false, false),
-                mockPrivateKey(false, false, false, true)))
-        .isFalse();
-  }
-
-  @Test
-  void testKeyPairToString() throws Exception {
-    assertThat(
-            ComparatorKeyring.stringify(
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(false, false, false, false))))
-        .isEqualTo(KEY_PAIR_TO_STRING);
-  }
-
-  @Test
-  void testKeyPairEquals() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(false, false, false, false)),
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(false, false, false, false))))
-        .isTrue();
-  }
-
-  @Test
-  void testKeyPairDifferPublicKey_notEqual() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(false, false, false, false)),
-                new PGPKeyPair(
-                    mockPublicKey(true, false),
-                    mockPrivateKey(false, false, false, false))))
-        .isFalse();
-  }
-
-  @Test
-  void testKeyPairDifferPrivateKey_notEqual() throws Exception {
-    assertThat(
-            ComparatorKeyring.compare(
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(false, false, false, false)),
-                new PGPKeyPair(
-                    mockPublicKey(false, false),
-                    mockPrivateKey(true, false, false, false))))
-        .isFalse();
-  }
-
-  // We don't need to check every single method in the generated instance to see that it behaves
-  // correctly. This should have been tested in ComparatorGenerator.
-  //
-  // We will fully test a single method just to make sure everything is "connected" correctly.
-
-  @Test
-  void testRdeSigningKey_actualThrows() throws Exception {
-    Keyring actualKeyring = mock(Keyring.class);
-    Keyring secondKeyring = mock(Keyring.class);
-    PGPKeyPair keyPair =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(false, false, false, false));
-    when(actualKeyring.getRdeSigningKey()).thenThrow(new KeyringException("message"));
-    when(secondKeyring.getRdeSigningKey()).thenReturn(keyPair);
-    Keyring comparatorKeyring = ComparatorKeyring.create(actualKeyring, secondKeyring);
-
-    assertThrows(KeyringException.class, comparatorKeyring::getRdeSigningKey);
-
-    assertAboutLogs()
-        .that(testLogHandler)
-        .hasLogAtLevelWithMessage(
-            Level.SEVERE, ".getRdeSigningKey: Only actual implementation threw exception");
-  }
-
-  @Test
-  void testRdeSigningKey_secondThrows() throws Exception {
-    Keyring actualKeyring = mock(Keyring.class);
-    Keyring secondKeyring = mock(Keyring.class);
-    PGPKeyPair keyPair =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(false, false, false, false));
-    when(actualKeyring.getRdeSigningKey()).thenReturn(keyPair);
-    when(secondKeyring.getRdeSigningKey()).thenThrow(new KeyringException("message"));
-    Keyring comparatorKeyring = ComparatorKeyring.create(actualKeyring, secondKeyring);
-
-    assertThat(comparatorKeyring.getRdeSigningKey()).isSameInstanceAs(keyPair);
-
-    assertAboutLogs()
-        .that(testLogHandler)
-        .hasLogAtLevelWithMessage(
-            Level.SEVERE, ".getRdeSigningKey: Only second implementation threw exception");
-  }
-
-  @Test
-  void testRdeSigningKey_bothThrow() {
-    Keyring actualKeyring = mock(Keyring.class);
-    Keyring secondKeyring = mock(Keyring.class);
-    when(actualKeyring.getRdeSigningKey()).thenThrow(new KeyringException("message"));
-    when(secondKeyring.getRdeSigningKey()).thenThrow(new KeyringException("message"));
-    Keyring comparatorKeyring = ComparatorKeyring.create(actualKeyring, secondKeyring);
-
-    assertThrows(KeyringException.class, comparatorKeyring::getRdeSigningKey);
-
-    assertAboutLogs().that(testLogHandler).hasNoLogsAtLevel(Level.SEVERE);
-  }
-
-  @Test
-  void testRdeSigningKey_same() throws Exception {
-    Keyring actualKeyring = mock(Keyring.class);
-    Keyring secondKeyring = mock(Keyring.class);
-    PGPKeyPair keyPair =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(false, false, false, false));
-    PGPKeyPair keyPairCopy =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(false, false, false, false));
-    when(actualKeyring.getRdeSigningKey()).thenReturn(keyPair);
-    when(secondKeyring.getRdeSigningKey()).thenReturn(keyPairCopy);
-    Keyring comparatorKeyring = ComparatorKeyring.create(actualKeyring, secondKeyring);
-
-    assertThat(comparatorKeyring.getRdeSigningKey()).isSameInstanceAs(keyPair);
-
-    assertAboutLogs().that(testLogHandler).hasNoLogsAtLevel(Level.SEVERE);
-  }
-
-  @Test
-  void testRdeSigningKey_different() throws Exception {
-    Keyring actualKeyring = mock(Keyring.class);
-    Keyring secondKeyring = mock(Keyring.class);
-    PGPKeyPair keyPair =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(false, false, false, false));
-    PGPKeyPair keyPairDifferent =
-        new PGPKeyPair(
-            mockPublicKey(false, false),
-            mockPrivateKey(true, false, false, false));
-    when(actualKeyring.getRdeSigningKey()).thenReturn(keyPair);
-    when(secondKeyring.getRdeSigningKey()).thenReturn(keyPairDifferent);
-    Keyring comparatorKeyring = ComparatorKeyring.create(actualKeyring, secondKeyring);
-
-    assertThat(comparatorKeyring.getRdeSigningKey()).isSameInstanceAs(keyPair);
-
-    String alternateKeyPairString = String.format(
-        "PGPKeyPair{%s, %s}", PUBLIC_KEY_TO_STRING, "PGPPrivateKey{keyId=2}");
-
-    assertAboutLogs()
-        .that(testLogHandler)
-        .hasLogAtLevelWithMessage(
-            Level.SEVERE,
-            String.format(
-                ".getRdeSigningKey: Got different results! '%s' vs '%s'",
-                KEY_PAIR_TO_STRING,
-                alternateKeyPairString));
-  }
-}

core/src/test/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdaterTest.java

@@ -102,6 +102,24 @@ public class SecretManagerKeyringUpdaterTest {
     verifyPersistedSecret("bsa-api-key-string", secret);
   }
 
+  @Test
+  void sqlPrimaryConnectionName() {
+    String name = "name";
+    updater.setSqlPrimaryConnectionName(name).update();
+
+    assertThat(keyring.getSqlPrimaryConnectionName()).isEqualTo(name);
+    verifyPersistedSecret("sql-primary-conn-name", name);
+  }
+
+  @Test
+  void sqlReplicaConnectionName() {
+    String name = "name";
+    updater.setSqlReplicaConnectionName(name).update();
+
+    assertThat(keyring.getSqlReplicaConnectionName()).isEqualTo(name);
+    verifyPersistedSecret("sql-replica-conn-name", name);
+  }
+
   @Test
   void marksdbDnlLoginAndPassword() {
     String secret = "marksdbDnlLoginAndPassword";

core/src/test/java/google/registry/persistence/PersistenceModuleTest.java

@@ -20,7 +20,6 @@ import dagger.Component;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.config.RegistryConfig.ConfigModule;
-import google.registry.keyring.secretmanager.SecretManagerKeyringModule;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.privileges.secretmanager.SecretManagerModule;
 import google.registry.util.UtilsModule;
@@ -84,7 +83,6 @@ class PersistenceModuleTest {
         ConfigModule.class,
         CredentialModule.class,
         PersistenceModule.class,
-        SecretManagerKeyringModule.class,
         SecretManagerModule.class,
         UtilsModule.class
       })