feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/__init__.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Beyondcorp resources."""
+
+from googlecloudsdk.calliope import base
+from surface.beyondcorp import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class BeyondcorpAlpha(extensions.BeyondcorpAlpha):
+  """Manage secure access to applications with integrated threat and data protection.
+
+     BeyondCorp Enterprise offers a zero trust solution that enables
+     secure access with integrated threat and data protection.The solution
+     enables secure access to both Google Cloud Platform and on-prem hosted
+     apps. For remote apps that are not deployed in Google Cloud Platform,
+     BeyondCorp Enterprise's App connector provides simplified
+     connectivity and app publishing experience. The BeyondCorp Enterprise
+     client connector extends support to non-web applications by creating a
+     secure connection to applications running in both Google Cloud and
+     non-Google Cloud environments with full context and identity aware access.
+
+
+     More information on Beyondcorp can be found here:
+     https://cloud.google.com/beyondcorp
+  """
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class BeyondcorpBeta(extensions.BeyondcorpBeta):
+  """Manage secure access to applications with integrated threat and data protection.
+
+     BeyondCorp Enterprise offers a zero trust solution that enables
+     secure access with integrated threat and data protection.The solution
+     enables secure access to both Google Cloud Platform and on-prem hosted
+     apps. For remote apps that are not deployed in Google Cloud Platform,
+     BeyondCorp Enterprise's App connector provides simplified
+     connectivity and app publishing experience. The BeyondCorp Enterprise
+     client connector extends support to non-web applications by creating a
+     secure connection to applications running in both Google Cloud and
+     non-Google Cloud environments with full context and identity aware access.
+
+
+     More information on Beyondcorp can be found here:
+     https://cloud.google.com/beyondcorp
+  """
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class BeyondcorpGa(extensions.BeyondcorpGa):
+  """Manage Beyondcorp resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/_init_extensions.py

@@ -0,0 +1,46 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+class BeyondcorpAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()
+
+
+@base.DefaultUniverseOnly
+class BeyondcorpBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()
+
+
+@base.DefaultUniverseOnly
+class BeyondcorpGa(base.Group):
+  """Optional no-auto-generated code for GA."""
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/__init__.py

@@ -0,0 +1,47 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The super-group for the beyondcorp application CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class App(base.Group):
+  """Manages application connectors and connections.
+
+     The gcloud beyondcorp command group lets you secure non-gcp application by
+     managing connectors and connections.
+
+     BeyondCorp Enterprise offers a zero trust solution that enables
+     secure access with integrated threat and data protection.The solution
+     enables secure access to both Google Cloud Platform and on-prem hosted
+     apps. For remote apps that are not deployed in Google Cloud Platform,
+     BeyondCorp Enterprise's App connector provides simplified
+     connectivity and app publishing experience.
+
+
+     More information on Beyondcorp can be found here:
+     https://cloud.google.com/beyondcorp
+  """
+
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/__init__.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Commands for creating and manipulating connections."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Connections(base.Group):
+  """Create and manipulate beyondcorp connections.
+
+  A Beyondcorp Connection resource represents a BeyondCorp protected
+  connection to a remote application. It creates all the necessary Google Cloud
+  Platform components needed for creating a BeyondCorp protected connection.
+  Multiple connectors can be authorised for a single Connection.
+  """
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/create.yaml

@@ -0,0 +1,92 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a new Beyondcorp application connection.
+    description: Create a new Beyondcorp application connection.
+    examples: |
+      The following command creates a Connection with ID ``my-connection'' using default ``tcp''
+      type connection:
+
+        $ {command} my-connection \
+            --location=us-central1 \
+            --application-endpoint=localhost:8080
+
+
+      The following command creates a Connection with ID ``my-connection'' with explicit project
+      value for all required and optional parameters:
+
+        $ {command} my-connection \
+            --project=projectId \
+            --location=us-central1 \
+            --application-endpoint-host=localhost \
+            --application-endpoint-port=8080 \
+            --type=tcp \
+            --connectors=my-connector1,my-connector2 \
+            --labels='foo=bar' \
+            --display-name=connection-display-name
+            --async
+
+  request:
+    collection: beyondcorp.projects.locations.appConnections
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:ValidateAndParseAppEndpoint
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:SetConnectors
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:SetAppGateway
+
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:PrintMessageInResponse
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      arg_name: connection
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnection
+      help_text: The Beyondcorp application connection you want to create.
+    params:
+    - group:
+        help_text: Application endpoint.
+        required: true
+        mutex: true
+        params:
+        - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint
+        - group:
+            params:
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint_host_v1alpha
+              required: true
+              release_tracks: [ALPHA]
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint_host_v1
+              required: true
+              release_tracks: [BETA]
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint_port_v1alpha
+              required: true
+              release_tracks: [ALPHA]
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint_port_v1
+              required: true
+              release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connectors_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connectors_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connection_type_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connection_type_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:display_name_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:display_name_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:app_gateway_v1
+      release_tracks: [BETA]
+
+    labels:
+      ALPHA:
+        api_field: googleCloudBeyondcorpAppconnectionsV1alphaAppConnection.labels
+      BETA:
+        api_field: googleCloudBeyondcorpAppconnectionsV1AppConnection.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/delete.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: Delete a single Connection
+    description: Delete a single Connection.
+    examples: |
+      To delete a connection named ``my-connection'' run:
+
+      $ {command} my-connection --project={project} --location={location}
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appConnections
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      arg_name: connection
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnection
+      help_text: The Beyondcorp connection you want to delete.

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/describe.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: Describe a single Connection
+    description: Describe a single Connection.
+    examples: |
+      To describe a connection ``my-connection'' run:
+
+      $ {command} my-connection --project={project} --location=us-central1
+
+      To describe a connection ``my-connection'' in a project for location us-central1 in table form, run:
+
+        $ {command} my-connection --project={project} \
+            --location=us-central1 \
+            --format=table(displayName, name.basename(), state, applicationEndpoint.host, applicationEndpoint.port, updateTime, labels)
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appConnections
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      arg_name: connection
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnection
+      help_text: The Beyondcorp connector you want to get details about.
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/list.yaml

@@ -0,0 +1,46 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      List Beyondcorp connection Resources.
+    description: |
+      List Beyondcorp connection resources based on project and location.
+
+    examples: |
+      To list all connections in a project for location ``us-central1'' in table form, run:
+
+        $ {command} --project=projectId --location=us-central1
+
+      To list all connections in a project for location ``us-central1'' in json form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1 \
+            --format=json(displayName, name.basename(), state, applicationEndpoint.host, applicationEndpoint.port, updateTime, labels)
+
+  request:
+    collection: beyondcorp.projects.locations.appConnections
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that define the Beyondcorp connector you want to list.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:location
+
+  output:
+    format: |
+        table(
+          name.basename():label=NAME,
+          displayName:label=DISPLAY_NAME,
+          state:label=CONNECTION_STATE,
+          applicationEndpoint.host.yesno(no="-"):label=REMOTE_HOST,
+          applicationEndpoint.port.yesno(no="-"):label=REMOTE_PORT,
+          updateTime.date():label=UPDATE_TIME,
+          labels.list():label=LABELS
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connections/update.yaml

@@ -0,0 +1,54 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update an existing Beyondcorp application connection.
+    description: Update an existing Beyondcorp application connection.
+    examples: |
+      To modify the connection ``my-connection'' in 'us-central1' by adding
+      labels 'k0', with value 'value1' and label 'k1' with value 'value2' and
+      removing labels with key 'k3', run:
+
+        $ {command} my-connection \
+            --location=us-central1 \
+            --display-name=new-display-name \
+            --connectors={connector1} \
+            --application-endpoint=host:port \
+            --update-labels=k0=value1,k1=value2 --remove-labels=k3
+
+  request:
+    collection: beyondcorp.projects.locations.appConnections
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:CheckFieldsSpecified
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:UpdateLabels
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:SetConnectors
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:ValidateAndParseAppEndpoint
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:UpdateApplicationEndpointMask
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:PrintMessageInResponse
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      arg_name: connection
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnection
+      help_text: The Beyondcorp connection you want to update.
+
+    params:
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:display_name_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:display_name_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connectors_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:connectors_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connections.flags:application_endpoint
+
+    additional_arguments_hook: googlecloudsdk.command_lib.beyondcorp.app.connections.hooks:UpdateLabelsFlags

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/__init__.py

@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Commands for creating and manipulating connectors."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Connectors(base.Group):
+  """Create and manipulate beyondcorp connectors.
+
+  A Beyondcorp connector represents an application facing component deployed
+  proximal to and with direct access to the application instances. It is used to
+  establish connectivity between the remote enterprise environment and Google
+  Cloud Platform. It initiates connections to the applications and can proxy the
+  data from users over the connection.
+  """
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/create.yaml

@@ -0,0 +1,57 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a new Beyondcorp application connector.
+    description: Create a new Beyondcorp application connector.
+    examples: |
+      The following command creates a Connector with ID ``my-connector'' in the default user project:
+
+        $ {command} my-connector \
+            --location=us-central1 \
+            --member=serviceAccount:connector-sa@projectId.iam.gserviceaccount.com
+
+      The following command creates a Connector with ID ``my-connector'' with explicit project value
+      for all required and optional parameters:
+
+        $ {command} my-connector \
+            --project=projectId \
+            --location=us-central1 \
+            --member=serviceAccount:connector-sa@projectId.iam.gserviceaccount.com \
+            --labels='foo=bar' \
+            --display-name=connector-display-name
+            --async
+
+  request:
+    collection: beyondcorp.projects.locations.appConnectors
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:PrintMessageInResponse
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      arg_name: connector
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnector
+      help_text: The Beyondcorp connector you want to create.
+
+    params:
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:service_account_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:service_account_v1
+      release_tracks: [BETA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:display_name_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:display_name_v1
+      release_tracks: [BETA]
+
+    labels:
+      ALPHA:
+        api_field: googleCloudBeyondcorpAppconnectorsV1alphaAppConnector.labels
+      BETA:
+        api_field: googleCloudBeyondcorpAppconnectorsV1AppConnector.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/delete.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: Delete a single Connector
+    description: Delete a single Connector.
+    examples: |
+      To delete a connector ``my-connector'' run:
+
+      $ {command} my-connector --project={project} --location={location}
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appConnectors
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      arg_name: connector
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnector
+      help_text: The Beyondcorp connector you want to delete.

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/describe.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: Describe a single Connector
+    description: Describe a single Connector.
+    examples: |
+      To describe a connector ``my-connector'' run:
+
+      $ {command} my-connector --project={project} --location={location}
+
+      To describe a connector in a project for location us-central1 in table form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1 \
+            --format=table(displayName, name, state, principalInfo.serviceAccount.email,createTime,updateTime,labels)
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appConnectors
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:HideDetailsBeforeDescribing
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      arg_name: connector
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnector
+      help_text: The Beyondcorp connector you want to get details about.
+    params:
+    - arg_name: details
+      type: bool
+      help_text: |
+        Includes details.
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/list.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      List Beyondcorp connector Resources.
+    description: |
+      List Beyondcorp connector resources based on project and location.
+
+    examples: |
+      To list all connectors in a project for location us-central1 in table form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1
+
+      To list all connectors in a project for location us-central1 in json form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1 \
+            --format=json(displayName, name, state, principalInfo.serviceAccount.email,createTime,updateTime,labels)
+
+  request:
+    collection: beyondcorp.projects.locations.appConnectors
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:PrintMessageInResponse
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that define the Beyondcorp connector you want to list.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:location
+
+  output:
+    format: |
+        table(
+          name.basename():label=NAME,
+          displayName:label=DISPLAY_NAME,
+          state:label=CONNECTOR_STATE,
+          principalInfo.serviceAccount.email:label=MEMBER,
+          createTime.date():label=CREATE_TIME,
+          updateTime.date():label=UPDATE_TIME,
+          labels.list():label=LABELS
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/connectors/update.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update an existing Beyondcorp application connector.
+    description: Update an existing Beyondcorp application connector.
+    examples: |
+      To modify the connector ``my-connector'' in 'us-central1' by adding
+      labels 'k0', with value 'value1' and label 'k1' with value 'value2' and
+      removing labels with key 'k3', run:
+
+        $ {command} my-connector \
+            --location=us-central1 \
+            --display-name=new-display-name \
+            --update-labels=k0=value1,k1=value2 --remove-labels=k3
+
+  request:
+    collection: beyondcorp.projects.locations.appConnectors
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:CheckFieldsSpecified
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:UpdateLabels
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:PrintMessageInResponse
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      arg_name: connector
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appconnector
+      help_text: The Beyondcorp connector you want to update
+    params:
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:display_name_v1alpha
+      release_tracks: [ALPHA]
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.connectors.flags:display_name_v1
+      release_tracks: [BETA]
+
+
+    additional_arguments_hook: googlecloudsdk.command_lib.beyondcorp.app.connectors.hooks:UpdateLabelsFlags

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/gateways/__init__.py

@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The super-group for the beyondcorp application CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class Gateways(base.Group):
+  """Manages appconnector gateways.
+
+  A BeyondCorp AppGateway resource represents a BeyondCorp protected
+  AppGateway to a remote application. It creates all the necessary google cloud
+  platform components needed for creating a BeyondCorp protected AppGateway.
+  Multiple connectors can be authorised for a single AppGateway
+  """
+
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/gateways/create.yaml

@@ -0,0 +1,43 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Create a new Beyondcorp AppConnector Gateway.
+    description: Create a new Beyondcorp AppConnector Gateway.
+    examples: |
+      The following command creates a Gateway with ID ``my-gateway'' in the default user project:
+
+        $ {command} my-gateway \
+            --location=us-central1 \
+            --host-type=regional-mig
+
+      The following command creates a Gateway with ID ``my-gateway'' with explicit project value
+      for all required and optional parameters:
+
+        $ {command} my-gateway \
+            --project=projectId \
+            --location=us-central1 \
+            --host-type=regional-mig \
+            --type=tcp \
+            --labels='foo=bar' \
+            --display-name=gateway-display-name
+            --async
+
+  request:
+    collection: beyondcorp.projects.locations.appGateways
+    BETA:
+      api_version: v1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appgateway
+      help_text: The Beyondcorp appconnector gateway you want to create.
+
+    params:
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.gateways.flags:host_type
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.gateways.flags:gateway_type
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.app.gateways.flags:display_name
+
+    labels:
+      api_field: appGateway.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/gateways/delete.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Delete a single AppConnector Gateway
+    description: Delete a single AppConnector Gateway.
+    examples: |
+      To delete a gateway ``my-gateway'' run:
+
+      $ {command} my-gateway --project={project} --location={location}
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appgateway
+      help_text: The Beyondcorp appconnector gateway you want to delete.

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/gateways/describe.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Describe a single AppConnector Gateway.
+    description: Describe a single AppConnector Gateway.
+    examples: |
+      To describe a gateway ``my-gateway'' run:
+
+      $ {command} my-gateway --project={project} --location={location}
+
+      To describe a gateway in a project for location us-central1 in table form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1 \
+            --format=json(displayName, name, state, type, hostType, updateTime, labels)
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.appGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:appgateway
+      help_text: The Beyondcorp appconnector gateway you want to get details about.
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/gateways/list.yaml

@@ -0,0 +1,42 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: List Beyondcorp AppConnector Gateway resources.
+    description: List Beyondcorp AppConnector Gateway resources based on project and location.
+    examples: |
+      examples: |
+      To list all gateways in a project for location us-central1 in table form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1
+
+      To list all gateways in a project for location us-central1 in json form, run:
+
+        $ {command} --project=projectId \
+            --location=us-central1 \
+            --format=json(displayName, name, state, type, hostType, updateTime, labels)
+
+  request:
+    collection: beyondcorp.projects.locations.appGateways
+    BETA:
+      api_version: v1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that define the Beyondcorp gateway you want to list.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:location
+
+  output:
+    format: |
+        table(
+          name.basename():label=NAME,
+          displayName:label=DISPLAY_NAME,
+          state:label=GATEWAY_STATE,
+          type:label=GATEWAY_TYPE,
+          hostType:label=HOST_TYPE,
+          updateTime.date():label=UPDATE_TIME,
+          labels.list():label=LABELS
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/operations/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Commands for creating and manipulating connectors."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Operations(base.Group):
+  """List and Describe beyondcorp appconnector operations."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/operations/describe.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: |
+      Describe a Beyondcorp Appconnector operation.
+    description: |
+      Describe a Beyondcorp Appconnector operation given a valid operation name.
+    examples: |
+      The following command describes an operation called
+      `operation-1484002552235-425b144f8c3f8-81aa4b49-0830d1e9`:
+
+        $ {command} --location=us-central1 operation-1484002552235-425b144f8c3f8-81aa4b49-0830d1e9
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:operation
+      help_text: |
+        Name of the AppConnector operation you want to describe.
+
+  request:
+    collection: beyondcorp.projects.locations.operations
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/app/operations/list.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: |
+      List Beyondcorp Appconnector operations.
+    description: |
+      List all Beyondcorp Appconnector operations in the specified project.
+
+      You can specify the maximum number of operations to list using the
+      `--limit` flag.
+    examples: |
+      The following command lists a maximum of five operations:
+
+          $ {command} --location=us-central1 --limit=5
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.app.resources:location
+      help_text: |
+        Region of the operations to display.
+
+  request:
+    collection: beyondcorp.projects.locations.operations
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1
+
+  output:
+    format: |
+       table(
+          name.basename():label=OPERATION_NAME,
+          metadata.verb:label=TYPE,
+          metadata.target.basename(),
+          done,
+          metadata.createTime.date():sort=1,
+          duration(start=metadata.createTime,end=metadata.endTime,precision=0,calendar=false).slice(2:).join("").yesno(no="<1S"):label=DURATION
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/__init__.py

@@ -0,0 +1,45 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The super-group for the BeyondCorp Enterprise client connector CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class ClientConnector(base.Group):
+  """Provides context-aware access to non-web applications (Deprecated).
+
+     BeyondCorp Enterprise is the zero trust solution from Google that provides
+     secure access to private applications with integrated threat and data
+     protection. BeyondCorp Enterprise uses Chrome to provide secure access for
+     all web-based (HTTPS) applications.
+
+     The BeyondCorp Enterprise client connector extends support to non-web
+     applications by creating a secure connection to applications running in
+     both Google Cloud and non-Google Cloud environments with full context and
+     identity aware access.
+
+     More information on Beyondcorp can be found here:
+     https://cloud.google.com/beyondcorp-enterprise/docs/client-connector
+  """
+
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Commands for creating and manipulating BeyondCorp client gateways (Deprecated)."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class ClientGateways(base.Group):
+  """Create and manipulate BeyondCorp client gateways.
+
+  Regional, server-side components to which clients can connect. Client gateways
+  are deployed by administrators. The gateways communicate with the BeyondCorp
+  Enterprise enforcement system to enforce context-aware checks. The BeyondCorp
+  Enterprise enforcement system uses Identity-Aware Proxy and Access Context
+  Manager, a flexible BeyondCorp Enterprise zero trust policy engine.
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/create.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Create a new BeyondCorp client gateway (Deprecated).
+    description: Create a new BeyondCorp client gateway.
+    examples: |
+      The following command creates a client gateway with ID ``my-client-gateway'' in the default user project and location us-central1:
+
+        $ {command} my-client-gateway --location=us-central1 \
+        --client-connector-service=projects/consumer-project-id/locations/us-central1/clientConnectorServices/my-service-resource
+
+      The following command creates a client gateway with ID ``my-client-gateway'' with explicit values
+      for all required and optional parameters:
+
+        $ {command} my-client-gateway --project=consumer-project-id --location=us-central1 \
+        --client-connector-service=projects/consumer-project-id/locations/us-central1/clientConnectorServices/my-service-resource
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client gateway you want to create.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_gateway
+
+    params:
+    - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.gateways.flags:client_connector_service

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/delete.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Delete a single BeyondCorp client gateway (Deprecated).
+    description: Delete a single BeyondCorp client gateway.
+    examples: |
+      To delete a client gateway with ID ``my-client-gateway'' run:
+
+      $ {command} my-client-gateway --project=consumer-project-id --location=us-central1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client gateway you want to delete.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_gateway

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/describe.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Describe a single BeyondCorp client gateway (Deprecated).
+    description: Describe a single BeyondCorp client gateway.
+    examples: |
+      To describe a client gateway ``my-client-gateway'' run:
+
+      $ {command} my-client-gateway --project=consumer-project-id --location=us-central1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client gateway you want to get details about.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_gateway
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/get_iam_policy.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Get the IAM policy for a BeyondCorp client gateway (Deprecated).
+    description: Gets the IAM policy for the given BeyondCorp client gateway.
+    examples: |
+      To get the IAM policy for a client gateway ``my-client-gateway'' run:
+
+      $ {command} my-client-gateway --project=consumer-project-id --location=us-central1
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client gateway for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_gateway
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/list.yaml

@@ -0,0 +1,32 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: |
+      List BeyondCorp client gateway resources (Deprecated).
+    description: |
+      List BeyondCorp client gateway resources based on project and location.
+
+    examples: |
+      To list all client gateways in a project for location us-central1 in table form, run:
+
+        $ {command} --project=consumer-project-id --location=us-central1
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that define the BeyondCorp client gateways you want to list.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:location
+
+  output:
+    format: |
+        table(
+          name.basename():label=NAME,
+          state:label=STATE,
+          clientConnectorService:label=CLIENT_CONNECTOR_SERVICE,
+          createTime.date():label=CREATE_TIME,
+          updateTime.date():label=UPDATE_TIME
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/gateways/set_iam_policy.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Set the IAM policy for a BeyondCorp client gateway (Deprecated).
+    description: Sets the IAM policy for the given BeyondCorp client gateway.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the client gateway with ID ``my-client-gateway'':
+
+        $ {command} my-client-gateway policy.json --location=us-central1
+
+  request:
+    collection: beyondcorp.projects.locations.clientGateways
+    BETA:
+      api_version: v1
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: BeyondcorpProjectsLocationsClientGatewaysSetIamPolicyRequest
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client gateway for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_gateway

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/operations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Commands for creating and manipulating client connector operations (Deprecated)."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class Operations(base.Group):
+  """List and describe BeyondCorp client connector operations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/operations/describe.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: |
+      Describe a BeyondCorp client connector operation (Deprecated).
+    description: |
+      Describe a BeyondCorp client connector operation given a valid operation name.
+    examples: |
+      The following command describes an operation called
+      `operation-1484002552235-425b144f8c3f8-81aa4b49-0830d1e9`:
+
+        $ {command} operation-1484002552235-425b144f8c3f8-81aa4b49-0830d1e9 \
+        --project=consumer-project-id --location=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:operation
+      help_text: |
+        Name of the client connector operation you want to describe.
+
+  request:
+    collection: beyondcorp.projects.locations.operations
+    BETA:
+      api_version: v1

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/operations/list.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: |
+      List BeyondCorp client connector operations (Deprecated).
+    description: |
+      List all BeyondCorp client connector operations in the specified project.
+
+      You can specify the maximum number of operations to list using the
+      `--limit` flag.
+    examples: |
+      The following command lists a maximum of five operations:
+
+          $ {command} --project=consumer-project-id --location=us-central1 --limit=5
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:location
+      help_text: |
+        Location of the operations to display.
+
+  request:
+    collection: beyondcorp.projects.locations.operations
+    BETA:
+      api_version: v1
+
+  output:
+    format: |
+       table(
+          name.basename():label=OPERATION_NAME,
+          metadata.verb:label=TYPE,
+          metadata.target.basename(),
+          done,
+          metadata.createTime.date():sort=1,
+          duration(start=metadata.createTime,end=metadata.endTime,precision=0,calendar=false).slice(2:).join("").yesno(no="<1S"):label=DURATION
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/__init__.py

@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Commands for creating and manipulating client connector services (Deprecated)."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class ClientConnectorServices(base.Group):
+  """Create and manipulate BeyondCorp client connector services.
+
+  The client connector service is used to define a common configuration for a
+  group of client gateways. Client gateways refer to the client connector
+  service and are used to control the regions where you want to manage user
+  traffic.
+    The gateways communicate with the BeyondCorp Enterprise enforcement system
+  to enforce context-aware checks. The BeyondCorp Enterprise enforcement system
+  uses Identity-Aware Proxy and Access Context Manager, a flexible BeyondCorp
+  Enterprise zero trust policy engine.
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/create.yaml

@@ -0,0 +1,45 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Create a new BeyondCorp client connector service (Deprecated).
+    description: Create a new BeyondCorp client connector service.
+    examples: |
+      The following command creates a client connector service with ID ``my-service-resource'' using ingress/egress config provided:
+
+        $ {command} my-service-resource --location=us-central1 --project=consumer-project-id \
+        --ingress-config='{"transportProtocol":"TCP", "destinationRoutes":[{"address":"196.0.0.1", "netmask":"255.255.255.0"}]}' \
+        --egress-peered-vpc='{"networkVpc":"projects/consumer-project-id/global/networks/my-vpc-network"}'
+
+      The following command creates a client connector service with ID ``my-service-resource'' with configuration from file:
+
+        $ {command} my-service-resource \
+        --project=consumer-project-id --location=us-central1 \
+        --config-from-file=/path/to/file/configJson.txt
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.client_connector.services.hooks:ParseConfig
+    BETA:
+      api_version: v1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client connector service you want to create.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service
+    params:
+    - group:
+        help_text: Client connector service configuration.
+        required: true
+        mutex: true
+        params:
+        - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:config_from_file
+        - group:
+            params:
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:ingress_config
+              required: true
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:egress_peered_vpc
+              required: true
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:display_name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/delete.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Delete a BeyondCorp client connector service (Deprecated).
+    description: Delete a BeyondCorp client connector service.
+    examples: |
+      To delete a client connector service with ID ``my-service-resource'' run:
+
+      $ {command} my-service-resource --project=consumer-project-id --location=us-central1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client connector service you want to delete.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/describe.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Describe a BeyondCorp client connector service (Deprecated).
+    description: Describe a BeyondCorp client connector service.
+    examples: |
+      To describe a client connector service with ID ``my-service-resource'' run:
+
+      $ {command} my-service-resource --project=consumer-project-id --location=us-central1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client connector service you want to get details about.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/get_iam_policy.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Get the IAM policy for a BeyondCorp client connector service (Deprecated).
+    description: Gets the IAM policy for a BeyondCorp client connector service.
+    examples: |
+      To get the IAM policy for a client connector service with ID ``my-service-resource'' run:
+
+      $ {command} my-service-resource --project=consumer-project-id --location=us-central1
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client connector service for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/list.yaml

@@ -0,0 +1,40 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: |
+      List BeyondCorp client connector service resources (Deprecated).
+    description: |
+      List BeyondCorp client connector service resources based on project and location.
+
+    examples: |
+      To list all client connector services in a project for location us-central1 in table form, run:
+
+        $ {command} --project=consumer-project-id --location=us-central1
+
+      To list all client connector service in a project for location us-central1 with limit=1, run:
+
+        $ {command} --project=consumer-project-id --location=us-central1 --limit=1
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that define the BeyondCorp client connector services you want to list.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:location
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        displayName:label=DISPLAY_NAME,
+        state:label=STATE,
+        ingress.config.transportProtocol:label=INGRESS_TRANSPORT_PROTOCOL,
+        ingress.config.destinationRoutes.address.list():label=INGRESS_DESTINATION_ROUTES_ADDRESS,
+        ingress.config.destinationRoutes.netmask.list():label=INGRESS_DESTINATION_ROUTES_NETMASK,
+        egress.peeredVpc.networkVpc:label=EGRESS_PEERED_NETWORK_VPC,
+        createTime.date():label=CREATE_TIME,
+        updateTime.date():label=UPDATE_TIME
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/set_iam_policy.yaml

@@ -0,0 +1,25 @@
+release_tracks: [BETA]
+help_text:
+  brief: Set the IAM policy for a BeyondCorp client connector service (Deprecated).
+  description: Sets the IAM policy for the given BeyondCorp client connector service.
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for the client connector service with ID ``my-service-resource'':
+
+      $ {command} my-service-resource policy.json
+
+request:
+  collection: beyondcorp.projects.locations.clientConnectorServices
+  BETA:
+    api_version: v1
+
+iam:
+  set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+  message_type_overrides:
+    policy: GoogleIamV1Policy
+    set_iam_policy_request: BeyondcorpProjectsLocationsClientConnectorServicesSetIamPolicyRequest
+
+arguments:
+  resource:
+    help_text: The BeyondCorp client connector service for which to set the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/client_connector/services/update.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Update a BeyondCorp client connector service (Deprecated).
+    description: Update a BeyondCorp client connector service. Note - Mutable fields include - \
+      display_name, ingress.config.destination_routes.
+    examples: |
+      Note - Mutable fields include: display_name, ingress.config.destination_routes.
+
+      The following command updates a client connector service with ID ``my-service-resource'' with ingress config:
+
+        $ {command} my-service-resource --project=consumer-project-id --location=us-central1 \
+        --display-name="my-new-resource" \
+        --ingress-config='{"destinationRoutes":[{"address":"196.0.0.1", "netmask":"255.255.255.0"},{"address":"197.0.0.2","netmask":"255.255.255.0"}]}'
+
+      The following command updates a client connector service with ID ``my-service-resource'' with configuration from file:
+
+        $ {command} my-service-resource \
+        --project=consumer-project-id --location=us-central1 \
+        --config-from-file=/path/to/file/config.json
+
+  request:
+    collection: beyondcorp.projects.locations.clientConnectorServices
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.beyondcorp.client_connector.services.hooks:CheckUpdateFieldsSpecified
+    - googlecloudsdk.command_lib.beyondcorp.client_connector.services.hooks:ParseUpdatedConfig
+    BETA:
+      api_version: v1
+
+  async:
+    collection: beyondcorp.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The BeyondCorp client connector service you want to update.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.client_connector.resources:client_connector_service
+
+    params:
+    - group:
+        help_text: Updated client connector service configuration.
+        required: true
+        mutex: true
+        params:
+        - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:config_from_file_update
+        - group:
+            params:
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:ingress_config_update
+            - _REF_: googlecloudsdk.command_lib.beyondcorp.client_connector.services.flags:display_name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Operation resources."""
+
+from googlecloudsdk.calliope import base
+from surface.beyondcorp.operations import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class OperationsGa(extensions.OperationsGa):
+  """Manage Operation resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/_init_extensions.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+class OperationsAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+@base.DefaultUniverseOnly
+class OperationsBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+@base.DefaultUniverseOnly
+class OperationsGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/_partials/_describe_ga.yaml

@@ -0,0 +1,21 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Describe operations
+    description: Describe an operation
+    examples: |-
+      To describe the operation, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the operation resource.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.default_resources:projects_locations_operations
+      required: true
+  request:
+    GA:
+      api_version: v1
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/_partials/_list_ga.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: List operations
+    description: List operations
+    examples: |-
+      To list all operations, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the operation's parent resource.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.default_resources:projects_locations
+      required: true
+  request:
+    GA:
+      api_version: v1
+    collection:
+    - beyondcorp.projects.locations.operations
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/operations/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Security Gateway resources."""
+
+from googlecloudsdk.calliope import base
+from surface.beyondcorp.security_gateways import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class SecurityGatewaysBeta(extensions.SecurityGatewaysBeta):
+  """Manage Security Gateway resources."""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class SecurityGatewaysGa(extensions.SecurityGatewaysGa):
+  """Manage Security Gateway resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_init_extensions.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+class SecurityGatewaysAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+@base.DefaultUniverseOnly
+class SecurityGatewaysBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+@base.DefaultUniverseOnly
+class SecurityGatewaysGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_create_beta.yaml

@@ -0,0 +1,234 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Create securityGateways
+    description: Create a securityGateway
+    examples: |-
+      To create the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: securityGatewayId
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the SecurityGateway.
+        Cannot exceed 64 characters.
+    - arg_name: hubs
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.hubs
+      required: false
+      repeated: true
+      help_text: |-
+        Map of Hubs that represents regional data path deployment with Google Cloud Platform region
+        as a key.
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig
+        required: false
+        help_text: |-
+          The configuration for the proxy.
+        params:
+        - arg_name: proxy-protocol-config-allowed-client-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.allowedClientHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            List of the allowed client header names.
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders
+            required: false
+            help_text: |-
+              Contextual headers configuration.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo
+                required: false
+                help_text: |-
+                  The configuration information for the delegated user.
+                params:
+                - arg_name: user-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo.outputType
+                  required: false
+                  help_text: |-
+                    The delegated user's information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo
+                required: false
+                help_text: |-
+                  The delegated group configuration details.
+                params:
+                - arg_name: group-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type of the delegated group information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo
+                required: false
+                help_text: |-
+                  The delegated device information configuration.
+                params:
+                - arg_name: device-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type details for the delegated device.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - arg_name: contextual-headers-output-type
+              api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.outputType
+              required: false
+              help_text: |-
+                Default output type for all enabled headers.
+              choices:
+              - arg_value: protobuf
+                enum_value: PROTOBUF
+                help_text: |-
+                  Protobuf output type.
+              - arg_value: json
+                enum_value: JSON
+                help_text: |-
+                  JSON output type.
+              - arg_value: none
+                enum_value: NONE
+                help_text: |-
+                  Explicitly disable header output.
+        - arg_name: proxy-protocol-config-metadata-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.metadataHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - arg_name: proxy-protocol-config-gateway-identity
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.gatewayIdentity
+          required: false
+          help_text: |-
+            The security gateway identity configuration.
+          choices:
+          - arg_value: resource-name
+            enum_value: RESOURCE_NAME
+            help_text: |-
+              Resource name for gateway identity, in the format:
+              projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}
+        - arg_name: proxy-protocol-config-client-ip
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.clientIp
+          action: store_true
+          required: false
+          type: bool
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+          default: null
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery
+        required: false
+        help_text: |-
+          Settings related to the Service Discovery.
+        params:
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway
+            required: true
+            help_text: |-
+              If Service Discovery is done through API, defines its settings.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride
+                required: true
+                help_text: |-
+                  API operation descriptor.
+                params:
+                - arg_name: resource-override-path
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride.path
+                  required: true
+                  repeated: false
+                  help_text: |-
+                    Contains the URI path fragment where HTTP request is sent.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore the
+        request if it has already been completed. The server will guarantee
+        that for at least 60 minutes since the first request.
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_create_ga.yaml

@@ -0,0 +1,234 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Create securityGateways
+    description: Create a securityGateway
+    examples: |-
+      To create the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: securityGatewayId
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the SecurityGateway.
+        Cannot exceed 64 characters.
+    - arg_name: hubs
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.hubs
+      required: false
+      repeated: true
+      help_text: |-
+        Map of Hubs that represents regional data path deployment with Google Cloud Platform region
+        as a key.
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig
+        required: false
+        help_text: |-
+          The configuration for the proxy.
+        params:
+        - arg_name: proxy-protocol-config-allowed-client-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.allowedClientHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            List of the allowed client header names.
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders
+            required: false
+            help_text: |-
+              Contextual headers configuration.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo
+                required: false
+                help_text: |-
+                  The configuration information for the delegated user.
+                params:
+                - arg_name: user-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo.outputType
+                  required: false
+                  help_text: |-
+                    The delegated user's information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo
+                required: false
+                help_text: |-
+                  The delegated group configuration details.
+                params:
+                - arg_name: group-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type of the delegated group information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo
+                required: false
+                help_text: |-
+                  The delegated device information configuration.
+                params:
+                - arg_name: device-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type details for the delegated device.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - arg_name: contextual-headers-output-type
+              api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.outputType
+              required: false
+              help_text: |-
+                Default output type for all enabled headers.
+              choices:
+              - arg_value: protobuf
+                enum_value: PROTOBUF
+                help_text: |-
+                  Protobuf output type.
+              - arg_value: json
+                enum_value: JSON
+                help_text: |-
+                  JSON output type.
+              - arg_value: none
+                enum_value: NONE
+                help_text: |-
+                  Explicitly disable header output.
+        - arg_name: proxy-protocol-config-metadata-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.metadataHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - arg_name: proxy-protocol-config-gateway-identity
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.gatewayIdentity
+          required: false
+          help_text: |-
+            The security gateway identity configuration.
+          choices:
+          - arg_value: resource-name
+            enum_value: RESOURCE_NAME
+            help_text: |-
+              Resource name for gateway identity, in the format:
+              projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}
+        - arg_name: proxy-protocol-config-client-ip
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.clientIp
+          action: store_true
+          required: false
+          type: bool
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+          default: null
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery
+        required: false
+        help_text: |-
+          Settings related to the Service Discovery.
+        params:
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway
+            required: true
+            help_text: |-
+              If Service Discovery is done through API, defines its settings.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride
+                required: true
+                help_text: |-
+                  API operation descriptor.
+                params:
+                - arg_name: resource-override-path
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride.path
+                  required: true
+                  repeated: false
+                  help_text: |-
+                    Contains the URI path fragment where HTTP request is sent.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore the
+        request if it has already been completed. The server will guarantee
+        that for at least 60 minutes since the first request.
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_delete_beta.yaml

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Delete securityGateways
+    description: Delete a securityGateway
+    examples: |-
+      To delete the securityGateway, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        BeyondCorp SecurityGateway name using the form:
+        `projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+    - arg_name: validate-only
+      api_field: validateOnly
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If set, validates request by executing a dry-run which would not
+        alter the resource in any way.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_delete_ga.yaml

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Delete securityGateways
+    description: Delete a securityGateway
+    examples: |-
+      To delete the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        BeyondCorp SecurityGateway name using the form:
+        `projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+    - arg_name: validate-only
+      api_field: validateOnly
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If set, validates request by executing a dry-run which would not
+        alter the resource in any way.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_describe_beta.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Describe securityGateways
+    description: Describe a securityGateway
+    examples: |-
+      To describe the securityGateway, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the PartnerTenant using the form:
+        `projects/{project_id}/locations/{location_id}/securityGateway/{security_gateway_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_describe_ga.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Describe securityGateways
+    description: Describe a securityGateway
+    examples: |-
+      To describe the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the PartnerTenant using the form:
+        `projects/{project_id}/locations/{location_id}/securityGateway/{security_gateway_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_get_iam_policy_beta.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Get the IAM policy for a security gateway.
+    description: Gets the IAM policy for the given security gateway.
+    examples: |
+      To get the IAM policy for a security gateway ``my-security-gateway'' run:
+
+      $ {command} my-security-gateway --project=consumer-project-id --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The security gateway for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_get_iam_policy_ga.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Get the IAM policy for a security gateway.
+    description: Gets the IAM policy for the given security gateway.
+    examples: |
+      To get the IAM policy for a security gateway ``my-security-gateway'' run:
+
+      $ {command} my-security-gateway --project=consumer-project-id --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The security gateway for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_list_beta.yaml

@@ -0,0 +1,44 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: List securityGateways
+    description: List securityGateways
+    examples: |-
+      To list all securityGateways, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The parent location to which the resources belong.
+         We support only global location.
+
+        `projects/{project_id}/locations/{location_id}/`
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_list_ga.yaml

@@ -0,0 +1,42 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: List securityGateways
+    description: List securityGateways
+    examples: |-
+      To list all securityGateways, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The parent location to which the resources belong.
+        `projects/{project_id}/locations/{location_id}/`
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_set_iam_policy_beta.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Set the IAM policy for a security gateway.
+    description: Sets the IAM policy for the given security gateway.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the security gateway with ID ``my-security-gateway'':
+
+        $ {command} my-security-gateway policy.json --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways
+    BETA:
+      api_version: v1
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: BeyondcorpProjectsLocationsSecurityGatewaysSetIamPolicyRequest
+  arguments:
+    resource:
+      help_text: The security gateway for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_set_iam_policy_ga.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [GA]
+  help_text:
+    brief: Set the IAM policy for a security gateway.
+    description: Sets the IAM policy for the given security gateway.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the security gateway with ID ``my-security-gateway'':
+
+        $ {command} my-security-gateway policy.json --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways
+    BETA:
+      api_version: v1
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: BeyondcorpProjectsLocationsSecurityGatewaysSetIamPolicyRequest
+  arguments:
+    resource:
+      help_text: The security gateway for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_update_beta.yaml

@@ -0,0 +1,250 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Update securityGateways
+    description: Update a securityGateway
+    examples: |-
+      To update the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the SecurityGateway.
+        Cannot exceed 64 characters.
+    - arg_name: hubs
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.hubs
+      required: false
+      repeated: true
+      help_text: |-
+        Map of Hubs that represents regional data path deployment with Google Cloud Platform region
+        as a key.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig
+        arg_name: proxy-protocol-config
+        clearable: true
+        required: false
+        help_text: |-
+          The configuration for the proxy.
+        params:
+        - arg_name: proxy-protocol-config-allowed-client-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.allowedClientHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            List of the allowed client header names.
+          clearable: true
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders
+            required: false
+            help_text: |-
+              Contextual headers configuration.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo
+                required: false
+                help_text: |-
+                  The configuration information for the delegated user.
+                params:
+                - arg_name: user-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo.outputType
+                  required: false
+                  help_text: |-
+                    The delegated user's information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo
+                required: false
+                help_text: |-
+                  The delegated group configuration details.
+                params:
+                - arg_name: group-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type of the delegated group information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo
+                required: false
+                help_text: |-
+                  The delegated device information configuration.
+                params:
+                - arg_name: device-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type details for the delegated device.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - arg_name: contextual-headers-output-type
+              api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.outputType
+              required: false
+              help_text: |-
+                Default output type for all enabled headers.
+              choices:
+              - arg_value: protobuf
+                enum_value: PROTOBUF
+                help_text: |-
+                  Protobuf output type.
+              - arg_value: json
+                enum_value: JSON
+                help_text: |-
+                  JSON output type.
+              - arg_value: none
+                enum_value: NONE
+                help_text: |-
+                  Explicitly disable header output.
+        - arg_name: proxy-protocol-config-metadata-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.metadataHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          clearable: true
+          spec:
+          - api_field: key
+          - api_field: value
+        - arg_name: proxy-protocol-config-gateway-identity
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.gatewayIdentity
+          required: false
+          help_text: |-
+            The security gateway identity configuration.
+          choices:
+          - arg_value: resource-name
+            enum_value: RESOURCE_NAME
+            help_text: |-
+              Resource name for gateway identity, in the format:
+              projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}
+        - arg_name: proxy-protocol-config-client-ip
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.clientIp
+          action: store_true_false
+          required: false
+          type: bool
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery
+        arg_name: service-discovery
+        clearable: true
+        required: false
+        help_text: |-
+          Settings related to the Service Discovery.
+        params:
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway
+            required: false
+            help_text: |-
+              If Service Discovery is done through API, defines its settings.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride
+                required: false
+                help_text: |-
+                  API operation descriptor.
+                params:
+                - arg_name: resource-override-path
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride.path
+                  required: false
+                  repeated: false
+                  help_text: |-
+                    Contains the URI path fragment where HTTP request is sent.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request timed out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/_partials/_update_ga.yaml

@@ -0,0 +1,250 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Update securityGateways
+    description: Update a securityGateway
+    examples: |-
+      To update the securityGateway, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the SecurityGateway.
+        Cannot exceed 64 characters.
+    - arg_name: hubs
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.hubs
+      required: false
+      repeated: true
+      help_text: |-
+        Map of Hubs that represents regional data path deployment with Google Cloud Platform region
+        as a key.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig
+        arg_name: proxy-protocol-config
+        clearable: true
+        required: false
+        help_text: |-
+          The configuration for the proxy.
+        params:
+        - arg_name: proxy-protocol-config-allowed-client-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.allowedClientHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            List of the allowed client header names.
+          clearable: true
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders
+            required: false
+            help_text: |-
+              Contextual headers configuration.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo
+                required: false
+                help_text: |-
+                  The configuration information for the delegated user.
+                params:
+                - arg_name: user-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.userInfo.outputType
+                  required: false
+                  help_text: |-
+                    The delegated user's information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo
+                required: false
+                help_text: |-
+                  The delegated group configuration details.
+                params:
+                - arg_name: group-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.groupInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type of the delegated group information.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo
+                required: false
+                help_text: |-
+                  The delegated device information configuration.
+                params:
+                - arg_name: device-info-output-type
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.deviceInfo.outputType
+                  required: false
+                  help_text: |-
+                    The output type details for the delegated device.
+                  choices:
+                  - arg_value: protobuf
+                    enum_value: PROTOBUF
+                    help_text: |-
+                      Protobuf output type.
+                  - arg_value: json
+                    enum_value: JSON
+                    help_text: |-
+                      JSON output type.
+                  - arg_value: none
+                    enum_value: NONE
+                    help_text: |-
+                      Explicitly disable header output.
+            - arg_name: contextual-headers-output-type
+              api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.contextualHeaders.outputType
+              required: false
+              help_text: |-
+                Default output type for all enabled headers.
+              choices:
+              - arg_value: protobuf
+                enum_value: PROTOBUF
+                help_text: |-
+                  Protobuf output type.
+              - arg_value: json
+                enum_value: JSON
+                help_text: |-
+                  JSON output type.
+              - arg_value: none
+                enum_value: NONE
+                help_text: |-
+                  Explicitly disable header output.
+        - arg_name: proxy-protocol-config-metadata-headers
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.metadataHeaders
+          required: false
+          repeated: true
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          clearable: true
+          spec:
+          - api_field: key
+          - api_field: value
+        - arg_name: proxy-protocol-config-gateway-identity
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.gatewayIdentity
+          required: false
+          help_text: |-
+            The security gateway identity configuration.
+          choices:
+          - arg_value: resource-name
+            enum_value: RESOURCE_NAME
+            help_text: |-
+              Resource name for gateway identity, in the format:
+              projects/{project_id}/locations/{location_id}/securityGateways/{security_gateway_id}
+        - arg_name: proxy-protocol-config-client-ip
+          api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.proxyProtocolConfig.clientIp
+          action: store_true_false
+          required: false
+          type: bool
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+    - group:
+        api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery
+        arg_name: service-discovery
+        clearable: true
+        required: false
+        help_text: |-
+          Settings related to the Service Discovery.
+        params:
+        - group:
+            api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway
+            required: false
+            help_text: |-
+              If Service Discovery is done through API, defines its settings.
+            params:
+            - group:
+                api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride
+                required: false
+                help_text: |-
+                  API operation descriptor.
+                params:
+                - arg_name: resource-override-path
+                  api_field: googleCloudBeyondcorpSecuritygatewaysV1SecurityGateway.serviceDiscovery.apiGateway.resourceOverride.path
+                  required: false
+                  repeated: false
+                  help_text: |-
+                    Contains the URI path fragment where HTTP request is sent.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request timed out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Application resources."""
+
+from googlecloudsdk.calliope import base
+from surface.beyondcorp.security_gateways.applications import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class ApplicationsBeta(extensions.ApplicationsBeta):
+  """Manage Application resources."""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class ApplicationsGa(extensions.ApplicationsGa):
+  """Manage Application resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_init_extensions.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+class ApplicationsAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+@base.DefaultUniverseOnly
+class ApplicationsBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+@base.DefaultUniverseOnly
+class ApplicationsGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_create_beta.yaml

@@ -0,0 +1,189 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Create applications
+    description: Create an application
+    examples: |-
+      To create the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: applicationId
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: endpoint-matchers
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.endpointMatchers
+      required: false
+      repeated: true
+      help_text: |-
+        An array of conditions to match the application's network endpoint.
+        Each element in the array is an EndpointMatcher object, which defines a
+        specific combination of a hostname pattern and one or more ports. The
+        application is considered matched if at least one of the EndpointMatcher
+        conditions in this array is met (the conditions are combined using OR
+        logic). Each EndpointMatcher must contain a hostname pattern, such as
+        "example.com", and one or more port numbers specified as a string, such as
+        "443".
+
+        Hostname and port number examples:
+        "*.example.com", "443"
+        "example.com" and "22"
+        "example.com" and "22,33"
+      spec:
+      - api_field: hostname
+        help_text: |-
+          Hostname of the application.
+      - api_field: ports
+        help_text: |-
+          The ports of the application.
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the application resource.
+        Cannot exceed 64 characters.
+    - arg_name: upstreams
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.upstreams
+      required: false
+      repeated: true
+      help_text: |-
+        Which upstream resources to forward traffic to.
+      spec:
+      - api_field: network
+        one_of_index: 0
+        help_text: |-
+          Network to forward traffic to.
+        spec:
+        - api_field: name
+          help_text: |-
+            Network name is of the format:
+            `projects/{project}/global/networks/{network}
+      - api_field: external
+        one_of_index: 0
+        help_text: |-
+          List of the external endpoints to forward traffic to.
+        spec:
+        - api_field: endpoints
+          help_text: |-
+            List of the endpoints to forward traffic to.
+          spec:
+          - api_field: hostname
+            help_text: |-
+              Hostname of the endpoint.
+          - api_field: port
+            help_text: |-
+              Port of the endpoint.
+      - api_field: proxyProtocol
+        help_text: |-
+          Enables proxy protocol configuration for the upstream.
+        spec:
+        - api_field: allowedClientHeaders
+          help_text: |-
+            List of the allowed client header names.
+        - api_field: contextualHeaders
+          help_text: |-
+            Configuration for the contextual headers.
+          spec:
+          - api_field: userInfo
+            help_text: |-
+              User details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The delegated user's information.
+          - api_field: groupInfo
+            help_text: |-
+              Group details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type of the delegated group information.
+          - api_field: deviceInfo
+            help_text: |-
+              The device information configuration.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type details for the delegated device.
+          - api_field: outputType
+            help_text: |-
+              Default output type for all enabled headers.
+        - api_field: metadataHeaders
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - api_field: gatewayIdentity
+          help_text: |-
+            The security gateway identity configuration.
+        - api_field: clientIp
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+      - api_field: egressPolicy
+        help_text: |-
+          Routing policy information.
+        spec:
+        - api_field: regions
+          help_text: |-
+            List of the regions where the application sends traffic.
+    - arg_name: schema
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.schema
+      required: false
+      help_text: |-
+        Type of the external application.
+      choices:
+      - arg_value: proxy-gateway
+        enum_value: PROXY_GATEWAY
+        help_text: |-
+          Proxy which routes traffic to actual applications, like Netscaler
+          Gateway.
+      - arg_value: api-gateway
+        enum_value: API_GATEWAY
+        help_text: |-
+          Service Discovery API endpoint when Service Discovery is enabled in
+          Gateway.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        request if it has already been completed. The server will guarantee
+        that for at least 60 minutes since the first request.
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_create_ga.yaml

@@ -0,0 +1,189 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Create applications
+    description: Create an application
+    examples: |-
+      To create the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: applicationId
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: endpoint-matchers
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.endpointMatchers
+      required: false
+      repeated: true
+      help_text: |-
+        An array of conditions to match the application's network endpoint.
+        Each element in the array is an EndpointMatcher object, which defines a
+        specific combination of a hostname pattern and one or more ports. The
+        application is considered matched if at least one of the EndpointMatcher
+        conditions in this array is met (the conditions are combined using OR
+        logic). Each EndpointMatcher must contain a hostname pattern, such as
+        "example.com", and one or more port numbers specified as a string, such as
+        "443".
+
+        Hostname and port number examples:
+        "*.example.com", "443"
+        "example.com" and "22"
+        "example.com" and "22,33"
+      spec:
+      - api_field: hostname
+        help_text: |-
+          Hostname of the application.
+      - api_field: ports
+        help_text: |-
+          The ports of the application.
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the application resource.
+        Cannot exceed 64 characters.
+    - arg_name: upstreams
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.upstreams
+      required: false
+      repeated: true
+      help_text: |-
+        Which upstream resources to forward traffic to.
+      spec:
+      - api_field: network
+        one_of_index: 0
+        help_text: |-
+          Network to forward traffic to.
+        spec:
+        - api_field: name
+          help_text: |-
+            Network name is of the format:
+            `projects/{project}/global/networks/{network}
+      - api_field: external
+        one_of_index: 0
+        help_text: |-
+          List of the external endpoints to forward traffic to.
+        spec:
+        - api_field: endpoints
+          help_text: |-
+            List of the endpoints to forward traffic to.
+          spec:
+          - api_field: hostname
+            help_text: |-
+              Hostname of the endpoint.
+          - api_field: port
+            help_text: |-
+              Port of the endpoint.
+      - api_field: proxyProtocol
+        help_text: |-
+          Enables proxy protocol configuration for the upstream.
+        spec:
+        - api_field: allowedClientHeaders
+          help_text: |-
+            List of the allowed client header names.
+        - api_field: contextualHeaders
+          help_text: |-
+            Configuration for the contextual headers.
+          spec:
+          - api_field: userInfo
+            help_text: |-
+              User details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The delegated user's information.
+          - api_field: groupInfo
+            help_text: |-
+              Group details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type of the delegated group information.
+          - api_field: deviceInfo
+            help_text: |-
+              The device information configuration.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type details for the delegated device.
+          - api_field: outputType
+            help_text: |-
+              Default output type for all enabled headers.
+        - api_field: metadataHeaders
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - api_field: gatewayIdentity
+          help_text: |-
+            The security gateway identity configuration.
+        - api_field: clientIp
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+      - api_field: egressPolicy
+        help_text: |-
+          Routing policy information.
+        spec:
+        - api_field: regions
+          help_text: |-
+            List of the regions where the application sends traffic.
+    - arg_name: schema
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.schema
+      required: false
+      help_text: |-
+        Type of the external application.
+      choices:
+      - arg_value: proxy-gateway
+        enum_value: PROXY_GATEWAY
+        help_text: |-
+          Proxy which routes traffic to actual applications, like Netscaler
+          Gateway.
+      - arg_value: api-gateway
+        enum_value: API_GATEWAY
+        help_text: |-
+          Service Discovery API endpoint when Service Discovery is enabled in
+          Gateway.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        request if it has already been completed. The server will guarantee
+        that for at least 60 minutes since the first request.
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_delete_beta.yaml

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Delete applications
+    description: Delete an application
+    examples: |-
+      To delete the application, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+    - arg_name: validate-only
+      api_field: validateOnly
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If set, validates request by executing a dry-run which would not
+        alter the resource in any way.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_delete_ga.yaml

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Delete applications
+    description: Delete an application
+    examples: |-
+      To delete the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+    - arg_name: validate-only
+      api_field: validateOnly
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If set, validates request by executing a dry-run which would not
+        alter the resource in any way.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_describe_beta.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Describe applications
+    description: Describe an application
+    examples: |-
+      To describe the application, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the Application using the form:
+        `projects/{project_id}/locations/global/securityGateway/{security_gateway_id}/applications/{application_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_describe_ga.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Describe applications
+    description: Describe an application
+    examples: |-
+      To describe the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the Application using the form:
+        `projects/{project_id}/locations/global/securityGateway/{security_gateway_id}/applications/{application_id}`
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_get_iam_policy_beta.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Get the IAM policy for a security gateway application.
+    description: Gets the IAM policy for the given security gateway application.
+    examples: |
+      To get the IAM policy for a security gateway application ``my-security-gateway-application'' run:
+
+      $ {command} my-security-gateway-application --project=consumer-project-id --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways.applications
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The security gateway application for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      is_positional: true
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_get_iam_policy_ga.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Get the IAM policy for a security gateway application.
+    description: Gets the IAM policy for the given security gateway application.
+    examples: |
+      To get the IAM policy for a security gateway application ``my-security-gateway-application'' run:
+
+      $ {command} my-security-gateway-application --project=consumer-project-id --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways.applications
+    BETA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The security gateway application for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      is_positional: true
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_list_beta.yaml

@@ -0,0 +1,42 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: List applications
+    description: List applications
+    examples: |-
+      To list all applications, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The parent location to which the resources belong.
+        `projects/{project_id}/locations/global/securityGateways/{security_gateway_id}`
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_list_ga.yaml

@@ -0,0 +1,42 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: List applications
+    description: List applications
+    examples: |-
+      To list all applications, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The parent location to which the resources belong.
+        `projects/{project_id}/locations/global/securityGateways/{security_gateway_id}`
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_set_iam_policy_beta.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [BETA]
+  help_text:
+    brief: Set the IAM policy for a security gateway application.
+    description: Sets the IAM policy for the given security gateway application.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the security gateway application with ID ``my-security-gateway-application'':
+
+        $ {command} my-security-gateway-application policy.json --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways.applications
+    BETA:
+      api_version: v1
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: BeyondcorpProjectsLocationsSecurityGatewaysApplicationsSetIamPolicyRequest
+  arguments:
+    resource:
+      help_text: The security gateway application for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_set_iam_policy_ga.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [GA]
+  help_text:
+    brief: Set the IAM policy for a security gateway application.
+    description: Sets the IAM policy for the given security gateway application.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the security gateway application with ID ``my-security-gateway-application'':
+
+        $ {command} my-security-gateway-application policy.json --location=global
+
+  request:
+    collection: beyondcorp.projects.locations.securityGateways.applications
+    BETA:
+      api_version: v1
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: BeyondcorpProjectsLocationsSecurityGatewaysApplicationsSetIamPolicyRequest
+  arguments:
+    resource:
+      help_text: The security gateway application for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_update_beta.yaml

@@ -0,0 +1,201 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Update applications
+    description: Update an application
+    examples: |-
+      To update the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: endpoint-matchers
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.endpointMatchers
+      required: false
+      repeated: true
+      help_text: |-
+        An array of conditions to match the application's network endpoint.
+        Each element in the array is an EndpointMatcher object, which defines a
+        specific combination of a hostname pattern and one or more ports. The
+        application is considered matched if at least one of the EndpointMatcher
+        conditions in this array is met (the conditions are combined using OR
+        logic). Each EndpointMatcher must contain a hostname pattern, such as
+        "example.com", and one or more port numbers specified as a string, such as
+        "443".
+
+        Hostname and port number examples:
+        "*.example.com", "443"
+        "example.com" and "22"
+        "example.com" and "22,33"
+      clearable: true
+      spec:
+      - api_field: hostname
+        help_text: |-
+          Hostname of the application.
+      - api_field: ports
+        help_text: |-
+          The ports of the application.
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the application resource.
+        Cannot exceed 64 characters.
+    - arg_name: upstreams
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.upstreams
+      required: false
+      repeated: true
+      help_text: |-
+        Which upstream resources to forward traffic to.
+      clearable: true
+      spec:
+      - api_field: network
+        one_of_index: 0
+        help_text: |-
+          Network to forward traffic to.
+        spec:
+        - api_field: name
+          help_text: |-
+            Network name is of the format:
+            `projects/{project}/global/networks/{network}
+      - api_field: external
+        one_of_index: 0
+        help_text: |-
+          List of the external endpoints to forward traffic to.
+        spec:
+        - api_field: endpoints
+          help_text: |-
+            List of the endpoints to forward traffic to.
+          spec:
+          - api_field: hostname
+            help_text: |-
+              Hostname of the endpoint.
+          - api_field: port
+            help_text: |-
+              Port of the endpoint.
+      - api_field: proxyProtocol
+        help_text: |-
+          Enables proxy protocol configuration for the upstream.
+        spec:
+        - api_field: allowedClientHeaders
+          help_text: |-
+            List of the allowed client header names.
+        - api_field: contextualHeaders
+          help_text: |-
+            Configuration for the contextual headers.
+          spec:
+          - api_field: userInfo
+            help_text: |-
+              User details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The delegated user's information.
+          - api_field: groupInfo
+            help_text: |-
+              Group details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type of the delegated group information.
+          - api_field: deviceInfo
+            help_text: |-
+              The device information configuration.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type details for the delegated device.
+          - api_field: outputType
+            help_text: |-
+              Default output type for all enabled headers.
+        - api_field: metadataHeaders
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - api_field: gatewayIdentity
+          help_text: |-
+            The security gateway identity configuration.
+        - api_field: clientIp
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+      - api_field: egressPolicy
+        help_text: |-
+          Routing policy information.
+        spec:
+        - api_field: regions
+          help_text: |-
+            List of the regions where the application sends traffic.
+    - arg_name: schema
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.schema
+      required: false
+      help_text: |-
+        Type of the external application.
+      choices:
+      - arg_value: proxy-gateway
+        enum_value: PROXY_GATEWAY
+        help_text: |-
+          Proxy which routes traffic to actual applications, like Netscaler
+          Gateway.
+      - arg_value: api-gateway
+        enum_value: API_GATEWAY
+        help_text: |-
+          Service Discovery API endpoint when Service Discovery is enabled in
+          Gateway.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request timed out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/_partials/_update_ga.yaml

@@ -0,0 +1,201 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Update applications
+    description: Update an application
+    examples: |-
+      To update the application, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. Name of the resource.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.beyondcorp.v1_resources:projects_locations_security_gateways_applications
+      required: true
+    - arg_name: endpoint-matchers
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.endpointMatchers
+      required: false
+      repeated: true
+      help_text: |-
+        An array of conditions to match the application's network endpoint.
+        Each element in the array is an EndpointMatcher object, which defines a
+        specific combination of a hostname pattern and one or more ports. The
+        application is considered matched if at least one of the EndpointMatcher
+        conditions in this array is met (the conditions are combined using OR
+        logic). Each EndpointMatcher must contain a hostname pattern, such as
+        "example.com", and one or more port numbers specified as a string, such as
+        "443".
+
+        Hostname and port number examples:
+        "*.example.com", "443"
+        "example.com" and "22"
+        "example.com" and "22,33"
+      clearable: true
+      spec:
+      - api_field: hostname
+        help_text: |-
+          Hostname of the application.
+      - api_field: ports
+        help_text: |-
+          The ports of the application.
+    - arg_name: display-name
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.displayName
+      required: false
+      repeated: false
+      help_text: |-
+        An arbitrary user-provided name for the application resource.
+        Cannot exceed 64 characters.
+    - arg_name: upstreams
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.upstreams
+      required: false
+      repeated: true
+      help_text: |-
+        Which upstream resources to forward traffic to.
+      clearable: true
+      spec:
+      - api_field: network
+        one_of_index: 0
+        help_text: |-
+          Network to forward traffic to.
+        spec:
+        - api_field: name
+          help_text: |-
+            Network name is of the format:
+            `projects/{project}/global/networks/{network}
+      - api_field: external
+        one_of_index: 0
+        help_text: |-
+          List of the external endpoints to forward traffic to.
+        spec:
+        - api_field: endpoints
+          help_text: |-
+            List of the endpoints to forward traffic to.
+          spec:
+          - api_field: hostname
+            help_text: |-
+              Hostname of the endpoint.
+          - api_field: port
+            help_text: |-
+              Port of the endpoint.
+      - api_field: proxyProtocol
+        help_text: |-
+          Enables proxy protocol configuration for the upstream.
+        spec:
+        - api_field: allowedClientHeaders
+          help_text: |-
+            List of the allowed client header names.
+        - api_field: contextualHeaders
+          help_text: |-
+            Configuration for the contextual headers.
+          spec:
+          - api_field: userInfo
+            help_text: |-
+              User details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The delegated user's information.
+          - api_field: groupInfo
+            help_text: |-
+              Group details.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type of the delegated group information.
+          - api_field: deviceInfo
+            help_text: |-
+              The device information configuration.
+            spec:
+            - api_field: outputType
+              help_text: |-
+                The output type details for the delegated device.
+          - api_field: outputType
+            help_text: |-
+              Default output type for all enabled headers.
+        - api_field: metadataHeaders
+          help_text: |-
+            Custom resource specific headers along with the values.
+            The names should conform to RFC 9110:
+            >Field names can contain alphanumeric characters, hyphens, and periods, can
+            contain only ASCII-printable characters and tabs, and must start with a
+            letter.
+          spec:
+          - api_field: key
+          - api_field: value
+        - api_field: gatewayIdentity
+          help_text: |-
+            The security gateway identity configuration.
+        - api_field: clientIp
+          help_text: |-
+            Client IP configuration. The client IP address is included if true.
+      - api_field: egressPolicy
+        help_text: |-
+          Routing policy information.
+        spec:
+        - api_field: regions
+          help_text: |-
+            List of the regions where the application sends traffic.
+    - arg_name: schema
+      api_field: googleCloudBeyondcorpSecuritygatewaysV1Application.schema
+      required: false
+      help_text: |-
+        Type of the external application.
+      choices:
+      - arg_value: proxy-gateway
+        enum_value: PROXY_GATEWAY
+        help_text: |-
+          Proxy which routes traffic to actual applications, like Netscaler
+          Gateway.
+      - arg_value: api-gateway
+        enum_value: API_GATEWAY
+        help_text: |-
+          Service Discovery API endpoint when Service Discovery is enabled in
+          Gateway.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        An optional request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server will know to ignore
+        the request if it has already been completed. The server will guarantee
+        that for at least 60 minutes after the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request timed out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, will ignore the second request. This prevents
+        clients from accidentally creating duplicate commitments.
+
+        The request ID must be a valid UUID with the exception that zero UUID is
+        not supported (00000000-0000-0000-0000-000000000000).
+  request:
+    api_version: v1
+    collection:
+    - beyondcorp.projects.locations.securityGateways.applications
+  async:
+    collection:
+    - beyondcorp.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/create.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/delete.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/get_iam_policy.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/set_iam_policy.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/applications/update.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/create.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/delete.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/get_iam_policy.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/set_iam_policy.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/beyondcorp/security_gateways/update.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true