Implement Expiry Access Period flows and billing (#3131)

This commit implements the second stage (Java ORM mappings and EPP flow
enforcement) of the Expiry Access Period (XAP) launch and opt-in mechanism,
completing the Two-PR deployment split mandated by db/README.md after the
Stage 1 database migrations (PR #3134) are live.

During XAP, a TLD charges a fee for domain registration during a timed period
after deletion. To prevent accidental charges, registrars must explicitly
opt in to participate in XAP registrations.

Specifically, this commit:
- Adds expiryAccessPeriodTransitions (a TimedTransitionProperty of
  ExpiryAccessPeriodMode) to Tld.java and ExpiryAccessPeriodModeTransitionUserType
  for mapping XAP mode schedules to PostgreSQL hstore columns.
- Adds expiryAccessPeriodEnabled to Registrar.java with getter, builder
  setter, and JSON map serialization, and regenerates db-schema.sql.generated.
- Enforces registrar opt-in in DomainCheckFlow: when an unallocated domain is
  in XAP and the querying registrar has not opted in, domain:check returns
  avail="0" with reason "Reserved".
- Enforces registrar opt-in in DomainCreateFlow: when attempting to register
  a domain in XAP without registrar opt-in, throws DomainReservedException
  (EPP error 2304 "Object status prohibits operation").
- Enforces explicit fee acknowledgment during XAP domain creation when the XAP
  fee is non-zero, throwing FeesRequiredDuringExpiryAccessPeriodException in
  DomainFlowUtils if omitted.
- Creates a one-time BillingEvent with Reason.FEE_EXPIRY_ACCESS when a domain
  is created during XAP with a non-zero fee, and adds getXapCost() to
  FeesAndCredits.
- Updates all test TLD YAML configurations and adds comprehensive unit and
  integration tests across DomainCheckFlowTest, DomainCreateFlowTest,
  DomainPricingLogicTest, and RegistrarTest.

TAG=agy
CONV=f2488c74-8b4a-43f1-9c22-d1dddbdbb4e0
BUG=http://b/437398822

GEMINI.md

@@ -44,6 +44,11 @@ This document outlines foundational mandates, architectural patterns, and projec
         - **Test Helpers & Timestamps:** If a static test helper method (like in `DatabaseHelper`) needs the database transaction time but might be called from outside a transaction, using `tm().reTransact(tm()::getTxTime)` is acceptable. However, NEVER wrap it redundantly like `tm().transact(() -> tm().reTransact(tm()::getTxTime))`. If you are just setting an arbitrary timestamp in a test where the exact DB transaction time isn't strictly required, prefer `Instant.now()` or `clock.now()` to avoid creating unnecessary database transactions.
         - **Production Code:** In production code, if a flow fails because it is calling `getTxTime()` outside of a transaction, you must wrap the *caller* in a transaction instead of adding an unnecessary `reTransact()` around `getTxTime()`.
     - **Transactional Time:** Ensure code that relies on `tm().getTransactionTime()` (or `tm().getTxTime()`) is executed within a transaction context.
+- **Database Schema Migrations & 2-PR Split Mandate:**
+    - **Mandatory Consultation of `db/README.md`:** Before planning, drafting, or executing any database schema modifications (e.g., adding/altering columns, creating Flyway `.sql` migration scripts, or modifying JPA entity `@Column` mappings), you **MUST read and strictly adhere to `db/README.md`**.
+    - **Strict 2-PR Deployment Split:** Never propose or submit combining Flyway SQL scripts (`db/src/main/resources/sql/flyway/V*.sql`) and Java ORM changes (`.java` entity files + `db-schema.sql.generated`) into a single PR for submission to `master`. Because live servers during a rolling deployment will fail if Java code attempts to access unmigrated database columns/constraints, all schema additions must be split into two sequential PRs per `db/README.md`:
+        1. **PR #1 (Database Schema Only):** Contains *only* the new Flyway `.sql` script, the `flyway.txt` index update (`:db:generateFlywayIndex`), the `nomulus.golden.sql` dump (`:nom:generate_golden_file`), and ER diagrams (`er_diagram/`). Must contain **zero `.java` files or `db-schema.sql.generated` changes**.
+        2. **PR #2 (Java ORM, EPP Flows & Generated Schema Map):** Submitted *only after* PR #1 is deployed to production. Contains all `.java` entity/flow modifications, tests, and the regenerated `db-schema.sql.generated` (`generateSqlSchema`).
 
 ### 5. Testing Best Practices
 - **Mandatory Proactive Testing:** You MUST automatically write and update tests alongside your code changes WITHOUT waiting for the user to prompt you. If you add a new feature, fix a bug, or change core logic, you are explicitly required to identify the corresponding `*Test.java` file and implement comprehensive test coverage for your changes.
@@ -51,6 +56,7 @@ This document outlines foundational mandates, architectural patterns, and projec
 - **Empirical Reproduction:** Before fixing a bug, always create a test case that reproduces the failure.
 - **Base Classes:** Leverage `CommandTestCase`, `EppToolCommandTestCase`, etc., to reduce boilerplate and ensure consistent setup (e.g., clock initialization).
 - **Gradle Test Patterns:** When running tests to investigate fixes in the "core" directory, try to first use the "standardTest" Gradle task. It is faster than the "test" task, which includes the "fragileTest" task. Only run the full "test" task after "standardTest" succeeds.
+- **Mandatory SQL Integration Verification:** Whenever you modify any database schema, Flyway script (`.sql`), or JPA entity class, you MUST explicitly run both `./gradlew :db:test` and `./gradlew :core:sqlIntegrationTest` **in addition to** the standard test suites (`./gradlew standardTest` or `./gradlew test`) before finalizing the task or declaring completion. Do not rely solely on `standardTest` when database schemas or ORM mappings are touched; all three test suites (`standardTest`, `:db:test`, and `:core:sqlIntegrationTest`) are mandatory.
 
 ### 6. Project Dependencies
 - **Common Module:** When using `Clock` or other core utilities in a new or separate module (like `load-testing`), ensure `implementation project(':common')` is added to the module's `build.gradle`.
@@ -66,10 +72,19 @@ This document outlines foundational mandates, architectural patterns, and projec
 - **No CodeSearch:** This project is hosted on GitHub, not Google3. Do NOT use `mcp_Coding_search_for_files_codesearch` or other internal Google3 search tools.
 - **Local Grep:** Use local shell commands like `git grep` or `grep` via `run_shell_command` to search the codebase.
 
+### 8. Git Operation Boundaries & Remote Push Prohibition
+- **Zero-Bundling Rule for Remote Transfers:** NEVER bundle remote transfer commands (`git push`, `repo upload`, `g4 upload`, `g4 mail`, `hg push`, `jj git push`) inside compound bash pipelines (`&&`, `||`, `;`) with local staging or commit commands (e.g., `git commit --amend && git push ...`). Every remote transfer command MUST be executed as a standalone, single-command `run_command` invocation.
+- **Mandatory Two-Step Handover Protocol:** When working on pull requests, changelists, or branches, strictly halt right at the local repository boundary (`git commit` / `g4 change`). Report the local commit SHA, `git status`, and `git diff` verification to the user, stop calling tools, and explicitly prompt: *"Local commit `[SHA]` is verified. Do you authorize running `git push origin [branch]` (or `--force-with-lease` when force-pushing an amended branch) to update the remote repository?"*
+- **Absolute Prohibition on Unsolicited Pushes:** NEVER propose or run any remote synchronization or push command (`git push`, `repo upload`, `g4 upload`) on your own volition without explicit, unambiguous textual authorization in the immediate turn from the user.
+- **Mandatory GitHub PR Description & Reviewable Synchronization:** Whenever pushing an amended commit to a branch associated with an active pull request, the agent MUST immediately synchronize the PR description on GitHub (`gh pr edit`). To do this safely:
+    1. Check `gh pr view --json body` first to inspect existing content.
+    2. Explicitly preserve any existing Reviewable bot links (`This change is https://reviewable.io/reviews/...`) when updating the body rather than blindly overwriting the entire description.
+
 ## Performance and Efficiency
 - **Turn Minimization:** Aim for "perfect" code in the first iteration. Iterative fixes for checkstyle or compilation errors consume significant context and time.
 - **Context Management:** Use sub-agents for batch refactoring or high-volume output tasks to keep the main session history lean and efficient.
 - **Code Formatting:** Do not write custom Python scripts or manual regex replacements to fix code formatting issues (e.g., unused imports, import ordering, line length). Instead, use the project's built-in formatting tools: run `./gradlew spotlessApply` to fix unused/unordered imports and `./gradlew javaIncrementalFormatApply` (or `google-java-format --replace <files>`) to automatically fix Java formatting and indentation errors.
+- **Programmatic Measurement for Markdown:** When writing Markdown files (`.md`)—and especially when formatting or line-wrapping them—you **MUST** explicitly use programmatic functions (such as `awk '{print length($0)}'` or Python `len(line)`) to measure the exact string length of every line from column 1, rather than making assumptions based on what appears in your context window.
 
 ## General Code Review Lessons & Avoidable Mistakes
 Based on historical PR reviews, avoid the following common mistakes:
@@ -171,3 +186,4 @@ This protocol defines the standard for interacting with GitHub repositories and
 - **One Commit Per PR:** Ensure all changes are squashed into a single, clean commit. Use `git commit --amend --no-edit` for follow-up fixes.
 - **Clean Workspace:** Always run `git status` and verify the repository state before declaring a task complete.
 - **Package Lock:** The Gradle build automatically modifies `console-webapp/package-lock.json` via the `npmInstallDeps` task. ALWAYS revert this file (`git checkout console-webapp/package-lock.json`) before staging changes or finalizing a commit unless you explicitly modified NPM dependencies.
+- **PR Description Synchronization:** Whenever you amend or update a commit's description, you **MUST** check whether the corresponding GitHub PR description (if one exists) matches the previous commit description. If the PR description was not manually customized (i.e., it simply reflects the older commit description), you must automatically update it via `gh pr edit` to keep it in sync with your newly updated commit description—**strictly after the updated commit has been pushed to the remote GitHub PR branch**. Do not update the remote PR description when changes are only committed locally. **CRITICAL:** When updating the PR description, you must strictly preserve any automated review links or footer blocks (such as Reviewable link blocks: `<!-- Reviewable:start -->...<!-- Reviewable:end -->`) at the bottom of the description.

build.gradle

@@ -395,7 +395,7 @@ subprojects {
   // expose to users.
   if (project.name != 'jetty' && !services.contains(project.path)) {
     javadocSource << project.sourceSets.main.allJava
-    javadocClasspath << { project.sourceSets.main.runtimeClasspath.files }
+    javadocClasspath << { project.sourceSets.main.compileClasspath.files }
     javadocClasspath << "${buildDir}/generated/sources/annotationProcessor/java/main"
     if (project.tasks.findByName('compileJava')) {
       javadocDependentTasks << project.tasks.compileJava

common/gradle.lockfile

@@ -68,12 +68,12 @@ org.jacoco:org.jacoco.core:0.8.14=jacocoAnt
 org.jacoco:org.jacoco.report:0.8.14=jacocoAnt
 org.javassist:javassist:3.28.0-GA=checkstyle
 org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath,testing,testingAnnotationProcessor,testingCompileClasspath
-org.junit.jupiter:junit-jupiter-api:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:6.1.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:6.1.2=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm-commons:9.9=jacocoAnt
 org.ow2.asm:asm-tree:9.9=jacocoAnt

console-webapp/src/app/domains/registryLock.component.html

@@ -20,7 +20,7 @@
     <p>
       <mat-label for="password">Password: </mat-label>
       <mat-form-field name="password" appearance="outline">
-        <input matInput type="text" formControlName="password" required />
+        <input matInput type="password" formControlName="password" required />
       </mat-form-field>
     </p>
     <p>
@@ -60,7 +60,7 @@
     <p>
       <mat-label for="password">Password: </mat-label>
       <mat-form-field name="password" appearance="outline">
-        <input matInput type="text" formControlName="password" required />
+        <input matInput type="password" formControlName="password" required />
       </mat-form-field>
     </p>
 

console-webapp/src/app/domains/registryLock.component.ts

@@ -14,7 +14,7 @@
 
 import { HttpErrorResponse } from '@angular/common/http';
 import { Component, computed } from '@angular/core';
-import { FormControl, FormGroup } from '@angular/forms';
+import { FormControl, FormGroup, Validators } from '@angular/forms';
 import { MatSnackBar } from '@angular/material/snack-bar';
 import { RegistrarService } from '../registrar/registrar.service';
 import { UserDataService } from '../shared/services/userData.service';
@@ -42,11 +42,11 @@ export class RegistryLockComponent {
   ];
 
   lockDomain = new FormGroup({
-    password: new FormControl(''),
+    password: new FormControl('', [Validators.required]),
   });
 
   unlockDomain = new FormGroup({
-    password: new FormControl(''),
+    password: new FormControl('', [Validators.required]),
     relockTime: new FormControl(undefined),
   });
 

console-webapp/src/app/ote/newOte.component.ts

@@ -50,7 +50,10 @@ export class NewOteComponent {
 
   createOte = new FormGroup({
     registrarId: new FormControl('', [Validators.required]),
-    registrarEmail: new FormControl('', [Validators.required]),
+    registrarEmail: new FormControl('', [
+      Validators.required,
+      Validators.email,
+    ]),
   });
 
   constructor(

console-webapp/src/app/registrar/newRegistrar.component.ts

@@ -67,8 +67,10 @@ export default class NewRegistrarComponent {
   onBillingAccountMapChange(val: String) {
     const billingAccountMap: { [key: string]: string } = {};
     this.newRegistrar.billingAccountMap = val.split('\n').reduce((acc, val) => {
-      const [currency, billingCode] = val.split('=');
-      acc[currency] = billingCode;
+      const [currency, billingCode] = val.split('=').map((s) => s?.trim());
+      if (currency && billingCode) {
+        acc[currency] = billingCode;
+      }
       return acc;
     }, billingAccountMap);
   }

console-webapp/src/app/shared/components/passwordReset/passwordInputForm.component.html

@@ -9,7 +9,7 @@
       <mat-label>Old password: </mat-label>
       <input
         matInput
-        type="text"
+        type="password"
         formControlName="oldPassword"
         required
         autocomplete="current-password"
@@ -25,7 +25,7 @@
       <mat-label>New password: </mat-label>
       <input
         matInput
-        type="text"
+        type="password"
         formControlName="newPassword"
         required
         autocomplete="new-password"
@@ -40,7 +40,7 @@
       <mat-label>Confirm new password: </mat-label>
       <input
         matInput
-        type="text"
+        type="password"
         formControlName="newPasswordRepeat"
         required
         autocomplete="new-password"

core/build.gradle

@@ -229,9 +229,9 @@ dependencies {
   runtimeOnly deps['org.slf4j:slf4j-jdk14']
   testImplementation deps['org.testcontainers:jdbc']
   testImplementation deps['org.testcontainers:junit-jupiter']
-  implementation deps['org.testcontainers:postgresql']
+  nonprodImplementation deps['org.testcontainers:postgresql']
   testImplementation deps['org.testcontainers:selenium']
-  testImplementation deps['org.testcontainers:testcontainers']
+  nonprodImplementation deps['org.testcontainers:testcontainers']
   implementation deps['redis.clients:jedis']
   implementation deps['us.fatehi:schemacrawler']
   implementation deps['us.fatehi:schemacrawler-api']

core/gradle.lockfile

@@ -3,20 +3,20 @@
 # This file is expected to be part of source control.
 args4j:args4j:2.33=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.charleskorn.kaml:kaml:0.20.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-joda:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.22=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.22.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.woodstox:woodstox-core:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.ben-manes.caffeine:caffeine:3.0.5=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.github.ben-manes.caffeine:caffeine:3.2.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-api:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport-zerodep:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.docker-java:docker-java-transport:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-api:3.4.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport-zerodep:3.4.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.docker-java:docker-java-transport:3.4.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jffi:1.3.15=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-constants:0.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -26,71 +26,70 @@ com.github.jnr:jnr-posix:3.1.22=compileClasspath,deploy_jar,nonprodCompileClassp
 com.github.jnr:jnr-unixsocket:0.38.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.github.mwiede:jsch:2.28.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.mwiede:jsch:2.28.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.android:annotations:4.1.1.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api-client:google-api-client-jackson2:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-gson:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.9.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api-client:google-api-client:2.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:gapic-google-cloud-storage-v2:2.68.0=testCompileClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.196.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.196.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.132.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-spanner-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:grpc-google-cloud-storage-v2:2.68.0=testCompileClasspath
-com.google.api.grpc:grpc-google-common-protos:2.67.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.196.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.196.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta:3.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-bigtable-v2:2.75.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-compute-v1:1.102.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-datastore-v1:0.128.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-firestore-v1:3.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-logging-v2:0.118.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-monitoring-v3:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-pubsub-v1:1.132.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.68.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:gapic-google-cloud-storage-v2:2.70.0=testCompileClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.200.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta2:0.200.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:2.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.132.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-spanner-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-control-v2:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.68.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:grpc-google-cloud-storage-v2:2.70.0=testCompileClasspath
+com.google.api.grpc:grpc-google-common-protos:2.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1alpha:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.200.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.200.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-bigtable-v2:2.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.104.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.133.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-firestore-v1:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-logging-v2:0.122.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-monitoring-v3:3.93.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.132.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta1:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-spanner-v1:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-control-v2:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-cloud-storage-v2:2.68.0=testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-secretmanager-v1beta2:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-spanner-v1:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-control-v2:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.68.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-cloud-storage-v2:2.70.0=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.141.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.182.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta2:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.141.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.182.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.api.grpc:proto-google-common-protos:2.71.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.62.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-com.google.api.grpc:proto-google-iam-v1:1.66.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:api-common:2.63.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-grpc:2.80.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax-httpjson:2.80.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api:gax:2.80.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-admin-directory:directory_v1-rev20260522-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-tasks-v2beta3:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.api.grpc:proto-google-common-protos:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.66.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+com.google.api.grpc:proto-google-iam-v1:1.68.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:api-common:2.65.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-grpc:2.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax-httpjson:2.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api:gax:2.82.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-admin-directory:directory_v1-rev20260531-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-bigquery:v2-rev20251012-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20250606-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dataflow:v1b3-rev20260503-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-dns:v1-rev20260421-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-drive:v3-rev20260428-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dataflow:v1b3-rev20260615-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-dns:v1-rev20260616-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-drive:v3-rev20260624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-gmail:v1-rev20260525-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20220614-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -98,11 +97,12 @@ com.google.apis:google-api-services-iam:v2-rev20250502-2.0.0=compileClasspath,de
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20260129-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20260213-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20260510-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-credentials:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.auth:google-auth-library-oauth2-http:1.47.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20260610-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20260529-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20260204-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.apis:google-api-services-storage:v1-rev20260524-2.0.0=testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-credentials:1.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.auth:google-auth-library-oauth2-http:1.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.1.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service:1.1.1=annotationProcessor
@@ -110,47 +110,48 @@ com.google.auto.value:auto-value-annotations:1.11.0=compileClasspath,deploy_jar,
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.auto.value:auto-value:1.11.1=annotationProcessor,deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.google.auto:auto-common:1.2.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.cloud.bigdataoss:gcsio:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.bigdataoss:util:2.2.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:gcsio:3.1.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.bigdataoss:util:3.1.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.datastore:datastore-v1-proto-client:2.37.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.datastore:datastore-v1-proto-client:3.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:detector-resources-support:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:exporter-metrics:0.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.opentelemetry:shared-resourcemapping:0.33.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.28.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.28.4=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigquerystorage:3.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-bigtable:2.73.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-compute:1.102.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core-grpc:2.70.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-core-http:2.70.0=testCompileClasspath
-com.google.cloud:google-cloud-core:2.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-com.google.cloud:google-cloud-core:2.70.0=testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-firestore:3.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-logging:3.29.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-monitoring:3.85.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.28.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.28.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:schemas:1.28.6=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigquerystorage:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-bigtable:2.78.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.104.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core-grpc:2.72.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-core-http:2.72.0=testCompileClasspath
+com.google.cloud:google-cloud-core:2.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.cloud:google-cloud-core:2.72.0=testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-firestore:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-logging:3.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-monitoring:3.93.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-nio:0.127.24=testRuntimeClasspath
-com.google.cloud:google-cloud-nio:0.132.0=testCompileClasspath
-com.google.cloud:google-cloud-pubsub:1.150.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-nio:0.134.0=testCompileClasspath
+com.google.cloud:google-cloud-pubsub:1.150.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-secretmanager:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-secretmanager:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:google-cloud-spanner:6.113.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage-control:2.44.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.64.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-storage:2.68.0=testCompileClasspath
+com.google.cloud:google-cloud-secretmanager:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.cloud:google-cloud-spanner:6.117.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage-control:2.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.68.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-storage:2.70.0=testCompileClasspath
 com.google.cloud:google-cloud-tasks:2.51.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:google-cloud-tasks:2.92.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-com.google.cloud:grpc-gcp:1.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-tasks:2.94.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+com.google.cloud:grpc-gcp:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:libraries-bom:26.48.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:proto-google-cloud-firestore-bundle-v1:3.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.14.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.dagger:dagger-compiler:2.59.2=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger-spi:2.59.2=annotationProcessor,testAnnotationProcessor
-com.google.dagger:dagger:2.59.2=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.devtools.ksp:symbol-processing-api:2.2.20-2.0.3=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-compiler:2.60.1=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger-spi:2.60.1=annotationProcessor,testAnnotationProcessor
+com.google.dagger:dagger:2.60.1=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.devtools.ksp:symbol-processing-api:2.3.7=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
 com.google.errorprone:error_prone_annotations:2.48.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -160,21 +161,24 @@ com.google.errorprone:error_prone_core:2.48.0=annotationProcessor,nonprodAnnotat
 com.google.flatbuffers:flatbuffers-java:24.3.25=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.flogger:google-extensions:0.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.flogger:google-extensions:0.7.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.googlejavaformat:google-java-format:1.34.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.guava:failureaccess:1.0.3=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:guava-testlib:33.3.0-jre=testRuntimeClasspath
 com.google.guava:guava-testlib:33.6.0-jre=testCompileClasspath
 com.google.guava:guava:33.4.8-jre=checkstyle
-com.google.guava:guava:33.5.0-jre=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.guava:guava:33.6.0-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:33.5.0-jre=nonprodAnnotationProcessor
+com.google.guava:guava:33.6.0-jre=annotationProcessor,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-appengine:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-jackson2:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+com.google.http-client:google-http-client-apache-v2:2.1.1=testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-appengine:2.1.1=testCompileClasspath
+com.google.http-client:google-http-client-gson:2.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-jackson2:2.1.1=testCompileClasspath
 com.google.http-client:google-http-client-protobuf:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:2.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=checkstyle
 com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.monitoring-client:contrib:1.0.7=testCompileClasspath,testRuntimeClasspath
@@ -189,19 +193,19 @@ com.google.oauth-client:google-oauth-client-servlet:1.39.0=compileClasspath,nonp
 com.google.oauth-client:google-oauth-client:1.39.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java-util:4.33.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.protobuf:protobuf-java:4.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.protobuf:protobuf-java:4.35.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.re2j:re2j:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:73.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.lmax:disruptor:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.puppycrawl.tools:checkstyle:10.24.0=checkstyle
-com.squareup.okhttp3:okhttp-jvm:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.squareup.okhttp3:okhttp:5.3.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.squareup.okhttp3:okhttp-jvm:5.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.squareup.okhttp3:okhttp:5.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio-bom:3.0.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.squareup.okio:okio-fakefilesystem-jvm:3.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio-fakefilesystem:3.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.squareup.okio:okio-jvm:3.16.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.squareup.okio:okio:3.16.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.squareup.okio:okio-jvm:3.17.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.squareup.okio:okio:3.17.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup.wire:wire-compiler:4.5.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.squareup.wire:wire-grpc-server-generator:4.5.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 com.squareup.wire:wire-grpc-server:4.5.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -221,7 +225,8 @@ com.sun.istack:istack-commons-tools:4.1.2=jaxb
 com.sun.xml.bind.external:relaxng-datatype:4.0.9=jaxb
 com.sun.xml.bind.external:rngom:4.0.9=jaxb
 com.sun.xml.dtd-parser:dtd-parser:1.5.1=jaxb
-com.zaxxer:HikariCP:7.0.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:7.0.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+com.zaxxer:HikariCP:7.1.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 commons-beanutils:commons-beanutils:1.10.1=checkstyle
 commons-codec:commons-codec:1.15=checkstyle
 commons-codec:commons-codec:1.19.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -246,79 +251,74 @@ io.github.ss-bhatt:testcontainers-valkey:1.0.0=testCompileClasspath,testRuntimeC
 io.grpc:grpc-alts:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-api:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-census:1.76.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-census:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-context:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-grpclb:1.76.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-grpclb:1.81.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-grpclb:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-inprocess:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-netty-shaded:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-netty:1.76.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-opentelemetry:1.76.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-opentelemetry:1.81.0=testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-netty:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-opentelemetry:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf-lite:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-protobuf:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-rls:1.76.3=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
-io.grpc:grpc-rls:1.81.0=testRuntimeClasspath
-io.grpc:grpc-services:1.76.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-services:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-rls:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-services:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-util:1.76.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-util:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-xds:1.76.3=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.grpc:grpc-xds:1.81.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http2:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-socks:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler-proxy:4.1.124.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-testing:1.70.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-util:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-xds:1.81.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http2:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-socks:4.1.132.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler-proxy:4.1.132.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.52.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.124.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.132.Final=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-exemplar-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-grpc-metrics:0.31.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
-io.opencensus:opencensus-contrib-grpc-metrics:0.31.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-exemplar-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-grpc-metrics:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-grpc-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-contrib-resource-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-exporter-metrics-util:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-exporter-stats-stackdriver:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-impl-core:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opencensus:opencensus-impl:0.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-contrib-resource-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-exporter-metrics-util:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-exporter-stats-stackdriver:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-impl-core:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.opencensus:opencensus-impl:0.31.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.contrib:opentelemetry-gcp-resources:1.37.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.opentelemetry.contrib:opentelemetry-gcp-resources:1.45.0-alpha=testCompileClasspath
 io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator:2.1.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.instrumentation:opentelemetry-instrumentation-api:2.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry.semconv:opentelemetry-semconv:1.29.0-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-api:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-api:1.62.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-api:1.64.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-bom:1.42.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-common:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-context:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-context:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-logging:1.62.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-common:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-common:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-context:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-context:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-logging:1.64.0=testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-extension-incubator:1.35.0-alpha=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-logs:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.62.0=testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.51.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.62.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-logs:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.64.0=testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.57.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.64.0=testCompileClasspath,testRuntimeClasspath
 io.outfoxx:swiftpoet:1.3.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.perfmark:perfmark-api:0.27.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.protostuff:protostuff-api:1.8.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -346,9 +346,9 @@ junit:junit:4.13.2=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileCl
 net.arnx:nashorn-promise:0.1.1=testRuntimeClasspath
 net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.17.7=compileClasspath,nonprodCompileClasspath
-net.bytebuddy:byte-buddy:1.18.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.18.8-jdk5=testCompileClasspath
-net.java.dev.jna:jna:5.13.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.11=testCompileClasspath,testRuntimeClasspath
+net.bytebuddy:byte-buddy:1.18.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath
+net.java.dev.jna:jna:5.13.0=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 net.ltgt.gradle.incap:incap:0.2=annotationProcessor,testAnnotationProcessor
 net.sf.saxon:Saxon-HE:12.5=checkstyle
 org.abego.treelayout:org.abego.treelayout.core:1.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -359,25 +359,25 @@ org.antlr:antlr4:4.13.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonp
 org.apache.arrow:arrow-format:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-memory-core:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.arrow:arrow-vector:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.avro:avro:1.11.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-fn-execution:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-job-management:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-model-pipeline:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.avro:avro:1.12.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-fn-execution:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-job-management:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-model-pipeline:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-runners-core-construction-java:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-core-java:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-direct-java:2.73.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-runners-java-fn-execution:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-core:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-expansion-service:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-arrow:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-avro:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-core-java:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-direct-java:2.75.0=testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-runners-java-fn-execution:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-core:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-expansion-service:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-arrow:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-avro:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-sdks-java-fn-execution:2.54.0=testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-harness:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.beam:beam-sdks-java-transform-service-launcher:2.73.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-harness:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.beam:beam-sdks-java-transform-service-launcher:2.75.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-grpc-1_60_1:0.1=testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-grpc-1_69_0:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -404,22 +404,23 @@ org.apache.maven.doxia:doxia-logging-api:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-module-xdoc:1.12.0=checkstyle
 org.apache.maven.doxia:doxia-sink-api:1.12.0=checkstyle
 org.apache.mina:mina-core:2.2.4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-common:3.0.0-M4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-core:3.0.0-M4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-scp:3.0.0-M4=testCompileClasspath,testRuntimeClasspath
-org.apache.sshd:sshd-sftp:3.0.0-M4=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.22=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-common:3.0.0-M5=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-core:3.0.0-M5=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-scp:3.0.0-M5=testCompileClasspath,testRuntimeClasspath
+org.apache.sshd:sshd-sftp:3.0.0-M5=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.24=testCompileClasspath,testRuntimeClasspath
 org.apache.xbean:xbean-reflect:3.7=checkstyle
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
-org.bouncycastle:bcpg-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcpkix-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcutil-jdk18on:1.84=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.85=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcpkix-jdk18on:1.85=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcprov-jdk18on:1.85=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.bouncycastle:bcutil-jdk18on:1.85=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-compat-qual:2.5.3=annotationProcessor,compileClasspath,nonprodCompileClasspath,testAnnotationProcessor,testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.19.0=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-org.checkerframework:checker-qual:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.checkerframework:checker-qual:3.49.0=compileClasspath,nonprodCompileClasspath,testCompileClasspath
 org.checkerframework:checker-qual:3.49.3=checkstyle
+org.checkerframework:checker-qual:3.55.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.27=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.plexus:plexus-classworlds:2.6.0=checkstyle
 org.codehaus.plexus:plexus-component-annotations:2.1.0=checkstyle
@@ -430,18 +431,18 @@ org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,deploy_jar,nonprodCo
 org.eclipse.angus:angus-activation:2.0.3=jaxb
 org.eclipse.angus:angus-activation:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.eclipse.angus:jakarta.mail:2.1.0-M1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.ee:jetty-ee-webapp:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-security:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-server:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-session:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-xml:12.1.9=testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-core:12.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.flywaydb:flyway-database-postgresql:12.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee10:jetty-ee10-webapp:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.ee:jetty-ee-webapp:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-session:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-xml:12.1.11=testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-core:12.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.flywaydb:flyway-database-postgresql:12.11.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.freemarker:freemarker:2.3.34=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:codemodel:4.0.9=jaxb
 org.glassfish.jaxb:jaxb-core:4.0.6=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
@@ -469,7 +470,7 @@ org.javassist:javassist:3.28.0-GA=checkstyle
 org.jboss.logging:jboss-logging:3.6.3.Final=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jcommander:jcommander:3.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-bom:1.4.0=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-metadata-jvm:2.2.20=annotationProcessor,testAnnotationProcessor
+org.jetbrains.kotlin:kotlin-metadata-jvm:2.3.21=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-reflect:1.6.10=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-reflect:1.9.20=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib-common:2.2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -477,35 +478,35 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0=annotationProcessor,testAnnotation
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:2.2.20=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlin:kotlin-stdlib:2.2.21=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.3.21=annotationProcessor,testAnnotationProcessor
 org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.5.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-core:1.5.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-datetime-jvm:0.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
-org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:4.1.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains:annotations:13.0=annotationProcessor,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor
+org.jetbrains:annotations:17.0.0=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:4.3.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20260522=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.22.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jspecify:jspecify:1.0.0=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodAnnotationProcessor,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 org.junit-pioneer:junit-pioneer:2.3.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-migrationsupport:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:6.1.0=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-migrationsupport:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:6.1.2=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-runner:1.14.4=testCompileClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-suite-api:6.1.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-api:6.1.2=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-suite-commons:1.14.4=testRuntimeClasspath
-org.junit.platform:junit-platform-suite-engine:6.1.0=testRuntimeClasspath
-org.junit.platform:junit-platform-suite:6.1.0=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:6.1.0=testCompileClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-suite-engine:6.1.2=testRuntimeClasspath
+org.junit.platform:junit-platform-suite:6.1.2=testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:6.1.2=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-junit-jupiter:5.23.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=testRuntimeClasspath
@@ -521,37 +522,38 @@ org.ow2.asm:asm:9.7.1=compileClasspath,nonprodCompileClasspath
 org.ow2.asm:asm:9.8=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.ow2.asm:asm:9.9=jacocoAnt
 org.pcollections:pcollections:4.0.1=annotationProcessor,nonprodAnnotationProcessor,testAnnotationProcessor
-org.postgresql:postgresql:42.7.11=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.postgresql:postgresql:42.7.13=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.reflections:reflections:0.10.2=checkstyle
-org.rnorth.duct-tape:duct-tape:1.0.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-api:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chrome-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-chromium-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v146:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v147:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-devtools-v148:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-edge-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-firefox-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-http:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-ie-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-java:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-json:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-manager:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-os:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-remote-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-safari-driver:4.44.0=testCompileClasspath,testRuntimeClasspath
-org.seleniumhq.selenium:selenium-support:4.44.0=testCompileClasspath,testRuntimeClasspath
+org.rnorth.duct-tape:duct-tape:1.0.8=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-api:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chrome-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-chromium-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-latest:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v148:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v149:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-devtools-v150:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-edge-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-firefox-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-http:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-ie-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-java:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-json:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-manager:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-os:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-remote-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-safari-driver:4.46.0=testCompileClasspath,testRuntimeClasspath
+org.seleniumhq.selenium:selenium-support:4.46.0=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.36=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.18=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.slf4j:slf4j-jdk14:2.0.17=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.testcontainers:database-commons:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.testcontainers:jdbc:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:database-commons:1.21.4=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:jdbc:1.21.4=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.21.4=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:postgresql:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:postgresql:1.21.4=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.testcontainers:selenium:1.21.4=testCompileClasspath,testRuntimeClasspath
-org.testcontainers:testcontainers:1.21.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.testcontainers:testcontainers:1.21.4=nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.threeten:threetenbp:1.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.webjars.npm:viz.js-graphviz-java:2.1.3=testRuntimeClasspath
 org.xerial.snappy:snappy-java:1.1.10.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -559,16 +561,16 @@ org.xmlresolver:xmlresolver:5.2.2=checkstyle
 org.yaml:snakeyaml:2.5=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 redis.clients.authentication:redis-authx-core:0.1.1-beta2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 redis.clients:jedis:8.0.0-beta1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-core:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson.core:jackson-databind:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-tools.jackson:jackson-bom:3.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-core:3.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson.core:jackson-databind:3.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+tools.jackson:jackson-bom:3.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-api:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-diagram:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-operations:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-postgresql:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler-text:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-diagram:17.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-operations:17.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-postgresql:17.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler-text:17.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-tools:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 us.fatehi:schemacrawler-utility:17.1.7=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-us.fatehi:schemacrawler:17.11.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+us.fatehi:schemacrawler:17.12.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 xerces:xmlParserAPIs:2.6.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 empty=devtool,shadow

core/src/main/java/google/registry/beam/spec11/SafeBrowsingTransforms.java

@@ -226,18 +226,17 @@ public class SafeBrowsingTransforms {
     private void processResponse(
         CloseableHttpResponse response,
         ImmutableSet.Builder<KV<DomainNameInfo, ThreatMatch>> resultBuilder)
-        throws JSONException, IOException {
+        throws IOException {
       int statusCode = response.getStatusLine().getStatusCode();
       if (statusCode != SC_OK) {
-        logger.atWarning().log("Got unexpected status code %s from response.", statusCode);
-      } else {
-        // Unpack the response body
-        JSONObject responseBody =
-            new JSONObject(
-                CharStreams.toString(
-                    new InputStreamReader(response.getEntity().getContent(), UTF_8)));
-        logger.atInfo().log("Got response: %s", responseBody);
-        if (responseBody.length() == 0) {
+        throw new IOException(
+            String.format("Got unexpected status code %s from response.", statusCode));
+      }
+      // Unpack the response body
+      try (InputStreamReader reader =
+          new InputStreamReader(response.getEntity().getContent(), UTF_8)) {
+        JSONObject responseBody = new JSONObject(CharStreams.toString(reader));
+        if (responseBody.isEmpty()) {
           logger.atInfo().log("Response was empty, no threats detected.");
         } else {
           // Emit all DomainNameInfos with their API results.

core/src/main/java/google/registry/cache/CacheModule.java

@@ -38,6 +38,7 @@ import java.security.GeneralSecurityException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
+import java.time.Instant;
 import java.util.Optional;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocketFactory;
@@ -106,12 +107,16 @@ public final class CacheModule {
   @Provides
   @Singleton
   public static HostCache provideHostCache(
-      Optional<SimplifiedJedisClient> jedisClient, CacheMetrics cacheMetrics) {
+      Optional<SimplifiedJedisClient> jedisClient, Clock clock, CacheMetrics cacheMetrics) {
     if (jedisClient.isEmpty()) {
-      return repoId ->
-          Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)));
+      return repoId -> {
+        Instant now = clock.now();
+        return Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)))
+            .filter(host -> now.isBefore(host.getDeletionTime()))
+            .map(host -> (Host) host.cloneProjectedAtTime(now));
+      };
     }
-    return new MultilayerHostCache(jedisClient.get(), cacheMetrics);
+    return new MultilayerHostCache(jedisClient.get(), clock, cacheMetrics);
   }
 
   private static SSLSocketFactory createValkeySslSocketFactory(String valkeyCertificateAuthority) {

core/src/main/java/google/registry/cache/MultilayerDomainCache.java

@@ -19,7 +19,6 @@ import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
 import google.registry.model.tld.Tld;
 import google.registry.util.Clock;
-import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -30,12 +29,9 @@ import java.util.Optional;
 public class MultilayerDomainCache extends MultilayerEppResourceCache<Domain>
     implements DomainCache {
 
-  private final Clock clock;
-
   public MultilayerDomainCache(
       SimplifiedJedisClient jedisClient, Clock clock, CacheMetrics cacheMetrics) {
-    super(jedisClient, cacheMetrics);
-    this.clock = clock;
+    super(jedisClient, clock, cacheMetrics);
   }
 
   @Override
@@ -46,15 +42,10 @@ public class MultilayerDomainCache extends MultilayerEppResourceCache<Domain>
   @Override
   protected Optional<Domain> loadFromDatabase(String domainName) {
     // Don't use the cache (avoid caching the same domain twice). Do use the replica SQL instance.
-    Optional<Domain> possibleDomain =
-        Optional.ofNullable(
-            ForeignKeyUtils.loadMostRecentResourceObjects(
-                    Domain.class, ImmutableList.of(domainName), true)
-                .get(domainName));
-    Instant now = clock.now();
-    return possibleDomain
-        .filter(domain -> now.isBefore(domain.getDeletionTime()))
-        .map(domain -> domain.cloneProjectedAtTime(now));
+    return Optional.ofNullable(
+        ForeignKeyUtils.loadMostRecentResourceObjects(
+                Domain.class, ImmutableList.of(domainName), true)
+            .get(domainName));
   }
 
   @Override

core/src/main/java/google/registry/cache/MultilayerEppResourceCache.java

@@ -18,7 +18,9 @@ import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
 import google.registry.config.RegistryConfig;
 import google.registry.model.EppResource;
+import google.registry.util.Clock;
 import java.time.Duration;
+import java.time.Instant;
 import java.util.Optional;
 
 /**
@@ -36,11 +38,13 @@ public abstract class MultilayerEppResourceCache<V extends EppResource> {
           .build();
 
   private final SimplifiedJedisClient jedisClient;
+  private final Clock clock;
   private final CacheMetrics cacheMetrics;
 
   protected MultilayerEppResourceCache(
-      SimplifiedJedisClient jedisClient, CacheMetrics cacheMetrics) {
+      SimplifiedJedisClient jedisClient, Clock clock, CacheMetrics cacheMetrics) {
     this.jedisClient = jedisClient;
+    this.clock = clock;
     this.cacheMetrics = cacheMetrics;
   }
 
@@ -50,7 +54,16 @@ public abstract class MultilayerEppResourceCache<V extends EppResource> {
     return true;
   }
 
+  @SuppressWarnings("unchecked")
   protected Optional<V> loadFromCaches(Class<V> clazz, String key) {
+    Instant now = clock.now();
+    return (Optional<V>)
+        loadFromCachesInternal(clazz, key)
+            .filter(v -> now.isBefore(v.getDeletionTime()))
+            .map(v -> v.cloneProjectedAtTime(now));
+  }
+
+  private Optional<V> loadFromCachesInternal(Class<V> clazz, String key) {
     // hopefully the resource is in the local cache
     Optional<V> possibleValue = Optional.ofNullable(localCache.getIfPresent(key));
     if (possibleValue.isPresent()) {

core/src/main/java/google/registry/cache/MultilayerHostCache.java

@@ -18,6 +18,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 
 import google.registry.model.host.Host;
 import google.registry.persistence.VKey;
+import google.registry.util.Clock;
 import java.util.Optional;
 
 /**
@@ -27,8 +28,9 @@ import java.util.Optional;
  */
 public class MultilayerHostCache extends MultilayerEppResourceCache<Host> implements HostCache {
 
-  public MultilayerHostCache(SimplifiedJedisClient jedisClient, CacheMetrics cacheMetrics) {
-    super(jedisClient, cacheMetrics);
+  public MultilayerHostCache(
+      SimplifiedJedisClient jedisClient, Clock clock, CacheMetrics cacheMetrics) {
+    super(jedisClient, clock, cacheMetrics);
   }
 
   @Override

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -16,6 +16,7 @@ package google.registry.config;
 
 import static com.google.common.base.Suppliers.memoize;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSortedMap.toImmutableSortedMap;
 import static google.registry.config.ConfigUtils.makeUrl;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
@@ -38,6 +39,7 @@ import google.registry.dns.ReadDnsRefreshRequestsAction;
 import google.registry.model.common.DnsRefreshRequest;
 import google.registry.mosapi.MosApiClient;
 import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.rde.RdeUploadUrl;
 import google.registry.request.Action.Service;
 import google.registry.util.RegistryEnvironment;
 import google.registry.util.YamlUtils;
@@ -48,6 +50,7 @@ import jakarta.mail.internet.AddressException;
 import jakarta.mail.internet.InternetAddress;
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
+import java.math.BigDecimal;
 import java.net.URI;
 import java.net.URL;
 import java.time.DayOfWeek;
@@ -58,6 +61,7 @@ import java.util.Optional;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import javax.annotation.Nullable;
+import org.joda.money.CurrencyUnit;
 
 /**
  * Central clearing-house for all configuration.
@@ -842,8 +846,8 @@ public final class RegistryConfig {
      */
     @Provides
     @Config("rdeUploadUrl")
-    public static URI provideRdeUploadUrl(RegistryConfigSettings config) {
-      return URI.create(config.rde.uploadUrl);
+    public static RdeUploadUrl provideRdeUploadUrl(RegistryConfigSettings config) {
+      return RdeUploadUrl.create(URI.create(config.rde.uploadUrl));
     }
 
     /**
@@ -1109,6 +1113,40 @@ public final class RegistryConfig {
       return config.registryPolicy.registryAdminClientId;
     }
 
+    /** Returns the total length of the Expiry Access Period. */
+    @Provides
+    @Config("domainExpiryAccessPeriodTotalLength")
+    public static Duration provideDomainExpiryAccessPeriodTotalLength(
+        RegistryConfigSettings config) {
+      return Duration.ofSeconds(config.registryPolicy.domainExpiryAccessPeriod.totalLengthSeconds);
+    }
+
+    /** Returns the length of each tier of the Expiry Access Period. */
+    @Provides
+    @Config("domainExpiryAccessPeriodTierLength")
+    public static Duration provideDomainExpiryAccessPeriodTierLength(
+        RegistryConfigSettings config) {
+      return Duration.ofSeconds(config.registryPolicy.domainExpiryAccessPeriod.tierLengthSeconds);
+    }
+
+    /** Returns a map of the fee for the first tier of the Expiry Access Period, by currency. */
+    @Provides
+    @Config("domainExpiryAccessPeriodInitialFee")
+    public static ImmutableMap<CurrencyUnit, BigDecimal> provideDomainExpiryAccessPeriodInitialFee(
+        RegistryConfigSettings config) {
+      return config.registryPolicy.domainExpiryAccessPeriod.initialFee.entrySet().stream()
+          .collect(toImmutableMap(entry -> CurrencyUnit.of(entry.getKey()), Entry::getValue));
+    }
+
+    /** Returns a map of the fee for the last tier of the Expiry Access Period, by currency. */
+    @Provides
+    @Config("domainExpiryAccessPeriodFinalFee")
+    public static ImmutableMap<CurrencyUnit, BigDecimal> provideDomainExpiryAccessPeriodFinalFee(
+        RegistryConfigSettings config) {
+      return config.registryPolicy.domainExpiryAccessPeriod.finalFee.entrySet().stream()
+          .collect(toImmutableMap(entry -> CurrencyUnit.of(entry.getKey()), Entry::getValue));
+    }
+
     @Singleton
     @Provides
     static RegistryConfigSettings provideRegistryConfigSettings() {

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -14,6 +14,7 @@
 
 package google.registry.config;
 
+import java.math.BigDecimal;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -94,6 +95,7 @@ public class RegistryConfigSettings {
     public String tmchCrlUrl;
     public String tmchMarksDbUrl;
     public String registryAdminClientId;
+    public DomainExpiryAccessPeriod domainExpiryAccessPeriod;
     public String premiumTermsExportDisclaimer;
     public String reservedTermsExportDisclaimer;
     public String rdapTos;
@@ -106,6 +108,13 @@ public class RegistryConfigSettings {
     public Set<String> noPollMessageOnDeletionRegistrarIds;
   }
 
+  public static class DomainExpiryAccessPeriod {
+    public long totalLengthSeconds;
+    public long tierLengthSeconds;
+    public Map<String, BigDecimal> initialFee;
+    public Map<String, BigDecimal> finalFee;
+  }
+
   /** Configuration for Hibernate. */
   public static class Hibernate {
     public boolean allowNestedTransactions;

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -88,6 +88,28 @@ registryPolicy:
   # registrar
   registryAdminClientId: TheRegistrar
 
+  # Configuration for the Expiry Access Period (XAP) that occurs immediately
+  # following completion of a domain's deletion. This needs to be enabled on a
+  # per-TLD basis as well.
+  domainExpiryAccessPeriod:
+    # The length of the total expiry access period; defaults to 10 days.
+    totalLengthSeconds: 864000
+    # The length of each tier during the expiry access period; defaults to 1
+    # hour. The XAP fee remains constant for the duration of each tier. The
+    # total length must be evenly divisible by the tier length, i.e. there
+    # should be a whole number of tiers all the same length.
+    tierLengthSeconds: 3600
+    # The initial fee for the first tier when the expiry access period starts,
+    # specified for each currency this registry platform uses.
+    initialFee:
+      USD: 100000
+      JPY: 10000000
+    # The final fee for the last tier when the expiry access period ends,
+    # specified for each currency this registry platform uses.
+    finalFee:
+      USD: 10
+      JPY: 1000
+
   # Disclaimer at the top of the exported premium terms list.
   premiumTermsExportDisclaimer: |
     This list contains domains for the TLD offered at a premium price. This

core/src/main/java/google/registry/flows/CookieSessionMetadata.java

@@ -19,7 +19,6 @@ import static java.nio.charset.StandardCharsets.US_ASCII;
 import com.google.common.base.Joiner;
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableSet;
-import com.google.common.flogger.FluentLogger;
 import com.google.common.io.BaseEncoding;
 import google.registry.request.Response;
 import jakarta.servlet.http.HttpServletRequest;
@@ -55,7 +54,6 @@ public class CookieSessionMetadata extends SessionMetadata {
       Pattern.compile("serviceExtensionUris=([^,\\s}]+)?");
   private static final Pattern FAILED_LOGIN_ATTEMPTS_PATTERN =
       Pattern.compile("failedLoginAttempts=([^,\\s]+)?");
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   private final Map<String, String> data = new HashMap<>();
 
@@ -66,7 +64,6 @@ public class CookieSessionMetadata extends SessionMetadata {
               Matcher matcher = COOKIE_PATTERN.matcher(cookie);
               if (matcher.find()) {
                 String sessionInfo = decode(matcher.group(1));
-                logger.atInfo().log("SESSION INFO: %s", sessionInfo);
                 matcher = REGISTRAR_ID_PATTERN.matcher(sessionInfo);
                 if (matcher.find()) {
                   String registrarId = matcher.group(1);

core/src/main/java/google/registry/flows/EppController.java

@@ -68,9 +68,12 @@ public final class EppController {
       try {
         eppInput = unmarshalEpp(EppInput.class, inputXmlBytes);
       } catch (EppException e) {
-        // Log the unmarshalling error, with the raw bytes (in base64) to help with debugging.
+        // Log the unmarshalling error, with the sanitized bytes (in base64) to help with debugging.
+        Optional<String> sanitizedXml = EppXmlSanitizer.sanitizeEppXmlIfValid(inputXmlBytes);
+        String xmlBytesToLog =
+            base64().encode(sanitizedXml.map(xml -> xml.getBytes(UTF_8)).orElse(inputXmlBytes));
         logger.atInfo().withCause(e).log(
-            "EPP request XML unmarshalling failed - \"%s\":\n%s\n%s\n%s\n%s",
+            "EPP request XML unmarshalling failed - \"%s\":\n%s\n%s",
             e.getMessage(),
             lazy(
                 () ->
@@ -83,12 +86,7 @@ public final class EppController {
                             "resultMessage",
                             e.getResult().getCode().msg,
                             "xmlBytes",
-                            base64().encode(inputXmlBytes)))),
-            LOG_SEPARATOR,
-            lazy(
-                () ->
-                    new String(inputXmlBytes, UTF_8)
-                        .trim()), // Charset decoding failures are swallowed.
+                            xmlBytesToLog))),
             LOG_SEPARATOR);
         // Return early by sending an error message, with no clTRID since we couldn't unmarshal it.
         eppMetricBuilder.setStatus(e.getResult().getCode());

core/src/main/java/google/registry/flows/EppXmlSanitizer.java

@@ -87,16 +87,22 @@ public class EppXmlSanitizer {
    *
    * <p>Also, an empty element will be formatted as {@code <tag></tag>} instead of {@code <tag/>}.
    */
-  public static String sanitizeEppXml(byte[] inputXmlBytes) {
+  public static Optional<String> sanitizeEppXmlIfValid(byte[] inputXmlBytes) {
     try {
       // Keep exactly one newline at end of sanitized string.
-      return CharMatcher.whitespace().trimTrailingFrom(sanitizeAndEncode(inputXmlBytes)) + "\n";
+      return Optional.of(
+          CharMatcher.whitespace().trimTrailingFrom(sanitizeAndEncode(inputXmlBytes)) + "\n");
     } catch (XMLStreamException | UnsupportedEncodingException e) {
       logger.atWarning().withCause(e).log("Failed to sanitize EPP XML message.");
-      return Base64.getMimeEncoder().encodeToString(inputXmlBytes);
+      return Optional.empty();
     }
   }
 
+  public static String sanitizeEppXml(byte[] inputXmlBytes) {
+    return sanitizeEppXmlIfValid(inputXmlBytes)
+        .orElseGet(() -> Base64.getMimeEncoder().encodeToString(inputXmlBytes));
+  }
+
   private static String sanitizeAndEncode(byte[] inputXmlBytes)
       throws XMLStreamException, UnsupportedEncodingException {
     XMLEventReader xmlEventReader =

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -46,6 +46,7 @@ import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.List;
 import java.util.Objects;
@@ -100,8 +101,30 @@ public final class ResourceFlowUtils {
 
   public static <R extends EppResource> void verifyResourceDoesNotExist(
       Class<R> clazz, String targetId, Instant now, String registrarId) throws EppException {
-    Optional<R> resource = ForeignKeyUtils.loadResource(clazz, targetId, now);
+    verifyResourceDoesNotExist(clazz, targetId, now, Duration.ZERO, registrarId);
+  }
+
+  /**
+   * Verifies that a resource with the specified type and id did not exist at the specified time.
+   *
+   * <p>This will throw an exception if the resource exists with a deletionTime greater than the
+   * specified time (i.e. a registrar is attempting to create a duplicate domain, host, or contact).
+   * If the resource had existed within the specified lookback window, but is not active now, i.e.
+   * it is recently deleted, then don't throw an exception, but do return the recently deleted
+   * resource for further processing (this is used by the Expiry Access Period).
+   *
+   * <p>If there is no need to specially handle the situation of recently deleted resources, then
+   * simply pass a lookback duration of {@link Duration#ZERO}.
+   */
+  public static <R extends EppResource> Optional<R> verifyResourceDoesNotExist(
+      Class<R> clazz, String targetId, Instant now, Duration lookback, String registrarId)
+      throws EppException {
+    Instant startOfWindow = now.minus(lookback);
+    Optional<R> resource = ForeignKeyUtils.loadResource(clazz, targetId, startOfWindow);
     if (resource.isPresent()) {
+      if (resource.get().getDeletionTime().isBefore(now)) {
+        return resource;
+      }
       // These are similar exceptions, but we can track them internally as log-based metrics.
       if (Objects.equals(registrarId, resource.get().getPersistedCurrentSponsorRegistrarId())) {
         throw new ResourceAlreadyExistsForThisClientException(targetId);
@@ -109,6 +132,7 @@ public final class ResourceFlowUtils {
         throw new ResourceCreateContentionException(targetId);
       }
     }
+    return Optional.empty();
   }
 
   /** Check that the given AuthInfo is present for a resource being transferred. */

core/src/main/java/google/registry/flows/domain/DomainCheckFlow.java

@@ -25,6 +25,7 @@ import static google.registry.flows.domain.DomainFlowUtils.checkHasBillingAccoun
 import static google.registry.flows.domain.DomainFlowUtils.getReservationTypes;
 import static google.registry.flows.domain.DomainFlowUtils.handleFeeRequest;
 import static google.registry.flows.domain.DomainFlowUtils.isAnchorTenant;
+import static google.registry.flows.domain.DomainFlowUtils.isDomainEligibleForXap;
 import static google.registry.flows.domain.DomainFlowUtils.isRegisterBsaCreate;
 import static google.registry.flows.domain.DomainFlowUtils.isReserved;
 import static google.registry.flows.domain.DomainFlowUtils.isValidReservedCreate;
@@ -75,6 +76,7 @@ import google.registry.model.eppoutput.CheckData.DomainCheck;
 import google.registry.model.eppoutput.CheckData.DomainCheckData;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.eppoutput.EppResponse.ResponseExtension;
+import google.registry.model.registrar.Registrar;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldState;
@@ -82,6 +84,7 @@ import google.registry.model.tld.label.ReservationType;
 import google.registry.persistence.VKey;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Collection;
 import java.util.HashSet;
@@ -138,6 +141,10 @@ public final class DomainCheckFlow implements TransactionalFlow {
   @Config("maxChecks")
   int maxChecks;
 
+  @Inject
+  @Config("domainExpiryAccessPeriodTotalLength")
+  Duration domainExpiryAccessPeriodTotalLength;
+
   @Inject @Superuser boolean isSuperuser;
   @Inject Clock clock;
   @Inject EppResponse.Builder responseBuilder;
@@ -249,7 +256,14 @@ public final class DomainCheckFlow implements TransactionalFlow {
       return Optional.of(e.getMessage());
     }
     return getMessageForCheckWithToken(
-        idn, existingDomains, bsaBlockedDomainNames, tldStates, token);
+        idn, existingDomains, bsaBlockedDomainNames, tldStates, token, now);
+  }
+
+  private static Optional<Domain> loadDomainIfInXap(
+      String domainName, Instant now, Duration domainExpiryAccessPeriodTotalLength) {
+    return ForeignKeyUtils.loadResource(
+            Domain.class, domainName, now.minus(domainExpiryAccessPeriodTotalLength))
+        .filter(domain -> isDomainEligibleForXap(domain, Tld.get(domain.getTld()), now));
   }
 
   private Optional<String> getMessageForCheckWithToken(
@@ -257,10 +271,18 @@ public final class DomainCheckFlow implements TransactionalFlow {
       ImmutableMap<String, VKey<Domain>> existingDomains,
       ImmutableSet<InternetDomainName> bsaBlockedDomains,
       ImmutableMap<String, TldState> tldStates,
-      Optional<AllocationToken> allocationToken) {
+      Optional<AllocationToken> allocationToken,
+      Instant now) {
     if (existingDomains.containsKey(domainName.toString())) {
       return Optional.of("In use");
     }
+    Tld tld = Tld.get(domainName.parent().toString());
+    if (tld.getExpiryAccessPeriodModeAt(now) == Tld.ExpiryAccessPeriodMode.ENABLED
+        && !Registrar.loadByRegistrarIdCached(registrarId).get().getExpiryAccessPeriodEnabled()
+        && loadDomainIfInXap(domainName.toString(), now, domainExpiryAccessPeriodTotalLength)
+            .isPresent()) {
+      return Optional.of("Reserved");
+    }
     TldState tldState = tldStates.get(domainName.parent().toString());
     if (isReserved(domainName, START_DATE_SUNRISE.equals(tldState))) {
       if (!isValidReservedCreate(domainName, allocationToken)
@@ -339,16 +361,27 @@ public final class DomainCheckFlow implements TransactionalFlow {
                   .build());
           continue;
         }
+        Optional<Domain> domainForFee = domain;
+        boolean isAvailable = availableDomains.contains(domainName);
+        if (isAvailable
+            && feeCheckItem.getCommandName().equals(FeeQueryCommandExtensionItem.CommandName.CREATE)
+            && tld.getExpiryAccessPeriodModeAt(now) == Tld.ExpiryAccessPeriodMode.ENABLED) {
+          Optional<Domain> recentlyDeletedDomain =
+              loadDomainIfInXap(domainName, now, domainExpiryAccessPeriodTotalLength);
+          if (recentlyDeletedDomain.isPresent()) {
+            domainForFee = recentlyDeletedDomain;
+          }
+        }
         handleFeeRequest(
             feeCheckItem,
             builder,
             domainNames.get(domainName),
-            domain,
+            domainForFee,
             feeCheck.getCurrency(),
             now,
             pricingLogic,
             token,
-            availableDomains.contains(domainName),
+            isAvailable,
             recurrences.getOrDefault(domainName, null));
         // In the case of a registrar that is running a tiered pricing promotion, we issue two
         // responses for the CREATE fee check command: one (the default response) with the

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -18,6 +18,7 @@ import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.dns.DnsUtils.requestDomainDnsRefresh;
 import static google.registry.flows.FlowUtils.persistEntityChanges;
 import static google.registry.flows.FlowUtils.validateRegistrarIsLoggedIn;
+import static google.registry.flows.ResourceFlowUtils.verifyResourceDoesNotExist;
 import static google.registry.flows.domain.DomainFlowUtils.COLLISION_MESSAGE;
 import static google.registry.flows.domain.DomainFlowUtils.checkAllowedAccessToTld;
 import static google.registry.flows.domain.DomainFlowUtils.checkHasBillingAccount;
@@ -25,6 +26,7 @@ import static google.registry.flows.domain.DomainFlowUtils.cloneAndLinkReference
 import static google.registry.flows.domain.DomainFlowUtils.createFeeCreateResponse;
 import static google.registry.flows.domain.DomainFlowUtils.getReservationTypes;
 import static google.registry.flows.domain.DomainFlowUtils.isAnchorTenant;
+import static google.registry.flows.domain.DomainFlowUtils.isDomainEligibleForXap;
 import static google.registry.flows.domain.DomainFlowUtils.isReserved;
 import static google.registry.flows.domain.DomainFlowUtils.isValidReservedCreate;
 import static google.registry.flows.domain.DomainFlowUtils.validateCreateCommandContactsAndNameservers;
@@ -58,6 +60,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.net.InternetDomainName;
 import google.registry.config.RegistryConfig;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.CommandUseErrorException;
 import google.registry.flows.EppException.ParameterValuePolicyErrorException;
@@ -71,6 +74,7 @@ import google.registry.flows.custom.DomainCreateFlowCustomLogic;
 import google.registry.flows.custom.DomainCreateFlowCustomLogic.BeforeResponseParameters;
 import google.registry.flows.custom.DomainCreateFlowCustomLogic.BeforeResponseReturnData;
 import google.registry.flows.custom.EntityChanges;
+import google.registry.flows.domain.DomainFlowUtils.DomainReservedException;
 import google.registry.flows.domain.DomainFlowUtils.RegistrantProhibitedException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils;
 import google.registry.flows.exceptions.ContactsProhibitedException;
@@ -107,6 +111,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.PendingActionNotificationResponse.DomainPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.poll.PollMessage.Autorenew;
+import google.registry.model.registrar.Registrar;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;
@@ -123,6 +128,7 @@ import jakarta.inject.Inject;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
+import org.joda.money.Money;
 
 /**
  * An EPP flow that creates a new domain resource.
@@ -219,6 +225,10 @@ public final class DomainCreateFlow implements MutatingFlow {
   @Inject DomainPricingLogic pricingLogic;
   @Inject DomainDeletionTimeCache domainDeletionTimeCache;
 
+  @Inject
+  @Config("domainExpiryAccessPeriodTotalLength")
+  Duration domainExpiryAccessPeriodTotalLength;
+
   @Inject
   DomainCreateFlow() {}
 
@@ -245,6 +255,13 @@ public final class DomainCreateFlow implements MutatingFlow {
     InternetDomainName domainName = validateDomainName(command.getDomainName());
     String domainLabel = domainName.parts().getFirst();
     Tld tld = Tld.get(domainName.parent().toString());
+    Duration lookback =
+        tld.getExpiryAccessPeriodModeAt(now) == Tld.ExpiryAccessPeriodMode.ENABLED
+            ? domainExpiryAccessPeriodTotalLength
+            : Duration.ZERO;
+    Optional<Domain> recentlyDeletedDomain =
+        verifyResourceDoesNotExist(Domain.class, targetId, now, lookback, registrarId)
+            .filter(domain -> isDomainEligibleForXap(domain, tld, now));
     validateCreateCommandContactsAndNameservers(command, tld, domainName);
     TldState tldState = tld.getTldState(now);
     Optional<LaunchCreateExtension> launchCreate =
@@ -280,6 +297,10 @@ public final class DomainCreateFlow implements MutatingFlow {
     if (!isSuperuser) {
       checkAllowedAccessToTld(registrarId, tld.getTldStr());
       checkHasBillingAccount(registrarId, tld.getTldStr());
+      if (recentlyDeletedDomain.isPresent()
+          && !Registrar.loadByRegistrarIdCached(registrarId).get().getExpiryAccessPeriodEnabled()) {
+        throw new DomainReservedException(domainName.toString());
+      }
       boolean isValidReservedCreate = isValidReservedCreate(domainName, allocationToken);
       ClaimsList claimsList = ClaimsListDao.get();
       verifyIsGaOrSpecialCase(
@@ -327,7 +348,14 @@ public final class DomainCreateFlow implements MutatingFlow {
         eppInput.getSingleExtension(FeeCreateCommandExtension.class);
     FeesAndCredits feesAndCredits =
         pricingLogic.getCreatePrice(
-            tld, targetId, now, years, isAnchorTenant, isSunriseCreate, allocationToken);
+            tld,
+            targetId,
+            now,
+            recentlyDeletedDomain,
+            years,
+            isAnchorTenant,
+            isSunriseCreate,
+            allocationToken);
     validateFeeChallenge(feeCreate, feesAndCredits, defaultTokenUsed);
     Optional<SecDnsCreateExtension> secDnsCreate =
         validateSecDnsExtension(eppInput.getSingleExtension(SecDnsCreateExtension.class));
@@ -358,7 +386,15 @@ public final class DomainCreateFlow implements MutatingFlow {
     entitiesToInsert.add(createBillingEvent, autorenewBillingEvent, autorenewPollMessage);
     // Bill for EAP cost, if any.
     if (!feesAndCredits.getEapCost().isZero()) {
-      entitiesToInsert.add(createEapBillingEvent(feesAndCredits, createBillingEvent));
+      entitiesToInsert.add(
+          createAdditionalBillingEvent(
+              Reason.FEE_EARLY_ACCESS, feesAndCredits.getEapCost(), createBillingEvent));
+    }
+    // Bill for XAP cost, if any.
+    if (!feesAndCredits.getXapCost().isZero()) {
+      entitiesToInsert.add(
+          createAdditionalBillingEvent(
+              Reason.FEE_EXPIRY_ACCESS, feesAndCredits.getXapCost(), createBillingEvent));
     }
 
     ImmutableSet<ReservationType> reservationTypes = getReservationTypes(domainName);
@@ -434,7 +470,14 @@ public final class DomainCreateFlow implements MutatingFlow {
     FeesAndCredits responseFeesAndCredits =
         shouldShowDefaultPrice
             ? pricingLogic.getCreatePrice(
-                tld, targetId, now, years, isAnchorTenant, isSunriseCreate, Optional.empty())
+                tld,
+                targetId,
+                now,
+                recentlyDeletedDomain,
+                years,
+                isAnchorTenant,
+                isSunriseCreate,
+                Optional.empty())
             : feesAndCredits;
 
     BeforeResponseReturnData responseData =
@@ -656,14 +699,14 @@ public final class DomainCreateFlow implements MutatingFlow {
     }
   }
 
-  private static BillingEvent createEapBillingEvent(
-      FeesAndCredits feesAndCredits, BillingEvent createBillingEvent) {
+  private static BillingEvent createAdditionalBillingEvent(
+      Reason reason, Money cost, BillingEvent createBillingEvent) {
     return new BillingEvent.Builder()
-        .setReason(Reason.FEE_EARLY_ACCESS)
+        .setReason(reason)
         .setTargetId(createBillingEvent.getTargetId())
         .setRegistrarId(createBillingEvent.getRegistrarId())
         .setPeriodYears(1)
-        .setCost(feesAndCredits.getEapCost())
+        .setCost(cost)
         .setEventTime(createBillingEvent.getEventTime())
         .setBillingTime(createBillingEvent.getBillingTime())
         .setFlags(createBillingEvent.getFlags())

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -642,6 +642,7 @@ public class DomainFlowUtils {
                       tld,
                       domainNameString,
                       now,
+                      domain,
                       years,
                       isAnchorTenant(domainName, allocationToken, Optional.empty()),
                       isSunrise,
@@ -765,6 +766,9 @@ public class DomainFlowUtils {
       if (!feesAndCredits.getEapCost().isZero()) {
         throw new FeesRequiredDuringEarlyAccessProgramException(feesAndCredits.getEapCost());
       }
+      if (!feesAndCredits.getXapCost().isZero()) {
+        throw new FeesRequiredDuringExpiryAccessPeriodException(feesAndCredits.getXapCost());
+      }
       if (feesAndCredits.getTotalCost().isZero() || !feesAndCredits.isFeeExtensionRequired()) {
         return;
       }
@@ -1168,6 +1172,32 @@ public class DomainFlowUtils {
         .getResultList();
   }
 
+  /**
+   * Returns true if the domain was deleted during its Add Grace Period (AGP).
+   *
+   * <p>Per policy, domains deleted during AGP are not subject to Expiry Access Period (XAP) fees or
+   * reservation restrictions upon subsequent re-registration.
+   */
+  public static boolean wasDeletedDuringAddGracePeriod(Domain domain, Tld tld) {
+    if (domain.getCreationTime() == null || domain.getDeletionTime() == null) {
+      return false;
+    }
+    return !domain
+        .getDeletionTime()
+        .isAfter(domain.getCreationTime().plus(tld.getAddGracePeriodLength()));
+  }
+
+  /**
+   * Returns true if the domain was deleted before {@code now} and is eligible for Expiry Access
+   * Period (XAP) evaluation.
+   */
+  public static boolean isDomainEligibleForXap(Domain domain, Tld tld, Instant now) {
+    if (domain.getDeletionTime() == null || !domain.getDeletionTime().isBefore(now)) {
+      return false;
+    }
+    return !wasDeletedDuringAddGracePeriod(domain, tld);
+  }
+
   /** Resource linked to this domain does not exist. */
   static class LinkedResourcesDoNotExistException extends ObjectDoesNotExistException {
     public LinkedResourcesDoNotExistException(Class<?> type, ImmutableSet<String> resourceIds) {
@@ -1355,6 +1385,18 @@ public class DomainFlowUtils {
     }
   }
 
+  /** Fees must be explicitly acknowledged when creating domains during the Expiry Access Period. */
+  static class FeesRequiredDuringExpiryAccessPeriodException
+      extends RequiredParameterMissingException {
+
+    public FeesRequiredDuringExpiryAccessPeriodException(Money expectedFee) {
+      super(
+          "Fees must be explicitly acknowledged when creating domains "
+              + "during the Expiry Access Period. The XAP fee is: "
+              + expectedFee);
+    }
+  }
+
   /** The 'grace-period', 'applied' and 'refundable' fields are disallowed by server policy. */
   static class UnsupportedFeeAttributeException extends UnimplementedOptionException {
     UnsupportedFeeAttributeException() {

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -15,13 +15,18 @@
 package google.registry.flows.domain;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.flows.domain.DomainFlowUtils.isDomainEligibleForXap;
 import static google.registry.flows.domain.DomainFlowUtils.zeroInCurrency;
 import static google.registry.flows.domain.token.AllocationTokenFlowUtils.discountTokenInvalidForPremiumName;
 import static google.registry.pricing.PricingEngineProxy.getPricesForDomainName;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;
 
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Range;
+import com.google.common.flogger.FluentLogger;
 import com.google.common.net.InternetDomainName;
 import google.registry.config.RegistryConfig;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.EppException;
 import google.registry.flows.custom.DomainPricingCustomLogic;
 import google.registry.flows.custom.DomainPricingCustomLogic.CreatePriceParameters;
@@ -31,6 +36,7 @@ import google.registry.flows.custom.DomainPricingCustomLogic.TransferPriceParame
 import google.registry.flows.custom.DomainPricingCustomLogic.UpdatePriceParameters;
 import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.domain.Domain;
 import google.registry.model.domain.fee.BaseFee;
 import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
@@ -40,7 +46,9 @@ import google.registry.model.domain.token.AllocationToken.TokenBehavior;
 import google.registry.model.pricing.PremiumPricingEngine.DomainPrices;
 import google.registry.model.tld.Tld;
 import jakarta.inject.Inject;
+import java.math.BigDecimal;
 import java.math.RoundingMode;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
 import javax.annotation.Nullable;
@@ -54,11 +62,28 @@ import org.joda.money.Money;
  */
 public final class DomainPricingLogic {
 
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
   private final DomainPricingCustomLogic customLogic;
+  private final Duration expiryAccessPeriodTotalLength;
+  private final Duration expiryAccessPeriodTierLength;
+  private final ImmutableMap<CurrencyUnit, BigDecimal> expiryAccessPeriodInitialFee;
+  private final ImmutableMap<CurrencyUnit, BigDecimal> expiryAccessPeriodFinalFee;
 
   @Inject
-  public DomainPricingLogic(DomainPricingCustomLogic customLogic) {
+  public DomainPricingLogic(
+      DomainPricingCustomLogic customLogic,
+      @Config("domainExpiryAccessPeriodTotalLength") Duration expiryAccessPeriodTotalLength,
+      @Config("domainExpiryAccessPeriodTierLength") Duration expiryAccessPeriodTierLength,
+      @Config("domainExpiryAccessPeriodInitialFee")
+          ImmutableMap<CurrencyUnit, BigDecimal> expiryAccessPeriodInitialFee,
+      @Config("domainExpiryAccessPeriodFinalFee")
+          ImmutableMap<CurrencyUnit, BigDecimal> expiryAccessPeriodFinalFee) {
     this.customLogic = customLogic;
+    this.expiryAccessPeriodTotalLength = expiryAccessPeriodTotalLength;
+    this.expiryAccessPeriodTierLength = expiryAccessPeriodTierLength;
+    this.expiryAccessPeriodInitialFee = expiryAccessPeriodInitialFee;
+    this.expiryAccessPeriodFinalFee = expiryAccessPeriodFinalFee;
   }
 
   /**
@@ -71,35 +96,23 @@ public final class DomainPricingLogic {
       Tld tld,
       String domainName,
       Instant dateTime,
+      Optional<Domain> recentlyDeletedDomain,
       int years,
       boolean isAnchorTenant,
       boolean isSunriseCreate,
       Optional<AllocationToken> allocationToken)
       throws EppException {
     CurrencyUnit currency = tld.getCurrency();
-
-    BaseFee createFee;
-    // Domain create cost is always zero for anchor tenants
-    if (isAnchorTenant) {
-      createFee = Fee.create(zeroInCurrency(currency), FeeType.CREATE, false);
-    } else {
-      DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
-      if (allocationToken.isPresent()) {
-        // Handle any special NONPREMIUM / SPECIFIED cases configured in the token
-        domainPrices =
-            applyTokenToDomainPrices(domainPrices, tld, dateTime, years, allocationToken.get());
-      }
-      Money domainCreateCost =
-          getDomainCreateCostWithDiscount(domainPrices, years, allocationToken, tld);
-      // Apply a sunrise discount if configured and applicable
-      if (isSunriseCreate) {
-        domainCreateCost =
-            domainCreateCost.multipliedBy(
-                1.0d - RegistryConfig.getSunriseDomainCreateDiscount(), RoundingMode.HALF_EVEN);
-      }
-      createFee =
-          Fee.create(domainCreateCost.getAmount(), FeeType.CREATE, domainPrices.isPremium());
-    }
+    Fee createFee =
+        computeCreateFee(
+            tld,
+            domainName,
+            dateTime,
+            years,
+            isAnchorTenant,
+            isSunriseCreate,
+            allocationToken,
+            currency);
 
     // Create fees for the cost and the EAP fee, if any.
     Fee eapFee = tld.getEapFeeFor(dateTime);
@@ -109,6 +122,7 @@ public final class DomainPricingLogic {
     if (!isAnchorTenant && !eapFee.hasZeroCost()) {
       feesBuilder.addFeeOrCredit(eapFee);
     }
+    maybeAddXapFee(tld, dateTime, recentlyDeletedDomain, currency, feesBuilder);
 
     // Apply custom logic to the create fee, if any.
     return customLogic.customizeCreatePrice(
@@ -121,6 +135,113 @@ public final class DomainPricingLogic {
             .build());
   }
 
+  private Fee computeCreateFee(
+      Tld tld,
+      String domainName,
+      Instant dateTime,
+      int years,
+      boolean isAnchorTenant,
+      boolean isSunriseCreate,
+      Optional<AllocationToken> allocationToken,
+      CurrencyUnit currency)
+      throws EppException {
+    // Domain create cost is always zero for anchor tenants
+    if (isAnchorTenant) {
+      return Fee.create(zeroInCurrency(currency), FeeType.CREATE, false);
+    }
+    DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
+    if (allocationToken.isPresent()) {
+      // Handle any special NONPREMIUM / SPECIFIED cases configured in the token
+      domainPrices =
+          applyTokenToDomainPrices(domainPrices, tld, dateTime, years, allocationToken.get());
+    }
+    Money domainCreateCost =
+        getDomainCreateCostWithDiscount(domainPrices, years, allocationToken, tld);
+    // Apply a sunrise discount if configured and applicable
+    if (isSunriseCreate) {
+      domainCreateCost =
+          domainCreateCost.multipliedBy(
+              1.0d - RegistryConfig.getSunriseDomainCreateDiscount(), RoundingMode.HALF_EVEN);
+    }
+    return Fee.create(domainCreateCost.getAmount(), FeeType.CREATE, domainPrices.isPremium());
+  }
+
+  private void maybeAddXapFee(
+      Tld tld,
+      Instant dateTime,
+      Optional<Domain> recentlyDeletedDomain,
+      CurrencyUnit currency,
+      FeesAndCredits.Builder feesBuilder) {
+    if (tld.getExpiryAccessPeriodModeAt(dateTime) == Tld.ExpiryAccessPeriodMode.ENABLED
+        && recentlyDeletedDomain.isPresent()
+        && isDomainEligibleForXap(recentlyDeletedDomain.get(), tld, dateTime)) {
+      Optional<Fee> xapFee =
+          getXapFeeFor(dateTime, recentlyDeletedDomain.get().getDeletionTime(), currency);
+      xapFee.ifPresent(
+          fee -> {
+            feesBuilder.addFeeOrCredit(fee);
+            if (!fee.hasZeroCost()) {
+              feesBuilder.setFeeExtensionRequired(true);
+            }
+          });
+    }
+  }
+
+  /**
+   * Calculates and returns the Expiry Access Fee for a recently deleted domain at the given time.
+   */
+  Optional<Fee> getXapFeeFor(Instant dateTime, Instant deletionTime, CurrencyUnit currency) {
+    Duration elapsedTimeInXap = Duration.between(deletionTime, dateTime);
+    if (!expiryAccessPeriodInitialFee.containsKey(currency)
+        || !expiryAccessPeriodFinalFee.containsKey(currency)) {
+      // If the XAP schedule hasn't been configured in YAML for the currency this TLD uses, log the
+      // error and then short-circuit return (to allow the EPP flow to continue normally).
+      logger.atSevere().log(
+          "Expiry Access Period configuration is lacking initial or final fees for currency %s.",
+          currency);
+      return Optional.empty();
+    }
+
+    // Determine which tier the current time falls into (0-indexed).
+    long tier = elapsedTimeInXap.toMillis() / expiryAccessPeriodTierLength.toMillis();
+    long numTiers =
+        expiryAccessPeriodTotalLength.toMillis() / expiryAccessPeriodTierLength.toMillis();
+    if (tier < 0 || tier >= numTiers) {
+      return Optional.empty();
+    }
+
+    // Calculate the parameters for the geometric sequence: XAP fee = initialFee * ratio ^ tier.
+    BigDecimal xapFee;
+    if (expiryAccessPeriodInitialFee.get(currency).signum() == 0 || numTiers <= 1 || tier == 0) {
+      xapFee =
+          expiryAccessPeriodInitialFee
+              .get(currency)
+              .setScale(currency.getDecimalPlaces(), RoundingMode.HALF_EVEN);
+    } else {
+      double base =
+          expiryAccessPeriodFinalFee.get(currency).doubleValue()
+              / expiryAccessPeriodInitialFee.get(currency).doubleValue();
+      double exponent = 1.0 / (numTiers - 1.0);
+      BigDecimal ratio = BigDecimal.valueOf(Math.pow(base, exponent));
+      BigDecimal fee = expiryAccessPeriodInitialFee.get(currency).multiply(ratio.pow((int) tier));
+      xapFee = fee.setScale(currency.getDecimalPlaces(), RoundingMode.HALF_EVEN);
+    }
+
+    Range<Instant> validPeriod =
+        Range.closedOpen(
+            deletionTime.plus(expiryAccessPeriodTierLength.multipliedBy(tier)),
+            deletionTime.plus(expiryAccessPeriodTierLength.multipliedBy(tier + 1)));
+    return Optional.of(
+        Fee.create(
+            xapFee,
+            FeeType.XAP,
+            // An XAP fee does not count as premium -- it's a separate one-time fee, independent of
+            // which the domain is separately considered standard vs premium.
+            false,
+            validPeriod,
+            validPeriod.upperEndpoint()));
+  }
+
   /** Returns a new renewal cost for the pricer. */
   public FeesAndCredits getRenewPrice(
       Tld tld,

core/src/main/java/google/registry/flows/domain/FeesAndCredits.java

@@ -77,6 +77,11 @@ public class FeesAndCredits extends ImmutableObject implements Buildable {
     return getTotalCostForType(FeeType.EAP);
   }
 
+  /** Returns the XAP cost for the event. */
+  public Money getXapCost() {
+    return getTotalCostForType(FeeType.XAP);
+  }
+
   /** Returns the renew cost for the event. */
   public Money getRenewCost() {
     return getTotalCostForType(FeeType.RENEW);

core/src/main/java/google/registry/flows/domain/token/AllocationTokenFlowUtils.java

@@ -242,7 +242,14 @@ public class AllocationTokenFlowUtils {
       case CREATE ->
           pricingLogic
               .getCreatePrice(
-                  tld, domainName, now, yearsForAction, false, false, Optional.of(token))
+                  tld,
+                  domainName,
+                  now,
+                  Optional.empty(),
+                  yearsForAction,
+                  false,
+                  false,
+                  Optional.of(token))
               .getTotalCost()
               .getAmount();
       case RENEW ->

core/src/main/java/google/registry/gcs/GcsUtils.java

@@ -14,12 +14,15 @@
 
 package google.registry.gcs;
 
+import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.Iterables.getLast;
 
 import com.google.cloud.storage.Blob;
 import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.BlobInfo;
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo;
 import com.google.cloud.storage.Storage;
 import com.google.cloud.storage.Storage.BlobListOption;
 import com.google.cloud.storage.StorageException;
@@ -33,12 +36,14 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.util.GoogleCredentialsBundle;
+import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.Serializable;
 import java.nio.channels.Channels;
+import java.util.concurrent.ConcurrentHashMap;
 import javax.annotation.CheckReturnValue;
 
 /**
@@ -50,6 +55,8 @@ public class GcsUtils implements Serializable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
+  private static final ConcurrentHashMap<String, Boolean> PAP_CACHE = new ConcurrentHashMap<>();
+
   private static final ImmutableMap<String, MediaType> EXTENSIONS =
       new ImmutableMap.Builder<String, MediaType>()
           .put("ghostryde", MediaType.APPLICATION_BINARY)
@@ -85,6 +92,7 @@ public class GcsUtils implements Serializable {
   /** Opens a GCS file for writing as an {@link OutputStream}, overwriting existing files. */
   @CheckReturnValue
   public OutputStream openOutputStream(BlobId blobId) {
+    verifyPublicAccessPrevention(blobId.getBucket());
     return Channels.newOutputStream(storage().writer(createBlobInfo(blobId)));
   }
 
@@ -94,6 +102,7 @@ public class GcsUtils implements Serializable {
    */
   @CheckReturnValue
   public OutputStream openOutputStream(BlobId blobId, ImmutableMap<String, String> metadata) {
+    verifyPublicAccessPrevention(blobId.getBucket());
     return Channels.newOutputStream(
         storage().writer(BlobInfo.newBuilder(blobId).setMetadata(metadata).build()));
   }
@@ -105,6 +114,7 @@ public class GcsUtils implements Serializable {
 
   /** Creates a GCS file with the given byte contents and metadata, overwriting existing files. */
   public void createFromBytes(BlobInfo blobInfo, byte[] bytes) throws StorageException {
+    verifyPublicAccessPrevention(blobInfo.getBucket());
     storage().create(blobInfo, bytes);
   }
 
@@ -120,6 +130,7 @@ public class GcsUtils implements Serializable {
 
   /** Update file content type on existing GCS file */
   public void updateContentType(BlobId blobId, String contentType) throws StorageException {
+    verifyPublicAccessPrevention(blobId.getBucket());
     if (existsAndNotEmpty(blobId)) {
       Blob blob = storage().get(blobId);
       blob.toBuilder().setContentType(contentType).build().update();
@@ -154,12 +165,6 @@ public class GcsUtils implements Serializable {
     }
   }
 
-  /** Returns the user defined metadata of a GCS file if the file exists, or an empty map. */
-  public ImmutableMap<String, String> getMetadata(BlobId blobId) throws StorageException {
-    Blob blob = storage().get(blobId);
-    return blob == null ? ImmutableMap.of() : ImmutableMap.copyOf(blob.getMetadata());
-  }
-
   /**
    * Returns the {@link BlobInfo} of the given GCS file.
    *
@@ -179,6 +184,37 @@ public class GcsUtils implements Serializable {
     return builder.build();
   }
 
+  /**
+   * Asserts that Public Access Prevention (PAP) is enforced on the GCS bucket.
+   *
+   * @throws IllegalStateException if PAP is not ENFORCED.
+   */
+  @VisibleForTesting
+  void verifyPublicAccessPrevention(String bucketName) {
+    if (RegistryEnvironment.get() != RegistryEnvironment.PRODUCTION) {
+      return;
+    }
+    PAP_CACHE.computeIfAbsent(
+        bucketName,
+        name -> {
+          Bucket bucket = storage().get(name);
+          checkState(bucket != null, "Bucket %s does not exist", name);
+          BucketInfo.PublicAccessPrevention pap =
+              bucket.getIamConfiguration().getPublicAccessPrevention();
+          checkState(
+              pap == BucketInfo.PublicAccessPrevention.ENFORCED,
+              "Public Access Prevention is not enforced on bucket %s. Current state: %s",
+              name,
+              pap);
+          return true;
+        });
+  }
+
+  @VisibleForTesting
+  static void clearPapCache() {
+    PAP_CACHE.clear();
+  }
+
   // These two methods are needed to check whether serialization is done correctly in tests.
   @Override
   public boolean equals(Object obj) {

core/src/main/java/google/registry/model/EntityYamlUtils.java

@@ -21,6 +21,7 @@ import static google.registry.util.DateTimeUtils.parseInstant;
 
 import com.fasterxml.jackson.core.JsonGenerator;
 import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.DeserializationContext;
 import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.KeyDeserializer;
@@ -38,6 +39,7 @@ import com.google.common.collect.ImmutableSortedSet;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.model.domain.token.AllocationToken;
+import google.registry.model.tld.Tld.ExpiryAccessPeriodMode;
 import google.registry.model.tld.Tld.TldState;
 import google.registry.persistence.VKey;
 import java.io.IOException;
@@ -336,7 +338,8 @@ public class EntityYamlUtils {
     @Override
     public TimedTransitionProperty<TldState> deserialize(
         JsonParser jp, DeserializationContext context) throws IOException {
-      SortedMap<String, String> valueMap = jp.readValueAs(SortedMap.class);
+      SortedMap<String, String> valueMap =
+          jp.readValueAs(new TypeReference<SortedMap<String, String>>() {});
       return TimedTransitionProperty.fromValueMap(
           valueMap.keySet().stream()
               .collect(
@@ -347,6 +350,37 @@ public class EntityYamlUtils {
     }
   }
 
+  /**
+   * A custom JSON deserializer for a {@link TimedTransitionProperty} of {@link
+   * ExpiryAccessPeriodMode}.
+   */
+  public static class TimedTransitionPropertyExpiryAccessPeriodModeDeserializer
+      extends StdDeserializer<TimedTransitionProperty<ExpiryAccessPeriodMode>> {
+
+    public TimedTransitionPropertyExpiryAccessPeriodModeDeserializer() {
+      this(null);
+    }
+
+    public TimedTransitionPropertyExpiryAccessPeriodModeDeserializer(
+        Class<TimedTransitionProperty<ExpiryAccessPeriodMode>> t) {
+      super(t);
+    }
+
+    @Override
+    public TimedTransitionProperty<ExpiryAccessPeriodMode> deserialize(
+        JsonParser jp, DeserializationContext context) throws IOException {
+      SortedMap<String, String> valueMap =
+          jp.readValueAs(new TypeReference<SortedMap<String, String>>() {});
+      return TimedTransitionProperty.fromValueMap(
+          valueMap.keySet().stream()
+              .collect(
+                  toImmutableSortedMap(
+                      natural(),
+                      key -> parseInstant(key),
+                      key -> ExpiryAccessPeriodMode.valueOf(valueMap.get(key)))));
+    }
+  }
+
   /** A custom JSON deserializer for a {@link TimedTransitionProperty} of {@link Money}. */
   public static class TimedTransitionPropertyMoneyDeserializer
       extends StdDeserializer<TimedTransitionProperty<Money>> {
@@ -362,7 +396,8 @@ public class EntityYamlUtils {
     @Override
     public TimedTransitionProperty<Money> deserialize(JsonParser jp, DeserializationContext context)
         throws IOException {
-      SortedMap<String, LinkedHashMap<String, Object>> valueMap = jp.readValueAs(SortedMap.class);
+      SortedMap<String, LinkedHashMap<String, Object>> valueMap =
+          jp.readValueAs(new TypeReference<SortedMap<String, LinkedHashMap<String, Object>>>() {});
       return TimedTransitionProperty.fromValueMap(
           valueMap.keySet().stream()
               .collect(
@@ -392,7 +427,8 @@ public class EntityYamlUtils {
     @Override
     public TimedTransitionProperty<FeatureStatus> deserialize(
         JsonParser jp, DeserializationContext context) throws IOException {
-      SortedMap<String, String> valueMap = jp.readValueAs(SortedMap.class);
+      SortedMap<String, String> valueMap =
+          jp.readValueAs(new TypeReference<SortedMap<String, String>>() {});
       return TimedTransitionProperty.fromValueMap(
           valueMap.keySet().stream()
               .collect(

core/src/main/java/google/registry/model/OteStats.java

@@ -176,11 +176,12 @@ public class OteStats {
      * Check if the {@link HistoryEntry} type matches as well as the {@link EppInput} if supplied.
      */
     private boolean matches(HistoryEntry.Type historyType, Optional<EppInput> eppInput) {
-      if (eppInputFilter.isPresent() && eppInput.isPresent()) {
-        return typeFilter.test(historyType) && eppInputFilter.get().test(eppInput.get());
-      } else {
-        return typeFilter.test(historyType);
+      if (!typeFilter.test(historyType)) {
+        return false;
       }
+      return eppInputFilter
+          .map(filter -> eppInput.isPresent() && filter.test(eppInput.get()))
+          .orElse(true);
     }
   }
 

core/src/main/java/google/registry/model/billing/BillingBase.java

@@ -48,6 +48,7 @@ public abstract class BillingBase extends ImmutableObject
     @Deprecated // DO NOT USE THIS REASON. IT REMAINS BECAUSE OF HISTORICAL DATA. SEE b/31676071.
     ERROR(false),
     FEE_EARLY_ACCESS(true),
+    FEE_EXPIRY_ACCESS(true),
     RENEW(true),
     RESTORE(true),
     SERVER_STATUS(false),

core/src/main/java/google/registry/model/billing/BillingEvent.java

@@ -200,7 +200,7 @@ public class BillingEvent extends BillingBase {
         checkState(
             instance.reason.hasPeriodYears() == (instance.periodYears != null),
             "Period years must be set if and only if reason is "
-                + "CREATE, FEE_EARLY_ACCESS, RENEW, RESTORE or TRANSFER.");
+                + "CREATE, FEE_EARLY_ACCESS, FEE_EXPIRY_ACCESS, RENEW, RESTORE or TRANSFER.");
       }
       checkState(
           instance.getFlags().contains(Flag.SYNTHETIC) == (instance.syntheticCreationTime != null),

core/src/main/java/google/registry/model/billing/BillingRecurrence.java

@@ -191,6 +191,10 @@ public class BillingRecurrence extends BillingBase {
               ^ instance.renewalPrice == null,
           "Renewal price can have a value if and only if the renewal price behavior is"
               + " SPECIFIED");
+      if (instance.renewalPrice != null) {
+        checkArgument(
+            instance.renewalPrice.isPositiveOrZero(), "SPECIFIED renewal price cannot be negative");
+      }
       instance.recurrenceTimeOfYear = TimeOfYear.fromInstant(instance.eventTime);
       instance.recurrenceEndTime =
           Optional.ofNullable(instance.recurrenceEndTime).orElse(END_INSTANT);

core/src/main/java/google/registry/model/domain/fee/BaseFee.java

@@ -51,6 +51,10 @@ public abstract class BaseFee extends ImmutableObject {
   public enum FeeType {
     CREATE("create"),
     EAP("Early Access Period, fee expires: %s", "Early Access Period"),
+    /**
+     * A one-time fee for registering a recently dropped domain, during the Expiry Access Period.
+     */
+    XAP("Expiry Access Period, fee expires: %s", "Expiry Access Period"),
     RENEW("renew"),
     RESTORE("restore"),
     /**

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -462,6 +462,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
           getInstance().renewalPriceBehavior.equals(RenewalPriceBehavior.SPECIFIED)
               == (getInstance().renewalPrice != null),
           "renewalPrice must be specified iff renewalPriceBehavior is SPECIFIED");
+      if (getInstance().renewalPrice != null) {
+        checkArgument(
+            getInstance().renewalPrice.isPositiveOrZero(), "Renewal price cannot be negative");
+      }
 
       if (getInstance().tokenType.equals(TokenType.BULK_PRICING)) {
         checkArgument(

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -265,6 +265,18 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
   @Column(nullable = false)
   boolean blockPremiumNames;
 
+  /**
+   * Whether this registrar has opted into participating in the Expiry Access Period (XAP).
+   *
+   * <p>If this is false, any domain currently in XAP will appear as reserved/unavailable on checks
+   * and creates.
+   *
+   * <p>TODO(mcilwain): Drop the temporary database default for expiry_access_period_enabled in a
+   * subsequent schema migration once this code is deployed.
+   */
+  @Column(nullable = false)
+  boolean expiryAccessPeriodEnabled;
+
   // Authentication.
 
   /** X.509 PEM client certificate(s) used to authenticate registrar to EPP service. */
@@ -560,6 +572,10 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
     return blockPremiumNames;
   }
 
+  public boolean getExpiryAccessPeriodEnabled() {
+    return expiryAccessPeriodEnabled;
+  }
+
   public boolean getContactsRequireSyncing() {
     return contactsRequireSyncing;
   }
@@ -654,6 +670,7 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
         .put("whoisServer", getWhoisServer())
         .putListOfStrings("rdapBaseUrls", getRdapBaseUrls())
         .put("blockPremiumNames", blockPremiumNames)
+        .put("expiryAccessPeriodEnabled", expiryAccessPeriodEnabled)
         .put("url", url)
         .put("icannReferralEmail", getIcannReferralEmail())
         .put("driveFolderId", driveFolderId)
@@ -871,7 +888,10 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
     }
 
     public Builder setIpAddressAllowList(Iterable<CidrAddressBlock> ipAddressAllowList) {
-      getInstance().ipAddressAllowList = ImmutableList.copyOf(ipAddressAllowList);
+      getInstance().ipAddressAllowList =
+          ipAddressAllowList == null
+              ? ImmutableList.of()
+              : ImmutableList.copyOf(ipAddressAllowList);
       return this;
     }
 
@@ -915,6 +935,11 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
       return this;
     }
 
+    public Builder setExpiryAccessPeriodEnabled(boolean expiryAccessPeriodEnabled) {
+      getInstance().expiryAccessPeriodEnabled = expiryAccessPeriodEnabled;
+      return this;
+    }
+
     public Builder setUrl(String url) {
       getInstance().url = url;
       return this;
@@ -1030,6 +1055,11 @@ public class Registrar extends UpdateAutoTimestampEntity implements Buildable, J
     return tm().transact(() -> tm().loadAllOf(Registrar.class));
   }
 
+  /** Loads all registrar entities directly from the database, sorted by the given field names. */
+  public static Iterable<Registrar> loadAllSorted(String... sortFields) {
+    return tm().transact(() -> tm().loadAllOfSorted(Registrar.class, sortFields));
+  }
+
   /** Loads all registrar entities using an in-memory cache. */
   public static Iterable<Registrar> loadAllCached() {
     return CACHE_BY_REGISTRAR_ID.get().values();

core/src/main/java/google/registry/model/tld/Tld.java

@@ -56,6 +56,7 @@ import google.registry.model.EntityYamlUtils.OptionalDurationSerializer;
 import google.registry.model.EntityYamlUtils.OptionalStringSerializer;
 import google.registry.model.EntityYamlUtils.SortedEnumSetSerializer;
 import google.registry.model.EntityYamlUtils.SortedSetSerializer;
+import google.registry.model.EntityYamlUtils.TimedTransitionPropertyExpiryAccessPeriodModeDeserializer;
 import google.registry.model.EntityYamlUtils.TimedTransitionPropertyMoneyDeserializer;
 import google.registry.model.EntityYamlUtils.TimedTransitionPropertyTldStateDeserializer;
 import google.registry.model.EntityYamlUtils.TokenVKeyListDeserializer;
@@ -76,6 +77,7 @@ import google.registry.persistence.EntityCallbacksListener.RecursivePostUpdate;
 import google.registry.persistence.VKey;
 import google.registry.persistence.converter.AllocationTokenVkeyListUserType;
 import google.registry.persistence.converter.BillingCostTransitionUserType;
+import google.registry.persistence.converter.ExpiryAccessPeriodModeTransitionUserType;
 import google.registry.persistence.converter.TldStateTransitionUserType;
 import google.registry.tldconfig.idn.IdnTableEnum;
 import google.registry.util.Idn;
@@ -120,6 +122,8 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
 
   public static final boolean DEFAULT_ESCROW_ENABLED = false;
   public static final boolean DEFAULT_DNS_PAUSED = false;
+  public static final ExpiryAccessPeriodMode DEFAULT_EXPIRY_ACCESS_PERIOD_MODE =
+      ExpiryAccessPeriodMode.DISABLED;
   public static final Duration DEFAULT_ADD_GRACE_PERIOD = Duration.ofDays(5);
   public static final Duration DEFAULT_AUTO_RENEW_GRACE_PERIOD = Duration.ofDays(45);
   public static final Duration DEFAULT_REDEMPTION_GRACE_PERIOD = Duration.ofDays(30);
@@ -197,6 +201,12 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
     PDT
   }
 
+  /** The modes an Expiry Access Period (XAP) can be in at any given point in time. */
+  public enum ExpiryAccessPeriodMode {
+    DISABLED,
+    ENABLED
+  }
+
   /** Returns the TLD for a given TLD, throwing if none exists. */
   public static Tld get(String tld) {
     return CACHE.get(tld).orElseThrow(() -> new TldNotFoundException(tld));
@@ -426,6 +436,19 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
   @Column(nullable = false)
   boolean dnsPaused = DEFAULT_DNS_PAUSED;
 
+  /**
+   * Whether the Expiry Access Period following domain deletes is enabled for this TLD.
+   *
+   * <p>TODO(mcilwain): Once this Java code has been fully deployed to production, drop the
+   * temporary database-level DEFAULT constraint on the "expiry_access_period_transitions" column in
+   * the "Tld" table in a subsequent schema release.
+   */
+  @Column(nullable = false, columnDefinition = "hstore")
+  @Type(ExpiryAccessPeriodModeTransitionUserType.class)
+  @JsonDeserialize(using = TimedTransitionPropertyExpiryAccessPeriodModeDeserializer.class)
+  TimedTransitionProperty<ExpiryAccessPeriodMode> expiryAccessPeriodTransitions =
+      TimedTransitionProperty.withInitialValue(DEFAULT_EXPIRY_ACCESS_PERIOD_MODE);
+
   /**
    * The length of the add grace period for this TLD.
    *
@@ -634,6 +657,14 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
     return dnsPaused;
   }
 
+  public ExpiryAccessPeriodMode getExpiryAccessPeriodModeAt(Instant now) {
+    return expiryAccessPeriodTransitions.getValueAtTime(now);
+  }
+
+  public ImmutableSortedMap<Instant, ExpiryAccessPeriodMode> getExpiryAccessPeriodTransitions() {
+    return expiryAccessPeriodTransitions.toValueMap();
+  }
+
   @Nullable
   public String getDriveFolderId() {
     return driveFolderId;
@@ -814,6 +845,56 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
     return new Builder(clone(this));
   }
 
+  /** Checks the validity of the TLD object, for use during building or deserializing. */
+  public void validateState() {
+    checkArgument(tldStr != null, "No registry TLD specified");
+    // Check for canonical form by converting to an InternetDomainName and then back.
+    checkArgument(
+        InternetDomainName.isValid(tldStr)
+            && tldStr.equals(InternetDomainName.from(tldStr).toString()),
+        "Cannot create registry for TLD that is not a valid, canonical domain name");
+    // Check the validity of all TimedTransitionProperties to ensure that they have values for
+    // START_INSTANT.  The setters above have already checked this for new values, but also check
+    // here to catch cases where we loaded an invalid TimedTransitionProperty from the database
+    // and cloned it into a new builder, to block re-building a Tld in an invalid state.
+    tldStateTransitions.checkValidity();
+    createBillingCostTransitions.checkValidity();
+    renewBillingCostTransitions.checkValidity();
+    eapFeeSchedule.checkValidity();
+    expiryAccessPeriodTransitions.checkValidity();
+    // All costs must be in the expected currency.
+    checkArgumentNotNull(getCurrency(), "Currency must be set");
+    Predicate<Money> currencyCheck =
+        (Money money) -> money.getCurrencyUnit().equals(currency) && money.isPositiveOrZero();
+    checkArgument(
+        currencyCheck.test(getRestoreBillingCost()),
+        "Restore cost is negative or in the wrong currency");
+    checkArgument(
+        currencyCheck.test(getServerStatusChangeBillingCost()),
+        "Server status change cost is negative or in the wrong currency");
+    checkArgument(
+        currencyCheck.test(getRegistryLockOrUnlockBillingCost()),
+        "Registry lock/unlock cost is negative or in the wrong currency");
+    checkArgument(
+        getRenewBillingCostTransitions().values().stream().allMatch(currencyCheck),
+        "Some renew cost(s) are negative or in the wrong currency");
+    checkArgument(
+        getCreateBillingCostTransitions().values().stream().allMatch(currencyCheck),
+        "Some create cost(s) are negative or in the wrong currency");
+    checkArgument(
+        eapFeeSchedule.toValueMap().values().stream().allMatch(currencyCheck),
+        "Some EAP fee cost(s) are negative or in the wrong currency'");
+    checkArgumentNotNull(
+        pricingEngineClassName, "All registries must have a configured pricing engine");
+    checkArgument(
+        dnsWriters != null && !dnsWriters.isEmpty(),
+        "At least one DNS writer must be specified."
+            + " VoidDnsWriter can be used if DNS writing isn't desired");
+    checkArgument(
+        numDnsPublishLocks > 0,
+        "Number of DNS publish locks must be positive. Use 1 for TLD-wide locks.");
+  }
+
   /** A builder for constructing {@link Tld} objects, since they are immutable. */
   public static class Builder extends Buildable.Builder<Tld> {
     public Builder() {}
@@ -864,6 +945,13 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
       return this;
     }
 
+    public Builder setExpiryAccessPeriodTransitions(
+        ImmutableSortedMap<Instant, ExpiryAccessPeriodMode> transitionsMap) {
+      getInstance().expiryAccessPeriodTransitions =
+          TimedTransitionProperty.fromValueMap(transitionsMap);
+      return this;
+    }
+
     public Builder setDriveFolderId(String driveFolderId) {
       getInstance().driveFolderId = driveFolderId;
       return this;
@@ -966,10 +1054,6 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
 
     public Builder setCreateBillingCostTransitions(
         ImmutableSortedMap<Instant, Money> createCostsMap) {
-      checkArgumentNotNull(createCostsMap, "Create billing costs map cannot be null");
-      checkArgument(
-          createCostsMap.values().stream().allMatch(Money::isPositiveOrZero),
-          "Create billing cost cannot be negative");
       getInstance().createBillingCostTransitions =
           TimedTransitionProperty.fromValueMap(createCostsMap);
       return this;
@@ -1012,17 +1096,12 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
     }
 
     public Builder setRestoreBillingCost(Money amount) {
-      checkArgument(amount.isPositiveOrZero(), "restoreBillingCost cannot be negative");
       getInstance().restoreBillingCost = amount;
       return this;
     }
 
     public Builder setRenewBillingCostTransitions(
         ImmutableSortedMap<Instant, Money> renewCostsMap) {
-      checkArgumentNotNull(renewCostsMap, "Renew billing costs map cannot be null");
-      checkArgument(
-          renewCostsMap.values().stream().allMatch(Money::isPositiveOrZero),
-          "Renew billing cost cannot be negative");
       getInstance().renewBillingCostTransitions =
           TimedTransitionProperty.fromValueMap(renewCostsMap);
       return this;
@@ -1030,10 +1109,6 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
 
     /** Sets the EAP fee schedule for the TLD. */
     public Builder setEapFeeSchedule(ImmutableSortedMap<Instant, Money> eapFeeSchedule) {
-      checkArgumentNotNull(eapFeeSchedule, "EAP fee schedule cannot be null");
-      checkArgument(
-          eapFeeSchedule.values().stream().allMatch(Money::isPositiveOrZero),
-          "EAP fee cannot be negative");
       getInstance().eapFeeSchedule = TimedTransitionProperty.fromValueMap(eapFeeSchedule);
       return this;
     }
@@ -1051,14 +1126,11 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
     }
 
     public Builder setServerStatusChangeBillingCost(Money amount) {
-      checkArgument(
-          amount.isPositiveOrZero(), "Server status change billing cost cannot be negative");
       getInstance().serverStatusChangeBillingCost = amount;
       return this;
     }
 
     public Builder setRegistryLockOrUnlockBillingCost(Money amount) {
-      checkArgument(amount.isPositiveOrZero(), "Registry lock/unlock cost cannot be negative");
       getInstance().registryLockOrUnlockBillingCost = amount;
       return this;
     }
@@ -1120,58 +1192,10 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
 
     @Override
     public Tld build() {
-      final Tld instance = getInstance();
-      // Pick up the name of the associated TLD from the instance object.
-      String tldName = instance.tldStr;
-      checkArgument(tldName != null, "No registry TLD specified");
-      // Check for canonical form by converting to an InternetDomainName and then back.
-      checkArgument(
-          InternetDomainName.isValid(tldName)
-              && tldName.equals(InternetDomainName.from(tldName).toString()),
-          "Cannot create registry for TLD that is not a valid, canonical domain name");
-      // Check the validity of all TimedTransitionProperties to ensure that they have values for
-      // START_INSTANT.  The setters above have already checked this for new values, but also check
-      // here to catch cases where we loaded an invalid TimedTransitionProperty from the database
-      // and cloned it into a new builder, to block re-building a Tld in an invalid state.
-      instance.tldStateTransitions.checkValidity();
-      instance.createBillingCostTransitions.checkValidity();
-      instance.renewBillingCostTransitions.checkValidity();
-      instance.eapFeeSchedule.checkValidity();
-      // All costs must be in the expected currency.
-      checkArgumentNotNull(instance.getCurrency(), "Currency must be set");
-      checkArgument(
-          instance.getRestoreBillingCost().getCurrencyUnit().equals(instance.currency),
-          "Restore cost must be in the TLD's currency");
-      checkArgument(
-          instance.getServerStatusChangeBillingCost().getCurrencyUnit().equals(instance.currency),
-          "Server status change cost must be in the TLD's currency");
-      checkArgument(
-          instance.getRegistryLockOrUnlockBillingCost().getCurrencyUnit().equals(instance.currency),
-          "Registry lock/unlock cost must be in the TLD's currency");
-      Predicate<Money> currencyCheck =
-          (Money money) -> money.getCurrencyUnit().equals(instance.currency);
-      checkArgument(
-          instance.getRenewBillingCostTransitions().values().stream().allMatch(currencyCheck),
-          "Renew cost must be in the TLD's currency");
-      checkArgument(
-          instance.getCreateBillingCostTransitions().values().stream().allMatch(currencyCheck),
-          "Create cost must be in the TLD's currency");
-      checkArgument(
-          instance.eapFeeSchedule.toValueMap().values().stream().allMatch(currencyCheck),
-          "All EAP fees must be in the TLD's currency");
-      checkArgumentNotNull(
-          instance.pricingEngineClassName, "All registries must have a configured pricing engine");
-      checkArgument(
-          instance.dnsWriters != null && !instance.dnsWriters.isEmpty(),
-          "At least one DNS writer must be specified."
-              + " VoidDnsWriter can be used if DNS writing isn't desired");
       // If not set explicitly, numDnsPublishLocks defaults to 1.
-      instance.setDefaultNumDnsPublishLocks();
-      checkArgument(
-          instance.numDnsPublishLocks > 0,
-          "Number of DNS publish locks must be positive. Use 1 for TLD-wide locks.");
-      instance.tldStr = tldName;
-      instance.tldUnicode = Idn.toUnicode(tldName);
+      getInstance().setDefaultNumDnsPublishLocks();
+      getInstance().validateState();
+      getInstance().tldUnicode = Idn.toUnicode(getInstance().tldStr);
       return super.build();
     }
   }

core/src/main/java/google/registry/model/tld/label/PremiumList.java

@@ -169,6 +169,14 @@ public final class PremiumList extends BaseDomainLabelList<BigDecimal, PremiumEn
         getInstance().revisionId = revisionId;
         return this;
       }
+
+      @Override
+      public PremiumEntry build() {
+        checkArgument(getInstance().price != null, "Price must not be null");
+        checkArgument(
+            getInstance().price.compareTo(BigDecimal.ZERO) >= 0, "Price must not be negative");
+        return super.build();
+      }
     }
   }
 

core/src/main/java/google/registry/persistence/converter/ExpiryAccessPeriodModeTransitionUserType.java

@@ -0,0 +1,33 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence.converter;
+
+import google.registry.model.common.TimedTransitionProperty;
+import google.registry.model.tld.Tld.ExpiryAccessPeriodMode;
+
+/** Hibernate custom type for {@link TimedTransitionProperty} of {@link ExpiryAccessPeriodMode}. */
+public class ExpiryAccessPeriodModeTransitionUserType
+    extends TimedTransitionBaseUserType<ExpiryAccessPeriodMode> {
+
+  @Override
+  String valueToString(ExpiryAccessPeriodMode value) {
+    return value.name();
+  }
+
+  @Override
+  ExpiryAccessPeriodMode stringToValue(String string) {
+    return ExpiryAccessPeriodMode.valueOf(string);
+  }
+}

core/src/main/java/google/registry/persistence/transaction/DelegatingReplicaJpaTransactionManager.java

@@ -257,11 +257,21 @@ public class DelegatingReplicaJpaTransactionManager implements JpaTransactionMan
     return getReplica().loadAllOf(clazz);
   }
 
+  @Override
+  public <T> ImmutableList<T> loadAllOfSorted(Class<T> clazz, String... sortFields) {
+    return getReplica().loadAllOfSorted(clazz, sortFields);
+  }
+
   @Override
   public <T> Stream<T> loadAllOfStream(Class<T> clazz) {
     return getReplica().loadAllOfStream(clazz);
   }
 
+  @Override
+  public <T> Stream<T> loadAllOfSortedStream(Class<T> clazz, String... sortFields) {
+    return getReplica().loadAllOfSortedStream(clazz, sortFields);
+  }
+
   @Override
   public <T> Optional<T> loadSingleton(Class<T> clazz) {
     return getReplica().loadSingleton(clazz);

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -76,6 +76,7 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Supplier;
 import java.util.function.UnaryOperator;
+import java.util.regex.Pattern;
 import java.util.stream.Stream;
 import java.util.stream.StreamSupport;
 import javax.annotation.Nullable;
@@ -88,6 +89,16 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
   private static final Retrier retrier = new Retrier(new SystemSleeper(), 6);
+
+  /**
+   * Strict allowlist regex for property/field names in dynamic JPQL ORDER BY clauses.
+   *
+   * <p>JPA and database engines forbid bind parameters (e.g. ? or :param) for schema identifiers or
+   * property names in ORDER BY clauses. To prevent JPQL/SQL injection when dynamically constructing
+   * sort queries, every sort field MUST be validated against this pattern before concatenation.
+   */
+  private static final Pattern VALID_SORT_FIELD_PATTERN = Pattern.compile("^[a-zA-Z0-9_.]+$");
+
   private static final String NESTED_TRANSACTION_MESSAGE =
       "Nested transaction detected. Try refactoring to avoid nested transactions. If unachievable,"
           + " use reTransact() in nested transactions";
@@ -528,15 +539,38 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
   @Override
   public <T> ImmutableList<T> loadAllOf(Class<T> clazz) {
-    return loadAllOfStream(clazz).collect(toImmutableList());
+    return loadAllOfSorted(clazz);
   }
 
   @Override
   public <T> Stream<T> loadAllOfStream(Class<T> clazz) {
+    return loadAllOfSortedStream(clazz);
+  }
+
+  @Override
+  public <T> ImmutableList<T> loadAllOfSorted(Class<T> clazz, String... sortFields) {
+    return loadAllOfSortedStream(clazz, sortFields).collect(toImmutableList());
+  }
+
+  @Override
+  public <T> Stream<T> loadAllOfSortedStream(Class<T> clazz, String... sortFields) {
     checkArgumentNotNull(clazz, "clazz must be specified");
+    checkArgumentNotNull(sortFields, "sortFields must not be null");
     assertInTransaction();
+    StringBuilder queryString =
+        new StringBuilder(String.format("FROM %s", getEntityType(clazz).getName()));
+    if (sortFields.length > 0) {
+      for (String field : sortFields) {
+        checkArgument(
+            VALID_SORT_FIELD_PATTERN.matcher(field).matches(),
+            "Invalid sort field name: %s",
+            field);
+      }
+      queryString.append(" ORDER BY ");
+      queryString.append(String.join(", ", sortFields));
+    }
     return getEntityManager()
-        .createQuery(String.format("FROM %s", getEntityType(clazz).getName()), clazz)
+        .createQuery(queryString.toString(), clazz)
         .getResultStream()
         .map(this::detach);
   }

core/src/main/java/google/registry/persistence/transaction/TransactionManager.java

@@ -219,6 +219,14 @@ public interface TransactionManager {
    */
   <T> ImmutableList<T> loadAllOf(Class<T> clazz);
 
+  /**
+   * Returns a list of all entities of the given type that exist in the database, ordered by the
+   * specified field names in ascending order.
+   *
+   * <p>The resulting list is empty if there are no entities of this type.
+   */
+  <T> ImmutableList<T> loadAllOfSorted(Class<T> clazz, String... sortFields);
+
   /**
    * Returns a stream of all entities of the given type that exist in the database.
    *
@@ -226,6 +234,14 @@ public interface TransactionManager {
    */
   <T> Stream<T> loadAllOfStream(Class<T> clazz);
 
+  /**
+   * Returns a stream of all entities of the given type that exist in the database, ordered by the
+   * specified field names in ascending order.
+   *
+   * <p>The resulting stream is empty if there are no entities of this type.
+   */
+  <T> Stream<T> loadAllOfSortedStream(Class<T> clazz, String... sortFields);
+
   /**
    * Loads the only instance of this particular class, or empty if none exists.
    *

core/src/main/java/google/registry/rde/JSchSshSession.java

@@ -24,7 +24,6 @@ import com.jcraft.jsch.SftpException;
 import google.registry.config.RegistryConfig.Config;
 import jakarta.inject.Inject;
 import java.io.Closeable;
-import java.net.URI;
 import java.time.Duration;
 
 /**
@@ -57,8 +56,7 @@ final class JSchSshSession implements Closeable {
      *
      * @throws JSchException if we fail to open the connection.
      */
-    JSchSshSession create(JSch jsch, URI uri) throws JSchException {
-      RdeUploadUrl url = RdeUploadUrl.create(uri);
+    JSchSshSession create(JSch jsch, RdeUploadUrl url) throws JSchException {
       logger.atInfo().log("Connecting to SSH endpoint: %s", url);
       Session session = jsch.getSession(
           url.getUser().orElse("domain-registry"),

core/src/main/java/google/registry/rde/RdeStagingAction.java

@@ -312,7 +312,8 @@ public final class RdeStagingAction implements Runnable {
                             jobRegion,
                             new LaunchFlexTemplateRequest().setLaunchParameter(parameter))
                         .execute();
-                logger.atInfo().log("Got response: %s", launchResponse.getJob().toPrettyString());
+                logger.atInfo().log(
+                    "Launched RDE staging Dataflow job: %s", launchResponse.getJob().getId());
                 jobNameBuilder.add(launchResponse.getJob().getId());
               } catch (IOException e) {
                 logger.atWarning().withCause(e).log("Pipeline Launch failed");

core/src/main/java/google/registry/rde/RdeUploadAction.java

@@ -64,7 +64,6 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.net.URI;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
@@ -116,11 +115,16 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
   @Inject @Config("rdeInterval") Duration interval;
   @Inject @Config("rdeUploadLockTimeout") Duration timeout;
   @Inject @Config("rdeUploadSftpCooldown") Duration sftpCooldown;
-  @Inject @Config("rdeUploadUrl") URI uploadUrl;
   @Inject @Key("rdeReceiverKey") PGPPublicKey receiverKey;
   @Inject @Key("rdeSigningKey") PGPKeyPair signingKey;
   @Inject @Key("rdeStagingDecryptionKey") PGPPrivateKey stagingDecryptionKey;
+
+  @Inject
+  @Config("rdeUploadUrl")
+  RdeUploadUrl rdeUploadUrl;
+
   @Inject RdeUploadAction() {}
+
   @Override
   public void run() {
     logger.atInfo().log("Attempting to acquire RDE upload lock for TLD '%s'.", tld);
@@ -135,7 +139,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
   @Override
   public void runWithLock(Instant watermark) throws Exception {
     // If a prefix is not provided,try to determine the prefix. This should only happen when the RDE
-    // upload cron job runs to catch up any un-retried (i. e. expected) RDE failures.
+    // upload cron job runs to catch up any un-retried (i.e. expected) RDE failures.
     String actualPrefix =
         prefix.orElseGet(() -> findMostRecentPrefixForWatermark(watermark, bucket, tld, gcsUtils));
     logger.atInfo().log("Verifying readiness to upload the RDE deposit.");
@@ -181,7 +185,7 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
     verifyFileExists(xmlFilename);
     verifyFileExists(xmlLengthFilename);
     verifyFileExists(reportFilename);
-    logger.atInfo().log("Commencing RDE upload for TLD '%s' to '%s'.", tld, uploadUrl);
+    logger.atInfo().log("Commencing RDE upload for TLD '%s' to '%s'.", tld, rdeUploadUrl);
     final long xmlLength = readXmlLength(xmlLengthFilename);
     retrier.callWithRetry(
         () -> upload(xmlFilename, xmlLength, watermark, name, nameWithoutPrefix),
@@ -221,10 +225,10 @@ public final class RdeUploadAction implements Runnable, EscrowTask {
   private void upload(
       BlobId xmlFile, long xmlLength, Instant watermark, String name, String nameWithoutPrefix)
       throws Exception {
-    logger.atInfo().log("Uploading XML file '%s' to remote path '%s'.", xmlFile, uploadUrl);
+    logger.atInfo().log("Uploading XML file '%s' to remote path '%s'.", xmlFile, rdeUploadUrl);
     try (InputStream gcsInput = gcsUtils.openInputStream(xmlFile);
         InputStream ghostrydeDecoder = Ghostryde.decoder(gcsInput, stagingDecryptionKey)) {
-      try (JSchSshSession session = jschSshSessionFactory.create(lazyJsch.get(), uploadUrl);
+      try (JSchSshSession session = jschSshSessionFactory.create(lazyJsch.get(), rdeUploadUrl);
           JSchSftpChannel ftpChan = session.openSftpChannel()) {
         ByteArrayOutputStream sigOut = new ByteArrayOutputStream();
         String rydeFilename = nameWithoutPrefix + ".ryde";

core/src/main/java/google/registry/rde/RdeUploadUrl.java

@@ -37,7 +37,7 @@ import javax.annotation.concurrent.Immutable;
  * @see RdeUploadAction
  */
 @Immutable
-final class RdeUploadUrl implements Comparable<RdeUploadUrl> {
+public final class RdeUploadUrl implements Comparable<RdeUploadUrl> {
 
   public static final Protocol SFTP = new Protocol("sftp", 22);
   private static final ImmutableMap<String, Protocol> ALLOWED_PROTOCOLS =

core/src/main/java/google/registry/reporting/billing/GenerateInvoicesAction.java

@@ -14,10 +14,14 @@
 
 package google.registry.reporting.billing;
 
+import static com.google.common.base.Preconditions.checkState;
 import static google.registry.beam.BeamUtils.createJobName;
+import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+import static java.time.ZoneOffset.UTC;
 
 import com.google.api.services.dataflow.Dataflow;
 import com.google.api.services.dataflow.model.LaunchFlexTemplateParameter;
@@ -29,6 +33,7 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.model.common.Cursor;
 import google.registry.persistence.PersistenceModule;
 import google.registry.reporting.ReportingModule;
 import google.registry.request.Action;
@@ -40,7 +45,9 @@ import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import java.io.IOException;
 import java.time.Duration;
+import java.time.Instant;
 import java.time.YearMonth;
+import java.util.Optional;
 
 /**
  * Invokes the {@code InvoicingPipeline} beam template via the REST api, and enqueues the {@link
@@ -107,6 +114,7 @@ public class GenerateInvoicesAction implements Runnable {
     response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
     logger.atInfo().log("Launching invoicing pipeline for %s.", yearMonth);
     try {
+      checkBillingRecurrenceCursor();
       LaunchFlexTemplateParameter parameter =
           new LaunchFlexTemplateParameter()
               .setJobName(createJobName("invoicing", clock))
@@ -156,4 +164,20 @@ public class GenerateInvoicesAction implements Runnable {
       response.setPayload(String.format("Pipeline launch failed: %s", e.getMessage()));
     }
   }
+
+  private void checkBillingRecurrenceCursor() {
+    Optional<Cursor> previousCursor =
+        tm().transact(() -> tm().loadByKeyIfPresent(Cursor.createGlobalVKey(RECURRING_BILLING)));
+    checkState(
+        previousCursor.isPresent(),
+        "BillingRecurrence expansion cursor is not present. Run ExpandBillingRecurrencesAction.");
+    Instant startOfNextMonth = yearMonth.plusMonths(1).atDay(1).atStartOfDay(UTC).toInstant();
+    Instant previousCursorTime = previousCursor.get().getCursorTime();
+    checkState(
+        !previousCursorTime.isBefore(startOfNextMonth),
+        "BillingRecurrence expansion cursor (%s) is before the start of the next month (%s). "
+            + "Run ExpandBillingRecurrencesAction.",
+        previousCursorTime,
+        startOfNextMonth);
+  }
 }

core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java

@@ -127,7 +127,7 @@ public class GenerateSpec11ReportAction implements Runnable {
                   jobRegion,
                   new LaunchFlexTemplateRequest().setLaunchParameter(parameter))
               .execute();
-      logger.atInfo().log("Got response: %s", launchResponse.getJob().toPrettyString());
+      logger.atInfo().log("Launched Spec11 Dataflow job: %s", launchResponse.getJob().getId());
       String jobId = launchResponse.getJob().getId();
       if (sendEmail) {
         cloudTasksUtils.enqueue(

core/src/main/java/google/registry/request/auth/OidcTokenAuthenticationMechanism.java

@@ -40,10 +40,9 @@ import javax.annotation.Nullable;
  * An authentication mechanism that verifies the OIDC token.
  *
  * <p>Currently, two flavors are supported: one that checks for the OIDC token as a regular bearer
- * token, and another that checks for the OIDC token passed by IAP. In both cases, the {@link
- * AuthResult} with the highest {@link AuthLevel} possible is returned. So, if the email address for
- * which the token is minted exists both as a {@link User} and as a service account, the returned
- * {@link AuthResult} is at {@link AuthLevel#USER}.
+ * token, and another that checks for the OIDC token passed by IAP. In the case where the email
+ * address for which the token is minted exists both as a {link User} and as a service account, the
+ * returned {@link AuthResult} is at {@link AuthLevel#APP} to avoid database lookups when possible.
  *
  * @see <a href="https://developers.google.com/identity/openid-connect/openid-connect">OpenID
  *     Connect </a>

core/src/main/java/google/registry/security/XsrfTokenManager.java

@@ -104,8 +104,7 @@ public final class XsrfTokenManager {
     // Reconstruct the token to verify validity.
     String reconstructedToken = encodeToken(ServerSecret.get().asBytes(), email, timestampMillis);
     if (!MessageDigest.isEqual(token.getBytes(UTF_8), reconstructedToken.getBytes(UTF_8))) {
-      logger.atWarning().log(
-          "Reconstructed XSRF mismatch (got != expected): %s != %s", token, reconstructedToken);
+      logger.atWarning().log("Token %s didn't match expected reconstructed token", token);
       return false;
     }
     return true;

core/src/main/java/google/registry/tools/ConfigureTldCommand.java

@@ -164,6 +164,8 @@ public class ConfigureTldCommand extends MutatingCommand {
     if (Boolean.TRUE.equals(breakGlass)) {
       newTld = newTld.asBuilder().setBreakglassMode(true).build();
     }
+    // Enforce any restrictions, e.g. "no negative fees"
+    newTld.validateState();
     stageEntityChange(oldTld, newTld);
   }
 

core/src/main/java/google/registry/tools/CreateOrUpdatePremiumListCommand.java

@@ -14,6 +14,7 @@
 
 package google.registry.tools;
 
+import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.beust.jcommander.Parameter;
@@ -39,6 +40,19 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand {
   protected List<String> inputData;
   protected CurrencyUnit currency;
 
+  @Parameter(
+      names = {"-d", "--dry_run"},
+      description = "Does not execute the entity mutation")
+  boolean dryRun;
+
+  @Parameter(
+      names = {"--build_environment"},
+      description =
+          "DO NOT USE THIS FLAG ON THE COMMAND LINE! This flag indicates the command is being run"
+              + " by the build environment tools. This flag should never be used by a human user"
+              + " from the command line.")
+  boolean buildEnv;
+
   @Nullable
   @Parameter(
       names = {"-n", "--name"},
@@ -68,4 +82,17 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand {
     }
     return message;
   }
+
+  @Override
+  protected boolean dontRunCommand() {
+    return dryRun;
+  }
+
+  @Override
+  protected boolean checkExecutionState() {
+    checkArgument(
+        !RegistryToolEnvironment.get().equals(RegistryToolEnvironment.PRODUCTION) || buildEnv,
+        "The --build_environment flag must be used when running in production");
+    return super.checkExecutionState();
+  }
 }

core/src/main/java/google/registry/tools/CreateOrUpdateReservedListCommand.java

@@ -14,6 +14,8 @@
 
 package google.registry.tools;
 
+import static com.google.common.base.Preconditions.checkArgument;
+
 import com.beust.jcommander.Parameter;
 import com.google.common.flogger.FluentLogger;
 import google.registry.model.tld.label.ReservedList;
@@ -35,6 +37,19 @@ public abstract class CreateOrUpdateReservedListCommand extends ConfirmingComman
 
   static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
+  @Parameter(
+      names = {"-d", "--dry_run"},
+      description = "Does not execute the entity mutation")
+  boolean dryRun;
+
+  @Parameter(
+      names = {"--build_environment"},
+      description =
+          "DO NOT USE THIS FLAG ON THE COMMAND LINE! This flag indicates the command is being run"
+              + " by the build environment tools. This flag should never be used by a human user"
+              + " from the command line.")
+  boolean buildEnv;
+
   @Nullable
   @Parameter(
       names = {"-n", "--name"},
@@ -74,4 +89,17 @@ public abstract class CreateOrUpdateReservedListCommand extends ConfirmingComman
             .collect(Collectors.joining(", "))
         + "]";
   }
+
+  @Override
+  protected boolean dontRunCommand() {
+    return dryRun;
+  }
+
+  @Override
+  protected boolean checkExecutionState() {
+    checkArgument(
+        !RegistryToolEnvironment.get().equals(RegistryToolEnvironment.PRODUCTION) || buildEnv,
+        "The --build_environment flag must be used when running in production");
+    return super.checkExecutionState();
+  }
 }

core/src/main/java/google/registry/tools/ShellCommand.java

@@ -91,10 +91,11 @@ public class ShellCommand implements Command {
    * flags aren't available in the constructor, so we have to do it in the {@link #run} function.
    */
   private final CommandRunner originalRunner;
-
-  private final LineReader lineReader;
   private final Clock clock;
 
+  private LineReader lineReader;
+  private Terminal terminal;
+  private JCommander jcommanderForCompletions;
   private String prompt = null;
 
   @Parameter(
@@ -118,21 +119,22 @@ public class ShellCommand implements Command {
           """)
   boolean encapsulateOutput = false;
 
-  ShellCommand(CommandRunner runner) throws IOException {
-    this(TerminalBuilder.terminal(), new SystemClock(), runner);
-    prompt = "nom > ";
-    lineReader.variable(LineReader.HISTORY_FILE, Path.of(USER_HOME.value(), HISTORY_FILE));
+  ShellCommand(CommandRunner runner) {
+    this.originalRunner = runner;
+    this.clock = new SystemClock();
+    this.prompt = "nom > ";
   }
 
   ShellCommand(Terminal terminal, Clock clock, CommandRunner runner) {
     this.originalRunner = runner;
+    this.terminal = terminal;
     this.lineReader = LineReaderBuilder.builder().terminal(terminal).build();
     this.clock = clock;
   }
 
   private void setPrompt(RegistryToolEnvironment environment, boolean alert) {
     // Do not set the prompt in tests.
-    if (lineReader.getTerminal() instanceof DumbTerminal) {
+    if (lineReader == null || lineReader.getTerminal() instanceof DumbTerminal) {
       return;
     }
     prompt =
@@ -143,7 +145,10 @@ public class ShellCommand implements Command {
   }
 
   public ShellCommand buildCompletions(JCommander jcommander) {
-    ((LineReaderImpl) lineReader).setCompleter(new JCommanderCompleter(jcommander));
+    this.jcommanderForCompletions = jcommander;
+    if (lineReader != null) {
+      ((LineReaderImpl) lineReader).setCompleter(new JCommanderCompleter(jcommander));
+    }
     return this;
   }
 
@@ -209,6 +214,19 @@ public class ShellCommand implements Command {
   /** Run the shell until the user presses "Ctrl-D". */
   @Override
   public void run() {
+    if (lineReader == null) {
+      try {
+        this.terminal = TerminalBuilder.terminal();
+        this.lineReader = LineReaderBuilder.builder().terminal(terminal).build();
+        lineReader.variable(LineReader.HISTORY_FILE, Path.of(USER_HOME.value(), HISTORY_FILE));
+        if (jcommanderForCompletions != null) {
+          ((LineReaderImpl) lineReader)
+              .setCompleter(new JCommanderCompleter(jcommanderForCompletions));
+        }
+      } catch (IOException e) {
+        throw new RuntimeException("Failed to initialize terminal", e);
+      }
+    }
     // Wrap standard output and error if requested. We have to do so here in run because the flags
     // haven't been processed in the constructor.
     CommandRunner runner =

core/src/main/java/google/registry/tools/UpdatePremiumListCommand.java

@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
-import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Strings;
 import google.registry.model.tld.label.PremiumList;
@@ -30,27 +29,11 @@ import java.nio.file.Files;
 @Parameters(separators = " =", commandDescription = "Update a PremiumList in Database.")
 class UpdatePremiumListCommand extends CreateOrUpdatePremiumListCommand {
 
-  @Parameter(
-      names = {"-d", "--dry_run"},
-      description = "Does not execute the entity mutation")
-  boolean dryRun;
-
-  @Parameter(
-      names = {"--build_environment"},
-      description =
-          "DO NOT USE THIS FLAG ON THE COMMAND LINE! This flag indicates the command is being run"
-              + " by the build environment tools. This flag should never be used by a human user"
-              + " from the command line.")
-  boolean buildEnv;
-
   // Indicates if there is a new change made by this command
   private boolean newChange = false;
 
   @Override
   protected String prompt() throws Exception {
-    checkArgument(
-        !RegistryToolEnvironment.get().equals(RegistryToolEnvironment.PRODUCTION) || buildEnv,
-        "The --build_environment flag must be used when running update_premium_list in production");
     name = Strings.isNullOrEmpty(name) ? convertFilePathToName(inputFile) : name;
     PremiumList existingList =
         PremiumListDao.getLatestRevision(name)

core/src/main/java/google/registry/tools/UpdateReservedListCommand.java

@@ -14,12 +14,10 @@
 
 package google.registry.tools;
 
-import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.DiffUtils.prettyPrintEntityDeepDiff;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
-import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Strings;
 import google.registry.model.tld.label.ReservedList;
@@ -30,28 +28,11 @@ import java.util.List;
 @Parameters(separators = " =", commandDescription = "Update a ReservedList.")
 final class UpdateReservedListCommand extends CreateOrUpdateReservedListCommand {
 
-  @Parameter(
-      names = {"-d", "--dry_run"},
-      description = "Does not execute the entity mutation")
-  boolean dryRun;
-
-  @Parameter(
-      names = {"--build_environment"},
-      description =
-          "DO NOT USE THIS FLAG ON THE COMMAND LINE! This flag indicates the command is being run"
-              + " by the build environment tools. This flag should never be used by a human user"
-              + " from the command line.")
-  boolean buildEnv;
-
   // indicates if there is a new change made by this command
   private boolean newChange = true;
 
   @Override
   protected String prompt() throws Exception {
-    checkArgument(
-        !RegistryToolEnvironment.get().equals(RegistryToolEnvironment.PRODUCTION) || buildEnv,
-        "The --build_environment flag must be used when running update_reserved_list in"
-            + " production");
     name = Strings.isNullOrEmpty(name) ? convertFilePathToName(input) : name;
     ReservedList existingReservedList =
         ReservedList.get(name)

core/src/main/java/google/registry/tools/server/GenerateZoneFilesAction.java

@@ -33,6 +33,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.secdns.DomainDsData;
 import google.registry.model.host.Host;
 import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tlds;
 import google.registry.request.Action;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.JsonActionRunner;
@@ -119,6 +120,7 @@ public class GenerateZoneFilesAction implements Runnable, JsonActionRunner.JsonA
   public Map<String, Object> handleJsonRequest(Map<String, ?> json) {
     @SuppressWarnings("unchecked")
     ImmutableSet<String> tlds = ImmutableSet.copyOf((List<String>) json.get("tlds"));
+    Tlds.assertTldsExist(tlds);
     Instant exportTime = Instant.parse(json.get("exportTime").toString());
     // We disallow exporting within the past 2 minutes because there might be outstanding writes.
     // We can only reliably call loadAtPointInTime at times that are UTC midnight and >
@@ -233,15 +235,20 @@ public class GenerateZoneFilesAction implements Runnable, JsonActionRunner.JsonA
     String domainLabel = stripTld(domain.getDomainName(), domain.getTld());
     Tld tld = Tld.get(domain.getTld());
     for (Host nameserver : tm().loadByKeys(domain.getNameservers()).values()) {
+      // Load the nameservers at the export time in case they've been renamed or deleted
+      Host host = loadAtPointInTime(nameserver, exportTime);
+      if (host == null) {
+        log.atSevere().log(
+            "Domain %s contained nameserver %s that didn't exist at time %s",
+            domain.getRepoId(), nameserver.getRepoId(), exportTime);
+        continue;
+      }
       result.append(
           String.format(
               NS_FORMAT,
               domainLabel,
-              tld.getDnsNsTtl()
-                  .orElse(dnsDefaultNsTtl)
-                  .toSeconds(),
-              // Load the nameservers at the export time in case they've been renamed or deleted.
-              loadAtPointInTime(nameserver, exportTime).getHostName()));
+              tld.getDnsNsTtl().orElse(dnsDefaultNsTtl).toSeconds(),
+              host.getHostName()));
     }
     for (DomainDsData dsData : domain.getDsData()) {
       result.append(

core/src/main/java/google/registry/ui/server/CspFilter.java

@@ -0,0 +1,41 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/** Filter to inject security headers, including CSP, for defense-in-depth. */
+public class CspFilter implements Filter {
+
+  private static final String CSP_POLICY =
+      "default-src 'self'; object-src 'none'; base-uri 'self';";
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    if (response instanceof HttpServletResponse httpResponse) {
+      httpResponse.setHeader("Content-Security-Policy", CSP_POLICY);
+      httpResponse.setHeader("X-Content-Type-Options", "nosniff");
+      httpResponse.setHeader("X-Frame-Options", "DENY");
+    }
+    chain.doFilter(request, response);
+  }
+}

core/src/main/java/google/registry/ui/server/console/ConsoleUsersAction.java

@@ -102,7 +102,7 @@ public class ConsoleUsersAction extends ConsoleApiAction {
   @Override
   protected void postHandler(User user) {
     checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-    tm().transact(this::runPostInTransaction);
+    tm().transact(() -> runPostInTransaction(user));
   }
 
   @Override
@@ -135,16 +135,16 @@ public class ConsoleUsersAction extends ConsoleApiAction {
     tm().transact(this::runDeleteInTransaction);
   }
 
-  private void runPostInTransaction() throws IOException {
+  private void runPostInTransaction(User callingUser) throws IOException {
     validateRequestParams();
     if (!tm().exists(VKey.create(User.class, this.userData.get().emailAddress))) {
       this.runCreate();
     } else {
-      this.runAppendUserToExistingRegistrar();
+      this.runAppendUserToExistingRegistrar(callingUser);
     }
   }
 
-  private void runAppendUserToExistingRegistrar() {
+  private void runAppendUserToExistingRegistrar(User callingUser) {
     ImmutableList<User> allRegistrarUsers = getAllRegistrarUsers(registrarId);
     if (allRegistrarUsers.size() >= 4) {
       throw new BadRequestException("Total users amount per registrar is limited to 4");
@@ -156,6 +156,9 @@ public class ConsoleUsersAction extends ConsoleApiAction {
       throw new BadRequestException(
           "Cannot append a global administrator or user with a global role to a registrar");
     }
+    for (String existingRegistrarId : userToAppend.getUserRoles().getRegistrarRoles().keySet()) {
+      checkPermission(callingUser, existingRegistrarId, ConsolePermission.MANAGE_USERS);
+    }
 
     updateUserRegistrarRoles(
         userToAppend, registrarId, requestRoleToAllowedRoles(this.userData.get().role));
@@ -263,10 +266,15 @@ public class ConsoleUsersAction extends ConsoleApiAction {
       return;
     }
 
+    User userToUpdate = verifyUserExists(this.userData.get().emailAddress);
+    if (userToUpdate.getUserRoles().isAdmin()
+        || !userToUpdate.getUserRoles().getGlobalRole().equals(GlobalRole.NONE)) {
+      throw new BadRequestException(
+          "Cannot update a global administrator or user with a global role");
+    }
+
     updateUserRegistrarRoles(
-        verifyUserExists(this.userData.get().emailAddress),
-        registrarId,
-        requestRoleToAllowedRoles(this.userData.get().role));
+        userToUpdate, registrarId, requestRoleToAllowedRoles(this.userData.get().role));
 
     sendConfirmationEmail(registrarId, this.userData.get().emailAddress, "Updated user");
     consoleApiParams.response().setStatus(SC_OK);

core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java

@@ -59,6 +59,7 @@ public class RegistrarsAction extends ConsoleApiAction {
       """
             SELECT * FROM "Registrar"
             WHERE registrar_id in :registrarIds
+            ORDER BY registrar_name ASC, registrar_id ASC
       """;
   static final String PATH = "/console-api/registrars";
   private final Optional<Registrar> registrar;
@@ -83,7 +84,7 @@ public class RegistrarsAction extends ConsoleApiAction {
       ImmutableSet<Registrar.Type> allowedRegistrarTypes =
           user.getUserRoles().isAdmin() ? TYPES_ALLOWED_FOR_ADMINS : TYPES_ALLOWED_FOR_USERS;
       ImmutableList<Registrar> registrars =
-          Streams.stream(Registrar.loadAll())
+          Streams.stream(Registrar.loadAllSorted("registrarName", "registrarId"))
               .filter(r -> allowedRegistrarTypes.contains(r.getType()))
               .collect(ImmutableList.toImmutableList());
       consoleApiParams.response().setPayload(consoleApiParams.gson().toJson(registrars));

core/src/main/java/google/registry/ui/server/console/domains/ConsoleDomainActionType.java

@@ -87,6 +87,6 @@ public abstract class ConsoleDomainActionType {
   }
 
   private String replaceValue(String xml, String key, String value) {
-    return xml.replaceAll("%" + key + "%", XML_ESCAPER.escape(value));
+    return xml.replace("%" + key + "%", XML_ESCAPER.escape(value));
   }
 }

core/src/main/java/google/registry/ui/server/console/settings/RdapRegistrarFieldsAction.java

@@ -93,7 +93,7 @@ public class RdapRegistrarFieldsAction extends ConsoleApiAction {
       newRegistrarBuilder.setPhoneNumber(providedRegistrar.getPhoneNumber());
       updates.add("PHONE");
     }
-    if (!providedRegistrar.getFaxNumber().equals(savedRegistrar.getPhoneNumber())) {
+    if (!providedRegistrar.getFaxNumber().equals(savedRegistrar.getFaxNumber())) {
       newRegistrarBuilder.setFaxNumber(providedRegistrar.getFaxNumber());
       updates.add("FAX");
     }

core/src/main/java/google/registry/xml/XmlTransformer.java

@@ -44,8 +44,8 @@ import javax.xml.XMLConstants;
 import javax.xml.stream.XMLInputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Result;
 import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.stream.StreamResult;
@@ -62,7 +62,7 @@ public class XmlTransformer {
   private static final String SYSTEM_ID = "<default system id>";
 
   /** A transformer factory for the {@link #prettyPrint} method. */
-  private static final TransformerFactory transformerFactory = TransformerFactory.newInstance();
+  private static final TransformerFactory transformerFactory = createTransformerFactory();
 
   /** A {@link JAXBContext} (thread-safe) to use for marshaling and unmarshaling. */
   private final JAXBContext jaxbContext;
@@ -156,21 +156,24 @@ public class XmlTransformer {
       // Plain old parsing exceptions have a SAXParseException with no further cause.
       if (e.getLinkedException() instanceof SAXParseException sae
           && e.getLinkedException().getCause() == null) {
-        throw new XmlException(String.format(
-            "Syntax error at line %d, column %d: %s",
-            sae.getLineNumber(),
-            sae.getColumnNumber(),
-            nullToEmpty(sae.getMessage()).replaceAll("&quot;", "")));
+        throw new XmlException(
+            String.format(
+                "Syntax error at line %d, column %d: %s",
+                sae.getLineNumber(),
+                sae.getColumnNumber(),
+                nullToEmpty(sae.getMessage()).replace("&quot;", "")));
       }
       // These get thrown for attempted XXE attacks.
       if (e.getLinkedException() instanceof XMLStreamException xse) {
-        throw new XmlException(String.format(
-            "Syntax error at line %d, column %d: %s",
-            xse.getLocation().getLineNumber(),
-            xse.getLocation().getColumnNumber(),
-            nullToEmpty(xse.getMessage())
-                .replaceAll("^.*\nMessage: ", "")  // Strip an ugly prefix from XMLStreamException.
-                .replaceAll("&quot;", "")));
+        throw new XmlException(
+            String.format(
+                "Syntax error at line %d, column %d: %s",
+                xse.getLocation().getLineNumber(),
+                xse.getLocation().getColumnNumber(),
+                nullToEmpty(xse.getMessage())
+                    .replaceAll(
+                        "^.*\nMessage: ", "") // Strip an ugly prefix from XMLStreamException.
+                    .replace("&quot;", "")));
       }
       throw new XmlException(e);
     } catch (JAXBException | XMLStreamException | IOException e) {
@@ -230,27 +233,6 @@ public class XmlTransformer {
     }
   }
 
-  /**
-   * Validates and streams {@code root} as characters, always using strict validation.
-   *
-   * <p>The root object must be annotated with {@link jakarta.xml.bind.annotation.XmlRootElement}.
-   * This method will verify that your object strictly conforms to {@link #schema}. Because the
-   * output is streamed, {@link XmlException} will most likely be thrown <i>after</i> output has
-   * been written.
-   *
-   * @param root the object to write
-   * @param result to write the output to
-   * @throws XmlException to rethrow {@link JAXBException}.
-   */
-  public void marshalStrict(Object root, Result result) throws XmlException {
-    try {
-      getMarshaller(schema, ImmutableMap.of())
-          .marshal(checkNotNull(root, "root"), checkNotNull(result, "result"));
-    } catch (JAXBException e) {
-      throw new XmlException(e);
-    }
-  }
-
   /** Returns new instance of {@link XmlFragmentMarshaller}. */
   public XmlFragmentMarshaller createFragmentMarshaller() {
     return new XmlFragmentMarshaller(jaxbContext, schema);
@@ -327,4 +309,14 @@ public class XmlTransformer {
   public static String prettyPrint(byte[] xmlBytes) {
     return prettyPrint(new String(xmlBytes, UTF_8));
   }
+
+  private static TransformerFactory createTransformerFactory() {
+    TransformerFactory transformerFactory = TransformerFactory.newInstance();
+    try {
+      transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+    } catch (TransformerConfigurationException e) {
+      throw new RuntimeException(e); // this should never happen
+    }
+    return transformerFactory;
+  }
 }

core/src/main/resources/google/registry/beam/billing/sql/cloud_sql_billing_events.sql

@@ -30,7 +30,7 @@ JOIN Registrar r ON b.clientId = r.registrarId
 JOIN Domain d ON b.domainRepoId = d.repoId
 JOIN Tld t ON t.tldStr = d.tld
 LEFT JOIN BillingCancellation c ON b.id = c.billingEvent
-LEFT JOIN BillingCancellation cr ON b.cancellationMatchingBillingEvent = cr.billingRecurrence
+LEFT JOIN BillingCancellation cr ON b.cancellationMatchingBillingEvent = cr.billingRecurrence AND b.billingTime = cr.billingTime
 WHERE r.billingAccountMap IS NOT NULL
 AND r.type = 'REAL'
 AND t.invoicingEnabled IS TRUE

core/src/test/java/google/registry/beam/billing/InvoicingPipelineTest.java

@@ -229,7 +229,22 @@ class InvoicingPipelineTest {
               3,
               "USD",
               20.5,
-              ""));
+              ""),
+          google.registry.beam.billing.BillingEvent.create(
+              17,
+              Instant.parse("2017-10-04T00:00:00Z"),
+              Instant.parse("2017-10-04T00:00:00Z"),
+              "theRegistrar",
+              "234",
+              "",
+              "test",
+              "RENEW",
+              "recurrence-collision.test",
+              "REPO-ID",
+              3,
+              "USD",
+              20.5,
+              "SYNTHETIC"));
 
   private static final ImmutableMap<String, ImmutableList<String>> EXPECTED_DETAILED_REPORT_MAP =
       ImmutableMap.of(
@@ -239,6 +254,8 @@ class InvoicingPipelineTest {
                   + "test,RENEW,mydomain2.test,REPO-ID,3,USD,20.50,",
               "1,2017-10-04 00:00:00 UTC,2017-10-04 00:00:00 UTC,theRegistrar,234,,"
                   + "test,RENEW,mydomain.test,REPO-ID,3,USD,20.50,",
+              "17,2017-10-04 00:00:00 UTC,2017-10-04 00:00:00 UTC,theRegistrar,234,,"
+                  + "test,RENEW,recurrence-collision.test,REPO-ID,3,USD,20.50,",
               "7,2017-10-04 00:00:00 UTC,2017-10-04 00:00:00 UTC,theRegistrar,234,,"
                   + "test,SERVER_STATUS,update-prohibited.test,REPO-ID,0,USD,20.00,",
               "6,2017-10-04 00:00:00 UTC,2017-10-04 00:00:00 UTC,theRegistrar,234,,"
@@ -264,7 +281,7 @@ class InvoicingPipelineTest {
 
   private static final ImmutableList<String> EXPECTED_INVOICE_OUTPUT =
       ImmutableList.of(
-          "2017-10-01,2020-09-30,234,61.50,USD,10125,1,PURCHASE,,3,"
+          "2017-10-01,2020-09-30,234,82.00,USD,10125,1,PURCHASE,,4,"
               + "RENEW | TLD: test | TERM: 3-year,20.50,USD,",
           "2017-10-01,2022-09-30,234,70.00,JPY,10125,1,PURCHASE,,1,"
               + "CREATE | TLD: hello | TERM: 5-year,70.00,JPY,",
@@ -398,7 +415,8 @@ JOIN Registrar r ON b.clientId = r.registrarId
 JOIN Domain d ON b.domainRepoId = d.repoId
 JOIN Tld t ON t.tldStr = d.tld
 LEFT JOIN BillingCancellation c ON b.id = c.billingEvent
-LEFT JOIN BillingCancellation cr ON b.cancellationMatchingBillingEvent = cr.billingRecurrence
+LEFT JOIN BillingCancellation cr ON b.cancellationMatchingBillingEvent = cr.billingRecurrence AND \
+b.billingTime = cr.billingTime
 WHERE r.billingAccountMap IS NOT NULL
 AND r.type = 'REAL'
 AND t.invoicingEnabled IS TRUE
@@ -607,6 +625,51 @@ AND cr.id IS NULL
         Instant.parse("2017-10-04T00:00:00.0Z"),
         Instant.parse("2017-10-02T00:00:00.0Z"));
     persistBillingEvent(16, domain15, registrar11, Reason.RENEW, 3, Money.of(USD, 20.5));
+
+    // Add a billing event in Year 1 and a cancellation in Year 2 for the same recurrence.
+    // The Year 1 event should NOT be cancelled.
+    Domain domain17 = persistActiveDomain("recurrence-collision.test");
+    DomainHistory domainHistoryCollision = persistDomainHistory(domain17, registrar1);
+
+    BillingRecurrence billingRecurrenceCollision =
+        new BillingRecurrence()
+            .asBuilder()
+            .setRegistrarId(registrar1.getRegistrarId())
+            .setRecurrenceEndTime(END_INSTANT)
+            .setId(100)
+            .setDomainHistory(domainHistoryCollision)
+            .setTargetId(domain17.getDomainName())
+            .setEventTime(Instant.parse("2017-10-04T00:00:00.0Z"))
+            .setReason(Reason.RENEW)
+            .build();
+    persistResource(billingRecurrenceCollision);
+
+    // Year 1 Billing Event (October 2017)
+    BillingEvent billingEventYear1 =
+        persistBillingEvent(17, domain17, registrar1, Reason.RENEW, 3, Money.of(USD, 20.5));
+    billingEventYear1 =
+        billingEventYear1
+            .asBuilder()
+            .setCancellationMatchingBillingEvent(billingRecurrenceCollision)
+            .setFlags(ImmutableSet.of(Flag.SYNTHETIC))
+            .setSyntheticCreationTime(Instant.parse("2017-10-03T00:00:00.0Z"))
+            .build();
+    persistResource(billingEventYear1);
+
+    // Year 2 Billing Cancellation (October 2018)
+    BillingCancellation cancellationYear2 =
+        new BillingCancellation()
+            .asBuilder()
+            .setId(101)
+            .setRegistrarId(registrar1.getRegistrarId())
+            .setEventTime(Instant.parse("2018-10-05T00:00:00.0Z"))
+            .setBillingTime(Instant.parse("2018-10-04T00:00:00.0Z"))
+            .setBillingRecurrence(billingRecurrenceCollision.createVKey())
+            .setTargetId(domain17.getDomainName())
+            .setReason(Reason.RENEW)
+            .setDomainHistory(domainHistoryCollision)
+            .build();
+    persistResource(cancellationYear2);
   }
 
   private static DomainHistory persistDomainHistory(Domain domain, Registrar registrar) {

core/src/test/java/google/registry/cache/MultilayerDomainCacheTest.java

@@ -24,11 +24,14 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 import static org.mockito.Mockito.when;
 
 import google.registry.model.domain.Domain;
+import google.registry.model.domain.GracePeriod;
+import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.tld.Tld;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeClock;
+import java.time.Duration;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -100,4 +103,39 @@ public class MultilayerDomainCacheTest {
     verify(cacheMetrics).recordLookup("Domain", CacheMetrics.CacheHitType.MISS_NONEXISTENT);
     verifyNoMoreInteractions(cacheMetrics);
   }
+
+  @Test
+  void testLoad_filtersOutDeletedDomain() {
+    Domain domain =
+        persistActiveDomain("example.tld")
+            .asBuilder()
+            .setDeletionTime(clock.now().plus(Duration.ofDays(1)))
+            .build();
+    when(jedisClient.get(Domain.class, "example.tld")).thenReturn(Optional.of(domain));
+    assertThat(cache.loadByDomainName("example.tld")).hasValue(domain);
+
+    clock.advanceBy(Duration.ofDays(2));
+    assertThat(cache.loadByDomainName("example.tld")).isEmpty();
+  }
+
+  @Test
+  void testLoad_projectsToCurrentTime() {
+    Domain domain =
+        persistActiveDomain("example.tld")
+            .asBuilder()
+            .addGracePeriod(
+                GracePeriod.create(
+                    GracePeriodStatus.ADD,
+                    "example.tld",
+                    clock.now().plus(Duration.ofDays(5)),
+                    "TheRegistrar",
+                    null))
+            .build();
+    when(jedisClient.get(Domain.class, "example.tld")).thenReturn(Optional.of(domain));
+    assertThat(cache.loadByDomainName("example.tld").get().getGracePeriods())
+        .containsExactlyElementsIn(domain.getGracePeriods());
+
+    clock.advanceBy(Duration.ofDays(10));
+    assertThat(cache.loadByDomainName("example.tld").get().getGracePeriods()).isEmpty();
+  }
 }

core/src/test/java/google/registry/cache/MultilayerHostCacheTest.java

@@ -25,6 +25,8 @@ import google.registry.model.host.Host;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.DatabaseHelper;
+import google.registry.testing.FakeClock;
+import java.time.Duration;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -38,12 +40,13 @@ public class MultilayerHostCacheTest {
       new JpaTestExtensions.Builder().buildIntegrationTestExtension();
 
   private final SimplifiedJedisClient jedisClient = mock(SimplifiedJedisClient.class);
+  private final FakeClock clock = new FakeClock();
   private final CacheMetrics cacheMetrics = mock(CacheMetrics.class);
   private MultilayerHostCache cache;
 
   @BeforeEach
   void beforeEach() {
-    cache = new MultilayerHostCache(jedisClient, cacheMetrics);
+    cache = new MultilayerHostCache(jedisClient, clock, cacheMetrics);
   }
 
   @Test
@@ -80,4 +83,18 @@ public class MultilayerHostCacheTest {
     verify(cacheMetrics).recordLookup("Host", CacheMetrics.CacheHitType.MISS_NONEXISTENT);
     verifyNoMoreInteractions(cacheMetrics);
   }
+
+  @Test
+  void testLoad_filtersOutDeletedHost() {
+    Host host =
+        persistActiveHost("ns1.example.tld")
+            .asBuilder()
+            .setDeletionTime(clock.now().plus(Duration.ofDays(1)))
+            .build();
+    when(jedisClient.get(Host.class, host.getRepoId())).thenReturn(Optional.of(host));
+    assertThat(cache.loadByRepoId(host.getRepoId())).hasValue(host);
+
+    clock.advanceBy(Duration.ofDays(2));
+    assertThat(cache.loadByRepoId(host.getRepoId())).isEmpty();
+  }
 }

core/src/test/java/google/registry/flows/domain/DomainCheckFlowTest.java

@@ -49,6 +49,8 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Ordering;
+import google.registry.config.RegistryConfig;
+import google.registry.config.RegistryConfigSettings;
 import google.registry.flows.EppException;
 import google.registry.flows.FlowUtils.GenericXmlSyntaxErrorException;
 import google.registry.flows.FlowUtils.NotLoggedInException;
@@ -95,6 +97,7 @@ import google.registry.model.tld.Tld.TldState;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.testing.DatabaseHelper;
 import java.math.BigDecimal;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
 import org.joda.money.Money;
@@ -2447,6 +2450,283 @@ class DomainCheckFlowTest extends ResourceCheckFlowTestCase<DomainCheckFlow, Dom
     runFlowAssertResponse(outputXml);
   }
 
+  @Test
+  void testFeeExtension_xapLabel_std_v1() throws Exception {
+    createTld("tld");
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+
+    RegistryConfigSettings settings = RegistryConfig.CONFIG_SETTINGS.get();
+    BigDecimal originalInitialFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.initialFee.get("USD");
+    BigDecimal originalFinalFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.finalFee.get("USD");
+
+    settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+        ImmutableMap.of("USD", new BigDecimal("110.00"));
+    settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+        ImmutableMap.of("USD", new BigDecimal("110.00"));
+
+    try {
+      clock.setTo(Instant.parse("2009-01-06T00:00:00Z"));
+      Instant deletionTime = Instant.parse("2009-01-01T00:00:00Z");
+      persistDeletedDomain("example1.tld", deletionTime);
+
+      setEppInput("domain_check_fee_stdv1.xml");
+      runFlowAssertResponse(loadFile("domain_check_fee_xap_response.xml"));
+    } finally {
+      settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+          ImmutableMap.of("USD", originalInitialFee);
+      settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+          ImmutableMap.of("USD", originalFinalFee);
+    }
+  }
+
+  @Test
+  void testCheck_xapLabel_notOptedIn_returnsReserved() throws Exception {
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant deletionTime = clock.now().minus(Duration.ofDays(5));
+    persistDeletedDomain("example1.tld", deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(false, "example1.tld", "Reserved"),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_recentlyDeletedDomain_afterXapEnds_notOptedIn_returnsAvailable() throws Exception {
+    // Once the 10-day XAP window expires after deletion (e.g. day 11), checking the domain should
+    // return available (avail="1") without XAP fees or reservation blocks for non-opted-in
+    // registrars.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant deletionTime = clock.now().minus(Duration.ofDays(11));
+    persistDeletedDomain("example1.tld", deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_recentlyDeletedDomain_afterXapEnds_optedIn_returnsAvailable() throws Exception {
+    // Once the 10-day XAP window expires after deletion (e.g. day 11), checking the domain should
+    // return available (avail="1") without XAP fees for opted-in registrars.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    Instant deletionTime = clock.now().minus(Duration.ofDays(11));
+    persistDeletedDomain("example1.tld", deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_recentlyDeletedDomain_beforeXapStarts_notOptedIn_returnsAvailable()
+      throws Exception {
+    // If a domain was recently deleted but XAP mode is currently disabled on the TLD, checking the
+    // domain should return available (avail="1") without XAP fees or reservation blocks for
+    // non-opted-in registrars.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.DISABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant deletionTime = clock.now().minus(Duration.ofDays(5));
+    persistDeletedDomain("example1.tld", deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_recentlyDeletedDomain_beforeXapStarts_optedIn_returnsAvailable() throws Exception {
+    // If a domain was recently deleted but XAP mode is currently disabled on the TLD, checking the
+    // domain should return available (avail="1") without XAP fees for opted-in registrars.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.DISABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    Instant deletionTime = clock.now().minus(Duration.ofDays(5));
+    persistDeletedDomain("example1.tld", deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_agpDeletedRegularDomain_duringXap_returnsAvailable() throws Exception {
+    // A regular domain (registered without an XAP fee) deleted during its Add Grace Period (AGP) is
+    // exempt from XAP, returning available (avail="1") without reservation blocks or XAP fees when
+    // checked during active XAP on the TLD.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(
+                    START_INSTANT,
+                    Tld.ExpiryAccessPeriodMode.DISABLED,
+                    clock.now().minus(Duration.ofHours(1)),
+                    Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant creationTime = clock.now().minus(Duration.ofDays(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    DatabaseHelper.persistDomainAsDeleted(
+        DatabaseHelper.newDomain("example1.tld")
+            .asBuilder()
+            .setCreationTimeForTest(creationTime)
+            .build(),
+        deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_agpDeletedXapDomain_duringXap_returnsAvailable() throws Exception {
+    // A domain originally registered with an XAP fee deleted during its Add Grace Period (AGP) is
+    // exempt from XAP, returning available (avail="1") without reservation blocks or XAP fees when
+    // checked during active XAP on the TLD.
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant creationTime = clock.now().minus(Duration.ofHours(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    DatabaseHelper.persistDomainAsDeleted(
+        DatabaseHelper.newDomain("example1.tld")
+            .asBuilder()
+            .setCreationTimeForTest(creationTime)
+            .build(),
+        deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(true, "example1.tld", null),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
+  @Test
+  void testCheck_anchorTenantDeletedAfterStandardAgp_duringXap_returnsReserved() throws Exception {
+    // An anchor tenant domain deleted after standard AGP (5 days), e.g. on day 10 of its 30-day
+    // anchor tenant AGP, is subject to XAP fees and reservation blocks (not exempt as an AGP
+    // delete).
+    createTld("tld");
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setAddGracePeriodLength(Duration.ofDays(5))
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    Instant creationTime = clock.now().minus(Duration.ofDays(10));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    DatabaseHelper.persistDomainAsDeleted(
+        DatabaseHelper.newDomain("example1.tld")
+            .asBuilder()
+            .setCreationTimeForTest(creationTime)
+            .build(),
+        deletionTime);
+    setEppInput("domain_check_one_tld.xml");
+    doCheckTest(
+        create(false, "example1.tld", "Reserved"),
+        create(true, "example2.tld", null),
+        create(true, "example3.tld", null));
+  }
+
   static AllocationToken setUpDefaultToken() {
     return setUpDefaultToken("TheRegistrar");
   }

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -77,6 +77,7 @@ import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Ordering;
 import google.registry.config.RegistryConfig;
+import google.registry.config.RegistryConfigSettings;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppRequestSource;
@@ -113,6 +114,7 @@ import google.registry.flows.domain.DomainFlowUtils.FeeDescriptionMultipleMatche
 import google.registry.flows.domain.DomainFlowUtils.FeeDescriptionParseException;
 import google.registry.flows.domain.DomainFlowUtils.FeesMismatchException;
 import google.registry.flows.domain.DomainFlowUtils.FeesRequiredDuringEarlyAccessProgramException;
+import google.registry.flows.domain.DomainFlowUtils.FeesRequiredDuringExpiryAccessPeriodException;
 import google.registry.flows.domain.DomainFlowUtils.FeesRequiredForPremiumNameException;
 import google.registry.flows.domain.DomainFlowUtils.InvalidDsRecordException;
 import google.registry.flows.domain.DomainFlowUtils.InvalidIdnDomainLabelException;
@@ -2688,6 +2690,427 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 + "during the Early Access Program. The EAP fee is: USD 100.00");
   }
 
+  @Test
+  void testFailure_domainInXap_withoutFeeAck_throwsException() throws Exception {
+    // Creating a domain during an active XAP tier without acknowledging the XAP fee in the EPP fee
+    // extension should fail with FeesRequiredDuringExpiryAccessPeriodException.
+    RegistryConfigSettings settings = RegistryConfig.CONFIG_SETTINGS.get();
+    BigDecimal originalInitialFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.initialFee.get("USD");
+    BigDecimal originalFinalFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.finalFee.get("USD");
+    settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    try {
+      persistHosts();
+      Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+      setXapForTld("tld", deletionTime);
+      Exception e =
+          assertThrows(FeesRequiredDuringExpiryAccessPeriodException.class, this::runFlow);
+      assertThat(e)
+          .hasMessageThat()
+          .isEqualTo(
+              "Fees must be explicitly acknowledged when creating domains "
+                  + "during the Expiry Access Period. The XAP fee is: USD 100.00");
+    } finally {
+      settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+          ImmutableMap.of("USD", originalInitialFee);
+      settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+          ImmutableMap.of("USD", originalFinalFee);
+    }
+  }
+
+  @Test
+  void testFailure_domainInXap_registrarNotOptedIn_throwsDomainReservedException()
+      throws Exception {
+    // When XAP is enabled on the TLD and the domain is in its XAP window, a registrar that has not
+    // opted into XAP cannot register the domain and should receive a DomainReservedException.
+    persistHosts();
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    Exception e = assertThrows(DomainReservedException.class, this::runFlow);
+    assertThat(e).hasMessageThat().isEqualTo("example.tld is a reserved domain");
+  }
+
+  @Test
+  void testSuccess_domainInXap_optedIn_withFeeAck_chargesXapFee() throws Exception {
+    // When an opted-in registrar acknowledges the XAP fee during an active XAP tier, domain
+    // creation should succeed and persist a one-time XAP fee (Reason.FEE_EXPIRY_ACCESS) in
+    // addition to the standard domain create fee (Reason.CREATE) and autorenew recurrence
+    // (Reason.RENEW).
+    RegistryConfigSettings settings = RegistryConfig.CONFIG_SETTINGS.get();
+    BigDecimal originalInitialFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.initialFee.get("USD");
+    BigDecimal originalFinalFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.finalFee.get("USD");
+    settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    try {
+      persistHosts();
+      Instant deletionTime = Instant.parse("1999-04-03T21:00:00.0Z");
+      setXapForTld("tld", deletionTime);
+      setEppInput(
+          "domain_create_eap_fee.xml",
+          new ImmutableMap.Builder<String, String>()
+              .putAll(FEE_STD_1_0_MAP)
+              .put("DESCRIPTION_1", "create")
+              .put("DESCRIPTION_2", "Expiry Access Period")
+              .build());
+      runFlowAssertResponse(loadFile("domain_create_response_xap_fee.xml"));
+
+      Domain domain = reloadResourceByForeignKey();
+      DomainHistory historyEntry = getHistoryEntries(domain, DomainHistory.class).get(0);
+      assertBillingEvents(
+          new BillingEvent.Builder()
+              .setReason(Reason.CREATE)
+              .setTargetId("example.tld")
+              .setRegistrarId("TheRegistrar")
+              .setPeriodYears(2)
+              .setCost(Money.of(USD, 24))
+              .setEventTime(clock.now())
+              .setBillingTime(clock.now().plus(Tld.get("tld").getAddGracePeriodLength()))
+              .setDomainHistory(historyEntry)
+              .build(),
+          new BillingEvent.Builder()
+              .setReason(Reason.FEE_EXPIRY_ACCESS)
+              .setTargetId("example.tld")
+              .setRegistrarId("TheRegistrar")
+              .setPeriodYears(1)
+              .setCost(Money.of(USD, 100))
+              .setEventTime(clock.now())
+              .setBillingTime(clock.now().plus(Tld.get("tld").getAddGracePeriodLength()))
+              .setDomainHistory(historyEntry)
+              .build(),
+          new BillingRecurrence.Builder()
+              .setReason(Reason.RENEW)
+              .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+              .setTargetId("example.tld")
+              .setRegistrarId("TheRegistrar")
+              .setEventTime(domain.getRegistrationExpirationTime())
+              .setRecurrenceEndTime(END_INSTANT)
+              .setDomainHistory(historyEntry)
+              .build());
+    } finally {
+      settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+          ImmutableMap.of("USD", originalInitialFee);
+      settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+          ImmutableMap.of("USD", originalFinalFee);
+    }
+  }
+
+  @Test
+  void testSuccess_premiumDomainInXap_optedIn_withFeeAck_chargesPremiumAndXapFees()
+      throws Exception {
+    // Creating a premium domain during active XAP should stack both fees, charging the premium
+    // domain create fee (Reason.CREATE) plus the one-time XAP tier fee (Reason.FEE_EXPIRY_ACCESS).
+    createTld("example");
+    RegistryConfigSettings settings = RegistryConfig.CONFIG_SETTINGS.get();
+    BigDecimal originalInitialFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.initialFee.get("USD");
+    BigDecimal originalFinalFee =
+        settings.registryPolicy.domainExpiryAccessPeriod.finalFee.get("USD");
+    settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+        ImmutableMap.of("USD", new BigDecimal("100.00"));
+    try {
+      persistHosts();
+      setEppInput("domain_create_premium_xap.xml");
+      Instant deletionTime = Instant.parse("1999-04-03T21:00:00.0Z");
+      setXapForTld("example", deletionTime);
+      runFlowAssertResponse(loadFile("domain_create_response_premium_xap.xml"));
+
+      Domain domain = reloadResourceByForeignKey();
+      DomainHistory historyEntry = getHistoryEntries(domain, DomainHistory.class).get(0);
+      assertBillingEvents(
+          new BillingEvent.Builder()
+              .setReason(Reason.CREATE)
+              .setTargetId("rich.example")
+              .setRegistrarId("TheRegistrar")
+              .setPeriodYears(2)
+              .setCost(Money.of(USD, 200))
+              .setEventTime(clock.now())
+              .setBillingTime(clock.now().plus(Tld.get("example").getAddGracePeriodLength()))
+              .setDomainHistory(historyEntry)
+              .build(),
+          new BillingEvent.Builder()
+              .setReason(Reason.FEE_EXPIRY_ACCESS)
+              .setTargetId("rich.example")
+              .setRegistrarId("TheRegistrar")
+              .setPeriodYears(1)
+              .setCost(Money.of(USD, 100))
+              .setEventTime(clock.now())
+              .setBillingTime(clock.now().plus(Tld.get("example").getAddGracePeriodLength()))
+              .setDomainHistory(historyEntry)
+              .build(),
+          new BillingRecurrence.Builder()
+              .setReason(Reason.RENEW)
+              .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+              .setTargetId("rich.example")
+              .setRegistrarId("TheRegistrar")
+              .setEventTime(domain.getRegistrationExpirationTime())
+              .setRecurrenceEndTime(END_INSTANT)
+              .setDomainHistory(historyEntry)
+              .build());
+    } finally {
+      settings.registryPolicy.domainExpiryAccessPeriod.initialFee =
+          ImmutableMap.of("USD", originalInitialFee);
+      settings.registryPolicy.domainExpiryAccessPeriod.finalFee =
+          ImmutableMap.of("USD", originalFinalFee);
+    }
+  }
+
+  @Test
+  void testSuccess_recentlyDeletedDomain_afterXapEnds_notOptedIn_succeedsWithoutXapFee()
+      throws Exception {
+    // Once the 10-day XAP window expires after deletion (e.g. day 11), the domain returns to
+    // standard pricing and can be registered without XAP fees or reservation blocks by
+    // non-opted-in registrars.
+    persistHosts();
+    Instant deletionTime = clock.now().minus(Duration.ofDays(11));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_recentlyDeletedDomain_afterXapEnds_optedIn_succeedsWithoutXapFee()
+      throws Exception {
+    // Once the 10-day XAP window expires after deletion (e.g. day 11), the domain returns to
+    // standard pricing and can be registered without XAP fees by opted-in registrars.
+    persistHosts();
+    Instant deletionTime = clock.now().minus(Duration.ofDays(11));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_recentlyDeletedDomain_beforeXapStarts_notOptedIn_succeedsWithoutXapFee()
+      throws Exception {
+    // If a domain was recently deleted but XAP mode is currently disabled on the TLD, the domain
+    // can be registered at standard pricing without XAP fees or reservation blocks by
+    // non-opted-in registrars.
+    persistHosts();
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.DISABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_recentlyDeletedDomain_beforeXapStarts_optedIn_succeedsWithoutXapFee()
+      throws Exception {
+    // If a domain was recently deleted but XAP mode is currently disabled on the TLD, the domain
+    // can be registered at standard pricing without XAP fees by opted-in registrars.
+    persistHosts();
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.DISABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_agpDeletedRegularDomain_duringXap_succeedsWithoutXapFee() throws Exception {
+    // A regular domain (registered without an XAP fee) that was deleted during its Add Grace
+    // Period (AGP) is exempt from XAP, succeeding at standard pricing without reservation blocks
+    // or XAP fees when re-registered during active XAP on the TLD.
+    persistHosts();
+    Instant creationTime = clock.now().minus(Duration.ofDays(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(
+                    START_INSTANT,
+                    Tld.ExpiryAccessPeriodMode.DISABLED,
+                    clock.now().minus(Duration.ofHours(1)),
+                    Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setCreationTime(creationTime)
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_agpDeletedXapDomain_duringXap_succeedsWithoutXapFee() throws Exception {
+    // A domain originally registered with an XAP fee that was deleted during its Add Grace
+    // Period (AGP) is exempt from XAP upon subsequent re-registration, succeeding at standard
+    // pricing without reservation blocks or XAP fees when re-registered during active XAP on the
+    // TLD.
+    persistHosts();
+    Instant creationTime = clock.now().minus(Duration.ofHours(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(false)
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setCreationTime(creationTime)
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+    doSuccessfulTest();
+  }
+
+  private void setXapForTld(String tldStr, Instant deletionTime) throws Exception {
+    persistResource(
+        Registrar.loadByRegistrarId("TheRegistrar")
+            .get()
+            .asBuilder()
+            .setExpiryAccessPeriodEnabled(true)
+            .build());
+    persistResource(
+        Tld.get(tldStr)
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+            .build());
+    persistResource(
+        new Domain.Builder()
+            .setDomainName(getUniqueIdFromCommand())
+            .setDeletionTime(deletionTime)
+            .setRegistrationExpirationTime(clock.now().plus(Duration.ofDays(365)))
+            .setCreationTime(clock.now().minus(Duration.ofDays(365)))
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("9999-EXAMPLE")
+            .build());
+  }
+
   private void setEapForTld(String tld) {
     persistResource(
         Tld.get(tld)

core/src/test/java/google/registry/flows/domain/DomainDeleteFlowTest.java

@@ -402,6 +402,36 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
         GracePeriodStatus.ADD, "domain_delete_response_fee.xml", FEE_STD_1_0_MAP);
   }
 
+  @Test
+  void testSuccess_addGracePeriodDelete_doesNotRefundXapFee() throws Exception {
+    setUpSuccessfulTest();
+    BillingEvent createBillingEvent =
+        persistResource(createBillingEvent(Reason.CREATE, Money.of(USD, 123)));
+    BillingEvent xapBillingEvent =
+        persistResource(createBillingEvent(Reason.FEE_EXPIRY_ACCESS, Money.of(USD, 100)));
+    setUpGracePeriods(
+        GracePeriod.forBillingEvent(GracePeriodStatus.ADD, domain.getRepoId(), createBillingEvent));
+    assertPollMessages(createAutorenewPollMessage("TheRegistrar").build());
+    clock.advanceOneMilli();
+    runFlowAssertResponse(loadFile("domain_delete_response_fee.xml", FEE_STD_1_0_MAP));
+    assertThat(reloadResourceByForeignKey()).isNull();
+    DomainHistory historyEntryDomainDelete =
+        getOnlyHistoryEntryOfType(domain, DOMAIN_DELETE, DomainHistory.class);
+    assertBillingEvents(
+        createAutorenewBillingEvent("TheRegistrar").setRecurrenceEndTime(clock.now()).build(),
+        createBillingEvent,
+        xapBillingEvent,
+        new BillingCancellation.Builder()
+            .setReason(Reason.CREATE)
+            .setTargetId("example.tld")
+            .setRegistrarId("TheRegistrar")
+            .setEventTime(clock.now())
+            .setBillingTime(plusDays(TIME_BEFORE_FLOW, 1))
+            .setBillingEvent(createBillingEvent.createVKey())
+            .setDomainHistory(historyEntryDomainDelete)
+            .build());
+  }
+
   private void doSuccessfulTest_noAddGracePeriod(String responseFilename) throws Exception {
     doSuccessfulTest_noAddGracePeriod(responseFilename, ImmutableMap.of());
   }

core/src/test/java/google/registry/flows/domain/DomainPricingLogicTest.java

@@ -30,12 +30,15 @@ import static google.registry.util.DateTimeUtils.END_INSTANT;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.minusHours;
 import static google.registry.util.DateTimeUtils.plusHours;
+import static org.joda.money.CurrencyUnit.JPY;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
+import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
+import com.google.common.collect.Range;
 import google.registry.flows.EppException;
 import google.registry.flows.HttpSessionMetadata;
 import google.registry.flows.SessionMetadata;
@@ -58,8 +61,10 @@ import google.registry.testing.FakeClock;
 import google.registry.testing.FakeHttpSession;
 import google.registry.util.Clock;
 import java.math.BigDecimal;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
+import org.joda.money.CurrencyUnit;
 import org.joda.money.Money;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -85,7 +90,12 @@ public class DomainPricingLogicTest {
     createTld("example");
     sessionMetadata = new HttpSessionMetadata(new FakeHttpSession());
     domainPricingLogic =
-        new DomainPricingLogic(new DomainPricingCustomLogic(eppInput, sessionMetadata, null));
+        new DomainPricingLogic(
+            new DomainPricingCustomLogic(eppInput, sessionMetadata, null),
+            Duration.ofDays(10),
+            Duration.ofHours(1),
+            ImmutableMap.of(USD, new BigDecimal("100000.00"), JPY, new BigDecimal("10000000")),
+            ImmutableMap.of(USD, new BigDecimal("10.00"), JPY, new BigDecimal("1000")));
     tld =
         persistResource(
             Tld.get("example")
@@ -146,7 +156,14 @@ public class DomainPricingLogicTest {
         persistResource(Tld.get("sunrise").asBuilder().setTldStateTransitions(transitions).build());
     assertThat(
             domainPricingLogic.getCreatePrice(
-                sunriseTld, "domain.sunrise", clock.now(), 2, false, true, Optional.empty()))
+                sunriseTld,
+                "domain.sunrise",
+                clock.now(),
+                Optional.empty(),
+                2,
+                false,
+                true,
+                Optional.empty()))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -170,7 +187,14 @@ public class DomainPricingLogicTest {
                 .build());
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "default.example", clock.now(), 1, false, false, Optional.of(allocationToken)))
+                tld,
+                "default.example",
+                clock.now(),
+                Optional.empty(),
+                1,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -195,7 +219,14 @@ public class DomainPricingLogicTest {
     // 3 year create should be 5 (discount price) + 10*2 (regular price) = 25.
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "default.example", clock.now(), 3, false, false, Optional.of(allocationToken)))
+                tld,
+                "default.example",
+                clock.now(),
+                Optional.empty(),
+                3,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -218,7 +249,14 @@ public class DomainPricingLogicTest {
                 .build());
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "default.example", clock.now(), 1, false, false, Optional.of(allocationToken)))
+                tld,
+                "default.example",
+                clock.now(),
+                Optional.empty(),
+                1,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1006,7 +1044,14 @@ public class DomainPricingLogicTest {
                 .build());
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 1, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                1,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1015,7 +1060,14 @@ public class DomainPricingLogicTest {
     // Two-year create should be 13 (standard price) + 100 (premium price), and it's premium
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 2, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1051,7 +1103,14 @@ public class DomainPricingLogicTest {
     // are standard
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 2, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1060,7 +1119,14 @@ public class DomainPricingLogicTest {
     // Similarly, 3 years should be 13 + 10 + 10
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 3, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                3,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1081,7 +1147,14 @@ public class DomainPricingLogicTest {
     // Two-year create should be 100 (premium 1st year) plus 10 (nonpremium 2nd year)
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 2, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1090,7 +1163,14 @@ public class DomainPricingLogicTest {
     // Similarly, 3 years should be 100 + 10 + 10
     assertThat(
             domainPricingLogic.getCreatePrice(
-                tld, "premium.example", clock.now(), 3, false, false, Optional.of(allocationToken)))
+                tld,
+                "premium.example",
+                clock.now(),
+                Optional.empty(),
+                3,
+                false,
+                false,
+                Optional.of(allocationToken)))
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
@@ -1135,4 +1215,291 @@ public class DomainPricingLogicTest {
                 .getRenewCost())
         .isEqualTo(Money.of(USD, 25));
   }
+
+  @Test
+  void testGetXapFeeFor_tier0_startOfXap() {
+    Instant deletionTime = clock.now();
+    Instant checkTime = deletionTime.plus(Duration.ofMinutes(30));
+    Optional<Fee> xapFee = domainPricingLogic.getXapFeeFor(checkTime, deletionTime, USD);
+    assertThat(xapFee)
+        .hasValue(
+            Fee.create(
+                new BigDecimal("100000.00"),
+                Fee.FeeType.XAP,
+                false,
+                Range.closedOpen(deletionTime, deletionTime.plus(Duration.ofHours(1))),
+                deletionTime.plus(Duration.ofHours(1))));
+  }
+
+  @Test
+  void testGetXapFeeFor_tier1() {
+    Instant deletionTime = clock.now();
+    Instant checkTime = deletionTime.plus(Duration.ofHours(1)).plus(Duration.ofMinutes(15));
+    Optional<Fee> xapFee = domainPricingLogic.getXapFeeFor(checkTime, deletionTime, USD);
+    assertThat(xapFee)
+        .hasValue(
+            Fee.create(
+                new BigDecimal("96219.61"),
+                Fee.FeeType.XAP,
+                false,
+                Range.closedOpen(
+                    deletionTime.plus(Duration.ofHours(1)), deletionTime.plus(Duration.ofHours(2))),
+                deletionTime.plus(Duration.ofHours(2))));
+  }
+
+  @Test
+  void testGetXapFeeFor_tier239_finalTier() {
+    Instant deletionTime = clock.now();
+    Instant checkTime = deletionTime.plus(Duration.ofHours(239)).plus(Duration.ofMinutes(30));
+    Optional<Fee> xapFee = domainPricingLogic.getXapFeeFor(checkTime, deletionTime, USD);
+    assertThat(xapFee)
+        .hasValue(
+            Fee.create(
+                new BigDecimal("10.00"),
+                Fee.FeeType.XAP,
+                false,
+                Range.closedOpen(
+                    deletionTime.plus(Duration.ofHours(239)),
+                    deletionTime.plus(Duration.ofHours(240))),
+                deletionTime.plus(Duration.ofHours(240))));
+  }
+
+  @Test
+  void testGetXapFeeFor_unconfiguredCurrency() {
+    Instant deletionTime = clock.now();
+    Instant checkTime = deletionTime.plus(Duration.ofMinutes(30));
+    Optional<Fee> xapFee =
+        domainPricingLogic.getXapFeeFor(checkTime, deletionTime, CurrencyUnit.EUR);
+    assertThat(xapFee).isEmpty();
+  }
+
+  @Test
+  void testGetCreatePrice_xapEnabled_includesXapFeeAndRequiresExtension() throws Exception {
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("deleted.example")
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        domainPricingLogic.getCreatePrice(
+            xapTld,
+            "deleted.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isTrue();
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.of(USD, new BigDecimal("96219.61")));
+    assertThat(feesAndCredits.getTotalCost()).isEqualTo(Money.of(USD, new BigDecimal("96232.61")));
+  }
+
+  @Test
+  void testGetXapFeeFor_afterXapEnds_returnsEmpty() {
+    Instant deletionTime = clock.now();
+    Instant checkTime = deletionTime.plus(Duration.ofDays(10)).plus(Duration.ofMinutes(1));
+    Optional<Fee> xapFee = domainPricingLogic.getXapFeeFor(checkTime, deletionTime, USD);
+    assertThat(xapFee).isEmpty();
+  }
+
+  @Test
+  void testGetCreatePrice_agpDeletedRegularDomain_duringXap_noXapFee() throws Exception {
+    // A regular domain deleted during AGP is exempt from XAP fee evaluation upon subsequent
+    // creation during active XAP.
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(
+                        START_INSTANT,
+                        Tld.ExpiryAccessPeriodMode.DISABLED,
+                        clock.now().minus(Duration.ofHours(1)),
+                        Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    Instant creationTime = clock.now().minus(Duration.ofDays(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("deleted.example")
+            .setCreationTime(creationTime)
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        domainPricingLogic.getCreatePrice(
+            xapTld,
+            "deleted.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isFalse();
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.zero(USD));
+    assertThat(feesAndCredits.getTotalCost()).isEqualTo(Money.of(USD, new BigDecimal("13.00")));
+  }
+
+  @Test
+  void testGetCreatePrice_agpDeletedXapDomain_duringXap_noXapFee() throws Exception {
+    // A domain originally registered with an XAP fee deleted during AGP is exempt from XAP fee
+    // evaluation upon subsequent creation during active XAP.
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    Instant creationTime = clock.now().minus(Duration.ofHours(2));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("deleted.example")
+            .setCreationTime(creationTime)
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        domainPricingLogic.getCreatePrice(
+            xapTld,
+            "deleted.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isFalse();
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.zero(USD));
+    assertThat(feesAndCredits.getTotalCost()).isEqualTo(Money.of(USD, new BigDecimal("13.00")));
+  }
+
+  @Test
+  void testGetCreatePrice_anchorTenantDeletedAfterStandardAgp_duringXap_chargesXapFee()
+      throws Exception {
+    // An anchor tenant domain deleted after standard AGP (5 days), e.g. on day 10 of its 30-day
+    // anchor tenant AGP, is subject to XAP fees upon re-registration (not exempt as an AGP delete).
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setAddGracePeriodLength(Duration.ofDays(5))
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    Instant creationTime = clock.now().minus(Duration.ofDays(10));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("deleted.example")
+            .setCreationTime(creationTime)
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        domainPricingLogic.getCreatePrice(
+            xapTld,
+            "deleted.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isTrue();
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.of(USD, new BigDecimal("96219.61")));
+  }
+
+  @Test
+  void testGetCreatePrice_premiumDomainInXap_chargesPremiumAndXapFees() throws Exception {
+    // Calculating create price for a recently deleted premium domain during active XAP should sum
+    // both the premium create fee and the one-time XAP tier fee.
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("premium.example")
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        domainPricingLogic.getCreatePrice(
+            xapTld,
+            "premium.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.hasAnyPremiumFees()).isTrue();
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isTrue();
+    assertThat(feesAndCredits.getCreateCost()).isEqualTo(Money.of(USD, new BigDecimal("100.00")));
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.of(USD, new BigDecimal("96219.61")));
+    assertThat(feesAndCredits.getTotalCost()).isEqualTo(Money.of(USD, new BigDecimal("96319.61")));
+  }
+
+  @Test
+  void testGetCreatePrice_zeroXapFee_doesNotRequireExtension() throws Exception {
+    // When an XAP tier fee is $0.00, it is included in the fee items but does not require a fee
+    // extension acknowledgment from the registrar.
+    Tld xapTld =
+        persistResource(
+            tld.asBuilder()
+                .setExpiryAccessPeriodTransitions(
+                    ImmutableSortedMap.of(START_INSTANT, Tld.ExpiryAccessPeriodMode.ENABLED))
+                .build());
+    DomainPricingLogic zeroFeePricingLogic =
+        new DomainPricingLogic(
+            new DomainPricingCustomLogic(eppInput, sessionMetadata, null),
+            Duration.ofDays(10),
+            Duration.ofHours(1),
+            ImmutableMap.of(USD, BigDecimal.ZERO),
+            ImmutableMap.of(USD, BigDecimal.ZERO));
+    Instant deletionTime = clock.now().minus(Duration.ofHours(1));
+    Domain deletedDomain =
+        new Domain.Builder()
+            .setDomainName("deleted.example")
+            .setDeletionTime(deletionTime)
+            .setCreationRegistrarId("TheRegistrar")
+            .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
+            .setRepoId("2-EXAMPLE")
+            .build();
+    FeesAndCredits feesAndCredits =
+        zeroFeePricingLogic.getCreatePrice(
+            xapTld,
+            "deleted.example",
+            clock.now(),
+            Optional.of(deletedDomain),
+            1,
+            false,
+            false,
+            Optional.empty());
+    assertThat(feesAndCredits.isFeeExtensionRequired()).isFalse();
+    assertThat(feesAndCredits.getXapCost()).isEqualTo(Money.zero(USD));
+    assertThat(feesAndCredits.getTotalCost()).isEqualTo(Money.of(USD, new BigDecimal("13.00")));
+  }
 }

core/src/test/java/google/registry/flows/domain/token/AllocationTokenFlowUtilsTest.java

@@ -36,6 +36,7 @@ import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.net.InternetDomainName;
@@ -54,6 +55,7 @@ import google.registry.model.tld.Tld;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
@@ -73,7 +75,12 @@ class AllocationTokenFlowUtilsTest {
       mock(AllocationTokenExtension.class);
 
   private final DomainPricingLogic domainPricingLogic =
-      new DomainPricingLogic(new DomainPricingCustomLogic(null, null, null));
+      new DomainPricingLogic(
+          new DomainPricingCustomLogic(null, null, null),
+          Duration.ofDays(30),
+          Duration.ofDays(1),
+          ImmutableMap.of(),
+          ImmutableMap.of());
 
   private Tld tld;
 

core/src/test/java/google/registry/gcs/GcsUtilsTest.java

@@ -15,27 +15,40 @@
 package google.registry.gcs;
 
 import static com.google.common.truth.Truth.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.BlobInfo;
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo;
+import com.google.cloud.storage.Storage;
 import com.google.cloud.storage.StorageOptions;
 import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.io.ByteStreams;
 import com.google.common.net.MediaType;
+import google.registry.testing.SystemPropertyExtension;
+import google.registry.util.RegistryEnvironment;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.OutputStream;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
 
 /** Unit tests for {@link GcsUtilsTest}. */
 class GcsUtilsTest {
 
+  @RegisterExtension
+  final SystemPropertyExtension systemPropertyExtension = new SystemPropertyExtension();
+
   private GcsUtils gcsUtils = new GcsUtils(LocalStorageHelper.getOptions());
 
   private String bucket = "my-bucket";
@@ -43,9 +56,18 @@ class GcsUtilsTest {
   private BlobId blobId = BlobId.of(bucket, filename);
   private ImmutableMap<String, String> metadata = ImmutableMap.of("key1", "val1", "Key2", "val2");
   private final byte[] bytes = new byte[] {'a', 'b', 'c'};
+  private RegistryEnvironment previousEnvironment;
 
   @BeforeEach
-  void beforeEach() {}
+  void beforeEach() {
+    previousEnvironment = RegistryEnvironment.get();
+    GcsUtils.clearPapCache();
+  }
+
+  @AfterEach
+  void afterEach() {
+    previousEnvironment.setup();
+  }
 
   @Test
   void testSerialization_testStorage() throws Exception {
@@ -111,6 +133,88 @@ class GcsUtilsTest {
     assertThat(gcsUtils.existsAndNotEmpty(blobId)).isFalse();
   }
 
+  @Test
+  void testVerifyPublicAccessPrevention_enforced() {
+    RegistryEnvironment.PRODUCTION.setup(systemPropertyExtension);
+    Storage mockStorage = mock(Storage.class);
+    StorageOptions mockOptions = mock(StorageOptions.class);
+    when(mockOptions.getService()).thenReturn(mockStorage);
+
+    Bucket mockBucket = mock(Bucket.class);
+    when(mockStorage.get("my-bucket")).thenReturn(mockBucket);
+
+    BucketInfo.IamConfiguration mockIamConfig = mock(BucketInfo.IamConfiguration.class);
+    when(mockBucket.getIamConfiguration()).thenReturn(mockIamConfig);
+    when(mockIamConfig.getPublicAccessPrevention())
+        .thenReturn(BucketInfo.PublicAccessPrevention.ENFORCED);
+
+    GcsUtils utils = new GcsUtils(mockOptions);
+    utils.verifyPublicAccessPrevention("my-bucket");
+  }
+
+  @Test
+  void testVerifyPublicAccessPrevention_notCheckedInNonProd() {
+    RegistryEnvironment.SANDBOX.setup(systemPropertyExtension);
+    Storage mockStorage = mock(Storage.class);
+    StorageOptions mockOptions = mock(StorageOptions.class);
+    when(mockOptions.getService()).thenReturn(mockStorage);
+
+    Bucket mockBucket = mock(Bucket.class);
+    when(mockStorage.get("my-bucket")).thenReturn(mockBucket);
+
+    BucketInfo.IamConfiguration mockIamConfig = mock(BucketInfo.IamConfiguration.class);
+    when(mockBucket.getIamConfiguration()).thenReturn(mockIamConfig);
+    when(mockIamConfig.getPublicAccessPrevention())
+        .thenReturn(BucketInfo.PublicAccessPrevention.INHERITED);
+
+    GcsUtils utils = new GcsUtils(mockOptions);
+    // no exception thrown even though PAP isn't enforced
+    utils.verifyPublicAccessPrevention("my-bucket");
+  }
+
+  @Test
+  void testVerifyPublicAccessPrevention_notEnforced() {
+    RegistryEnvironment.PRODUCTION.setup(systemPropertyExtension);
+    Storage mockStorage = mock(Storage.class);
+    StorageOptions mockOptions = mock(StorageOptions.class);
+    when(mockOptions.getService()).thenReturn(mockStorage);
+
+    Bucket mockBucket = mock(Bucket.class);
+    when(mockStorage.get("my-bucket")).thenReturn(mockBucket);
+
+    BucketInfo.IamConfiguration mockIamConfig = mock(BucketInfo.IamConfiguration.class);
+    when(mockBucket.getIamConfiguration()).thenReturn(mockIamConfig);
+    when(mockIamConfig.getPublicAccessPrevention())
+        .thenReturn(BucketInfo.PublicAccessPrevention.INHERITED);
+
+    GcsUtils utils = new GcsUtils(mockOptions);
+
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class, () -> utils.verifyPublicAccessPrevention("my-bucket"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("Public Access Prevention is not enforced on bucket my-bucket");
+  }
+
+  @Test
+  void testVerifyPublicAccessPrevention_nonexistentBucket() {
+    RegistryEnvironment.PRODUCTION.setup(systemPropertyExtension);
+    Storage mockStorage = mock(Storage.class);
+    StorageOptions mockOptions = mock(StorageOptions.class);
+    when(mockOptions.getService()).thenReturn(mockStorage);
+
+    when(mockStorage.get("nonexistent-bucket")).thenReturn(null);
+
+    GcsUtils utils = new GcsUtils(mockOptions);
+
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class,
+            () -> utils.verifyPublicAccessPrevention("nonexistent-bucket"));
+    assertThat(thrown).hasMessageThat().contains("Bucket nonexistent-bucket does not exist");
+  }
+
   private static byte[] serialize(Object object) throws IOException {
     try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
       ObjectOutputStream oos = new ObjectOutputStream(baos);

core/src/test/java/google/registry/model/OteStatsTest.java

@@ -16,10 +16,17 @@ package google.registry.model;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.persistActiveDomain;
+import static google.registry.testing.DatabaseHelper.persistPremiumList;
+import static google.registry.testing.DatabaseHelper.persistResource;
+import static org.joda.money.CurrencyUnit.USD;
 
 import google.registry.model.OteStats.StatType;
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.reporting.HistoryEntry.Type;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
+import java.time.Instant;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -60,39 +67,40 @@ public final class OteStatsTest {
     OteStats stats = OteStats.getFromRegistrar("blobio");
     String expected =
         """
-            contact creates: 0
-            contact deletes: 0
-            contact transfer approves: 0
-            contact transfer cancels: 0
-            contact transfer rejects: 0
-            contact transfer requests: 0
-            contact updates: 0
-            domain autorenews: 0
-            domain creates: 5
-            domain creates ascii: 4
-            domain creates idn: 1
-            domain creates start date sunrise: 1
-            domain creates with claims notice: 1
-            domain creates with fee: 1
-            domain creates with sec dns: 1
-            domain creates without sec dns: 4
-            domain deletes: 1
-            domain renews: 0
-            domain restores: 1
-            domain transfer approves: 1
-            domain transfer cancels: 1
-            domain transfer rejects: 1
-            domain transfer requests: 1
-            domain updates: 1
-            domain updates with sec dns: 1
-            domain updates without sec dns: 0
-            host creates: 1
-            host creates external: 0
-            host creates subordinate: 1
-            host deletes: 1
-            host updates: 1
-            unclassified flows: 0
-            TOTAL: 30""";
+        contact creates: 0
+        contact deletes: 0
+        contact transfer approves: 0
+        contact transfer cancels: 0
+        contact transfer rejects: 0
+        contact transfer requests: 0
+        contact updates: 0
+        domain autorenews: 0
+        domain creates: 5
+        domain creates ascii: 4
+        domain creates idn: 1
+        domain creates start date sunrise: 1
+        domain creates with claims notice: 1
+        domain creates with fee: 1
+        domain creates with sec dns: 1
+        domain creates without sec dns: 4
+        domain deletes: 1
+        domain renews: 0
+        domain restores: 1
+        domain transfer approves: 1
+        domain transfer cancels: 1
+        domain transfer rejects: 1
+        domain transfer requests: 1
+        domain updates: 1
+        domain updates with sec dns: 1
+        domain updates without sec dns: 0
+        host creates: 1
+        host creates external: 0
+        host creates subordinate: 1
+        host deletes: 1
+        host updates: 1
+        unclassified flows: 0
+        TOTAL: 30\
+        """;
     assertThat(stats.toString()).isEqualTo(expected);
   }
 
@@ -102,39 +110,72 @@ public final class OteStatsTest {
     OteStats stats = OteStats.getFromRegistrar("blobio");
     String expected =
         """
-            contact creates: 0
-            contact deletes: 0
-            contact transfer approves: 0
-            contact transfer cancels: 0
-            contact transfer rejects: 0
-            contact transfer requests: 0
-            contact updates: 0
-            domain autorenews: 0
-            domain creates: 4
-            domain creates ascii: 4
-            domain creates idn: 0
-            domain creates start date sunrise: 1
-            domain creates with claims notice: 1
-            domain creates with fee: 1
-            domain creates with sec dns: 1
-            domain creates without sec dns: 3
-            domain deletes: 1
-            domain renews: 0
-            domain restores: 0
-            domain transfer approves: 1
-            domain transfer cancels: 1
-            domain transfer rejects: 1
-            domain transfer requests: 1
-            domain updates: 1
-            domain updates with sec dns: 1
-            domain updates without sec dns: 0
-            host creates: 1
-            host creates external: 0
-            host creates subordinate: 1
-            host deletes: 0
-            host updates: 10
-            unclassified flows: 0
-            TOTAL: 34""";
+        contact creates: 0
+        contact deletes: 0
+        contact transfer approves: 0
+        contact transfer cancels: 0
+        contact transfer rejects: 0
+        contact transfer requests: 0
+        contact updates: 0
+        domain autorenews: 0
+        domain creates: 4
+        domain creates ascii: 4
+        domain creates idn: 0
+        domain creates start date sunrise: 1
+        domain creates with claims notice: 1
+        domain creates with fee: 1
+        domain creates with sec dns: 1
+        domain creates without sec dns: 3
+        domain deletes: 1
+        domain renews: 0
+        domain restores: 0
+        domain transfer approves: 1
+        domain transfer cancels: 1
+        domain transfer rejects: 1
+        domain transfer requests: 1
+        domain updates: 1
+        domain updates with sec dns: 1
+        domain updates without sec dns: 0
+        host creates: 1
+        host creates external: 0
+        host creates subordinate: 1
+        host deletes: 0
+        host updates: 10
+        unclassified flows: 0
+        TOTAL: 34\
+        """;
     assertThat(stats.toString()).isEqualTo(expected);
   }
+
+  @Test
+  void testDomainCreateWithoutXmlBytes_doesNotSatisfyComplexRequirements() throws Exception {
+    persistPremiumList("default_sandbox_list", USD, "sandbox,USD 1000");
+    OteAccountBuilder.forRegistrarId("blobio").buildAndPersist();
+    String oteAccount1 = "blobio-1";
+    Instant now = Instant.parse("2026-06-25T10:00:00Z");
+
+    // Persist a DOMAIN_CREATE history entry without XML bytes
+    persistResource(
+        new DomainHistory.Builder()
+            .setDomain(persistActiveDomain("example.tld"))
+            .setRegistrarId(oteAccount1)
+            .setType(Type.DOMAIN_CREATE)
+            .setXmlBytes(null) // explicitly null
+            .setModificationTime(now)
+            .build());
+
+    OteStats stats = OteStats.getFromRegistrar("blobio");
+
+    // It should count towards the basic DOMAIN_CREATES
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES)).isEqualTo(1);
+
+    // It should NOT count towards any stat type that requires EPP input filtering
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_ASCII)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_IDN)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_START_DATE_SUNRISE)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_WITH_CLAIMS_NOTICE)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_WITH_FEE)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_WITH_SEC_DNS)).isEqualTo(0);
+    assertThat(stats.getCount(StatType.DOMAIN_CREATES_WITHOUT_SEC_DNS)).isEqualTo(0);
+  }
 }

core/src/test/java/google/registry/model/billing/BillingBaseTest.java

@@ -890,4 +890,23 @@ public class BillingBaseTest extends EntityTestCase {
             "Renewal price can have a value if and only if the "
                 + "renewal price behavior is SPECIFIED");
   }
+
+  @Test
+  void testFailure_buildWithSpecifiedRenewalBehavior_negativeRenewalPrice() {
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new BillingRecurrence.Builder()
+                        .setDomainHistory(domainHistory)
+                        .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+                        .setReason(Reason.RENEW)
+                        .setEventTime(plusYears(now, 1))
+                        .setRenewalPriceBehavior(RenewalPriceBehavior.SPECIFIED)
+                        .setRenewalPrice(Money.of(USD, -100))
+                        .setRecurrenceEndTime(END_INSTANT)
+                        .build()))
+        .hasMessageThat()
+        .isEqualTo("SPECIFIED renewal price cannot be negative");
+  }
 }

core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java

@@ -612,6 +612,22 @@ public class AllocationTokenTest extends EntityTestCase {
         .isEqualTo("renewalPrice must be specified iff renewalPriceBehavior is SPECIFIED");
   }
 
+  @Test
+  void testBuild_negativeRenewalPrice() {
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new AllocationToken.Builder()
+                        .setToken("abc")
+                        .setTokenType(SINGLE_USE)
+                        .setRenewalPriceBehavior(RenewalPriceBehavior.SPECIFIED)
+                        .setRenewalPrice(Money.of(CurrencyUnit.USD, -5))
+                        .build()))
+        .hasMessageThat()
+        .isEqualTo("Renewal price cannot be negative");
+  }
+
   @Test
   void testBuild_registrationBehaviors() {
     createTld("tld");

core/src/test/java/google/registry/model/registrar/RegistrarTest.java

@@ -773,4 +773,20 @@ class RegistrarTest extends EntityTestCase {
     assertThat(Registrar.loadByRegistrarId("registrar").toString())
         .contains("allowedTlds=[bar, baz, foo, gon, tri]");
   }
+
+  @Test
+  void testSuccess_expiryAccessPeriodEnabled() {
+    assertThat(registrar.getExpiryAccessPeriodEnabled()).isFalse();
+    persistResource(registrar.asBuilder().setExpiryAccessPeriodEnabled(true).build());
+    assertThat(
+            Registrar.loadByRegistrarId("registrar").orElseThrow().getExpiryAccessPeriodEnabled())
+        .isTrue();
+  }
+
+  @Test
+  void testSuccess_toJsonMap_includesExpiryAccessPeriodEnabled() {
+    assertThat(registrar.toJsonMap()).containsEntry("expiryAccessPeriodEnabled", false);
+    Registrar modified = registrar.asBuilder().setExpiryAccessPeriodEnabled(true).build();
+    assertThat(modified.toJsonMap()).containsEntry("expiryAccessPeriodEnabled", true);
+  }
 }

core/src/test/java/google/registry/model/tld/TldTest.java

@@ -257,7 +257,8 @@ public final class TldTest extends EntityTestCase {
                     .asBuilder()
                     .setCreateBillingCostTransitions(createCostTransitions)
                     .build());
-    assertThat(thrown.getMessage()).isEqualTo("Create billing cost cannot be negative");
+    assertThat(thrown.getMessage())
+        .isEqualTo("Some create cost(s) are negative or in the wrong currency");
   }
 
   @Test
@@ -614,8 +615,11 @@ public final class TldTest extends EntityTestCase {
                 Tld.get("tld")
                     .asBuilder()
                     .setRenewBillingCostTransitions(
-                        ImmutableSortedMap.of(START_INSTANT, Money.of(USD, -42))));
-    assertThat(thrown).hasMessageThat().contains("billing cost cannot be negative");
+                        ImmutableSortedMap.of(START_INSTANT, Money.of(USD, -42)))
+                    .build());
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Some renew cost(s) are negative or in the wrong currency");
   }
 
   @Test
@@ -623,8 +627,10 @@ public final class TldTest extends EntityTestCase {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> Tld.get("tld").asBuilder().setRestoreBillingCost(Money.of(USD, -42)));
-    assertThat(thrown).hasMessageThat().contains("restoreBillingCost cannot be negative");
+            () -> Tld.get("tld").asBuilder().setRestoreBillingCost(Money.of(USD, -42)).build());
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Restore cost is negative or in the wrong currency");
   }
 
   @Test
@@ -652,8 +658,14 @@ public final class TldTest extends EntityTestCase {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () -> Tld.get("tld").asBuilder().setServerStatusChangeBillingCost(Money.of(USD, -42)));
-    assertThat(thrown).hasMessageThat().contains("billing cost cannot be negative");
+            () ->
+                Tld.get("tld")
+                    .asBuilder()
+                    .setServerStatusChangeBillingCost(Money.of(USD, -42))
+                    .build());
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Server status change cost is negative or in the wrong currency");
   }
 
   @Test
@@ -667,7 +679,9 @@ public final class TldTest extends EntityTestCase {
                     .setRenewBillingCostTransitions(
                         ImmutableSortedMap.of(START_INSTANT, Money.of(EUR, 42)))
                     .build());
-    assertThat(thrown).hasMessageThat().contains("cost must be in the TLD's currency");
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Some renew cost(s) are negative or in the wrong currency");
   }
 
   @Test
@@ -681,7 +695,7 @@ public final class TldTest extends EntityTestCase {
                     .setCreateBillingCostTransitions(
                         ImmutableSortedMap.of(START_INSTANT, Money.of(EUR, 42)))
                     .build());
-    assertThat(thrown).hasMessageThat().contains("cost must be in the TLD's currency");
+    assertThat(thrown).hasMessageThat().contains("negative or in the wrong currency");
   }
 
   @Test
@@ -690,7 +704,7 @@ public final class TldTest extends EntityTestCase {
         assertThrows(
             IllegalArgumentException.class,
             () -> Tld.get("tld").asBuilder().setRestoreBillingCost(Money.of(EUR, 42)).build());
-    assertThat(thrown).hasMessageThat().contains("cost must be in the TLD's currency");
+    assertThat(thrown).hasMessageThat().contains("negative or in the wrong currency");
   }
 
   @Test
@@ -703,7 +717,7 @@ public final class TldTest extends EntityTestCase {
                     .asBuilder()
                     .setServerStatusChangeBillingCost(Money.of(EUR, 42))
                     .build());
-    assertThat(thrown).hasMessageThat().contains("cost must be in the TLD's currency");
+    assertThat(thrown).hasMessageThat().contains("negative or in the wrong currency");
   }
 
   @Test
@@ -732,6 +746,37 @@ public final class TldTest extends EntityTestCase {
         .isEqualTo(new BigDecimal("50.00"));
   }
 
+  @Test
+  void testExpiryAccessPeriodMode_undefined() {
+    assertThat(Tld.get("tld").getExpiryAccessPeriodModeAt(fakeClock.now()))
+        .isEqualTo(Tld.ExpiryAccessPeriodMode.DISABLED);
+  }
+
+  @Test
+  void testExpiryAccessPeriodMode_specified() {
+    Instant a = minusDays(fakeClock.now(), 1);
+    Instant b = plusDays(fakeClock.now(), 1);
+    Tld tld =
+        Tld.get("tld")
+            .asBuilder()
+            .setExpiryAccessPeriodTransitions(
+                ImmutableSortedMap.of(
+                    START_INSTANT,
+                    Tld.ExpiryAccessPeriodMode.DISABLED,
+                    a,
+                    Tld.ExpiryAccessPeriodMode.ENABLED,
+                    b,
+                    Tld.ExpiryAccessPeriodMode.DISABLED))
+            .build();
+
+    assertThat(tld.getExpiryAccessPeriodModeAt(fakeClock.now()))
+        .isEqualTo(Tld.ExpiryAccessPeriodMode.ENABLED);
+    assertThat(tld.getExpiryAccessPeriodModeAt(minusDays(fakeClock.now(), 2)))
+        .isEqualTo(Tld.ExpiryAccessPeriodMode.DISABLED);
+    assertThat(tld.getExpiryAccessPeriodModeAt(plusDays(fakeClock.now(), 2)))
+        .isEqualTo(Tld.ExpiryAccessPeriodMode.DISABLED);
+  }
+
   @Test
   void testFailure_eapFee_wrongCurrency() {
     IllegalArgumentException thrown =
@@ -742,7 +787,7 @@ public final class TldTest extends EntityTestCase {
                     .asBuilder()
                     .setEapFeeSchedule(ImmutableSortedMap.of(START_INSTANT, Money.zero(EUR)))
                     .build());
-    assertThat(thrown).hasMessageThat().contains("All EAP fees must be in the TLD's currency");
+    assertThat(thrown).hasMessageThat().contains("negative or in the wrong currency");
   }
 
   @Test

core/src/test/java/google/registry/model/tld/label/PremiumListTest.java

@@ -110,28 +110,44 @@ public class PremiumListTest {
 
   @Test
   void testValidation_labelMustBeLowercase() {
-    Exception e =
-        assertThrows(
-            IllegalArgumentException.class,
-            () ->
-                new PremiumEntry.Builder()
-                    .setPrice(BigDecimal.valueOf(399))
-                    .setLabel("UPPER.tld")
-                    .build());
-    assertThat(e).hasMessageThat().contains("must be in puny-coded, lower-case form");
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new PremiumEntry.Builder()
+                        .setPrice(BigDecimal.valueOf(399))
+                        .setLabel("UPPER.tld")
+                        .build()))
+        .hasMessageThat()
+        .contains("must be in puny-coded, lower-case form");
+  }
+
+  @Test
+  void testValidation_priceMustNotBeNegative() {
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new PremiumEntry.Builder()
+                        .setPrice(BigDecimal.valueOf(-100))
+                        .setLabel("anchor")
+                        .build()))
+        .hasMessageThat()
+        .isEqualTo("Price must not be negative");
   }
 
   @Test
   void testValidation_labelMustBePunyCoded() {
-    Exception e =
-        assertThrows(
-            IllegalArgumentException.class,
-            () ->
-                new PremiumEntry.Builder()
-                    .setPrice(BigDecimal.valueOf(399))
-                    .setLabel("lower.みんな")
-                    .build());
-    assertThat(e).hasMessageThat().contains("must be in puny-coded, lower-case form");
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new PremiumEntry.Builder()
+                        .setPrice(BigDecimal.valueOf(399))
+                        .setLabel("lower.みんな")
+                        .build()))
+        .hasMessageThat()
+        .contains("must be in puny-coded, lower-case form");
   }
 
   @Test

core/src/test/java/google/registry/persistence/transaction/JpaTransactionManagerImplTest.java

@@ -404,6 +404,39 @@ class JpaTransactionManagerImplTest {
         .containsExactlyElementsIn(moreEntities);
   }
 
+  @Test
+  void loadAllOfSorted() {
+    TestEntity entityB = new TestEntity("b_entity", "gamma");
+    TestEntity entityC = new TestEntity("c_entity", "alpha");
+    TestEntity entityA = new TestEntity("a_entity", "beta");
+    persistResources(ImmutableList.of(entityB, entityC, entityA));
+
+    assertThat(tm().transact(() -> tm().loadAllOfSorted(TestEntity.class, "name")))
+        .containsExactly(entityA, entityB, entityC)
+        .inOrder();
+
+    assertThat(tm().transact(() -> tm().loadAllOfSorted(TestEntity.class, "data")))
+        .containsExactly(entityC, entityA, entityB)
+        .inOrder();
+
+    assertThat(tm().transact(() -> tm().loadAllOfSorted(TestEntity.class, "data", "name")))
+        .containsExactly(entityC, entityA, entityB)
+        .inOrder();
+  }
+
+  @Test
+  void loadAllOfSorted_invalidFieldName_throwsException() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                tm().transact(
+                        () ->
+                            tm().loadAllOfSorted(
+                                    TestEntity.class, "name; DROP TABLE TestEntity;")));
+    assertThat(thrown).hasMessageThat().contains("Invalid sort field name");
+  }
+
   @Test
   void saveAllNew_rollsBackWhenFailure() {
     moreEntities.forEach(entity -> assertThat(tm().transact(() -> tm().exists(entity))).isFalse());

core/src/test/java/google/registry/rdap/RdapTestHelper.java

@@ -73,7 +73,10 @@ class RdapTestHelper {
             "We reserve the right to modify this agreement at any time.");
     rdapJsonFormatter.rdapTosStaticUrl = "https://www.example.tld/about/rdap/tos.html";
     rdapJsonFormatter.hostCache =
-        (repoId) -> Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)));
+        (repoId) ->
+            Optional.ofNullable(EppResource.loadByCache(VKey.create(Host.class, repoId)))
+                .filter(host -> clock.now().isBefore(host.getDeletionTime()))
+                .map(host -> (Host) host.cloneProjectedAtTime(clock.now()));
     return rdapJsonFormatter;
   }
 

core/src/test/java/google/registry/rde/RdeUploadActionTest.java

@@ -155,7 +155,7 @@ public class RdeUploadActionTest {
       action.timeout = Duration.ofSeconds(23);
       action.tld = "tld";
       action.sftpCooldown = Duration.ofSeconds(7);
-      action.uploadUrl = uploadUrl;
+      action.rdeUploadUrl = RdeUploadUrl.create(uploadUrl);
       action.receiverKey = keyring.getRdeReceiverKey();
       action.signingKey = keyring.getRdeSigningKey();
       action.stagingDecryptionKey = keyring.getRdeStagingDecryptionKey();
@@ -212,7 +212,7 @@ public class RdeUploadActionTest {
   @Test
   void testRun() {
     createTld("lol");
-    RdeUploadAction action = createAction(null);
+    RdeUploadAction action = createAction(URI.create("sftp://user:password@localhost:5432"));
     action.tld = "lol";
     action.run();
     verify(runner)
@@ -231,7 +231,7 @@ public class RdeUploadActionTest {
   @Test
   void testRun_withPrefix() throws Exception {
     createTld("lol");
-    RdeUploadAction action = createAction(null);
+    RdeUploadAction action = createAction(URI.create("sftp://user:password@localhost:5432"));
     action.prefix = Optional.of("job-name/");
     action.tld = "lol";
     action.run();

core/src/test/java/google/registry/reporting/billing/GenerateInvoicesActionTest.java

@@ -15,8 +15,11 @@
 package google.registry.reporting.billing;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
+import static google.registry.testing.DatabaseHelper.persistResource;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+import static org.mockito.ArgumentMatchers.startsWith;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -25,6 +28,7 @@ import com.google.cloud.tasks.v2.HttpMethod;
 import com.google.common.net.MediaType;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.beam.BeamActionTestBase;
+import google.registry.model.common.Cursor;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.reporting.ReportingModule;
@@ -33,6 +37,7 @@ import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.FakeClock;
 import java.io.IOException;
 import java.time.Duration;
+import java.time.Instant;
 import java.time.YearMonth;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -50,8 +55,13 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
   private CloudTasksUtils cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
   private GenerateInvoicesAction action;
 
+  private void setCursor(Instant cursorTime) {
+    persistResource(Cursor.createGlobal(RECURRING_BILLING, cursorTime));
+  }
+
   @Test
   void testLaunchTemplateJob_withPublish() throws Exception {
+    setCursor(Instant.parse("2017-11-01T00:00:00Z"));
     action =
         new GenerateInvoicesAction(
             "test-project",
@@ -84,6 +94,7 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
 
   @Test
   void testLaunchTemplateJob_withoutPublish() throws Exception {
+    setCursor(Instant.parse("2017-11-01T00:00:00Z"));
     action =
         new GenerateInvoicesAction(
             "test-project",
@@ -107,6 +118,7 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
 
   @Test
   void testCaughtIOException() throws IOException {
+    setCursor(Instant.parse("2017-11-01T00:00:00Z"));
     when(launch.execute()).thenThrow(new IOException("Pipeline error"));
     action =
         new GenerateInvoicesAction(
@@ -128,4 +140,58 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
     verify(emailUtils).sendAlertEmail("Pipeline Launch failed due to Pipeline error");
     cloudTasksHelper.assertNoTasksEnqueued("beam-reporting");
   }
+
+  @Test
+  void testFailure_cursorLagging() {
+    setCursor(Instant.parse("2017-10-31T23:59:59.999Z"));
+    action =
+        new GenerateInvoicesAction(
+            "test-project",
+            "test-region",
+            "staging_bucket",
+            "billing_bucket",
+            "REG-INV",
+            false,
+            YearMonth.of(2017, 10),
+            emailUtils,
+            cloudTasksUtils,
+            clock,
+            response,
+            dataflow);
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_INTERNAL_SERVER_ERROR);
+    assertThat(response.getPayload()).contains("Pipeline launch failed");
+    assertThat(response.getPayload()).contains("BillingRecurrence expansion cursor");
+    verify(emailUtils)
+        .sendAlertEmail(
+            startsWith("Pipeline Launch failed due to BillingRecurrence expansion cursor"));
+    cloudTasksHelper.assertNoTasksEnqueued("beam-reporting");
+  }
+
+  @Test
+  void testFailure_cursorMissing() {
+    // Do not set cursor, should default to START_INSTANT (1970)
+    action =
+        new GenerateInvoicesAction(
+            "test-project",
+            "test-region",
+            "staging_bucket",
+            "billing_bucket",
+            "REG-INV",
+            false,
+            YearMonth.of(2017, 10),
+            emailUtils,
+            cloudTasksUtils,
+            clock,
+            response,
+            dataflow);
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_INTERNAL_SERVER_ERROR);
+    assertThat(response.getPayload()).contains("Pipeline launch failed");
+    assertThat(response.getPayload()).contains("BillingRecurrence expansion cursor");
+    verify(emailUtils)
+        .sendAlertEmail(
+            startsWith("Pipeline Launch failed due to BillingRecurrence expansion cursor"));
+    cloudTasksHelper.assertNoTasksEnqueued("beam-reporting");
+  }
 }

core/src/test/java/google/registry/tools/ConfigureTldCommandTest.java

@@ -454,6 +454,16 @@ public class ConfigureTldCommandTest extends CommandTestCase<ConfigureTldCommand
                 + " unit USD. Found [EUR] currency unit(s) in the renewBillingCostTransitionsMap");
   }
 
+  @Test
+  void testFailure_negativeCreateCost() throws Exception {
+    File tldFile = tmpDir.resolve("negativecost.yaml").toFile();
+    Files.asCharSink(tldFile, UTF_8).write(loadFile(getClass(), "negativecost.yaml"));
+    IllegalArgumentException thrown =
+        assertThrows(IllegalArgumentException.class, () -> runCommandForced("--input=" + tldFile));
+    assertThat(thrown.getMessage())
+        .isEqualTo("Some create cost(s) are negative or in the wrong currency");
+  }
+
   @Test
   void testSuccess_emptyStringClearsDefaultPromoTokens() throws Exception {
     Tld tld = createTld("tld");

core/src/test/java/google/registry/tools/CreatePremiumListCommandTest.java

@@ -119,4 +119,11 @@ class CreatePremiumListCommandTest<C extends CreatePremiumListCommand>
                     + "yet TLD %s does not exist",
                 fileName));
   }
+
+  @Test
+  void testDryRun_doesNotCreateList() throws Exception {
+    runCommandForced(
+        "--name=" + TLD_TEST, "--input=" + premiumTermsPath, "--currency=USD", "--dry_run");
+    assertThat(PremiumListDao.getLatestRevision(TLD_TEST)).isEmpty();
+  }
 }

core/src/test/java/google/registry/tools/CreateReservedListCommandTest.java

@@ -180,4 +180,11 @@ class CreateReservedListCommandTest
     command.init();
     assertThat(command.prompt()).contains("reservedListMap=[]");
   }
+
+  @Test
+  void testDryRun_doesNotCreateList() throws Exception {
+    runCommandForced(
+        "--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath, "--dry_run");
+    assertThat(ReservedList.get("xn--q9jyb4c_common-reserved")).isEmpty();
+  }
 }

core/src/test/java/google/registry/tools/UpdatePremiumListCommandTest.java

@@ -209,9 +209,7 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
                     "--name=" + TLD_TEST,
                     "--input=" + Paths.get(tmpFile.getPath())));
     assertThat(thrown.getMessage())
-        .isEqualTo(
-            "The --build_environment flag must be used when running update_premium_list in"
-                + " production");
+        .isEqualTo("The --build_environment flag must be used when running in production");
   }
 
   @Test

core/src/test/java/google/registry/tools/UpdateReservedListCommandTest.java

@@ -139,9 +139,7 @@ class UpdateReservedListCommandTest
                     "--name=xn--q9jyb4c_common-reserved",
                     "--input=" + reservedTermsPath));
     assertThat(thrown.getMessage())
-        .isEqualTo(
-            "The --build_environment flag must be used when running update_reserved_list in"
-                + " production");
+        .isEqualTo("The --build_environment flag must be used when running in production");
   }
 
   @Test

core/src/test/java/google/registry/tools/server/GenerateZoneFilesActionTest.java

@@ -23,6 +23,7 @@ import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.util.DateTimeUtils.plusMinutes;
 import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
@@ -56,6 +57,20 @@ class GenerateZoneFilesActionTest {
 
   private final GcsUtils gcsUtils = new GcsUtils(LocalStorageHelper.getOptions());
 
+  @Test
+  void testGenerate_nonexistentTld_throwsException() {
+    GenerateZoneFilesAction action = new GenerateZoneFilesAction();
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                action.handleJsonRequest(
+                    ImmutableMap.<String, Object>of(
+                        "tlds", ImmutableList.of("nonexistent-tld"),
+                        "exportTime", Instant.parse("2024-03-27T00:00:00Z"))));
+    assertThat(thrown).hasMessageThat().contains("TLDs do not exist: nonexistent-tld");
+  }
+
   @Test
   void testGenerate_defaultTtls() throws Exception {
     createTlds("tld", "com");
@@ -167,4 +182,34 @@ class GenerateZoneFilesActionTest {
     // The remaining lines can be in any order.
     assertThat(generatedFileLines).containsExactlyElementsIn(goldenFileLines);
   }
+
+  @Test
+  void testGenerate_deletedNameserver_ignoresAndLogsSevere() throws Exception {
+    createTlds("tld");
+    Instant now = Instant.parse("2024-03-27T00:00:00Z");
+    Host deletedHost = persistResource(newHost("ns.deleted.tld"));
+    // Delete the host before exportTime
+    persistResource(deletedHost.asBuilder().setDeletionTime(now.minusSeconds(3600)).build());
+
+    persistResource(
+        DatabaseHelper.newDomain("example.tld")
+            .asBuilder()
+            .addNameservers(ImmutableSet.of(deletedHost.createVKey()))
+            .build());
+
+    GenerateZoneFilesAction action = new GenerateZoneFilesAction();
+    action.bucket = "zonefiles-bucket";
+    action.gcsUtils = gcsUtils;
+    action.databaseRetention = Duration.ofDays(29);
+    action.dnsDefaultATtl = Duration.ofSeconds(11);
+    action.dnsDefaultNsTtl = Duration.ofSeconds(222);
+    action.dnsDefaultDsTtl = Duration.ofSeconds(3333);
+    action.clock = new FakeClock(plusMinutes(now, 2));
+
+    Map<String, Object> response =
+        action.handleJsonRequest(
+            ImmutableMap.<String, Object>of("tlds", ImmutableList.of("tld"), "exportTime", now));
+    assertThat(response)
+        .containsEntry("filenames", ImmutableList.of("gs://zonefiles-bucket/tld-" + now + ".zone"));
+  }
 }

core/src/test/java/google/registry/ui/server/CspFilterTest.java

@@ -0,0 +1,44 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.junit.jupiter.api.Test;
+
+/** Unit tests for {@link CspFilter}. */
+class CspFilterTest {
+
+  @Test
+  void testDoFilter_setsHeaders() throws Exception {
+    CspFilter filter = new CspFilter();
+    HttpServletRequest request = mock(HttpServletRequest.class);
+    HttpServletResponse response = mock(HttpServletResponse.class);
+    FilterChain chain = mock(FilterChain.class);
+
+    filter.doFilter(request, response, chain);
+
+    verify(response)
+        .setHeader(
+            "Content-Security-Policy", "default-src 'self'; object-src 'none'; base-uri 'self';");
+    verify(response).setHeader("X-Content-Type-Options", "nosniff");
+    verify(response).setHeader("X-Frame-Options", "DENY");
+    verify(chain).doFilter(request, response);
+  }
+}

core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java

@@ -424,6 +424,51 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
         .isEqualTo(RegistrarRole.TECH_CONTACT);
   }
 
+  @Test
+  void testFailure_appendUser_crossTenantNoPermission() throws IOException {
+    User callingUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
+    AuthResult authResult = AuthResult.createUser(callingUser);
+    ConsoleUsersAction action =
+        createAction(
+            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
+            Optional.of("POST"),
+            Optional.of(
+                new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
+  }
+
+  @Test
+  void testSuccess_appendUser_crossTenantWithPermission() throws IOException {
+    User callingUser =
+        DatabaseHelper.persistResource(
+            new User.Builder()
+                .setEmailAddress("multitenant@test.com")
+                .setUserRoles(
+                    new UserRoles()
+                        .asBuilder()
+                        .setRegistrarRoles(
+                            ImmutableMap.of(
+                                "TheRegistrar",
+                                RegistrarRole.PRIMARY_CONTACT,
+                                "NewRegistrar",
+                                RegistrarRole.PRIMARY_CONTACT))
+                        .build())
+                .build());
+    AuthResult authResult = AuthResult.createUser(callingUser);
+    ConsoleUsersAction action =
+        createAction(
+            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
+            Optional.of("POST"),
+            Optional.of(
+                new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_OK);
+    User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com"));
+    assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar"))
+        .isEqualTo(RegistrarRole.TECH_CONTACT);
+  }
+
   @Test
   void testFailure_appendUser_globalAdmin() throws IOException {
     User user = DatabaseHelper.createAdminUser("email@email.com");
@@ -504,6 +549,62 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
         .contains("Cannot delete a global administrator or user with a global role");
   }
 
+  @Test
+  void testFailure_updateUser_globalAdmin() throws IOException {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    AuthResult authResult = AuthResult.createUser(user);
+    // Historically associated global admin
+    DatabaseHelper.persistResource(
+        new User.Builder()
+            .setEmailAddress("globaladmin@test.com")
+            .setUserRoles(
+                new UserRoles.Builder()
+                    .setIsAdmin(true)
+                    .setGlobalRole(GlobalRole.NONE)
+                    .setRegistrarRoles(
+                        ImmutableMap.of("TheRegistrar", RegistrarRole.PRIMARY_CONTACT))
+                    .build())
+            .build());
+
+    ConsoleUsersAction action =
+        createAction(
+            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
+            Optional.of("PUT"),
+            Optional.of(
+                new UserData(
+                    "globaladmin@test.com", null, RegistrarRole.ACCOUNT_MANAGER.toString(), null)));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_BAD_REQUEST);
+    assertThat(response.getPayload())
+        .contains("Cannot update a global administrator or user with a global role");
+  }
+
+  @Test
+  void testFailure_updateUser_globalRole() throws IOException {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    AuthResult authResult = AuthResult.createUser(user);
+    // Historically associated user with global role
+    DatabaseHelper.persistResource(
+        new User.Builder()
+            .setEmailAddress("support@test.com")
+            .setUserRoles(
+                new UserRoles.Builder()
+                    .setIsAdmin(false)
+                    .setGlobalRole(GlobalRole.SUPPORT_AGENT)
+                    .build())
+            .build());
+
+    ConsoleUsersAction action =
+        createAction(
+            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
+            Optional.of("PUT"),
+            Optional.of(
+                new UserData(
+                    "support@test.com", null, RegistrarRole.ACCOUNT_MANAGER.toString(), null)));
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
+  }
+
   private ConsoleUsersAction createAction(
       Optional<ConsoleApiParams> maybeConsoleApiParams,
       Optional<String> method,

core/src/test/java/google/registry/ui/server/console/settings/SecurityActionTest.java

@@ -113,6 +113,31 @@ class SecurityActionTest extends ConsoleActionBaseTestCase {
     assertThat(history.getDescription()).hasValue("registrarId|IP_CHANGE,PRIMARY_SSL_CERT_CHANGE");
   }
 
+  @Test
+  void testSuccess_postRegistrarInfo_nullIpAllowList() throws IOException {
+    CertificateChecker lenientChecker =
+        new CertificateChecker(
+            ImmutableSortedMap.of(START_INSTANT, 20825, Instant.parse("2020-09-01T00:00:00Z"), 398),
+            30,
+            15,
+            2048,
+            ImmutableSet.of("secp256r1", "secp384r1"),
+            clock);
+
+    clock.setTo(Instant.parse("2020-11-01T00:00:00Z"));
+    String jsonWithNullIp =
+        String.format(
+            "{\"registrarId\": \"registrarId\", \"clientCertificate\": \"%s\","
+                + " \"ipAddressAllowList\": null}",
+            SAMPLE_CERT2);
+    SecurityAction action =
+        createAction(testRegistrar.getRegistrarId(), jsonWithNullIp, lenientChecker);
+    action.run();
+    assertThat(((FakeResponse) consoleApiParams.response()).getStatus()).isEqualTo(SC_OK);
+    Registrar r = loadRegistrar(testRegistrar.getRegistrarId());
+    assertThat(r.getIpAddressAllowList()).isEmpty();
+  }
+
   @Test
   void testFailure_validityPeriodTooLong_returnsSpecificError() throws IOException {
     CertificateChecker strictChecker =

core/src/test/resources/google/registry/flows/domain/domain_check_fee_xap_response.xml

@@ -0,0 +1,54 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <domain:chkData xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:cd>
+          <domain:name avail="true">example1.tld</domain:name>
+        </domain:cd>
+        <domain:cd>
+          <domain:name avail="true">example2.tld</domain:name>
+        </domain:cd>
+        <domain:cd>
+          <domain:name avail="true">example3.tld</domain:name>
+        </domain:cd>
+      </domain:chkData>
+    </resData>
+    <extension>
+      <fee:chkData xmlns:fee="urn:ietf:params:xml:ns:epp:fee-1.0">
+        <fee:currency>USD</fee:currency>
+        <fee:cd>
+          <fee:objID>example1.tld</fee:objID>
+          <fee:class>standard</fee:class>
+          <fee:command name="create">
+            <fee:period unit="y">1</fee:period>
+            <fee:fee description="create">13.00</fee:fee>
+            <fee:fee description="Expiry Access Period, fee expires: 2009-01-06T01:00:00Z">110.00</fee:fee>
+          </fee:command>
+        </fee:cd>
+        <fee:cd>
+          <fee:objID>example2.tld</fee:objID>
+          <fee:class>standard</fee:class>
+          <fee:command name="create">
+            <fee:period unit="y">1</fee:period>
+            <fee:fee description="create">13.00</fee:fee>
+          </fee:command>
+        </fee:cd>
+        <fee:cd>
+          <fee:objID>example3.tld</fee:objID>
+          <fee:class>standard</fee:class>
+          <fee:command name="create">
+            <fee:period unit="y">1</fee:period>
+            <fee:fee description="create">13.00</fee:fee>
+          </fee:command>
+        </fee:cd>
+      </fee:chkData>
+    </extension>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_premium_xap.xml

@@ -0,0 +1,26 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <create>
+      <domain:create
+          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>rich.example</domain:name>
+        <domain:period unit="y">2</domain:period>
+        <domain:ns>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+          <domain:hostObj>ns2.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:create>
+    </create>
+    <extension>
+      <fee:create xmlns:fee="urn:ietf:params:xml:ns:epp:fee-1.0">
+        <fee:currency>USD</fee:currency>
+        <fee:fee description="create">200.00</fee:fee>
+        <fee:fee description="Expiry Access Period">100.00</fee:fee>
+      </fee:create>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_response_premium_xap.xml

@@ -0,0 +1,26 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <domain:creData
+          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>rich.example</domain:name>
+        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
+        <domain:exDate>2001-04-03T22:00:00.0Z</domain:exDate>
+      </domain:creData>
+    </resData>
+    <extension>
+      <fee:creData xmlns:fee="urn:ietf:params:xml:ns:epp:fee-1.0">
+        <fee:currency>USD</fee:currency>
+        <fee:fee description="create">200.00</fee:fee>
+        <fee:fee description="Expiry Access Period, fee expires: 1999-04-03T23:00:00Z">100.00</fee:fee>
+      </fee:creData>
+    </extension>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_response_xap_fee.xml

@@ -0,0 +1,26 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <domain:creData
+        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
+        <domain:exDate>2001-04-03T22:00:00.0Z</domain:exDate>
+      </domain:creData>
+    </resData>
+    <extension>
+      <fee:creData xmlns:fee="urn:ietf:params:xml:ns:epp:fee-1.0">
+        <fee:currency>USD</fee:currency>
+        <fee:fee description="create">24.00</fee:fee>
+        <fee:fee description="Expiry Access Period, fee expires: 1999-04-03T23:00:00Z">100.00</fee:fee>
+      </fee:creData>
+    </extension>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>

core/src/test/resources/google/registry/model/tld/tld.yaml

@@ -32,6 +32,8 @@ eapFeeSchedule:
     currency: "USD"
     amount: 0.00
 escrowEnabled: false
+expiryAccessPeriodTransitions:
+  "1970-01-01T00:00:00.000Z": "DISABLED"
 idnTables:
 - "EXTENDED_LATIN"
 - "JA"

core/src/test/resources/google/registry/tools/1tld.yaml

@@ -19,6 +19,8 @@ eapFeeSchedule:
     currency: "USD"
     amount: 0.00
 escrowEnabled: false
+expiryAccessPeriodTransitions:
+  "1970-01-01T00:00:00.000Z": "DISABLED"
 idnTables: []
 invoicingEnabled: false
 lordnUsername: null

core/src/test/resources/google/registry/tools/badidn.yaml

@@ -23,6 +23,8 @@ eapFeeSchedule:
     currency: "USD"
     amount: 0.00
 escrowEnabled: false
+expiryAccessPeriodTransitions:
+  "1970-01-01T00:00:00.000Z": "DISABLED"
 idnTables:
 - "foo"
 invoicingEnabled: false