feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/__init__.py

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Network Connectivity resources."""
+
+from googlecloudsdk.calliope import base
+from surface.network_connectivity import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class NetworkConnectivityAlpha(extensions.NetworkConnectivityAlpha, base.Group):
+  """Manage Network Connectivity Center resources."""
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class NetworkConnectivityBeta(extensions.NetworkConnectivityBeta):
+  """Manage Network Connectivity resources."""
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class NetworkConnectivityGa(extensions.NetworkConnectivityGa):
+  """Manage Network Connectivity resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/_init_extensions.py

@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+class NetworkConnectivityAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+  category = base.NETWORKING_CATEGORY
+
+  def Filter(self, context, args):
+    # TODO: b/190537535 - Determine if command group works with project number.
+    base.RequireProjectID(args)
+    del context, args
+
+
+class NetworkConnectivityBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+  category = base.NETWORKING_CATEGORY
+
+  def Filter(self, context, args):
+    # TODO: b/190537535 - Determine if command group works with project number.
+    base.RequireProjectID(args)
+    del context, args
+
+
+class NetworkConnectivityGa(base.Group):
+  """Optional no-auto-generated code for GA."""
+  category = base.NETWORKING_CATEGORY
+
+  def Filter(self, context, args):
+    # TODO: b/190537535 - Determine if command group works with project number.
+    base.RequireProjectID(args)
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Center hubs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Hubs(base.Group):
+  """Manage Network Connectivity Center hubs."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/accept_spoke.py

@@ -0,0 +1,90 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for accepting spokes into hubs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class AcceptSpoke(base.Command):
+  """Accept a spoke into a hub.
+
+  Accept a proposed or previously rejected VPC spoke. By accepting a spoke,
+  you permit connectivity between the associated VPC network
+  and other VPC networks that are attached to the same hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddHubResourceArg(parser, 'to accept the spoke into')
+    flags.AddSpokeFlag(parser, 'URI of the spoke to accept')
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.HubsClient(
+        release_track=self.ReleaseTrack())
+    hub_ref = args.CONCEPTS.hub.Parse()
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      op_ref = client.AcceptSpokeBeta(hub_ref, args.spoke)
+    else:
+      op_ref = client.AcceptSpoke(hub_ref, args.spoke)
+
+    log.status.Print('Accept spoke request issued for: [{}]'.format(
+        hub_ref.Name()))
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPollerNoResources(client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    return res
+
+
+AcceptSpoke.detailed_help = {
+    'EXAMPLES': f""" \
+  To accept a spoke named ``my-spoke'' into a hub named ``my-hub'', run:
+
+      $ {{command}} my-hub --spoke="https://networkconnectivity.{properties.VALUES.core.universe_domain.Get()}/v1/projects/spoke-project/locations/global/spokes/my-spoke"
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/accept_spoke_update.py

@@ -0,0 +1,97 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for accepting spoke updates."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class AcceptSpokeUpdate(base.Command):
+  """Accept a proposal to update a spoke in a hub.
+
+  Accept a proposed or previously rejected VPC spoke update. By accepting a
+  spoke update, you permit updating connectivity between the associated VPC
+  network and other VPC networks that are attached to the same hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddHubResourceArg(parser, 'to accept the spoke update')
+    flags.AddSpokeFlag(parser, 'URI of the spoke to accept update')
+    flags.AddSpokeEtagFlag(parser, 'Etag of the spoke to accept update')
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.HubsClient(
+        release_track=self.ReleaseTrack()
+    )
+    hub_ref = args.CONCEPTS.hub.Parse()
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      op_ref = client.AcceptSpokeUpdateBeta(
+          hub_ref, args.spoke, args.spoke_etag
+      )
+    else:
+      op_ref = client.AcceptSpokeUpdate(hub_ref, args.spoke, args.spoke_etag)
+
+    log.status.Print(
+        'Accept spoke update request issued for: [{}]'.format(hub_ref.Name())
+    )
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPollerNoResources(client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    return res
+
+
+AcceptSpokeUpdate.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To accept updating a spoke named ``my-spoke'' with ``etag'' in a hub named ``my-hub'', run:
+
+    $ {command} my-hub --spoke="projects/spoke-project/locations/global/hubs/my-spoke" --spoke-etag=etag
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/add_iam_policy_binding.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Add an IAM policy binding to the IAM policy of a hub resource.
+    description: |
+      Add an IAM policy binding to the IAM policy of a hub resource. One binding consists of
+      a member, a role, and an optional condition.
+    examples: |
+      To grant a user the ``roles/networkconnectivity.groupUser'' role on the hub called ``my-hub'', run the following command:
+
+      $ {command} my-hub --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The hub that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Add an IAM policy binding to the IAM policy of a hub resource.
+    description: |
+      Add an IAM policy binding to the IAM policy of a hub resource. One binding consists of
+      a member, a role, and an optional condition.
+    examples: |
+      To grant a user the ``roles/networkconnectivity.groupUser'' role on the hub called ``my-hub'', run the following command:
+
+      $ {command} my-hub --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The hub that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/create.yaml

@@ -0,0 +1,117 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Create a new hub.
+    description: Create a new hub with the given name.
+    examples: |
+      To create a hub with the name ``my-hub'' and the description ``optional description'', run:
+
+        $ {command} my-hub --description="optional description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+      help_text: Name of the hub to be created.
+    params:
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaHub.description
+      help_text: Description of the hub.
+    - arg_name: policy-mode
+      api_field: googleCloudNetworkconnectivityV1betaHub.policyMode
+      help_text: Policy mode of the hub.
+    - arg_name: preset-topology
+      api_field: googleCloudNetworkconnectivityV1betaHub.presetTopology
+      help_text: Topology of the hub. Only applicable when ``--policy-mode=PRESET''.
+    - group:
+        mutex: true
+        required: false
+        params:
+        - arg_name: export-psc
+          api_field: googleCloudNetworkconnectivityV1betaHub.exportPsc
+          default: null
+          help_text: |-
+            This boolean controls whether Private Service Connect transitivity is enabled for the hub.
+        - group:
+            hidden: true
+            required: false
+            params:
+            - arg_name: export-psc-published-services-and-regional-google-apis
+              api_field: googleCloudNetworkconnectivityV1betaHub.exportPscConfig.publishedServicesAndRegionalGoogleApis
+              hidden: true
+              default: null
+              help_text: |-
+                This boolean control whether Private Service Connect endpoints for regional ILBs and regional Google APIs should be propagated.
+            - arg_name: export-psc-global-google-apis
+              api_field: googleCloudNetworkconnectivityV1betaHub.exportPscConfig.globalGoogleApis
+              hidden: true
+              default: null
+              help_text: |-
+                This boolean controls whether Private Service Connect endpoints for global Google APIs should be propagated.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaHub.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.global.hubs
+    method: create
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent
+    - googlecloudsdk.command_lib.network_connectivity.util:SetExportPscBeta
+
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: Create a new hub.
+    description: Create a new hub with the given name.
+    examples: |
+      To create a hub with the name ``my-hub'' and the description ``optional description'', run:
+
+        $ {command} my-hub --description="optional description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+      help_text: Name of the hub to be created.
+    params:
+    - arg_name: description
+      api_field: hub.description
+      help_text: Description of the hub.
+    - arg_name: policy-mode
+      release_tracks: [GA]
+      api_field: hub.policyMode
+      help_text: Policy mode of the hub.
+    - arg_name: preset-topology
+      release_tracks: [GA]
+      api_field: hub.presetTopology
+      help_text: Topology of the hub. Only applicable when ``--policy-mode=PRESET''.
+    - group:
+        release_tracks: [GA]
+        mutex: true
+        required: false
+        params:
+        - arg_name: export-psc
+          release_tracks: [GA]
+          api_field: hub.exportPsc
+          help_text: |-
+            This boolean controls whether Private Service Connect transitivity is enabled for the hub.
+    labels:
+      api_field: hub.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    ALPHA:
+      api_version: v1alpha1
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs
+    method: create
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent
+    # TODO: b/420998347 - Remove this hook once v1 supports HYBRID_INSPECTION.
+    - googlecloudsdk.command_lib.network_connectivity.util:ProhibitHybridInspection

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/delete.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Delete a hub.
+    description: Delete the specified hub.
+
+    examples: |
+      To delete a hub named ``my-hub'', run:
+
+        $ {command} my-hub
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+      help_text: Name of the hub to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/describe.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe a hub.
+    description: Retrieve and display details about a hub.
+
+    examples: |
+      To display details about a hub named ``my-hub'', run:
+
+        $ {command} my-hub
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+      help_text: Name of the hub to be described.
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/get_iam_policy.yaml

@@ -0,0 +1,48 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Get the IAM policy for a hub resource.
+    description: |
+      Get the IAM policy of a hub. If formatted as JSON, the output
+      can be edited and used as a policy file for *set-iam-policy*.
+    examples: |
+      To get the IAM policy for a hub named ``my-hub'', run:
+
+      $ {command} my-hub
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The hub for which you want the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsSetIamPolicyRequest
+
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Get the IAM policy for a hub resource.
+    description: |
+      Get the IAM policy of a hub. If formatted as JSON, the output
+      can be edited and used as a policy file for *set-iam-policy*.
+    examples: |
+      To get the IAM policy for a hub named ``my-hub'', run:
+
+      $ {command} my-hub
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The hub for which you want the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for groups."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Groups(base.Group):
+  """Manage Network Connectivity Center groups."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/add_iam_policy_binding.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Add an IAM policy binding to the IAM policy of a group resource.
+    description: |
+      Add an IAM policy binding to the IAM policy of a group resource. One binding consists of
+      a member, a role, and an optional condition.
+    examples: |
+      To grant a user the ``roles/networkconnectivity.groupUser'' role on the group called ``my-group'' in the hub called ``my-hub''', run the following command:
+
+        $ {command} my-group --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser" --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The group that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsGroupsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Add an IAM policy binding to the IAM policy of a group resource.
+    description: |
+      Add an IAM policy binding to the IAM policy of a group resource. One binding consists of
+      a member, a role, and an optional condition.
+    examples: |
+      To grant a user the ``roles/networkconnectivity.groupUser'' role on the group called ``my-group'' in the hub called ``my-hub''', run the following command:
+
+        $ {command} my-group --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser" --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The group that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Describe a group.
+    description: |
+      Retrieve and display details about a group.
+    examples: |
+      To display details about a group named ``my-group'', run:
+
+        $ {command} my-group
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group
+      help_text: |
+        Name of the group to describe.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.groups

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/get_iam_policy.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a group resource.
+    description: |
+      Get the IAM policy of a group. If formatted as JSON, the output
+      can be edited and used as a policy file for *set-iam-policy*.
+    examples: |
+      To get the IAM policy for a group named ``my-group'' in the hub named ``my-hub'', run:
+
+        $ {command} my-group --hub="my-hub"
+
+  request: &request
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The group for which you want the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/list.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: List groups.
+    description: Retrieve and display a list of all groups in the specified hub.
+
+    examples: |
+      To list all groups across all hubs, run:
+
+        $ {command} --hub=-
+
+      To list all groups in hub `my-hub`, run:
+
+        $ {command} --hub=my-hub
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hubDefaultAll
+      help_text: Parent hub of the groups to display.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+
+  output:
+    # Columns: NAME, HUB, DESCRIPTION
+    format: table(name.basename():sort=2, name.segment(5):label=HUB:sort=1, description)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/remove_iam_policy_binding.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Remove an IAM policy binding from the IAM policy of a group resource.
+    description: |
+      Remove an IAM policy binding from the IAM policy of a group resource.
+    examples: |
+      To remove the ``roles/networkconnectivity.groupUser'' role from a user of the group ``my-group'' in the hub ``my-hub'',
+      run:
+
+        $ {command} my-group --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser" --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The group that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsGroupsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Remove an IAM policy binding from the IAM policy of a group resource.
+    description: |
+      Remove an IAM policy binding from the IAM policy of a group resource.
+    examples: |
+      To remove the ``roles/networkconnectivity.groupUser'' role from a user of the group ``my-group'' in the hub ``my-hub'',
+      run:
+
+        $ {command} my-group --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser" --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The group that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/set_iam_policy.yaml

@@ -0,0 +1,49 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Set the IAM policy of a group resource.
+    description: |
+      Replace the existing IAM policy of a group resource with a policy
+      encoded in a JSON or YAML file.
+    examples: |
+      To replace the IAM policy of a group resource with the policy defined in a
+      file called ``policy.json'', run:
+
+        $ {command} my-group policy.json --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The hub for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsGroupsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Set the IAM policy of a group resource.
+    description: |
+      Replace the existing IAM policy of a group resource with a policy
+      encoded in a JSON or YAML file.
+    examples: |
+      To replace the IAM policy of a group resource with the policy defined in a
+      file called ``policy.json'', run:
+
+        $ {command} my-group policy.json --hub="my-hub"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs.groups
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The hub for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:group

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/groups/update.py

@@ -0,0 +1,192 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for updating groups."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.command_lib.util.args import repeated
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Update(base.Command):
+  """Update a group.
+
+  Update the details of a group.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddGroupResourceArg(parser, 'to update')
+    flags.AddDescriptionFlag(parser, 'New description of the group.')
+    flags.AddAsyncFlag(parser)
+    labels_util.AddUpdateLabelsFlags(parser)
+    repeated.AddPrimitiveArgs(
+        parser,
+        'group',
+        'auto-accept-projects',
+        'auto-accept projects',
+        additional_help="""This controls the list of project ids or
+        project numbers for which auto-accept is enabled for the group.""",
+        include_set=False,
+    )
+
+  def UpdateGroupBeta(self, client, group_ref, args):
+    update_mask = []
+    description = args.description
+    if description is not None:
+      update_mask.append('description')
+
+    labels = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+    original_group = client.Get(group_ref)
+    if labels_diff.MayHaveUpdates():
+      labels_update = labels_diff.Apply(
+          client.messages.GoogleCloudNetworkconnectivityV1betaGroup.LabelsValue,
+          original_group.labels,
+      )
+      if labels_update.needs_update:
+        labels = labels_update.labels
+        update_mask.append('labels')
+
+    # TODO: b/349140768 - Add e2e test for this command.
+    def _get_current_auto_accept_projects():
+      if original_group.autoAccept is None:
+        return []
+      return original_group.autoAccept.autoAcceptProjects
+
+    auto_accept_projects = repeated.ParsePrimitiveArgs(
+        args, 'auto_accept_projects', _get_current_auto_accept_projects
+    )
+    auto_accept = None
+    if auto_accept_projects is not None:
+      auto_accept = (
+          client.messages.GoogleCloudNetworkconnectivityV1betaAutoAccept(
+              autoAcceptProjects=auto_accept_projects
+          )
+      )
+      update_mask.append('auto_accept.auto_accept_projects')
+
+    # Construct a group message with only the updated fields
+    group = client.messages.GoogleCloudNetworkconnectivityV1betaGroup(
+        description=description, labels=labels, autoAccept=auto_accept
+    )
+
+    return client.UpdateGroupBeta(group_ref, group, update_mask)
+
+  def UpdateGroupGA(self, client, group_ref, args):
+    update_mask = []
+    description = args.description
+    if description is not None:
+      update_mask.append('description')
+
+    labels = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+    original_group = client.Get(group_ref)
+    if labels_diff.MayHaveUpdates():
+      labels_update = labels_diff.Apply(
+          client.messages.Group.LabelsValue, original_group.labels
+      )
+      if labels_update.needs_update:
+        labels = labels_update.labels
+        update_mask.append('labels')
+
+    # TODO(b/349140768): Add e2e test for this command.
+    def _get_current_auto_accept_projects():
+      if original_group.autoAccept is None:
+        return []
+      return original_group.autoAccept.autoAcceptProjects
+
+    auto_accept_projects = repeated.ParsePrimitiveArgs(
+        args, 'auto_accept_projects', _get_current_auto_accept_projects
+    )
+    auto_accept = None
+    if auto_accept_projects is not None:
+      auto_accept = client.messages.AutoAccept(
+          autoAcceptProjects=auto_accept_projects
+      )
+      update_mask.append('auto_accept.auto_accept_projects')
+
+    # Construct a group message with only the updated fields
+    group = client.messages.Group(
+        description=description, labels=labels, autoAccept=auto_accept
+    )
+
+    return client.UpdateGroup(group_ref, group, update_mask)
+
+  def Run(self, args):
+    client = networkconnectivity_api.GroupsClient(
+        release_track=self.ReleaseTrack()
+    )
+    group_ref = args.CONCEPTS.group.Parse()
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      op_ref = self.UpdateGroupBeta(client, group_ref, args)
+    else:
+      op_ref = self.UpdateGroupGA(client, group_ref, args)
+
+    log.status.Print('Update request issued for: [{}]'.format(group_ref.Name()))
+
+    if op_ref.done:
+      log.UpdatedResource(group_ref.Name(), kind='group')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.group_service, client.operation_service
+    )
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+    log.UpdatedResource(group_ref.Name(), kind='group')
+    return res
+
+
+Update.detailed_help = {
+    'EXAMPLES': """\
+  To update the description of a group named ``my-group'', in the hub ``my-hub'', run:
+
+    $ {command} my-group --hub=my-hub --description="new group description"
+
+  To add the project ``my-project'' to the auto-accept list of a group named ``my-group'' in the hub ``my-hub'', run:
+
+    $ {command} my-group --hub=my-hub --add-auto-accept-projects=my-project
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/list.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List hubs.
+    description: Retrieve and display a list of all hubs in the specified project.
+
+    examples: |
+      To list all hubs, run:
+
+        $ {command}
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:project
+      help_text: Project of the hubs to display.
+
+  output:
+    format: table(name.basename(), description)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/list_spokes.py

@@ -0,0 +1,83 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for listing spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.network_connectivity import util
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class ListSpokes(base.ListCommand):
+  """List hub spokes.
+
+  Retrieve and display a list of all spokes associated with a hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    # Remove URI flag to match surface spec
+    base.URI_FLAG.RemoveFromParser(parser)
+
+    # Add flags to identify region
+    flags.AddSpokeLocationsFlag(parser)
+    flags.AddViewFlag(parser)
+    flags.AddHubResourceArg(parser, """associated with the returned list of
+                            spokes""")
+
+    # Table formatting
+    parser.display_info.AddFormat(util.LIST_SPOKES_FORMAT)
+
+  def Run(self, args):
+    release_track = self.ReleaseTrack()
+    view = ViewToEnum(args.view, release_track)
+    client = networkconnectivity_api.HubsClient(release_track)
+    hub_ref = args.CONCEPTS.hub.Parse()
+    return client.ListHubSpokes(
+        hub_ref,
+        spoke_locations=args.spoke_locations,
+        limit=args.limit,
+        order_by=None,  # Do all sorting client-side
+        filter_expression=None,  # Do all filtering client-side
+        view=view)
+
+
+def ViewToEnum(view, release_track):
+  """Converts the typed view into its Enum value."""
+  list_hub_spokes_req = networkconnectivity_util.GetMessagesModule(release_track).NetworkconnectivityProjectsLocationsGlobalHubsListSpokesRequest  # pylint: disable=line-too-long
+  if view == 'detailed':
+    return list_hub_spokes_req.ViewValueValuesEnum.DETAILED
+  return list_hub_spokes_req.ViewValueValuesEnum.BASIC
+
+ListSpokes.detailed_help = {
+    'EXAMPLES': """ \
+  To list all spokes in the ``us-central1'' region and the global location, run:
+
+        $ {command} HUB --spoke-locations=us-central1,global
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/query_status.py

@@ -0,0 +1,151 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for listing spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.command_lib.network_connectivity import filter_rewrite
+from googlecloudsdk.command_lib.network_connectivity import flags
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class QueryStatus(base.ListCommand):
+  """Query the status of Private Service Connect propagation for a hub."""
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    # Remove URI flag to match surface spec
+    base.URI_FLAG.RemoveFromParser(parser)
+    flags.AddHubResourceArg(
+        parser, """to query Private Service Connect propagation for"""
+    )
+    # TODO(b/347697136): remove list of values and instead link to documentation
+    parser.add_argument(
+        '--group-by',
+        help="""
+        Comma-separated list of resource field key names to group by. Aggregated
+        values will be displayed for each group. If `--group-by` is set, the value
+        of the `--sort-by` flag must be the same as or a subset of the `--group-by`
+        flag.
+
+        Accepted values are:
+        - 'psc_propagation_status.source_spoke'
+        - 'psc_propagation_status.source_group'
+        - 'psc_propagation_status.source_forwarding_rule'
+        - 'psc_propagation_status.target_spoke'
+        - 'psc_propagation_status.target_group'
+        - 'psc_propagation_status.code'
+        """,
+    )
+    parser.display_info.AddFormat("""
+      table(
+        pscPropagationStatus.sourceForwardingRule.basename(),
+        pscPropagationStatus.sourceSpoke.basename(),
+        pscPropagationStatus.sourceGroup.basename(),
+        pscPropagationStatus.targetSpoke.basename(),
+        pscPropagationStatus.targetGroup.basename(),
+        pscPropagationStatus.code:label=CODE,
+        count)
+        """)
+
+  def Run(self, args):
+    valid_fields = {
+        'psc_propagation_status.source_spoke',
+        'psc_propagation_status.source_group',
+        'psc_propagation_status.source_forwarding_rule',
+        'psc_propagation_status.target_spoke',
+        'psc_propagation_status.target_group',
+        'psc_propagation_status.code',
+    }
+    release_track = self.ReleaseTrack()
+    client = networkconnectivity_api.HubsClient(release_track)
+    hub_ref = args.CONCEPTS.hub.Parse()
+    group_by_fields: list[str] = []
+    if args.group_by:
+      group_by_fields: list[str] = args.group_by.replace(' ', '').split(',')
+      if not all((x in valid_fields) for x in group_by_fields):
+        raise ValueError(
+            'Invalid group-by fields: {} valid fields are:\n{}'.format(
+                ', '.join(sorted((set(group_by_fields) - valid_fields))),
+                '\n'.join(sorted(valid_fields)),
+            )
+        )
+
+    filter_expression = ''
+    # this extracts the filter expression from the args.filter string
+    # then sets it to an empty string to bypass client-side filtering
+    if args.filter:
+      _, filter_expression = filter_rewrite.BackendFilterRewrite().Rewrite(
+          args.filter
+      )
+    args.filter = ''
+
+    sort_by_fields = []
+    if args.sort_by:
+      sort_by_fields: list[str] = args.sort_by
+      if not all((x in valid_fields) for x in sort_by_fields):
+        raise ValueError(
+            'Invalid sort-by fields: {}, valid fields are:\n{}'.format(
+                ', '.join(sorted((set(sort_by_fields) - valid_fields))),
+                '\n'.join(sorted(valid_fields)),
+            )
+        )
+
+    limit = 5000
+    if args.limit:
+      limit = args.limit
+
+    page_size = 100
+    if args.page_size:
+      page_size = args.page_size
+
+    return client.QueryHubStatus(
+        hub_ref,
+        filter_expression=filter_expression,
+        group_by=','.join(group_by_fields),
+        order_by=','.join(sort_by_fields),
+        page_size=page_size,
+        limit=limit,
+    )
+
+
+QueryStatus.detailed_help = {
+    'EXAMPLES': """ \
+  To query the Private Service Connect propagation status of a hub, run:
+
+        $ {command} HUB
+
+  To query the Private Service Connect propagation status of a hub grouped by source spoke and code, run:
+
+        $ {command} HUB --group-by="psc_propagation_status.source_spoke,psc_propagation_status.code"
+
+  To query the Private Service Connect propagation status of a hub sorted by the source forwarding rule, run:
+
+        $ {command} HUB --sort-by="psc_propagation_status.source_forwarding_rule"
+
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/reject_spoke.py

@@ -0,0 +1,93 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for rejecting spokes from hubs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class RejectSpoke(base.Command):
+  """Reject a spoke from a hub.
+
+  Reject a VPC spoke. By rejecting a spoke,
+  you prevent or remove connectivity between the associated VPC network
+  and any other VPC networks that are attached to the same hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddHubResourceArg(parser, 'to reject the spoke from')
+    flags.AddSpokeFlag(parser, 'URI of the spoke to reject')
+    flags.AddRejectionDetailsFlag(parser)
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.HubsClient(
+        release_track=self.ReleaseTrack())
+    hub_ref = args.CONCEPTS.hub.Parse()
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      op_ref = client.RejectSpokeBeta(hub_ref, args.spoke, args.details)
+    else:
+      op_ref = client.RejectSpoke(hub_ref, args.spoke, args.details)
+
+    log.status.Print('Reject spoke request issued for: [{}]'.format(
+        hub_ref.Name()))
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPollerNoResources(client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    return res
+
+
+RejectSpoke.detailed_help = {
+    'EXAMPLES':
+        f""" \
+  To reject a spoke named ``my-spoke'' from a hub named ``my-hub'' with reason ``my-reason'', run:
+
+    $ {{command}} my-hub --spoke="https://networkconnectivity.{properties.VALUES.core.universe_domain.Get()}/v1/projects/spoke-project/locations/global/spokes/my-spoke" --details=my-reason
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/reject_spoke_update.py

@@ -0,0 +1,100 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for rejecting spokes updates."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class RejectSpokeUpdate(base.Command):
+  """Reject a proposal to update a spoke in a hub.
+
+  Reject a VPC spoke update proposal. By rejecting a spoke update,
+  you prevent updating the connectivity between the associated VPC network and
+  any other VPC networks that are attached to the same hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddHubResourceArg(parser, 'to reject the spoke update')
+    flags.AddSpokeFlag(parser, 'URI of the spoke to reject update')
+    flags.AddSpokeEtagFlag(parser, 'Etag of the spoke to reject update')
+    flags.AddRejectionDetailsFlag(parser)
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.HubsClient(
+        release_track=self.ReleaseTrack()
+    )
+    hub_ref = args.CONCEPTS.hub.Parse()
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      op_ref = client.RejectSpokeUpdateBeta(
+          hub_ref, args.spoke, args.spoke_etag, args.details
+      )
+    else:
+      op_ref = client.RejectSpokeUpdate(
+          hub_ref, args.spoke, args.spoke_etag, args.details
+      )
+
+    log.status.Print(
+        'Reject spoke update request issued for: [{}]'.format(hub_ref.Name())
+    )
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPollerNoResources(client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    return res
+
+
+RejectSpokeUpdate.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To reject updating a spoke named ``my-spoke'' with ``etag'' in a hub named ``my-hub'' with reason ``my-reason'', run:
+
+    $ {command} my-hub --spoke="projects/spoke-project/locations/global/hubs/my-spoke" --spoke-etag=etag --details=my-reason
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/remove_iam_policy_binding.yaml

@@ -0,0 +1,47 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Remove an IAM policy binding from the IAM policy of a hub resource.
+    description: |
+      Remove an IAM policy binding from the IAM policy of a hub resource.
+    examples: |
+      To remove the ``roles/networkconnectivity.groupUser'' role from a user of the hub ``my-hub'',
+      run:
+
+      $ {command} my-hub --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The hub that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Remove an IAM policy binding from the IAM policy of a hub resource.
+    description: |
+      Remove an IAM policy binding from the IAM policy of a hub resource.
+    examples: |
+      To remove the ``roles/networkconnectivity.groupUser'' role from a user of the hub ``my-hub'',
+      run:
+
+      $ {command} my-hub --member="user:username@gmail.com" --role="roles/networkconnectivity.groupUser"
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The hub that you want to update.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for route tables."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class RouteTables(base.Group):
+  """Manage Network Connectivity Center route tables."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Describe a route table.
+    description: |
+      Retrieve and display details about a route table.
+    examples: |
+      To display details about a route table named ``my-route-table'', run:
+
+        $ {command} my-route-table
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:routeTable
+      help_text: |
+        Name of the route table to describe.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.routeTables

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/list.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: List route tables.
+    description: Retrieve and display a list of all route tables in the specified hub.
+
+    examples: |
+      To list all route tables across all hubs, run:
+
+        $ {command} --hub=-
+
+      To list all route tables in hub `my-hub`, run:
+
+        $ {command} --hub=my-hub
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hubDefaultAll
+      help_text: Parent hub of the route tables to display.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.routeTables
+
+  output:
+    # Columns: NAME, HUB, DESCRIPTION
+    format: table(name.basename(), name.segment(5):label=HUB, description)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/routes/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for routes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Routes(base.Group):
+  """Manage Network Connectivity Center routes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/routes/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Describe a route.
+    description: |
+      Retrieve and display details about a route.
+    examples: |
+      To display details about a route named ``my-route'', run:
+
+        $ {command} my-route
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:route
+      help_text: |
+        Name of the route to describe.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.routeTables.routes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/route_tables/routes/list.yaml

@@ -0,0 +1,55 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: List routes.
+    description: Retrieve and display a list of all routes in the specified route table.
+
+    examples: |
+      To list all routes across all route tables, run:
+
+        $ {command} --hub=- --route_table=-
+
+      To list all routes in route table `my-route-table`, run:
+
+        $ {command} --hub=my-hub --route_table=my-route-table
+
+      To list all routes in route table `my-route-table`, effective at a location/region run:
+
+        $ {command} --hub=my-hub --route_table=my-route-table --effective-location=location
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:routeTableDefaultAll
+      help_text: Parent route table of the routes to display.
+    params:
+    - arg_name: effective-location
+      help_text: The effective location/region to limit the list of routes. The effective location must be a valid region name. To list valid region names, use 'gcloud compute regions list'.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs.routeTables.routes
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:CheckForRouteTableAndHubWildcardMismatch
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendEffectiveLocationFilter
+
+  output:
+    # Columns: IP_CIDR_RANGE, PRIORITY, LOCATION, STATE, TYPE, NEXT_HOP, HUB, ROUTE_TABLE
+    format: |
+      table(
+        ipCidrRange,
+        priority,
+        location.basename(),
+        state,
+        type,
+        format(
+          "{0}{1}",
+          nextHopVpcNetwork.yesno(yes="N/A", no=""),
+          firstof(nextHopVpnTunnel.siteToSiteDataTransfer, nextHopRouterApplianceInstance.siteToSiteDataTransfer, nextHopInterconnectAttachment.siteToSiteDataTransfer, nextHopSpoke.siteToSiteDataTransfer).yesno(yes="ON", no="")
+        ).yesno(no="OFF"):label=SITE_TO_SITE,
+        firstof(nextHopVpcNetwork.uri, nextHopVpnTunnel.uri, nextHopRouterApplianceInstance.uri, nextHopInterconnectAttachment.uri, nextHopSpoke.uri).basename():label=NEXT_HOP,
+        name.segment(5):label=HUB:sort=1,
+        name.segment(7):label=ROUTE_TABLE:sort=2
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/set_iam_policy.yaml

@@ -0,0 +1,49 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Set the IAM policy of a hub resource.
+    description: |
+      Replace the existing IAM policy of a hub resource with a policy
+      encoded in a JSON or YAML file.
+    examples: |
+      To replace the IAM policy of a hub resource with the policy defined in a
+      file called ``policy.json'', run:
+
+      $ {command} my-hub policy.json
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1beta
+
+  arguments:
+    resource:
+      help_text: The hub for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+
+  iam:
+    set_iam_policy_request_path: googleIamV1SetIamPolicyRequest
+    message_type_overrides:
+      policy: GoogleIamV1Policy
+      set_iam_policy_request: NetworkconnectivityProjectsLocationsGlobalHubsSetIamPolicyRequest
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Set the IAM policy of a hub resource.
+    description: |
+      Replace the existing IAM policy of a hub resource with a policy
+      encoded in a JSON or YAML file.
+    examples: |
+      To replace the IAM policy of a hub resource with the policy defined in a
+      file called ``policy.json'', run:
+
+      $ {command} my-hub policy.json
+
+  request:
+    collection: networkconnectivity.projects.locations.global.hubs
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The hub for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/update.py

@@ -0,0 +1,189 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+"""Command for updating hubs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+def UpdatedPscFields(args, export_psc_config):
+  """UpdatedPscFields returns the updated PSC field values.
+
+  This method uses the existing hub and the flags to determine the new values.
+
+  Args:
+    args: The arguments that the user specified.
+    export_psc_config: The existing hub's exportPscConfig.
+
+  Returns:
+    A tuple of the updated exportPsc field and updated exportPscConfig field.
+  """
+  # If the user did not specify any PSC flags, we can return early.
+  if not (
+      args.IsSpecified('export_psc')
+      or args.IsSpecified(
+          'export_psc_published_services_and_regional_google_apis'
+      )
+      or args.IsSpecified('export_psc_global_google_apis')
+  ):
+    return None, None
+
+  # Handle the case where export_psc_config is None. This will happen if the
+  # user does not have the NCC_PSC_GAPI visiblity label: b/391865147#comment29.
+  # TODO: b/406009715 - Remove this once the API is GA.
+  if export_psc_config is None:
+    return args.export_psc, None
+
+  # Check if this is the legacy case. We can ignore the other flags because the
+  # mutex group ensures that the other flags are not set.
+  if args.export_psc is not None:
+    if args.export_psc:
+      # If true, enable only PSC-ILB propagation.
+      export_psc_config.publishedServicesAndRegionalGoogleApis = True
+      return True, export_psc_config
+
+    # If false, disable PSC-ILB and PSC-GAPI propagation.
+    export_psc_config.publishedServicesAndRegionalGoogleApis = False
+    export_psc_config.globalGoogleApis = False
+    return False, export_psc_config
+
+  # If this is not the legacy case, handle the new PSC flags.
+  # 1. Update the new exportPscConfig values if they are set.
+  if args.export_psc_published_services_and_regional_google_apis is not None:
+    export_psc_config.publishedServicesAndRegionalGoogleApis = (
+        args.export_psc_published_services_and_regional_google_apis
+    )
+  if args.export_psc_global_google_apis is not None:
+    export_psc_config.globalGoogleApis = args.export_psc_global_google_apis
+
+  # 2. If either of the values in the updated exportPscConfig are true, then set
+  # exportPsc to true. Otherwise, set exportPsc to false.
+  updated_export_psc = (
+      export_psc_config.publishedServicesAndRegionalGoogleApis
+      or export_psc_config.globalGoogleApis
+  )
+  return updated_export_psc, export_psc_config
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class Update(base.Command):
+  """Update a hub.
+
+  Update the details of a hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddHubResourceArg(parser, 'to be updated')
+    flags.AddDescriptionFlag(parser, 'New description of the hub.')
+    flags.AddPscGroup(parser)
+    flags.AddAsyncFlag(parser)
+    labels_util.AddUpdateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.HubsClient(
+        release_track=self.ReleaseTrack()
+    )
+    hub_ref = args.CONCEPTS.hub.Parse()
+    update_mask = []
+    description = args.description
+    if description is not None:
+      update_mask.append('description')
+
+    # Fetch the hub so we can update the PSC fields.
+    original_hub = client.Get(hub_ref)
+    updated_export_psc, updated_export_psc_config = UpdatedPscFields(
+        args, original_hub.exportPscConfig
+    )
+    # We use both the export_psc field and the new export_psc_config, so we need
+    # to include both in the mask.
+    if updated_export_psc is not None:
+      update_mask.append('exportPsc')
+      update_mask.append('exportPscConfig')
+
+    # Update the labels (using the original hub as well).
+    labels = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+    if labels_diff.MayHaveUpdates():
+      labels_update = labels_diff.Apply(
+          client.messages.GoogleCloudNetworkconnectivityV1betaHub.LabelsValue,
+          original_hub.labels,
+      )
+      if labels_update.needs_update:
+        labels = labels_update.labels
+        update_mask.append('labels')
+
+    hub = client.messages.GoogleCloudNetworkconnectivityV1betaHub(
+        description=description,
+        exportPsc=updated_export_psc,
+        exportPscConfig=updated_export_psc_config,
+        labels=labels,
+    )
+    op_ref = client.UpdateHubBeta(hub_ref, hub, update_mask)
+
+    log.status.Print('Update request issued for: [{}]'.format(hub_ref.Name()))
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.hub_service, client.operation_service
+    )
+
+    if op_ref.done:
+      log.UpdatedResource(hub_ref.Name(), kind='hub')
+      return poller.GetResult(op_resource)
+
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+        max_wait_ms=3600000,  # 1 hour
+    )
+    log.UpdatedResource(hub_ref.Name(), kind='hub')
+    return res
+
+
+Update.detailed_help = {
+    'EXAMPLES': """ \
+  To update the description of a hub named ``my-hub'', run:
+
+    $ {command} my-hub --description="The new description of my-hub".
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1beta API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/hubs/update.yaml

@@ -0,0 +1,57 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: Update a hub.
+    description: Update the details of a hub.
+
+    examples: |
+      To update the description of a hub named ``my-hub'', run:
+
+        $ {command} my-hub --description="The new description of my-hub".
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:hub
+      help_text: Name of the hub to be updated.
+    params:
+    - arg_name: description
+      api_field: hub.description
+      help_text: New description of the hub.
+    - arg_name: labels
+      release_tracks: [ALPHA]
+      api_field: hub.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - group:
+        release_tracks: [GA]
+        mutex: true
+        required: false
+        params:
+        - arg_name: export-psc
+          release_tracks: [GA]
+          api_field: hub.exportPsc
+          help_text: Whether Private Service Connect transitivity is enabled for the hub.
+    GA:
+      labels:
+        api_field: hub.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    ALPHA:
+      api_version: v1alpha1
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.hubs
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Center internal ranges."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA)
+class InternalRanges(base.Group):
+  """Manage internal ranges."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/create.yaml

@@ -0,0 +1,236 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: |
+      Create a new internal range.
+    description: |
+      Create a new internal range with the given name.
+    examples: |
+      Create an internal range with name ``my-range'' and ip-cidr-range ``192.168.0.0/25'' in
+      network ``https://www.googleapis.com/compute/v1/projects/my-project/locations/global/networks/my-network'':
+
+        $ {command} my-range
+          --ip-cidr-range="192.168.0.0/25"
+          --network="https://www.googleapis.com/compute/v1/projects/my-project/locations/global/networks/my-network"
+          --project=my-project
+
+      Create an internal range with name ``my-range'' and auto-allocated /25 block (prefix-length
+      ``25'') in network ``my-network'':
+
+        $ {command} my-range
+          --prefix-length=25
+          --network="my-network"
+          --project=my-project
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:internalRange
+      help_text: |
+        Name of the internal range to be created.
+    params:
+    - arg_name: description
+      api_field: internalRange.description
+      help_text: |
+        Description of the internal range to be created.
+    - group:
+        mutex: true
+        required: true
+        params:
+        - arg_name: ip-cidr-range
+          api_field: internalRange.ipCidrRange
+          help_text: |
+            IP range that this internal range defines.
+        - group:
+            params:
+            - arg_name: prefix-length
+              api_field: internalRange.prefixLength
+              help_text: |
+                An alternative to ip-cidr-range.
+                Can be set when trying to create a reservation that automatically finds a free range
+                of the given size.
+              required: true
+            - group:
+                help_text: |
+                  Additional options for the internal range's address auto-allocation (allowed only
+                  when prefix-length is set):
+                params:
+                - arg_name: target-cidr-range
+                  api_field: internalRange.targetCidrRange
+                  help_text: |
+                    Can be set to narrow down or pick a different address space while searching for
+                    a free range.
+                    If not set, defaults to the "10.0.0.0/8" address space. This can be used to
+                    search in other rfc-1918 address spaces like "172.16.0.0/12" and
+                    "192.168.0.0/16" or non-rfc-1918 address spaces used in the VPC.
+                  type: arg_list
+                - arg_name: exclude-cidr-ranges
+                  api_field: internalRange.excludeCidrRanges
+                  help_text: |
+                    A list of CIDR ranges to exclude from the search for a free range.
+                    This can be used to exclude specific ranges that are already intended to
+                    have some other use.
+                  type: arg_list
+                - arg_name: allocation-strategy
+                  api_field: internalRange.allocationOptions.allocationStrategy
+                  help_text: |
+                    Allocation strategy to be used when searching for a free range.
+                  choices:
+                  - arg_value: random
+                    enum_value: RANDOM
+                    help_text: |
+                      Random strategy, the legacy algorithm, used for backwards compatibility. This
+                      allocation strategy remains efficient in the case of concurrent allocation
+                      requests in the same peered network space and doesn't require providing the
+                      level of concurrency in an explicit parameter, but it is prone to fragmenting
+                      available address space.
+                  - arg_value: first-available
+                    enum_value: FIRST_AVAILABLE
+                    help_text: |
+                      Pick the first available address range. This strategy is deterministic and the
+                      result is easy to predict.
+                  - arg_value: random-first-n-available
+                    enum_value: RANDOM_FIRST_N_AVAILABLE
+                    help_text: |
+                      Pick an arbitrary range out of the first N available ones. The N will be set
+                      in the first_available_ranges_lookup_size flag. This strategy should be used
+                      when concurrent allocation requests are made in the same space of peered
+                      networks  while the fragmentation of the addrress space is reduced.
+                  - arg_value: first-smallest-fitting
+                    enum_value: FIRST_SMALLEST_FITTING
+                    help_text: |
+                      Pick the smallest but fitting available range. This deterministic strategy
+                      minimizes fragmentation of the address space.
+                - arg_name: first-available-ranges-lookup-size
+                  api_field: internalRange.allocationOptions.firstAvailableRangesLookupSize
+                  help_text: |
+                    The number of ranges to be considered when using the
+                    RANDOM_FIRST_N_AVAILABLE allocation strategy. This is only allowed when
+                    allocation-strategy is set to RANDOM_FIRST_N_AVAILABLE.
+    - arg_name: labels
+      api_field: internalRange.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - arg_name: network
+      api_field: internalRange.network
+      help_text: |
+        The URL or resource ID of the network in which to reserve the internal range.
+        Legacy network is not supported. This can only be specified for a global internal address.
+
+        For example:
+          - https://www.googleapis.com/compute/v1/projects/my-project/locations/global/networks/my-network
+          - /projects/my-project/locations/global/networks/my-network
+          - my-network
+      required: true
+    - arg_name: usage
+      api_field: internalRange.usage
+      help_text: |
+        The type of usage set for the internal range.
+      choices:
+      - arg_value: for-vpc
+        enum_value: FOR_VPC
+        help_text: |
+          A cloud resource can use the reserved CIDR block by associating it with the internal range
+          resource if usage is set to FOR_VPC.
+      - arg_value: external-to-vpc
+        enum_value: EXTERNAL_TO_VPC
+        help_text:  |
+          Ranges created with EXTERNAL_TO_VPC cannot be associated with cloud resources and are
+          meant to block out address ranges for various use cases, like for example, usage on-prem,
+          with dynamic route announcements via interconnect.
+      - arg_value: for-migration
+        enum_value: FOR_MIGRATION
+        help_text: |
+          Ranges created with FOR_MIGRATION are used as locks for migrating subnetworks between
+          peered VPC networks.
+      default: for-vpc
+    - arg_name: peering
+      api_field: internalRange.peering
+      help_text: |
+        The type of peering set for the internal range.
+      choices:
+      - arg_value: for-self
+        enum_value: FOR_SELF
+        help_text: |
+          This beharior represents the case that the internal range is intended to be used in the
+          VPC on which it is created and is accessible from its peers. This implies that peers or
+          peer-of-peers cannot use this range.
+      - arg_value: for-peer
+        enum_value: FOR_PEER
+        help_text: |
+          This behavior can be set when the internal range is being reserved for usage by the peers.
+          This means that no resource within the VPC in which it is being created can use this to
+          associate with a cloud resource, but one of the peers can. This represents "donating" a
+          range for peers to use.
+      - arg_value: not-shared
+        enum_value: NOT_SHARED
+        help_text: |
+          This behavior can be set when the internal range is being reserved for usage by the VPC on
+          which it is created but not shared with the peers. In a sense it is local to the VPC. This
+          can be used to create internal ranges for various purposes like
+          HTTP_INTERNAL_LOAD_BALANCER or for interconnect routes that are not shared with peers.
+          This also implies that peers cannot use this range in a way that is visible to this VPC,
+          but can re-use this range as long as it is NOT_SHARED from the peer VPC too.
+      default: for-self
+    - arg_name: overlaps
+      api_field: internalRange.overlaps
+      help_text: Overlap specifications for the range being created.
+      choices:
+      - arg_value: overlap-route-range
+        enum_value: OVERLAP_ROUTE_RANGE
+        help_text: |
+          Allows for creation or existence of routes that have a more specific destination
+          than the created range.
+      - arg_value: overlap-existing-subnet-range
+        enum_value: OVERLAP_EXISTING_SUBNET_RANGE
+        help_text: |
+          Allows for creation of internal ranges that overlap with existing subnets.
+    - group:
+        help_text: |
+          Endpoints of a for-migration internal range. This is only applicable when --usage is set
+          to for-migration.
+          Both MIGRATION_SOURCE and MIGRATION_TARGET must either belong to the same VPC or their
+          VPCs must be peered (they may then even belong to different projects).
+          MIGRATION_SOURCE must belong to the VPC network specifed by the --network flag.
+          MIGRATION_TARGET may name a subnetwork which does not exist yet; it must be a valid
+          resource path, and parent resources (network and project) and their locations must exist.
+        params:
+        - arg_name: migration-source
+          required: true
+          api_field: internalRange.migration.source
+          help_text: |
+            The migration source subnetwork (of a for-migration internal range) resource URI or
+            resource ID.
+        - arg_name: migration-target
+          required: true
+          api_field: internalRange.migration.target
+          help_text: |
+            The migration target subnetwork (of a for-migration internal range) resource URI or
+            resource ID.
+    - arg_name: immutable
+      api_field: internalRange.immutable
+      help_text: |
+        Mark the internal range as immutable. Then only non-semantic fields like description and
+        labels could be modified after creation.
+      type: bool
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.network_connectivity.util:ValidateMigration
+    GA:
+      api_version: v1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.network_connectivity.util:ValidateMigration
+    collection: networkconnectivity.projects.locations.internalRanges
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/delete.yaml

@@ -0,0 +1,26 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: |
+      Delete an internal range.
+    description: |
+      Delete the specified internal range.
+    examples: |
+      Delete an internal range named ``my-range'':
+
+        $ {command} my-range
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:internalRange
+      help_text: Name of the internal range to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.internalRanges

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: |
+      Describe an internal range.
+    description: |
+      Retrieve and display details about an internal range.
+    examples: |
+      Display details about an internal range named ``my-range'':
+
+        $ {command} my-range
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:internalRange
+      help_text: Name of the internal range to be described.
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.internalRanges

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/list.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: |
+      List internal ranges.
+    description: |
+      Retrieve and display a list of all internal ranges in the specified project.
+    examples: |
+      List all internal ranges:
+
+        $ {command}
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:regionDefaultGlobal
+      help_text: |
+        Location of the internal ranges to display.
+
+  output:
+    format: table(name.basename(), description, network.basename(), ipCidrRange)
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.internalRanges

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/internal_ranges/update.yaml

@@ -0,0 +1,97 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: |
+      Update an internal range.
+    description: |
+      Update the details of an internal range.
+    examples: |
+      Update ip-cidr-range of an internal range named ``my-range'':
+
+        $ {command} my-range
+          --ip-cidr-range="192.168.0.0/24"
+
+      Extend an internal range named ``my-range'' to an address block of /24:
+
+        $ {command} my-range
+          --prefix-length=24
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:internalRange
+      help_text: |
+        Name of the internal range to be created.
+    params:
+    - group:
+        mutex: true
+        params:
+        - arg_name: ip-cidr-range
+          api_field: internalRange.ipCidrRange
+          help_text: |
+            IP range that this internal range defines.
+        - arg_name: prefix-length
+          api_field: internalRange.prefixLength
+          help_text: |
+            An alternative to ip-cidr-range.
+            Can be set when trying to create a reservation that automatically finds a free range of
+            the given size.
+    - group:
+        mutex: true
+        params:
+        - arg_name: clear-overlaps
+          type: bool
+          help_text: |
+            Clear existing overlap fields for the range.
+        - arg_name: overlaps
+          api_field: internalRange.overlaps
+          help_text: Overlap specifications for the range being updated.
+          choices:
+          - arg_value: overlap-route-range
+            enum_value: OVERLAP_ROUTE_RANGE
+            help_text: |
+              Allows for creation or existence of routes that have a more specific destination
+              than the created range.
+          - arg_value: overlap-existing-subnet-range
+            enum_value: OVERLAP_EXISTING_SUBNET_RANGE
+            help_text: |
+              Allows for creation of internal ranges that overlap with existing subnets.
+    - group:
+        mutex: true
+        params:
+        - arg_name: clear-labels
+          type: bool
+          help_text: |
+            Clear existing labels for the range.
+        - arg_name: labels
+          api_field: internalRange.labels.additionalProperties
+          metavar: KEY=VALUE
+          help_text: List of label KEY=VALUE pairs for the range being updated.
+          type:
+            arg_dict:
+              flatten: true
+              spec:
+              - api_field: key
+              - api_field: value
+    - group:
+        params:
+        - arg_name: description
+          api_field: internalRange.description
+          help_text: Description of the Internal Range
+
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    ALPHA:
+      api_version: v1alpha1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.network_connectivity.util:ClearOverlaps
+      - googlecloudsdk.command_lib.network_connectivity.util:ClearLabels
+    GA:
+      api_version: v1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.network_connectivity.util:ClearOverlaps
+      - googlecloudsdk.command_lib.network_connectivity.util:ClearLabels
+    collection: networkconnectivity.projects.locations.internalRanges
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/locations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for locations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Operations(base.Group):
+  """Get information about supported Network Connectivity Center locations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/locations/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Describe a Network Connectivity Center location.
+    description: |
+      Retrieve details about a location.
+    examples: |
+      To describe location `us-central1`, run:
+
+        $ {command} us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:location
+      help_text: |
+        Name of the location to describe.
+
+  request:  &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/locations/list.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: List Network Connectivity Center locations.
+    description: |
+      Retrieve and display a list of locations.
+
+      Network Connectivity Center includes two general types of spokes: those
+      that use the site-to-site data transfer feature and those that don't. To
+      get a list of the locations that support one of these features, use the
+      --filter flag (see examples). The full list of location features can be found here:
+      https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest/Shared.Types/LocationFeature
+
+      To specify the maximum number of locations to return, use the `--limit` flag.
+
+    examples: |
+      To list all locations, run:
+
+        $ {command}
+
+      To list locations that support the site-to-site data transfer feature, run:
+
+        $ {command} --filter="metadata.locationFeatures=SITE_TO_SITE_SPOKES"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:project
+      help_text: |
+        Name of the project to list locations for.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations
+
+  output:
+    # Reference: https://cloud.google.com/sdk/gcloud/reference/topic/projections
+    format: |
+      table(
+        name.basename():label=LOCATION,
+        metadata.locationFeatures.list():label=FEATURES
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/__init__.py

@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Multicloud Data Transfer Config resources."""
+
+from googlecloudsdk.calliope import base
+from surface.network_connectivity.multicloud_data_transfer_configs import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class MulticloudDataTransferConfigsBeta(
+    extensions.MulticloudDataTransferConfigsBeta
+):
+  """Manage Multicloud Data Transfer Config resources."""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class MulticloudDataTransferConfigsGa(
+    extensions.MulticloudDataTransferConfigsGa
+):
+  """Manage Multicloud Data Transfer Config resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_init_extensions.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+class MulticloudDataTransferConfigsAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+class MulticloudDataTransferConfigsBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+class MulticloudDataTransferConfigsGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_create_beta.yaml

@@ -0,0 +1,119 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Create multicloudDataTransferConfigs
+    description: Create a multicloudDataTransferConfig
+    examples: |-
+      To create the multicloudDataTransferConfig, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `MulticloudDataTransferConfig` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}`.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: multicloudDataTransferConfigId
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: labels
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: services
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.services
+      required: false
+      repeated: true
+      help_text: |-
+        Maps services to their current or planned states. Service names are keys,
+        and the associated values describe the state of the service. If a state
+        change is expected, the value is either `ADDING` or `DELETING`,
+        depending on the actions taken.
+
+        Sample output:
+        "services": {
+          "big-query": {
+            "states": [
+              {
+                "effectiveTime": "2024-12-12T08:00:00Z"
+                "state": "ADDING",
+              },
+            ]
+          },
+          "cloud-storage": {
+            "states": [
+              {
+                "state": "ACTIVE",
+              }
+            ]
+          }
+        }
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_create_ga.yaml

@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Create a multicloudDataTransferConfig
+    description: Create a multicloudDataTransferConfig
+    examples: |-
+      To create the multicloudDataTransferConfig, run:
+
+      $ {command} config-1 \
+        --location=europe-west1 \
+        --description="Multicloud Data Transfer Config description" \
+        --services=compute-engine,cloud-storage
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `MulticloudDataTransferConfig` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}`.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: multicloudDataTransferConfigId
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: labels
+      api_field: multicloudDataTransferConfig.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: multicloudDataTransferConfig.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: multicloudDataTransferConfig.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: services
+      api_field: multicloudDataTransferConfig.services
+      required: false
+      repeated: true
+      help_text: |-
+        Maps services to their current or planned states. Service names are keys,
+        and the associated values describe the state of the service. If a state
+        change is expected, the value is either `ADDING` or `DELETING`,
+        depending on the actions taken.
+
+        Sample output:
+        "services": {
+          "big-query": {
+            "states": [
+              {
+                "effectiveTime": "2024-12-12T08:00:00Z"
+                "state": "ADDING",
+              },
+            ]
+          },
+          "cloud-storage": {
+            "states": [
+              {
+                "state": "ACTIVE",
+              }
+            ]
+          }
+        }
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_delete_beta.yaml

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Delete multicloudDataTransferConfigs
+    description: Delete a multicloudDataTransferConfig
+    examples: |-
+      To delete the multicloudDataTransferConfig, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `MulticloudDataTransferConfig` resource to delete.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+    - arg_name: etag
+      api_field: etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_delete_ga.yaml

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Delete a multicloudDataTransferConfig
+    description: Delete a multicloudDataTransferConfig
+    examples: |-
+      To delete the multicloudDataTransferConfig, run:
+
+      $ {command} config-1 \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `MulticloudDataTransferConfig` resource to delete.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+    - arg_name: etag
+      api_field: etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_describe_beta.yaml

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Describe multicloudDataTransferConfigs
+    description: Describe a multicloudDataTransferConfig
+    examples: |-
+      To describe the multicloudDataTransferConfig, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `MulticloudDataTransferConfig` resource to get.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_describe_ga.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Describe a multicloudDataTransferConfig
+    description: Describe a multicloudDataTransferConfig
+    examples: |-
+      To describe the multicloudDataTransferConfig, run:
+
+      $ {command} config-1 \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `MulticloudDataTransferConfig` resource to get.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_list_beta.yaml

@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: List multicloudDataTransferConfigs
+    description: List multicloudDataTransferConfigs
+    examples: |-
+      To list all multicloudDataTransferConfigs, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations
+      required: true
+    - arg_name: return-partial-success
+      api_field: returnPartialSuccess
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If `true`, allows partial responses for multi-regional aggregated list
+        requests.
+      default: null
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_list_ga.yaml

@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: List multicloudDataTransferConfigs
+    description: List multicloudDataTransferConfigs
+    examples: |-
+      To list all multicloudDataTransferConfigs, run:
+
+      $ {command} --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations
+      required: true
+    - arg_name: return-partial-success
+      api_field: returnPartialSuccess
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If `true`, allows partial responses for multi-regional aggregated list
+        requests.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_update_beta.yaml

@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Update multicloudDataTransferConfigs
+    description: Update a multicloudDataTransferConfig
+    examples: |-
+      To update the multicloudDataTransferConfig, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `MulticloudDataTransferConfig` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}`.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: labels
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: services
+      api_field: googleCloudNetworkconnectivityV1betaMulticloudDataTransferConfig.services
+      required: false
+      repeated: true
+      help_text: |-
+        Maps services to their current or planned states. Service names are keys,
+        and the associated values describe the state of the service. If a state
+        change is expected, the value is either `ADDING` or `DELETING`,
+        depending on the actions taken.
+
+        Sample output:
+        "services": {
+          "big-query": {
+            "states": [
+              {
+                "effectiveTime": "2024-12-12T08:00:00Z"
+                "state": "ADDING",
+              },
+            ]
+          },
+          "cloud-storage": {
+            "states": [
+              {
+                "state": "ACTIVE",
+              }
+            ]
+          }
+        }
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/_partials/_update_ga.yaml

@@ -0,0 +1,125 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Update a multicloudDataTransferConfig
+    description: Update a multicloudDataTransferConfig
+    examples: |-
+      To update the multicloudDataTransferConfig, run:
+
+      $ {command} config-1 \
+        --location=europe-west1 \
+        --description="Multicloud Data Transfer Config description updated" \
+        --update-services=cloud-run
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `MulticloudDataTransferConfig` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}`.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: labels
+      api_field: multicloudDataTransferConfig.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: multicloudDataTransferConfig.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: multicloudDataTransferConfig.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: services
+      api_field: multicloudDataTransferConfig.services
+      required: false
+      repeated: true
+      help_text: |-
+        Maps services to their current or planned states. Service names are keys,
+        and the associated values describe the state of the service. If a state
+        change is expected, the value is either `ADDING` or `DELETING`,
+        depending on the actions taken.
+
+        Sample output:
+        "services": {
+          "big-query": {
+            "states": [
+              {
+                "effectiveTime": "2024-12-12T08:00:00Z"
+                "state": "ADDING",
+              },
+            ]
+          },
+          "cloud-storage": {
+            "states": [
+              {
+                "state": "ACTIVE",
+              }
+            ]
+          }
+        }
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+        spec: []
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `MulticloudDataTransferConfig`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/create.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/delete.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Destination resources."""
+
+from googlecloudsdk.calliope import base
+from surface.network_connectivity.multicloud_data_transfer_configs.destinations import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class DestinationsBeta(extensions.DestinationsBeta):
+  """Manage Destination resources."""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class DestinationsGa(extensions.DestinationsGa):
+  """Manage Destination resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_init_extensions.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+class DestinationsAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+class DestinationsBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+class DestinationsGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_create_beta.yaml

@@ -0,0 +1,106 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Create destinations
+    description: Create a destination
+    examples: |-
+      To create the destination, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `Destination` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}/destinations/{destination}`.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: destinationId
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: labels
+      api_field: googleCloudNetworkconnectivityV1betaDestination.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: googleCloudNetworkconnectivityV1betaDestination.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaDestination.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: ip-prefix
+      api_field: googleCloudNetworkconnectivityV1betaDestination.ipPrefix
+      required: true
+      repeated: false
+      help_text: |-
+        The IP prefix that represents your workload on another CSP.
+    - arg_name: endpoints
+      api_field: googleCloudNetworkconnectivityV1betaDestination.endpoints
+      required: true
+      repeated: true
+      help_text: |-
+        The list of `DestinationEndpoint` resources configured for the IP prefix.
+      spec:
+      - api_field: asn
+        help_text: |-
+          The ASN of the remote IP prefix.
+      - api_field: csp
+        help_text: |-
+          The CSP of the remote IP prefix.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `Destination`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_create_ga.yaml

@@ -0,0 +1,111 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Create a destination
+    description: Create a destination
+    examples: |-
+      To create the destination, run:
+
+      $ {command} destination-1 \
+        --multicloud-data-transfer-config=config-1 \
+        --location=europe-west1 \
+        --description="Multicloud Data Transfer destination description" \
+        --ip-prefix="10.1.1.0/24" \
+        --endpoints=asn=8075,csp=microsoft
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `Destination` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}/destinations/{destination}`.
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: destinationId
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: labels
+      api_field: destination.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: destination.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: destination.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: ip-prefix
+      api_field: destination.ipPrefix
+      required: true
+      repeated: false
+      help_text: |-
+        The IP prefix that represents your workload on another CSP.
+    - arg_name: endpoints
+      api_field: destination.endpoints
+      required: true
+      repeated: true
+      help_text: |-
+        The list of `DestinationEndpoint` resources configured for the IP prefix.
+      spec:
+      - api_field: asn
+        help_text: |-
+          The ASN of the remote IP prefix.
+      - api_field: csp
+        help_text: |-
+          The CSP of the remote IP prefix.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request. This prevents
+        clients from accidentally creating duplicate `Destination`
+        resources.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_delete_beta.yaml

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Delete destinations
+    description: Delete a destination
+    examples: |-
+      To delete the destination, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `Destination` resource to delete.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+    - arg_name: etag
+      api_field: etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_delete_ga.yaml

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Delete a destination
+    description: Delete a destination
+    examples: |-
+      To delete the destination, run:
+
+      $ {command} destination-1 \
+        --multicloud-data-transfer-config=config-1 \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `Destination` resource to delete.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+    - arg_name: etag
+      api_field: etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_describe_beta.yaml

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Describe destinations
+    description: Describe a destination
+    examples: |-
+      To describe the destination, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `Destination` resource to get.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_describe_ga.yaml

@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Describe a destination
+    description: Describe a destination
+    examples: |-
+      To describe the destination, run:
+
+      $ {command} destination-1 \
+        --multicloud-data-transfer-config=config-1 \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the `Destination` resource to get.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_list_beta.yaml

@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: List destinations
+    description: List destinations
+    examples: |-
+      To list all destinations, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: return-partial-success
+      api_field: returnPartialSuccess
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If `true`, allow partial responses for multi-regional aggregated list
+        requests.
+      default: null
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_list_ga.yaml

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: List destinations
+    description: List destinations
+    examples: |-
+      To list all destinations, run:
+
+      $ {command} --multicloud-data-transfer-config=config-1 \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs
+      required: true
+    - arg_name: return-partial-success
+      api_field: returnPartialSuccess
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        If `true`, allow partial responses for multi-regional aggregated list
+        requests.
+      default: null
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_update_beta.yaml

@@ -0,0 +1,101 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Update destinations
+    description: Update a destination
+    examples: |-
+      To update the destination, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `Destination` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}/destinations/{destination}`.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: labels
+      api_field: googleCloudNetworkconnectivityV1betaDestination.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: googleCloudNetworkconnectivityV1betaDestination.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaDestination.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: endpoints
+      api_field: googleCloudNetworkconnectivityV1betaDestination.endpoints
+      required: false
+      repeated: true
+      help_text: |-
+        The list of `DestinationEndpoint` resources configured for the IP prefix.
+      clearable: true
+      spec:
+      - api_field: asn
+        help_text: |-
+          The ASN of the remote IP prefix.
+      - api_field: csp
+        help_text: |-
+          The CSP of the remote IP prefix.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/_partials/_update_ga.yaml

@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Update a destination
+    description: Update a destination
+    examples: |-
+      To update the destination, run:
+
+      $ {command} destination-1 \
+        --multicloud-data-transfer-config=config-1 \
+        --location=europe-west1 \
+        --description="Multicloud Data Transfer destination description updated" \
+        --endpoints=asn=16509,csp=aws
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The name of the `Destination` resource.
+        Format:
+        `projects/{project}/locations/{location}/multicloudDataTransferConfigs/{multicloud_data_transfer_config}/destinations/{destination}`.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_configs_destinations
+      required: true
+    - arg_name: labels
+      api_field: destination.labels
+      required: false
+      repeated: true
+      help_text: |-
+        User-defined labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+    - arg_name: etag
+      api_field: destination.etag
+      required: false
+      repeated: false
+      help_text: |-
+        The etag is computed by the server, and might be sent with update and
+        delete requests so that the client has an up-to-date value before
+        proceeding.
+    - arg_name: description
+      api_field: destination.description
+      required: false
+      repeated: false
+      help_text: |-
+        A description of this resource.
+    - arg_name: endpoints
+      api_field: destination.endpoints
+      required: false
+      repeated: true
+      help_text: |-
+        The list of `DestinationEndpoint` resources configured for the IP prefix.
+      clearable: true
+      spec:
+      - api_field: asn
+        help_text: |-
+          The ASN of the remote IP prefix.
+      - api_field: csp
+        help_text: |-
+          The CSP of the remote IP prefix.
+    - arg_name: request-id
+      api_field: requestId
+      required: false
+      repeated: false
+      help_text: |-
+        A request ID to identify requests. Specify a unique request ID
+        so that if you must retry your request, the server can ignore
+        the request if it has already been completed. The server waits
+        for at least 60 minutes since the first request.
+
+        For example, consider a situation where you make an initial request and
+        the request times out. If you make the request again with the same request
+        ID, the server can check if original operation with the same request ID
+        was received, and if so, can ignore the second request.
+
+        The request ID must be a valid UUID with the exception that zero UUID
+        (00000000-0000-0000-0000-000000000000) isn't supported.
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferConfigs.destinations
+  async:
+    collection:
+    - networkconnectivity.projects.locations.operations
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/create.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/delete.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/destinations/update.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_configs/update.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/__init__.py

@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""Manage Multicloud Data Transfer Supported Service resources."""
+
+from googlecloudsdk.calliope import base
+from surface.network_connectivity.multicloud_data_transfer_supported_services import _init_extensions as extensions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.Autogenerated
+class MulticloudDataTransferSupportedServicesBeta(
+    extensions.MulticloudDataTransferSupportedServicesBeta
+):
+  """Manage Multicloud Data Transfer Supported Service resources."""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Autogenerated
+class MulticloudDataTransferSupportedServicesGa(
+    extensions.MulticloudDataTransferSupportedServicesGa
+):
+  """Manage Multicloud Data Transfer Supported Service resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/_init_extensions.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+"""File to add optional custom code to extend __init__.py."""
+from googlecloudsdk.calliope import base
+
+
+class MulticloudDataTransferSupportedServicesAlpha(base.Group):
+  """Optional no-auto-generated code for ALPHA."""
+
+
+class MulticloudDataTransferSupportedServicesBeta(base.Group):
+  """Optional no-auto-generated code for BETA."""
+
+
+class MulticloudDataTransferSupportedServicesGa(base.Group):
+  """Optional no-auto-generated code for GA."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/_partials/_describe_beta.yaml

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: Describe multicloudDataTransferSupportedServices
+    description: Describe a multicloudDataTransferSupportedService
+    examples: |-
+      To describe the multicloudDataTransferSupportedService, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the service.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations_multicloud_data_transfer_supported_services
+      required: true
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferSupportedServices

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/_partials/_describe_ga.yaml

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: Describe multicloudDataTransferSupportedService
+    description: Describe multicloudDataTransferSupportedService
+    examples: |-
+      To describe the multicloudDataTransferSupportedService, run:
+
+      $ {command} compute-engine \
+        --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the service.
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations_multicloud_data_transfer_supported_services
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferSupportedServices

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/_partials/_list_beta.yaml

@@ -0,0 +1,43 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - BETA
+  auto_generated: true
+  help_text:
+    brief: List multicloudDataTransferSupportedServices
+    description: List multicloudDataTransferSupportedServices
+    examples: |-
+      To list all multicloudDataTransferSupportedServices, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1beta_resources:projects_locations
+      required: true
+  request:
+    api_version: v1beta
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferSupportedServices
+  response:
+    id_field: name
+  output:
+    format: table(name, service_configs)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/_partials/_list_ga.yaml

@@ -0,0 +1,43 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+- release_tracks:
+  - GA
+  auto_generated: true
+  help_text:
+    brief: List multicloudDataTransferSupportedServices
+    description: List multicloudDataTransferSupportedServices
+    examples: |-
+      To list all multicloudDataTransferSupportedServices, run:
+
+      $ {command} --location=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        The name of the parent resource.
+      is_positional: false
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.v1_resources:projects_locations
+      required: true
+  request:
+    api_version: v1
+    collection:
+    - networkconnectivity.projects.locations.multicloudDataTransferSupportedServices
+  response:
+    id_field: name
+  output:
+    format: table(name, service_configs)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/describe.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/multicloud_data_transfer_supported_services/list.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# NOTE: This file is autogenerated and should not be edited by hand.
+# AUTOGEN_CLI_VERSION: HEAD
+_PARTIALS_: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/operations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Operations(base.Group):
+  """Manage Network Connectivity Center operations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/operations/describe.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: Describe a Network Connectivity Center operation.
+    description: |
+      Retrieve details about an operation; this command is useful if you want to check on
+      a long-running operation.
+    examples: |
+      To describe operation `operation-12345` in `us-central1`, run:
+
+        $ {command} operation-12345 --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:operation
+      help_text: |
+        Name of the operation to describe.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/operations/list.yaml

@@ -0,0 +1,41 @@
+- release_tracks: [BETA, GA]
+
+  help_text:
+    brief: List Network Connectivity Center operations.
+    description: |
+      Retrieve and display a list of operations in the specified region, sorted by creation time.
+
+      To specify the maximum number of operations to return, use the `--limit` flag.
+
+    examples: |
+      To list all operations in region `us-central1`, run:
+
+        $ {command} --region=us-central1
+
+      To list a maximum of five operations in `us-central1`, run:
+
+        $ {command} --region=us-central1 --limit=5
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:region
+      help_text: Region of the operations to display.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.operations
+
+  output:
+    # Columns: ID, TYPE, TARGET, CREATE_TIME, END_TIME, DONE
+    format: |
+       table(
+          name.basename():label=ID,
+          metadata.verb:label=TYPE,
+          metadata.target.basename(),
+          metadata.createTime.date('%Y-%m-%d %H:%M:%S %Oz', undefined=''):sort=1,
+          metadata.endTime.date('%Y-%m-%d %H:%M:%S %Oz', undefined=''),
+          done
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/policy_based_routes/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Policy-based Routes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class PolicyBasedRoutes(base.Group):
+  """Manage Policy-based Routes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/policy_based_routes/create.yaml

@@ -0,0 +1,147 @@
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: Create a new policy-based route.
+    description: Create a new policy-based route with the given name.
+    examples: |
+      To create a policy-based route with the name ``my-pbr'' to route all traffic in ``default''
+      network to an internal load balancer with IP 10.0.0.1, run:
+
+        $ {command} my-pbr --network="projects/my-project/global/networks/default"
+          --next-hop-ilb-ip=10.0.0.1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:policyBasedRoute
+      help_text: Name of the policy-based route to be created.
+    params:
+    - arg_name: network
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.network
+      help_text: Fully-qualified URL of the network that this route applies to. E.g. `projects/my-project/global/networks/my-network`
+    - group:
+        mutex: true
+        params:
+        - arg_name: tags
+          api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.virtualMachine.tags
+          type: arg_list
+          help_text: List of VM instance tags that this route applies to. VM instances that have ANY of tags specified here installs this route. Note if both `--tags` and `--interconnect-attachment-region` are not set, then the policy-based route will be installed in all endpoints, including VMs, VPNs, and Interconnect attachements, in the network.
+        - arg_name: interconnect-attachment-region
+          api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.interconnectAttachment.region
+          help_text: Cloud region to install this policy-based route on interconnect attachment. Use `all` to install it on all interconnect attachments. Note if both `--tags` and `--interconnect-attachment-region` are not set, then the policy-based route will be installed in all network endpoints, including VMs, VPNs, and Interconnect attachements, in the network.
+    - arg_name: priority
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.priority
+      help_text: Priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. Note the priority of policy-based route is always higher than other types of route (e.g. static routes/advanced routes)
+    - arg_name: ip-protocol
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.filter.ipProtocol
+      help_text: IP protocol that this policy-based route applies to. Valid values are `TCP`, `UDP`, and `ALL`. Default is `ALL`.
+    - arg_name: source-range
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.filter.srcRange
+      help_text: Source IP range of outgoing packets that this policy-based route applies to.
+    - arg_name: destination-range
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.filter.destRange
+      help_text: Destination IP range of outgoing packets that this policy-based route applies to.
+    - arg_name: protocol-version
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.filter.protocolVersion
+      help_text: Internet protocol versions that this policy-based route applies to. Valid values are `IPV4`, and `IPV6`. Default is `IPV4'.
+      default: IPV4
+    - group:
+        mutex: true
+        params:
+        - arg_name: next-hop-ilb-ip
+          api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.nextHopIlbIp
+          help_text: IP of a global access enabled L4 ILB that should be the next hop to handle packets.
+        - arg_name: next-hop-other-routes
+          api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.nextHopOtherRoutes
+          help_text: Next hop should be other routes that handle packets. This effectively excludes matching packets being applied on other policy-based routes with a lower priority.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.description
+      help_text: Optional description of this resource. Provide this field when you create the resource.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaPolicyBasedRoute.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    ALPHA:
+      api_version: v1beta
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.global.policyBasedRoutes
+    method: create
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new policy-based route.
+    description: Create a new policy-based route with the given name.
+    examples: |
+      To create a policy-based route with the name ``my-pbr'' to route all traffic in ``default''
+      network to an internal load balancer with IP 10.0.0.1, run:
+
+        $ {command} my-pbr --network="projects/my-project/global/networks/default"
+          --next-hop-ilb-ip=10.0.0.1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:policyBasedRoute
+      help_text: Name of the policy-based route to be created.
+    params:
+    - arg_name: network
+      required: true
+      api_field: policyBasedRoute.network
+      help_text: Fully-qualified URL of the network that this route applies to. E.g. `projects/my-project/global/networks/my-network`
+    - group:
+        mutex: true
+        params:
+        - arg_name: tags
+          api_field: policyBasedRoute.virtualMachine.tags
+          type: arg_list
+          help_text: List of VM instance tags that this route applies to. VM instances that have ANY of tags specified here installs this route. Note if both `--tags` and `--interconnect-attachment-region` are not set, then the policy-based route will be installed in all endpoints, including VMs, VPNs, and Interconnect attachements, in the network.
+        - arg_name: interconnect-attachment-region
+          api_field: policyBasedRoute.interconnectAttachment.region
+          help_text: Cloud region to install this policy-based route on interconnect attachment. Use `all` to install it on all interconnect attachments. Note if both `--tags` and `--interconnect-attachment-region` are not set, then the policy-based route will be installed in all network endpoints, including VMs, VPNs, and Interconnect attachements, in the network.
+    - arg_name: priority
+      api_field: policyBasedRoute.priority
+      help_text: Priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. Note the priority of policy-based route is always higher than other types of route (e.g. static routes/advanced routes)
+    - arg_name: ip-protocol
+      api_field: policyBasedRoute.filter.ipProtocol
+      help_text: IP protocol that this policy-based route applies to. Valid values are `TCP`, `UDP`, and `ALL`. Default is `ALL`.
+    - arg_name: source-range
+      api_field: policyBasedRoute.filter.srcRange
+      help_text: Source IP range of outgoing packets that this policy-based route applies to.
+    - arg_name: destination-range
+      api_field: policyBasedRoute.filter.destRange
+      help_text: Destination IP range of outgoing packets that this policy-based route applies to.
+    - arg_name: protocol-version
+      api_field: policyBasedRoute.filter.protocolVersion
+      help_text: Internet protocol versions that this policy-based route applies to. For this version, only `IPV4` is supported.
+      default: IPV4
+    - group:
+        mutex: true
+        params:
+        - arg_name: next-hop-ilb-ip
+          api_field: policyBasedRoute.nextHopIlbIp
+          help_text: IP of a global access enabled L4 ILB that should be the next hop to handle packets.
+        - arg_name: next-hop-other-routes
+          api_field: policyBasedRoute.nextHopOtherRoutes
+          help_text: Next hop should be other routes that handle packets. This effectively excludes matching packets being applied on other policy-based routes with a lower priority.
+    - arg_name: description
+      api_field: policyBasedRoute.description
+      help_text: Optional description of this resource. Provide this field when you create the resource.
+    labels:
+      api_field: policyBasedRoute.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.policyBasedRoutes
+    method: create
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/policy_based_routes/delete.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Delete a policy-based route.
+    description: Delete the specified policy-based route.
+
+    examples: |
+      To delete a policy-based route named ``my-pbr'', run:
+
+        $ {command} my-pbr
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:policyBasedRoute
+      help_text: Name of the policy-based route to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    ALPHA:
+      api_version: v1beta
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.policyBasedRoutes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/policy_based_routes/describe.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe a policy-based route.
+    description: Retrieve and display details about a policy-based route.
+
+    examples: |
+      To display details about a policy-based route named ``my-pbr'', run:
+
+        $ {command} my-pbr
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:policyBasedRoute
+      help_text: Name of the policy-based route to be described.
+
+  request: &request
+    ALPHA:
+      api_version: v1beta
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.policyBasedRoutes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/policy_based_routes/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List policy-based routes.
+    description: Retrieve and display a list of all policy-based routes in the specified project.
+    examples: |
+      To display details about a policy-based route named ``my-pbr'', run:
+
+        $ {command} my-pbr
+
+  request: &request
+    ALPHA:
+      api_version: v1beta
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.global.policyBasedRoutes
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:AppendLocationsGlobalToParent
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:project
+      help_text: Project of the policy-based routes to display.
+
+  output:
+    format: table(name.basename(), description)

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/regional_endpoints/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Regional Endpoints."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class RegionalEndpoints(base.Group):
+  """Manage Network Connectivity RegionalEndpoints."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/regional_endpoints/create.yaml

@@ -0,0 +1,133 @@
+- release_tracks: [BETA]
+  universe_compatible: false
+
+  help_text:
+    brief: Create a new regional endpoint.
+    description: Create a new regional endpoint with the given name.
+    examples: |
+      To create a regional endpoint with the name 'my-regional-endpoint' in us-central1
+      targeting my-target-endpoint, run:
+
+        $ {command} my-regional-endpoint
+          --region=us-central1
+          [--address=my-address]
+          [--network=my-network]
+          [--subnetwork=my-subnet]
+          --target-google-api=my-target-endpoint
+          [--enable-global-access]
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:regionalEndpoint
+      help_text: Name of the regional endpoint to be created.
+    params:
+    - arg_name: enable-global-access
+      action: store_true
+      default: false
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.accessType
+      help_text: |
+        Whether the REGIONAL or GLOBAL access is enabled.
+      choices:
+      - arg_value: false
+        enum_value: REGIONAL
+        help_text: REGIONAL access is enabled for the regional endpoint.
+      - arg_value: true
+        enum_value: GLOBAL
+        help_text: GLOBAL access is enabled for the regional.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.description
+      help_text: Description of the regional endpoint.
+    - arg_name: network
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.network
+      help_text: Consumer's VPC network that this regional endpoint belongs to.
+    - arg_name: subnetwork
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.subnetwork
+      help_text: The name of the subnetwork from which the IP address will be allocated.
+    - arg_name: target-google-api
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.targetGoogleApi
+      help_text: The service endpoint the regional endpoint will connect to.
+    - arg_name: address
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.address
+      help_text: The IP Address of the Regional Endpoint. When no address is provided, an IP from the subnetwork is allocated. Use one of the following formats:\
+        * IPv4 address as in `10.0.0.1`
+        * Address resource URI as in
+        `projects/{project}/regions/{region}/addresses/{address_name}` for an IPv4
+        or IPv6 address.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaRegionalEndpoint.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.regionalEndpoints
+    method: create
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new regional endpoint.
+    description: Create a new regional endpoint with the given name.
+    examples: |
+      To create a regional endpoint with the name 'my-regional-endpoint' in us-central1
+      targeting my-target-endpoint, run:
+
+        $ {command} my-regional-endpoint
+          --region=us-central1
+          [--address=my-address]
+          [--network=my-network]
+          [--subnetwork=my-subnet]
+          --target-google-api=my-target-endpoint
+          [--enable-global-access]
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:regionalEndpoint
+      help_text: Name of the regional endpoint to be created.
+    params:
+    - arg_name: enable-global-access
+      action: store_true
+      default: false
+      api_field: regionalEndpoint.accessType
+      help_text: |
+        Whether the REGIONAL or GLOBAL access is enabled.
+      choices:
+      - arg_value: false
+        enum_value: REGIONAL
+        help_text: REGIONAL access is enabled for the regional endpoint.
+      - arg_value: true
+        enum_value: GLOBAL
+        help_text: GLOBAL access is enabled for the regional.
+    - arg_name: description
+      api_field: regionalEndpoint.description
+      help_text: Description of the regional endpoint.
+    - arg_name: network
+      api_field: regionalEndpoint.network
+      help_text: Consumer's VPC network that this regional endpoint belongs to.
+    - arg_name: subnetwork
+      api_field: regionalEndpoint.subnetwork
+      help_text: The name of the subnetwork from which the IP address will be allocated.
+    - arg_name: target-google-api
+      required: true
+      api_field: regionalEndpoint.targetGoogleApi
+      help_text: The service endpoint the regional endpoint will connect to.
+    - arg_name: address
+      api_field: regionalEndpoint.address
+      help_text: |
+        The IP Address of the Regional Endpoint. When no address is provided, an IP from the subnetwork is allocated. Use one of the following formats:
+        - IPv4 address as in ``10.0.0.1''
+        - Address resource URI as in ``projects/{project}/regions/{region}/addresses/{address_name}'' for an IPv4 or IPv6 address.
+    labels:
+      api_field: regionalEndpoint.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.regionalEndpoints
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/regional_endpoints/delete.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [BETA, GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      Delete a regional endpoint.
+    description: |
+      Delete the specified regional endpoint.
+    examples: |
+      To delete a regional endpoint named 'my-regional-endpoint' in us-central1:
+
+        $ {command} my-regional-endpoint
+          --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:regionalEndpoint
+      help_text: Name of the regional endpoint to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.regionalEndpoints

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/regional_endpoints/describe.yaml

@@ -0,0 +1,26 @@
+- release_tracks: [BETA, GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      Describe a regional endpoint.
+    description: |
+      Retrieve and display details about a regional endpoint.
+    examples: |
+      Display details about a regional endpoint named 'my-regional-endpoint' in us-central1:
+
+        $ {command} my-regional-endpoint
+          --region=us-central1
+          [--project=my-project]
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:regionalEndpoint
+      help_text: Name of the regional endpoint to be described.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.regionalEndpoints

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/regional_endpoints/list.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [BETA, GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      List regional endpoints.
+    description: |
+      Retrieve and display a list of all regional endpoints in the specified project.
+    examples: |
+      To list all regional endpoints in us-central1, run:
+
+        $ {command}
+          --region=us-central1
+          [--project=my-project]
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:region
+      help_text: |
+        Region of the regional endpoints to display.
+
+  output:
+    format: table(
+      name.basename(),
+      name.segment(3):label=LOCATION,
+      network.basename(),
+      address,
+      targetGoogleApi,
+      accessType)
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: networkconnectivity.projects.locations.regionalEndpoints

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/service_connection_policies/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Service ConnectionPolicies."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class ServiceConnectionPolicies(base.Group):
+  """Manage Service Connection Policies."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/service_connection_policies/create.yaml

@@ -0,0 +1,82 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new Service Connection Policy.
+    description: Create a new Service Connection Policy with the given name.
+    examples: |
+      Create a Service Connection Policy with name ``my-service-conn-policy''
+      for network ``projects/my-project/global/networks/net1''
+      and service class ``my-service-class-ad32fa4b'' in region ``us-central1''
+      using subnet projects/my-project/regions/us-central1/subnetworks/subnet1
+      subject to custom-resource-hierarchy-levels that allows
+      connections from Google-managed producer instances in projects/my-project.
+
+        $ {command} my-service-conn-policy --network="projects/my-project/global/networks/net1" --service-class=my-service-class-ad32fa4b --region=us-central1 --subnets=projects/my-project/regions/us-central1/subnetworks/subnet1 --psc-connection-limit=100 --producer-instance-location=custom-resource-hierarchy-levels --allowed-google-producers-resource-hierarchy-level=projects/my-project
+
+  arguments:
+    params:
+    - arg_name: service_connection_policy
+      required: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:serviceConnectionPolicy
+      help_text: Name of the Service Connection Policy to be created.
+    - arg_name: network
+      required: true
+      resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.compute_resources:network
+      resource_method_params:
+        serviceConnectionPolicy.network: "{__relative_name__}"
+      help_text: Network that this service connection policy applies to. E.g. projects/my-project/global/networks/net1
+    - arg_name: service-class
+      required: true
+      api_field: serviceConnectionPolicy.serviceClass
+      help_text: Service class that this policy is created for. E.g. my-service-class-ad32fa4b
+    - arg_name: description
+      api_field: serviceConnectionPolicy.description
+      help_text: Description of the Service Connection Policy to be created.
+    - arg_name: labels
+      api_field: serviceConnectionPolicy.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - group:
+        required: true
+        params:
+        - arg_name: subnets
+          required: true
+          resource_spec: !REF googlecloudsdk.command_lib.network_connectivity.compute_resources:subnetwork
+          resource_method_params:
+            serviceConnectionPolicy.pscConfig.subnetworks: "{__relative_name__}"
+          help_text: Subnetwork to use for IP address management.
+          repeated: true
+        - arg_name: psc-connection-limit
+          type: int
+          api_field: serviceConnectionPolicy.pscConfig.limit
+          help_text: Max number of PSC connections for this policy.
+        - arg_name: producer-instance-location
+          api_field: serviceConnectionPolicy.pscConfig.producerInstanceLocation
+          help_text: Option that determines where the producer instances can be located for which connections can be created in the network controlled by this policy.
+          choices:
+          - arg_value: none
+            enum_value:  PRODUCER_INSTANCE_LOCATION_UNSPECIFIED
+            help_text: The producer instance must be within the same project as this connection policy.
+          - arg_value: custom-resource-hierarchy-levels
+            enum_value:  CUSTOM_RESOURCE_HIERARCHY_LEVELS
+            help_text: The producer instance must be located in one of the values provided in the allowed-google-producers-resource-hierarchy-level flag.
+        - arg_name: allowed-google-producers-resource-hierarchy-level
+          api_field: serviceConnectionPolicy.pscConfig.allowedGoogleProducersResourceHierarchyLevel
+          repeated: true
+          help_text: List of projects, folders, or orgs where the producer instance can be located in the form "projects/123456789", folders/123456789", or "organizations/123456789".
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    GA:
+      api_version: v1
+    method: create
+    collection: networkconnectivity.projects.locations.serviceConnectionPolicies

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/service_connection_policies/delete.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Delete a service connection policy.
+    description: Delete the specified service connection policy.
+    examples: |
+      To delete a service connection policy with name ``pol1'' in region ``us-central1'', run:
+
+        $ {command} pol1 --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:serviceConnectionPolicy
+      help_text: Name of the Service Connection Policy to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    GA:
+      api_version: v1
+    method: delete
+    collection: networkconnectivity.projects.locations.serviceConnectionPolicies