Allow superuser ext to override client/server transfer prohibited (#2890)

The superuser can remove/add those statuses anyway, so there's not
really any point. This also saves us trouble if we need to do a BTAPPA
transfer.

.gitignore

@@ -121,9 +121,5 @@ core/**/registrar_dbg*.js
 core/**/registrar_bin*.css
 core/**/registrar_dbg*.css
 
-# Appengine generated files
-core/WEB-INF/appengine-generated/*.bin
-core/WEB-INF/appengine-generated/*.xml
-
 # jEnv
 .java-version

appengine_war.gradle

@@ -1,108 +0,0 @@
-// Copyright 2019 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-apply plugin: 'war'
-
-def environment = rootProject.environment
-def gcpProject = rootProject.gcpProject
-
-// Set this directory before applying the appengine plugin so that the
-// plugin will recognize this as an app-engine standard app (and also
-// obtains the appengine-web.xml from the correct location)
-project.convention.plugins['war'].webAppDirName =
-        "../../core/src/main/java/google/registry/env/${environment}/${project.name}"
-
-apply plugin: 'com.google.cloud.tools.appengine'
-
-def coreResourcesDir = "${rootDir}/core/build/resources/main"
-def coreLibsDir = "${rootDir}/core/build/libs"
-
-// Get the web.xml file for the service.
-war {
-    webInf {
-        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
-    }
-}
-
-war {
-    from("${coreResourcesDir}/google/registry/ui/html") {
-        include "*.html"
-    }
-    from("${coreLibsDir}") {
-        include "core.jar"
-        into("WEB-INF/lib")
-    }
-}
-
-if (project.path == ":services:default") {
-    war {
-        from("${coreResourcesDir}/google/registry/ui/html") {
-            include "*.html"
-            into("registrar")
-        }
-    }
-}
-
-appengine {
-    deploy {
-        // appengineDeployAll task requires the version to be set. So,
-        // this config lets gcloud select a version name when deploying
-        // to alpha or sandbox from our workstation.
-        if (!rootProject.prodOrSandboxEnv) {
-            version = 'GCLOUD_CONFIG'
-        }
-
-        // Don't set gcpProject directly, it gets overriden in ./build.gradle.
-        // Do -P environment={crash,alpha} instead.  For sandbox/production,
-        // use Spinnaker.
-        projectId = gcpProject
-    }
-}
-
-dependencies {
-    implementation project(path: ':core', configuration: 'deploy_jar')
-}
-
-// The tools.jar file gets pulled in from the java environment and for some
-// reason gets exploded "readonly", causing subsequent builds to fail when
-// they can't overwrite it.  The hack below makes the file writable after
-// we're done exploding it.
-//
-// Fun fact: We only use this jar for documentation generation and as such we
-// don't need it in our warfile, as it is not used by the application at
-// runtime.  But it's not clear how to exclude it, as we seem to be
-// constructing the jar from the entire WEB-INF directory and per-file
-// exclude rules don't seem to work on it.  Better solutions are welcome :-)
-explodeWar.doLast {
-    file("${it.explodedAppDirectory}/WEB-INF/lib/tools.jar").setWritable(true)
-}
-
-appengineDeployAll.mustRunAfter ':console-webapp:deploy'
-appengineDeployAll.finalizedBy ':deployCloudSchedulerAndQueue'
-
-rootProject.stage.dependsOn appengineStage
-tasks['war'].dependsOn ':core:processResources'
-tasks['war'].dependsOn ':core:jar'
-
-// Impose verification for all of the deployment tasks.  We haven't found a
-// better way to do this other than to apply to each of them independently.
-// If a new task gets added, it will still fail if "environment"  is not defined
-// because gcpProject is null.  We just won't get as friendly an error message.
-appengineDeployAll.configure rootProject.verifyDeploymentConfig
-appengineDeploy.configure rootProject.verifyDeploymentConfig
-appengineDeployCron.configure rootProject.verifyDeploymentConfig
-appengineDeployDispatch.configure rootProject.verifyDeploymentConfig
-appengineDeployDos.configure rootProject.verifyDeploymentConfig
-appengineDeployIndex.configure rootProject.verifyDeploymentConfig
-appengineDeployQueue.configure rootProject.verifyDeploymentConfig

build.gradle

@@ -84,10 +84,10 @@ tasks.build.dependsOn(tasks.checkLicense)
 // Paths to main and test sources.
 ext.projectRootDir = "${rootDir}"
 
-// Tasks to deploy/stage all App Engine services
+// Tasks to deploy/stage all services
 task deploy {
   group = 'deployment'
-  description = 'Deploys all services to App Engine.'
+  description = 'Deploys all services.'
 }
 
 task stage {
@@ -331,9 +331,6 @@ subprojects {
 
   // Set up all of the deployment projects.
   if (services.contains(project.path)) {
-
-    apply from: "${rootDir.path}/appengine_war.gradle"
-
     // Return early, do not apply the settings below.
     return
   }
@@ -380,17 +377,6 @@ subprojects {
   }
 }
 
-// Force SDK download and deployment to be sequential, otherwise parallel tasks
-// will fail. For SDK download, they will try to write to the same location to
-// upgrade gcloud. For deployment, they will try to deploy different services to
-// the same project at the same time.
-for (int i = 1; i < services.size(); i++) {
-  project("${services[i]}").downloadCloudSdk
-          .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
-  project("${services[i]}").appengineDeployAll
-          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
-}
-
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
 // output and final test status (pass/fail, errors) for each test class.
 //

common/src/main/java/google/registry/util/DateTimeUtils.java

@@ -33,8 +33,8 @@ public abstract class DateTimeUtils {
   /**
    * A date in the far future that we can treat as infinity.
    *
-   * <p>This value is (2^63-1)/1000 rounded down. AppEngine stores dates as 64 bit microseconds, but
-   * Java uses milliseconds, so this is the largest representable date that will survive a
+   * <p>This value is (2^63-1)/1000 rounded down. Postgres can store dates as 64 bit microseconds,
+   * but Java uses milliseconds, so this is the largest representable date that will survive a
    * round-trip through the database.
    */
   public static final DateTime END_OF_TIME = new DateTime(Long.MAX_VALUE / 1000, DateTimeZone.UTC);

config/nom_build.py

@@ -104,7 +104,7 @@ PROPERTIES = [
     Property('testFilter',
              'Comma separated list of test patterns, if specified run only '
              'these.'),
-    Property('environment', 'GAE Environment for deployment and staging.'),
+    Property('environment', 'Environment for deployment and staging.'),
 
     # Cloud SQL properties
     Property('dbServer',

console-webapp/README.md

@@ -9,7 +9,7 @@ expected to change.
 
 ## Deployment
 
-Webapp is deployed with the nomulus default service war to Google App Engine.
+The webapp is deployed with the nomulus default service war to GKE.
 During nomulus default service war build task, gradle script triggers the
 following:
 

console-webapp/src/app/settings/contact/contact.service.ts

@@ -47,9 +47,9 @@ export interface Contact {
   registrarId?: string;
   faxNumber?: string;
   types: Array<contactType>;
-  visibleInWhoisAsAdmin?: boolean;
-  visibleInWhoisAsTech?: boolean;
-  visibleInDomainWhoisAsAbuse?: boolean;
+  visibleInRdapAsAdmin?: boolean;
+  visibleInRdapAsTech?: boolean;
+  visibleInDomainRdapAsAbuse?: boolean;
 }
 
 export interface ViewReadyContact extends Contact {

console-webapp/src/app/settings/contact/contactDetails.component.html

@@ -111,7 +111,7 @@
       <h1>RDAP Preferences</h1>
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInWhoisAsAdmin"
+          [(ngModel)]="contactService.contactInEdit.visibleInRdapAsAdmin"
           [ngModelOptions]="{ standalone: true }"
           >Show in Registrar RDAP record as admin contact</mat-checkbox
         >
@@ -119,7 +119,7 @@
 
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInWhoisAsTech"
+          [(ngModel)]="contactService.contactInEdit.visibleInRdapAsTech"
           [ngModelOptions]="{ standalone: true }"
           >Show in Registrar RDAP record as technical contact</mat-checkbox
         >
@@ -127,7 +127,7 @@
 
       <div>
         <mat-checkbox
-          [(ngModel)]="contactService.contactInEdit.visibleInDomainWhoisAsAbuse"
+          [(ngModel)]="contactService.contactInEdit.visibleInDomainRdapAsAbuse"
           [ngModelOptions]="{ standalone: true }"
           >Show Phone and Email in Domain RDAP Record as registrar abuse contact
           (per CL&D requirements)</mat-checkbox
@@ -189,24 +189,24 @@
         <mat-list-item role="listitem">
           <h2>RDAP Preferences</h2>
         </mat-list-item>
-        @if(contactService.contactInEdit.visibleInWhoisAsAdmin) {
+        @if(contactService.contactInEdit.visibleInRdapAsAdmin) {
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-value"
             >Show in Registrar RDAP record as admin contact</span
           >
         </mat-list-item>
-        } @if(contactService.contactInEdit.visibleInWhoisAsTech) {
+        } @if(contactService.contactInEdit.visibleInRdapAsTech) {
         <mat-divider></mat-divider>
         <mat-list-item
           role="listitem"
-          *ngIf="contactService.contactInEdit.visibleInWhoisAsTech"
+          *ngIf="contactService.contactInEdit.visibleInRdapAsTech"
         >
           <span class="console-app__list-value"
             >Show in Registrar RDAP record as technical contact</span
           >
         </mat-list-item>
-        } @if(contactService.contactInEdit.visibleInDomainWhoisAsAbuse) {
+        } @if(contactService.contactInEdit.visibleInDomainRdapAsAbuse) {
         <mat-divider></mat-divider>
         <mat-list-item role="listitem">
           <span class="console-app__list-value"

core/build.gradle

@@ -110,7 +110,7 @@ configurations {
   // for details.
   nomulus_test
 
-  // Exclude non-canonical servlet-api jars. Our AppEngine deployment uses
+  // Exclude non-canonical servlet-api jars. Our deployment uses
   // javax.servlet:servlet-api:2.5
   // For reasons we do not understand, marking the following dependencies as
   // compileOnly instead of compile does not exclude them from runtimeClasspath.

core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java

@@ -20,7 +20,6 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.UrlConnectionService;
@@ -43,7 +42,7 @@ import javax.net.ssl.HttpsURLConnection;
  * --service BACKEND -X POST -u '/_dr/task/executeCannedScript}'}
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/executeCannedScript",
     method = {POST, GET},
     automaticallyPrintOk = true,

core/src/main/java/google/registry/batch/CheckBulkComplianceAction.java

@@ -27,7 +27,6 @@ import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.BulkPricingPackage;
 import google.registry.model.registrar.Registrar;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.auth.Auth;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.Clock;
@@ -39,7 +38,10 @@ import org.joda.time.Days;
  * An action that checks all {@link BulkPricingPackage} objects for compliance with their max create
  * limit.
  */
-@Action(service = GaeService.BACKEND, path = CheckBulkComplianceAction.PATH, auth = Auth.AUTH_ADMIN)
+@Action(
+    service = Action.Service.BACKEND,
+    path = CheckBulkComplianceAction.PATH,
+    auth = Auth.AUTH_ADMIN)
 public class CheckBulkComplianceAction implements Runnable {
 
   public static final String PATH = "/_dr/task/checkBulkCompliance";

core/src/main/java/google/registry/batch/CloudTasksUtils.java

@@ -43,7 +43,6 @@ import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action;
 import google.registry.request.Action.Method;
-import google.registry.request.Action.Service;
 import google.registry.util.Clock;
 import google.registry.util.CollectionUtils;
 import google.registry.util.GoogleCredentialsBundle;
@@ -56,8 +55,6 @@ import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Optional;
 import java.util.Random;
-import java.util.function.BiConsumer;
-import java.util.function.Consumer;
 import java.util.function.Supplier;
 import org.joda.time.Duration;
 
@@ -119,19 +116,13 @@ public class CloudTasksUtils implements Serializable {
    * <p>For GET requests we add them on to the URL, and for POST requests we add them in the body of
    * the request.
    *
-   * <p>The parameters {@code putHeadersFunction} and {@code setBodyFunction} are used so that this
-   * method can be called with either an AppEngine HTTP request or a standard non-AppEngine HTTP
-   * request. The two objects do not have the same methods, but both have ways of setting headers /
-   * body.
-   *
    * @return the resulting path (unchanged for POST requests, with params added for GET requests)
    */
   private static String processRequestParameters(
       String path,
       Method method,
       Multimap<String, String> params,
-      BiConsumer<String, String> putHeadersFunction,
-      Consumer<ByteString> setBodyFunction) {
+      HttpRequest.Builder requestBuilder) {
     if (CollectionUtils.isNullOrEmpty(params)) {
       return path;
     }
@@ -149,8 +140,8 @@ public class CloudTasksUtils implements Serializable {
     if (method.equals(Method.GET)) {
       return String.format("%s?%s", path, encodedParams);
     }
-    putHeadersFunction.accept(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString());
-    setBodyFunction.accept(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
+    requestBuilder.putHeaders(HttpHeaders.CONTENT_TYPE, MediaType.FORM_DATA.toString());
+    requestBuilder.setBody(ByteString.copyFrom(encodedParams, StandardCharsets.UTF_8));
     return path;
   }
 
@@ -161,29 +152,26 @@ public class CloudTasksUtils implements Serializable {
    * default service account as the principal. That account must have permission to submit tasks to
    * Cloud Tasks.
    *
-   * <p>The caller of this method is responsible for passing in the appropriate service based on the
-   * runtime (GAE/GKE). Use the overload that takes an action class if possible.
+   * <p>The caller of this method is responsible for passing in the appropriate service. Use the
+   * overload that takes an action class if possible.
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the GAE/GKE service to route the request to.
+   * @param service the service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   protected Task createTask(
-      String path, Method method, Service service, Multimap<String, String> params) {
+      String path, Method method, Action.Service service, Multimap<String, String> params) {
     checkArgument(
         path != null && !path.isEmpty() && path.charAt(0) == '/',
         "The path must start with a '/'.");
     HttpRequest.Builder requestBuilder =
         HttpRequest.newBuilder().setHttpMethod(HttpMethod.valueOf(method.name()));
-    path =
-        processRequestParameters(
-            path, method, params, requestBuilder::putHeaders, requestBuilder::setBody);
+    path = processRequestParameters(path, method, params, requestBuilder);
     OidcToken.Builder oidcTokenBuilder =
         OidcToken.newBuilder()
             .setServiceAccountEmail(credential.serviceAccount())
@@ -205,16 +193,15 @@ public class CloudTasksUtils implements Serializable {
    * Cloud Tasks.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action and the runtime.
+   * class will automatically determine the service to use based on the action.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   public Task createTask(
       Class<? extends Runnable> actionClazz, Method method, Multimap<String, String> params) {
@@ -231,32 +218,29 @@ public class CloudTasksUtils implements Serializable {
         method,
         actionClazz.getSimpleName(),
         allowedMethods);
-    Service service =
-        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
-    return createTask(path, method, service, params);
+    return createTask(path, method, action.service(), params);
   }
 
   /**
    * Create a {@link Task} to be enqueued with a random delay up to {@code jitterSeconds}.
    *
-   * <p>The caller of this method is responsible for passing in the appropriate service based on the
-   * runtime (GAE/GKE). Use the overload that takes an action class if possible.
+   * <p>The caller of this method is responsible for passing in the appropriate service. Use the
+   * overload that takes an action class if possible.
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the GAE/GKE service to route the request to.
+   * @param service the service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @param jitterSeconds the number of seconds that a task is randomly delayed up to.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   public Task createTaskWithJitter(
       String path,
       Method method,
-      Service service,
+      Action.Service service,
       Multimap<String, String> params,
       Optional<Integer> jitterSeconds) {
     if (jitterSeconds.isEmpty() || jitterSeconds.get() <= 0) {
@@ -274,7 +258,7 @@ public class CloudTasksUtils implements Serializable {
    * Create a {@link Task} to be enqueued with a random delay up to {@code jitterSeconds}.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action and the runtime.
+   * class will automatically determine the service to use based on the action.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
@@ -282,9 +266,8 @@ public class CloudTasksUtils implements Serializable {
    *     to the server to process the duplicate keys.
    * @param jitterSeconds the number of seconds that a task is randomly delayed up to.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   public Task createTaskWithJitter(
       Class<? extends Runnable> actionClazz,
@@ -297,9 +280,7 @@ public class CloudTasksUtils implements Serializable {
         "Action class %s is not annotated with @Action",
         actionClazz.getSimpleName());
     String path = action.path();
-    Service service =
-        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
-    return createTaskWithJitter(path, method, service, params, jitterSeconds);
+    return createTaskWithJitter(path, method, action.service(), params, jitterSeconds);
   }
 
   /**
@@ -307,19 +288,18 @@ public class CloudTasksUtils implements Serializable {
    *
    * @param path the relative URI (staring with a slash and ending without one).
    * @param method the HTTP method to be used for the request.
-   * @param service the GAE/GKE service to route the request to.
+   * @param service the service to route the request to.
    * @param params a multimap of URL query parameters. Duplicate keys are saved as is, and it is up
    *     to the server to process the duplicate keys.
    * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   private Task createTaskWithDelay(
       String path,
       Method method,
-      Service service,
+      Action.Service service,
       Multimap<String, String> params,
       Duration delay) {
     if (delay.isEqual(Duration.ZERO)) {
@@ -335,7 +315,7 @@ public class CloudTasksUtils implements Serializable {
    * Create a {@link Task} to be enqueued with delay of {@code duration}.
    *
    * <p>Prefer this overload over the one where the path and service are explicitly defined, as this
-   * class will automatically determine the service to use based on the action and the runtime.
+   * class will automatically determine the service to use based on the action.
    *
    * @param actionClazz the action class to run, must be annotated with {@link Action}.
    * @param method the HTTP method to be used for the request.
@@ -343,9 +323,8 @@ public class CloudTasksUtils implements Serializable {
    *     to the server to process the duplicate keys.
    * @param delay the amount of time that a task needs to be delayed for.
    * @return the enqueued task.
-   * @see <a
-   *     href=ttps://cloud.google.com/appengine/docs/standard/java/taskqueue/push/creating-tasks#target>Specifyinig
-   *     the worker service</a>
+   * @see <a href=https://docs.cloud.google.com/tasks/docs/creating-http-target-tasks#java>Creating
+   *     HTTP target tasks</a>
    */
   public Task createTaskWithDelay(
       Class<? extends Runnable> actionClazz,
@@ -354,9 +333,7 @@ public class CloudTasksUtils implements Serializable {
       Duration delay) {
     Action action = getAction(actionClazz);
     String path = action.path();
-    Service service =
-        RegistryEnvironment.isOnJetty() ? Action.ServiceGetter.get(action) : action.service();
-    return createTaskWithDelay(path, method, service, params, delay);
+    return createTaskWithDelay(path, method, action.service(), params, delay);
   }
 
   private static Action getAction(Class<? extends Runnable> actionClazz) {

core/src/main/java/google/registry/batch/DeleteExpiredDomainsAction.java

@@ -37,7 +37,6 @@ import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.persistence.transaction.QueryComposer.Comparator;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
@@ -68,7 +67,7 @@ import org.joda.time.Duration;
  * this action runs, thus alerting us that human action is needed to correctly process the delete.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = DeleteExpiredDomainsAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class DeleteExpiredDomainsAction implements Runnable {

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -37,7 +37,6 @@ import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntryDao;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -55,7 +54,7 @@ import jakarta.inject.Inject;
  * production.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/deleteLoadTestData",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -42,7 +42,6 @@ import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.RegistryEnvironment;
@@ -59,7 +58,7 @@ import org.joda.time.Duration;
  * billing events, along with their ForeignKeyDomainIndex entities.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/deleteProberData",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/batch/ExpandBillingRecurrencesAction.java

@@ -35,7 +35,6 @@ import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.Cursor;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -51,7 +50,7 @@ import org.joda.time.DateTime;
  * BillingRecurrence} billing events into synthetic {@link BillingEvent} events.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/expandBillingRecurrences",
     auth = Auth.AUTH_ADMIN)
 public class ExpandBillingRecurrencesAction implements Runnable {

core/src/main/java/google/registry/batch/RelockDomainAction.java

@@ -32,7 +32,6 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.tld.RegistryLockDao;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -47,7 +46,7 @@ import org.joda.time.Duration;
 
 /** Task that re-locks a previously-Registry-Locked domain after a predetermined period of time. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = RelockDomainAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
@@ -113,11 +112,11 @@ public class RelockDomainAction implements Runnable {
   public void run() {
     /* We wish to manually control our retry behavior, in order to limit the number of retries
      * and/or notify registrars / support only after a certain number of retries, or only
-     * with a certain type of failure. AppEngine will automatically retry on any non-2xx status
+     * with a certain type of failure. Cloud Tasks will automatically retry on any non-2xx status
      * code, so return SC_NO_CONTENT (204) by default to avoid this auto-retry.
      *
-     * See https://cloud.google.com/appengine/docs/standard/java/taskqueue/push/retrying-tasks
-     * for more details on retry behavior. */
+     * See https://docs.cloud.google.com/tasks/docs/configuring-queues#retry for more details on
+     * retry behavior. */
     response.setStatus(SC_NO_CONTENT);
     response.setContentType(MediaType.PLAIN_TEXT_UTF_8);
     tm().transact(this::relockDomain);

core/src/main/java/google/registry/batch/RemoveAllDomainContactsAction.java

@@ -44,7 +44,6 @@ import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.request.lock.LockHandler;
@@ -67,7 +66,7 @@ import org.joda.time.Duration;
  * leaving behind a record recording that update.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = RemoveAllDomainContactsAction.PATH,
     method = Action.Method.POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/batch/ResaveAllEppResourcesPipelineAction.java

@@ -28,7 +28,6 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -54,7 +53,7 @@ import jakarta.inject.Inject;
  * <p>This runs the {@link google.registry.beam.resave.ResaveAllEppResourcesPipeline}.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = ResaveAllEppResourcesPipelineAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class ResaveAllEppResourcesPipelineAction implements Runnable {

core/src/main/java/google/registry/batch/ResaveEntityAction.java

@@ -25,7 +25,6 @@ import com.google.common.flogger.FluentLogger;
 import google.registry.model.EppResource;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Action.Method;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
@@ -40,7 +39,7 @@ import org.joda.time.DateTime;
  * <p>{@link EppResource}s will be projected forward to the current time.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = ResaveEntityAction.PATH,
     auth = Auth.AUTH_ADMIN,
     method = Method.POST)

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -35,7 +35,6 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.registrar.RegistrarPoc.Type;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.EmailMessage;
@@ -50,7 +49,7 @@ import org.joda.time.format.DateTimeFormatter;
 
 /** An action that sends notification emails to registrars whose certificates are expiring soon. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = SendExpiringCertificateNotificationEmailAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class SendExpiringCertificateNotificationEmailAction implements Runnable {

core/src/main/java/google/registry/batch/WipeOutContactHistoryPiiAction.java

@@ -30,7 +30,6 @@ import google.registry.beam.wipeout.WipeOutContactHistoryPiiPipeline;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.contact.ContactHistory;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -49,7 +48,7 @@ import org.joda.time.DateTime;
  * time.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = WipeOutContactHistoryPiiAction.PATH,
     auth = Auth.AUTH_ADMIN)
 public class WipeOutContactHistoryPiiAction implements Runnable {

core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java

@@ -40,8 +40,6 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
 
   @Override
   public void beforeProcessing(PipelineOptions options) {
-    // TODO(b/416299900): remove next line after GAE is removed.
-    System.setProperty("google.registry.jetty", "true");
     RegistryPipelineOptions registryOptions = options.as(RegistryPipelineOptions.class);
     RegistryEnvironment environment = registryOptions.getRegistryEnvironment();
     if (environment == null || environment.equals(RegistryEnvironment.UNITTEST)) {

core/src/main/java/google/registry/bigquery/BigqueryConnection.java

@@ -279,20 +279,6 @@ public class BigqueryConnection implements AutoCloseable {
     private TableReference getTableReference() {
       return table.getTableReference().clone();
     }
-
-    /** Returns a string representation of the TableReference for the wrapped table. */
-    public String getStringReference() {
-      return tableReferenceToString(table.getTableReference());
-    }
-
-    /** Returns a string representation of the given TableReference. */
-    private static String tableReferenceToString(TableReference tableRef) {
-      return String.format(
-          "%s:%s.%s",
-          tableRef.getProjectId(),
-          tableRef.getDatasetId(),
-          tableRef.getTableId());
-    }
   }
 
   /**
@@ -398,29 +384,12 @@ public class BigqueryConnection implements AutoCloseable {
   }
 
   /**
-   * Starts an asynchronous query job to dump the results of the specified query into a local
-   * ImmutableTable object, row-keyed by the row number (indexed from 1), column-keyed by the
-   * TableFieldSchema for that column, and with the value object as the cell value.  Note that null
-   * values will not actually be null, but they can be checked for using Data.isNull().
+   * Dumps the results of the specified query into a local ImmutableTable object, row-keyed by the
+   * row number (indexed from 1), column-keyed by the TableFieldSchema for that column, and with the
+   * value object as the cell value.
    *
-   * <p>Returns a ListenableFuture that holds the ImmutableTable on success.
-   */
-  public ListenableFuture<ImmutableTable<Integer, TableFieldSchema, Object>>
-      queryToLocalTable(String querySql) {
-    Job job = new Job()
-        .setConfiguration(new JobConfiguration()
-            .setQuery(new JobConfigurationQuery()
-                .setQuery(querySql)
-                .setDefaultDataset(getDataset())));
-    return transform(runJobToCompletion(job), this::getQueryResults, directExecutor());
-  }
-
-  /**
-   * Returns the result of calling queryToLocalTable, but synchronously to avoid spawning new
-   * background threads, which App Engine doesn't support.
-   *
-   * @see <a href="https://cloud.google.com/appengine/docs/standard/java/runtime#Threads">App Engine
-   *     Runtime</a>
+   * <p>Note that null values will not actually be null, but they can be checked for using
+   * Data.isNull()
    */
   public ImmutableTable<Integer, TableFieldSchema, Object> queryToLocalTableSync(String querySql) {
     Job job = new Job()
@@ -634,10 +603,6 @@ public class BigqueryConnection implements AutoCloseable {
         });
   }
 
-  private ListenableFuture<Job> runJobToCompletion(final Job job) {
-    return service.submit(() -> runJob(job, null));
-  }
-
   /** Helper that returns true if a dataset with this name exists. */
   public boolean checkDatasetExists(String datasetName) throws IOException {
     try {
@@ -676,14 +641,6 @@ public class BigqueryConnection implements AutoCloseable {
         .setDatasetId(getDatasetId());
   }
 
-  /** Returns table reference with the projectId and datasetId filled out for you. */
-  public TableReference getTable(String tableName) {
-    return new TableReference()
-        .setProjectId(getProjectId())
-        .setDatasetId(getDatasetId())
-        .setTableId(tableName);
-  }
-
   /**
    * Helper that creates a dataset with this name if it doesn't already exist, and returns true if
    * creation took place.

core/src/main/java/google/registry/bsa/BsaDiffCreator.java

@@ -71,9 +71,7 @@ class BsaDiffCreator {
     Optional<String> previousJobName = schedule.latestCompleted().map(CompletedJob::jobName);
     /*
      * Memory usage is a concern when creating a diff, when the newest download needs to be held in
-     * memory in its entirety. The top-grade AppEngine VM has 3GB of memory, leaving less than 1.5GB
-     * to application memory footprint after subtracting overheads due to copying garbage collection
-     * and non-heap data etc. Assuming 400K labels, each of which on average included in 5 orders,
+     * memory in its entirety. Assuming 400K labels, each of which on average included in 5 orders,
      * the memory footprint is at least 300MB when loaded into a Hashset-backed Multimap (64-bit
      * JVM, with 12-byte object header, 16-byte array header, and 16-byte alignment).
      *

core/src/main/java/google/registry/bsa/BsaDownloadAction.java

@@ -41,7 +41,6 @@ import google.registry.bsa.persistence.DownloadScheduler;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.tld.Tlds;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -51,7 +50,7 @@ import java.util.Optional;
 import java.util.stream.Stream;
 
 @Action(
-    service = GaeService.BSA,
+    service = Action.Service.BACKEND,
     path = BsaDownloadAction.PATH,
     method = {GET, POST},
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/bsa/BsaRefreshAction.java

@@ -31,7 +31,6 @@ import google.registry.bsa.persistence.RefreshScheduler;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.tld.Tlds;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.BatchedStreams;
@@ -42,7 +41,7 @@ import java.util.stream.Stream;
 import org.joda.time.Duration;
 
 @Action(
-    service = GaeService.BSA,
+    service = Action.Service.BACKEND,
     path = BsaRefreshAction.PATH,
     method = {GET, POST},
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/bsa/BsaValidateAction.java

@@ -53,7 +53,6 @@ import google.registry.model.domain.Domain;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -66,7 +65,7 @@ import org.joda.time.Duration;
 
 /** Validates the BSA data in the database against the most recent block lists. */
 @Action(
-    service = GaeService.BSA,
+    service = Action.Service.BACKEND,
     path = BsaValidateAction.PATH,
     method = {GET, POST},
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/bsa/UploadBsaUnavailableDomainsAction.java

@@ -42,7 +42,6 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.ReservedList;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
@@ -78,7 +77,7 @@ import org.joda.time.DateTime;
  * <p>The file is also uploaded to GCS to preserve it as a record for ourselves.
  */
 @Action(
-    service = GaeService.BSA,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/uploadBsaUnavailableNames",
     method = {GET, POST},
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/config/CredentialModule.java

@@ -44,8 +44,6 @@ public abstract class CredentialModule {
    * <p>The credential returned by the Cloud Runtime depends on the runtime environment:
    *
    * <ul>
-   *   <li>On App Engine, returns a scope-less {@code ComputeEngineCredentials} for
-   *       PROJECT_ID@appspot.gserviceaccount.com
    *   <li>On Compute Engine, returns a scope-less {@code ComputeEngineCredentials} for
    *       PROJECT_NUMBER-compute@developer.gserviceaccount.com
    *   <li>On end user host, this returns the credential downloaded by gcloud. Please refer to <a
@@ -87,8 +85,8 @@ public abstract class CredentialModule {
    * the application default credential user.
    *
    * <p>The Workspace domain must grant delegated admin access to the default service account user
-   * (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in {@code defaultScopes}
-   * and {@code delegationScopes}.
+   * (nomulus-service-account@{project-id}.iam.gserviceaccount.com on GCP) with all scopes in {@code
+   * defaultScopes} and {@code delegationScopes}.
    */
   @AdcDelegatedCredential
   @Provides
@@ -113,9 +111,9 @@ public abstract class CredentialModule {
    * Provides a {@link GoogleCredentialsBundle} for sending emails through Google Workspace.
    *
    * <p>The Workspace domain must grant delegated admin access to the default service account user
-   * (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in {@code defaultScopes}
-   * and {@code delegationScopes}. In addition, the user {@code gSuiteOutgoingEmailAddress} must
-   * have the permission to send emails.
+   * (nomulus-service-account@{project-id}.iam.gserviceaccount.com on GCP) with all scopes in {@code
+   * defaultScopes} and {@code delegationScopes}. In addition, the user {@code
+   * gSuiteOutgoingEmailAddress} must have the permission to send emails.
    */
   @GmailDelegatedCredential
   @Provides

core/src/main/java/google/registry/config/DelegatedCredentials.java

@@ -55,8 +55,9 @@ import org.apache.commons.codec.binary.Base64;
  *
  * <p>This class accepts the application-default-credential as {@code ServiceAccountSigner},
  * avoiding the need for exported private keys. In this case, the default credential user itself
- * (project-id@appspot.gserviceaccount.com on AppEngine) must have domain-wide delegation to the
- * Workspace APIs. The default credential user also must have the Token Creator role to itself.
+ * (nomulus-service-account@{project-id}.iam.gserviceaccount.com on GCP) must have domain-wide
+ * delegation to the Workspace APIs. The default credential user also must have the Token Creator
+ * role to itself.
  *
  * <p>If the user provides a credential {@code S} that carries its own private key, such as {@link
  * com.google.auth.oauth2.ServiceAccountCredentials}, this class can use {@code S} to impersonate

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -37,7 +37,7 @@ import google.registry.bsa.UploadBsaUnavailableDomainsAction;
 import google.registry.dns.ReadDnsRefreshRequestsAction;
 import google.registry.model.common.DnsRefreshRequest;
 import google.registry.persistence.transaction.JpaTransactionManager;
-import google.registry.request.Action.GkeService;
+import google.registry.request.Action.Service;
 import google.registry.util.RegistryEnvironment;
 import google.registry.util.YamlUtils;
 import jakarta.inject.Named;
@@ -961,7 +961,7 @@ public final class RegistryConfig {
     }
 
     /**
-     * Number of times to retry a GAE operation when {@code TransientFailureException} is thrown.
+     * Number of times to retry an operation when {@code TransientFailureException} is thrown.
      *
      * <p>The number of milliseconds it'll sleep before giving up is {@code (2^n - 2) * 100}.
      *
@@ -1422,7 +1422,7 @@ public final class RegistryConfig {
     }
   }
 
-  /** Returns the App Engine project ID, which is based off the environment name. */
+  /** Returns the project ID, which is based off the environment name. */
   public static String getProjectId() {
     return CONFIG_SETTINGS.get().gcpProject.projectId;
   }
@@ -1444,55 +1444,10 @@ public final class RegistryConfig {
     return CONFIG_SETTINGS.get().gcpProject.baseDomain;
   }
 
-  public static URL getServiceUrl(GkeService service) {
+  public static URL getServiceUrl(Service service) {
     return makeUrl(String.format("https://%s.%s", service.getServiceId(), getBaseDomain()));
   }
 
-  /**
-   * Returns the address of the Nomulus app default HTTP server.
-   *
-   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
-   */
-  public static URL getDefaultServer() {
-    return makeUrl(CONFIG_SETTINGS.get().gcpProject.defaultServiceUrl);
-  }
-
-  /**
-   * Returns the address of the Nomulus app backend HTTP server.
-   *
-   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
-   */
-  public static URL getBackendServer() {
-    return makeUrl(CONFIG_SETTINGS.get().gcpProject.backendServiceUrl);
-  }
-
-  /**
-   * Returns the address of the Nomulus app bsa HTTP server.
-   *
-   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
-   */
-  public static URL getBsaServer() {
-    return makeUrl(CONFIG_SETTINGS.get().gcpProject.bsaServiceUrl);
-  }
-
-  /**
-   * Returns the address of the Nomulus app tools HTTP server.
-   *
-   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
-   */
-  public static URL getToolsServer() {
-    return makeUrl(CONFIG_SETTINGS.get().gcpProject.toolsServiceUrl);
-  }
-
-  /**
-   * Returns the address of the Nomulus app pubapi HTTP server.
-   *
-   * <p>This is used by the {@code nomulus} tool to connect to the App Engine remote API.
-   */
-  public static URL getPubapiServer() {
-    return makeUrl(CONFIG_SETTINGS.get().gcpProject.pubapiServiceUrl);
-  }
-
   /** Returns the amount of time a singleton should be cached, before expiring. */
   public static java.time.Duration getSingletonCacheRefreshDuration() {
     return java.time.Duration.ofSeconds(CONFIG_SETTINGS.get().caching.singletonCacheRefreshSeconds);
@@ -1556,12 +1511,7 @@ public final class RegistryConfig {
     return CONFIG_SETTINGS.get().gSuite.outgoingEmailDisplayName;
   }
 
-  /**
-   * Returns default WHOIS server to use when {@code Registrar#getWhoisServer()} is {@code null}.
-   *
-   * @see "google.registry.whois.DomainWhoisResponse"
-   * @see "google.registry.whois.RegistrarWhoisResponse"
-   */
+  /** Returns default WHOIS server to use when {@code Registrar#getWhoisServer()} is null. */
   public static String getDefaultRegistrarWhoisServer() {
     return CONFIG_SETTINGS.get().registryPolicy.defaultRegistrarWhoisServer;
   }

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -50,11 +50,6 @@ public class RegistryConfigSettings {
     public long projectIdNumber;
     public String locationId;
     public boolean isLocal;
-    public String defaultServiceUrl;
-    public String backendServiceUrl;
-    public String bsaServiceUrl;
-    public String toolsServiceUrl;
-    public String pubapiServiceUrl;
     public String baseDomain;
   }
 

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -12,17 +12,11 @@ gcpProject:
   projectIdNumber: 123456789012
   # Location of the GCP project, note that us-central1 and europe-west1 are special in that
   # they are used without the trailing number in GCP commands and Google Cloud Console.
-  # See: https://cloud.google.com/appengine/docs/locations as an example
+  # See: https://docs.cloud.google.com/compute/docs/regions-zones as an example
   locationId: registry-location-id
 
   # whether to use local/test credentials when connecting to the servers
   isLocal: true
-  # URLs of the services for the project.
-  defaultServiceUrl: https://default.example.com
-  backendServiceUrl: https://backend.example.com
-  bsaServiceUrl: https://bsa.example.com
-  toolsServiceUrl: https://tools.example.com
-  pubapiServiceUrl: https://pubapi.example.com
 
   # The base domain name of the registry service. Services are reachable at [service].baseDomain.
   baseDomain: registry.test
@@ -32,9 +26,9 @@ gSuite:
   domainName: domain-registry.example
 
   # Display name and email address used on outgoing emails through G Suite.
-  # The email address must be valid and have permission in the GAE app to send
-  # emails. For more info see:
-  # https://cloud.google.com/appengine/docs/standard/java/mail/#who_can_send_mail
+  # The email address must be valid and the domain must be set up to send emails.
+  # For more info see
+  # https://docs.cloud.google.com/compute/docs/tutorials/sending-mail
   outgoingEmailDisplayName: Example Registry
   outgoingEmailAddress: noreply@project-id.appspotmail.com
   # TODO(b/279671974): reuse `outgoingEmailAddress` after migration
@@ -201,18 +195,16 @@ hibernate:
   # but lock tables explicitly, either using framework-dependent API, or execute
   # "select table for update" statements directly.
   connectionIsolation: TRANSACTION_SERIALIZABLE
-  # Whether to log all SQL queries to App Engine logs. Overridable at runtime.
+  # Whether to log all SQL queries. Overridable at runtime.
   logSqlQueries: false
 
   # Connection pool configurations.
   hikariConnectionTimeout: 20000
   # Cloud SQL connections are a relatively scarce resource (maximum is 1000 as
   # of March 2021). The minimumIdle should be a small value so that machines may
-  # release connections after a demand spike. The maximumPoolSize is set to 10
-  # because that is the maximum number of concurrent requests a Nomulus server
-  # instance can handle (as limited by AppEngine for basic/manual scaling). Note
-  # that BEAM pipelines are not subject to the maximumPoolSize value defined
-  # here. See PersistenceModule.java for more information.
+  # release connections after a demand spike. Note that BEAM pipelines are not
+  # subject to the maximumPoolSize value defined here. See PersistenceModule.java
+  # for more information.
   hikariMinimumIdle: 1
   hikariMaximumPoolSize: 40
   hikariIdleTimeout: 300000
@@ -264,8 +256,8 @@ caching:
 
   # Maximum total number of static premium list entry entities to cache in
   # memory, across all premium lists for all TLDs. Tuning this up will use more
-  # memory (and might require using larger App Engine instances). Note that
-  # premium list entries that are absent are cached in addition to ones that are
+  # memory (and might require using larger instances). Note that premium list
+  # entries that are absent are cached in addition to ones that are
   # present, so the total cache size is not bounded by the total number of
   # premium price entries that exist.
   staticPremiumListMaxCachedEntries: 200000
@@ -346,12 +338,8 @@ credentialOAuth:
   localCredentialOauthScopes:
   # View and manage data in all Google Cloud APIs.
   - https://www.googleapis.com/auth/cloud-platform
-  # Call App Engine APIs locally.
-  - https://www.googleapis.com/auth/appengine.apis
   # View your email address.
   - https://www.googleapis.com/auth/userinfo.email
-  # View and manage your applications deployed on Google App Engine
-  - https://www.googleapis.com/auth/appengine.admin
   # The lifetime of an access token generated by our custom credentials classes
   # Must be shorter than one hour.
   tokenRefreshDelaySeconds: 1800
@@ -433,7 +421,7 @@ misc:
   spec11BccEmailAddresses:
     - abuse@example.com
 
-  # Number of times to retry a GAE operation when a transient exception is thrown.
+  # Number of times to retry an operation when a transient exception is thrown.
   # The number of milliseconds it'll sleep before giving up is (2^n - 2) * 100.
   transientFailureRetries: 12
 

core/src/main/java/google/registry/cron/TldFanoutAction.java

@@ -40,14 +40,12 @@ import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
-import google.registry.request.Action.GkeService;
+import google.registry.request.Action.Service;
 import google.registry.request.Parameter;
 import google.registry.request.ParameterMap;
 import google.registry.request.RequestParameters;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
-import google.registry.util.RegistryEnvironment;
 import jakarta.inject.Inject;
 import java.util.Optional;
 import java.util.stream.Stream;
@@ -59,8 +57,7 @@ import java.util.stream.Stream;
  *
  * <ul>
  *   <li>{@code endpoint} (Required) URL path of servlet to launch. This may contain pathargs.
- *   <li>{@code queue} (Required) Name of the App Engine push queue to which this task should be
- *       sent.
+ *   <li>{@code queue} (Required) Name of the queue to which this task should be sent.
  *   <li>{@code forEachRealTld} Launch the task in each real TLD namespace.
  *   <li>{@code forEachTestTld} Launch the task in each test TLD namespace.
  *   <li>{@code runInEmpty} Launch the task once, without the TLD argument.
@@ -80,7 +77,7 @@ import java.util.stream.Stream;
  * </ul>
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Service.BACKEND,
     path = "/_dr/cron/fanout",
     automaticallyPrintOk = true,
     auth = Auth.AUTH_ADMIN)
@@ -160,10 +157,6 @@ public final class TldFanoutAction implements Runnable {
       params.put(RequestParameters.PARAM_TLD, tld);
     }
     return cloudTasksUtils.createTaskWithJitter(
-        endpoint,
-        Action.Method.POST,
-        RegistryEnvironment.isOnJetty() ? GkeService.BACKEND : GaeService.BACKEND,
-        params,
-        jitterSeconds);
+        endpoint, Action.Method.POST, Service.BACKEND, params, jitterSeconds);
   }
 }

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -52,7 +52,6 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.tld.Tld;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Header;
 import google.registry.request.HttpException.ServiceUnavailableException;
 import google.registry.request.Parameter;
@@ -72,7 +71,7 @@ import org.joda.time.Duration;
 
 /** Task that sends domain and host updates to the DNS server. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = PublishDnsUpdatesAction.PATH,
     method = POST,
     automaticallyPrintOk = true,

core/src/main/java/google/registry/dns/ReadDnsRefreshRequestsAction.java

@@ -45,7 +45,6 @@ import google.registry.dns.DnsUtils.TargetType;
 import google.registry.model.common.DnsRefreshRequest;
 import google.registry.model.tld.Tld;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -60,7 +59,7 @@ import org.joda.time.Duration;
  * table.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/readDnsRefreshRequests",
     automaticallyPrintOk = true,
     method = POST,

core/src/main/java/google/registry/dns/RefreshDnsAction.java

@@ -26,7 +26,6 @@ import google.registry.model.annotations.ExternalMessagingName;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.NotFoundException;
 import google.registry.request.Parameter;
@@ -36,7 +35,7 @@ import jakarta.inject.Inject;
 
 /** Action that manually triggers refresh of DNS information. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/dnsRefresh",
     automaticallyPrintOk = true,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/dns/RefreshDnsOnHostRenameAction.java

@@ -26,7 +26,6 @@ import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -34,7 +33,7 @@ import jakarta.inject.Inject;
 import org.joda.time.DateTime;
 
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = PATH,
     method = Action.Method.POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/dns/writer/dnsupdate/DnsMessageTransport.java

@@ -36,8 +36,10 @@ import org.xbill.DNS.Opcode;
 /**
  * A transport for DNS messages. Sends/receives DNS messages over TCP using old-style {@link Socket}
  * s and the message framing defined in <a href="https://tools.ietf.org/html/rfc1035">RFC 1035</a>.
- * We would like use the dnsjava library's {@link org.xbill.DNS.SimpleResolver} class for this, but
- * it requires {@link java.nio.channels.SocketChannel} which is not supported on AppEngine.
+ *
+ * <p>TODO(b/463732345): now that we're no longer on AppEngine, see if we can use the dnsjava
+ * library's {@link org.xbill.DNS.SimpleResolver} class instead of this (that requires {@link
+ * java.nio.channels.SocketChannel} which is not supported on AppEngine).
  */
 public class DnsMessageTransport {
 

core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml

@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>100</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="alpha"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml

@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>100</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="alpha"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <!-- Enable external traffic to go through VPC, required for static ip -->
-  <vpc-access-connector>
-    <name>projects/domain-registry-alpha/locations/us-central1/connectors/appengine-connector</name>
-    <egress-setting>all-traffic</egress-setting>
-  </vpc-access-connector>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml

@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>8</max-instances>
-    <idle-timeout>30m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="alpha"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/registrar/*.html" expiration="1m"/>
-
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>8</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="alpha"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/assets/js/**" expiration="1m"/>
-    <include path="/assets/css/**" expiration="1m"/>
-    <include path="/assets/images/**" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>5</max-instances>
-    <idle-timeout>5m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="alpha"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/assets/js/**" expiration="1m"/>
-    <include path="/assets/css/**" expiration="1m"/>
-    <include path="/assets/images/**" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/common/META-INF/appengine-application.xml

@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8" standalone="no"?>
-<appengine-application xmlns="http://appengine.google.com/ns/1.0">
-  <application>domain-registry</application>
-</appengine-application>

core/src/main/java/google/registry/env/common/META-INF/application.xml

@@ -1,46 +0,0 @@
-<?xml version="1.0"
-encoding="UTF-8"?>
-
-<application
-  xmlns="http://java.sun.com/xml/ns/javaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
-                      http://java.sun.com/xml/ns/javaee/application_5.xsd"
-  version="5">
-
-  <description>Google Registry</description>
-  <display-name>Google Registry</display-name>
-
-  <!-- Modules -->
-  <!-- The default module should be listed first -->
-  <module>
-    <web>
-      <web-uri>default</web-uri>
-      <context-root>default</context-root>
-    </web>
-  </module>
-  <module>
-    <web>
-      <web-uri>pubapi</web-uri>
-      <context-root>pubapi</context-root>
-    </web>
-  </module>
-  <module>
-    <web>
-      <web-uri>backend</web-uri>
-      <context-root>backend</context-root>
-    </web>
-  </module>
-  <module>
-    <web>
-      <web-uri>bsa</web-uri>
-      <context-root>bsa</context-root>
-    </web>
-  </module>
-  <module>
-    <web>
-      <web-uri>tools</web-uri>
-      <context-root>tools</context-root>
-    </web>
-  </module>
-</application>

core/src/main/java/google/registry/env/common/backend/WEB-INF/logging.properties

@@ -1,17 +0,0 @@
-# A default java.util.logging configuration.
-# (All App Engine logging is through java.util.logging by default).
-#
-# To use this configuration, copy it into your application's WEB-INF
-# folder and add the following to your appengine-web.xml:
-#
-# <system-properties>
-#   <property name="java.util.logging.config.file" value="WEB-INF/logging.properties"/>
-# </system-properties>
-#
-
-# Set the default logging level for all loggers to INFO.
-.level = INFO
-
-# Turn off logging in Hibernate classes for misleading ERROR-level logs
-org.hibernate.orm.jdbc.batch.level=OFF
-org.hibernate.engine.jdbc.spi.SqlExceptionHelper.level=OFF

core/src/main/java/google/registry/env/common/backend/WEB-INF/web.xml

@@ -1,333 +0,0 @@
-<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
-  version="6.0">
-  <!-- Servlets -->
-
-  <!-- Servlet for injected backends actions -->
-  <servlet>
-    <display-name>BackendServlet</display-name>
-    <servlet-name>backend-servlet</servlet-name>
-    <servlet-class>google.registry.module.backend.BackendServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-
-  <!-- RDE -->
-
-  <!--
-    Responsible for scanning the database to create a full deposit for a single TLD
-    and streaming it to cloud storage. Requests are sent here by App Engine after
-    `RdeCreateCronServlet` enqueues a task specifying a URL that points to this servlet.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/rdeStaging</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Once `rdeCreateFullCron` finishes writing a deposit file to cloud storage, it'll
-    launch this task with the cloud filename so it can be uploaded to Iron Mountain
-    via SFTP. The file is deleted once the upload completes. This should be run via
-    `rde-upload-backend`.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/rdeUpload</url-pattern>
-  </servlet-mapping>
-
-  <!-- Sends an XML RDE report to ICANN's HTTP server after rdeUploadTask finishes. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/rdeReport</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Bulk Registration Data Access. This task creates a thin escrow deposit
-    and saves it to cloud storage, where a separate script owned by the SREs
-    uploads it to ICANN.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/brdaCopy</url-pattern>
-  </servlet-mapping>
-
-  <!-- Billing -->
-
-  <!--
-    Generates the invoice CSV for the month, which we send to billing to charge
-    registrars for their registrations.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/generateInvoices</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Emails the month's invoice CSV to the internal billing team, and publishes
-    the detail reports to the individual registrars' drive accounts.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/publishInvoices</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Copies invoice detail reports from GCS to the associated registrar's Drive folder.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/copyDetailReports</url-pattern>
-  </servlet-mapping>
-
-  <!-- ICANN Monthly Reporting -->
-
-  <!--
-    Monthly ICANN transaction and activity reports. This task generates report
-    files (in CSV format) and stores them in GCS under
-    gs://domain-registry-reporting/icann/monthly/YYYY-MM
-    by default.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/icannReportingStaging</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Monthly ICANN transaction and activity reports. This task uploads the generated
-    report files (in CSV format) via an HTTP PUT to ICANN's endpoint.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/icannReportingUpload</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Generates the Spec11 report for the month, storing it on GCS.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/generateSpec11</url-pattern>
-  </servlet-mapping>
-
-  <!--
-    Publishes the Spec11 report for the month, emailing registrars about their
-    registrations which were flagged by the SafeBrowsing API.
-  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/publishSpec11</url-pattern>
-  </servlet-mapping>
-
-  <!-- Trademark Clearinghouse -->
-
-  <!-- Downloads TMCH DNL data from MarksDB. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/tmchDnl</url-pattern>
-  </servlet-mapping>
-
-  <!-- Downloads TMCH SMDRL data from MarksDB. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/tmchSmdrl</url-pattern>
-  </servlet-mapping>
-
-  <!-- Downloads TMCH CRL data from MarksDB. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/tmchCrl</url-pattern>
-  </servlet-mapping>
-
-  <!-- Reads the LORDN queues and uploads CSV data for sunrise and claims marks to MarksDB. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/nordnUpload</url-pattern>
-  </servlet-mapping>
-
-  <!-- Verifies upload of LORDN data to MarksDB. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/nordnVerify</url-pattern>
-  </servlet-mapping>
-
-  <!-- Reads the DNS refresh requests and kick off the appropriate tasks to update zone. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/readDnsRefreshRequests</url-pattern>
-  </servlet-mapping>
-
-  <!-- Publishes DNS updates. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/publishDnsUpdates</url-pattern>
-  </servlet-mapping>
-
-  <!-- Manually refreshes DNS information. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/dnsRefresh</url-pattern>
-  </servlet-mapping>
-
-  <!-- Fans out a cron task over an adjustable range of TLDs. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/cron/fanout</url-pattern>
-  </servlet-mapping>
-
-  <!-- Syncs registrars to the registrar spreadsheet.  -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/syncRegistrarsSheet</url-pattern>
-  </servlet-mapping>
-
-  <!-- Exports TLD premium terms. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/exportPremiumTerms</url-pattern>
-  </servlet-mapping>
-
-  <!-- Exports TLD reserved terms. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/exportReservedTerms</url-pattern>
-  </servlet-mapping>
-
-  <!-- Syncs RegistrarContact changes to Google Groups. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/syncGroupMembers</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/exportDomainLists</url-pattern>
-  </servlet-mapping>
-
-  <!--  Action to delete all prober data. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/deleteProberData</url-pattern>
-  </servlet-mapping>
-
-  <!--  Action to delete load test data. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/deleteLoadTestData</url-pattern>
-  </servlet-mapping>
-
-  <!--  Dataflow pipeline to re-save all EPP resources. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/resaveAllEppResourcesPipeline</url-pattern>
-  </servlet-mapping>
-
-  <!--  Reread all Registrar RDAP Base Urls from the ICANN endpoint. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/updateRegistrarRdapBaseUrls</url-pattern>
-  </servlet-mapping>
-
-  <!--  Action to re-save a given entity. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/resaveEntity</url-pattern>
-  </servlet-mapping>
-
-  <!-- Enqueues DNS update tasks following a host rename. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/refreshDnsOnHostRename</url-pattern>
-  </servlet-mapping>
-
-  <!-- Action to expand BillingRecurrences into BillingEvents. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/expandBillingRecurrences</url-pattern>
-  </servlet-mapping>
-
-  <!-- Background action to delete domains past end of autorenewal. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/deleteExpiredDomains</url-pattern>
-  </servlet-mapping>
-
-  <!-- Background action to send notification emails to registrars with expiring certificate. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/sendExpiringCertificateNotificationEmail</url-pattern>
-  </servlet-mapping>
-
-  <!-- Action to automatically re-lock a domain after unlocking it -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/relockDomain</url-pattern>
-  </servlet-mapping>
-
-  <!-- Background action to wipe out PII fields of ContactHistory entities that
-have been in the database for a certain period of time. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/wipeOutContactHistoryPii</url-pattern>
-  </servlet-mapping>
-
-  <!-- Action to wipeout Cloud SQL data -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/wipeOutCloudSql</url-pattern>
-  </servlet-mapping>
-
-  <!-- Action to execute canned scripts -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/executeCannedScript</url-pattern>
-  </servlet-mapping>
-
-  <!-- Security config -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Internal</web-resource-name>
-      <description>
-        Admin-only internal section. Requests for paths covered by the URL patterns below will be
-        checked for a logged-in user account that's allowed to access the AppEngine admin console
-        (NOTE: this includes Editor/Viewer permissions in addition to Owner and the new IAM
-        App Engine Admin role. See https://cloud.google.com/appengine/docs/java/access-control
-        specifically the "Access handlers that have a login:admin restriction" line.)
-
-        TODO(b/28219927): lift some of these restrictions so that we can allow OAuth authentication
-        for endpoints that need to be accessed by open-source automated processes.
-      </description>
-
-      <!-- Internal AppEngine endpoints.  The '_ah' is short for app hosting.  -->
-      <url-pattern>/_ah/*</url-pattern>
-
-      <!-- Registrar console (should not be available on non-default module). -->
-      <url-pattern>/registrar*</url-pattern>
-
-      <!-- Verbatim JavaScript sources (only visible to admins for debugging). -->
-      <url-pattern>/assets/sources/*</url-pattern>
-
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>admin</role-name>
-    </auth-constraint>
-
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <!-- Require TLS on all requests. -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Secure</web-resource-name>
-      <description>
-        Require encryption for all paths. http URLs will be redirected to https.
-      </description>
-      <url-pattern>/*</url-pattern>
-    </web-resource-collection>
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-</web-app>

core/src/main/java/google/registry/env/common/bsa/WEB-INF/logging.properties

@@ -1,17 +0,0 @@
-# A default java.util.logging configuration.
-# (All App Engine logging is through java.util.logging by default).
-#
-# To use this configuration, copy it into your application's WEB-INF
-# folder and add the following to your appengine-web.xml:
-#
-# <system-properties>
-#   <property name="java.util.logging.config.file" value="WEB-INF/logging.properties"/>
-# </system-properties>
-#
-
-# Set the default logging level for all loggers to INFO.
-.level = INFO
-
-# Turn off logging in Hibernate classes for misleading ERROR-level logs
-org.hibernate.orm.jdbc.batch.level=OFF
-org.hibernate.engine.jdbc.spi.SqlExceptionHelper.level=OFF

core/src/main/java/google/registry/env/common/bsa/WEB-INF/web.xml

@@ -1,87 +0,0 @@
-<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
-  version="6.0">
-  <!-- Servlets -->
-
-  <!-- Servlet for injected backends actions -->
-  <servlet>
-    <display-name>BsaServlet</display-name>
-    <servlet-name>bsa-servlet</servlet-name>
-    <servlet-class>google.registry.module.bsa.BsaServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-
-  <!-- Download action -->
-  <servlet-mapping>
-    <servlet-name>bsa-servlet</servlet-name>
-    <url-pattern>/_dr/task/bsaDownload</url-pattern>
-  </servlet-mapping>
-
-  <!-- Refresh action -->
-  <servlet-mapping>
-    <servlet-name>bsa-servlet</servlet-name>
-    <url-pattern>/_dr/task/bsaRefresh</url-pattern>
-  </servlet-mapping>
-
-  <!-- Refresh action -->
-  <servlet-mapping>
-    <servlet-name>bsa-servlet</servlet-name>
-    <url-pattern>/_dr/task/bsaValidate</url-pattern>
-  </servlet-mapping>
-
-  <!-- Upload unavailable domains to BSA action -->
-  <servlet-mapping>
-    <servlet-name>bsa-servlet</servlet-name>
-    <url-pattern>/_dr/task/uploadBsaUnavailableNames</url-pattern>
-  </servlet-mapping>
-
-  <!-- Security config -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Internal</web-resource-name>
-      <description>
-        Admin-only internal section. Requests for paths covered by the URL patterns below will be
-        checked for a logged-in user account that's allowed to access the AppEngine admin console
-        (NOTE: this includes Editor/Viewer permissions in addition to Owner and the new IAM
-        App Engine Admin role. See https://cloud.google.com/appengine/docs/java/access-control
-        specifically the "Access handlers that have a login:admin restriction" line.)
-
-        TODO(b/28219927): lift some of these restrictions so that we can allow OAuth authentication
-        for endpoints that need to be accessed by open-source automated processes.
-      </description>
-
-      <!-- Internal AppEngine endpoints.  The '_ah' is short for app hosting.  -->
-      <url-pattern>/_ah/*</url-pattern>
-
-      <!-- Registrar console (should not be available on non-default module). -->
-      <url-pattern>/registrar*</url-pattern>
-
-      <!-- Verbatim JavaScript sources (only visible to admins for debugging). -->
-      <url-pattern>/assets/sources/*</url-pattern>
-
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>admin</role-name>
-    </auth-constraint>
-
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <!-- Require TLS on all requests. -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Secure</web-resource-name>
-      <description>
-        Require encryption for all paths. http URLs will be redirected to https.
-      </description>
-      <url-pattern>/*</url-pattern>
-    </web-resource-collection>
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-</web-app>

core/src/main/java/google/registry/env/common/default/WEB-INF/dispatch.xml

@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<dispatch-entries>
-  <!-- Send all public-facing unauthenticated traffic to the pubapi service. -->
-  <dispatch>
-    <url>*/rdap/*</url>
-    <module>pubapi</module>
-  </dispatch>
-  <dispatch>
-    <url>*/whois/*</url>
-    <module>pubapi</module>
-  </dispatch>
-  <dispatch>
-    <url>*/_dr/whois</url>
-    <module>pubapi</module>
-  </dispatch>
-  <dispatch>
-    <url>*/check</url>
-    <module>pubapi</module>
-  </dispatch>
-  <dispatch>
-    <url>*/console/*</url>
-    <module>console</module>
-  </dispatch>
-  <dispatch>
-    <url>*/console</url>
-    <module>console</module>
-  </dispatch>
-</dispatch-entries>

core/src/main/java/google/registry/env/common/default/WEB-INF/logging.properties

@@ -1,17 +0,0 @@
-# A default java.util.logging configuration.
-# (All App Engine logging is through java.util.logging by default).
-#
-# To use this configuration, copy it into your application's WEB-INF
-# folder and add the following to your appengine-web.xml:
-#
-# <system-properties>
-#   <property name="java.util.logging.config.file" value="WEB-INF/logging.properties"/>
-# </system-properties>
-#
-
-# Set the default logging level for all loggers to INFO.
-.level = INFO
-
-# Turn off logging in Hibernate classes for misleading ERROR-level logs
-org.hibernate.orm.jdbc.batch.level=OFF
-org.hibernate.engine.jdbc.spi.SqlExceptionHelper.level=OFF

core/src/main/java/google/registry/env/common/default/WEB-INF/web.xml

@@ -1,66 +0,0 @@
-<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
-  version="6.0">
-  <!-- Servlets -->
-
-  <!-- Servlet for injected frontend actions -->
-  <servlet>
-    <display-name>FrontendServlet</display-name>
-    <servlet-name>frontend-servlet</servlet-name>
-    <servlet-class>google.registry.module.frontend.FrontendServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-
-  <!-- The primary EPP endpoint for the Registry, which accepts EPP requests from our TLS proxy. -->
-  <servlet-mapping>
-    <servlet-name>frontend-servlet</servlet-name>
-    <url-pattern>/_dr/epp</url-pattern>
-  </servlet-mapping>
-
-  <!-- Registrar console endpoints -->
-  <servlet-mapping>
-    <servlet-name>frontend-servlet</servlet-name>
-    <url-pattern>/console-api/*</url-pattern>
-  </servlet-mapping>
-
-  <!-- Security config -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Internal</web-resource-name>
-      <description>
-        Admin-only internal section.  Requests for paths covered by the URL patterns below will be
-        checked for a logged-in user account that's allowed to access the AppEngine admin console
-        (NOTE: this includes Editor/Viewer permissions in addition to Owner and the new IAM
-        App Engine Admin role. See https://cloud.google.com/appengine/docs/java/access-control
-        specifically the "Access handlers that have a login:admin restriction" line.)
-
-        TODO(b/28219927): lift some of these restrictions so that we can allow OAuth authentication
-        for endpoints that need to be accessed by open-source automated processes.
-      </description>
-      <!-- Internal AppEngine endpoints.  The '_ah' is short for app hosting.  -->
-      <url-pattern>/_ah/*</url-pattern>
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>admin</role-name>
-    </auth-constraint>
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <!-- Require TLS on all requests. -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Secure</web-resource-name>
-      <description>
-        Require encryption for all paths. http URLs will be redirected to https.
-      </description>
-      <url-pattern>/*</url-pattern>
-    </web-resource-collection>
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-</web-app>

core/src/main/java/google/registry/env/common/pubapi/WEB-INF/logging.properties

@@ -1,17 +0,0 @@
-# A default java.util.logging configuration.
-# (All App Engine logging is through java.util.logging by default).
-#
-# To use this configuration, copy it into your application's WEB-INF
-# folder and add the following to your appengine-web.xml:
-#
-# <system-properties>
-#   <property name="java.util.logging.config.file" value="WEB-INF/logging.properties"/>
-# </system-properties>
-#
-
-# Set the default logging level for all loggers to INFO.
-.level = INFO
-
-# Turn off logging in Hibernate classes for misleading ERROR-level logs
-org.hibernate.orm.jdbc.batch.level=OFF
-org.hibernate.engine.jdbc.spi.SqlExceptionHelper.level=OFF

core/src/main/java/google/registry/env/common/pubapi/WEB-INF/web.xml

@@ -1,102 +0,0 @@
-<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
-  version="6.0">
-  <!-- Servlets -->
-
-  <!-- Servlet for injected frontend actions -->
-  <servlet>
-    <display-name>PubApiServlet</display-name>
-    <servlet-name>pubapi-servlet</servlet-name>
-    <servlet-class>google.registry.module.pubapi.PubApiServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-
-  <!-- HTTP WHOIS. -->
-  <servlet-mapping>
-    <servlet-name>pubapi-servlet</servlet-name>
-    <url-pattern>/whois/*</url-pattern>
-  </servlet-mapping>
-
-  <!-- Protocol WHOIS. -->
-  <servlet-mapping>
-    <servlet-name>pubapi-servlet</servlet-name>
-    <url-pattern>/_dr/whois</url-pattern>
-  </servlet-mapping>
-
-  <!-- RDAP (new WHOIS). -->
-  <servlet-mapping>
-    <servlet-name>pubapi-servlet</servlet-name>
-    <url-pattern>/rdap/*</url-pattern>
-  </servlet-mapping>
-
-  <!-- Public API to do availability checks -->
-  <servlet-mapping>
-    <servlet-name>pubapi-servlet</servlet-name>
-    <url-pattern>/check</url-pattern>
-  </servlet-mapping>
-
-  <!-- Security config -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Internal</web-resource-name>
-      <description>
-        Admin-only internal section.  Requests for paths covered by the URL patterns below will be
-        checked for a logged-in user account that's allowed to access the AppEngine admin console
-        (NOTE: this includes Editor/Viewer permissions in addition to Owner and the new IAM
-        App Engine Admin role.  See https://cloud.google.com/appengine/docs/java/access-control
-        specifically the "Access handlers that have a login:admin restriction" line.)
-
-        TODO(b/28219927): lift some of these restrictions so that we can allow OAuth authentication
-        for endpoints that need to be accessed by open-source automated processes.
-      </description>
-
-      <!-- Internal AppEngine endpoints.  The '_ah' is short for app hosting.  -->
-      <url-pattern>/_ah/*</url-pattern>
-
-      <!-- Verbatim JavaScript sources (only visible to admins for debugging). -->
-      <url-pattern>/assets/sources/*</url-pattern>
-
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>admin</role-name>
-    </auth-constraint>
-
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Registrar console</web-resource-name>
-      <description>
-        Registrar console requires user login.  This is in addition to the
-        code-level "requireLogin" configuration on individual @Actions.
-      </description>
-      <url-pattern>/registrar*</url-pattern>
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>*</role-name>
-    </auth-constraint>
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <!-- Require TLS on all requests. -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Secure</web-resource-name>
-      <description>
-        Require encryption for all paths. http URLs will be redirected to https.
-      </description>
-      <url-pattern>/*</url-pattern>
-    </web-resource-collection>
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-</web-app>

core/src/main/java/google/registry/env/common/tools/WEB-INF/logging.properties

@@ -1,17 +0,0 @@
-# A default java.util.logging configuration.
-# (All App Engine logging is through java.util.logging by default).
-#
-# To use this configuration, copy it into your application's WEB-INF
-# folder and add the following to your appengine-web.xml:
-#
-# <system-properties>
-#   <property name="java.util.logging.config.file" value="WEB-INF/logging.properties"/>
-# </system-properties>
-#
-
-# Set the default logging level for all loggers to INFO.
-.level = INFO
-
-# Turn off logging in Hibernate classes for misleading ERROR-level logs
-org.hibernate.orm.jdbc.batch.level=OFF
-org.hibernate.engine.jdbc.spi.SqlExceptionHelper.level=OFF

core/src/main/java/google/registry/env/common/tools/WEB-INF/web.xml

@@ -1,120 +0,0 @@
-<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
-  version="6.0">
-  <!-- Servlets -->
-
-  <!-- Servlet for injected tools actions -->
-  <servlet>
-    <display-name>ToolsServlet</display-name>
-    <servlet-name>tools-servlet</servlet-name>
-    <servlet-class>google.registry.module.tools.ToolsServlet</servlet-class>
-    <load-on-startup>1</load-on-startup>
-  </servlet>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/updateUserGroup</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/verifyOte</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/createGroups</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/createPremiumList</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/list/*</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/deleteEntity</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/admin/updatePremiumList</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/loadtest</url-pattern>
-  </servlet-mapping>
-
-  <!--  ExecuteEppCommand uses this to execute remotely. -->
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/epptool</url-pattern>
-  </servlet-mapping>
-
-  <!-- Refreshes all active domains in DNS -->
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/task/refreshDnsForAllDomains</url-pattern>
-  </servlet-mapping>
-
-  <servlet-mapping>
-    <servlet-name>tools-servlet</servlet-name>
-    <url-pattern>/_dr/task/generateZoneFiles</url-pattern>
-  </servlet-mapping>
-
-  <!-- Security config -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Internal</web-resource-name>
-      <description>
-        Admin-only internal section.  Requests for paths covered by the URL patterns below will be
-        checked for a logged-in user account that's allowed to access the AppEngine admin console
-        (NOTE: this includes Editor/Viewer permissions in addition to Owner and the new IAM
-        App Engine Admin role.  See https://cloud.google.com/appengine/docs/java/access-control
-        specifically the "Access handlers that have a login:admin restriction" line.)
-
-        TODO(b/28219927): lift some of these restrictions so that we can allow OAuth authentication
-        for endpoints that need to be accessed by open-source automated processes.
-     </description>
-
-      <!-- Internal AppEngine endpoints.  The '_ah' is short for app hosting.  -->
-      <url-pattern>/_ah/*</url-pattern>
-
-      <!-- Registrar console (should not be available on non-default module). -->
-      <url-pattern>/registrar*</url-pattern>
-
-      <!-- Verbatim JavaScript sources (only visible to admins for debugging). -->
-      <url-pattern>/assets/sources/*</url-pattern>
-
-    </web-resource-collection>
-    <auth-constraint>
-      <role-name>admin</role-name>
-    </auth-constraint>
-
-    <!-- Repeated here since catch-all rule below is not inherited. -->
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-
-  <!-- Require TLS on all requests. -->
-  <security-constraint>
-    <web-resource-collection>
-      <web-resource-name>Secure</web-resource-name>
-      <description>
-        Require encryption for all paths. http URLs will be redirected to https.
-      </description>
-      <url-pattern>/*</url-pattern>
-    </web-resource-collection>
-    <user-data-constraint>
-      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
-    </user-data-constraint>
-  </security-constraint>
-</web-app>

core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml

@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="crash"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml

@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="crash"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <!-- Enable external traffic to go through VPC, required for static ip -->
-  <vpc-access-connector>
-    <name>projects/domain-registry-crash/locations/us-central1/connectors/appengine-connector</name>
-    <egress-setting>all-traffic</egress-setting>
-  </vpc-access-connector>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml

@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>30m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="crash"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/registrar/*.html" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>8</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="crash"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/assets/js/**" expiration="1m"/>
-    <include path="/assets/css/**" expiration="1m"/>
-    <include path="/assets/images/**" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="crash"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1m"/>
-    <include path="/assets/js/**" expiration="1m"/>
-    <include path="/assets/css/**" expiration="1m"/>
-    <include path="/assets/images/**" expiration="1m"/>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="local"/>
-    <property name="appengine.generated.dir"
-              value="/tmp/domain-registry-appengine-generated/local/"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="local"/>
-    <property name="appengine.generated.dir"
-              value="/tmp/domain-registry-appengine-generated/local/"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml

@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="local"/>
-    <property name="appengine.generated.dir"
-              value="/tmp/domain-registry-appengine-generated/local/"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/registrar/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml

@@ -1,41 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>8</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="local"/>
-    <property name="appengine.generated.dir"
-              value="/tmp/domain-registry-appengine-generated/local/"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/js/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/css/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/images/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml

@@ -1,41 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="local"/>
-    <property name="appengine.generated.dir"
-              value="/tmp/domain-registry-appengine-generated/local/"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/js/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/css/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-    <include path="/assets/images/**">
-      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
-    </include>
-  </static-files>
-</appengine-web-app>

core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml

@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <basic-scaling>
-    <max-instances>100</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="production"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml

@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <basic-scaling>
-    <max-instances>3</max-instances>
-    <idle-timeout>60m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="production"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <!-- Enable external traffic to go through VPC, required for static ip -->
-  <vpc-access-connector>
-    <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>
-    <egress-setting>all-traffic</egress-setting>
-  </vpc-access-connector>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml

@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <manual-scaling>
-    <instances>24</instances>
-  </manual-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="production"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/registrar/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml

@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <manual-scaling>
-    <instances>24</instances>
-  </manual-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="production"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/assets/js/**" expiration="1d"/>
-    <include path="/assets/css/**" expiration="1d"/>
-    <include path="/assets/images/**" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml

@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <basic-scaling>
-    <max-instances>5</max-instances>
-    <idle-timeout>60m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="production"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/assets/js/**" expiration="1d"/>
-    <include path="/assets/css/**" expiration="1d"/>
-    <include path="/assets/images/**" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml

@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="qa"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1h"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml

@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="qa"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1h"/>
-  </static-files>
-
-    <!-- Enable external traffic to go through VPC, required for static ip -->
-  <vpc-access-connector>
-    <name>projects/domain-registry-qa/locations/us-central1/connectors/appengine-connector</name>
-    <egress-setting>all-traffic</egress-setting>
-  </vpc-access-connector>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>F4_1G</instance-class>
-  <automatic-scaling>
-    <min-idle-instances>1</min-idle-instances>
-    <max-idle-instances>automatic</max-idle-instances>
-    <min-pending-latency>automatic</min-pending-latency>
-    <max-pending-latency>100ms</max-pending-latency>
-    <max-concurrent-requests>10</max-concurrent-requests>
-  </automatic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="qa"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1h"/>
-    <include path="/registrar/*.html" expiration="1h"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml

@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="qa"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1h"/>
-    <include path="/assets/js/**" expiration="1h"/>
-    <include path="/assets/css/**" expiration="1h"/>
-    <include path="/assets/images/**" expiration="1h"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml

@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>10</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="qa"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1h"/>
-    <include path="/assets/js/**" expiration="1h"/>
-    <include path="/assets/css/**" expiration="1h"/>
-    <include path="/assets/images/**" expiration="1h"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml

@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>100</max-instances>
-    <idle-timeout>10m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="sandbox"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml

@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>bsa</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>3</max-instances>
-    <idle-timeout>60m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="sandbox"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Enable external traffic to go through VPC, required for static ip -->
-  <vpc-access-connector>
-    <name>projects/domain-registry-sandbox/locations/us-central1/connectors/appengine-connector</name>
-    <egress-setting>all-traffic</egress-setting>
-  </vpc-access-connector>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml

@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <manual-scaling>
-    <instances>6</instances>
-  </manual-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="sandbox"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/registrar/*.html" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml

@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4_1G</instance-class>
-  <manual-scaling>
-    <instances>5</instances>
-  </manual-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="sandbox"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/assets/js/**" expiration="1d"/>
-    <include path="/assets/css/**" expiration="1d"/>
-    <include path="/assets/images/**" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml

@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
-
-  <runtime>java21</runtime>
-  <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
-  <sessions-enabled>true</sessions-enabled>
-  <instance-class>B4</instance-class>
-  <basic-scaling>
-    <max-instances>5</max-instances>
-    <idle-timeout>60m</idle-timeout>
-  </basic-scaling>
-
-  <system-properties>
-    <property name="java.util.logging.config.file"
-              value="WEB-INF/logging.properties"/>
-    <property name="google.registry.environment"
-              value="sandbox"/>
-  </system-properties>
-
-  <env-variables>
-    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
-  </env-variables>
-
-  <static-files>
-    <include path="/*.html" expiration="1d"/>
-    <include path="/assets/js/**" expiration="1d"/>
-    <include path="/assets/css/**" expiration="1d"/>
-    <include path="/assets/images/**" expiration="1d"/>
-  </static-files>
-
-  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
-  <static-error-handlers>
-    <handler file="error.html"/>
-  </static-error-handlers>
-</appengine-web-app>

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -36,7 +36,6 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.auth.Auth;
 import google.registry.storage.drive.DriveConnection;
 import google.registry.util.Clock;
@@ -58,7 +57,7 @@ import org.joda.time.DateTimeZone;
  * name TLD.txt into the domain-lists bucket. Note that this overwrites the files in place.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/exportDomainLists",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -33,7 +33,6 @@ import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumList.PremiumEntry;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
 import google.registry.request.Response;
@@ -46,7 +45,7 @@ import java.util.SortedSet;
 
 /** Action that exports the premium terms list for a TLD to Google Drive. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/exportPremiumTerms",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/export/ExportReservedTermsAction.java

@@ -25,7 +25,6 @@ import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
 import google.registry.model.tld.Tld;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
 import google.registry.request.Response;
@@ -35,7 +34,7 @@ import jakarta.inject.Inject;
 
 /** Action that exports the publicly viewable reserved terms list for a TLD to Google Drive. */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/exportReservedTerms",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/export/SyncGroupMembersAction.java

@@ -34,7 +34,6 @@ import google.registry.groups.GroupsConnection.Role;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
 import google.registry.util.Retrier;
@@ -53,7 +52,7 @@ import javax.annotation.Nullable;
  * <p>This uses the <a href="https://developers.google.com/admin-sdk/directory/">Directory API</a>.
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = "/_dr/task/syncGroupMembers",
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java

@@ -128,10 +128,10 @@ class SyncRegistrarsSheet {
                   builder.put("billingContacts", convertContacts(contacts, byType(BILLING)));
                   builder.put(
                       "contactsMarkedAsWhoisAdmin",
-                      convertContacts(contacts, RegistrarPoc::getVisibleInWhoisAsAdmin));
+                      convertContacts(contacts, RegistrarPoc::getVisibleInRdapAsAdmin));
                   builder.put(
                       "contactsMarkedAsWhoisTech",
-                      convertContacts(contacts, RegistrarPoc::getVisibleInWhoisAsTech));
+                      convertContacts(contacts, RegistrarPoc::getVisibleInRdapAsTech));
                   builder.put("emailAddress", convert(registrar.getEmailAddress()));
                   builder.put("address.street", convert(address.getStreet()));
                   builder.put("address.city", convert(address.getCity()));

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java

@@ -24,7 +24,6 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 import com.google.common.flogger.FluentLogger;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -55,7 +54,7 @@ import org.joda.time.Duration;
  * @see SyncRegistrarsSheet
  */
 @Action(
-    service = GaeService.BACKEND,
+    service = Action.Service.BACKEND,
     path = SyncRegistrarsSheetAction.PATH,
     method = POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/flows/CheckApiAction.java

@@ -54,7 +54,6 @@ import google.registry.model.tld.label.ReservationType;
 import google.registry.monitoring.whitebox.CheckApiMetric;
 import google.registry.monitoring.whitebox.CheckApiMetric.Availability;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.RequestParameters;
 import google.registry.request.Response;
@@ -72,7 +71,7 @@ import org.joda.time.DateTime;
  * user controlled, lest it open an XSS vector. Do not modify this to return the domain name in the
  * response.
  */
-@Action(service = GaeService.PUBAPI, path = "/check", auth = Auth.AUTH_PUBLIC)
+@Action(service = Action.Service.PUBAPI, path = "/check", auth = Auth.AUTH_PUBLIC)
 public class CheckApiAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/flows/EppTlsAction.java

@@ -15,7 +15,6 @@
 package google.registry.flows;
 
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Action.Method;
 import google.registry.request.Payload;
 import google.registry.request.auth.Auth;
@@ -27,7 +26,7 @@ import jakarta.servlet.http.HttpServletRequest;
  * to RFC 5730. Commands must be requested via POST.
  */
 @Action(
-    service = GaeService.DEFAULT,
+    service = Action.Service.FRONTEND,
     path = "/_dr/epp",
     method = Method.POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/flows/EppToolAction.java

@@ -22,7 +22,6 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.model.eppcommon.ProtocolDefinition;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Action.Method;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
@@ -31,7 +30,7 @@ import jakarta.servlet.http.HttpServletRequest;
 
 /** Runs EPP commands directly without logging in, verifying an XSRF token from the tool. */
 @Action(
-    service = GaeService.TOOLS,
+    service = Action.Service.BACKEND,
     path = EppToolAction.PATH,
     method = Method.POST,
     auth = Auth.AUTH_ADMIN)

core/src/main/java/google/registry/flows/FlowReporter.java

@@ -51,7 +51,7 @@ public class FlowReporter {
   @Inject Class<? extends Flow> flowClass;
   @Inject FlowReporter() {}
 
-  /** Records information about the current flow execution in the GAE request logs. */
+  /** Records information about the current flow execution in the request logs. */
   public void recordToLogs() {
     // Explicitly log flow metadata separately from the EPP XML itself so that it stays compact
     // enough to be sure to fit in a single log entry (the XML part in rare cases could be long

core/src/main/java/google/registry/flows/FlowRunner.java

@@ -73,7 +73,7 @@ public class FlowRunner {
         eppRequestSource,
         isDryRun ? "DRY_RUN" : "LIVE",
         isSuperuser ? "SUPERUSER" : "NORMAL");
-    // Record flow info to the GAE request logs for reporting purposes if it's not a dry run.
+    // Record flow info to the request logs for reporting purposes if it's not a dry run.
     if (!isDryRun) {
       flowReporter.recordToLogs();
     }

core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java

@@ -133,10 +133,9 @@ import org.joda.time.DateTime;
 @ReportingSpec(ActivityReportField.DOMAIN_TRANSFER_REQUEST)
 public final class DomainTransferRequestFlow implements MutatingFlow {
 
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
-      StatusValue.CLIENT_TRANSFER_PROHIBITED,
-      StatusValue.PENDING_DELETE,
-      StatusValue.SERVER_TRANSFER_PROHIBITED);
+  private static final ImmutableSet<StatusValue> NON_SUPERUSER_DISALLOWED_STATUSES =
+      ImmutableSet.of(
+          StatusValue.CLIENT_TRANSFER_PROHIBITED, StatusValue.SERVER_TRANSFER_PROHIBITED);
 
   @Inject ResourceCommand resourceCommand;
   @Inject ExtensionManager extensionManager;
@@ -299,8 +298,9 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
       DateTime now,
       Optional<DomainTransferRequestSuperuserExtension> superuserExtension)
       throws EppException {
-    verifyNoDisallowedStatuses(existingDomain, DISALLOWED_STATUSES);
+    verifyNoDisallowedStatuses(existingDomain, ImmutableSet.of(StatusValue.PENDING_DELETE));
     if (!isSuperuser) {
+      verifyNoDisallowedStatuses(existingDomain, NON_SUPERUSER_DISALLOWED_STATUSES);
       verifyAuthInfoPresentForResourceTransfer(authInfo);
       verifyAuthInfo(authInfo.get(), existingDomain);
     }

core/src/main/java/google/registry/flows/session/LoginFlow.java

@@ -47,6 +47,7 @@ import google.registry.model.eppinput.EppInput.Options;
 import google.registry.model.eppinput.EppInput.Services;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.registrar.Registrar;
+import google.registry.util.PasswordUtils;
 import google.registry.util.StopwatchLogger;
 import jakarta.inject.Inject;
 import java.util.Optional;
@@ -150,8 +151,19 @@ public class LoginFlow implements MutatingFlow {
       throw new RegistrarAccountNotActiveException();
     }
 
-    if (login.getNewPassword().isPresent()) {
-      String newPassword = login.getNewPassword().get();
+    // TODO(b/458423787): Remove this circa March 2026 after enough time has passed for the logins
+    // to have transitioned to Argon2 hashing.
+    if (login.getNewPassword().isPresent()
+        || registrar.get().getCurrentHashAlgorithm(login.getPassword()).orElse(null)
+            != PasswordUtils.HashAlgorithm.ARGON_2_ID) {
+      String newPassword =
+          login
+              .getNewPassword()
+              .orElseGet(
+                  () -> {
+                    logger.atInfo().log("Rehashing existing registrar password with ARGON_2_ID");
+                    return login.getPassword();
+                  });
       // Load fresh from database (bypassing the cache) to ensure we don't save stale data.
       Optional<Registrar> freshRegistrar = Registrar.loadByRegistrarId(login.getClientId());
       stopwatch.tick("LoginFlow reload freshRegistrar");

core/src/main/java/google/registry/idn/Latin-IDN.xml

@@ -4,7 +4,7 @@
     <version comment="Latin LGR">1</version>
     <date>2025-10-01</date>
     <language>und-Latn</language>
-    <unicode-version>2</unicode-version>
+    <unicode-version>11.1.0</unicode-version>
     <description type="text/html"><![CDATA[
        <div class="instructions">
 <h2>INSTRUCTIONS</h2>
@@ -650,7 +650,6 @@
     <!--Action elements go here - order defines precedence-->
     <action disp="invalid" match="leading-combining-mark" comment="labels with leading combining marks are invalid &#x235F;" />
     <action disp="invalid" any-variant="out-of-repertoire-var" comment="any variant label with a code point out of repertoire is invalid &#x235F;" />
-    <action disp="invalid" match="dot-L-dot" comment="labels with one L sharing two middle dots are invalid" />
     <action disp="blocked" any-variant="blocked" comment="any variant label containing blocked variants is blocked &#x235F;" />
     <action disp="allocatable" all-variants="allocatable" comment="variant labels with all variants allocatable are allocatable &#x235F;" />
     <action disp="allocatable" all-variants="fallback" comment="any label with all variants of type fallback is allocatable &#x235F;" />

core/src/main/java/google/registry/keyring/api/Keyring.java

@@ -44,7 +44,7 @@ public interface Keyring extends AutoCloseable {
    * Returns public key for encrypting escrow deposits being staged to cloud storage.
    *
    * <p>This adds an additional layer of security so cloud storage administrators won't be tempted
-   * to go poking around the App Engine Cloud Console and see a dump of the entire database.
+   * to go poking around the Pantheon Cloud Console and see a dump of the entire database.
    *
    * <p>This keypair should only be known to the domain registry shared registry system.
    *

core/src/main/java/google/registry/loadtest/LoadTestAction.java

@@ -28,7 +28,6 @@ import com.google.protobuf.Timestamp;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.flows.EppToolAction;
 import google.registry.request.Action;
-import google.registry.request.Action.GaeService;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.util.Clock;
@@ -52,7 +51,7 @@ import org.joda.time.DateTime;
  * least one must be specified in order for load testing to do anything.
  */
 @Action(
-    service = GaeService.TOOLS,
+    service = Action.Service.BACKEND,
     path = LoadTestAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,

core/src/main/java/google/registry/model/common/Cursor.java

@@ -76,7 +76,7 @@ public class Cursor extends UpdateAutoTimestampEntity {
      *
      * <p>The way we solve this problem is by having {@code RdeUploadAction} check this cursor
      * before performing an upload for a given TLD. If the cursor is less than two hours old, the
-     * action will fail with a status code above 300 and App Engine will keep retrying the action
+     * action will fail with a status code above 300 and Cloud Tasks will keep retrying the action
      * until it's ready.
      */
     RDE_UPLOAD_SFTP(true),