feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for the SaaS Runtime API."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class SaasRuntime(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Commands for SaaS Runtime.'}
+
+
+@base.UniverseCompatible
+@base.Hidden
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class SaasRuntimeAlpha(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Commands for SaaS Runtime.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/__init__.py

@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The flags command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+class SaasFlags(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime Flags.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/create.yaml

@@ -0,0 +1,134 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Create Flag
+    description: Create a Flag
+    examples: |-
+      To create a Flag, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        ID of the Flag:
+
+          "projects/{project}/locations/{location}/flags/{flag_id}"
+
+        This follows the standard Google Cloud naming scheme (URI).
+      is_positional: true
+      request_id_field: flagId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      required: true
+
+    - arg_name: key
+      api_field: flag.key
+      help_text: |-
+        Flag key used in client runtime evaluation (required).
+        Max length: 256 bytes.
+      is_positional: false
+      required: true
+      repeated: false
+
+    - arg_name: value-type
+      api_field: flag.valueType
+      help_text: |-
+        The type of the flag's value, e.g. BOOL (required).
+      is_positional: false
+      required: true
+      repeated: false
+      choices:
+      - arg_value: bool
+        enum_value: FLAG_VALUE_TYPE_BOOL
+        help_text: |-
+          The flag's value type is a boolean.
+      - arg_value: int
+        enum_value: FLAG_VALUE_TYPE_INT
+        help_text: |-
+          The flag's value type is an integer.
+      - arg_value: string
+        enum_value: FLAG_VALUE_TYPE_STRING
+        help_text: |-
+          The flag's value type is a string.
+      - arg_value: double
+        enum_value: FLAG_VALUE_TYPE_DOUBLE
+        help_text: |-
+          The flag's value type is a double.
+
+    - arg_name: evaluation-spec
+      api_field: flag.evaluationSpec
+      help_text: |-
+        Specification of how the Flag value should be evaluated.
+      is_positional: false
+      required: false
+      repeated: false
+      spec:
+      - api_field: defaultTarget
+        help_text: |-
+          Default variant for the flag.
+      - api_field: variants
+        help_text: |-
+          A list of variants.
+          Variant is an identifier for a value (name assigned to a value).
+        spec:
+        - api_field: name
+          help_text: |-
+            Name of the variant.
+            Max length: 128 bytes.
+        - api_field: boolValue
+          help_text: |-
+            Value is a single boolean flag value for the variant.
+        - api_field: intValue
+          help_text: |-
+            Value is a single integer flag value for the variant.
+        - api_field: stringValue
+          help_text: |-
+            Value is a single string flag value for the variant.
+        - api_field: doubleValue
+          help_text: |-
+            Value is a single double flag value for the variant.
+
+    - arg_name: unit-kind
+      help_text: |-
+        Reference to the UnitKind that can consume this Flag.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        flag.unitKind: '{__relative_name__}'
+      required: true
+      repeated: false
+
+    - arg_name: description
+      api_field: flag.description
+      required: false
+      help_text: |-
+        A description of the flag.
+        Max length: 500 bytes.
+      is_positional: false
+
+    - arg_name: labels
+      api_field: flag.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flag.annotations
+      required: false
+      repeated: true
+      help_text: |-
+        Unstructured key-value map stored with a resource that may be set by
+        external tools to store and retrieve arbitrary metadata. Annotations
+        are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flags

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/delete.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Delete Flag
+    description: Delete a Flag
+    examples: |-
+      To delete a Flag, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag ID of the Flag to delete.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flags

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/describe.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Describe Flag
+    description: Describe a Flag
+    examples: |-
+      To describe a Flag, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag ID of the Flag to describe.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flags

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/list.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: List Flags
+    description: List Flags
+    examples: |-
+      To list Flags, run:
+
+        $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Location in which to list Flags.
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flags
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/push.py

@@ -0,0 +1,399 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to create SaaS Runtime Flags from a manifest file."""
+
+from __future__ import annotations
+
+import json
+import pprint
+from typing import Any, Callable
+from apitools.base.protorpclite import messages as rpclite_messages
+from apitools.base.py import encoding
+from apitools.base.py import exceptions
+import googlecloudsdk.api_lib.saasservicemgmt.util as saasservicemgmt_util
+from googlecloudsdk.api_lib.util import messages as msg_utils
+from googlecloudsdk.calliope import arg_parsers
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as calliope_exceptions
+from googlecloudsdk.command_lib.saas_runtime import flags as arg_utils
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.generated_clients.apis.saasservicemgmt.v1beta1 import saasservicemgmt_v1beta1_client as ezclient
+from googlecloudsdk.generated_clients.apis.saasservicemgmt.v1beta1 import saasservicemgmt_v1beta1_messages as ezmessages
+
+
+FLAG_TYPE_MAP: dict[str, str] = {
+    'boolean': 'FLAG_VALUE_TYPE_BOOL',
+    'integer': 'FLAG_VALUE_TYPE_INT',
+    'double': 'FLAG_VALUE_TYPE_DOUBLE',
+    'string': 'FLAG_VALUE_TYPE_STRING',
+}
+
+VALUE_TYPE_HANDLERS: dict[str, tuple[str, type[Any]]] = {
+    'FLAG_VALUE_TYPE_BOOL': ('boolValue', bool),
+    'FLAG_VALUE_TYPE_INT': ('intValue', int),
+    'FLAG_VALUE_TYPE_DOUBLE': ('doubleValue', float),
+    'FLAG_VALUE_TYPE_STRING': ('stringValue', str),
+}
+
+
+def _ValidFlagType(flag_type: str | None) -> bool:
+  """Returns True if the flag type is valid."""
+  return flag_type is not None and flag_type in FLAG_TYPE_MAP
+
+
+def _ParseFlagData(
+    flag_key: str,
+    unit_kind_name: str,
+    flag_definition: dict[str, Any],
+) -> dict[str, Any]:
+  """Parses a flag definition and returns a dict of fields to be set."""
+  log.debug(f'Flag definition:\n{pprint.pformat(flag_definition)}\n')
+
+  flag_type = flag_definition.get('flagType')
+  if not _ValidFlagType(flag_type):
+    raise exceptions.InvalidDataError(
+        f'Flag "{flag_key}" invalid. "{flag_type}" is not a supported flag'
+        ' type.'
+    )
+
+  value_type = FLAG_TYPE_MAP.get(flag_type)
+
+  default_value = flag_definition.get('defaultValue')
+  if default_value is None:
+    raise exceptions.InvalidDataError(
+        f'Flag "{flag_key}" invalid. "defaultValue" is not set.'
+    )
+
+  flag_dict = {
+      'key': flag_key,
+      'valueType': value_type,
+      'evaluationSpec': _GetDefaultEvaluationSpecDict(
+          default_value, value_type
+      ),
+      'unitKind': unit_kind_name,
+  }
+  if flag_definition.get('description'):
+    flag_dict['description'] = flag_definition['description']
+
+  return flag_dict
+
+
+def _GetDefaultEvaluationSpecDict(
+    default_value: str, value_type: str
+) -> dict[str, Any]:
+  """Returns the default evaluation spec for the given value type."""
+
+  if value_type not in VALUE_TYPE_HANDLERS:
+    raise exceptions.InvalidDataError(f'Unsupported value type: {value_type}')
+
+  variant_type, expected_type = VALUE_TYPE_HANDLERS[
+      value_type
+  ]
+  if not isinstance(default_value, expected_type):
+    raise exceptions.InvalidDataError(
+        f'Invalid default value "{default_value}" for type {value_type}.'
+        f' Expected type {expected_type.__name__} but got'
+        f' {type(default_value).__name__}.'
+    )
+
+  variant_dict = {
+      'name': 'default',
+  }
+  variant_dict[variant_type] = expected_type(default_value)
+
+  return {
+      'defaultTarget': 'default',
+      'variants': [variant_dict],
+  }
+
+
+def _GetFlagMessagesFromManifest(
+    manifest_json: dict[str, Any], unit_kind_name: str
+) -> list[ezmessages.Flag]:
+  """Parses a JSON manifest file and returns a list of flags."""
+
+  if 'flags' not in manifest_json:
+    raise exceptions.InvalidDataError(
+        'Manifest must have a top-level "flags" key.'
+    )
+
+  flags_data = manifest_json['flags']
+  if not isinstance(flags_data, dict):
+    raise exceptions.InvalidDataError('"flags" property is invalid.')
+
+  has_error = False
+  flags = []
+  for flag_key, flag_definition in flags_data.items():
+    try:
+      flag_dict = _ParseFlagData(flag_key, unit_kind_name, flag_definition)
+      flag_msg = msg_utils.DictToMessageWithErrorCheck(
+          flag_dict, ezmessages.Flag, throw_on_unexpected_fields=False
+      )
+      flags.append(flag_msg)
+    except (
+        rpclite_messages.ValidationError,
+        exceptions.InvalidDataError,
+    ) as e:
+      log.error(f'Failed to parse flag definition for flag "{flag_key}": {e!r}')
+      has_error = True
+
+  if has_error:
+    raise exceptions.InvalidDataError(
+        'Failed to parse some flags in the manifest.'
+    )
+
+  return flags
+
+
+def _GetValidFlags(
+    flags: list[ezmessages.Flag],
+    flags_service: ezclient.SaasservicemgmtV1beta1.ProjectsLocationsFlagsService,
+    parent: str,
+) -> list[ezmessages.Flag]:
+  """Returns a list of flags that are valid to create."""
+  valid_flags = []
+  validation_failed = False
+  for flag_msg in flags:
+    try:
+      _CreateFlag(flags_service, parent, flag_msg, validate_only=True)
+    except exceptions.HttpConflictError:
+      log.status.Print(f'Flag {flag_msg.key} already exists. Ignoring.')
+    except exceptions.HttpError as e:
+      _LogHttpError(e, flag_msg.key, log.error, 'Flag creation would fail')
+      validation_failed = True
+    except exceptions.InvalidDataError as e:
+      log.error(f'Flag creation would fail: {e}')
+      validation_failed = True
+    else:
+      valid_flags.append(flag_msg)
+
+  if validation_failed:
+    raise exceptions.InvalidDataError('Manifest file contains invalid flags')
+
+  return valid_flags
+
+
+def _IsFlagAlreadyExistsError(e: exceptions.HttpError) -> bool:
+  """Returns True if the error is due to a flag already existing."""
+  if not isinstance(e, exceptions.HttpError):
+    return False
+
+  if e.status_code != 400:
+    return False
+
+  try:
+    error_content = json.loads(e.content)
+    error_message = error_content.get('error', {}).get('message', '')
+    return 'already exists' in error_message
+  except json.JSONDecodeError:
+    return False
+
+
+def _GetExistingFlag(
+    flags_service: ezclient.SaasservicemgmtV1beta1.ProjectsLocationsFlagsService,
+    parent: str,
+    flag_key: str,
+) -> ezmessages.Flag | None:
+  """Gets a flag by its key."""
+  try:
+    get_request = ezmessages.SaasservicemgmtProjectsLocationsFlagsGetRequest(
+        name=f'{parent}/flags/{flag_key}'
+    )
+    return flags_service.Get(get_request)
+  except exceptions.HttpError as e:
+    _LogHttpError(e, flag_key, log.error, 'Failed to get existing flag')
+    return None
+
+
+def _CreateFlag(
+    flags_service: ezclient.SaasservicemgmtV1beta1.ProjectsLocationsFlagsService,
+    parent: str,
+    flag_msg: ezmessages.Flag,
+    validate_only: bool = False,
+) -> None:
+  """Creates a flag in the SaaS Runtime API."""
+  flags_create_req = (
+      ezmessages.SaasservicemgmtProjectsLocationsFlagsCreateRequest(
+          parent=parent,
+          flagId=flag_msg.key,
+          validateOnly=validate_only,
+          flag=flag_msg,
+      )
+  )
+  flags_create_req_dict = encoding.MessageToDict(flags_create_req)
+  if not validate_only:
+    log.status.Print(
+        f'\nAttempting to create flag:\n{pprint.pformat(flags_create_req_dict)}'
+    )
+
+  try:
+    # Note: base_api client has a retry mechanism built in.
+    flag_resp = flags_service.Create(flags_create_req)
+
+    if not validate_only:
+      log.status.Print(
+          '\nCreated flag:\n'
+          f'{pprint.pformat(encoding.MessageToDict(flag_resp))}'
+      )
+
+  except exceptions.HttpError as e:
+    if _IsFlagAlreadyExistsError(e):
+      existing_flag = _GetExistingFlag(flags_service, parent, flag_msg.key)
+      if existing_flag is None:
+        raise
+
+      log.debug(
+          f'\nFlag {flag_msg.key} already exists. Existing'
+          f' flag:\n{pprint.pformat(encoding.MessageToDict(existing_flag))}'
+      )
+
+      if existing_flag.valueType != flag_msg.valueType:
+        raise exceptions.InvalidDataError(
+            f'Flag {flag_msg.key} of type {flag_msg.valueType} already exists'
+            f' with different value type {existing_flag.valueType}'
+        ) from e
+      else:
+        raise exceptions.HttpConflictError(
+            e.response, e.content, e.url, e.method_config, e.request
+        )
+    else:
+      raise e
+
+
+def _LogHttpError(
+    e: exceptions.HttpError,
+    flag_key: str,
+    log_func: Callable[[str], None],
+    msg_prefix: str = '',
+):
+  """Logs an HTTP error."""
+  try:
+    error_content = json.loads(e.content)
+    error_message = error_content.get('error', {}).get(
+        'message', 'Unknown error'
+    )
+    error_code = error_content.get('error', {}).get('code', 'Unknown error')
+    log_func(f'{msg_prefix} {flag_key}: {error_code} : {error_message}')
+  except json.JSONDecodeError:
+    log_func(f'{msg_prefix} {flag_key}: {e.content}')
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+class Push(base.Command):
+  """Create SaaS Runtime Flags from a JSON manifest file."""
+
+  detailed_help = {
+      'brief': 'Create Flags from a JSON manifest file.',
+      'DESCRIPTION': """\
+          Creates Flags based on the contents of a provided JSON manifest file. Flags defined in the file
+          will be created. If a Flag already exists with the same type, it will be ignored. Otherwise,
+          the command will exit with an error.
+      """,
+      'EXAMPLES': """\
+          To create flags from a manifest file named `my_flags.json`:
+
+              $ {command} --file=my_flags.json --unit-kind=my-unit-kind
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for gcloud saas-runtime flags push: --file, --unit-kind."""
+    parser.add_argument(
+        '--file',
+        type=arg_parsers.FileContents(),
+        required=True,
+        help=(
+            'Path to the JSON manifest file containing the flag definitions.'
+            ' The manifest file must conform to the OpenFeature CLI flag'
+            ' manifest schema.'
+        ),
+    )
+
+    # This also implicitly adds the --location flag.
+    arg_utils.AddUnitKindArgToParser(
+        parser,
+        required=True,
+        help_text='UnitKind to push all the flags in the manifest file to.',
+    )
+
+  def Run(self, args):
+    """Execute the gcloud saas-runtime flags push command."""
+
+    project = properties.VALUES.core.project.Get()
+    unit_kind_ref = args.CONCEPTS.unit_kind.Parse()
+    parent = unit_kind_ref.Parent().RelativeName()
+
+    log.debug(f'--project={project}')
+    log.debug(f'--location={args.location}')
+    log.debug(f'--unit-kind={args.unit_kind}')
+    log.debug(f'Parent reference: {unit_kind_ref.Parent()}')
+    log.debug(f'Parent relative name: {parent}')
+    log.debug(f'UnitKind Name: {unit_kind_ref.Name()}')
+    log.debug(f'UnitKind RelativeName: {unit_kind_ref.RelativeName()}')
+
+    client = saasservicemgmt_util.GetV1Beta1ClientInstance()
+    flags_service = client.projects_locations_flags
+
+    # Parse the manifest file.
+    try:
+      manifest = json.loads(args.file)
+    except json.JSONDecodeError as e:
+      raise calliope_exceptions.ToolException(
+          f'Failed to parse JSON: {e}'
+      ) from e
+
+    # Validate the manifest file.
+    try:
+      flags = _GetFlagMessagesFromManifest(
+          manifest, unit_kind_ref.RelativeName()
+      )
+    except exceptions.InvalidDataError as e:
+      raise calliope_exceptions.ToolException(
+          f'Failed to parse flags: {e}'
+      ) from e
+
+    # Validate the flags.
+    log.status.Print(f'Found {len(flags)} flags in manifest. Validating...')
+    try:
+      valid_flags = _GetValidFlags(flags, flags_service, parent)
+    except exceptions.InvalidDataError as e:
+      raise calliope_exceptions.ToolException(
+          f'No flags were created: {e}'
+      ) from e
+
+    # Create the flags.
+    if not valid_flags:
+      log.status.Print('No valid flags to create. No flags were created.')
+      return
+
+    log.status.Print(
+        'All flags validated successfully. Creating'
+        f' {len(valid_flags)} flags...'
+    )
+
+    for flag_msg in valid_flags:
+      try:
+        _CreateFlag(flags_service, parent, flag_msg, validate_only=False)
+      except exceptions.HttpError as e:
+        _LogHttpError(e, flag_msg.key, log.error, 'Failed to create flag')
+        raise calliope_exceptions.ToolException(
+            f'Halting execution due to post-validation error: {e}'
+        ) from e
+
+    log.status.Print(f'{len(valid_flags)} flags created successfully.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/__init__.py

@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The flags releases command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+class SaasFlagsReleases(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime Flags Releases.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/create.yaml

@@ -0,0 +1,83 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Create Flag Release
+    description: Create a Flag Release.
+    examples: |-
+      To create a Flag Release, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        ID of the Flag Release:
+
+          "projects/{project}/locations/{location}/flagReleases/{flag_release_id}"
+
+        This follows the standard Google Cloud naming scheme (URI).
+      is_positional: true
+      request_id_field: flagReleaseId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_release
+      required: true
+      repeated: false
+
+    - arg_name: flag-revisions
+      help_text: |-
+        Flag Revisions (IDs) to be rolled out. This is the ultimate source of truth
+        of what a Rollout or a UnitOperation carries.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_revision
+      resource_method_params:
+        flagRelease.flagRevisions: '{__relative_name__}'
+      required: false
+      repeated: true
+
+    - arg_name: obsolete-flags
+      help_text: |-
+        Flags (IDs) to be removed from the given UnitKind and all the related Units.
+        If Flag (ID) is provided here, its Flag Revisions will be removed from the
+        UnitKind and Units.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      resource_method_params:
+        flagRelease.obsoleteFlags: '{__relative_name__}'
+      required: false
+      repeated: true
+
+    - arg_name: unit-kind
+      help_text: |-
+        UnitKind (ID) this Flag Release applies to.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        flagRelease.unitKind: '{__relative_name__}'
+      required: true
+      repeated: false
+
+    - arg_name: labels
+      api_field: flagRelease.labels
+      required: false
+      repeated: true
+      help_text: |-
+        Labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flagRelease.annotations
+      required: false
+      repeated: true
+      help_text: |-
+        Unstructured key-value map stored with a resource that may be set by
+        external tools to store and retrieve arbitrary metadata. Annotations
+        are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagReleases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/delete.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Delete Flag Release
+    description: Delete a Flag Release
+    examples: |-
+      To delete a Flag Release, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Release ID of the Flag Release to delete.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_release
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagReleases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/describe.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Describe Flag Revision
+    description: Describe a Flag Release
+    examples: |-
+      To describe a Flag Release, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Release ID of the Flag Release to describe.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_release
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagReleases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/list.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: List Flags Releases
+    description: List Flags Releases
+    examples: |-
+      To list all Flags Releases, run:
+
+          $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Location in which to list Flag Releases.
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagReleases
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/releases/update.yaml

@@ -0,0 +1,53 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Update Flag Release
+    description: Update a Flag Release
+    examples: |-
+      To update a Flag Release, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        ID of the Flag Release:
+
+          "projects/{project}/locations/{location}/flagReleases/{flag_release_id}"
+
+        This follows the standard Google Cloud naming scheme (URI).
+      is_positional: true
+      request_id_field: flagReleaseId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_release
+      required: true
+
+    - arg_name: labels
+      api_field: flagRelease.labels
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flagRelease.annotations
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        Unstructured key-value map stored with a resource that may be set by
+        external tools to store and retrieve arbitrary metadata. Annotations
+        are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagReleases
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/__init__.py

@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The flags revisions command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+class SaasFlagsRevisions(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime flags revisions.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/create.yaml

@@ -0,0 +1,59 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Create Flag Revision
+    description: Create a Flag Revision.
+    examples: |-
+      To create a Flag Revision, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Revision ID. Google Cloud resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/flagRevisions/{flag_revision_id}"
+      is_positional: true
+      request_id_field: flagRevisionId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_revision
+      required: true
+      repeated: false
+
+    - arg_name: flag
+      help_text: |-
+        Name (ID) of the Flag this is a revision of.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      resource_method_params:
+        flagRevision.flag: '{__relative_name__}'
+      required: true
+      repeated: false
+
+    - arg_name: labels
+      api_field: flagRevision.labels
+      required: false
+      repeated: true
+      help_text: |-
+        Labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flagRevision.annotations
+      required: false
+      repeated: true
+      help_text: |-
+        Annotations is an unstructured key-value map stored with a resource that
+        may be set by external tools to store and retrieve arbitrary metadata.
+        They are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagRevisions

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/delete.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Delete Flag Revision
+    description: Delete a Flag Revision
+    examples: |-
+      To delete a Flag Revision, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Revision ID of the Flag Revision to delete.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_revision
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagRevisions

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/describe.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Describe Flag Revision
+    description: Describe a Flag Revision
+    examples: |-
+      To describe a Flag Revision, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Revision ID of the Flag Revision to describe.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_revision
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagRevisions

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/list.yaml

@@ -0,0 +1,21 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: List Flags Revisions
+    description: List Flags Revisions
+    examples: |-
+      To list Flags Revisions, run:
+
+          $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListFlagRevisionsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagRevisions
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/revisions/update.yaml

@@ -0,0 +1,52 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Update Flag Revision
+    description: Update a Flag Revision.
+    examples: |-
+      To update Flag Revision, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Flag Revision ID. Google Cloud resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/flagRevisions/{flag_revision_id}"
+      is_positional: true
+      request_id_field: flagRevisionId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_revision
+      required: true
+
+    - arg_name: labels
+      api_field: flagRevision.labels
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flagRevision.annotations
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        Annotations is an unstructured key-value map stored with a resource that
+        may be set by external tools to store and retrieve arbitrary metadata.
+        They are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flagRevisions
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/flags/update.yaml

@@ -0,0 +1,86 @@
+- release_tracks:
+  - ALPHA
+  hidden: true
+  help_text:
+    brief: Update Flag
+    description: Update a Flag
+    examples: |-
+      To update a Flag, run:
+
+          $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        ID of the Flag:
+
+          "projects/{project}/locations/{location}/flags/{flag_id}"
+
+        This follows the standard Google Cloud naming scheme (URI).
+      is_positional: true
+      request_id_field: flagId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag
+      required: true
+
+    - arg_name: evaluation-spec
+      api_field: flag.evaluationSpec
+      clearable: true
+      help_text: |-
+        Specification of how the Flag value should be evaluated.
+      is_positional: false
+      required: false
+      repeated: false
+      spec:
+      - api_field: defaultTarget
+        help_text: |-
+          Default variant for the flag.
+      - api_field: variants
+        help_text: |-
+          A list of variants.
+          Variant is an identifier for a value (name assigned to a value).
+        spec:
+        - api_field: name
+          help_text: |-
+            Name of the variant.
+            Max length: 128 bytes.
+        - api_field: boolValue
+          help_text: |-
+            Value is a single flag value for the variant.
+
+    - arg_name: description
+      api_field: flag.description
+      clearable: true
+      required: false
+      help_text: |-
+        A description of the flag. Max length: 500 bytes.
+      is_positional: false
+
+    - arg_name: labels
+      api_field: flag.labels
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+      spec:
+      - api_field: key
+      - api_field: value
+
+    - arg_name: annotations
+      api_field: flag.annotations
+      clearable: true
+      required: false
+      repeated: true
+      help_text: |-
+        Unstructured key-value map stored with a resource that may be set by
+        external tools to store and retrieve arbitrary metadata. Annotations
+        are not queryable and should be preserved when modifying objects.
+      spec:
+      - api_field: key
+      - api_field: value
+
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.flags
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The releases command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime releases.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/create.yaml

@@ -0,0 +1,86 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Release
+    description: Create a Release
+    examples: |-
+      To create the Release, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/releases/{release}"
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: releaseId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      required: true
+    - arg_name: unit-kind
+      help_text: |-
+        Reference to the UnitKind this Release corresponds to (required and
+        immutable once created).
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        release.unitKind: '{__relative_name__}'
+      required: true
+    - group:
+        api_field: release.blueprint
+        required: true
+        help_text: |-
+          Blueprints are OCI Images that contain all of the artifacts needed to
+          provision a unit. Metadata such as, type of the engine used to actuate the
+          blueprint (e.g. terraform, helm etc) and version will come from the image
+          manifest. If the hostname is omitted, it will be assumed to be the regional
+          path to Artifact Registry (eg. us-east1-docker.pkg.dev).
+        params:
+        - arg_name: blueprint-package
+          api_field: release.blueprint.package
+          required: true
+          repeated: false
+          help_text: |-
+            URI to a blueprint used by the Unit.
+    - arg_name: upgradeable-from-releases
+      api_field: release.releaseRequirements.upgradeableFromReleases
+      required: false
+      repeated: true
+      help_text: |-
+        A list of releases from which a unit can be upgraded to this one
+        (optional). If left empty no constraints will be applied. When provided,
+        unit upgrade requests to this release will check and enforce this
+        constraint.
+    - arg_name: input-variable-defaults
+      api_field: release.inputVariableDefaults
+      required: false
+      repeated: true
+      help_text: |-
+        Mapping of input variables to default values. Maximum 100
+      spec:
+      - api_field: variable
+        help_text: |-
+          Name of the variable from actuation configs.
+      - api_field: type
+        help_text: |-
+          Name of a supported variable type. Supported types are string, int, bool.
+      - api_field: value
+        help_text: |-
+          String encoded value for the variable.
+    - arg_name: labels
+      api_field: release.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.releases
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.releases:AddParentToUpgradeableFromReleases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Release
+    description: Delete a Release
+    examples: |-
+      To delete the release, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.releases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Release
+    description: Describe a Release
+    examples: |-
+      To describe the Release, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.releases

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List releases
+    description: List releases
+    examples: |-
+      To list releases in us-central1, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListReleasesRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.releases
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/releases/update.yaml

@@ -0,0 +1,64 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Release
+    description: Update a Release
+    examples: |-
+      To update the Release, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/releases/{release}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      required: true
+    - arg_name: upgradeable-from-releases
+      api_field: release.releaseRequirements.upgradeableFromReleases
+      required: false
+      repeated: true
+      help_text: |-
+        A list of releases from which a unit can be upgraded to this one
+        (optional). If left empty no constraints will be applied. When provided,
+        unit upgrade requests to this release will check and enforce this
+        constraint.
+      clearable: true
+    - arg_name: input-variable-defaults
+      api_field: release.inputVariableDefaults
+      required: false
+      repeated: true
+      help_text: |-
+        Mapping of input variables to default values. Maximum 100
+      clearable: true
+      spec:
+      - api_field: variable
+        help_text: |-
+          Name of the variable from actuation configs.
+      - api_field: type
+        help_text: |-
+          Name of a supported variable type. Supported types are string, int, bool.
+      - api_field: value
+        help_text: |-
+          String encoded value for the variable.
+    - arg_name: labels
+      api_field: release.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.releases
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.releases:AddParentToUpgradeableFromReleases
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The rollout-kinds command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime rollout-kinds.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/create.yaml

@@ -0,0 +1,101 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Rollout Kind
+    description: Create a Rollout Kind
+    examples: |-
+      To create the Rollout Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - group:
+        mutex: true
+        help_text: |-
+          Arguments for the  error budget.
+        params:
+        - group:
+            api_field: rolloutKind.errorBudget
+            required: false
+            help_text: |-
+              The configuration for error budget. If the number of failed units exceeds
+              max(allowed_count, allowed_ratio * total_units), the rollout will be paused.
+            params:
+            - arg_name: error-budget-allowed-count
+              api_field: rolloutKind.errorBudget.allowedCount
+              required: false
+              repeated: false
+              type: int
+              help_text: |-
+                The maximum number of failed units allowed in a location without pausing
+                the rollout.
+            - arg_name: error-budget-allowed-percentage
+              api_field: rolloutKind.errorBudget.allowedPercentage
+              required: false
+              repeated: false
+              type: int
+              help_text: |-
+                The maximum percentage of units allowed to fail (0, 100] within a location
+                without pausing the rollout.
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/rolloutKinds/{rollout_kind_id}"
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: rolloutKindId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout_kind
+      required: true
+    - arg_name: unit-kind
+      required: true
+      repeated: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        rolloutKind.unitKind: '{__relative_name__}'
+      help_text: |-
+        UnitKind that this rollout kind corresponds to. Rollouts stemming from this
+        rollout kind will target the units of this unit kind. In other words, this
+        defines the population of target units to be upgraded by rollouts.
+    - arg_name: rollout-orchestration-strategy
+      api_field: rolloutKind.rolloutOrchestrationStrategy
+      required: false
+      repeated: false
+      help_text: |-
+        The strategy to use for executing rollouts.
+    - arg_name: unit-filter
+      api_field: rolloutKind.unitFilter
+      required: false
+      repeated: false
+      help_text: |-
+        CEL(https://github.com/google/cel-spec) formatted filter string against Unit. The filter
+        will be applied to determine the eligible unit population. This filter can only reduce, but
+        not expand the scope of the rollout.
+    - arg_name: update-unit-kind-strategy
+      api_field: rolloutKind.updateUnitKindStrategy
+      required: false
+      help_text: |-
+        The config for updating the unit kind. By default, the unit kind will be
+        updated on the rollout start.
+      choices:
+      - arg_value: on-start
+        enum_value: UPDATE_UNIT_KIND_STRATEGY_ON_START
+        help_text: |-
+          Update the unit kind strategy on the rollout start.
+      - arg_value: never
+        enum_value: UPDATE_UNIT_KIND_STRATEGY_NEVER
+        help_text: |-
+          Never update the unit kind.
+    - arg_name: labels
+      api_field: rolloutKind.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rolloutKinds

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Rollout Kind
+    description: Delete a Rollout Kind
+    examples: |-
+      To delete the Rollout Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout_kind
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rolloutKinds

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe Rollout Kind
+    description: Describe a Rollout Kind
+    examples: |-
+      To describe the Rollout Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout_kind
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rolloutKinds

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Rollout Kinds
+    description: List Rollout Kinds
+    examples: |-
+      To list all Rollout Kinds, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListRolloutKindsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rolloutKinds
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollout_kinds/update.yaml

@@ -0,0 +1,94 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Rollout Kind
+    description: Update a Rollout Kind
+    examples: |-
+      To update the Rollout Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - group:
+        mutex: true
+        help_text: |-
+          Arguments for the  error budget.
+        params:
+        - group:
+            api_field: rolloutKind.errorBudget
+            arg_name: error-budget
+            clearable: true
+            required: false
+            help_text: |-
+              The configuration for error budget. If the number of failed units exceeds
+              max(allowed_count, allowed_ratio * total_units), the rollout will be paused.
+            params:
+            - arg_name: error-budget-allowed-count
+              api_field: rolloutKind.errorBudget.allowedCount
+              required: false
+              repeated: false
+              type: int
+              help_text: |-
+                The maximum number of failed units allowed in a location without pausing
+                the rollout.
+            - arg_name: error-budget-allowed-percentage
+              api_field: rolloutKind.errorBudget.allowedPercentage
+              required: false
+              repeated: false
+              type: int
+              help_text: |-
+                The maximum percentage of units allowed to fail (0, 100] within a location
+                without pausing the rollout.
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/rolloutKinds/{rollout_kind_id}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout_kind
+      required: true
+    - arg_name: rollout-orchestration-strategy
+      api_field: rolloutKind.rolloutOrchestrationStrategy
+      required: false
+      repeated: false
+      help_text: |-
+        The strategy to use for executing rollouts.
+    - arg_name: unit-filter
+      api_field: rolloutKind.unitFilter
+      required: false
+      repeated: false
+      help_text: |-
+        CEL(https://github.com/google/cel-spec) formatted filter string against Unit. The filter
+        will be applied to determine the eligible unit population. This filter can only reduce, but
+        not expand the scope of the rollout.
+    - arg_name: update-unit-kind-strategy
+      api_field: rolloutKind.updateUnitKindStrategy
+      required: false
+      help_text: |-
+        The config for updating the unit kind. By default, the unit kind will be
+        updated on the rollout start.
+      choices:
+      - arg_value: on-start
+        enum_value: UPDATE_UNIT_KIND_STRATEGY_ON_START
+        help_text: |-
+          Update the unit kind strategy on the rollout start.
+      - arg_value: never
+        enum_value: UPDATE_UNIT_KIND_STRATEGY_NEVER
+        help_text: |-
+          Never update the unit kind.
+    - arg_name: labels
+      api_field: rolloutKind.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rolloutKinds
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The rollouts command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime rollouts.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/create.yaml

@@ -0,0 +1,137 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Rollout
+    description: Create a Rollout
+    examples: |-
+      To create the Rollout, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/rollout/{rollout_id}"
+      is_positional: true
+      is_primary_resource: true
+      request_id_field: rolloutId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      required: true
+    - group:
+        mutex: true
+        required: true
+        params:
+        - arg_name: release
+          help_text: |-
+            Name of the Release that gets rolled out to target Units.
+            Required if no other type of release is specified.
+          is_positional: false
+          is_primary_resource: false
+          resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+          resource_method_params:
+            rollout.release: '{__relative_name__}'
+          required: false
+        - arg_name: flag-release
+          help_text: |-
+            Name of the Flag Release that gets rolled out to target Units.
+            Required if no other type of release is specified.
+          is_positional: false
+          is_primary_resource: false
+          release_tracks: [ALPHA]
+          resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:flag_release
+          resource_method_params:
+            rollout.flagRelease: '{__relative_name__}'
+          required: false
+    - arg_name: rollout-orchestration-strategy
+      api_field: rollout.rolloutOrchestrationStrategy
+      required: false
+      repeated: false
+      help_text: |-
+        The strategy to use for executing this rollout. If not provided, the
+        strategy from Rollout Type will be used.
+    - arg_name: unit-filter
+      api_field: rollout.unitFilter
+      required: false
+      repeated: false
+      help_text: |-
+        CEL(https://github.com/google/cel-spec) formatted filter string against
+        Unit. The filter will be applied to determine the eligible unit population.
+        This filter can only reduce, but not expand the scope of the rollout. If
+        not provided, the unit_filter from the RolloutType will be used.
+    - arg_name: rollout-kind
+      help_text: |-
+        Name of the RolloutKind this rollout is stemming from and adhering to.
+      is_positional: false
+      is_primary_resource: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout_kind
+      resource_method_params:
+        rollout.rolloutKind: '{__relative_name__}'
+      required: false
+    - group:
+        api_field: rollout.control
+        required: false
+        help_text: |-
+          RolloutControl provides a way to request a change to the execution of a
+          Rollout by pausing or canceling it.
+        params:
+        - group:
+            mutex: true
+            help_text: |-
+              Arguments for the action params.
+            params:
+            - group:
+                api_field: rollout.control.runParams
+                required: false
+                help_text: |-
+                  Parameters for the RUN action controlling the behavior of the rollout
+                  when it is resumed from a PAUSED state.
+                params:
+                - arg_name: retry-failed-operations
+                  api_field: rollout.control.runParams.retryFailedOperations
+                  action: store_true_false
+                  required: true
+                  type: bool
+                  help_text: |-
+                    If true, the rollout will retry failed operations when resumed.
+                    This is applicable only the current state of the Rollout is PAUSED and
+                    the requested action is RUN.
+        - arg_name: control-action
+          api_field: rollout.control.action
+          required: true
+          help_text: |-
+            Action to be performed on the Rollout.
+            The default behavior is to run the rollout until it naturally reaches a
+            terminal state.
+          choices:
+          - arg_value: run
+            enum_value: ROLLOUT_ACTION_RUN
+            help_text: |-
+              Run the Rollout until it naturally reaches a terminal state.
+              A rollout requested to run will progress through all natural Rollout
+              States (such as RUNNING -> SUCCEEDED or RUNNING -> FAILED).
+              If retriable errors are encountered during the rollout, the rollout
+              will paused by default and can be resumed by re-requesting this RUN
+              action.
+          - arg_value: pause
+            enum_value: ROLLOUT_ACTION_PAUSE
+            help_text: |-
+              Pause the Rollout until it is resumed (i.e. RUN is requested).
+          - arg_value: cancel
+            enum_value: ROLLOUT_ACTION_CANCEL
+            help_text: |-
+              Cancel the Rollout permanently.
+    - arg_name: labels
+      api_field: rollout.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rollouts

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Rollout
+    description: Delete a Rollout
+    examples: |-
+      To delete the Rollout, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rollouts

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Rollout
+    description: Describe a Rollout
+    examples: |-
+      To describe the Rollout, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rollouts

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Rollouts
+    description: List Rollouts
+    examples: |-
+      To list all Rollouts, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListRolloutsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rollouts
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/rollouts/update.yaml

@@ -0,0 +1,107 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Rollout
+    description: Update a Rollout
+    examples: |-
+      To update the Rollout, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/rollout/{rollout_id}"
+      is_positional: true
+      is_primary_resource: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      required: true
+    - arg_name: rollout-orchestration-strategy
+      api_field: rollout.rolloutOrchestrationStrategy
+      required: false
+      repeated: false
+      help_text: |-
+        The strategy to use for executing this rollout. If not provided, the
+        strategy from Rollout Type will be used.
+    - arg_name: unit-filter
+      api_field: rollout.unitFilter
+      required: false
+      repeated: false
+      help_text: |-
+        CEL(https://github.com/google/cel-spec) formatted filter string against
+        Unit. The filter will be applied to determine the eligible unit population.
+        This filter can only reduce, but not expand the scope of the rollout. If
+        not provided, the unit_filter from the RolloutType will be used.
+    - group:
+        api_field: rollout.control
+        arg_name: control
+        clearable: true
+        required: false
+        help_text: |-
+          RolloutControl provides a way to request a change to the execution of a
+          Rollout by pausing or canceling it.
+        params:
+        - group:
+            mutex: true
+            help_text: |-
+              Arguments for the action params.
+            params:
+            - group:
+                api_field: rollout.control.runParams
+                required: false
+                help_text: |-
+                  Parameters for the RUN action controlling the behavior of the rollout
+                  when it is resumed from a PAUSED state.
+                params:
+                - arg_name: retry-failed-operations
+                  api_field: rollout.control.runParams.retryFailedOperations
+                  action: store_true_false
+                  required: false
+                  type: bool
+                  help_text: |-
+                    If true, the rollout will retry failed operations when resumed.
+                    This is applicable only the current state of the Rollout is PAUSED and
+                    the requested action is RUN.
+        - arg_name: control-action
+          api_field: rollout.control.action
+          required: false
+          help_text: |-
+            Action to be performed on the Rollout.
+            The default behavior is to run the rollout until it naturally reaches a
+            terminal state.
+          choices:
+          - arg_value: run
+            enum_value: ROLLOUT_ACTION_RUN
+            help_text: |-
+              Run the Rollout until it naturally reaches a terminal state.
+              A rollout requested to run will progress through all natural Rollout
+              States (such as RUNNING -> SUCCEEDED or RUNNING -> FAILED).
+              If retriable errors are encountered during the rollout, the rollout
+              will paused by default and can be resumed by re-requesting this RUN
+              action.
+          - arg_value: pause
+            enum_value: ROLLOUT_ACTION_PAUSE
+            help_text: |-
+              Pause the Rollout until it is resumed (i.e. RUN is requested).
+          - arg_value: cancel
+            enum_value: ROLLOUT_ACTION_CANCEL
+            help_text: |-
+              Cancel the Rollout permanently.
+    - arg_name: labels
+      api_field: rollout.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.rollouts
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The saas-types command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime saas.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/create.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a SaaS
+    description: Create a SaaS
+    examples: |-
+      To create a new SaaS, run:
+
+      $ {command} saas --locations=name=us-central2 --locations=name=europe-west1
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/saas/{saas}"
+      is_positional: true
+      request_id_field: saasId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      required: true
+    - arg_name: locations
+      api_field: saas.locations
+      required: true
+      repeated: true
+      help_text: |-
+        List of locations that the service is available in. Rollout refers to the
+        list to generate a rollout plan.
+      spec:
+      - api_field: name
+        help_text: |-
+          Name of location.
+    - arg_name: labels
+      api_field: saas.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.saas

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a SaaS
+    description: Delete a SaaS
+    examples: |-
+      To delete the SaaS, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the resource within a service.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.saas

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a SaaS
+    description: Describe a SaaS
+    examples: |-
+      To describe the SaaS, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the resource within a service.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.saas

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List SaaS
+    description: List SaaS
+    examples: |-
+      To list all Saas Types, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        The parent of the saas type.
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.saas
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/saas/update.yaml

@@ -0,0 +1,46 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a SaaS
+    description: Update a SaaS
+    examples: |-
+      To update the SaaS, run:
+
+      $ {command} my-saas
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/saas/{saas}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      required: true
+    - arg_name: locations
+      api_field: saas.locations
+      clearable: true
+      repeated: true
+      help_text: |-
+        List of locations that the service is available in. Rollout refers to the
+        list to generate a rollout plan.
+      spec:
+      - api_field: name
+        help_text: |-
+          Name of location. Example flag usage: --locations=name=us-central1
+    - arg_name: labels
+      api_field: saas.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.saas
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The tenants command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime tenants.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/create.yaml

@@ -0,0 +1,49 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Tenant
+    description: Create a Tenant
+    examples: |-
+      To create the Tenant, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/tenants/{tenant}"
+      is_positional: true
+      request_id_field: tenantId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      required: true
+    - arg_name: saas
+      help_text: |-
+        A reference to the Saas that defines the product (managed service) that
+        the producer wants to manage with SaaS Runtime. Part of the
+        SaaS Runtime common data model.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      resource_method_params:
+        tenant.saas: '{__relative_name__}'
+      required: true
+    - arg_name: consumer-resource
+      api_field: tenant.consumerResource
+      required: false
+      repeated: false
+      help_text: |-
+        A reference to the consumer resource this SaaS Tenant is representing.
+    - arg_name: labels
+      api_field: tenant.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.tenants

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Tenant
+    description: Delete a Tenant
+    examples: |-
+      To delete the Tenant, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.tenants

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Tenant
+    description: Describe a Tenant
+    examples: |-
+      To describe the Tenant, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.tenants

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Tenants
+    description: List Tenants
+    examples: |-
+      To list all Tenants, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListTenantsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.tenants
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/tenants/update.yaml

@@ -0,0 +1,35 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update tenants
+    description: Update a tenant
+    examples: |-
+      To update the tenant, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/tenants/{tenant}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      required: true
+    - arg_name: labels
+      api_field: tenant.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.tenants
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The unit-kinds command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime unit-kinds.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/create.yaml

@@ -0,0 +1,143 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Unit Kind
+    description: Create a Unit Kind
+    examples: |-
+      To create the Unit Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/unitKinds/{unitKind}"
+      is_positional: true
+      request_id_field: unitKindId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      required: true
+    - arg_name: default-release
+      help_text: |-
+        A reference to the Release object to use as default for creating new units
+        of this Unit Kind (optional).
+
+        If not specified, a new unit must explicitly reference which release to use
+        for its creation.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      resource_method_params:
+        unitKind.defaultRelease: '{__relative_name__}'
+      required: false
+    - arg_name: saas
+      help_text: |-
+        A reference to the Saas that defines the product (managed service) that
+        the producer wants to manage with Saas Runtime. Immutable once set.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      resource_method_params:
+        unitKind.saas: '{__relative_name__}'
+      required: true
+    - arg_name: dependencies
+      api_field: unitKind.dependencies
+      required: false
+      repeated: true
+      help_text: |-
+        List of other unit kinds that this release will depend on. Dependencies
+        will be automatically provisioned if not found. Maximum 10.
+      spec:
+      - api_field: unitKind
+        resource_pattern: projects/{project}/locations/{location}/unitKinds/{unitKind}
+        help_text: |-
+          The unit kind of the dependency.
+      - api_field: alias
+        help_text: |-
+          An alias for the dependency. Used for input variable mapping.
+    - arg_name: input-variable-mappings
+      api_field: unitKind.inputVariableMappings
+      required: false
+      repeated: true
+      help_text: |-
+        List of inputVariables for this release that will either be retrieved from
+        a dependency's outputVariables, or will be passed on to a dependency's
+        inputVariables. Maximum 100.
+      spec:
+      - api_field: variable
+        help_text: |-
+          name of the variable
+      - json_name: from
+        api_field: from_
+        help_text: |-
+          Output variables which will get their values from dependencies
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the outputVariable will pass its value to
+        - api_field: outputVariable
+          help_text: |-
+            Name of the outputVariable on the dependency
+      - api_field: to
+        help_text: |-
+          Input variables whose values will be passed on to dependencies.
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the inputVariable will pass its value to
+        - api_field: inputVariable
+          help_text: |-
+            Name of the inputVariable on the dependency
+        - api_field: ignoreForLookup
+          help_text: |-
+            Indicates if this mapping should be used during lookup or not
+    - arg_name: output-variable-mappings
+      api_field: unitKind.outputVariableMappings
+      required: false
+      repeated: true
+      help_text: |-
+        List of inputVariables for this release that will either be retrieved from
+        a dependency's outputVariables, or will be passed on to a dependency's
+        inputVariables. Maximum 100.
+      spec:
+      - api_field: variable
+        help_text: |-
+          name of the variable
+      - json_name: from
+        api_field: from_
+        help_text: |-
+          Output variables which will get their values from dependencies
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the outputVariable will pass its value to
+        - api_field: outputVariable
+          help_text: |-
+            Name of the outputVariable on the dependency
+      - api_field: to
+        help_text: |-
+          Input variables whose values will be passed on to dependencies.
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the inputVariable will pass its value to
+        - api_field: inputVariable
+          help_text: |-
+            Name of the inputVariable on the dependency
+        - api_field: ignoreForLookup
+          help_text: |-
+            Indicates if this mapping should be used during lookup or not
+    - arg_name: labels
+      api_field: unitKind.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitKinds
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.unit_kinds:AddParentToDependencies

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Unit Kind
+    description: Delete a Unit Kind
+    examples: |-
+      To delete the Unit Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitKinds

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Unit Kind
+    description: Describe a Unit Kind
+    examples: |-
+      To describe the Unit Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitKinds

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Unit Kinds
+    description: List Unit Kinds
+    examples: |-
+      To list all Unit Kinds, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListUnitKindsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitKinds
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_kinds/update.yaml

@@ -0,0 +1,149 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Unit Kind
+    description: Update a Unit Kind
+    examples: |-
+      To update the Unit Kind, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/unitKinds/{unitKind}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      required: true
+    - arg_name: default-release
+      help_text: |-
+        A reference to the Release object to use as default for creating new units
+        of this Unit Kind.
+
+        If not specified, a new unit must explicitly reference which release to use
+        for its creation.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+      resource_method_params:
+        unitKind.defaultRelease: '{__relative_name__}'
+      required: false
+      clearable: true
+    - arg_name: saas
+      help_text: |-
+        A reference to the Saas that defines the product (managed service) that
+        the producer wants to manage with Saas Runtime. Immutable once set.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:saas
+      resource_method_params:
+        unitKind.saas: '{__relative_name__}'
+      required: false
+      clearable: false
+    - arg_name: dependencies
+      api_field: unitKind.dependencies
+      required: false
+      repeated: true
+      help_text: |-
+        List of other unit kinds that this release will depend on. Dependencies
+        will be automatically provisioned if not found. Maximum 10.
+      clearable: true
+      spec:
+      - api_field: unitKind
+        resource_pattern: projects/{project}/locations/{location}/unitKinds/{unitKind}
+        help_text: |-
+          The unit kind of the dependency.
+      - api_field: alias
+        help_text: |-
+          An alias for the dependency. Used for input variable mapping.
+    - arg_name: input-variable-mappings
+      api_field: unitKind.inputVariableMappings
+      required: false
+      repeated: true
+      help_text: |-
+        List of inputVariables for this release that will either be retrieved from
+        a dependency's outputVariables, or will be passed on to a dependency's
+        inputVariables. Maximum 100.
+      clearable: true
+      spec:
+      - api_field: variable
+        help_text: |-
+          name of the variable
+      - json_name: from
+        api_field: from_
+        help_text: |-
+          Output variables which will get their values from dependencies
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the outputVariable will pass its value to
+        - api_field: outputVariable
+          help_text: |-
+            Name of the outputVariable on the dependency
+      - api_field: to
+        help_text: |-
+          Input variables whose values will be passed on to dependencies.
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the inputVariable will pass its value to
+        - api_field: inputVariable
+          help_text: |-
+            Name of the inputVariable on the dependency
+        - api_field: ignoreForLookup
+          help_text: |-
+            Tells SaaS Runtime if this mapping should be used during lookup or not
+    - arg_name: output-variable-mappings
+      api_field: unitKind.outputVariableMappings
+      required: false
+      repeated: true
+      help_text: |-
+        List of outputVariables for this unit kind will be passed to this unit's
+        outputVariables. Maximum 100.
+      clearable: true
+      spec:
+      - api_field: variable
+        help_text: |-
+          name of the variable
+      - json_name: from
+        api_field: from_
+        help_text: |-
+          Output variables which will get their values from dependencies
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the outputVariable will pass its value to
+        - api_field: outputVariable
+          help_text: |-
+            Name of the outputVariable on the dependency
+      - api_field: to
+        help_text: |-
+          Input variables whose values will be passed on to dependencies.
+        spec:
+        - api_field: dependency
+          help_text: |-
+            Alias of the dependency that the inputVariable will pass its value to
+        - api_field: inputVariable
+          help_text: |-
+            Name of the inputVariable on the dependency
+        - api_field: ignoreForLookup
+          help_text: |-
+            Tells SaaS Runtime if this mapping should be used during lookup or not
+    - arg_name: labels
+      api_field: unitKind.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitKinds
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.unit_kinds:AddParentToDependencies
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The unit-operations command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime unit-operations.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/create.yaml

@@ -0,0 +1,181 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Unit Operation
+    description: Create a Unit Operation
+    examples: |-
+      To create the Unit Operation, run:
+
+      $ {command}
+  arguments:
+    params:
+    - group:
+        mutex: true
+        help_text: |-
+          Arguments for the unit operation type.
+        params:
+        - group:
+            required: false
+            help_text: |-
+              Provision is the unit operation that provision the underlying resources
+              represented by a Unit. Can only execute if the Unit is not currently
+              provisioned.
+            params:
+            - arg_name: provision
+              help_text: |-
+                This flag can be used to specify an empty provision operation.
+              is_positional: false
+              required: false
+              type: bool
+            - arg_name: provision-release
+              help_text: |-
+                Reference to the Release object to use for the Unit. (optional).
+              is_positional: false
+              resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+              resource_method_params:
+                unitOperation.provision.release: '{__relative_name__}'
+            - arg_name: provision-input-variables
+              api_field: unitOperation.provision.inputVariables
+              required: false
+              repeated: true
+              help_text: |-
+                Set of input variables. Maximum 100. (optional)
+              spec:
+              - api_field: variable
+                help_text: |-
+                  Name of the variable from actuation configs.
+              - api_field: type
+                help_text: |-
+                  Name of a supported variable type. Supported types are string, int, bool.
+              - api_field: value
+                help_text: |-
+                  String encoded value for the variable.
+        - group:
+            required: false
+            help_text: |-
+              Upgrade is the unit operation that upgrades a provisioned unit, which may
+              also include the underlying resources represented by a Unit. Can only execute
+              if the Unit is currently provisioned.
+            params:
+            - arg_name: upgrade
+              help_text: |-
+                This flag can be used to specify an empty upgrade operation.
+              is_positional: false
+              required: false
+              type: bool
+            - arg_name: upgrade-release
+              help_text: |-
+                Reference to the Release object to use for the Unit. (optional).
+              is_positional: false
+              resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+              resource_method_params:
+                unitOperation.upgrade.release: '{__relative_name__}'
+              required: false
+            - arg_name: upgrade-input-variables
+              api_field: unitOperation.upgrade.inputVariables
+              required: false
+              repeated: true
+              help_text: |-
+                Set of input variables. Maximum 100. (optional)
+              spec:
+              - api_field: variable
+                help_text: |-
+                  Name of the variable from actuation configs.
+              - api_field: type
+                help_text: |-
+                  Name of a supported variable type. Supported types are string, int, bool.
+              - api_field: value
+                help_text: |-
+                  String encoded value for the variable.
+        - group:
+            required: false
+            help_text: |-
+              Deprovision is the unit operation that deprovision the underlying
+              resources represented by a Unit. Can only execute if the Unit is currently
+              provisioned.
+            params:
+            - arg_name: deprovision
+              help_text: |-
+                This flag can be used to specify an empty deprovision operation.
+              is_positional: false
+              required: false
+              type: bool
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+         "projects/{project}/locations/{location}/unitOperations/{unitOperation}"
+      is_positional: true
+      request_id_field: unitOperationId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_operation
+      required: true
+    - arg_name: unit
+      help_text: |-
+        The Unit a given Unit Operation will act upon.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit
+      resource_method_params:
+        unitOperation.unit: '{__relative_name__}'
+      required: true
+    - arg_name: parent-unit-operation
+      help_text: |-
+        Reference to parent resource: Unit Operation. If an operation needs to
+        create other operations as part of its workflow, each of the child
+        operations should have this field set to the parent. This can be used for
+        tracing. (Optional)
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:parent_unit_operation
+      resource_method_params:
+        unitOperation.parentUnitOperation: '{__relative_name__}'
+      required: false
+      is_primary_resource: false
+    - arg_name: rollout
+      help_text: |-
+        Specifies which rollout created this Unit Operation. This cannot be
+        modified and is used for filtering purposes only. If a dependent unit and
+        unit operation are created as part of another unit operation, they will use
+        the same rolloutId.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      resource_method_params:
+        unitOperation.rollout: '{__relative_name__}'
+      required: false
+    - arg_name: cancel
+      api_field: unitOperation.cancel
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        When true, attempt to cancel the operation. Cancellation may fail if the
+        operation is already executing. (Optional)
+    - group:
+        required: false
+        help_text: |-
+          A time specification to schedule the maintenance.
+        params:
+        - arg_name: schedule-start-time
+          api_field: unitOperation.schedule.startTime
+          required: false
+          repeated: false
+          type: googlecloudsdk.core.util.times:ParseDateTime
+          processor: googlecloudsdk.core.util.times:FormatDateTime
+          help_text: |-
+            Start of operation. If not set, will be set to the start of the next
+            window. (optional)
+    - arg_name: labels
+      api_field: unitOperation.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitOperations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyProvision
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyUpgrade
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyDeprovision

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Unit Operation
+    description: Delete a Unit Operation
+    examples: |-
+      To delete the Unit Operation, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the resource within a service.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_operation
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitOperations

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Unit Operation
+    description: Describe a Unit Operation
+    examples: |-
+      To describe the Unit Operation, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        The resource name of the resource within a service.
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_operation
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitOperations

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Unit Operations
+    description: List Unit Operations
+    examples: |-
+      To list all Unit Operations, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        The parent of the unit operation.
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitOperations
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/unit_operations/update.yaml

@@ -0,0 +1,184 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Unit Operation
+    description: Update a Unit Operation
+    examples: |-
+      To update the Unit Operation, run:
+
+      $ {command}
+  arguments:
+    params:
+    - group:
+        mutex: true
+        help_text: |-
+          Arguments for the unit operation type.
+        params:
+        - group:
+            required: false
+            help_text: |-
+              Provision is the unit operation that provision the underlying resources
+              represented by a Unit. Can only execute if the Unit is not currently
+              provisioned.
+            params:
+            - arg_name: provision
+              help_text: |-
+                This flag can be used to specify an empty provision operation.
+              is_positional: false
+              required: false
+              type: bool
+            - arg_name: provision-release
+              help_text: |-
+                Reference to the Release object to use for the Unit. (optional).
+              is_positional: false
+              resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+              resource_method_params:
+                unitOperation.provision.release: '{__relative_name__}'
+              required: false
+              clearable: true
+            - arg_name: provision-input-variables
+              api_field: unitOperation.provision.inputVariables
+              required: false
+              repeated: true
+              help_text: |-
+                Set of input variables. Maximum 100. (optional)
+              clearable: true
+              spec:
+              - api_field: variable
+                help_text: |-
+                  Name of the variable from actuation configs.
+              - api_field: type
+                help_text: |-
+                  Name of a supported variable type. Supported types are string, int, bool.
+              - api_field: value
+                help_text: |-
+                  String encoded value for the variable.
+        - group:
+            required: false
+            help_text: |-
+              Upgrade is the unit operation that upgrades a provisioned unit, which may
+              also include the underlying resources represented by a Unit. Can only execute
+              if the Unit is currently provisioned.
+            params:
+            - arg_name: upgrade
+              help_text: |-
+                This flag can be used to specify an empty upgrade operation.
+              is_positional: false
+              required: false
+              type: bool
+            - arg_name: upgrade-release
+              help_text: |-
+                Reference to the Release object to use for the Unit. (optional).
+              is_positional: false
+              resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:release
+              resource_method_params:
+                unitOperation.upgrade.release: '{__relative_name__}'
+              required: false
+              clearable: true
+            - arg_name: upgrade-input-variables
+              api_field: unitOperation.upgrade.inputVariables
+              required: false
+              repeated: true
+              help_text: |-
+                Set of input variables. Maximum 100. (optional)
+              clearable: true
+              spec:
+              - api_field: variable
+                help_text: |-
+                  Name of the variable from actuation configs.
+              - api_field: type
+                help_text: |-
+                  Name of a supported variable type. Supported types are string, int, bool.
+              - api_field: value
+                help_text: |-
+                  String encoded value for the variable.
+        - group:
+            required: false
+            help_text: |-
+              Deprovision is the unit operation that deprovision the underlying
+              resources represented by a Unit. Can only execute if the Unit is currently
+              provisioned.
+            params:
+            - arg_name: deprovision
+              help_text: |-
+                This flag can be used to specify an empty deprovision operation.
+              is_positional: false
+              required: false
+              type: bool
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+         "projects/{project}/locations/{location}/unitOperations/{unitOperation}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_operation
+      required: true
+    - arg_name: parent-unit-operation
+      help_text: |-
+        Reference to parent resource: UnitOperation. If an operation needs to
+        create other operations as part of its workflow, each of the child
+        operations should have this field set to the parent. This can be used for
+        tracing. (Optional)
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:parent_unit_operation
+      resource_method_params:
+        unitOperation.parentUnitOperation: '{__relative_name__}'
+      required: false
+      clearable: true
+      is_primary_resource: false
+    - arg_name: rollout
+      help_text: |-
+        Specifies which rollout created this Unit Operation. This cannot be
+        modified and is used for filtering purposes only. If a dependent unit and
+        unit operation are created as part of another unit operation, they will use
+        the same rolloutId.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:rollout
+      resource_method_params:
+        unitOperation.rollout: '{__relative_name__}'
+      required: false
+      clearable: true
+    - arg_name: cancel
+      api_field: unitOperation.cancel
+      action: store_true
+      required: false
+      type: bool
+      help_text: |-
+        When true, attempt to cancel the operation. Cancellation may fail if the
+        operation is already executing. (Optional)
+      default: null
+    - group:
+        required: false
+        help_text: |-
+          A time specification to schedule the maintenance.
+        params:
+        - arg_name: schedule-start-time
+          api_field: unitOperation.schedule.startTime
+          required: false
+          repeated: false
+          type: googlecloudsdk.core.util.times:ParseDateTime
+          processor: googlecloudsdk.core.util.times:FormatDateTime
+          help_text: |-
+            Start of operation. If not set, will be set to the start of the next
+            window. (optional)
+    - arg_name: labels
+      api_field: unitOperation.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.unitOperations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyProvision
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyUpgrade
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleEmptyDeprovision
+    - googlecloudsdk.command_lib.saas_runtime.unit_operations:HandleOneOfOperationTypeUpdate
+  update:
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The units command group for the SaaS Runtime CLI."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Saas(base.Group):
+  category = base.SAAS_CATEGORY
+  detailed_help = {'brief': 'Manage SaaS Runtime units.'}

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/create.yaml

@@ -0,0 +1,87 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Create a Unit
+    description: Create a Unit
+    examples: |-
+      To create the Unit, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/units/{unit}"
+      is_positional: true
+      request_id_field: unitId
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit
+      required: true
+    - arg_name: unit-kind
+      help_text: |-
+        Reference to the UnitKind this Unit belongs to (required and immutable once
+        created).
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        unit.unitKind: '{__relative_name__}'
+      required: false
+    - arg_name: tenant
+      help_text: |-
+        Reference to the Saas Tenant resource this unit belongs to. This for
+        example informs the maintenance policies to use for scheduling future
+        updates on a unit. (optional and immutable once created)
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      resource_method_params:
+        unit.tenant: '{__relative_name__}'
+      required: false
+    - group:
+        required: false
+        help_text: |-
+          Captures requested directives for performing future maintenance on the
+          unit. This includes a request for the unit to skip maintenance for a period
+          of time and remain pinned to its current release as well as controls for
+          postponing maintenance scheduled in future.
+        params:
+        - arg_name: maintenance-pinned-until-time
+          api_field: unit.maintenance.pinnedUntilTime
+          required: false
+          repeated: false
+          type: googlecloudsdk.core.util.times:ParseDateTime
+          processor: googlecloudsdk.core.util.times:FormatDateTime
+          help_text: |-
+            If present, it fixes the release on the unit until the given time; i.e.
+            changes to the release field will be rejected. Rollouts should and will
+            also respect this by not requesting an upgrade in the first place.
+    - arg_name: management-mode
+      api_field: unit.managementMode
+      required: false
+      help_text: |-
+        Indicates whether the Unit life cycle is controlled
+        by the user or by the system.
+        Immutable once created.
+      choices:
+      - arg_value: user
+        enum_value: MANAGEMENT_MODE_USER
+        help_text: |-
+          Unit's lifecycle is managed by the user.
+      - arg_value: system
+        enum_value: MANAGEMENT_MODE_SYSTEM
+        help_text: |-
+          The system will decide when to deprovision and delete the unit.
+          User still can deprovision or delete the unit manually.
+    - arg_name: labels
+      api_field: unit.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.units

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/delete.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Delete a Unit
+    description: Delete a Unit
+    examples: |-
+      To delete the Unit, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.units

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Describe a Unit
+    description: Describe a Unit
+    examples: |-
+      To describe the Unit, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Name of the resource
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit
+      required: true
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.units

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/list.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: List Units
+    description: List Units
+    examples: |-
+      To list all Units, run:
+
+      $ {command}
+  arguments:
+    resource:
+      help_text: |-
+        Parent value for ListUnitsRequest
+      spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:project_location_with_default
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.units
+  response:
+    id_field: name

gcloud auth application-default login/google-cloud-sdk/lib/surface/saas_runtime/units/update.yaml

@@ -0,0 +1,73 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update a Unit
+    description: Update a Unit
+    examples: |-
+      To update the Unit, run:
+
+      $ {command}
+  arguments:
+    params:
+    - help_text: |-
+        Identifier. The resource name (full URI of the resource) following the standard naming
+        scheme:
+
+          "projects/{project}/locations/{location}/units/{unit}"
+      is_positional: true
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit
+      required: true
+    - arg_name: unit-kind
+      help_text: |-
+        Reference to the UnitKind this Unit belongs to. Immutable once set.
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:unit_kind
+      resource_method_params:
+        unit.unitKind: '{__relative_name__}'
+      required: false
+      clearable: true
+    - arg_name: tenant
+      help_text: |-
+        Reference to the Saas Tenant resource this unit belongs to. This for
+        example informs the maintenance policies to use for scheduling future
+        updates on a unit. (optional and immutable once created)
+      is_positional: false
+      resource_spec: !REF googlecloudsdk.command_lib.saas_runtime.resources:tenant
+      resource_method_params:
+        unit.tenant: '{__relative_name__}'
+      required: false
+      clearable: true
+    - group:
+        required: false
+        help_text: |-
+          Captures requested directives for performing future maintenance on the
+          unit. This includes a request for the unit to skip maintenance for a period
+          of time and remain pinned to its current release as well as controls for
+          postponing maintenance scheduled in future.
+        params:
+        - arg_name: maintenance-pinned-until-time
+          api_field: unit.maintenance.pinnedUntilTime
+          required: false
+          repeated: false
+          type: googlecloudsdk.core.util.times:ParseDateTime
+          processor: googlecloudsdk.core.util.times:FormatDateTime
+          help_text: |-
+            If present, it fixes the release on the unit until the given time; i.e.
+            changes to the release field will be rejected. Rollouts should and will
+            also respect this by not requesting an upgrade in the first place.
+    - arg_name: labels
+      api_field: unit.labels
+      required: false
+      repeated: true
+      help_text: |-
+        The labels on the resource, which can be used for categorization.
+        similar to Kubernetes resource labels.
+      clearable: true
+      spec:
+      - api_field: key
+      - api_field: value
+  request:
+    api_version: v1beta1
+    collection:
+    - saasservicemgmt.projects.locations.units
+  update:
+    read_modify_update: true