Use downloaded Gradle distribution on Cloud Build (#2918 )

This way we get around the http url and no longer needs public access on the GCS bucket.
Add RST support in Sandbox (#2917 )
2026-07-09 01:27:09 +00:00 · 2025-12-30 21:08:04 +00:00 · 2025-12-30 20:59:28 +00:00 · 2025-12-30 16:41:56 +00:00 · 2025-12-27 00:57:24 +00:00 · 2025-12-26 16:08:04 +00:00
93 changed files with 1049 additions and 3877 deletions
@@ -56,7 +56,7 @@ PROPERTIES_HEADER = """\
 # nom_build), run ./nom_build --help.
 #
 # DO NOT EDIT THIS FILE BY HAND
-org.gradle.jvmargs=-Xmx2048m
+org.gradle.jvmargs=-Xmx4096m
 org.gradle.caching=true
 org.gradle.parallel=true
 """
@@ -117,28 +117,19 @@ PROPERTIES = [
    Property('dbUser', 'Database user name for use in connection'),
    Property('dbPassword', 'Database password for use in connection'),

-    Property('publish_repo',
-             'Maven repository that hosts the Cloud SQL schema jar and the '
-             'registry server test jars. Such jars are needed for '
-             'server/schema integration tests. Please refer to <a '
-             'href="./integration/README.md">integration project</a> for more '
-             'information.'),
-    Property('baseSchemaTag',
-             'The nomulus version tag of the schema for use in the schema'
-             'deployment integration test (:db:schemaIncrementalDeployTest)'),
-    Property('schema_version',
-             'The nomulus version tag of the schema for use in a database'
-             'integration test.'),
-    Property('nomulus_version',
-             'The version of nomulus to test against in a database '
-             'integration test.'),
    Property('dot_path',
             'The path to "dot", part of the graphviz package that converts '
             'a BEAM pipeline to image. Setting this property to empty string '
             'will disable image generation.',
             '/usr/bin/dot'),
    Property('pipeline',
-             'The name of the Beam pipeline being staged.')
+             'The name of the Beam pipeline being staged.'),
+    Property('nomulus_env',
+             'For use by scripts. Normally not set manually.'),
+    Property('schema_env',
+             'For use by scripts. Normally not set manually.'),
+    Property('schemaTestArtifactsDir',
+             'For use by scripts. Normally not set manually.')
 ]

 GRADLE_FLAGS = [
@@ -646,23 +646,6 @@ artifacts {
  nomulus_test testUberJar
 }

-publishing {
-  repositories {
-    maven {
-      url project.publish_repo
-    }
-  }
-  publications {
-    nomulusTestsPublication(MavenPublication) {
-      groupId 'google.registry'
-      artifactId 'nomulus_test'
-      version project.nomulus_version
-      artifact nomulusFossJar
-      artifact testUberJar
-    }
-  }
-}
-
 task buildToolImage(dependsOn: nomulus, type: Exec) {
  commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }
@@ -14,60 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.verifyTargetIdCount;

-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSet;
-import google.registry.config.RegistryConfig.Config;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.ForeignKeyUtils;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactCommand.Check;
-import google.registry.model.eppinput.ResourceCommand;
-import google.registry.model.eppoutput.CheckData.ContactCheck;
-import google.registry.model.eppoutput.CheckData.ContactCheckData;
-import google.registry.model.eppoutput.EppResponse;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.util.Clock;
 import jakarta.inject.Inject;

 /**
- * An EPP flow that checks whether a contact can be provisioned.
+ * An EPP flow that is meant to check whether a contact can be provisioned.
 *
- * <p>This flows can check the existence of multiple contacts simultaneously.
- *
- * @error {@link google.registry.flows.exceptions.TooManyResourceChecksException}
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_CHECK)
-public final class ContactCheckFlow implements TransactionalFlow {
-
-  @Inject ResourceCommand resourceCommand;
-  @Inject @RegistrarId String registrarId;
-  @Inject ExtensionManager extensionManager;
-  @Inject Clock clock;
-  @Inject @Config("maxChecks") int maxChecks;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactCheckFlow extends ContactsProhibitedFlow {
  @Inject ContactCheckFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate(); // There are no legal extensions for this flow.
-    ImmutableList<String> targetIds = ((Check) resourceCommand).getTargetIds();
-    verifyTargetIdCount(targetIds, maxChecks);
-    ImmutableSet<String> existingIds =
-        ForeignKeyUtils.loadKeys(Contact.class, targetIds, clock.nowUtc()).keySet();
-    ImmutableList.Builder<ContactCheck> checks = new ImmutableList.Builder<>();
-    for (String id : targetIds) {
-      boolean unused = !existingIds.contains(id);
-      checks.add(ContactCheck.create(unused, id, unused ? null : "In use"));
-    }
-    return responseBuilder.setResData(ContactCheckData.create(checks.build())).build();
-  }
 }
@@ -14,94 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceDoesNotExist;
-import static google.registry.flows.contact.ContactFlowUtils.validateAsciiPostalInfo;
-import static google.registry.flows.contact.ContactFlowUtils.validateContactAgainstPolicy;
-import static google.registry.model.EppResourceUtils.createRepoId;
-import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_PROHIBITED;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.config.RegistryConfig.Config;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
-import google.registry.flows.exceptions.ResourceAlreadyExistsForThisClientException;
-import google.registry.flows.exceptions.ResourceCreateContentionException;
-import google.registry.model.common.FeatureFlag;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactCommand.Create;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppinput.ResourceCommand;
-import google.registry.model.eppoutput.CreateData.ContactCreateData;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import jakarta.inject.Inject;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that creates a new contact.
+ * An EPP flow meant to create a new contact.
 *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
 * @error {@link ContactsProhibitedException}
- * @error {@link ResourceAlreadyExistsForThisClientException}
- * @error {@link ResourceCreateContentionException}
- * @error {@link ContactFlowUtils.BadInternationalizedPostalInfoException}
- * @error {@link ContactFlowUtils.DeclineContactDisclosureFieldDisallowedPolicyException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_CREATE)
-public final class ContactCreateFlow implements MutatingFlow {
-
-  @Inject ResourceCommand resourceCommand;
-  @Inject ExtensionManager extensionManager;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
-  @Inject @Config("contactAndHostRoidSuffix") String roidSuffix;
+public final class ContactCreateFlow extends ContactsProhibitedFlow {
  @Inject ContactCreateFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    if (FeatureFlag.isActiveNow(MINIMUM_DATASET_CONTACTS_PROHIBITED)) {
-      throw new ContactsProhibitedException();
-    }
-    Create command = (Create) resourceCommand;
-    DateTime now = tm().getTransactionTime();
-    verifyResourceDoesNotExist(Contact.class, targetId, now, registrarId);
-    Contact newContact =
-        new Contact.Builder()
-            .setContactId(targetId)
-            .setAuthInfo(command.getAuthInfo())
-            .setCreationRegistrarId(registrarId)
-            .setPersistedCurrentSponsorRegistrarId(registrarId)
-            .setRepoId(createRepoId(tm().allocateId(), roidSuffix))
-            .setFaxNumber(command.getFax())
-            .setVoiceNumber(command.getVoice())
-            .setDisclose(command.getDisclose())
-            .setEmailAddress(command.getEmail())
-            .setInternationalizedPostalInfo(command.getInternationalizedPostalInfo())
-            .setLocalizedPostalInfo(command.getLocalizedPostalInfo())
-            .build();
-    validateAsciiPostalInfo(newContact.getInternationalizedPostalInfo());
-    validateContactAgainstPolicy(newContact);
-    historyBuilder
-        .setType(HistoryEntry.Type.CONTACT_CREATE)
-        .setXmlBytes(null) // We don't want to store contact details in the history entry.
-        .setContact(newContact);
-    tm().insertAll(ImmutableSet.of(newContact, historyBuilder.build()));
-    return responseBuilder
-        .setResData(ContactCreateData.create(newContact.getContactId(), now))
-        .build();
-  }
 }
@@ -14,97 +14,20 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.DELETE_PROHIBITED_STATUSES;
-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.checkLinkedDomains;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
-import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.ResourceTransferUtils.handlePendingTransferOnDelete;
-import static google.registry.model.eppoutput.Result.Code.SUCCESS;
-import static google.registry.model.transfer.TransferStatus.SERVER_CANCELLED;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.Superuser;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.reporting.HistoryEntry.Type;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that deletes a contact.
+ * An EPP flow that is meant to delete a contact.
 *
- * <p>Contacts that are in use by any domain cannot be deleted. The flow may return immediately if a
- * quick smoke check determines that deletion is impossible due to an existing reference. However, a
- * successful delete will always be asynchronous, as all existing domains must be checked for
- * references to the host before the deletion is allowed to proceed. A poll message will be written
- * with the success or failure message when the process is complete.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
- * @error {@link google.registry.flows.exceptions.ResourceStatusProhibitsOperationException}
- * @error {@link google.registry.flows.exceptions.ResourceToDeleteIsReferencedException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_DELETE)
-public final class ContactDeleteFlow implements MutatingFlow {
-
-  @Inject ExtensionManager extensionManager;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject Trid trid;
-  @Inject @Superuser boolean isSuperuser;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
-
+public final class ContactDeleteFlow extends ContactsProhibitedFlow {
  @Inject
  ContactDeleteFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
-    checkLinkedDomains(targetId, now, Contact.class);
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyOptionalAuthInfo(authInfo, existingContact);
-    verifyNoDisallowedStatuses(existingContact, ImmutableSet.of(StatusValue.PENDING_DELETE));
-    if (!isSuperuser) {
-      verifyNoDisallowedStatuses(existingContact, DELETE_PROHIBITED_STATUSES);
-      verifyResourceOwnership(registrarId, existingContact);
-    }
-    // Handle pending transfers on contact deletion.
-    Contact newContact =
-        existingContact.getStatusValues().contains(StatusValue.PENDING_TRANSFER)
-            ? denyPendingTransfer(existingContact, SERVER_CANCELLED, now, registrarId)
-            : existingContact;
-    // Wipe out PII on contact deletion.
-    newContact =
-        newContact.asBuilder().wipeOut().setStatusValues(null).setDeletionTime(now).build();
-    ContactHistory contactHistory =
-        historyBuilder.setType(Type.CONTACT_DELETE).setContact(newContact).build();
-    handlePendingTransferOnDelete(existingContact, newContact, now, contactHistory);
-    tm().insert(contactHistory);
-    tm().update(newContact);
-    return responseBuilder.setResultFromCode(SUCCESS).build();
-  }
 }
@@ -1,126 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.flows.contact;
-
-import static google.registry.model.contact.PostalInfo.Type.INTERNATIONALIZED;
-
-import com.google.common.base.CharMatcher;
-import com.google.common.base.Preconditions;
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Sets;
-import google.registry.flows.EppException;
-import google.registry.flows.EppException.ParameterValuePolicyErrorException;
-import google.registry.flows.EppException.ParameterValueSyntaxErrorException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAddress;
-import google.registry.model.contact.PostalInfo;
-import google.registry.model.poll.PendingActionNotificationResponse.ContactPendingActionNotificationResponse;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
-import google.registry.model.transfer.TransferData;
-import google.registry.model.transfer.TransferResponse.ContactTransferResponse;
-import java.util.Set;
-import javax.annotation.Nullable;
-import org.joda.time.DateTime;
-
-/** Static utility functions for contact flows. */
-public class ContactFlowUtils {
-  /** Check that an internationalized postal info has only ascii characters. */
-  static void validateAsciiPostalInfo(@Nullable PostalInfo internationalized) throws EppException {
-    if (internationalized != null) {
-      Preconditions.checkState(INTERNATIONALIZED.equals(internationalized.getType()));
-      ContactAddress address = internationalized.getAddress();
-      Set<String> fields = Sets.newHashSet(
-          internationalized.getName(),
-          internationalized.getOrg(),
-          address.getCity(),
-          address.getCountryCode(),
-          address.getState(),
-          address.getZip());
-      fields.addAll(address.getStreet());
-      for (String field : fields) {
-        if (field != null && !CharMatcher.ascii().matchesAllOf(field)) {
-          throw new BadInternationalizedPostalInfoException();
-        }
-      }
-    }
-  }
-
-  /** Check contact's state against server policy. */
-  static void validateContactAgainstPolicy(Contact contact) throws EppException {
-    if (contact.getDisclose() != null && !contact.getDisclose().getFlag()) {
-      throw new DeclineContactDisclosureFieldDisallowedPolicyException();
-    }
-  }
-
-  /** Create a poll message for the gaining client in a transfer. */
-  static PollMessage createGainingTransferPollMessage(
-      String targetId, TransferData transferData, DateTime now, HistoryEntryId contactHistoryId) {
-    return new PollMessage.OneTime.Builder()
-        .setRegistrarId(transferData.getGainingRegistrarId())
-        .setEventTime(transferData.getPendingTransferExpirationTime())
-        .setMsg(transferData.getTransferStatus().getMessage())
-        .setResponseData(
-            ImmutableList.of(
-                createTransferResponse(targetId, transferData),
-                ContactPendingActionNotificationResponse.create(
-                    targetId,
-                    transferData.getTransferStatus().isApproved(),
-                    transferData.getTransferRequestTrid(),
-                    now)))
-        .setContactHistoryId(contactHistoryId)
-        .build();
-  }
-
-  /** Create a poll message for the losing client in a transfer. */
-  static PollMessage createLosingTransferPollMessage(
-      String targetId, TransferData transferData, HistoryEntryId contactHistoryId) {
-    return new PollMessage.OneTime.Builder()
-        .setRegistrarId(transferData.getLosingRegistrarId())
-        .setEventTime(transferData.getPendingTransferExpirationTime())
-        .setMsg(transferData.getTransferStatus().getMessage())
-        .setResponseData(ImmutableList.of(createTransferResponse(targetId, transferData)))
-        .setContactHistoryId(contactHistoryId)
-        .build();
-  }
-
-  /** Create a {@link ContactTransferResponse} off of the info in a {@link TransferData}. */
-  static ContactTransferResponse createTransferResponse(
-      String targetId, TransferData transferData) {
-    return new ContactTransferResponse.Builder()
-        .setContactId(targetId)
-        .setGainingRegistrarId(transferData.getGainingRegistrarId())
-        .setLosingRegistrarId(transferData.getLosingRegistrarId())
-        .setPendingTransferExpirationTime(transferData.getPendingTransferExpirationTime())
-        .setTransferRequestTime(transferData.getTransferRequestTime())
-        .setTransferStatus(transferData.getTransferStatus())
-        .build();
-  }
-
-  /** Declining contact disclosure is disallowed by server policy. */
-  static class DeclineContactDisclosureFieldDisallowedPolicyException
-      extends ParameterValuePolicyErrorException {
-    public DeclineContactDisclosureFieldDisallowedPolicyException() {
-      super("Declining contact disclosure is disallowed by server policy.");
-    }
-  }
-
-  /** Internationalized postal infos can only contain ASCII characters. */
-  static class BadInternationalizedPostalInfoException extends ParameterValueSyntaxErrorException {
-    public BadInternationalizedPostalInfoException() {
-      super("Internationalized postal infos can only contain ASCII characters");
-    }
-  }
-}
@@ -14,91 +14,20 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
-import static google.registry.model.EppResourceUtils.isLinked;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.Superuser;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactInfoData;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppoutput.EppResponse;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.util.Clock;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that returns information about a contact.
+ * An EPP flow that is meant to return information about a contact.
 *
- * <p>The response includes the contact's postal info, phone numbers, emails, the authInfo which can
- * be used to request a transfer and the details of the contact's most recent transfer if it has
- * ever been transferred. Any registrar can see any contact's information, but the authInfo is only
- * visible to the registrar that owns the contact or to a registrar that already supplied it.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_INFO)
-public final class ContactInfoFlow implements TransactionalFlow {
-
-  @Inject ExtensionManager extensionManager;
-  @Inject Clock clock;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @Superuser boolean isSuperuser;
-  @Inject EppResponse.Builder responseBuilder;
-
+public final class ContactInfoFlow extends ContactsProhibitedFlow {
  @Inject
  ContactInfoFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    DateTime now = clock.nowUtc();
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate(); // There are no legal extensions for this flow.
-    Contact contact = loadAndVerifyExistence(Contact.class, targetId, now);
-    if (!isSuperuser) {
-      verifyResourceOwnership(registrarId, contact);
-    }
-    boolean includeAuthInfo =
-        registrarId.equals(contact.getCurrentSponsorRegistrarId()) || authInfo.isPresent();
-    ImmutableSet.Builder<StatusValue> statusValues = new ImmutableSet.Builder<>();
-    statusValues.addAll(contact.getStatusValues());
-    if (isLinked(contact.createVKey(), now)) {
-      statusValues.add(StatusValue.LINKED);
-    }
-    return responseBuilder
-        .setResData(
-            ContactInfoData.newBuilder()
-                .setContactId(contact.getContactId())
-                .setRepoId(contact.getRepoId())
-                .setStatusValues(statusValues.build())
-                .setPostalInfos(contact.getPostalInfosAsList())
-                .setVoiceNumber(contact.getVoiceNumber())
-                .setFaxNumber(contact.getFaxNumber())
-                .setEmailAddress(contact.getEmailAddress())
-                .setCurrentSponsorRegistrarId(contact.getCurrentSponsorRegistrarId())
-                .setCreationRegistrarId(contact.getCreationRegistrarId())
-                .setCreationTime(contact.getCreationTime())
-                .setLastEppUpdateRegistrarId(contact.getLastEppUpdateRegistrarId())
-                .setLastEppUpdateTime(contact.getLastEppUpdateTime())
-                .setLastTransferTime(contact.getLastTransferTime())
-                .setAuthInfo(includeAuthInfo ? contact.getAuthInfo() : null)
-                .setDisclose(contact.getDisclose())
-                .build())
-        .build();
-  }
 }
@@ -14,92 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyHasPendingTransfer;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
-import static google.registry.flows.contact.ContactFlowUtils.createGainingTransferPollMessage;
-import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
-import static google.registry.model.ResourceTransferUtils.approvePendingTransfer;
-import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_TRANSFER_APPROVE;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppinput.ResourceCommand;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.poll.PollMessage;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that approves a pending transfer on a contact.
+ * An EPP flow that is meant to approve a pending transfer on a contact.
 *
- * <p>The "gaining" registrar requests a transfer from the "losing" (aka current) registrar. The
- * losing registrar has a "transfer" time period to respond (by default five days) after which the
- * transfer is automatically approved. Within that window, this flow allows the losing client to
- * explicitly approve the transfer request, which then becomes effective immediately.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.exceptions.NotPendingTransferException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_TRANSFER_APPROVE)
-public final class ContactTransferApproveFlow implements MutatingFlow {
-
-  @Inject ResourceCommand resourceCommand;
-  @Inject ExtensionManager extensionManager;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactTransferApproveFlow extends ContactsProhibitedFlow {
  @Inject ContactTransferApproveFlow() {}
-
-  /**
-   * The logic in this flow, which handles client approvals, very closely parallels the logic in
-   * {@link Contact#cloneProjectedAtTime} which handles implicit server approvals.
-   */
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyOptionalAuthInfo(authInfo, existingContact);
-    verifyHasPendingTransfer(existingContact);
-    verifyResourceOwnership(registrarId, existingContact);
-    Contact newContact =
-        approvePendingTransfer(existingContact, TransferStatus.CLIENT_APPROVED, now);
-    ContactHistory contactHistory =
-        historyBuilder.setType(CONTACT_TRANSFER_APPROVE).setContact(newContact).build();
-    // Create a poll message for the gaining client.
-    PollMessage gainingPollMessage =
-        createGainingTransferPollMessage(
-            targetId, newContact.getTransferData(), now, contactHistory.getHistoryEntryId());
-    tm().insertAll(ImmutableSet.of(contactHistory, gainingPollMessage));
-    tm().update(newContact);
-    // Delete the billing event and poll messages that were written in case the transfer would have
-    // been implicitly server approved.
-    tm().delete(existingContact.getTransferData().getServerApproveEntities());
-    return responseBuilder
-        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
-        .build();
-  }
 }
@@ -14,88 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyHasPendingTransfer;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyTransferInitiator;
-import static google.registry.flows.contact.ContactFlowUtils.createLosingTransferPollMessage;
-import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
-import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_TRANSFER_CANCEL;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppinput.ResourceCommand;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.poll.PollMessage;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that cancels a pending transfer on a contact.
+ * An EPP flow that is meant to cancel a pending transfer on a contact.
 *
- * <p>The "gaining" registrar requests a transfer from the "losing" (aka current) registrar. The
- * losing registrar has a "transfer" time period to respond (by default five days) after which the
- * transfer is automatically approved. Within that window, this flow allows the gaining client to
- * withdraw the transfer request.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.exceptions.NotPendingTransferException}
- * @error {@link google.registry.flows.exceptions.NotTransferInitiatorException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_TRANSFER_CANCEL)
-public final class ContactTransferCancelFlow implements MutatingFlow {
-
-  @Inject ResourceCommand resourceCommand;
-  @Inject ExtensionManager extensionManager;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactTransferCancelFlow extends ContactsProhibitedFlow {
  @Inject ContactTransferCancelFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyOptionalAuthInfo(authInfo, existingContact);
-    verifyHasPendingTransfer(existingContact);
-    verifyTransferInitiator(registrarId, existingContact);
-    Contact newContact =
-        denyPendingTransfer(existingContact, TransferStatus.CLIENT_CANCELLED, now, registrarId);
-    ContactHistory contactHistory =
-        historyBuilder.setType(CONTACT_TRANSFER_CANCEL).setContact(newContact).build();
-    // Create a poll message for the losing client.
-    PollMessage losingPollMessage =
-        createLosingTransferPollMessage(
-            targetId, newContact.getTransferData(), contactHistory.getHistoryEntryId());
-    tm().insertAll(ImmutableSet.of(contactHistory, losingPollMessage));
-    tm().update(newContact);
-    // Delete the billing event and poll messages that were written in case the transfer would have
-    // been implicitly server approved.
-    tm().delete(existingContact.getTransferData().getServerApproveEntities());
-    return responseBuilder
-        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
-        .build();
-  }
 }
@@ -14,74 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;

-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.TransactionalFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.flows.exceptions.NoTransferHistoryToQueryException;
-import google.registry.flows.exceptions.NotAuthorizedToViewTransferException;
-import google.registry.model.contact.Contact;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppoutput.EppResponse;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.util.Clock;
 import jakarta.inject.Inject;
-import java.util.Optional;

 /**
- * An EPP flow that queries a pending transfer on a contact.
+ * An EPP flow that is meant to query a pending transfer on a contact.
 *
- * <p>The "gaining" registrar requests a transfer from the "losing" (aka current) registrar. The
- * losing registrar has a "transfer" time period to respond (by default five days) after which the
- * transfer is automatically approved. This flow can be used by the gaining or losing registrars (or
- * anyone with the correct authId) to see the status of a transfer, which may still be pending or
- * may have been approved, rejected, cancelled or implicitly approved by virtue of the transfer
- * period expiring.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.exceptions.NoTransferHistoryToQueryException}
- * @error {@link google.registry.flows.exceptions.NotAuthorizedToViewTransferException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_TRANSFER_QUERY)
-public final class ContactTransferQueryFlow implements TransactionalFlow {
-
-  @Inject ExtensionManager extensionManager;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject Clock clock;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactTransferQueryFlow extends ContactsProhibitedFlow {
  @Inject ContactTransferQueryFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate(); // There are no legal extensions for this flow.
-    Contact contact = loadAndVerifyExistence(Contact.class, targetId, clock.nowUtc());
-    verifyOptionalAuthInfo(authInfo, contact);
-    // Most of the fields on the transfer response are required, so there's no way to return valid
-    // XML if the object has never been transferred (and hence the fields aren't populated).
-    if (contact.getTransferData().getTransferStatus() == null) {
-      throw new NoTransferHistoryToQueryException();
-    }
-    // Note that the authorization info on the command (if present) has already been verified. If
-    // it's present, then the other checks are unnecessary.
-    if (authInfo.isEmpty()
-        && !registrarId.equals(contact.getTransferData().getGainingRegistrarId())
-        && !registrarId.equals(contact.getTransferData().getLosingRegistrarId())) {
-      throw new NotAuthorizedToViewTransferException();
-    }
-    return responseBuilder
-        .setResData(createTransferResponse(targetId, contact.getTransferData()))
-        .build();
-  }
 }
@@ -14,85 +14,19 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyHasPendingTransfer;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
-import static google.registry.flows.contact.ContactFlowUtils.createGainingTransferPollMessage;
-import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
-import static google.registry.model.ResourceTransferUtils.denyPendingTransfer;
-import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_TRANSFER_REJECT;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.poll.PollMessage;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that rejects a pending transfer on a contact.
+ * An EPP flow that is meant to reject a pending transfer on a contact.
 *
- * <p>The "gaining" registrar requests a transfer from the "losing" (aka current) registrar. The
- * losing registrar has a "transfer" time period to respond (by default five days) after which the
- * transfer is automatically approved. Within that window, this flow allows the losing client to
- * reject the transfer request.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
- * @error {@link google.registry.flows.exceptions.NotPendingTransferException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_TRANSFER_REJECT)
-public final class ContactTransferRejectFlow implements MutatingFlow {
-
-  @Inject ExtensionManager extensionManager;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactTransferRejectFlow extends ContactsProhibitedFlow {
  @Inject ContactTransferRejectFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyOptionalAuthInfo(authInfo, existingContact);
-    verifyHasPendingTransfer(existingContact);
-    verifyResourceOwnership(registrarId, existingContact);
-    Contact newContact =
-        denyPendingTransfer(existingContact, TransferStatus.CLIENT_REJECTED, now, registrarId);
-    ContactHistory contactHistory =
-        historyBuilder.setType(CONTACT_TRANSFER_REJECT).setContact(newContact).build();
-    PollMessage gainingPollMessage =
-        createGainingTransferPollMessage(
-            targetId, newContact.getTransferData(), now, contactHistory.getHistoryEntryId());
-    tm().insertAll(ImmutableSet.of(contactHistory, gainingPollMessage));
-    tm().update(newContact);
-    // Delete the billing event and poll messages that were written in case the transfer would have
-    // been implicitly server approved.
-    tm().delete(existingContact.getTransferData().getServerApproveEntities());
-    return responseBuilder
-        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
-        .build();
-  }
 }
@@ -14,162 +14,20 @@

 package google.registry.flows.contact;

-import static google.registry.flows.FlowUtils.createHistoryEntryId;
-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyAuthInfoPresentForResourceTransfer;
-import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses;
-import static google.registry.flows.contact.ContactFlowUtils.createGainingTransferPollMessage;
-import static google.registry.flows.contact.ContactFlowUtils.createLosingTransferPollMessage;
-import static google.registry.flows.contact.ContactFlowUtils.createTransferResponse;
-import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
-import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_TRANSFER_REQUEST;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.config.RegistryConfig.Config;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
-import google.registry.flows.exceptions.AlreadyPendingTransferException;
-import google.registry.flows.exceptions.ObjectAlreadySponsoredException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.eppoutput.EppResponse;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
-import google.registry.model.transfer.ContactTransferData;
-import google.registry.model.transfer.TransferStatus;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;

 /**
- * An EPP flow that requests a transfer on a contact.
+ * An EPP flow that is meant to request a transfer on a contact.
 *
- * <p>The "gaining" registrar requests a transfer from the "losing" (aka current) registrar. The
- * losing registrar has a "transfer" time period to respond (by default five days) after which the
- * transfer is automatically approved. Within that window, the transfer might be approved explicitly
- * by the losing registrar or rejected, and the gaining registrar can also cancel the transfer
- * request.
- *
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.exceptions.AlreadyPendingTransferException}
- * @error {@link google.registry.flows.exceptions.MissingTransferRequestAuthInfoException}
- * @error {@link google.registry.flows.exceptions.ObjectAlreadySponsoredException}
- * @error {@link google.registry.flows.exceptions.ResourceStatusProhibitsOperationException}
+ * @error {@link ContactsProhibitedException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_TRANSFER_REQUEST)
-public final class ContactTransferRequestFlow implements MutatingFlow {
-
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES =
-      ImmutableSet.of(
-          StatusValue.CLIENT_TRANSFER_PROHIBITED,
-          StatusValue.PENDING_DELETE,
-          StatusValue.SERVER_TRANSFER_PROHIBITED);
-
-  @Inject ExtensionManager extensionManager;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @RegistrarId String gainingClientId;
-  @Inject @TargetId String targetId;
-
-  @Inject
-  @Config("contactAutomaticTransferLength")
-  Duration automaticTransferLength;
-
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject Trid trid;
-  @Inject EppResponse.Builder responseBuilder;
-
+public final class ContactTransferRequestFlow extends ContactsProhibitedFlow {
  @Inject
  ContactTransferRequestFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(gainingClientId);
-    extensionManager.validate();
-    DateTime now = tm().getTransactionTime();
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyAuthInfoPresentForResourceTransfer(authInfo);
-    verifyAuthInfo(authInfo.get(), existingContact);
-    // Verify that the resource does not already have a pending transfer.
-    if (TransferStatus.PENDING.equals(existingContact.getTransferData().getTransferStatus())) {
-      throw new AlreadyPendingTransferException(targetId);
-    }
-    String losingClientId = existingContact.getCurrentSponsorRegistrarId();
-    // Verify that this client doesn't already sponsor this resource.
-    if (gainingClientId.equals(losingClientId)) {
-      throw new ObjectAlreadySponsoredException();
-    }
-    verifyNoDisallowedStatuses(existingContact, DISALLOWED_STATUSES);
-
-    DateTime transferExpirationTime = now.plus(automaticTransferLength);
-    ContactTransferData serverApproveTransferData =
-        new ContactTransferData.Builder()
-            .setTransferRequestTime(now)
-            .setTransferRequestTrid(trid)
-            .setGainingRegistrarId(gainingClientId)
-            .setLosingRegistrarId(losingClientId)
-            .setPendingTransferExpirationTime(transferExpirationTime)
-            .setTransferStatus(TransferStatus.SERVER_APPROVED)
-            .build();
-    HistoryEntryId contactHistoryId = createHistoryEntryId(existingContact);
-    historyBuilder
-        .setRevisionId(contactHistoryId.getRevisionId())
-        .setType(CONTACT_TRANSFER_REQUEST);
-    // If the transfer is server approved, this message will be sent to the losing registrar. */
-    PollMessage serverApproveLosingPollMessage =
-        createLosingTransferPollMessage(targetId, serverApproveTransferData, contactHistoryId);
-    // If the transfer is server approved, this message will be sent to the gaining registrar. */
-    PollMessage serverApproveGainingPollMessage =
-        createGainingTransferPollMessage(
-            targetId, serverApproveTransferData, now, contactHistoryId);
-    ContactTransferData pendingTransferData =
-        serverApproveTransferData
-            .asBuilder()
-            .setTransferStatus(TransferStatus.PENDING)
-            .setServerApproveEntities(
-                serverApproveGainingPollMessage.getContactRepoId(),
-                contactHistoryId.getRevisionId(),
-                ImmutableSet.of(
-                    serverApproveGainingPollMessage.createVKey(),
-                    serverApproveLosingPollMessage.createVKey()))
-            .build();
-    // When a transfer is requested, a poll message is created to notify the losing registrar.
-    PollMessage requestPollMessage =
-        createLosingTransferPollMessage(targetId, pendingTransferData, contactHistoryId)
-            .asBuilder()
-            .setEventTime(now) // Unlike the serverApprove messages, this applies immediately.
-            .build();
-    Contact newContact =
-        existingContact
-            .asBuilder()
-            .setTransferData(pendingTransferData)
-            .addStatusValue(StatusValue.PENDING_TRANSFER)
-            .build();
-    tm().update(newContact);
-    tm().insertAll(
-            ImmutableSet.of(
-                historyBuilder.setContact(newContact).build(),
-                requestPollMessage,
-                serverApproveGainingPollMessage,
-                serverApproveLosingPollMessage));
-    return responseBuilder
-        .setResultFromCode(SUCCESS_WITH_ACTION_PENDING)
-        .setResData(createTransferResponse(targetId, newContact.getTransferData()))
-        .build();
-  }
 }
@@ -14,158 +14,19 @@

 package google.registry.flows.contact;

-import static com.google.common.collect.Sets.union;
-import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
-import static google.registry.flows.ResourceFlowUtils.checkSameValuesNotAddedAndRemoved;
-import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
-import static google.registry.flows.ResourceFlowUtils.verifyAllStatusesAreClientSettable;
-import static google.registry.flows.ResourceFlowUtils.verifyNoDisallowedStatuses;
-import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
-import static google.registry.flows.ResourceFlowUtils.verifyResourceOwnership;
-import static google.registry.flows.contact.ContactFlowUtils.validateAsciiPostalInfo;
-import static google.registry.flows.contact.ContactFlowUtils.validateContactAgainstPolicy;
-import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_PROHIBITED;
-import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_UPDATE;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.ExtensionManager;
-import google.registry.flows.FlowModule.RegistrarId;
-import google.registry.flows.FlowModule.Superuser;
-import google.registry.flows.FlowModule.TargetId;
-import google.registry.flows.MutatingFlow;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.ContactsProhibitedException;
-import google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException;
-import google.registry.model.common.FeatureFlag;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactCommand.Update;
-import google.registry.model.contact.ContactCommand.Update.Change;
-import google.registry.model.contact.ContactHistory;
-import google.registry.model.contact.PostalInfo;
-import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.eppcommon.AuthInfo;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppinput.ResourceCommand;
-import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import jakarta.inject.Inject;
-import java.util.Optional;
-import javax.annotation.Nullable;
-import org.joda.time.DateTime;

 /**
- * An EPP flow that updates a contact.
+ * An EPP flow meant to update a contact.
 *
 * @error {@link ContactsProhibitedException}
- * @error {@link google.registry.flows.FlowUtils.NotLoggedInException}
- * @error {@link google.registry.flows.ResourceFlowUtils.AddRemoveSameValueException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException}
- * @error {@link google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
- * @error {@link google.registry.flows.ResourceFlowUtils.StatusNotClientSettableException}
- * @error {@link google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException}
- * @error {@link google.registry.flows.exceptions.ResourceStatusProhibitsOperationException}
- * @error {@link ContactFlowUtils.BadInternationalizedPostalInfoException}
- * @error {@link ContactFlowUtils.DeclineContactDisclosureFieldDisallowedPolicyException}
 */
+@Deprecated
@ReportingSpec(ActivityReportField.CONTACT_UPDATE)
-public final class ContactUpdateFlow implements MutatingFlow {
-
-  /**
-   * Note that CLIENT_UPDATE_PROHIBITED is intentionally not in this list. This is because it
-   * requires special checking, since you must be able to clear the status off the object with an
-   * update.
-   */
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
-      StatusValue.PENDING_DELETE,
-      StatusValue.SERVER_UPDATE_PROHIBITED);
-
-  @Inject ResourceCommand resourceCommand;
-  @Inject ExtensionManager extensionManager;
-  @Inject Optional<AuthInfo> authInfo;
-  @Inject @RegistrarId String registrarId;
-  @Inject @TargetId String targetId;
-  @Inject @Superuser boolean isSuperuser;
-  @Inject ContactHistory.Builder historyBuilder;
-  @Inject EppResponse.Builder responseBuilder;
+public final class ContactUpdateFlow extends ContactsProhibitedFlow {
  @Inject ContactUpdateFlow() {}
-
-  @Override
-  public EppResponse run() throws EppException {
-    extensionManager.register(MetadataExtension.class);
-    validateRegistrarIsLoggedIn(registrarId);
-    extensionManager.validate();
-    if (FeatureFlag.isActiveNow(MINIMUM_DATASET_CONTACTS_PROHIBITED)) {
-      throw new ContactsProhibitedException();
-    }
-    Update command = (Update) resourceCommand;
-    DateTime now = tm().getTransactionTime();
-    Contact existingContact = loadAndVerifyExistence(Contact.class, targetId, now);
-    verifyOptionalAuthInfo(authInfo, existingContact);
-    ImmutableSet<StatusValue> statusToRemove = command.getInnerRemove().getStatusValues();
-    ImmutableSet<StatusValue> statusesToAdd = command.getInnerAdd().getStatusValues();
-    if (!isSuperuser) {  // The superuser can update any contact and set any status.
-      verifyResourceOwnership(registrarId, existingContact);
-      verifyAllStatusesAreClientSettable(union(statusesToAdd, statusToRemove));
-    }
-    verifyNoDisallowedStatuses(existingContact, DISALLOWED_STATUSES);
-    checkSameValuesNotAddedAndRemoved(statusesToAdd, statusToRemove);
-    Contact.Builder builder = existingContact.asBuilder();
-    Change change = command.getInnerChange();
-    // The spec requires the following behaviors:
-    //   * If you update part of a postal info, the fields that you didn't update are unchanged.
-    //   * If you update one postal info but not the other, the other is deleted.
-    // Therefore, if you want to preserve one postal info and update another you need to send the
-    // update and also something that technically updates the preserved one, even if it only
-    // "updates" it by setting just one field to the same value.
-    PostalInfo internationalized = change.getInternationalizedPostalInfo();
-    PostalInfo localized = change.getLocalizedPostalInfo();
-    if (internationalized != null) {
-      builder.overlayInternationalizedPostalInfo(internationalized);
-      if (localized == null) {
-        builder.setLocalizedPostalInfo(null);
-      }
-    }
-    if (localized != null) {
-      builder.overlayLocalizedPostalInfo(localized);
-      if (internationalized == null) {
-        builder.setInternationalizedPostalInfo(null);
-      }
-    }
-    Contact newContact =
-        builder
-            .setLastEppUpdateTime(now)
-            .setLastEppUpdateRegistrarId(registrarId)
-            .setAuthInfo(preferFirst(change.getAuthInfo(), existingContact.getAuthInfo()))
-            .setDisclose(preferFirst(change.getDisclose(), existingContact.getDisclose()))
-            .setEmailAddress(preferFirst(change.getEmail(), existingContact.getEmailAddress()))
-            .setFaxNumber(preferFirst(change.getFax(), existingContact.getFaxNumber()))
-            .setVoiceNumber(preferFirst(change.getVoice(), existingContact.getVoiceNumber()))
-            .addStatusValues(statusesToAdd)
-            .removeStatusValues(statusToRemove)
-            .build();
-    // If the resource is marked with clientUpdateProhibited, and this update did not clear that
-    // status, then the update must be disallowed (unless a superuser is requesting the change).
-    if (!isSuperuser
-        && existingContact.getStatusValues().contains(StatusValue.CLIENT_UPDATE_PROHIBITED)
-        && newContact.getStatusValues().contains(StatusValue.CLIENT_UPDATE_PROHIBITED)) {
-      throw new ResourceHasClientUpdateProhibitedException();
-    }
-    validateAsciiPostalInfo(newContact.getInternationalizedPostalInfo());
-    validateContactAgainstPolicy(newContact);
-    historyBuilder
-        .setType(CONTACT_UPDATE)
-        .setXmlBytes(null) // We don't want to store contact details in the history entry.
-        .setContact(newContact);
-    tm().insert(historyBuilder.build());
-    tm().update(newContact);
-    return responseBuilder.build();
-  }
-
-  /** Return the first non-null param, or null if both are null. */
-  @Nullable
-  private static <T> T preferFirst(@Nullable T a, @Nullable T b) {
-    return a != null ? a : b;
-  }
 }
@@ -0,0 +1,28 @@
+// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.flows.contact;
+
+import google.registry.flows.EppException;
+import google.registry.flows.Flow;
+import google.registry.flows.exceptions.ContactsProhibitedException;
+import google.registry.model.eppoutput.EppResponse;
+
+/** Nomulus follows the Minimum Dataset Requirements, meaning it stores no contact information. */
+public abstract class ContactsProhibitedFlow implements Flow {
+  @Override
+  public EppResponse run() throws EppException {
+    throw new ContactsProhibitedException();
+  }
+}
@@ -108,7 +108,8 @@ public final class DomainClaimsCheckFlow implements TransactionalFlow {
          verifyClaimsPeriodNotEnded(tld, now);
        }
      }
-      Optional<String> claimKey = ClaimsListDao.get().getClaimKey(parsedDomain.parts().get(0));
+      Optional<String> claimKey =
+          ClaimsListDao.get(tldStr).getClaimKey(parsedDomain.parts().get(0));
      launchChecksBuilder.add(
          LaunchCheck.create(
              LaunchCheckName.create(claimKey.isPresent(), domainName), claimKey.orElse(null)));
@@ -280,7 +280,7 @@ public final class DomainCreateFlow implements MutatingFlow {
      checkAllowedAccessToTld(registrarId, tld.getTldStr());
      checkHasBillingAccount(registrarId, tld.getTldStr());
      boolean isValidReservedCreate = isValidReservedCreate(domainName, allocationToken);
-      ClaimsList claimsList = ClaimsListDao.get();
+      ClaimsList claimsList = ClaimsListDao.get(tld.getTldStr());
      verifyIsGaOrSpecialCase(
          tld,
          claimsList,
@@ -312,7 +312,8 @@ public final class DomainCreateFlow implements MutatingFlow {
      // at this point so that we can verify it before the "after validation" extension point.
      signedMarkId =
          tmchUtils
-              .verifySignedMarks(launchCreate.get().getSignedMarks(), domainLabel, now)
+              .verifySignedMarks(
+                  tld.getTldStr(), launchCreate.get().getSignedMarks(), domainLabel, now)
              .getId();
    }
    verifyNotBlockedByBsa(domainName, tld, now, allocationToken);
@@ -55,7 +55,7 @@ public final class DomainFlowTmchUtils {
  }

  public SignedMark verifySignedMarks(
-      ImmutableList<AbstractSignedMark> signedMarks, String domainLabel, DateTime now)
+      String tld, ImmutableList<AbstractSignedMark> signedMarks, String domainLabel, DateTime now)
      throws EppException {
    if (signedMarks.size() > 1) {
      throw new TooManySignedMarksException();
@@ -64,7 +64,7 @@ public final class DomainFlowTmchUtils {
      throw new SignedMarksMustBeEncodedException();
    }
    SignedMark signedMark =
-        verifyEncodedSignedMark((EncodedSignedMark) signedMarks.get(0), now);
+        verifyEncodedSignedMark(tld, (EncodedSignedMark) signedMarks.get(0), now);
    return verifySignedMarkValidForDomainLabel(signedMark, domainLabel);
  }

@@ -76,8 +76,9 @@ public final class DomainFlowTmchUtils {
    return signedMark;
  }

-  public SignedMark verifyEncodedSignedMark(EncodedSignedMark encodedSignedMark, DateTime now)
-      throws EppException {
+  // TODO(b/412715713): remove the tld parameter when RST completes.
+  public SignedMark verifyEncodedSignedMark(
+      String tld, EncodedSignedMark encodedSignedMark, DateTime now) throws EppException {
    if (!encodedSignedMark.getEncoding().equals("base64")) {
      throw new Base64RequiredForEncodedSignedMarksException();
    }
@@ -95,7 +96,7 @@ public final class DomainFlowTmchUtils {
      throw new SignedMarkParsingErrorException();
    }

-    if (SignedMarkRevocationList.get().isSmdRevoked(signedMark.getId(), now)) {
+    if (SignedMarkRevocationList.get(tld).isSmdRevoked(signedMark.getId(), now)) {
      throw new SignedMarkRevokedErrorException();
    }

@@ -218,7 +218,7 @@ public class DomainFlowUtils {
    return domainName;
  }

-  private static void validateFirstLabel(String firstLabel) throws EppException {
+  public static void validateFirstLabel(String firstLabel) throws EppException {
    if (firstLabel.length() > MAX_LABEL_SIZE) {
      throw new DomainLabelTooLongException();
    }
@@ -1240,49 +1240,49 @@ public class DomainFlowUtils {
  }

  /** Domain names can only contain a-z, 0-9, '.' and '-'. */
-  static class BadDomainNameCharacterException extends ParameterValuePolicyErrorException {
+  static class BadDomainNameCharacterException extends ParameterValueSyntaxErrorException {
    public BadDomainNameCharacterException() {
      super("Domain names can only contain a-z, 0-9, '.' and '-'");
    }
  }

  /** Non-IDN domain names cannot contain hyphens in the third or fourth position. */
-  static class DashesInThirdAndFourthException extends ParameterValuePolicyErrorException {
+  static class DashesInThirdAndFourthException extends ParameterValueSyntaxErrorException {
    public DashesInThirdAndFourthException() {
      super("Non-IDN domain names cannot contain dashes in the third or fourth position");
    }
  }

  /** Domain labels cannot begin with a dash. */
-  static class LeadingDashException extends ParameterValuePolicyErrorException {
+  static class LeadingDashException extends ParameterValueSyntaxErrorException {
    public LeadingDashException() {
      super("Domain labels cannot begin with a dash");
    }
  }

  /** Domain labels cannot end with a dash. */
-  static class TrailingDashException extends ParameterValuePolicyErrorException {
+  static class TrailingDashException extends ParameterValueSyntaxErrorException {
    public TrailingDashException() {
      super("Domain labels cannot end with a dash");
    }
  }

  /** Domain labels cannot be longer than 63 characters. */
-  static class DomainLabelTooLongException extends ParameterValuePolicyErrorException {
+  static class DomainLabelTooLongException extends ParameterValueSyntaxErrorException {
    public DomainLabelTooLongException() {
      super("Domain labels cannot be longer than 63 characters");
    }
  }

  /** No part of a domain name can be empty. */
-  static class EmptyDomainNamePartException extends ParameterValuePolicyErrorException {
+  static class EmptyDomainNamePartException extends ParameterValueSyntaxErrorException {
    public EmptyDomainNamePartException() {
      super("No part of a domain name can be empty");
    }
  }

  /** Domain name starts with xn-- but is not a valid IDN. */
-  static class InvalidPunycodeException extends ParameterValuePolicyErrorException {
+  static class InvalidPunycodeException extends ParameterValueSyntaxErrorException {
    public InvalidPunycodeException() {
      super("Domain name starts with xn-- but is not a valid IDN");
    }
@@ -65,6 +65,7 @@ public final class HostCheckFlow implements TransactionalFlow {
        ForeignKeyUtils.loadKeys(Host.class, hostnames, clock.nowUtc()).keySet();
    ImmutableList.Builder<HostCheck> checks = new ImmutableList.Builder<>();
    for (String hostname : hostnames) {
+      HostFlowUtils.validateHostName(hostname);
      boolean unused = !existingIds.contains(hostname);
      checks.add(HostCheck.create(unused, hostname, unused ? null : "In use"));
    }
@@ -14,12 +14,14 @@

 package google.registry.flows.host;

+import static google.registry.flows.domain.DomainFlowUtils.validateFirstLabel;
 import static google.registry.model.EppResourceUtils.isActive;
 import static google.registry.model.tld.Tlds.findTldForName;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static java.util.stream.Collectors.joining;

 import com.google.common.base.Ascii;
+import com.google.common.base.CharMatcher;
 import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.AuthorizationErrorException;
@@ -38,6 +40,10 @@ import org.joda.time.DateTime;
 /** Static utility functions for host flows. */
 public class HostFlowUtils {

+  /** Validator for ASCII lowercase letters, digits, and "-_", allowing "." as a separator */
+  private static final CharMatcher HOST_NAME_ALLOWED_CHARS =
+      CharMatcher.inRange('a', 'z').or(CharMatcher.inRange('0', '9').or(CharMatcher.anyOf("-._")));
+
  /** Checks that a host name is valid. */
  public static InternetDomainName validateHostName(String name) throws EppException {
    checkArgumentNotNull(name, "Must specify host name to validate");
@@ -53,6 +59,9 @@ public class HostFlowUtils {
      if (!name.equals(hostNamePunyCoded)) {
        throw new HostNameNotPunyCodedException(hostNamePunyCoded);
      }
+      if (!HOST_NAME_ALLOWED_CHARS.matchesAllOf(name)) {
+        throw new BadHostNameCharacterException();
+      }
      InternetDomainName hostName = InternetDomainName.from(name);
      if (!name.equals(hostName.toString())) {
        throw new HostNameNotNormalizedException(hostName.toString());
@@ -71,6 +80,7 @@ public class HostFlowUtils {
      if (hostName.parts().size() < effectiveTld.parts().size() + 2) {
        throw new HostNameTooShallowException();
      }
+      validateFirstLabel(hostName.parts().getFirst());
      return hostName;
    } catch (IllegalArgumentException e) {
      throw new InvalidHostNameException();
@@ -180,4 +190,11 @@ public class HostFlowUtils {
          String.format("Host names must be in normalized format; expected %s", expectedHostName));
    }
  }
+
+  /** Host names can only contain a-z, 0-9, '.', '_', and '-'. */
+  static class BadHostNameCharacterException extends ParameterValueSyntaxErrorException {
+    public BadHostNameCharacterException() {
+      super("Host names can only contain a-z, 0-9, '.', '_', and '-'");
+    }
+  }
 }
@@ -135,7 +135,6 @@ public class FlowPicker {
          return switch (((Poll) innerCommand).getPollOp()) {
            case ACK -> PollAckFlow.class;
            case REQUEST -> PollRequestFlow.class;
-            default -> UnimplementedFlow.class;
          };
        }
      };
@@ -21,6 +21,7 @@ import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.ImmutableObject;
+import google.registry.tmch.RstTmchUtils;
 import jakarta.persistence.CollectionTable;
 import jakarta.persistence.Column;
 import jakarta.persistence.ElementCollection;
@@ -71,6 +72,11 @@ public class SignedMarkRevocationList extends ImmutableObject {
    return CACHE.get();
  }

+  // TODO(b/412715713): remove the tld parameter when RST completes.
+  public static SignedMarkRevocationList get(String tld) {
+    return RstTmchUtils.getSmdrList(tld).orElseGet(SignedMarkRevocationList::get);
+  }
+
  /** Create a new {@link SignedMarkRevocationList} without saving it. */
  public static SignedMarkRevocationList create(
      DateTime creationTime, ImmutableMap<String, DateTime> revokes) {
@@ -1034,12 +1034,13 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
      return this;
    }

-    public static final Pattern ROID_SUFFIX_PATTERN = Pattern.compile("^[A-Z\\d_]{1,8}$");
+    public static final Pattern ROID_SUFFIX_PATTERN = Pattern.compile("^[A-Z\\d]{1,8}$");

    public Builder setRoidSuffix(String roidSuffix) {
      checkArgument(
          ROID_SUFFIX_PATTERN.matcher(roidSuffix).matches(),
-          "ROID suffix must be in format %s",
+          "ROID suffix %s must be in format %s",
+          roidSuffix,
          ROID_SUFFIX_PATTERN.pattern());
      getInstance().roidSuffix = roidSuffix;
      return this;
@@ -22,6 +22,7 @@ import com.github.benmanes.caffeine.cache.LoadingCache;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.CacheUtils;
+import google.registry.tmch.RstTmchUtils;
 import java.time.Duration;
 import java.util.Optional;

@@ -72,6 +73,11 @@ public class ClaimsListDao {
    return CACHE.get(ClaimsListDao.class);
  }

+  // TODO(b/412715713): remove the tld parameter when RST completes.
+  public static ClaimsList get(String tld) {
+    return RstTmchUtils.getClaimsList(tld).orElseGet(ClaimsListDao::get);
+  }
+
  /**
   * Returns the most recent revision of the {@link ClaimsList} in SQL or an empty list if it
   * doesn't exist.
@@ -43,6 +43,15 @@ public enum IdnTableEnum {
   */
  UNCONFUSABLE_LATIN("unconfusable_latin.txt"),

+  /**
+   * ICANN LGR 2025 Latin, but with confusable characters removed.
+   *
+   * <p>This is based on <a
+   * href="https://www.icann.org/sites/default/files/packages/lgr/lgr-second-level-latin-full-variant-script-24jan24-en.html">ICANN's
+   * LGR table</a>, but is simpler.
+   */
+  AUGMENTED_LATIN("augmented_latin.txt"),
+
  /**
   * Japanese, as used on our existing TLD launches prior to 2023.
   *
@@ -1,4 +1,4 @@
-# URL: https://www.iana.org/domains/idn-tables/tables/google_latn_1.0.txt
+# URL: https://www.iana.org/domains/idn-tables/tables/google_latn_3.0.txt
 # Policy: https://www.registry.google/about/policies/domainabuse/
 U+002D                         # HYPHEN-MINUS
 U+0030                         # DIGIT ZERO
@@ -0,0 +1,120 @@
+// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tmch;
+
+import static com.google.common.base.Suppliers.memoize;
+import static com.google.common.io.Resources.getResource;
+import static com.google.common.io.Resources.readLines;
+import static google.registry.tmch.RstTmchUtils.RstEnvironment.OTE;
+import static google.registry.tmch.RstTmchUtils.RstEnvironment.PROD;
+import static google.registry.util.RegistryEnvironment.SANDBOX;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.base.Supplier;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.flogger.FluentLogger;
+import google.registry.model.smd.SignedMarkRevocationList;
+import google.registry.model.tmch.ClaimsList;
+import google.registry.util.RegistryEnvironment;
+import java.io.IOException;
+import java.net.URL;
+import java.util.Locale;
+import java.util.Optional;
+
+/**
+ * Utilities supporting TMCH-related RST testing in the Sandbox environment.
+ *
+ * <p>For logistic reasons we must conduct RST testing in the Sandbox environments. RST tests
+ * require the use of special labels hosted on their website. To isolate these labels from regular
+ * customers conducting onboarding tests, we manually download the test files as resources, and
+ * serve them up only to RST TLDs.
+ */
+public class RstTmchUtils {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  /**
+   * The RST environments.
+   *
+   * <p>We conduct both OTE and PROD RST tests in Sandbox.
+   */
+  enum RstEnvironment {
+    OTE,
+    PROD
+  }
+
+  private static final ImmutableMap<RstEnvironment, Supplier<Optional<ClaimsList>>> CLAIMS_CACHE =
+      ImmutableMap.of(
+          OTE, memoize(() -> getClaimsList(OTE)), PROD, memoize(() -> getClaimsList(PROD)));
+
+  private static final ImmutableMap<RstEnvironment, Supplier<Optional<SignedMarkRevocationList>>>
+      SMDRL_CACHE =
+          ImmutableMap.of(
+              OTE, memoize(() -> getSmdrList(OTE)), PROD, memoize(() -> getSmdrList(PROD)));
+
+  /** Returns appropriate test labels if {@code tld} is for RST testing; otherwise returns empty. */
+  public static Optional<ClaimsList> getClaimsList(String tld) {
+    return getRstEnvironment(tld).map(CLAIMS_CACHE::get).flatMap(Supplier::get);
+  }
+
+  /** Returns appropriate test labels if {@code tld} is for RST testing; otherwise returns empty. */
+  public static Optional<SignedMarkRevocationList> getSmdrList(String tld) {
+    return getRstEnvironment(tld).map(SMDRL_CACHE::get).flatMap(Supplier::get);
+  }
+
+  static Optional<RstEnvironment> getRstEnvironment(String tld) {
+    if (!RegistryEnvironment.get().equals(SANDBOX)) {
+      return Optional.empty();
+    }
+    if (tld.startsWith("cc-rst-test-")) {
+      return Optional.of(OTE);
+    }
+    if (tld.startsWith("zz--")) {
+      return Optional.of(PROD);
+    }
+    return Optional.empty();
+  }
+
+  private static Optional<ClaimsList> getClaimsList(RstEnvironment rstEnvironment) {
+    if (!RegistryEnvironment.get().equals(SANDBOX)) {
+      return Optional.empty();
+    }
+    String resourceName = rstEnvironment.name().toLowerCase(Locale.ROOT) + ".rst.dnl.csv";
+    URL resource = getResource(RstTmchUtils.class, resourceName);
+    try {
+      return Optional.of(ClaimsListParser.parse(readLines(resource, UTF_8)));
+    } catch (IOException e) {
+      // Do not throw.
+      logger.atSevere().withCause(e).log(
+          "Could not load Claims list %s for %s in Sandbox.", resourceName, rstEnvironment);
+      return Optional.empty();
+    }
+  }
+
+  private static Optional<SignedMarkRevocationList> getSmdrList(RstEnvironment rstEnvironment) {
+    if (!RegistryEnvironment.get().equals(SANDBOX)) {
+      return Optional.empty();
+    }
+    String resourceName = rstEnvironment.name().toLowerCase(Locale.ROOT) + ".rst.smdrl.csv";
+    URL resource = getResource(RstTmchUtils.class, resourceName);
+    try {
+      return Optional.of(SmdrlCsvParser.parse(readLines(resource, UTF_8)));
+    } catch (IOException e) {
+      // Do not throw.
+      logger.atSevere().withCause(e).log(
+          "Could not load SMDR list %s for %s in Sandbox.", resourceName, rstEnvironment);
+      return Optional.empty();
+    }
+  }
+}
@@ -19,12 +19,12 @@ import static com.google.common.base.Strings.isNullOrEmpty;
 import static com.google.common.base.Verify.verify;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 import static google.registry.util.RegistrarUtils.normalizeRegistrarName;
 import static java.nio.charset.StandardCharsets.US_ASCII;
 import static org.joda.time.DateTimeZone.UTC;

 import com.beust.jcommander.Parameter;
+import com.google.common.base.Ascii;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.flows.certs.CertificateChecker;
@@ -305,20 +305,16 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
      if (!allowedTlds.isEmpty()) {
        checkArgument(
            addAllowedTlds.isEmpty(), "Can't specify both --allowedTlds and --addAllowedTlds");
-        ImmutableSet.Builder<String> allowedTldsBuilder = new ImmutableSet.Builder<>();
-        for (String allowedTld : allowedTlds) {
-          allowedTldsBuilder.add(canonicalizeHostname(allowedTld));
-        }
-        builder.setAllowedTlds(allowedTldsBuilder.build());
+        builder.setAllowedTlds(
+            allowedTlds.stream().map(Ascii::toLowerCase).collect(toImmutableSet()));
      }
      if (!addAllowedTlds.isEmpty()) {
        ImmutableSet.Builder<String> allowedTldsBuilder = new ImmutableSet.Builder<>();
        if (oldRegistrar != null) {
          allowedTldsBuilder.addAll(oldRegistrar.getAllowedTlds());
        }
-        for (String allowedTld : addAllowedTlds) {
-          allowedTldsBuilder.add(canonicalizeHostname(allowedTld));
-        }
+        allowedTldsBuilder.addAll(
+            addAllowedTlds.stream().map(Ascii::toLowerCase).collect(toImmutableSet()));
        builder.setAllowedTlds(allowedTldsBuilder.build());
      }
      if (ipAllowList != null) {
@@ -0,0 +1,10 @@
+1,2024-09-13T02:21:12.0Z
+DNL,lookup-key,insertion-datetime
+test---validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test--validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-and-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-andvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testand-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testandvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
@@ -0,0 +1,7 @@
+1,2022-11-22T01:49:36.9Z
+smd-id,insertion-datetime
+0000001761385117375880-65535,2013-07-15T00:00:00.0Z
+0000001751501056761969-65535,2017-07-26T10:12:41.9Z
+000000541526299609231-65535,2018-05-14T17:52:23.7Z
+000000541602140609520-65535,2020-10-08T07:07:25.0Z
+000000541669081776937-65535,2022-11-22T01:49:36.9Z
@@ -0,0 +1,10 @@
+1,2024-09-13T02:21:12.0Z
+DNL,lookup-key,insertion-datetime
+test---validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test--validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-and-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-andvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+test-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testand-validate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testandvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+testvalidate,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
@@ -0,0 +1,7 @@
+1,2022-11-22T01:49:36.9Z
+smd-id,insertion-datetime
+0000001761385117375880-65535,2013-07-15T00:00:00.0Z
+0000001751501056761969-65535,2017-07-26T10:12:41.9Z
+000000541526299609231-65535,2018-05-14T17:52:23.7Z
+000000541602140609520-65535,2020-10-08T07:07:25.0Z
+000000541669081776937-65535,2022-11-22T01:49:36.9Z
@@ -335,7 +335,7 @@ class InvoicingPipelineTest {
            .build();
    persistResource(registrar);
    Tld test =
-        newTld("test", "_TEST", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
+        newTld("test", "TEST", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
            .asBuilder()
            .setInvoicingEnabled(true)
            .build();
@@ -391,7 +391,7 @@ class InvoicingPipelineTest {
    // Test that comments are removed from the .sql file correctly
    assertThat(InvoicingPipeline.makeCloudSqlQuery("2017-10"))
        .isEqualTo(
-            """
+"""

 SELECT b, r FROM BillingEvent b
 JOIN Registrar r ON b.clientId = r.registrarId
@@ -449,13 +449,13 @@ AND cr.id IS NULL
    persistResource(registrar3);

    Tld test =
-        newTld("test", "_TEST", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
+        newTld("test", "TEST", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
            .asBuilder()
            .setInvoicingEnabled(true)
            .build();
    persistResource(test);
    Tld hello =
-        newTld("hello", "_HELLO", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
+        newTld("hello", "HELLO", ImmutableSortedMap.of(START_OF_TIME, GENERAL_AVAILABILITY))
            .asBuilder()
            .setInvoicingEnabled(true)
            .build();
@@ -163,7 +163,7 @@ public class RegistryJpaReadTest {
  }

  private void setupForJoinQuery() {
-    Tld registry = newTld("com", "ABCD_APP");
+    Tld registry = newTld("com", "ABCDAPP");
    Registrar registrar =
        makeRegistrar1()
            .asBuilder()
@@ -17,6 +17,7 @@ package google.registry.bsa;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.tldconfig.idn.IdnTableEnum.AUGMENTED_LATIN;
 import static google.registry.tldconfig.idn.IdnTableEnum.EXTENDED_LATIN;
 import static google.registry.tldconfig.idn.IdnTableEnum.JA;
 import static google.registry.tldconfig.idn.IdnTableEnum.UNCONFUSABLE_LATIN;
@@ -43,6 +44,7 @@ public class IdnCheckerTest {
  Tld jaonly;
  Tld jandelatin;
  Tld strictlatin;
+  Tld auglatin;
  IdnChecker idnChecker;

  @BeforeEach
@@ -50,6 +52,7 @@ public class IdnCheckerTest {
    jaonly = createTld("jaonly");
    jandelatin = createTld("jandelatin");
    strictlatin = createTld("strictlatin");
+    auglatin = createTld("auglatin");

    jaonly =
        persistResource(
@@ -72,6 +75,13 @@ public class IdnCheckerTest {
                .setBsaEnrollStartTime(Optional.of(fakeClock.nowUtc()))
                .setIdnTables(ImmutableSet.of(UNCONFUSABLE_LATIN))
                .build());
+    auglatin =
+        persistResource(
+            auglatin
+                .asBuilder()
+                .setBsaEnrollStartTime(Optional.of(fakeClock.nowUtc()))
+                .setIdnTables(ImmutableSet.of(AUGMENTED_LATIN))
+                .build());
    fakeClock.advanceOneMilli();
    idnChecker = new IdnChecker(fakeClock);
  }
@@ -79,12 +89,13 @@ public class IdnCheckerTest {
  @Test
  void getAllValidIdns_allTlds() {
    assertThat(idnChecker.getAllValidIdns("all"))
-        .containsExactly(EXTENDED_LATIN, JA, UNCONFUSABLE_LATIN);
+        .containsExactly(EXTENDED_LATIN, JA, UNCONFUSABLE_LATIN, AUGMENTED_LATIN);
  }

  @Test
  void getAllValidIdns_notJa() {
-    assertThat(idnChecker.getAllValidIdns("à")).containsExactly(EXTENDED_LATIN, UNCONFUSABLE_LATIN);
+    assertThat(idnChecker.getAllValidIdns("à"))
+        .containsExactly(EXTENDED_LATIN, UNCONFUSABLE_LATIN, AUGMENTED_LATIN);
  }

  @Test
@@ -116,6 +127,7 @@ public class IdnCheckerTest {

  @Test
  void getForbiddingTlds_success() {
-    assertThat(idnChecker.getForbiddingTlds(ImmutableSet.of("JA"))).containsExactly(strictlatin);
+    assertThat(idnChecker.getForbiddingTlds(ImmutableSet.of("JA")))
+        .containsExactly(strictlatin, auglatin);
  }
 }
@@ -1,110 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.flows;
-
-import static google.registry.model.eppoutput.Result.Code.SUCCESS;
-import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACK_MESSAGE;
-import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_NO_MESSAGES;
-import static google.registry.testing.EppMetricSubject.assertThat;
-
-import com.google.common.collect.ImmutableMap;
-import google.registry.persistence.transaction.JpaTestExtensions;
-import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.RegisterExtension;
-
-/** Tests for contact lifecycle. */
-class EppLifecycleContactTest extends EppTestCase {
-
-  @RegisterExtension
-  final JpaIntegrationTestExtension jpa =
-      new JpaTestExtensions.Builder().withClock(clock).buildIntegrationTestExtension();
-
-  @Test
-  void testContactLifecycle() throws Exception {
-    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
-    assertThatCommand("contact_create_sh8013.xml")
-        .atTime("2000-06-01T00:00:00Z")
-        .hasResponse(
-            "contact_create_response_sh8013.xml",
-            ImmutableMap.of("CRDATE", "2000-06-01T00:00:00Z"));
-    assertThat(getRecordedEppMetric())
-        .hasClientId("NewRegistrar")
-        .and()
-        .hasNoTld()
-        .and()
-        .hasCommandName("ContactCreate")
-        .and()
-        .hasStatus(SUCCESS);
-    assertThatCommand("contact_info.xml")
-        .atTime("2000-06-01T00:01:00Z")
-        .hasResponse("contact_info_from_create_response.xml");
-    assertThat(getRecordedEppMetric())
-        .hasClientId("NewRegistrar")
-        .and()
-        .hasCommandName("ContactInfo")
-        .and()
-        .hasStatus(SUCCESS);
-    assertThatCommand("contact_delete_sh8013.xml")
-        .hasResponse("contact_delete_response_sh8013.xml");
-    assertThat(getRecordedEppMetric())
-        .hasClientId("NewRegistrar")
-        .and()
-        .hasCommandName("ContactDelete")
-        .and()
-        .hasStatus(SUCCESS);
-    assertThatLogoutSucceeds();
-  }
-
-  @Test
-  void testContactTransferPollMessage() throws Exception {
-    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
-    assertThatCommand("contact_create_sh8013.xml")
-        .atTime("2000-06-01T00:00:00Z")
-        .hasResponse(
-            "contact_create_response_sh8013.xml",
-            ImmutableMap.of("CRDATE", "2000-06-01T00:00:00Z"));
-    assertThatLogoutSucceeds();
-
-    // Initiate a transfer of the newly created contact.
-    assertThatLoginSucceeds("TheRegistrar", "password2");
-    assertThatCommand("contact_transfer_request.xml")
-        .atTime("2000-06-08T22:00:00Z")
-        .hasResponse("contact_transfer_request_response_alternate.xml");
-    assertThatLogoutSucceeds();
-
-    // Log back in with the losing registrar, read the poll message, and then ack it.
-    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
-    assertThatCommand("poll.xml")
-        .atTime("2000-06-08T22:01:00Z")
-        .hasResponse("poll_response_contact_transfer.xml");
-    assertThat(getRecordedEppMetric())
-        .hasClientId("NewRegistrar")
-        .and()
-        .hasCommandName("PollRequest")
-        .and()
-        .hasStatus(SUCCESS_WITH_ACK_MESSAGE);
-    assertThatCommand("poll_ack.xml", ImmutableMap.of("ID", "6-2000"))
-        .atTime("2000-06-08T22:02:00Z")
-        .hasResponse("poll_ack_response_empty.xml");
-    assertThat(getRecordedEppMetric())
-        .hasClientId("NewRegistrar")
-        .and()
-        .hasCommandName("PollAck")
-        .and()
-        .hasStatus(SUCCESS_WITH_NO_MESSAGES);
-    assertThatLogoutSucceeds();
-  }
-}
@@ -91,14 +91,6 @@ class EppLifecycleHostTest extends EppTestCase {
    createTld("example");
    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
    // Create the fakesite domain.
-    assertThatCommand("contact_create_sh8013.xml")
-        .atTime("2000-06-01T00:00:00Z")
-        .hasResponse(
-            "contact_create_response_sh8013.xml",
-            ImmutableMap.of("CRDATE", "2000-06-01T00:00:00Z"));
-    assertThatCommand("contact_create_jd1234.xml")
-        .atTime("2000-06-01T00:01:00Z")
-        .hasResponse("contact_create_response_jd1234.xml");
    assertThatCommand("domain_create_fakesite_no_nameservers.xml")
        .atTime("2000-06-01T00:04:00Z")
        .hasResponse(
@@ -142,15 +134,6 @@ class EppLifecycleHostTest extends EppTestCase {

    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");

-    assertThatCommand("contact_create_sh8013.xml")
-        .atTime("2000-06-01T00:00:00Z")
-        .hasResponse(
-            "contact_create_response_sh8013.xml",
-            ImmutableMap.of("CRDATE", "2000-06-01T00:00:00Z"));
-    assertThatCommand("contact_create_jd1234.xml")
-        .atTime("2000-06-01T00:01:00Z")
-        .hasResponse("contact_create_response_jd1234.xml");
-
    // Create domain example.bar.foo.tld
    assertThatCommand(
            "domain_create_no_hosts_or_dsdata.xml",
@@ -223,7 +223,7 @@ public class EppTestCase {
    return eppMetricBuilder.build();
  }

-  /** Create the two administrative contacts and two hosts. */
+  /** Create the two hosts. */
  void createHosts() throws Exception {
    DateTime createTime = DateTime.parse("2000-06-01T00:00:00Z");
    assertThatCommand("host_create.xml", ImmutableMap.of("HOSTNAME", "ns1.example.external"))
@@ -14,85 +14,25 @@

 package google.registry.flows.contact;

-import static google.registry.model.eppoutput.CheckData.ContactCheck.create;
-import static google.registry.testing.DatabaseHelper.persistActiveContact;
-import static google.registry.testing.DatabaseHelper.persistDeletedContact;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceCheckFlowTestCase;
-import google.registry.flows.exceptions.TooManyResourceChecksException;
-import google.registry.model.contact.Contact;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactCheckFlow}. */
-class ContactCheckFlowTest extends ResourceCheckFlowTestCase<ContactCheckFlow, Contact> {
+class ContactCheckFlowTest extends FlowTestCase<ContactCheckFlow> {

  ContactCheckFlowTest() {
    setEppInput("contact_check.xml");
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }

-  @Test
-  void testNothingExists() throws Exception {
-    // These ids come from the check xml.
-    doCheckTest(
-        create(true, "sh8013", null),
-        create(true, "sah8013", null),
-        create(true, "8013sah", null));
-  }
-
-  @Test
-  void testOneExists() throws Exception {
-    persistActiveContact("sh8013");
-    // These ids come from the check xml.
-    doCheckTest(
-        create(false, "sh8013", "In use"),
-        create(true, "sah8013", null),
-        create(true, "8013sah", null));
-  }
-
-  @Test
-  void testOneExistsButWasDeleted() throws Exception {
-    persistDeletedContact("sh8013", clock.nowUtc().minusDays(1));
-    // These ids come from the check xml.
-    doCheckTest(
-        create(true, "sh8013", null),
-        create(true, "sah8013", null),
-        create(true, "8013sah", null));
-  }
-
-  @Test
-  void testXmlMatches() throws Exception {
-    persistActiveContact("sah8013");
-    runFlowAssertResponse(loadFile("contact_check_response.xml"));
-  }
-
-  @Test
-  void test50IdsAllowed() throws Exception {
-    // Make sure we don't have a regression that reduces the number of allowed checks.
-    setEppInput("contact_check_50.xml");
-    runFlow();
-  }
-
-  @Test
-  void testTooManyIds() {
-    setEppInput("contact_check_51.xml");
-    EppException thrown = assertThrows(TooManyResourceChecksException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-check");
-  }
 }
@@ -14,141 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_PROHIBITED;
-import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
-import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.newContact;
-import static google.registry.testing.DatabaseHelper.persistActiveContact;
-import static google.registry.testing.DatabaseHelper.persistDeletedContact;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableSortedMap;
-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowTestCase;
-import google.registry.flows.contact.ContactFlowUtils.BadInternationalizedPostalInfoException;
-import google.registry.flows.contact.ContactFlowUtils.DeclineContactDisclosureFieldDisallowedPolicyException;
+import google.registry.flows.FlowTestCase;
 import google.registry.flows.exceptions.ContactsProhibitedException;
-import google.registry.flows.exceptions.ResourceAlreadyExistsForThisClientException;
-import google.registry.flows.exceptions.ResourceCreateContentionException;
-import google.registry.model.common.FeatureFlag;
-import google.registry.model.contact.Contact;
-import org.joda.time.DateTime;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactCreateFlow}. */
-class ContactCreateFlowTest extends ResourceFlowTestCase<ContactCreateFlow, Contact> {
+class ContactCreateFlowTest extends FlowTestCase<ContactCreateFlow> {

  ContactCreateFlowTest() {
    setEppInput("contact_create.xml");
-    clock.setTo(DateTime.parse("1999-04-03T22:00:00.0Z"));
-  }
-
-  private void doSuccessfulTest() throws Exception {
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("contact_create_response.xml"));
-    // Check that the contact was created and persisted with a history entry.
-    Contact contact = reloadResourceByForeignKey();
-    assertAboutContacts().that(contact).hasOnlyOneHistoryEntryWhich().hasNoXml();
-    assertNoBillingEvents();
-    assertLastHistoryContainsResource(contact);
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    dryRunFlowAssertResponse(loadFile("contact_create_response.xml"));
-  }
-
-  @Test
-  void testSuccess_neverExisted() throws Exception {
-    doSuccessfulTest();
-  }
-
-  @Test
-  void testSuccess_existedButWasDeleted() throws Exception {
-    persistDeletedContact(getUniqueIdFromCommand(), clock.nowUtc().minusDays(1));
-    clock.advanceOneMilli();
-    doSuccessfulTest();
-  }
-
-  @Test
-  void testFailure_alreadyExists() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    ResourceAlreadyExistsForThisClientException thrown =
-        assertThrows(ResourceAlreadyExistsForThisClientException.class, this::runFlow);
-    assertThat(thrown)
-        .hasMessageThat()
-        .contains(
-            String.format("Object with given ID (%s) already exists", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_minimumDatasetPhase2_cannotCreateContacts() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_PROHIBITED)
-            .setStatusMap(
-                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
-            .build());
-    EppException thrown = assertThrows(ContactsProhibitedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_resourceContention() throws Exception {
-    String targetId = getUniqueIdFromCommand();
-    persistResource(
-        newContact(targetId)
-            .asBuilder()
-            .setPersistedCurrentSponsorRegistrarId("NewRegistrar")
-            .build());
-    ResourceCreateContentionException thrown =
-        assertThrows(ResourceCreateContentionException.class, this::runFlow);
-    assertThat(thrown)
-        .hasMessageThat()
-        .contains(String.format("Object with given ID (%s) already exists", targetId));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_nonAsciiInLocAddress() throws Exception {
-    setEppInput("contact_create_hebrew_loc.xml");
-    doSuccessfulTest();
-  }
-
-  @Test
-  void testFailure_nonAsciiInIntAddress() {
-    setEppInput("contact_create_hebrew_int.xml");
-    EppException thrown =
-        assertThrows(BadInternationalizedPostalInfoException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_declineDisclosure() {
-    setEppInput("contact_create_decline_disclosure.xml");
-    EppException thrown =
-        assertThrows(DeclineContactDisclosureFieldDisallowedPolicyException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-create");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,269 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.collect.MoreCollectors.onlyElement;
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.createTld;
-import static google.registry.testing.DatabaseHelper.getPollMessages;
-import static google.registry.testing.DatabaseHelper.newContact;
-import static google.registry.testing.DatabaseHelper.persistActiveContact;
-import static google.registry.testing.DatabaseHelper.persistContactWithPendingTransfer;
-import static google.registry.testing.DatabaseHelper.persistDeletedContact;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Iterables;
-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowTestCase;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
-import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
-import google.registry.flows.exceptions.ResourceToDeleteIsReferencedException;
-import google.registry.model.contact.Contact;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.poll.PendingActionNotificationResponse;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.reporting.HistoryEntry.Type;
-import google.registry.model.tld.Tld;
-import google.registry.model.transfer.TransferData;
-import google.registry.model.transfer.TransferResponse;
-import google.registry.model.transfer.TransferStatus;
-import google.registry.testing.DatabaseHelper;
-import org.joda.time.DateTime;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactDeleteFlow}. */
-class ContactDeleteFlowTest extends ResourceFlowTestCase<ContactDeleteFlow, Contact> {
+class ContactDeleteFlowTest extends FlowTestCase<ContactDeleteFlow> {

-  @BeforeEach
-  void initFlowTest() {
+  ContactDeleteFlowTest() {
    setEppInput("contact_delete.xml");
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    dryRunFlowAssertResponse(loadFile("contact_delete_response.xml"));
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("contact_delete_response.xml"));
-    assertSqlDeleteSuccess();
-  }
-
-  @Test
-  void testSuccess_pendingTransfer_sql() throws Exception {
-    DateTime transferRequestTime = clock.nowUtc().minusDays(3);
-    TransferData oldTransferData =
-        persistContactWithPendingTransfer(
-                persistActiveContact(getUniqueIdFromCommand()),
-                transferRequestTime,
-                transferRequestTime.plus(Tld.DEFAULT_TRANSFER_GRACE_PERIOD),
-                clock.nowUtc())
-            .getTransferData();
-    clock.advanceOneMilli();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("contact_delete_response.xml"));
-    assertSqlDeleteSuccess(Type.CONTACT_DELETE, Type.CONTACT_TRANSFER_REQUEST);
-    Contact softDeletedContact = reloadResourceByForeignKey(clock.nowUtc().minusMillis(1));
-    assertThat(softDeletedContact.getTransferData())
-        .isEqualTo(
-            oldTransferData
-                .copyConstantFieldsToBuilder()
-                .setTransferStatus(TransferStatus.SERVER_CANCELLED)
-                .setPendingTransferExpirationTime(softDeletedContact.getDeletionTime())
-                .build());
-    PollMessage gainingPollMessage =
-        Iterables.getOnlyElement(getPollMessages("NewRegistrar", clock.nowUtc()));
-    assertThat(gainingPollMessage.getEventTime()).isEqualTo(clock.nowUtc());
-    assertThat(
-            gainingPollMessage.getResponseData().stream()
-                .filter(TransferResponse.class::isInstance)
-                .map(TransferResponse.class::cast)
-                .collect(onlyElement())
-                .getTransferStatus())
-        .isEqualTo(TransferStatus.SERVER_CANCELLED);
-    PendingActionNotificationResponse panData =
-        gainingPollMessage.getResponseData().stream()
-            .filter(PendingActionNotificationResponse.class::isInstance)
-            .map(PendingActionNotificationResponse.class::cast)
-            .collect(onlyElement());
-    assertThat(panData.getTrid())
-        .isEqualTo(Trid.create("transferClient-trid", "transferServer-trid"));
-    assertThat(panData.getActionResult()).isFalse();
-  }
-
-  @Test
-  void testSuccess_clTridNotSpecified() throws Exception {
-    setEppInput("contact_delete_no_cltrid.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("contact_delete_response_no_cltrid.xml"));
-    assertSqlDeleteSuccess();
-  }
-
-  @Test
-  void testFailure_neverExisted() throws Exception {
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_existedButWasDeleted() throws Exception {
-    persistDeletedContact(getUniqueIdFromCommand(), clock.nowUtc().minusDays(1));
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_existedButWasClientDeleteProhibited() throws Exception {
-    doFailingStatusTest(
-        StatusValue.CLIENT_DELETE_PROHIBITED, ResourceStatusProhibitsOperationException.class);
-  }
-
-  @Test
-  void testFailure_existedButWasServerDeleteProhibited() throws Exception {
-    doFailingStatusTest(
-        StatusValue.SERVER_DELETE_PROHIBITED, ResourceStatusProhibitsOperationException.class);
-  }
-
-  @Test
-  void testFailure_existedButWasPendingDelete() throws Exception {
-    doFailingStatusTest(
-        StatusValue.PENDING_DELETE, ResourceStatusProhibitsOperationException.class);
-  }
-
-  private void doFailingStatusTest(StatusValue statusValue, Class<? extends EppException> exception)
-      throws Exception {
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(statusValue))
-            .build());
-    EppException thrown = assertThrows(exception, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(statusValue.getXmlName());
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_clientDeleteProhibited_superuser() throws Exception {
-    persistResource(
-        persistActiveContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .addStatusValue(StatusValue.CLIENT_DELETE_PROHIBITED)
-            .build());
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("contact_delete_response.xml"));
-  }
-
-  @Test
-  void testSuccess_serverDeleteProhibited_superuser() throws Exception {
-    persistResource(
-        persistActiveContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .addStatusValue(StatusValue.SERVER_DELETE_PROHIBITED)
-            .build());
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("contact_delete_response.xml"));
-  }
-
-  @Test
-  void testFailure_pendingDelete_superuser() throws Exception {
-    persistResource(
-        persistActiveContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .addStatusValue(StatusValue.PENDING_DELETE)
-            .build());
+  void testThrowsException() {
    assertAboutEppExceptions()
-        .that(
-            assertThrows(
-                ResourceStatusProhibitsOperationException.class,
-                () -> runFlow(CommitMode.LIVE, UserPrivileges.SUPERUSER)))
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
        .marshalsToXml();
  }
-
-  @Test
-  void testFailure_unauthorizedClient() throws Exception {
-    sessionMetadata.setRegistrarId("NewRegistrar");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown = assertThrows(ResourceNotOwnedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_superuserUnauthorizedClient() throws Exception {
-    sessionMetadata.setRegistrarId("NewRegistrar");
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("contact_delete_response.xml"));
-    assertSqlDeleteSuccess();
-  }
-
-  @Test
-  void testFailure_failfastWhenLinkedToDomain() throws Exception {
-    createTld("tld");
-    persistResource(
-        DatabaseHelper.newDomain("example.tld", persistActiveContact(getUniqueIdFromCommand())));
-    EppException thrown = assertThrows(ResourceToDeleteIsReferencedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-delete");
-  }
-
-  private void assertSqlDeleteSuccess(HistoryEntry.Type... historyEntryTypes) throws Exception {
-    assertThat(reloadResourceByForeignKey()).isNull();
-    assertAboutContacts()
-        .that(reloadResourceByForeignKey(clock.nowUtc().minusMillis(1)))
-        .isNotActiveAt(clock.nowUtc())
-        .and()
-        .hasNullLocalizedPostalInfo()
-        .and()
-        .hasNullInternationalizedPostalInfo()
-        .and()
-        .hasNullEmailAddress()
-        .and()
-        .hasNullVoiceNumber()
-        .and()
-        .hasNullFaxNumber()
-        .and()
-        .hasExactlyStatusValues(StatusValue.OK)
-        .and()
-        .hasOneHistoryEntryEachOfTypes(historyEntryTypes);
-    assertNoBillingEvents();
-  }
-
-  private void assertSqlDeleteSuccess() throws Exception {
-    assertSqlDeleteSuccess(Type.CONTACT_DELETE);
-  }
 }
@@ -14,202 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.EppResourceUtils.isDeleted;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.createTld;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSet;
-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowTestCase;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAddress;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.contact.ContactPhoneNumber;
-import google.registry.model.contact.Disclose;
-import google.registry.model.contact.PostalInfo;
-import google.registry.model.contact.PostalInfo.Type;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.eppcommon.PresenceMarker;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.testing.DatabaseHelper;
-import org.joda.time.DateTime;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactInfoFlow}. */
-class ContactInfoFlowTest extends ResourceFlowTestCase<ContactInfoFlow, Contact> {
+class ContactInfoFlowTest extends FlowTestCase<ContactInfoFlow> {

  ContactInfoFlowTest() {
    setEppInput("contact_info.xml");
  }

-  private Contact persistContact(boolean active) {
-    Contact contact =
-        persistResource(
-            new Contact.Builder()
-                .setContactId("sh8013")
-                .setRepoId("2FF-ROID")
-                .setDeletionTime(active ? null : clock.nowUtc().minusDays(1))
-                .setStatusValues(ImmutableSet.of(StatusValue.CLIENT_DELETE_PROHIBITED))
-                .setInternationalizedPostalInfo(
-                    new PostalInfo.Builder()
-                        .setType(Type.INTERNATIONALIZED)
-                        .setName("John Doe")
-                        .setOrg("Example Inc.")
-                        .setAddress(
-                            new ContactAddress.Builder()
-                                .setStreet(ImmutableList.of("123 Example Dr.", "Suite 100"))
-                                .setCity("Dulles")
-                                .setState("VA")
-                                .setZip("20166-6503")
-                                .setCountryCode("US")
-                                .build())
-                        .build())
-                .setVoiceNumber(
-                    new ContactPhoneNumber.Builder()
-                        .setPhoneNumber("+1.7035555555")
-                        .setExtension("1234")
-                        .build())
-                .setFaxNumber(
-                    new ContactPhoneNumber.Builder().setPhoneNumber("+1.7035555556").build())
-                .setEmailAddress("jdoe@example.com")
-                .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
-                .setCreationRegistrarId("NewRegistrar")
-                .setLastEppUpdateRegistrarId("NewRegistrar")
-                .setCreationTimeForTest(DateTime.parse("1999-04-03T22:00:00.0Z"))
-                .setLastEppUpdateTime(DateTime.parse("1999-12-03T09:00:00.0Z"))
-                .setLastTransferTime(DateTime.parse("2000-04-08T09:00:00.0Z"))
-                .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("2fooBAR")))
-                .setDisclose(
-                    new Disclose.Builder()
-                        .setFlag(true)
-                        .setVoice(new PresenceMarker())
-                        .setEmail(new PresenceMarker())
-                        .build())
-                .build());
-    assertThat(isDeleted(contact, clock.nowUtc())).isNotEqualTo(active);
-    return contact;
-  }
-
  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    persistContact(true);
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(
-        loadFile("contact_info_response.xml"),
-        // We use a different roid scheme than the samples so ignore it.
-        "epp.response.resData.infData.roid");
-    assertNoHistory();
-    assertNoBillingEvents();
-  }
-
-  @Test
-  void testSuccess_linked() throws Exception {
-    createTld("foobar");
-    persistResource(DatabaseHelper.newDomain("example.foobar", persistContact(true)));
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(
-        loadFile("contact_info_response_linked.xml"),
-        // We use a different roid scheme than the samples so ignore it.
-        "epp.response.resData.infData.roid");
-    assertNoHistory();
-    assertNoBillingEvents();
-  }
-
-  @Test
-  void testSuccess_owningRegistrarWithoutAuthInfo_seesAuthInfo() throws Exception {
-    setEppInput("contact_info_no_authinfo.xml");
-    persistContact(true);
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(
-        loadFile("contact_info_response.xml"),
-        // We use a different roid scheme than the samples so ignore it.
-        "epp.response.resData.infData.roid");
-    assertNoHistory();
-    assertNoBillingEvents();
-  }
-
-  @Test
-  void testFailure_otherRegistrar_notAuthorized() throws Exception {
-    setRegistrarIdForFlow("NewRegistrar");
-    persistContact(true);
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    ResourceNotOwnedException thrown = assertThrows(ResourceNotOwnedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_otherRegistrarWithoutAuthInfoAsSuperuser_doesNotSeeAuthInfo() throws Exception {
-    setRegistrarIdForFlow("NewRegistrar");
-    setEppInput("contact_info_no_authinfo.xml");
-    persistContact(true);
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(
-        CommitMode.LIVE,
-        UserPrivileges.SUPERUSER,
-        loadFile("contact_info_response_no_authinfo.xml"),
-        // We use a different roid scheme than the samples so ignore it.
-        "epp.response.resData.infData.roid");
-    assertNoHistory();
-    assertNoBillingEvents();
-  }
-
-  @Test
-  void testSuccess_otherRegistrarWithAuthInfoAsSuperuser_seesAuthInfo() throws Exception {
-    setRegistrarIdForFlow("NewRegistrar");
-    persistContact(true);
-    // Check that the persisted contact info was returned.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(
-        CommitMode.LIVE,
-        UserPrivileges.SUPERUSER,
-        loadFile("contact_info_response.xml"),
-        // We use a different roid scheme than the samples so ignore it.
-        "epp.response.resData.infData.roid");
-    assertNoHistory();
-    assertNoBillingEvents();
-  }
-
-  @Test
-  void testFailure_neverExisted() throws Exception {
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_existedButWasDeleted() throws Exception {
-    persistContact(false);
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    persistContact(true);
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-info");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,254 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.collect.MoreCollectors.onlyElement;
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.createTld;
-import static google.registry.testing.DatabaseHelper.getOnlyPollMessage;
-import static google.registry.testing.DatabaseHelper.getPollMessages;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
-import google.registry.flows.exceptions.NotPendingTransferException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.poll.PendingActionNotificationResponse;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transfer.TransferData;
-import google.registry.model.transfer.TransferResponse;
-import google.registry.model.transfer.TransferStatus;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactTransferApproveFlow}. */
-class ContactTransferApproveFlowTest
-    extends ContactTransferFlowTestCase<ContactTransferApproveFlow, Contact> {
+class ContactTransferApproveFlowTest extends FlowTestCase<ContactTransferApproveFlow> {

-  @BeforeEach
-  void setUp() {
+  ContactTransferApproveFlowTest() {
    setEppInput("contact_transfer_approve.xml");
-    setRegistrarIdForFlow("TheRegistrar");
-    setupContactWithPendingTransfer();
-    clock.advanceOneMilli();
-    createTld("foobar");
-  }
-
-  private void doSuccessfulTest(String commandFilename, String expectedXmlFilename)
-      throws Exception {
-    setEppInput(commandFilename);
-    // Look in the future and make sure the poll messages for implicit ack are there.
-    assertThat(getPollMessages("NewRegistrar", clock.nowUtc().plusMonths(1)))
-        .hasSize(1);
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc().plusMonths(1)))
-        .hasSize(1);
-
-    // Setup done; run the test.
-    contact = reloadResourceByForeignKey();
-    TransferData originalTransferData = contact.getTransferData();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile(expectedXmlFilename));
-
-    // Transfer should have succeeded. Verify correct fields were set.
-    contact = reloadResourceByForeignKey();
-    assertAboutContacts()
-        .that(contact)
-        .hasCurrentSponsorRegistrarId("NewRegistrar")
-        .and()
-        .hasLastTransferTime(clock.nowUtc())
-        .and()
-        .hasOneHistoryEntryEachOfTypes(
-            HistoryEntry.Type.CONTACT_TRANSFER_REQUEST, HistoryEntry.Type.CONTACT_TRANSFER_APPROVE);
-    assertThat(contact.getTransferData())
-        .isEqualTo(
-            originalTransferData.copyConstantFieldsToBuilder()
-                .setTransferStatus(TransferStatus.CLIENT_APPROVED)
-                .setPendingTransferExpirationTime(clock.nowUtc())
-                .build());
-    assertNoBillingEvents();
-    // The poll message (in the future) to the losing registrar for implicit ack should be gone.
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc().plusMonths(1))).isEmpty();
-    // The poll message in the future to the gaining registrar should be gone too, but there
-    // should be one at the current time to the gaining registrar.
-    PollMessage gainingPollMessage = getOnlyPollMessage("NewRegistrar");
-    assertThat(gainingPollMessage.getEventTime()).isEqualTo(clock.nowUtc());
-    assertThat(
-            gainingPollMessage
-                .getResponseData()
-                .stream()
-                .filter(TransferResponse.class::isInstance)
-                .map(TransferResponse.class::cast)
-                .collect(onlyElement())
-                .getTransferStatus())
-        .isEqualTo(TransferStatus.CLIENT_APPROVED);
-    PendingActionNotificationResponse panData =
-        gainingPollMessage
-            .getResponseData()
-            .stream()
-            .filter(PendingActionNotificationResponse.class::isInstance)
-            .map(PendingActionNotificationResponse.class::cast)
-            .collect(onlyElement());
-    assertThat(panData.getTrid())
-        .isEqualTo(Trid.create("transferClient-trid", "transferServer-trid"));
-    assertThat(panData.getActionResult()).isTrue();
-    assertLastHistoryContainsResource(contact);
-  }
-
-  private void doFailingTest(String commandFilename) throws Exception {
-    setEppInput(commandFilename);
-    // Setup done; run the test.
-    assertMutatingFlow(true);
-    runFlow();
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    setEppInput("contact_transfer_approve.xml");
-    dryRunFlowAssertResponse(loadFile("contact_transfer_approve_response.xml"));
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    doSuccessfulTest("contact_transfer_approve.xml", "contact_transfer_approve_response.xml");
-  }
-
-  @Test
-  void testSuccess_withAuthinfo() throws Exception {
-    doSuccessfulTest("contact_transfer_approve_with_authinfo.xml",
-        "contact_transfer_approve_response.xml");
-  }
-
-  @Test
-  void testFailure_badContactPassword() {
-    // Change the contact's password so it does not match the password in the file.
-    contact = persistResource(
-        contact.asBuilder()
-            .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("badpassword")))
-            .build());
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_approve_with_authinfo.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_neverBeenTransferred() {
-    changeTransferStatus(null);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientApproved() {
-    changeTransferStatus(TransferStatus.CLIENT_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientRejected() {
-    changeTransferStatus(TransferStatus.CLIENT_REJECTED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientCancelled() {
-    changeTransferStatus(TransferStatus.CLIENT_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverApproved() {
-    changeTransferStatus(TransferStatus.SERVER_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverCancelled() {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_gainingClient() {
-    setRegistrarIdForFlow("NewRegistrar");
-    EppException thrown =
-        assertThrows(
-            ResourceNotOwnedException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_unrelatedClient() {
-    setRegistrarIdForFlow("ClientZ");
-    EppException thrown =
-        assertThrows(
-            ResourceNotOwnedException.class, () -> doFailingTest("contact_transfer_approve.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_deletedContact() throws Exception {
-    contact = persistResource(
-        contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_approve.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_nonexistentContact() throws Exception {
-    persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    contact = persistResource(
-        contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_approve.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-transfer-approve");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,240 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.collect.MoreCollectors.onlyElement;
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.getOnlyPollMessage;
-import static google.registry.testing.DatabaseHelper.getPollMessages;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.exceptions.NotPendingTransferException;
-import google.registry.flows.exceptions.NotTransferInitiatorException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transfer.TransferData;
-import google.registry.model.transfer.TransferResponse;
-import google.registry.model.transfer.TransferStatus;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactTransferCancelFlow}. */
-class ContactTransferCancelFlowTest
-    extends ContactTransferFlowTestCase<ContactTransferCancelFlow, Contact> {
+class ContactTransferCancelFlowTest extends FlowTestCase<ContactTransferCancelFlow> {

-  @BeforeEach
-  void setUp() {
-    this.setEppInput("contact_transfer_cancel.xml");
-    setRegistrarIdForFlow("NewRegistrar");
-    setupContactWithPendingTransfer();
-    clock.advanceOneMilli();
-  }
-
-  private void doSuccessfulTest(String commandFilename, String expectedXmlFilename)
-      throws Exception {
-    this.setEppInput(commandFilename);
-    // Look in the future and make sure the poll messages for implicit ack are there.
-    assertThat(getPollMessages("NewRegistrar", clock.nowUtc().plusMonths(1))).hasSize(1);
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc().plusMonths(1))).hasSize(1);
-
-    // Setup done; run the test.
-    contact = reloadResourceByForeignKey();
-    TransferData originalTransferData = contact.getTransferData();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile(expectedXmlFilename));
-
-    // Transfer should have been cancelled. Verify correct fields were set.
-    contact = reloadResourceByForeignKey();
-    assertAboutContacts()
-        .that(contact)
-        .hasCurrentSponsorRegistrarId("TheRegistrar")
-        .and()
-        .hasLastTransferTimeNotEqualTo(clock.nowUtc())
-        .and()
-        .hasOneHistoryEntryEachOfTypes(
-            HistoryEntry.Type.CONTACT_TRANSFER_REQUEST, HistoryEntry.Type.CONTACT_TRANSFER_CANCEL);
-    assertThat(contact.getTransferData())
-        .isEqualTo(
-            originalTransferData.copyConstantFieldsToBuilder()
-                .setTransferStatus(TransferStatus.CLIENT_CANCELLED)
-                .setPendingTransferExpirationTime(clock.nowUtc())
-                .build());
-    assertNoBillingEvents();
-    // The poll message (in the future) to the gaining registrar for implicit ack should be gone.
-    assertThat(getPollMessages("NewRegistrar", clock.nowUtc().plusMonths(1))).isEmpty();
-    // The poll message in the future to the losing registrar should be gone too, but there
-    // should be one at the current time to the losing registrar.
-    PollMessage losingPollMessage = getOnlyPollMessage("TheRegistrar");
-    assertThat(losingPollMessage.getEventTime()).isEqualTo(clock.nowUtc());
-    assertThat(
-            losingPollMessage
-                .getResponseData()
-                .stream()
-                .filter(TransferResponse.class::isInstance)
-                .map(TransferResponse.class::cast)
-                .collect(onlyElement())
-                .getTransferStatus())
-        .isEqualTo(TransferStatus.CLIENT_CANCELLED);
-    assertLastHistoryContainsResource(contact);
-  }
-
-  private void doFailingTest(String commandFilename) throws Exception {
-    this.setEppInput(commandFilename);
-    // Setup done; run the test.
-    assertMutatingFlow(true);
-    runFlow();
-  }
-
-  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
+  ContactTransferCancelFlowTest() {
    setEppInput("contact_transfer_cancel.xml");
-    dryRunFlowAssertResponse(loadFile("contact_transfer_cancel_response.xml"));
  }

  @Test
-  void testSuccess() throws Exception {
-    doSuccessfulTest("contact_transfer_cancel.xml", "contact_transfer_cancel_response.xml");
-  }
-
-  @Test
-  void testSuccess_withAuthinfo() throws Exception {
-    doSuccessfulTest("contact_transfer_cancel_with_authinfo.xml",
-        "contact_transfer_cancel_response.xml");
-  }
-
-  @Test
-  void testFailure_badContactPassword() {
-    // Change the contact's password so it does not match the password in the file.
-    contact =
-        persistResource(
-            contact
-                .asBuilder()
-                .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("badpassword")))
-                .build());
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_cancel_with_authinfo.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_neverBeenTransferred() {
-    changeTransferStatus(null);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientApproved() {
-    changeTransferStatus(TransferStatus.CLIENT_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientRejected() {
-    changeTransferStatus(TransferStatus.CLIENT_REJECTED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientCancelled() {
-    changeTransferStatus(TransferStatus.CLIENT_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverApproved() {
-    changeTransferStatus(TransferStatus.SERVER_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverCancelled() {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_sponsoringClient() {
-    setRegistrarIdForFlow("TheRegistrar");
-    EppException thrown =
-        assertThrows(
-            NotTransferInitiatorException.class,
-            () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_unrelatedClient() {
-    setRegistrarIdForFlow("ClientZ");
-    EppException thrown =
-        assertThrows(
-            NotTransferInitiatorException.class,
-            () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_deletedContact() throws Exception {
-    contact =
-        persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_nonexistentContact() throws Exception {
-    persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_cancel.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-transfer-cancel");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -1,93 +0,0 @@
-// Copyright 2017 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.flows.contact;
-
-import static com.google.common.base.Preconditions.checkState;
-import static google.registry.testing.DatabaseHelper.newContact;
-import static google.registry.testing.DatabaseHelper.persistContactWithPendingTransfer;
-import static google.registry.testing.DatabaseHelper.persistResource;
-
-import google.registry.flows.Flow;
-import google.registry.flows.ResourceFlowTestCase;
-import google.registry.model.EppResource;
-import google.registry.model.contact.Contact;
-import google.registry.model.tld.Tld;
-import google.registry.model.transfer.TransferStatus;
-import google.registry.persistence.transaction.JpaTransactionManagerExtension;
-import org.joda.time.DateTime;
-import org.joda.time.Duration;
-import org.junit.jupiter.api.BeforeEach;
-
-/**
- * Base class for contact transfer flow unit tests.
- *
- * @param <F> the flow type
- * @param <R> the resource type
- */
-abstract class ContactTransferFlowTestCase<F extends Flow, R extends EppResource>
-    extends ResourceFlowTestCase<F, R> {
-
-  // Transfer is requested on the 6th and expires on the 11th.
-  // The "now" of this flow is on the 9th, 3 days in.
-
-  private static final DateTime TRANSFER_REQUEST_TIME = DateTime.parse("2000-06-06T22:00:00.0Z");
-  private static final DateTime TRANSFER_EXPIRATION_TIME =
-      TRANSFER_REQUEST_TIME.plus(Tld.DEFAULT_TRANSFER_GRACE_PERIOD);
-  private static final Duration TIME_SINCE_REQUEST = Duration.standardDays(3);
-
-  protected Contact contact;
-
-  ContactTransferFlowTestCase() {
-    checkState(!Tld.DEFAULT_TRANSFER_GRACE_PERIOD.isShorterThan(TIME_SINCE_REQUEST));
-    clock.setTo(TRANSFER_REQUEST_TIME.plus(TIME_SINCE_REQUEST));
-  }
-
-  @BeforeEach
-  void beforeEachContactTransferFlowTestCase() {
-    // Registrar ClientZ is used in tests that need another registrar that definitely doesn't own
-    // the resources in question.
-    persistResource(
-        JpaTransactionManagerExtension.makeRegistrar1()
-            .asBuilder()
-            .setRegistrarId("ClientZ")
-            .build());
-  }
-
-  /** Adds a contact that has a pending transfer on it from TheRegistrar to NewRegistrar. */
-  void setupContactWithPendingTransfer() {
-    contact =
-        persistContactWithPendingTransfer(
-            newContact("sh8013"),
-            TRANSFER_REQUEST_TIME,
-            TRANSFER_EXPIRATION_TIME,
-            TRANSFER_REQUEST_TIME);
-  }
-
-  /** Changes the transfer status on the persisted contact. */
-  protected void changeTransferStatus(TransferStatus transferStatus) {
-    contact = persistResource(
-        contact.asBuilder()
-            .setTransferData(
-                contact.getTransferData().asBuilder().setTransferStatus(transferStatus).build())
-            .build());
-    clock.advanceOneMilli();
-  }
-
-  /** Changes the client ID that the flow will run as. */
-  @Override
-  protected void setRegistrarIdForFlow(String registrarId) {
-    sessionMetadata.setRegistrarId(registrarId);
-  }
-}
@@ -14,206 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.exceptions.NoTransferHistoryToQueryException;
-import google.registry.flows.exceptions.NotAuthorizedToViewTransferException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transfer.TransferStatus;
-import org.joda.time.DateTime;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactTransferQueryFlow}. */
-class ContactTransferQueryFlowTest
-    extends ContactTransferFlowTestCase<ContactTransferQueryFlow, Contact> {
+class ContactTransferQueryFlowTest extends FlowTestCase<ContactTransferQueryFlow> {

-  @BeforeEach
-  void setUp() {
+  ContactTransferQueryFlowTest() {
    setEppInput("contact_transfer_query.xml");
-    clock.setTo(DateTime.parse("2000-06-10T22:00:00.0Z"));
-    setRegistrarIdForFlow("NewRegistrar");
-    setupContactWithPendingTransfer();
-  }
-
-  private void doSuccessfulTest(String commandFilename, String expectedXmlFilename)
-      throws Exception {
-    setEppInput(commandFilename);
-    eppLoader.replaceAll("JD1234-REP", contact.getRepoId());
-    // Setup done; run the test.
-    assertMutatingFlow(false);
-    runFlowAssertResponse(loadFile(expectedXmlFilename));
-    assertAboutContacts().that(reloadResourceByForeignKey(clock.nowUtc().minusDays(1)))
-        .hasOneHistoryEntryEachOfTypes(HistoryEntry.Type.CONTACT_TRANSFER_REQUEST);
-    assertNoBillingEvents();
-  }
-
-  private void doFailingTest(String commandFilename) throws Exception {
-    setEppInput(commandFilename);
-    eppLoader.replaceAll("JD1234-REP", contact.getRepoId());
-    // Setup done; run the test.
-    assertMutatingFlow(false);
-    runFlow();
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    doSuccessfulTest("contact_transfer_query.xml", "contact_transfer_query_response.xml");
-  }
-
-  @Test
-  void testSuccess_withContactRoid() throws Exception {
-    doSuccessfulTest("contact_transfer_query_with_roid.xml", "contact_transfer_query_response.xml");
-  }
-
-  @Test
-  void testSuccess_sponsoringClient() throws Exception {
-    setRegistrarIdForFlow("TheRegistrar");
-    doSuccessfulTest("contact_transfer_query.xml", "contact_transfer_query_response.xml");
-  }
-
-  @Test
-  void testSuccess_withAuthinfo() throws Exception {
-    setRegistrarIdForFlow("ClientZ");
-    doSuccessfulTest("contact_transfer_query_with_authinfo.xml",
-        "contact_transfer_query_response.xml");
-  }
-
-  @Test
-  void testSuccess_clientApproved() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_APPROVED);
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_client_approved.xml");
-  }
-
-  @Test
-  void testSuccess_clientRejected() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_REJECTED);
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_client_rejected.xml");
-  }
-
-  @Test
-  void testSuccess_clientCancelled() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_CANCELLED);
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_client_cancelled.xml");
-  }
-
-  @Test
-  void testSuccess_serverApproved() throws Exception {
-    changeTransferStatus(TransferStatus.SERVER_APPROVED);
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_server_approved.xml");
-  }
-
-  @Test
-  void testSuccess_serverCancelled() throws Exception {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_server_cancelled.xml");
-  }
-
-  @Test
-  void testFailure_pendingDeleteContact() throws Exception {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    contact = persistResource(
-        contact.asBuilder().setDeletionTime(clock.nowUtc().plusDays(1)).build());
-    doSuccessfulTest("contact_transfer_query.xml",
-        "contact_transfer_query_response_server_cancelled.xml");
-  }
-
-  @Test
-  void testFailure_badContactPassword() {
-    // Change the contact's password so it does not match the password in the file.
-    contact =
-        persistResource(
-            contact
-                .asBuilder()
-                .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("badpassword")))
-                .build());
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_query_with_authinfo.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_badContactRoid() {
-    // Set the contact to a different ROID, but don't persist it; this is just so the substitution
-    // code above will write the wrong ROID into the file.
-    contact = contact.asBuilder().setRepoId("DEADBEEF_TLD-ROID").build();
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_query_with_roid.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_neverBeenTransferred() {
-    changeTransferStatus(null);
-    EppException thrown =
-        assertThrows(
-            NoTransferHistoryToQueryException.class,
-            () -> doFailingTest("contact_transfer_query.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_unrelatedClient() {
-    setRegistrarIdForFlow("ClientZ");
-    EppException thrown =
-        assertThrows(
-            NotAuthorizedToViewTransferException.class,
-            () -> doFailingTest("contact_transfer_query.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_deletedContact() throws Exception {
-    contact =
-        persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class, () -> doFailingTest("contact_transfer_query.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_nonexistentContact() throws Exception {
-    persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class, () -> doFailingTest("contact_transfer_query.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-transfer-query");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,253 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.collect.MoreCollectors.onlyElement;
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.getOnlyPollMessage;
-import static google.registry.testing.DatabaseHelper.getPollMessages;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
-import google.registry.flows.exceptions.NotPendingTransferException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.poll.PendingActionNotificationResponse;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transfer.TransferData;
-import google.registry.model.transfer.TransferResponse;
-import google.registry.model.transfer.TransferStatus;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactTransferRejectFlow}. */
-class ContactTransferRejectFlowTest
-    extends ContactTransferFlowTestCase<ContactTransferRejectFlow, Contact> {
+class ContactTransferRejectFlowTest extends FlowTestCase<ContactTransferRejectFlow> {

-  @BeforeEach
-  void setUp() {
+  ContactTransferRejectFlowTest() {
    setEppInput("contact_transfer_reject.xml");
-    setRegistrarIdForFlow("TheRegistrar");
-    setupContactWithPendingTransfer();
-    clock.advanceOneMilli();
-  }
-
-  private void doSuccessfulTest(String commandFilename, String expectedXmlFilename)
-      throws Exception {
-    setEppInput(commandFilename);
-    // Look in the future and make sure the poll messages for implicit ack are there.
-    assertThat(getPollMessages("NewRegistrar", clock.nowUtc().plusMonths(1)))
-        .hasSize(1);
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc().plusMonths(1)))
-        .hasSize(1);
-
-    // Setup done; run the test.
-    contact = reloadResourceByForeignKey();
-    TransferData originalTransferData = contact.getTransferData();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile(expectedXmlFilename));
-
-    // Transfer should have failed. Verify correct fields were set.
-    contact = reloadResourceByForeignKey();
-    assertAboutContacts()
-        .that(contact)
-        .hasCurrentSponsorRegistrarId("TheRegistrar")
-        .and()
-        .hasLastTransferTimeNotEqualTo(clock.nowUtc())
-        .and()
-        .hasOneHistoryEntryEachOfTypes(
-            HistoryEntry.Type.CONTACT_TRANSFER_REQUEST, HistoryEntry.Type.CONTACT_TRANSFER_REJECT);
-    assertThat(contact.getTransferData())
-        .isEqualTo(
-            originalTransferData.copyConstantFieldsToBuilder()
-                .setTransferStatus(TransferStatus.CLIENT_REJECTED)
-                .setPendingTransferExpirationTime(clock.nowUtc())
-                .build());
-    // The poll message (in the future) to the losing registrar for implicit ack should be gone.
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc().plusMonths(1)))
-        .isEmpty();
-    // The poll message in the future to the gaining registrar should be gone too, but there
-    // should be one at the current time to the gaining registrar.
-    PollMessage gainingPollMessage = getOnlyPollMessage("NewRegistrar");
-    assertThat(gainingPollMessage.getEventTime()).isEqualTo(clock.nowUtc());
-    assertThat(
-            gainingPollMessage
-                .getResponseData()
-                .stream()
-                .filter(TransferResponse.class::isInstance)
-                .map(TransferResponse.class::cast)
-                .collect(onlyElement())
-                .getTransferStatus())
-        .isEqualTo(TransferStatus.CLIENT_REJECTED);
-    PendingActionNotificationResponse panData =
-        gainingPollMessage
-            .getResponseData()
-            .stream()
-            .filter(PendingActionNotificationResponse.class::isInstance)
-            .map(PendingActionNotificationResponse.class::cast)
-            .collect(onlyElement());
-    assertThat(panData.getTrid())
-        .isEqualTo(Trid.create("transferClient-trid", "transferServer-trid"));
-    assertThat(panData.getActionResult()).isFalse();
-    assertNoBillingEvents();
-    assertLastHistoryContainsResource(contact);
-  }
-
-  private void doFailingTest(String commandFilename) throws Exception {
-    setEppInput(commandFilename);
-    // Setup done; run the test.
-    assertMutatingFlow(true);
-    runFlow();
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    setEppInput("contact_transfer_reject.xml");
-    dryRunFlowAssertResponse(loadFile("contact_transfer_reject_response.xml"));
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    doSuccessfulTest("contact_transfer_reject.xml", "contact_transfer_reject_response.xml");
-  }
-
-  @Test
-  void testSuccess_domainAuthInfo() throws Exception {
-    doSuccessfulTest("contact_transfer_reject_with_authinfo.xml",
-        "contact_transfer_reject_response.xml");
-  }
-
-  @Test
-  void testFailure_badPassword() {
-    // Change the contact's password so it does not match the password in the file.
-    contact =
-        persistResource(
-            contact
-                .asBuilder()
-                .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("badpassword")))
-                .build());
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_reject_with_authinfo.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_neverBeenTransferred() {
-    changeTransferStatus(null);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientApproved() {
-    changeTransferStatus(TransferStatus.CLIENT_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientRejected() {
-    changeTransferStatus(TransferStatus.CLIENT_REJECTED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientCancelled() {
-    changeTransferStatus(TransferStatus.CLIENT_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverApproved() {
-    changeTransferStatus(TransferStatus.SERVER_APPROVED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverCancelled() {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    EppException thrown =
-        assertThrows(
-            NotPendingTransferException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_gainingClient() {
-    setRegistrarIdForFlow("NewRegistrar");
-    EppException thrown =
-        assertThrows(
-            ResourceNotOwnedException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_unrelatedClient() {
-    setRegistrarIdForFlow("ClientZ");
-    EppException thrown =
-        assertThrows(
-            ResourceNotOwnedException.class, () -> doFailingTest("contact_transfer_reject.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_deletedContact() throws Exception {
-    contact =
-        persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_reject.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_nonexistentContact() throws Exception {
-    persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_reject.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-transfer-reject");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,304 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.base.Predicates.equalTo;
-import static com.google.common.base.Predicates.not;
-import static com.google.common.collect.Iterables.getOnlyElement;
-import static com.google.common.collect.MoreCollectors.onlyElement;
-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.config.RegistryConfig.getContactAutomaticTransferLength;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.assertPollMessagesEqual;
-import static google.registry.testing.DatabaseHelper.deleteResource;
-import static google.registry.testing.DatabaseHelper.getPollMessages;
-import static google.registry.testing.DatabaseHelper.loadByKeys;
-import static google.registry.testing.DatabaseHelper.persistActiveContact;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
-import static google.registry.util.CollectionUtils.forceEmptyToNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Iterables;
-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowUtils.BadAuthInfoForResourceException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.exceptions.AlreadyPendingTransferException;
-import google.registry.flows.exceptions.MissingTransferRequestAuthInfoException;
-import google.registry.flows.exceptions.ObjectAlreadySponsoredException;
-import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAuthInfo;
-import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
-import google.registry.model.eppcommon.StatusValue;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.poll.PollMessage;
-import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transfer.ContactTransferData;
-import google.registry.model.transfer.TransferStatus;
-import org.joda.time.DateTime;
-import org.junit.jupiter.api.BeforeEach;
+import google.registry.flows.FlowTestCase;
+import google.registry.flows.exceptions.ContactsProhibitedException;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactTransferRequestFlow}. */
-class ContactTransferRequestFlowTest
-    extends ContactTransferFlowTestCase<ContactTransferRequestFlow, Contact> {
+class ContactTransferRequestFlowTest extends FlowTestCase<ContactTransferRequestFlow> {

  ContactTransferRequestFlowTest() {
-    // We need the transfer to happen at exactly this time in order for the response to match up.
-    clock.setTo(DateTime.parse("2000-06-08T22:00:00.0Z"));
-  }
-
-  @BeforeEach
-  void beforeEach() {
    setEppInput("contact_transfer_request.xml");
-    setRegistrarIdForFlow("NewRegistrar");
-    contact = persistActiveContact("sh8013");
-    clock.advanceOneMilli();
-  }
-
-  private void doSuccessfulTest(String commandFilename, String expectedXmlFilename)
-      throws Exception {
-    setEppInput(commandFilename);
-    DateTime afterTransfer = clock.nowUtc().plus(getContactAutomaticTransferLength());
-
-    // Setup done; run the test.
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile(expectedXmlFilename));
-
-    // Transfer should have been requested. Verify correct fields were set.
-    contact = reloadResourceByForeignKey();
-    assertAboutContacts()
-        .that(contact)
-        .hasCurrentSponsorRegistrarId("TheRegistrar")
-        .and()
-        .hasOnlyOneHistoryEntryWhich()
-        .hasType(HistoryEntry.Type.CONTACT_TRANSFER_REQUEST);
-    Trid expectedTrid =
-        Trid.create(
-            getClientTrid(),
-            contact.getTransferData().getTransferRequestTrid().getServerTransactionId());
-    assertThat(contact.getTransferData())
-        .isEqualTo(
-            new ContactTransferData.Builder()
-                .setTransferRequestTrid(expectedTrid)
-                .setTransferRequestTime(clock.nowUtc())
-                .setGainingRegistrarId("NewRegistrar")
-                .setLosingRegistrarId("TheRegistrar")
-                .setTransferStatus(TransferStatus.PENDING)
-                .setPendingTransferExpirationTime(afterTransfer)
-                // Make the server-approve entities field a no-op comparison; it's easier to
-                // do this comparison separately below.
-                .setServerApproveEntities(
-                    contact.getRepoId(),
-                    contact.getTransferData().getHistoryEntryId(),
-                    forceEmptyToNull(contact.getTransferData().getServerApproveEntities()))
-                .build());
-    assertNoBillingEvents();
-    assertThat(getPollMessages("TheRegistrar", clock.nowUtc())).hasSize(1);
-    PollMessage losingRequestMessage =
-        getOnlyElement(getPollMessages("TheRegistrar", clock.nowUtc()));
-
-    // If we fast forward AUTOMATIC_TRANSFER_DAYS the transfer should have happened.
-    assertAboutContacts()
-        .that(contact.cloneProjectedAtTime(afterTransfer))
-        .hasCurrentSponsorRegistrarId("NewRegistrar");
-    assertThat(getPollMessages("NewRegistrar", afterTransfer)).hasSize(1);
-    assertThat(getPollMessages("TheRegistrar", afterTransfer)).hasSize(2);
-    PollMessage gainingApproveMessage =
-        getOnlyElement(getPollMessages("NewRegistrar", afterTransfer));
-    PollMessage losingApproveMessage =
-        getPollMessages("TheRegistrar", afterTransfer)
-            .stream()
-            .filter(not(equalTo(losingRequestMessage)))
-            .collect(onlyElement());
-
-    // Check for TransferData server-approve entities containing what we expect: only
-    // poll messages, the approval notice ones for gaining and losing registrars.
-    assertPollMessagesEqual(
-        Iterables.filter(
-            loadByKeys(contact.getTransferData().getServerApproveEntities()), PollMessage.class),
-        ImmutableList.of(gainingApproveMessage, losingApproveMessage));
-    assertLastHistoryContainsResource(contact);
-  }
-
-  private void doFailingTest(String commandFilename) throws Exception {
-    setEppInput(commandFilename);
-    // Setup done; run the test.
-    assertMutatingFlow(true);
-    runFlow();
  }

  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    setEppInput("contact_transfer_request.xml");
-    dryRunFlowAssertResponse(loadFile("contact_transfer_request_response.xml"));
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testFailure_noAuthInfo() {
-    EppException thrown =
-        assertThrows(
-            MissingTransferRequestAuthInfoException.class,
-            () -> doFailingTest("contact_transfer_request_no_authinfo.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_badPassword() {
-    // Change the contact's password so it does not match the password in the file.
-    contact =
-        persistResource(
-            contact
-                .asBuilder()
-                .setAuthInfo(ContactAuthInfo.create(PasswordAuth.create("badpassword")))
-                .build());
-    EppException thrown =
-        assertThrows(
-            BadAuthInfoForResourceException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_clientApproved() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_APPROVED);
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testSuccess_clientRejected() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_REJECTED);
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testSuccess_clientCancelled() throws Exception {
-    changeTransferStatus(TransferStatus.CLIENT_CANCELLED);
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testSuccess_serverApproved() throws Exception {
-    changeTransferStatus(TransferStatus.SERVER_APPROVED);
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testSuccess_serverCancelled() throws Exception {
-    changeTransferStatus(TransferStatus.SERVER_CANCELLED);
-    doSuccessfulTest("contact_transfer_request.xml", "contact_transfer_request_response.xml");
-  }
-
-  @Test
-  void testFailure_pending() {
-    contact =
-        persistResource(
-            contact
-                .asBuilder()
-                .setTransferData(
-                    contact
-                        .getTransferData()
-                        .asBuilder()
-                        .setTransferStatus(TransferStatus.PENDING)
-                        .setPendingTransferExpirationTime(clock.nowUtc().plusDays(1))
-                        .build())
-                .build());
-    EppException thrown =
-        assertThrows(
-            AlreadyPendingTransferException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_sponsoringClient() {
-    setRegistrarIdForFlow("TheRegistrar");
-    EppException thrown =
-        assertThrows(
-            ObjectAlreadySponsoredException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_deletedContact() throws Exception {
-    contact =
-        persistResource(contact.asBuilder().setDeletionTime(clock.nowUtc().minusDays(1)).build());
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_nonexistentContact() throws Exception {
-    deleteResource(contact);
-    ResourceDoesNotExistException thrown =
-        assertThrows(
-            ResourceDoesNotExistException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_clientTransferProhibited() {
-    contact =
-        persistResource(
-            contact.asBuilder().addStatusValue(StatusValue.CLIENT_TRANSFER_PROHIBITED).build());
-    ResourceStatusProhibitsOperationException thrown =
-        assertThrows(
-            ResourceStatusProhibitsOperationException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertThat(thrown).hasMessageThat().contains("clientTransferProhibited");
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverTransferProhibited() {
-    contact =
-        persistResource(
-            contact.asBuilder().addStatusValue(StatusValue.SERVER_TRANSFER_PROHIBITED).build());
-    ResourceStatusProhibitsOperationException thrown =
-        assertThrows(
-            ResourceStatusProhibitsOperationException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertThat(thrown).hasMessageThat().contains("serverTransferProhibited");
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_pendingDelete() {
-    contact =
-        persistResource(contact.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build());
-    ResourceStatusProhibitsOperationException thrown =
-        assertThrows(
-            ResourceStatusProhibitsOperationException.class,
-            () -> doFailingTest("contact_transfer_request.xml"));
-    assertThat(thrown).hasMessageThat().contains("pendingDelete");
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-transfer-request");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -14,449 +14,24 @@

 package google.registry.flows.contact;

-import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_PROHIBITED;
-import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
-import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.ContactSubject.assertAboutContacts;
-import static google.registry.testing.DatabaseHelper.assertNoBillingEvents;
-import static google.registry.testing.DatabaseHelper.newContact;
-import static google.registry.testing.DatabaseHelper.persistActiveContact;
-import static google.registry.testing.DatabaseHelper.persistDeletedContact;
-import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
-import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.junit.jupiter.api.Assertions.assertThrows;

-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.ImmutableSortedMap;
-import google.registry.flows.EppException;
-import google.registry.flows.FlowUtils.NotLoggedInException;
-import google.registry.flows.ResourceFlowTestCase;
-import google.registry.flows.ResourceFlowUtils.AddRemoveSameValueException;
-import google.registry.flows.ResourceFlowUtils.ResourceDoesNotExistException;
-import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
-import google.registry.flows.ResourceFlowUtils.StatusNotClientSettableException;
-import google.registry.flows.contact.ContactFlowUtils.BadInternationalizedPostalInfoException;
-import google.registry.flows.contact.ContactFlowUtils.DeclineContactDisclosureFieldDisallowedPolicyException;
+import google.registry.flows.FlowTestCase;
 import google.registry.flows.exceptions.ContactsProhibitedException;
-import google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException;
-import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
-import google.registry.model.common.FeatureFlag;
-import google.registry.model.contact.Contact;
-import google.registry.model.contact.ContactAddress;
-import google.registry.model.contact.PostalInfo;
-import google.registry.model.contact.PostalInfo.Type;
-import google.registry.model.eppcommon.StatusValue;
 import org.junit.jupiter.api.Test;

 /** Unit tests for {@link ContactUpdateFlow}. */
-class ContactUpdateFlowTest extends ResourceFlowTestCase<ContactUpdateFlow, Contact> {
+class ContactUpdateFlowTest extends FlowTestCase<ContactUpdateFlow> {

  ContactUpdateFlowTest() {
    setEppInput("contact_update.xml");
  }

-  private void doSuccessfulTest() throws Exception {
-    clock.advanceOneMilli();
-    assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("generic_success_response.xml"));
-    Contact contact = reloadResourceByForeignKey();
-    // Check that the contact was updated. This value came from the xml.
-    assertAboutContacts()
-        .that(contact)
-        .hasAuthInfoPwd("2fooBAR")
-        .and()
-        .hasOnlyOneHistoryEntryWhich()
-        .hasNoXml();
-    assertNoBillingEvents();
-    assertLastHistoryContainsResource(contact);
-  }
-
  @Test
-  void testNotLoggedIn() {
-    sessionMetadata.setRegistrarId(null);
-    EppException thrown = assertThrows(NotLoggedInException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testDryRun() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    dryRunFlowAssertResponse(loadFile("generic_success_response.xml"));
-  }
-
-  @Test
-  void testSuccess() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    doSuccessfulTest();
-  }
-
-  @Test
-  void testFailure_minimumDatasetPhase2_cannotUpdateContacts() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_PROHIBITED)
-            .setStatusMap(
-                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
-            .build());
-    EppException thrown = assertThrows(ContactsProhibitedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_updatingInternationalizedPostalInfoDeletesLocalized() throws Exception {
-    Contact contact =
-        persistResource(
-            newContact(getUniqueIdFromCommand())
-                .asBuilder()
-                .setLocalizedPostalInfo(
-                    new PostalInfo.Builder()
-                        .setType(Type.LOCALIZED)
-                        .setAddress(
-                            new ContactAddress.Builder()
-                                .setStreet(ImmutableList.of("111 8th Ave", "4th Floor"))
-                                .setCity("New York")
-                                .setState("NY")
-                                .setZip("10011")
-                                .setCountryCode("US")
-                                .build())
-                        .build())
-                .build());
-    clock.advanceOneMilli();
-    // The test xml updates the internationalized postal info and should therefore implicitly delete
-    // the localized one since they are treated as a pair for update purposes.
-    assertAboutContacts().that(contact)
-        .hasNonNullLocalizedPostalInfo().and()
-        .hasNullInternationalizedPostalInfo();
-
-    runFlowAssertResponse(loadFile("generic_success_response.xml"));
-    assertAboutContacts().that(reloadResourceByForeignKey())
-        .hasNullLocalizedPostalInfo().and()
-        .hasInternationalizedPostalInfo(new PostalInfo.Builder()
-            .setType(Type.INTERNATIONALIZED)
-            .setAddress(new ContactAddress.Builder()
-                .setStreet(ImmutableList.of("124 Example Dr.", "Suite 200"))
-                .setCity("Dulles")
-                .setState("VA")
-                .setZip("20166-6503")
-                .setCountryCode("US")
-                .build())
-            .build());
-  }
-
-  @Test
-  void testSuccess_updatingLocalizedPostalInfoDeletesInternationalized() throws Exception {
-    setEppInput("contact_update_localized.xml");
-    Contact contact =
-        persistResource(
-            newContact(getUniqueIdFromCommand())
-                .asBuilder()
-                .setInternationalizedPostalInfo(
-                    new PostalInfo.Builder()
-                        .setType(Type.INTERNATIONALIZED)
-                        .setAddress(
-                            new ContactAddress.Builder()
-                                .setStreet(ImmutableList.of("111 8th Ave", "4th Floor"))
-                                .setCity("New York")
-                                .setState("NY")
-                                .setZip("10011")
-                                .setCountryCode("US")
-                                .build())
-                        .build())
-                .build());
-    clock.advanceOneMilli();
-    // The test xml updates the localized postal info and should therefore implicitly delete
-    // the internationalized one since they are treated as a pair for update purposes.
-    assertAboutContacts().that(contact)
-        .hasNonNullInternationalizedPostalInfo().and()
-        .hasNullLocalizedPostalInfo();
-
-    runFlowAssertResponse(loadFile("generic_success_response.xml"));
-    assertAboutContacts().that(reloadResourceByForeignKey())
-        .hasNullInternationalizedPostalInfo().and()
-        .hasLocalizedPostalInfo(new PostalInfo.Builder()
-            .setType(Type.LOCALIZED)
-            .setAddress(new ContactAddress.Builder()
-                .setStreet(ImmutableList.of("124 Example Dr.", "Suite 200"))
-                .setCity("Dulles")
-                .setState("VA")
-                .setZip("20166-6503")
-                .setCountryCode("US")
-                .build())
-            .build());
-  }
-
-  @Test
-  void testSuccess_partialPostalInfoUpdate() throws Exception {
-    setEppInput("contact_update_partial_postalinfo.xml");
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setLocalizedPostalInfo(
-                new PostalInfo.Builder()
-                    .setType(Type.LOCALIZED)
-                    .setName("A. Person")
-                    .setOrg("Company Inc.")
-                    .setAddress(
-                        new ContactAddress.Builder()
-                            .setStreet(ImmutableList.of("123 4th st", "5th Floor"))
-                            .setCity("City")
-                            .setState("AB")
-                            .setZip("12345")
-                            .setCountryCode("US")
-                            .build())
-                    .build())
-            .build());
-    clock.advanceOneMilli();
-    // The test xml updates the address of the postal info and should leave the name untouched.
-    runFlowAssertResponse(loadFile("generic_success_response.xml"));
-    assertAboutContacts().that(reloadResourceByForeignKey()).hasLocalizedPostalInfo(
-        new PostalInfo.Builder()
-            .setType(Type.LOCALIZED)
-            .setName("A. Person")
-            .setOrg("Company Inc.")
-            .setAddress(new ContactAddress.Builder()
-                .setStreet(ImmutableList.of("456 5th st"))
-                .setCity("Place")
-                .setState("CD")
-                .setZip("54321")
-                .setCountryCode("US")
-                .build())
-            .build());
-  }
-
-  @Test
-  void testSuccess_updateOnePostalInfo_touchOtherPostalInfoPreservesIt() throws Exception {
-    setEppInput("contact_update_partial_postalinfo_preserve_int.xml");
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setLocalizedPostalInfo(
-                new PostalInfo.Builder()
-                    .setType(Type.LOCALIZED)
-                    .setName("A. Person")
-                    .setOrg("Company Inc.")
-                    .setAddress(
-                        new ContactAddress.Builder()
-                            .setStreet(ImmutableList.of("123 4th st", "5th Floor"))
-                            .setCity("City")
-                            .setState("AB")
-                            .setZip("12345")
-                            .setCountryCode("US")
-                            .build())
-                    .build())
-            .setInternationalizedPostalInfo(
-                new PostalInfo.Builder()
-                    .setType(Type.INTERNATIONALIZED)
-                    .setName("B. Person")
-                    .setOrg("Company Co.")
-                    .setAddress(
-                        new ContactAddress.Builder()
-                            .setStreet(ImmutableList.of("100 200th Dr.", "6th Floor"))
-                            .setCity("Town")
-                            .setState("CD")
-                            .setZip("67890")
-                            .setCountryCode("US")
-                            .build())
-                    .build())
-            .build());
-    clock.advanceOneMilli();
-    // The test xml updates the address of the localized postal info. It also sets the name of the
-    // internationalized postal info to the same value it previously had, which causes it to be
-    // preserved. If the xml had not mentioned the internationalized one at all it would have been
-    // deleted.
-    runFlowAssertResponse(loadFile("generic_success_response.xml"));
-    assertAboutContacts().that(reloadResourceByForeignKey())
-        .hasLocalizedPostalInfo(
-            new PostalInfo.Builder()
-                .setType(Type.LOCALIZED)
-                .setName("A. Person")
-                .setOrg("Company Inc.")
-                .setAddress(new ContactAddress.Builder()
-                    .setStreet(ImmutableList.of("456 5th st"))
-                    .setCity("Place")
-                    .setState("CD")
-                    .setZip("54321")
-                    .setCountryCode("US")
-                    .build())
-                .build())
-        .and()
-        .hasInternationalizedPostalInfo(
-            new PostalInfo.Builder()
-                .setType(Type.INTERNATIONALIZED)
-                .setName("B. Person")
-                .setOrg("Company Co.")
-                .setAddress(new ContactAddress.Builder()
-                    .setStreet(ImmutableList.of("100 200th Dr.", "6th Floor"))
-                    .setCity("Town")
-                    .setState("CD")
-                    .setZip("67890")
-                    .setCountryCode("US")
-                    .build())
-                .build());
-  }
-
-  @Test
-  void testFailure_neverExisted() throws Exception {
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_existedButWasDeleted() throws Exception {
-    persistDeletedContact(getUniqueIdFromCommand(), clock.nowUtc().minusDays(1));
-    ResourceDoesNotExistException thrown =
-        assertThrows(ResourceDoesNotExistException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains(String.format("(%s)", getUniqueIdFromCommand()));
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_statusValueNotClientSettable() throws Exception {
-    setEppInput("contact_update_prohibited_status.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown = assertThrows(StatusNotClientSettableException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_superuserStatusValueNotClientSettable() throws Exception {
-    setEppInput("contact_update_prohibited_status.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("generic_success_response.xml"));
-  }
-
-  @Test
-  void testFailure_unauthorizedClient() throws Exception {
-    sessionMetadata.setRegistrarId("NewRegistrar");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown = assertThrows(ResourceNotOwnedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_superuserUnauthorizedClient() throws Exception {
-    sessionMetadata.setRegistrarId("NewRegistrar");
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("generic_success_response.xml"));
-  }
-
-  @Test
-  void testSuccess_clientUpdateProhibited_removed() throws Exception {
-    setEppInput("contact_update_remove_client_update_prohibited.xml");
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(StatusValue.CLIENT_UPDATE_PROHIBITED))
-            .build());
-    doSuccessfulTest();
-    assertAboutContacts()
-        .that(reloadResourceByForeignKey())
-        .doesNotHaveStatusValue(StatusValue.CLIENT_UPDATE_PROHIBITED);
-  }
-
-  @Test
-  void testSuccess_superuserClientUpdateProhibited_notRemoved() throws Exception {
-    setEppInput("contact_update_prohibited_status.xml");
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(StatusValue.CLIENT_UPDATE_PROHIBITED))
-            .build());
-    clock.advanceOneMilli();
-    runFlowAssertResponse(
-        CommitMode.LIVE, UserPrivileges.SUPERUSER, loadFile("generic_success_response.xml"));
-    assertAboutContacts()
-        .that(reloadResourceByForeignKey())
-        .hasStatusValue(StatusValue.CLIENT_UPDATE_PROHIBITED)
-        .and()
-        .hasStatusValue(StatusValue.SERVER_DELETE_PROHIBITED);
-  }
-
-  @Test
-  void testFailure_clientUpdateProhibited_notRemoved() throws Exception {
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(StatusValue.CLIENT_UPDATE_PROHIBITED))
-            .build());
-    EppException thrown =
-        assertThrows(ResourceHasClientUpdateProhibitedException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_serverUpdateProhibited() throws Exception {
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(StatusValue.SERVER_UPDATE_PROHIBITED))
-            .build());
-    ResourceStatusProhibitsOperationException thrown =
-        assertThrows(ResourceStatusProhibitsOperationException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains("serverUpdateProhibited");
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_pendingDeleteProhibited() throws Exception {
-    persistResource(
-        newContact(getUniqueIdFromCommand())
-            .asBuilder()
-            .setStatusValues(ImmutableSet.of(StatusValue.PENDING_DELETE))
-            .build());
-    ResourceStatusProhibitsOperationException thrown =
-        assertThrows(ResourceStatusProhibitsOperationException.class, this::runFlow);
-    assertThat(thrown).hasMessageThat().contains("pendingDelete");
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testSuccess_nonAsciiInLocAddress() throws Exception {
-    setEppInput("contact_update_hebrew_loc.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    doSuccessfulTest();
-  }
-
-  @Test
-  void testFailure_nonAsciiInIntAddress() throws Exception {
-    setEppInput("contact_update_hebrew_int.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown =
-        assertThrows(BadInternationalizedPostalInfoException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_declineDisclosure() throws Exception {
-    setEppInput("contact_update_decline_disclosure.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown =
-        assertThrows(DeclineContactDisclosureFieldDisallowedPolicyException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testFailure_addRemoveSameValue() throws Exception {
-    setEppInput("contact_update_add_remove_same.xml");
-    persistActiveContact(getUniqueIdFromCommand());
-    EppException thrown = assertThrows(AddRemoveSameValueException.class, this::runFlow);
-    assertAboutEppExceptions().that(thrown).marshalsToXml();
-  }
-
-  @Test
-  void testIcannActivityReportField_getsLogged() throws Exception {
-    persistActiveContact(getUniqueIdFromCommand());
-    clock.advanceOneMilli();
-    runFlow();
-    assertIcannReportingActivityFieldLogged("srs-cont-update");
+  void testThrowsException() {
+    assertAboutEppExceptions()
+        .that(assertThrows(ContactsProhibitedException.class, this::runFlow))
+        .marshalsToXml();
  }
 }
@@ -20,7 +20,9 @@ import static google.registry.testing.DatabaseHelper.persistDeletedHost;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
 import static org.junit.jupiter.api.Assertions.assertThrows;

+import com.google.common.collect.ImmutableMap;
 import google.registry.flows.EppException;
+import google.registry.flows.EppException.ParameterValueSyntaxErrorException;
 import google.registry.flows.FlowUtils.NotLoggedInException;
 import google.registry.flows.ResourceCheckFlowTestCase;
 import google.registry.flows.exceptions.TooManyResourceChecksException;
@@ -95,4 +97,36 @@ class HostCheckFlowTest extends ResourceCheckFlowTestCase<HostCheckFlow, Host> {
    runFlow();
    assertIcannReportingActivityFieldLogged("srs-host-check");
  }
+
+  @Test
+  void testFailure_dotHost() throws Exception {
+    setEppInput("host_check_generic.xml", ImmutableMap.of("HOSTNAME", ".host"));
+    assertAboutEppExceptions()
+        .that(assertThrows(ParameterValueSyntaxErrorException.class, this::runFlow))
+        .marshalsToXml();
+  }
+
+  @Test
+  void testFailure_dashHost() {
+    setEppInput("host_check_generic.xml", ImmutableMap.of("HOSTNAME", "-host"));
+    assertAboutEppExceptions()
+        .that(assertThrows(ParameterValueSyntaxErrorException.class, this::runFlow))
+        .marshalsToXml();
+  }
+
+  @Test
+  void testFailure_underscoreHost() {
+    setEppInput("host_check_generic.xml", ImmutableMap.of("HOSTNAME", "_host"));
+    assertAboutEppExceptions()
+        .that(assertThrows(ParameterValueSyntaxErrorException.class, this::runFlow))
+        .marshalsToXml();
+  }
+
+  @Test
+  void testFailure_hostDash() {
+    setEppInput("host_check_generic.xml", ImmutableMap.of("HOSTNAME", "host-"));
+    assertAboutEppExceptions()
+        .that(assertThrows(ParameterValueSyntaxErrorException.class, this::runFlow))
+        .marshalsToXml();
+  }
 }
@@ -39,12 +39,12 @@ import google.registry.flows.exceptions.ResourceAlreadyExistsForThisClientExcept
 import google.registry.flows.exceptions.ResourceCreateContentionException;
 import google.registry.flows.host.HostCreateFlow.SubordinateHostMustHaveIpException;
 import google.registry.flows.host.HostCreateFlow.UnexpectedExternalHostIpException;
+import google.registry.flows.host.HostFlowUtils.BadHostNameCharacterException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotLowerCaseException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotNormalizedException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotPunyCodedException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooLongException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooShallowException;
-import google.registry.flows.host.HostFlowUtils.InvalidHostNameException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainDoesNotExistException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainInPendingDeleteException;
 import google.registry.model.ForeignKeyUtils;
@@ -286,7 +286,7 @@ class HostCreateFlowTest extends ResourceFlowTestCase<HostCreateFlow, Host> {

  @Test
  void testFailure_badCharacter() {
-    doFailingHostNameTest("foo bar", InvalidHostNameException.class);
+    doFailingHostNameTest("foo bar", BadHostNameCharacterException.class);
  }

  @Test
@@ -54,13 +54,13 @@ import google.registry.flows.ResourceFlowUtils.ResourceNotOwnedException;
 import google.registry.flows.ResourceFlowUtils.StatusNotClientSettableException;
 import google.registry.flows.exceptions.ResourceHasClientUpdateProhibitedException;
 import google.registry.flows.exceptions.ResourceStatusProhibitsOperationException;
+import google.registry.flows.host.HostFlowUtils.BadHostNameCharacterException;
 import google.registry.flows.host.HostFlowUtils.HostDomainNotOwnedException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotLowerCaseException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotNormalizedException;
 import google.registry.flows.host.HostFlowUtils.HostNameNotPunyCodedException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooLongException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooShallowException;
-import google.registry.flows.host.HostFlowUtils.InvalidHostNameException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainDoesNotExistException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainInPendingDeleteException;
 import google.registry.flows.host.HostUpdateFlow.CannotAddIpToExternalHostException;
@@ -1259,7 +1259,7 @@ class HostUpdateFlowTest extends ResourceFlowTestCase<HostUpdateFlow, Host> {

  @Test
  void testFailure_renameToBadCharacter() throws Exception {
-    doFailingHostNameTest("foo bar", InvalidHostNameException.class);
+    doFailingHostNameTest("foo bar", BadHostNameCharacterException.class);
  }

  @Test
@@ -751,7 +751,9 @@ public final class TldTest extends EntityTestCase {
        assertThrows(
            IllegalArgumentException.class,
            () -> Tld.get("tld").asBuilder().setRoidSuffix("123456789"));
-    assertThat(e).hasMessageThat().isEqualTo("ROID suffix must be in format ^[A-Z\\d_]{1,8}$");
+    assertThat(e)
+        .hasMessageThat()
+        .isEqualTo("ROID suffix 123456789 must be in format ^[A-Z\\d]{1,8}$");
  }

  @Test
@@ -766,6 +768,12 @@ public final class TldTest extends EntityTestCase {
        IllegalArgumentException.class, () -> Tld.get("tld").asBuilder().setRoidSuffix("ABC-DEF"));
  }

+  @Test
+  void testFailure_roidSuffixContainsUnderscores() {
+    assertThrows(
+        IllegalArgumentException.class, () -> Tld.get("tld").asBuilder().setRoidSuffix("ABC_DEF"));
+  }
+
  @Test
  void testSuccess_setDefaultPromoTokens() {
    Tld registry = Tld.get("tld");
@@ -246,7 +246,7 @@ class RdapDomainActionTest extends RdapActionBaseTestCase<RdapDomainAction> {
        .isEqualTo(
            addDomainBoilerplateNotices(
                jsonFileBuilder()
-                    .addDomain("cat.1.tld", "D-1_TLD")
+                    .addDomain("cat.1.tld", "D-1TLD")
                    .addNameserver("ns1.cat.lol", "2-ROID")
                    .addNameserver("ns2.cat.lol", "4-ROID")
                    .addRegistrar("Multilevel Registrar")
@@ -732,7 +732,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        RequestType.NAME,
        "cat.1.test",
        jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1_TEST")
+            .addDomain("cat.1.test", "1B-1TEST")
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "17-ROID")
            .addNameserver("ns2.cat.2.test", "19-ROID")
@@ -746,7 +746,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        RequestType.NAME,
        "ca*.1.test",
        jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1_TEST")
+            .addDomain("cat.1.test", "1B-1TEST")
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "17-ROID")
            .addNameserver("ns2.cat.2.test", "19-ROID")
@@ -822,7 +822,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        .that(generateActualJson(RequestType.NAME, "cat.*"))
        .isEqualTo(
            jsonFileBuilder()
-                .addDomain("cat.1.test", "1B-1_TEST")
+                .addDomain("cat.1.test", "1B-1TEST")
                .addDomain("cat.example", "F-EXAMPLE")
                .addDomain("cat.lol", "6-LOL")
                .addDomain("cat.みんな", "15-Q9JYB4C")
@@ -860,7 +860,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        .that(generateActualJson(RequestType.NAME, "cat*"))
        .isEqualTo(
            jsonFileBuilder()
-                .addDomain("cat.1.test", "1B-1_TEST")
+                .addDomain("cat.1.test", "1B-1TEST")
                .addDomain("cat.example", "F-EXAMPLE")
                .addDomain("cat.lol", "6-LOL")
                .addDomain("cat.みんな", "15-Q9JYB4C")
@@ -1284,7 +1284,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        RequestType.NS_LDH_NAME,
        "ns1.cat.1.test",
        jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1_TEST")
+            .addDomain("cat.1.test", "1B-1TEST")
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "17-ROID")
            .addNameserver("ns2.cat.2.test", "19-ROID")
@@ -1298,7 +1298,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
        RequestType.NS_LDH_NAME,
        "ns*.cat.1.test",
        jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1_TEST")
+            .addDomain("cat.1.test", "1B-1TEST")
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "17-ROID")
            .addNameserver("ns2.cat.2.test", "19-ROID")
@@ -74,7 +74,9 @@ class RdapNameserverActionTest extends RdapActionBaseTestCase<RdapNameserverActi
        .that(generateActualJson("invalid/host/name"))
        .isEqualTo(
            generateExpectedJsonError(
-                "invalid/host/name is not a valid nameserver: Invalid host name", 400));
+                "invalid/host/name is not a valid nameserver: Host names can only contain a-z, 0-9,"
+                    + " '.', '_', and '-'",
+                400));
    assertThat(response.getStatus()).isEqualTo(400);
  }

@@ -420,8 +420,7 @@ public final class DatabaseHelper {
  public static Tld createTld(String tld, ImmutableSortedMap<DateTime, TldState> tldStates) {
    // Coerce the TLD string into a valid ROID suffix.
    String roidSuffix =
-        Ascii.toUpperCase(tld.replaceFirst(ACE_PREFIX_REGEX, "").replace('.', '_'))
-            .replace('-', '_');
+        Ascii.toUpperCase(tld.replaceFirst(ACE_PREFIX_REGEX, "").replace(".", "")).replace("-", "");
    return createTld(
        tld, roidSuffix.length() > 8 ? roidSuffix.substring(0, 8) : roidSuffix, tldStates);
  }
@@ -0,0 +1,161 @@
+// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tmch;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.RegistryEnvironment.PRODUCTION;
+import static google.registry.util.RegistryEnvironment.SANDBOX;
+import static org.joda.time.DateTime.now;
+import static org.joda.time.DateTimeZone.UTC;
+
+import com.google.common.base.Splitter;
+import google.registry.model.smd.SignedMarkRevocationList;
+import google.registry.model.smd.SignedMarkRevocationListDao;
+import google.registry.model.tmch.ClaimsListDao;
+import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.testing.FakeClock;
+import google.registry.util.RegistryEnvironment;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+public class RstTmchUtilsIntTest {
+  private final FakeClock clock = new FakeClock();
+
+  @RegisterExtension
+  final JpaTestExtensions.JpaIntegrationTestExtension jpa =
+      new JpaTestExtensions.Builder().withClock(clock).buildIntegrationTestExtension();
+
+  private static final String TMCH_CLAIM_LABEL = "tmch";
+  // RST label found in *.rst.dnl.csv resources. Currently both files are identical
+  private static final String RST_CLAIM_LABEL = "test--validate";
+
+  private static final String TMCH_SMD_ID = "tmch";
+  // RST label found in *.rst.smdrl.csv resources. Currently both files are identical
+  private static final String RST_SMD_ID = "0000001761385117375880-65535";
+
+  private static final String TMCH_DNL =
+      """
+      1,2024-09-13T02:21:12.0Z
+      DNL,lookup-key,insertion-datetime
+      LABEL,2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001,2024-09-13T02:21:12.0Z
+      """
+          .replace("LABEL", TMCH_CLAIM_LABEL);
+
+  private static final String TMCH_SMDRL =
+      """
+      1,2022-11-22T01:49:36.9Z
+      smd-id,insertion-datetime
+      ID,2013-07-15T00:00:00.0Z
+      """
+          .replace("ID", TMCH_SMD_ID);
+
+  @BeforeEach
+  void setup() throws Exception {
+    Splitter lineSplitter = Splitter.on("\n").omitEmptyStrings().trimResults();
+    tm().transact(
+            () -> ClaimsListDao.save(ClaimsListParser.parse(lineSplitter.splitToList(TMCH_DNL))));
+    tm().transact(
+            () ->
+                SignedMarkRevocationListDao.save(
+                    SmdrlCsvParser.parse(lineSplitter.splitToList(TMCH_SMDRL))));
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getClaimsList_production(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      PRODUCTION.setup();
+      var claimsList = ClaimsListDao.get(tld);
+      assertThat(claimsList.getClaimKey(TMCH_CLAIM_LABEL)).isPresent();
+      assertThat(claimsList.getClaimKey(RST_CLAIM_LABEL)).isEmpty();
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getSmdrList_production(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      PRODUCTION.setup();
+      var smdrl = SignedMarkRevocationList.get(tld);
+      assertThat(smdrl.isSmdRevoked(TMCH_SMD_ID, now(UTC))).isTrue();
+      assertThat(smdrl.isSmdRevoked(RST_SMD_ID, now(UTC))).isFalse();
+      assertThat(smdrl.size()).isEqualTo(1);
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getClaimsList_sandbox(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      SANDBOX.setup();
+      var claimsList = ClaimsListDao.get(tld);
+      if (tld.equals("app")) {
+        assertThat(claimsList.getClaimKey(TMCH_CLAIM_LABEL)).isPresent();
+        assertThat(claimsList.getClaimKey(RST_CLAIM_LABEL)).isEmpty();
+      } else {
+        assertThat(claimsList.getClaimKey(TMCH_CLAIM_LABEL)).isEmpty();
+        // Currently ote and prod have the same data.
+        assertThat(claimsList.getClaimKey(RST_CLAIM_LABEL)).isPresent();
+      }
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getSmdrList_sandbox(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      SANDBOX.setup();
+      var smdrList = SignedMarkRevocationList.get(tld);
+      if (tld.equals("app")) {
+        assertThat(smdrList.size()).isEqualTo(1);
+        assertThat(smdrList.isSmdRevoked(TMCH_SMD_ID, now(UTC))).isTrue();
+        assertThat(smdrList.isSmdRevoked(RST_SMD_ID, now(UTC))).isFalse();
+      } else {
+        // Currently ote and prod have the same data.
+        assertThat(smdrList.size()).isEqualTo(5);
+        assertThat(smdrList.isSmdRevoked(TMCH_SMD_ID, now())).isFalse();
+        assertThat(smdrList.isSmdRevoked(RST_SMD_ID, now())).isTrue();
+      }
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  private static Stream<Arguments> provideTestCases() {
+    return Stream.of(
+        Arguments.of("NotRST", "app"),
+        Arguments.of("OTE", "cc-rst-test-tld-1"),
+        Arguments.of("PROD", "zz--idn-123"));
+  }
+}
@@ -0,0 +1,117 @@
+// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tmch;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.tmch.RstTmchUtils.getClaimsList;
+import static google.registry.tmch.RstTmchUtils.getSmdrList;
+import static google.registry.util.RegistryEnvironment.PRODUCTION;
+import static google.registry.util.RegistryEnvironment.SANDBOX;
+
+import google.registry.util.RegistryEnvironment;
+import java.util.stream.Stream;
+import org.joda.time.DateTime;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+public class RstTmchUtilsTest {
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getClaimsList_production(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      PRODUCTION.setup();
+      assertThat(getClaimsList(tld)).isEmpty();
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getSmdrList_production(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      PRODUCTION.setup();
+      assertThat(getSmdrList(tld)).isEmpty();
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getClaimsList_sandbox(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      SANDBOX.setup();
+      var claimsListOptional = getClaimsList(tld);
+      if (tld.equals("app")) {
+        assertThat(claimsListOptional).isEmpty();
+      } else {
+        // Currently ote and prod have the same data.
+        var claimsList = claimsListOptional.get();
+        assertThat(claimsList.getClaimKey("test-and-validate")).isPresent();
+        var labelsToKeys = claimsList.getLabelsToKeys();
+        assertThat(labelsToKeys).hasSize(8);
+        assertThat(labelsToKeys)
+            .containsEntry(
+                "test---validate", "2024091300/6/a/b/arJyPPf2CK7f21bVGne0qMgW0000000001");
+      }
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  @ParameterizedTest
+  @MethodSource("provideTestCases")
+  @SuppressWarnings("unused") // testCaseName
+  void getSmdrList_sandbox(String testCaseName, String tld) {
+    var currEnv = RegistryEnvironment.get();
+    try {
+      SANDBOX.setup();
+      var smdrListOptional = getSmdrList(tld);
+      if (tld.equals("app")) {
+        assertThat(smdrListOptional).isEmpty();
+      } else {
+        // Currently ote and prod have the same data.
+        var smdrList = smdrListOptional.get();
+        assertThat(smdrList.size()).isEqualTo(5);
+        assertThat(
+                smdrList.isSmdRevoked(
+                    "000000541526299609231-65535", DateTime.parse("2018-05-14T17:52:23.6Z")))
+            .isFalse();
+        assertThat(
+                smdrList.isSmdRevoked(
+                    "000000541526299609231-65535", DateTime.parse("2018-05-14T17:52:23.7Z")))
+            .isTrue();
+      }
+    } finally {
+      currEnv.setup();
+    }
+  }
+
+  private static Stream<Arguments> provideTestCases() {
+    return Stream.of(
+        Arguments.of("NotRST", "app"),
+        Arguments.of("OTE", "cc-rst-test-tld-1"),
+        Arguments.of("PROD", "zz--idn-123"));
+  }
+}
@@ -57,7 +57,7 @@ class TmchTestDataExpirationTest {
    String tmchData = loadFile(TmchTestDataExpirationTest.class, filePath);
    EncodedSignedMark smd = TmchData.readEncodedSignedMark(tmchData);
    try {
-      tmchUtils.verifyEncodedSignedMark(smd, DateTime.now(UTC));
+      tmchUtils.verifyEncodedSignedMark("", smd, DateTime.now(UTC));
    } catch (EppException e) {
      throw new AssertionError("Error verifying signed mark " + filePath, e);
    }
@@ -368,7 +368,7 @@ public class ConfigureTldCommandTest extends CommandTestCase<ConfigureTldCommand
                    "TLDSTR", name, "TLDUNICODE", name, "ROIDSUFFIX", "TLLLLLLLLLLLLLLLLLLLLLLD")));
    IllegalArgumentException thrown =
        assertThrows(IllegalArgumentException.class, () -> runCommandForced("--input=" + tldFile));
-    assertThat(thrown.getMessage()).isEqualTo("ROID suffix must be in format ^[A-Z\\d_]{1,8}$");
+    assertThat(thrown.getMessage()).isEqualTo("ROID suffix must be in format ^[A-Z\\d]{1,8}$");
  }

  @Test
@@ -124,6 +124,24 @@ class UpdateRegistrarCommandTest extends CommandTestCase<UpdateRegistrarCommand>
        .containsExactly("xn--q9jyb4c", "foobar");
  }

+  @Test
+  void testSuccess_allowedTlds_tldNameWithHyphens() throws Exception {
+    persistRdapAbuseContact();
+    createTlds("zz--main-1611", "foobar");
+    persistResource(
+        loadRegistrar("NewRegistrar")
+            .asBuilder()
+            .setAllowedTlds(ImmutableSet.of("foobar"))
+            .build());
+    runCommandInEnvironment(
+        RegistryToolEnvironment.PRODUCTION,
+        "--allowed_tlds=zz--main-1611,foobar",
+        "--force",
+        "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").getAllowedTlds())
+        .containsExactly("zz--main-1611", "foobar");
+  }
+
  @Test
  void testSuccess_addAllowedTlds() throws Exception {
    persistRdapAbuseContact();
@@ -142,6 +160,19 @@ class UpdateRegistrarCommandTest extends CommandTestCase<UpdateRegistrarCommand>
        .containsExactly("xn--q9jyb4c", "foo", "bar");
  }

+  @Test
+  void testSuccess_addAllowedTlds_tldNameWithHyphens() throws Exception {
+    persistRdapAbuseContact();
+    createTlds("foo", "bar", "zz--main-1611");
+    runCommandInEnvironment(
+        RegistryToolEnvironment.PRODUCTION,
+        "--add_allowed_tlds=foo,bar",
+        "--force",
+        "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").getAllowedTlds())
+        .containsExactly("foo", "bar", "zz--main-1611");
+  }
+
  @Test
  void testSuccess_addAllowedTldsWithDupes() throws Exception {
    persistRdapAbuseContact();
@@ -26,6 +26,11 @@
    <rdeIDN:urlPolicy>https://www.registry.google/about/policies/domainabuse/</rdeIDN:urlPolicy>
 </rdeIDN:idnTableRef>

+<rdeIDN:idnTableRef id="augmented_latin">
+    <rdeIDN:url>https://www.iana.org/domains/idn-tables/tables/google_latn_3.0.txt</rdeIDN:url>
+    <rdeIDN:urlPolicy>https://www.registry.google/about/policies/domainabuse/</rdeIDN:urlPolicy>
+</rdeIDN:idnTableRef>
+
 <rdeIDN:idnTableRef id="ja">
    <rdeIDN:url>https://www.iana.org/domains/idn-tables/tables/google_ja_1.0.txt</rdeIDN:url>
    <rdeIDN:urlPolicy>https://www.registry.google/about/policies/domainabuse/</rdeIDN:urlPolicy>
@@ -37,7 +42,7 @@
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeHost-1.0">1</rdeHeader:count>
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1</rdeHeader:count>
-    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">3</rdeHeader:count>
+    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">4</rdeHeader:count>
 </rdeHeader:header>

 </rde:contents>
@@ -14,6 +14,6 @@
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeHost-1.0">1</rdeHeader:count>
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1</rdeHeader:count>
-        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">3</rdeHeader:count>
+        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">4</rdeHeader:count>
    </rdeHeader:header>
 </rdeReport:report>
@@ -1,33 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <command>
-    <create>
-      <contact:create
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>jd1234</contact:id>
-        <contact:postalInfo type="int">
-          <contact:name>John Doe</contact:name>
-          <contact:org>Example Inc.</contact:org>
-          <contact:addr>
-            <contact:street>123 Example Dr.</contact:street>
-            <contact:street>Suite 100</contact:street>
-            <contact:city>Dulles</contact:city>
-            <contact:sp>VA</contact:sp>
-            <contact:pc>20166-6503</contact:pc>
-            <contact:cc>US</contact:cc>
-          </contact:addr>
-        </contact:postalInfo>
-        <contact:voice x="1234">+1.7035555555</contact:voice>
-        <contact:fax>+1.7035555556</contact:fax>
-        <contact:email>jdoe@example.com</contact:email>
-        <contact:authInfo>
-          <contact:pw>2fooBAR</contact:pw>
-        </contact:authInfo>
-        <contact:disclose flag="1">
-          <contact:voice/>
-          <contact:email/>
-        </contact:disclose>
-      </contact:create>
-    </create>
-    <clTRID>ABC-12345</clTRID>
-  </command>
-</epp>
@@ -1,18 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <response>
-    <result code="1000">
-      <msg>Command completed successfully</msg>
-    </result>
-    <resData>
-      <contact:creData
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>jd1234</contact:id>
-        <contact:crDate>2000-06-01T00:01:00.0Z</contact:crDate>
-      </contact:creData>
-    </resData>
-    <trID>
-      <clTRID>ABC-12345</clTRID>
-      <svTRID>server-trid</svTRID>
-    </trID>
-  </response>
-</epp>
@@ -1,18 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <response>
-    <result code="1000">
-      <msg>Command completed successfully</msg>
-    </result>
-    <resData>
-      <contact:creData
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>sh8013</contact:id>
-        <contact:crDate>%CRDATE%</contact:crDate>
-      </contact:creData>
-    </resData>
-    <trID>
-      <clTRID>ABC-12345</clTRID>
-      <svTRID>server-trid</svTRID>
-    </trID>
-  </response>
-</epp>
@@ -1,33 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <command>
-    <create>
-      <contact:create
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>sh8013</contact:id>
-        <contact:postalInfo type="int">
-          <contact:name>John Doe</contact:name>
-          <contact:org>Example Inc.</contact:org>
-          <contact:addr>
-            <contact:street>123 Example Dr.</contact:street>
-            <contact:street>Suite 100</contact:street>
-            <contact:city>Dulles</contact:city>
-            <contact:sp>VA</contact:sp>
-            <contact:pc>20166-6503</contact:pc>
-            <contact:cc>US</contact:cc>
-          </contact:addr>
-        </contact:postalInfo>
-        <contact:voice x="1234">+1.7035555555</contact:voice>
-        <contact:fax>+1.7035555556</contact:fax>
-        <contact:email>jdoe@example.com</contact:email>
-        <contact:authInfo>
-          <contact:pw>2fooBAR</contact:pw>
-        </contact:authInfo>
-        <contact:disclose flag="1">
-          <contact:voice/>
-          <contact:email/>
-        </contact:disclose>
-      </contact:create>
-    </create>
-    <clTRID>ABC-12345</clTRID>
-  </command>
-</epp>
@@ -1,11 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <response>
-    <result code="1000">
-      <msg>Command completed successfully</msg>
-    </result>
-    <trID>
-      <clTRID>ABC-12345</clTRID>
-      <svTRID>server-trid</svTRID>
-    </trID>
-  </response>
-</epp>
@@ -1,11 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <command>
-    <delete>
-      <contact:delete
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>sh8013</contact:id>
-      </contact:delete>
-    </delete>
-    <clTRID>ABC-12345</clTRID>
-  </command>
-</epp>
@@ -1,14 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <command>
-    <transfer op="request">
-      <contact:transfer
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>sh8013</contact:id>
-        <contact:authInfo>
-          <contact:pw>2fooBAR</contact:pw>
-        </contact:authInfo>
-      </contact:transfer>
-    </transfer>
-    <clTRID>ABC-12345</clTRID>
-  </command>
-</epp>
@@ -1,22 +0,0 @@
-<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
-  <response>
-    <result code="1001">
-      <msg>Command completed successfully; action pending</msg>
-    </result>
-    <resData>
-      <contact:trnData
-       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
-        <contact:id>sh8013</contact:id>
-        <contact:trStatus>pending</contact:trStatus>
-        <contact:reID>TheRegistrar</contact:reID>
-        <contact:reDate>2000-06-08T22:00:00.0Z</contact:reDate>
-        <contact:acID>NewRegistrar</contact:acID>
-        <contact:acDate>2000-06-13T22:00:00.0Z</contact:acDate>
-      </contact:trnData>
-    </resData>
-    <trID>
-      <clTRID>ABC-12345</clTRID>
-      <svTRID>server-trid</svTRID>
-    </trID>
-  </response>
-</epp>
@@ -3,56 +3,56 @@
    <check>
      <host:check
       xmlns:host="urn:ietf:params:xml:ns:host-1.0">
-        <host:name>www1.tld</host:name>
-        <host:name>www2.tld</host:name>
-        <host:name>www3.tld</host:name>
-        <host:name>www4.tld</host:name>
-        <host:name>www5.tld</host:name>
-        <host:name>www6.tld</host:name>
-        <host:name>www7.tld</host:name>
-        <host:name>www8.tld</host:name>
-        <host:name>www9.tld</host:name>
-        <host:name>www10.tld</host:name>
-        <host:name>www11.tld</host:name>
-        <host:name>www12.tld</host:name>
-        <host:name>www13.tld</host:name>
-        <host:name>www14.tld</host:name>
-        <host:name>www15.tld</host:name>
-        <host:name>www16.tld</host:name>
-        <host:name>www17.tld</host:name>
-        <host:name>www18.tld</host:name>
-        <host:name>www19.tld</host:name>
-        <host:name>www20.tld</host:name>
-        <host:name>www21.tld</host:name>
-        <host:name>www22.tld</host:name>
-        <host:name>www23.tld</host:name>
-        <host:name>www24.tld</host:name>
-        <host:name>www25.tld</host:name>
-        <host:name>www26.tld</host:name>
-        <host:name>www27.tld</host:name>
-        <host:name>www28.tld</host:name>
-        <host:name>www29.tld</host:name>
-        <host:name>www30.tld</host:name>
-        <host:name>www31.tld</host:name>
-        <host:name>www32.tld</host:name>
-        <host:name>www33.tld</host:name>
-        <host:name>www34.tld</host:name>
-        <host:name>www35.tld</host:name>
-        <host:name>www36.tld</host:name>
-        <host:name>www37.tld</host:name>
-        <host:name>www38.tld</host:name>
-        <host:name>www39.tld</host:name>
-        <host:name>www40.tld</host:name>
-        <host:name>www41.tld</host:name>
-        <host:name>www42.tld</host:name>
-        <host:name>www43.tld</host:name>
-        <host:name>www44.tld</host:name>
-        <host:name>www45.tld</host:name>
-        <host:name>www46.tld</host:name>
-        <host:name>www47.tld</host:name>
-        <host:name>www48.tld</host:name>
-        <host:name>www49.tld</host:name>
-        <host:name>www50.tld</host:name>
+        <host:name>ns1.www1.tld</host:name>
+        <host:name>ns1.www2.tld</host:name>
+        <host:name>ns1.www3.tld</host:name>
+        <host:name>ns1.www4.tld</host:name>
+        <host:name>ns1.www5.tld</host:name>
+        <host:name>ns1.www6.tld</host:name>
+        <host:name>ns1.www7.tld</host:name>
+        <host:name>ns1.www8.tld</host:name>
+        <host:name>ns1.www9.tld</host:name>
+        <host:name>ns1.www10.tld</host:name>
+        <host:name>ns1.www11.tld</host:name>
+        <host:name>ns1.www12.tld</host:name>
+        <host:name>ns1.www13.tld</host:name>
+        <host:name>ns1.www14.tld</host:name>
+        <host:name>ns1.www15.tld</host:name>
+        <host:name>ns1.www16.tld</host:name>
+        <host:name>ns1.www17.tld</host:name>
+        <host:name>ns1.www18.tld</host:name>
+        <host:name>ns1.www19.tld</host:name>
+        <host:name>ns1.www20.tld</host:name>
+        <host:name>ns1.www21.tld</host:name>
+        <host:name>ns1.www22.tld</host:name>
+        <host:name>ns1.www23.tld</host:name>
+        <host:name>ns1.www24.tld</host:name>
+        <host:name>ns1.www25.tld</host:name>
+        <host:name>ns1.www26.tld</host:name>
+        <host:name>ns1.www27.tld</host:name>
+        <host:name>ns1.www28.tld</host:name>
+        <host:name>ns1.www29.tld</host:name>
+        <host:name>ns1.www30.tld</host:name>
+        <host:name>ns1.www31.tld</host:name>
+        <host:name>ns1.www32.tld</host:name>
+        <host:name>ns1.www33.tld</host:name>
+        <host:name>ns1.www34.tld</host:name>
+        <host:name>ns1.www35.tld</host:name>
+        <host:name>ns1.www36.tld</host:name>
+        <host:name>ns1.www37.tld</host:name>
+        <host:name>ns1.www38.tld</host:name>
+        <host:name>ns1.www39.tld</host:name>
+        <host:name>ns1.www40.tld</host:name>
+        <host:name>ns1.www41.tld</host:name>
+        <host:name>ns1.www42.tld</host:name>
+        <host:name>ns1.www43.tld</host:name>
+        <host:name>ns1.www44.tld</host:name>
+        <host:name>ns1.www45.tld</host:name>
+        <host:name>ns1.www46.tld</host:name>
+        <host:name>ns1.www47.tld</host:name>
+        <host:name>ns1.www48.tld</host:name>
+        <host:name>ns1.www49.tld</host:name>
+        <host:name>ns1.www50.tld</host:name>
      </host:check>
    </check>
    <clTRID>ABC-12345</clTRID>
@@ -0,0 +1,11 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+    <command>
+        <check>
+            <host:check
+                    xmlns:host="urn:ietf:params:xml:ns:host-1.0">
+                <host:name>%HOSTNAME%</host:name>
+            </host:check>
+        </check>
+        <clTRID>ABC-12345</clTRID>
+    </command>
+</epp>
@@ -20,7 +20,7 @@
        </resData>
        <trID>
            <clTRID>ABC-12345</clTRID>
-            <svTRID>BYiJH5vHRRW6EuYXo/Kdsg==-23</svTRID>
+            <svTRID>server-trid</svTRID>
        </trID>
    </response>
 </epp>
@@ -261,7 +261,7 @@
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeHost-1.0">2</rdeHeader:count>
    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">2</rdeHeader:count>
-    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">3</rdeHeader:count>
+    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">4</rdeHeader:count>
 </rdeHeader:header>

 </rde:contents>
@@ -37,6 +37,6 @@
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeHost-1.0">2</rdeHeader:count>
        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">2</rdeHeader:count>
-        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">3</rdeHeader:count>
+        <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">4</rdeHeader:count>
    </rdeHeader:header>
 </rdeReport:report>
@@ -135,7 +135,7 @@
  <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeContact-1.0">0</rdeHeader:count>
  <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeHost-1.0">1</rdeHeader:count>
  <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">2</rdeHeader:count>
-  <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">3</rdeHeader:count>
+  <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeIDN-1.0">4</rdeHeader:count>
 </rdeHeader:header>

 </rde:contents>
@@ -126,22 +126,6 @@ artifacts {
  schema schemaJar
 }

-publishing {
-  repositories {
-    maven {
-      url project.publish_repo
-    }
-  }
-  publications {
-    sqlSchemaPublication(MavenPublication) {
-      groupId 'google.registry'
-      artifactId 'schema'
-      version project.schema_version
-      artifact schemaJar
-    }
-  }
-}
-
 // Adds flyway tasks such as: flywayInfo, flywayValidate, flywayMigrate (
 // deploying the schema in local repository), and flywayClean (dropping all data
 // in the database). The latter two commands are disallowed in environments
@@ -248,14 +232,10 @@ if (ext.isRestricted()) {
  }
 }

-if (project.baseSchemaTag != '') {
-  repositories {
-    maven {
-      url project.publish_repo
-    }
-  }
+if (project.schemaTestArtifactsDir != '') {
  dependencies {
-    integration "google.registry:schema:${project.baseSchemaTag}"
+    // For schemaIncrementalDeployTest, which only uses sandbox schema
+    integration files("${project.schemaTestArtifactsDir}/schema.sandbox.jar")
  }

  // Checks if Flyway scripts can be deployed to an existing database with
@@ -7,7 +7,7 @@
 # nom_build), run ./nom_build --help.
 #
 # DO NOT EDIT THIS FILE BY HAND
-org.gradle.jvmargs=-Xmx2048m
+org.gradle.jvmargs=-Xmx4096m
 org.gradle.caching=true
 org.gradle.parallel=true
 mavenUrl=
@@ -22,9 +22,8 @@ dbServer=
 dbName=postgres
 dbUser=
 dbPassword=
-publish_repo=
-baseSchemaTag=
-schema_version=
-nomulus_version=
 dot_path=/usr/bin/dot
 pipeline=
+nomulus_env=
+schema_env=
+schemaTestArtifactsDir=
@@ -1,50 +1,38 @@
 ## Summary

-This project runs cross-version server/schema integration tests with arbitrary
-version pairs. It may be used by presubmit tests and continuous-integration
-tests, or as a gating test during release and/or deployment.
+This subproject provides two integration tests that ensure schema safety:

-## Maven Dependencies
+*  One test checks for edits to Flyway scripts already deployed to Sandbox
+   Production. Such edits will cause schema deployment failure.
+*  Another test runs cross-version server/schema integration tests between a
+   pull request and the deployed release in Sandbox or Production. If a pull
+   request fails this test, it either contains schema changes not compatible
+   with Sandbox/Production binaries, or binaries not compatible with the
+   current schema in Sandbox/Production. This test may be include in presubmit
+   testing.

-This release process is expected to publish the following Maven dependencies to
-a well-known repository:
+## Test Artifacts

-*   google.registry:schema, which contains the schema DDL scripts. This is done
-    by the ':db:publish' task.
-*   google.registry:nomulus_test, which contains the nomulus classes and
-    dependencies needed for the integration tests. This is done by the
-    ':core:publish' task.
+To support the tests above, each release generates the following test artifacts:

-After each deployment in sandbox or production, the deployment process is
-expected to save the version tag of the binary or schema along with the
-environment. These tags will be made available to test runners.
+*  schema.jar: The flyway scripts.
+*  nomulus-public.jar:  The open-source java classes.
+*  nomulus-tests-alldeps.jar: Uber jar with schema test classes and all
+   third-party dependencies.
+
+After each deployment in sandbox or production, the deployment process copies
+these artifacts to a well-known location, and appends the environment tag to
+the file names.

 ## Usage

-The ':integration:sqlIntegrationTest' task is the test runner. It uses the
-following properties:
+Use the convenience scripts in the `integration` folder to run the tests. 

-*   nomulus_version: a Registry server release tag, or 'local' if the code in
-    the local Git tree should be used.
-*   schema_version: a schema release tag, or 'local' if the code in the local
-    Git tree should be used.
-*   publish_repo: the Maven repository where release jars may be found. This is
-    required if neither of the above is 'local'.
+```bash
+./integration/run_schema_check.sh -p domain-registry-dev

-Given a program 'fetch_version_tag' that retrieves the currently deployed
-version tag of SQL schema or server binary in a particular environment (which as
-mentioned earlier are saved by the deployment process), the following code
-snippet checks if the current PR or local clone has schema changes, and if yes,
-tests the production server's version with the new schema.
-
-```shell
-current_prod_schema=$(fetch_version_tag schema production)
-current_prod_server=$(fetch_version_tag server production)
-schema_changes=$(git diff ${current_prod_schema} --name-only \
-  ./db/src/main/resources/sql/flyway/ | wc -l)
-[[ schema_changes -gt  0 ]] && ./gradlew :integration:sqlIntegrationTest \
-  -Ppublish_repo=${REPO} -Pschema_version=local \
-  -Pnomulus_version=current_prod_server
+./integration/run_compatibility_tests.sh -p domain-registry-dev -s sql
+./integration/run_compatibility_tests.sh -p domain-registry-dev -s nomulus
 ```

 ## Implementation Notes
@@ -18,22 +18,16 @@
 import static com.google.common.base.Preconditions.checkArgument
 import static com.google.common.base.Strings.isNullOrEmpty

-if (schema_version == '' || nomulus_version == '') {
+if (schema_env == '' || nomulus_env == '') {
  return
 }

 def USE_LOCAL = 'local'

-if (schema_version != USE_LOCAL || nomulus_version != USE_LOCAL) {
+if (schema_env != USE_LOCAL || nomulus_env != USE_LOCAL) {
  checkArgument(
-      !isNullOrEmpty(publish_repo),
-      'The publish_repo is required when remote jars are needed.')
-
-  repositories {
-    maven {
-      url project.publish_repo
-    }
-  }
+      !isNullOrEmpty(schemaTestArtifactsDir),
+      'The schemaTestArtifactsDir is required when deployed jars are needed.')
 }

 def testUberJarName = ''
@@ -41,25 +35,25 @@ def testUberJarName = ''
 // Might need to add this back if we re-add nebula-lint
 // gradleLint.ignore('unused-dependency') {
 dependencies {
-  if (schema_version == USE_LOCAL) {
+  if (schema_env == USE_LOCAL) {
    testRuntimeOnly project(path: ':db', configuration: 'schema')
  } else {
-    testRuntimeOnly "google.registry:schema:${schema_version}"
+    testRuntimeOnly files("${project.schemaTestArtifactsDir}/schema.${schema_env}.jar")
  }
-  if (nomulus_version == USE_LOCAL) {
+  if (nomulus_env == USE_LOCAL) {
    testRuntimeOnly project(path: ':core', configuration: 'nomulus_test')
    testUberJarName = 'nomulus-tests-alldeps.jar'
  } else {
-    testRuntimeOnly "google.registry:nomulus_test:${nomulus_version}:public"
-    testRuntimeOnly "google.registry:nomulus_test:${nomulus_version}:alldeps"
-    testUberJarName = "nomulus_test-${nomulus_version}-alldeps.jar"
+    testRuntimeOnly files("${project.schemaTestArtifactsDir}/nomulus-public.${nomulus_env}.jar")
+    testRuntimeOnly files("${project.schemaTestArtifactsDir}/nomulus-tests-alldeps.${nomulus_env}.jar")
+    testUberJarName = "nomulus-tests-alldeps.${nomulus_env}.jar"
  }
 }
 // }

 configurations.testRuntimeOnly.transitive = false

-def unpackedTestDir = "${projectDir}/build/unpackedTests/${nomulus_version}"
+def unpackedTestDir = "${projectDir}/build/unpackedTests/${nomulus_env}"

 // Extracts SqlIntegrationTestSuite.class to a temp folder. Gradle's test
 // runner only looks for runnable tests on a regular file system. However,
@@ -78,7 +72,7 @@ task extractSqlIntegrationTestSuite (type: Copy) {
  into unpackedTestDir
  includeEmptyDirs = false

-  if (nomulus_version == USE_LOCAL) {
+  if (nomulus_env == USE_LOCAL) {
    dependsOn ':core:testUberJar'
  }
 }
@@ -56,37 +56,50 @@ function runTest() {
  local deployed_system=${1}
  local version=${2}
  local dev_project=${3}
+  local env=${4}

-  local changes=$(getChangeCountSinceVersion ${deployed_system} ${version})
-  if [[ ${changes} = 0 ]]; then
-    echo "No relevant changes in ${deployed_system} since ${version}"
-    return 0
+#  local changes=$(getChangeCountSinceVersion ${deployed_system} ${version})
+#  if [[ ${changes} = 0 ]]; then
+#    echo "No relevant changes in ${deployed_system} since ${version}"
+#    return 0
+#  fi
+#
+#  echo "Found relevant changes in ${deployed_system} since ${version}"
+
+  if [[ -n "${SCHEMA_TEST_ARTIFACTS_DIR}" ]]; then
+    echo "Using schema test jars downloaded to ${SCHEMA_TEST_ARTIFACTS_DIR}"
+  else
+    SCHEMA_TEST_ARTIFACTS_DIR=$(mktemp -d)
+    echo "Created working dir ${SCHEMA_TEST_ARTIFACTS_DIR} for downloaded test jars."
+    trap 'rm -rf ${SCHEMA_TEST_ARTIFACTS_DIR}' EXIT
+    gcloud storage cp --verbosity=none \
+        "gs://${DEV_PROJECT}-deployed-tags/schema-test-artifacts/*.jar" \
+        "${SCHEMA_TEST_ARTIFACTS_DIR}"
  fi

-  echo "Found relevant changes in ${deployed_system} since ${version}"
-
-  local nomulus_version
-  local schema_version
+  local nomulus_env
+  local schema_env

  if [[ ${deployed_system} = "sql" ]]; then
-    schema_version=${version}
-    nomulus_version="local"
+    schema_env=${env}
+    nomulus_env="local"
  else
-    nomulus_version=${version}
-    schema_version="local"
+    nomulus_env=${env}
+    schema_env="local"
  fi

-  echo "Running test with -Pnomulus_version=${nomulus_version}" \
-      "-Pschema_version=${schema_version}"
+  echo "Running test with -Pnomulus_env=${nomulus_env}" \
+      "-Pschema_env=${schema_env}" \
+      "-PschemaTestArtifactsDir=${SCHEMA_TEST_ARTIFACTS_DIR}" \

  # The https scheme in the Maven repo URL below is required for Kokoro. See
  # ./run_schema_check.sh for more information.
  (cd ${SCRIPT_DIR}/..; \
      ./gradlew :integration:sqlIntegrationTest \
          -PdevProject=${dev_project} \
-          -Pnomulus_version=${nomulus_version} \
-          -Pschema_version=${schema_version} \
-          -Ppublish_repo=https://storage.googleapis.com/${dev_project}-deployed-tags/maven)
+          -Pnomulus_env=${nomulus_env} \
+          -Pschema_env=${schema_env} \
+          -PschemaTestArtifactsDir=${SCHEMA_TEST_ARTIFACTS_DIR})
 }

 set -e
@@ -128,19 +141,16 @@ if [[ -z "${ENV}" ]]; then
  SANDBOX_VERSION=$(fetchVersion ${DEPLOYED_SYSTEM} sandbox ${DEV_PROJECT})
  PROD_VERSION=$(fetchVersion ${DEPLOYED_SYSTEM} production ${DEV_PROJECT})
  if [[ ${SANDBOX_VERSION} = ${PROD_VERSION} ]]; then
-    VERSIONS=(${PROD_VERSION})
    echo "- sandbox and production at ${PROD_VERSION}"
+    runTest ${DEPLOYED_SYSTEM} ${SANDBOX_VERSION} ${DEV_PROJECT} sandbox
  else
-    VERSIONS=(${PROD_VERSION} ${SANDBOX_VERSION})
    echo "- sandbox at ${SANDBOX_VERSION}"
+    runTest ${DEPLOYED_SYSTEM} ${SANDBOX_VERSION} ${DEV_PROJECT} sandbox
    echo "- production at ${PROD_VERSION}"
+    runTest ${DEPLOYED_SYSTEM} ${PROD_VERSION} ${DEV_PROJECT} production
  fi
 else
  TARGET_VERSION=$(fetchVersion ${DEPLOYED_SYSTEM} ${ENV} ${DEV_PROJECT})
-  VERSIONS=(${TARGET_VERSION})
-    echo "- ${ENV} at ${TARGET_VERSION}"
+  echo "- ${ENV} at ${TARGET_VERSION}"
+  runTest ${DEPLOYED_SYSTEM} ${TARGET_VERSION} ${DEV_PROJECT} ${ENV}
 fi
-
-for v in "${VERSIONS[@]}"; do
-  runTest ${DEPLOYED_SYSTEM} ${v} ${DEV_PROJECT}
-done
@@ -67,13 +67,17 @@ fi
 sandbox_tag=$(fetchVersion sql sandbox ${DEV_PROJECT})
 echo "Checking Flyway scripts against schema in Sandbox (${sandbox_tag})."

-# The URL of the Maven repo on GCS for the publish_repo parameter must use the
-# https scheme (https://storage.googleapis.com/{BUCKET}/{PATH}) in order to work
-# with Kokoro. Gradle's alternative gcs scheme does not work on Kokoro: a GCP
-# credential with proper scopes for GCS access is required even for public
-# buckets, however, Kokoro VM instances are not set up with such credentials.
-# Incidentally, gcs can be used on Cloud Build.
+if [[ -n "${SCHEMA_TEST_ARTIFACTS_DIR}" ]]; then
+  echo "Using schema test jars downloaded to ${SCHEMA_TEST_ARTIFACTS_DIR}"
+else
+  SCHEMA_TEST_ARTIFACTS_DIR=$(mktemp -d)
+  echo "Created working dir ${SCHEMA_TEST_ARTIFACTS_DIR} for downloaded test jars."
+  trap 'rm -rf ${SCHEMA_TEST_ARTIFACTS_DIR}' EXIT
+  gcloud storage cp --verbosity=none \
+      "gs://${DEV_PROJECT}-deployed-tags/schema-test-artifacts/*.jar" \
+      "${SCHEMA_TEST_ARTIFACTS_DIR}"
+fi
+
 (cd ${SCRIPT_DIR}/..; \
    ./gradlew :db:schemaIncrementalDeployTest \
-        -PbaseSchemaTag=${sandbox_tag} \
-        -Ppublish_repo=https://storage.googleapis.com/${DEV_PROJECT}-deployed-tags/maven)
+        -PschemaTestArtifactsDir="${SCHEMA_TEST_ARTIFACTS_DIR}")
@@ -9,6 +9,9 @@
 # To trigger a build automatically, follow the instructions below and add a trigger:
 # https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
 steps:
+# Download saved Gradle distribution from GCS and install it.
+- name: 'gcr.io/${PROJECT_ID}/builder:live'
+  entrypoint: ./release/install_gradle.sh
 # Compile javadoc
 - name: 'gcr.io/${PROJECT_ID}/builder:live'
  entrypoint: /bin/bash
@@ -41,6 +41,7 @@ steps:
    export KYTHE_OUTPUT_DIRECTORY="$${PWD}/kythe_output"
    mkdir -p $${KYTHE_OUTPUT_DIRECTORY}
    mkdir -p $${KYTHE_OUTPUT_DIRECTORY}/merged
+    ./release/install_gradle.sh
    ./gradlew clean testClasses \
      -Dno_werror=true -PenableCrossReferencing=true
 # Merge kzip files
@@ -7,6 +7,9 @@ steps:
 # Create a directory to store the artifacts
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  args: ['mkdir', 'nomulus']
+# Download saved Gradle distribution from GCS and install it.
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  entrypoint: ./release/install_gradle.sh
 # Run tests
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  # Set home for Gradle caches. Must be consistent with last step below
@@ -14,6 +17,7 @@ steps:
  env: [ 'GRADLE_USER_HOME=/workspace/cloudbuild-caches' ]
  args: ['./gradlew',
         'test',
+         '--max-workers=8',
         '-PskipDockerIncompatibleTests=true',
         '-PmavenUrl=gcs://domain-registry-maven-repository/maven',
         '-PpluginsUrl=gcs://domain-registry-maven-repository/plugins'
@@ -154,8 +158,7 @@ steps:
      google/registry/beam/resave_all_epp_resources_pipeline_metadata.json \
      google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline \
      google/registry/beam/wipe_out_contact_history_pii_pipeline_metadata.json
-# Tentatively build and publish Cloud SQL schema jar here, before the schema release process is
-# finalized. Also publish nomulus:core jars that are needed for server/schema compatibility tests.
+# Build and upload the schema jar as well as other artifacts needed by the schema tests.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  entrypoint: /bin/bash
  # Set home for Gradle caches. Must be consistent with previous steps above
@@ -165,20 +168,8 @@ steps:
  - -c
  - |
    set -e
-    ./gradlew \
-      :db:publish \
-      -PmavenUrl=gcs://domain-registry-maven-repository/maven \
-      -PpluginsUrl=gcs://domain-registry-maven-repository/plugins \
-      -Ppublish_repo=gcs://${PROJECT_ID}-deployed-tags/maven \
-      -Pschema_version=${TAG_NAME}
-    ./gradlew \
-      :core:publish \
-      -PmavenUrl=gcs://domain-registry-maven-repository/maven \
-      -PpluginsUrl=gcs://domain-registry-maven-repository/plugins \
-      -Ppublish_repo=gcs://${PROJECT_ID}-deployed-tags/maven \
-      -Pnomulus_version=${TAG_NAME}
-    # Upload jars for use by schema deployment and schema compatibility test.
-    # The jars published to GCS will be unaccessible to Kokoro once public access is removed.
+    ./gradlew :db:schemaJar
+    ./gradlew :core:nomulusFossJar :core:testUberJar
    cp db/build/libs/schema.jar output/
    cp core/build/libs/nomulus-public.jar output/
    cp core/build/libs/nomulus-tests-alldeps.jar output/
@@ -7,6 +7,9 @@
 # To trigger a build automatically, follow the instructions below and add a trigger:
 # https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
 steps:
+# Download saved Gradle distribution from GCS and install it.
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  entrypoint: ./release/install_gradle.sh
 # Build the proxy docker image.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
  args:
@@ -265,7 +265,6 @@ steps:
      fi
    else
      gcloud storage cp $gradle_bin gs://${gcs_loc}/
-      gcloud storage objects update --predefined-acl=publicRead gs://${gcs_loc}/${gradle_bin}
    fi
    rm ${gradle_bin}
    sed -i s%services.gradle.org/distributions%storage.googleapis.com/${gcs_loc}% \
@@ -0,0 +1,32 @@
+#!/bin/bash
+# Copyright 2019 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# This script should be invoked from the Gradle root. It downloads the
+# gradle distribution saved on GCS, and sets Gradle's distribution URL
+# to the local copy. This is necessary since when accessing a GCS bucket
+# using http, the bucket must have public access, which is forbidden by
+# our policy.
+
+set -e
+
+gradle_url=$(grep distributionUrl gradle/wrapper/gradle-wrapper.properties \
+  | awk -F = '{print $2}' | sed 's/\\//g')
+gradle_bin=$(basename $gradle_url)
+gcs_loc="domain-registry-maven-repository/gradle"
+
+gcloud storage cp "gs://${gcs_loc}/${gradle_bin}" .
+local_url="file\\\://${PWD}/${gradle_bin}"
+sed -i "s#distributionUrl=.*#distributionUrl=${local_url}#" \
+  gradle/wrapper/gradle-wrapper.properties
@@ -19,9 +19,11 @@ import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

 import com.google.common.base.Ascii;
 import com.google.common.base.Joiner;
+import com.google.common.base.Splitter;
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
 import com.google.common.net.InternetDomainName;
+import java.util.List;

 /** Utility methods related to domain names. */
 public final class DomainNameUtils {
@@ -39,14 +41,34 @@ public final class DomainNameUtils {
            .equals(potentialParent.parts());
  }

-  /** Canonicalizes a hostname/domain name by lowercasing and converting unicode to punycode. */
+  /**
+   * Canonicalizes a hostname/domain name by lowercasing and converting Unicode to punycode.
+   *
+   * <p>This applies slightly stricter rules to all labels other than the TLD part (all other labels
+   * are not allowed to have hyphens in the third and fourth position except when using
+   * ACE-formatted Punycode). This restriction is not enforced on the last label (so multi-part TLDs
+   * still cannot have said characters except on the last part).
+   */
  public static String canonicalizeHostname(String label) {
    String labelLowercased = Ascii.toLowerCase(label);
-    try {
-      return Idn.toASCII(labelLowercased);
-    } catch (IllegalArgumentException e) {
-      throw new IllegalArgumentException(String.format("Error ASCIIfying label '%s'", label), e);
+    String finalChar = "";
+    if (labelLowercased.endsWith(".")) {
+      labelLowercased = labelLowercased.substring(0, labelLowercased.length() - 1);
+      finalChar = ".";
    }
+    List<String> parts = Splitter.on('.').splitToList(labelLowercased);
+    // If the hostname only has one part, just canonicalize that.
+    if (parts.size() == 1) {
+      return Idn.toASCII(parts.getFirst()) + finalChar;
+    }
+    // If the hostname has multiple parts, apply stricter validation to all labels but the last
+    // one (which relaxes the hyphens in third and fourth positions rule).
+    StringBuilder sb = new StringBuilder();
+    for (int i = 0; i < parts.size() - 1; i++) {
+      sb.append(Idn.toASCII(parts.get(i))).append('.');
+    }
+    sb.append(Idn.tldToASCII(parts.getLast())).append(finalChar);
+    return sb.toString();
  }

  /**
@@ -14,9 +14,15 @@

 package google.registry.util;

+import static com.google.common.base.Preconditions.checkArgument;
+
 import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Sets;
 import com.ibm.icu.text.IDNA;
+import com.ibm.icu.text.IDNA.Error;
 import com.ibm.icu.text.IDNA.Info;
+import java.util.Set;

 /**
 * A partial API-compatible replacement for {@link java.net.IDN} that replaces <a
@@ -51,11 +57,29 @@ public final class Idn {
    StringBuilder result = new StringBuilder();
    UTS46_INSTANCE.nameToASCII(name, result, info);
    if (info.hasErrors()) {
-      throw new IllegalArgumentException("Errors: " + Joiner.on(',').join(info.getErrors()));
+      throw new IllegalArgumentException(
+          String.format(
+              "Errors ASCIIfying label %s: %s", name, Joiner.on(',').join(info.getErrors())));
    }
    return result.toString();
  }

+  /**
+   * Translates a TLD string from Unicode to Punycoded ASCII.
+   *
+   * <p>Unlike {@link #toASCII}, this method does NOT enforce the restriction that hyphens may only
+   * be present on the third and fourth characters for "xn--" ACE-formatted domains.
+   */
+  public static String tldToASCII(String name) {
+    Info info = new Info();
+    StringBuilder result = new StringBuilder();
+    UTS46_INSTANCE.nameToASCII(name, result, info);
+    Set<Error> errors = Sets.difference(info.getErrors(), ImmutableSet.of(Error.HYPHEN_3_4));
+    checkArgument(
+        errors.isEmpty(), "Errors ASCIIfying label %s: %s", name, Joiner.on(',').join(errors));
+    return result.toString();
+  }
+
  /**
   * Translates a string from ASCII Compatible Encoding (ACE) to Unicode, as defined by the
   * ToUnicode operation of <a href="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</a>.
@@ -45,13 +45,37 @@ class DomainNameUtilsTest {
        .isEqualTo("119.63.227.45-ns1.jhz-tt.uk");
  }

+  @Test
+  void testCanonicalizeHostname_retainsTrailingDot() {
+    assertThat(canonicalizeHostname("みんな.みんな.")).isEqualTo("xn--q9jyb4c.xn--q9jyb4c.");
+    assertThat(canonicalizeHostname("BAR.foo.みんな.")).isEqualTo("bar.foo.xn--q9jyb4c.");
+    assertThat(canonicalizeHostname("cat.lol.")).isEqualTo("cat.lol.");
+  }
+
  @Test
  void testCanonicalizeHostname_throwsOn34HyphenRule() {
    IllegalArgumentException thrown =
        assertThrows(
            IllegalArgumentException.class,
            () -> canonicalizeHostname("119.63.227.45--ns1.jhz-tt.uk"));
-    assertThat(thrown).hasCauseThat().hasMessageThat().contains("HYPHEN_3_4");
+    assertThat(thrown).hasMessageThat().contains("HYPHEN_3_4");
+  }
+
+  @Test
+  void testCanonicalizeHostname_throwsOn34HyphenRule_withTrailingDot() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> canonicalizeHostname("119.63.227.45--ns1.jhz-tt.uk."));
+    assertThat(thrown).hasMessageThat().contains("HYPHEN_3_4");
+  }
+
+  @Test
+  void testCanonicalizeHostname_allows34HyphenOnTld() {
+    assertThat(canonicalizeHostname("foobar.zz--main-2262")).isEqualTo("foobar.zz--main-2262");
+    assertThat(canonicalizeHostname("foobar.zz--main-2262.")).isEqualTo("foobar.zz--main-2262.");
+    assertThat(canonicalizeHostname("みんな.45--foo")).isEqualTo("xn--q9jyb4c.45--foo");
+    assertThat(canonicalizeHostname("みんな.45--foo.")).isEqualTo("xn--q9jyb4c.45--foo.");
  }

  @Test
Author	SHA1	Message	Date
Weimin Yu	7e9d4c27d1	Use downloaded Gradle distribution on Cloud Build (#2918 ) This way we get around the http url and no longer needs public access on the GCS bucket.	2025-12-30 21:08:04 +00:00
Weimin Yu	f9c22ff1c5	Add RST support in Sandbox (#2917 ) * Add RST support in Sandbox Added RST test label files as resources. Added a RstTmchUtils class that loads appropriate labels according to TLD pattern. Temporarily changed label fetching in production to include the TLD string, so that the new class may know which set of labels to use. * Addressing comments * Addressing comments	2025-12-30 20:59:28 +00:00
gbrodman	2562d582f3	Add more strict hostname validation on host:check flows (#2915 ) We do most of these on host create already so we should also do them on host checks. The only added change is the character validation (our existing hostnames all match these).	2025-12-30 16:41:56 +00:00
Ben McIlwain	6f0bc1ded9	Add Augmented Latin IDN table to IDN enums (#2914 ) This was added in https://github.com/google/nomulus/pull/2884 , but now as of this PR it can actually be configured and used on a TLD.	2025-12-27 00:57:24 +00:00
gbrodman	db9fc3271d	Change EPP errors 2306->2005 for some structural issues (#2911 ) 2306 signifies something that is syntactically valid but semantically invalid (like if someone tried to register a .com domain). These errors are for domain syntax that could never be valid, thus we should throw a syntax exception instead of a policy exception.	2025-12-26 16:08:04 +00:00
Ben McIlwain	84491fde70	Don't allow underscores in TLD ROID suffixes (#2913 ) Per ICANN it's a disallowed character.	2025-12-26 16:01:28 +00:00
Juan Celhay	0519e2ffcf	Change gradle memory/workers to avoid OOM in CB (#2910 )	2025-12-23 15:49:25 +00:00
gbrodman	85f75494ab	Remove implementation of contact flows (#2896 ) Now that we have transitioned to the minimum dataset, we no longer support any actions on contacts (and by the time this is merged / deployed, all contacts will be deleted). We should just throw an appropriate exception on all contact-related flows. We don't delete the flows themselves, so that we can have an appropriate error message. We also keep all the flows and XML templates around individually for now because we may be required to continue to differentiate the requests in ICANN activity reporting (e.g. srs-cont-create vs srs-cont-delete)	2025-12-23 15:38:24 +00:00
Ben McIlwain	cbba91558a	Allow double hyphens in 3rd&4th position in all domain operations (#2909 ) This is a follow-up to PR #2908, which relaxed this restriction on bare TLDs only, but now we also allow it systemwide on domains and hostnames as well. The rules against hyphens in these positions are still enforced on all parts of the domain name except the last one. Correct handling of multi-part TLDs in this regard is out of scope in this PR; a multi-part TLD that looked something like ".zz--foobar.foobar" would still fail validation. (But of course you cannot a priori know just from looking at a 3-part string whether it might be a hostname on a normal TLD, or a domain name on a 2-part TLD.) This also has some annoying interactions with a trailing dot (indicating the root), which need to be preserved, but otherwise don't affect how TLD validation is handled. BUG= http://b/471013082	2025-12-23 00:57:57 +00:00
Ben McIlwain	c24f09febc	Don't call canonicalizeHostname() on nomulus command TLD args (#2908 ) The canonicalizeHostname() helper method is only suitable for use with domain names or host names. It does not work on bare TLDs, because a bare TLD can have hyphens in the third and fourth position without necessarily being an IDN. Note that the configure TLD command already correctly allows TLDs with such names to be created. Note that we are still enforcing that the TLDs to be added exist, so they have to pass all TLD naming requirements that are enforced on creating TLDs, and we are still lowercasing the TLD names passed as arguments here (though we're no longer punycoding them, although arguably that's not super useful on command-line params anyway). BUG= http://b/471013082	2025-12-22 21:34:55 +00:00
Weimin Yu	fd51035f23	Stop depending on GCS public access for Kokoro (#2907 ) We used to publish test artifacts to a Maven repo on GCS, for use by schema tests. For this to work with Kokoro, the GCS bucket must be accessible to all users. To comply with the no-public-user requirement, we store the necessary jars at at well-known bucket and map them into Kokoro. This strategy cannot be used on the Maven repo because only a small number of files with fixed names may be mapped. With the Maven repo, there are too many files to map.	2025-12-17 20:55:03 +00:00