@maxim_mazurok/gapi.client.cloudkms-v1 0.2.20260611 → 0.3.20260702

package/index.d.ts

@@ -9,7 +9,7 @@
 // This file was generated by https://github.com/Maxim-Mazurok/google-api-typings-generator. Please do not edit it manually.
 // In case of any problems please post issue to https://github.com/Maxim-Mazurok/google-api-typings-generator
 // Generated from: https://cloudkms.googleapis.com/$discovery/rest?version=v1
-// Revision: 20260611
+// Revision: 20260702
 
 /// <reference types="gapi.client" />
 
@@ -98,10 +98,7 @@ declare namespace gapi.client {
       exemptedMembers?: string[];
       /** The log type that this config enables. */
       logType?:
-        | 'LOG_TYPE_UNSPECIFIED'
-        | 'ADMIN_READ'
-        | 'DATA_WRITE'
-        | 'DATA_READ';
+        'LOG_TYPE_UNSPECIFIED' | 'ADMIN_READ' | 'DATA_WRITE' | 'DATA_READ';
     }
     interface AutokeyConfig {
       /** Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag. */
@@ -205,7 +202,8 @@ declare namespace gapi.client {
         | 'ASYMMETRIC_DECRYPT'
         | 'RAW_ENCRYPT_DECRYPT'
         | 'MAC'
-        | 'KEY_ENCAPSULATION';
+        | 'KEY_ENCAPSULATION'
+        | 'AES_WRAPPING';
       /** next_rotation_time will be advanced by this period when the service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours. If rotation_period is set, next_rotation_time must also be set. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted. */
       rotationPeriod?: string;
       /** A template describing settings for new CryptoKeyVersion instances. The properties of new CryptoKeyVersion instances created by either CreateCryptoKeyVersion or auto-rotation are controlled by this template. */
@@ -260,7 +258,8 @@ declare namespace gapi.client {
         | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256'
         | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU'
         | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU'
-        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU';
+        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU'
+        | 'AES_256_KWP';
       /** Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM. */
       attestation?: KeyOperationAttestation;
       /** Output only. The time at which this CryptoKeyVersion was created. */
@@ -277,6 +276,8 @@ declare namespace gapi.client {
       generateTime?: string;
       /** Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED. */
       generationFailureReason?: string;
+      /** Output only. Field indicating that the key wrapping key is trusted. This field is only valid for key purpose AES_256_WRAPPING, and protection level HSM_SINGLE_TENANT. */
+      hsmTrusted?: boolean;
       /** Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED. */
       importFailureReason?: string;
       /** Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported. */
@@ -308,6 +309,8 @@ declare namespace gapi.client {
         | 'GENERATION_FAILED'
         | 'PENDING_EXTERNAL_DESTRUCTION'
         | 'EXTERNAL_DESTRUCTION_FAILED';
+      /** Immutable. Field indicating that the key may be wrapped by a trusted key. This field can be set for all key purposes except ENCRYPT_DECRYPT, and is only valid for keys with protection level HSM_SINGLE_TENANT. This field can only be set at creation or import time via CreateCryptoKeyVersion, or ImportCryptoKeyVersion. */
+      trustedWrappingEnabled?: boolean;
     }
     interface CryptoKeyVersionTemplate {
       /** Required. Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT. */
@@ -358,7 +361,8 @@ declare namespace gapi.client {
         | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256'
         | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU'
         | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU'
-        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU';
+        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU'
+        | 'AES_256_KWP';
       /** ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE. */
       protectionLevel?:
         | 'PROTECTION_LEVEL_UNSPECIFIED'
@@ -446,9 +450,7 @@ declare namespace gapi.client {
       etag?: string;
       /** Optional. Describes who can perform control plane operations on the EKM. If unset, this defaults to MANUAL. */
       keyManagementMode?:
-        | 'KEY_MANAGEMENT_MODE_UNSPECIFIED'
-        | 'MANUAL'
-        | 'CLOUD_KMS';
+        'KEY_MANAGEMENT_MODE_UNSPECIFIED' | 'MANUAL' | 'CLOUD_KMS';
       /** Output only. The resource name for the EkmConnection in the format `projects/*‍/locations/*‍/ekmConnections/*`. */
       name?: string;
       /** Optional. A list of ServiceResolvers where the EKM can be reached. There should be one ServiceResolver per EKM replica. Currently, only a single ServiceResolver is supported. */
@@ -487,6 +489,12 @@ declare namespace gapi.client {
       verifiedPlaintextCrc32c?: boolean;
     }
     interface ExecuteSingleTenantHsmInstanceProposalRequest {}
+    interface ExportTrustedKeyWrappedCryptoKeyVersionResponse {
+      /** The wrapped key material. */
+      wrappedKey?: string;
+      /** Integrity verification field. A CRC32C checksum of the returned ExportTrustedKeyWrappedCryptoKeyVersionResponse.wrapped_key. An integrity check of ExportTrustedKeyWrappedCryptoKeyVersionResponse.wrapped_key can be performed by computing the CRC32C checksum of ExportTrustedKeyWrappedCryptoKeyVersionResponse.wrapped_key and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type. */
+      wrappedKeyCrc32c?: string;
+    }
     interface Expr {
       /** Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. */
       description?: string;
@@ -498,9 +506,11 @@ declare namespace gapi.client {
       title?: string;
     }
     interface ExternalProtectionLevelOptions {
-      /** The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection. */
+      /** Optional. The resource name of the backend environment where the key material of CryptoKeyVersions is associated with. Setting this field overrides the CryptoKeyBackend. This field may be set when CryptoKeyVersions is set to EXTERNAL_VPC. Format: `projects/*‍/locations/*‍/ekmConnections/*`. */
+      ekmConnectionBackendOverride?: string;
+      /** Optional. The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection. */
       ekmConnectionKeyPath?: string;
-      /** The URI for an external resource that this CryptoKeyVersion represents. */
+      /** Optional. The URI for an external resource that this CryptoKeyVersion represents. */
       externalKeyUri?: string;
     }
     interface GenerateRandomBytesRequest {
@@ -570,13 +580,16 @@ declare namespace gapi.client {
         | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256'
         | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU'
         | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU'
-        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU';
+        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU'
+        | 'AES_256_KWP';
       /** Optional. The optional name of an existing CryptoKeyVersion to target for an import operation. If this field is not present, a new CryptoKeyVersion containing the supplied key material is created. If this field is present, the supplied key material is imported into the existing CryptoKeyVersion. To import into an existing CryptoKeyVersion, the CryptoKeyVersion must be a child of ImportCryptoKeyVersionRequest.parent, have been previously created via ImportCryptoKeyVersion, and be in DESTROYED or IMPORT_FAILED state. The key material and algorithm must match the previous CryptoKeyVersion exactly if the CryptoKeyVersion has ever contained key material. */
       cryptoKeyVersion?: string;
       /** Required. The name of the ImportJob that was used to wrap this key material. */
       importJob?: string;
       /** Optional. This field has the same meaning as wrapped_key. Prefer to use that field in new work. Either that field or this field (but not both) must be specified. */
       rsaAesWrappedKey?: string;
+      /** Optional. Whether trusted wrapping will be enabled on the imported [CryptoKeyVersion]. This field is only supported for keys with CryptoKeyVersionTemplate.protection_level HSM_SINGLE_TENANT. This field is supported for all CryptoKeyPurposes besides ENCRYPT_DECRYPT. */
+      trustedWrappingEnabled?: boolean;
       /** Optional. The wrapped key material to import. Before wrapping, key material must be formatted. If importing symmetric key material, the expected key material format is plain bytes. If importing asymmetric key material, the expected key material format is PKCS#8-encoded DER (the PrivateKeyInfo structure from RFC 5208). When wrapping with import methods (RSA_OAEP_3072_SHA1_AES_256 or RSA_OAEP_4096_SHA1_AES_256 or RSA_OAEP_3072_SHA256_AES_256 or RSA_OAEP_4096_SHA256_AES_256), this field must contain the concatenation of: 1. An ephemeral AES-256 wrapping key wrapped with the public_key using RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an empty label. 2. The formatted key to be imported, wrapped with the ephemeral AES-256 key using AES-KWP (RFC 5649). This format is the same as the format produced by PKCS#11 mechanism CKM_RSA_AES_KEY_WRAP. When wrapping with import methods (RSA_OAEP_3072_SHA256 or RSA_OAEP_4096_SHA256), this field must contain the formatted key to be imported, wrapped with the public_key using RSAES-OAEP with SHA-256, MGF1 with SHA-256, and an empty label. */
       wrappedKey?: string;
     }
@@ -631,6 +644,64 @@ declare namespace gapi.client {
         | 'ACTIVE'
         | 'EXPIRED';
     }
+    interface ImportTrustedKeyWrappedCryptoKeyVersionRequest {
+      /** Required. Required - The algorithm of the key being imported. This does not need to match the version_template of the CryptoKey this version imports into. */
+      algorithm?:
+        | 'CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED'
+        | 'GOOGLE_SYMMETRIC_ENCRYPTION'
+        | 'AES_128_GCM'
+        | 'AES_256_GCM'
+        | 'AES_128_CBC'
+        | 'AES_256_CBC'
+        | 'AES_128_CTR'
+        | 'AES_256_CTR'
+        | 'RSA_SIGN_PSS_2048_SHA256'
+        | 'RSA_SIGN_PSS_3072_SHA256'
+        | 'RSA_SIGN_PSS_4096_SHA256'
+        | 'RSA_SIGN_PSS_4096_SHA512'
+        | 'RSA_SIGN_PKCS1_2048_SHA256'
+        | 'RSA_SIGN_PKCS1_3072_SHA256'
+        | 'RSA_SIGN_PKCS1_4096_SHA256'
+        | 'RSA_SIGN_PKCS1_4096_SHA512'
+        | 'RSA_SIGN_RAW_PKCS1_2048'
+        | 'RSA_SIGN_RAW_PKCS1_3072'
+        | 'RSA_SIGN_RAW_PKCS1_4096'
+        | 'RSA_DECRYPT_OAEP_2048_SHA256'
+        | 'RSA_DECRYPT_OAEP_3072_SHA256'
+        | 'RSA_DECRYPT_OAEP_4096_SHA256'
+        | 'RSA_DECRYPT_OAEP_4096_SHA512'
+        | 'RSA_DECRYPT_OAEP_2048_SHA1'
+        | 'RSA_DECRYPT_OAEP_3072_SHA1'
+        | 'RSA_DECRYPT_OAEP_4096_SHA1'
+        | 'EC_SIGN_P256_SHA256'
+        | 'EC_SIGN_P384_SHA384'
+        | 'EC_SIGN_SECP256K1_SHA256'
+        | 'EC_SIGN_ED25519'
+        | 'HMAC_SHA256'
+        | 'HMAC_SHA1'
+        | 'HMAC_SHA384'
+        | 'HMAC_SHA512'
+        | 'HMAC_SHA224'
+        | 'EXTERNAL_SYMMETRIC_ENCRYPTION'
+        | 'ML_KEM_768'
+        | 'ML_KEM_1024'
+        | 'KEM_XWING'
+        | 'PQ_SIGN_ML_DSA_44'
+        | 'PQ_SIGN_ML_DSA_65'
+        | 'PQ_SIGN_ML_DSA_87'
+        | 'PQ_SIGN_SLH_DSA_SHA2_128S'
+        | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256'
+        | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU'
+        | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU'
+        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU'
+        | 'AES_256_KWP';
+      /** Optional. The optional name of an existing CryptoKeyVersion to target for an import operation. If this field is not present, a new CryptoKeyVersion containing the supplied key material is created. If this field is present, the supplied key material is imported into the existing CryptoKeyVersion. To import into an existing CryptoKeyVersion, the CryptoKeyVersion must be a child of ImportTrustedKeyWrappedCryptoKeyVersionRequest.parent, have been previously created via ImportTrustedKeyWrappedCryptoKeyVersion, and be in DESTROYED or IMPORT_FAILED state. The key material and algorithm must match the previous CryptoKeyVersion exactly if the CryptoKeyVersion has ever contained key material */
+      cryptoKeyVersion?: string;
+      /** Required. Required - the CKV of the trusted key used to import. This can be the name of a CryptoKeyVersion or a CryptoKey. */
+      importingKey?: string;
+      /** Required. The target key pre-wrapped on premises. */
+      wrappedKey?: string;
+    }
     interface KeyAccessJustificationsEnrollmentConfig {
       /** Indicates whether the project has KAJ logging enabled. */
       auditLogging?: boolean;
@@ -907,7 +978,8 @@ declare namespace gapi.client {
         | 'PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256'
         | 'PQ_SIGN_ML_DSA_44_EXTERNAL_MU'
         | 'PQ_SIGN_ML_DSA_65_EXTERNAL_MU'
-        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU';
+        | 'PQ_SIGN_ML_DSA_87_EXTERNAL_MU'
+        | 'AES_256_KWP';
       /** The name of the CryptoKeyVersion public key. Provided here for verification. NOTE: This field is in Beta. */
       name?: string;
       /** The public key, encoded in PEM format. For more information, see the [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13). */
@@ -1085,8 +1157,16 @@ declare namespace gapi.client {
       updateMask?: string;
     }
     interface ShowEffectiveAutokeyConfigResponse {
-      /** Name of the key project configured in the resource project's folder ancestry. */
+      /** Name of the key project configured in the ancestry of the project or folder. */
       keyProject?: string;
+      /** The KeyProjectResolutionMode for the AutokeyConfig. */
+      keyProjectResolutionMode?:
+        | 'KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED'
+        | 'DEDICATED_KEY_PROJECT'
+        | 'RESOURCE_PROJECT'
+        | 'DISABLED';
+      /** Source of the effective AutokeyConfig. */
+      source?: Source;
     }
     interface ShowEffectiveKeyAccessJustificationsEnrollmentConfigResponse {
       /** Contains the effective KeyAccessJustificationsEnrollmentConfig for external keys. */
@@ -1170,6 +1250,12 @@ declare namespace gapi.client {
         | 'DELETED';
       /** Input only. The TTL for the SingleTenantHsmInstanceProposal. Proposals will expire after this duration. */
       ttl?: string;
+      /** Promotes a key with the AES_WRAPPING purpose to a trusted wrapping key. The key must be in the ACTIVE state to perform this operation. */
+      upgradeKeyTrust?: UpgradeKeyTrust;
+    }
+    interface Source {
+      /** Contains the resource name of the AutokeyConfig that is effective, for example, `folders/{FOLDER_NUMBER}` or `projects/{PROJECT_NUMBER}` or `organizations/{ORGANIZATION_NUMBER}`. */
+      name?: string;
     }
     interface Status {
       /** The status code, which should be an enum value of google.rpc.Code. */
@@ -1191,6 +1277,12 @@ declare namespace gapi.client {
       /** Required. The id of the child CryptoKeyVersion to use as primary. */
       cryptoKeyVersionId?: string;
     }
+    interface UpgradeKeyTrust {
+      /** Required. The name of the CryptoKeyVersion to promote. */
+      name?: string;
+      /** Required. The public key associated with the 2FA key that will sign the login nonce for this operation. */
+      twoFactorPublicKeyPem?: string;
+    }
     interface VerifyConnectivityResponse {}
     interface WrappingPublicKey {
       /** Output only. Contains the public key, formatted according to the PublicKey.PublicKeyFormat specified in the KeyManagementService.GetImportJob request. */
@@ -1253,6 +1345,33 @@ declare namespace gapi.client {
         /** Legacy upload protocol for media (e.g. "media", "multipart"). */
         uploadType?: string;
       }): Request<KeyAccessJustificationsPolicyConfig>;
+      /** Returns the effective Cloud KMS Autokey configuration for a given project or folder. */
+      showEffectiveAutokeyConfig(request?: {
+        /** V1 error format. */
+        '$.xgafv'?: '1' | '2';
+        /** OAuth access token. */
+        access_token?: string;
+        /** Data format for response. */
+        alt?: 'json' | 'media' | 'proto';
+        /** JSONP */
+        callback?: string;
+        /** Selector specifying which fields to include in a partial response. */
+        fields?: string;
+        /** API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token. */
+        key?: string;
+        /** OAuth 2.0 token for the current user. */
+        oauth_token?: string;
+        /** Required. Name of the resource project or folder to show the effective Cloud KMS Autokey configuration for. This may be helpful for interrogating the effect of nested folder configurations on a given resource project. Format: * projects/{project} * folders/{folder} */
+        parent: string;
+        /** Returns response with indentations and line breaks. */
+        prettyPrint?: boolean;
+        /** Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters. */
+        quotaUser?: string;
+        /** Upload protocol for media (e.g. "raw", "multipart"). */
+        upload_protocol?: string;
+        /** Legacy upload protocol for media (e.g. "media", "multipart"). */
+        uploadType?: string;
+      }): Request<ShowEffectiveAutokeyConfigResponse>;
       /** Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey. */
       updateAutokeyConfig(request: {
         /** V1 error format. */
@@ -2306,6 +2425,35 @@ declare namespace gapi.client {
         },
         body: DestroyCryptoKeyVersionRequest,
       ): Request<CryptoKeyVersion>;
+      /** Exports a CryptoKeyVersion with a trusted key. The CryptoKeyVersion must have trusted_wrapping_enabled set to true. The CryptoKeyVersion of the [wrapping_key] must have the AES_WRAPPING purpose. The [wrapping_key] must have the AES_256_KWP algorithm. */
+      exportTrustedKeyWrappedCryptoKeyVersion(request?: {
+        /** V1 error format. */
+        '$.xgafv'?: '1' | '2';
+        /** OAuth access token. */
+        access_token?: string;
+        /** Data format for response. */
+        alt?: 'json' | 'media' | 'proto';
+        /** JSONP */
+        callback?: string;
+        /** Selector specifying which fields to include in a partial response. */
+        fields?: string;
+        /** API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token. */
+        key?: string;
+        /** Required. The name of the CryptoKeyVersion to export. The CryptoKeyVersion must have trusted_wrapping_enabled set to true. */
+        name: string;
+        /** OAuth 2.0 token for the current user. */
+        oauth_token?: string;
+        /** Returns response with indentations and line breaks. */
+        prettyPrint?: boolean;
+        /** Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters. */
+        quotaUser?: string;
+        /** Upload protocol for media (e.g. "raw", "multipart"). */
+        upload_protocol?: string;
+        /** Legacy upload protocol for media (e.g. "media", "multipart"). */
+        uploadType?: string;
+        /** Required. The name of the CryptoKeyVersion to use as a wrapping key. The CryptoKeyVersion must have hsm_trusted set to true. */
+        wrappingKey?: string;
+      }): Request<ExportTrustedKeyWrappedCryptoKeyVersionResponse>;
       /** Returns metadata for a given CryptoKeyVersion. */
       get(request?: {
         /** V1 error format. */
@@ -2425,6 +2573,64 @@ declare namespace gapi.client {
         },
         body: ImportCryptoKeyVersionRequest,
       ): Request<CryptoKeyVersion>;
+      /** Import wrapped key material into a CryptoKeyVersion with a trusted key. All requests must specify a CryptoKey. If a CryptoKeyVersion is additionally specified in the request, key material will be reimported into that version. Otherwise, a new version will be created, and will be assigned the next sequential id within the CryptoKey. The CryptoKeyVersion will have trusted_wrapping_enabled set to true. */
+      importTrustedKeyWrappedCryptoKeyVersion(request: {
+        /** V1 error format. */
+        '$.xgafv'?: '1' | '2';
+        /** OAuth access token. */
+        access_token?: string;
+        /** Data format for response. */
+        alt?: 'json' | 'media' | 'proto';
+        /** JSONP */
+        callback?: string;
+        /** Selector specifying which fields to include in a partial response. */
+        fields?: string;
+        /** API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token. */
+        key?: string;
+        /** OAuth 2.0 token for the current user. */
+        oauth_token?: string;
+        /** Required. The name of the CryptoKey to be imported into. */
+        parent: string;
+        /** Returns response with indentations and line breaks. */
+        prettyPrint?: boolean;
+        /** Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters. */
+        quotaUser?: string;
+        /** Upload protocol for media (e.g. "raw", "multipart"). */
+        upload_protocol?: string;
+        /** Legacy upload protocol for media (e.g. "media", "multipart"). */
+        uploadType?: string;
+        /** Request body */
+        resource: ImportTrustedKeyWrappedCryptoKeyVersionRequest;
+      }): Request<CryptoKeyVersion>;
+      importTrustedKeyWrappedCryptoKeyVersion(
+        request: {
+          /** V1 error format. */
+          '$.xgafv'?: '1' | '2';
+          /** OAuth access token. */
+          access_token?: string;
+          /** Data format for response. */
+          alt?: 'json' | 'media' | 'proto';
+          /** JSONP */
+          callback?: string;
+          /** Selector specifying which fields to include in a partial response. */
+          fields?: string;
+          /** API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token. */
+          key?: string;
+          /** OAuth 2.0 token for the current user. */
+          oauth_token?: string;
+          /** Required. The name of the CryptoKey to be imported into. */
+          parent: string;
+          /** Returns response with indentations and line breaks. */
+          prettyPrint?: boolean;
+          /** Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters. */
+          quotaUser?: string;
+          /** Upload protocol for media (e.g. "raw", "multipart"). */
+          upload_protocol?: string;
+          /** Legacy upload protocol for media (e.g. "media", "multipart"). */
+          uploadType?: string;
+        },
+        body: ImportTrustedKeyWrappedCryptoKeyVersionRequest,
+      ): Request<CryptoKeyVersion>;
       /** Lists CryptoKeyVersions. */
       list(request?: {
         /** V1 error format. */
@@ -2842,6 +3048,8 @@ declare namespace gapi.client {
         quotaUser?: string;
         /** If set to true, the request will create a CryptoKey without any CryptoKeyVersions. You must manually call CreateCryptoKeyVersion or ImportCryptoKeyVersion before you can use this CryptoKey. */
         skipInitialVersionCreation?: boolean;
+        /** Optional. Whether trusted wrapping will be enabled on the first CryptoKeyVersions created for this CryptoKey. This field is only supported for keys with CryptoKeyVersionTemplate.protection_level HSM_SINGLE_TENANT. This field is supported for all CryptoKeyPurposes except ENCRYPT_DECRYPT. */
+        trustedWrappingEnabled?: boolean;
         /** Upload protocol for media (e.g. "raw", "multipart"). */
         upload_protocol?: string;
         /** Legacy upload protocol for media (e.g. "media", "multipart"). */
@@ -2875,6 +3083,8 @@ declare namespace gapi.client {
           quotaUser?: string;
           /** If set to true, the request will create a CryptoKey without any CryptoKeyVersions. You must manually call CreateCryptoKeyVersion or ImportCryptoKeyVersion before you can use this CryptoKey. */
           skipInitialVersionCreation?: boolean;
+          /** Optional. Whether trusted wrapping will be enabled on the first CryptoKeyVersions created for this CryptoKey. This field is only supported for keys with CryptoKeyVersionTemplate.protection_level HSM_SINGLE_TENANT. This field is supported for all CryptoKeyPurposes except ENCRYPT_DECRYPT. */
+          trustedWrappingEnabled?: boolean;
           /** Upload protocol for media (e.g. "raw", "multipart"). */
           upload_protocol?: string;
           /** Legacy upload protocol for media (e.g. "media", "multipart"). */
@@ -4501,7 +4711,7 @@ declare namespace gapi.client {
         /** Legacy upload protocol for media (e.g. "media", "multipart"). */
         uploadType?: string;
       }): Request<KeyAccessJustificationsPolicyConfig>;
-      /** Returns the effective Cloud KMS Autokey configuration for a given project. */
+      /** Returns the effective Cloud KMS Autokey configuration for a given project or folder. */
       showEffectiveAutokeyConfig(request?: {
         /** V1 error format. */
         '$.xgafv'?: '1' | '2';
@@ -4517,7 +4727,7 @@ declare namespace gapi.client {
         key?: string;
         /** OAuth 2.0 token for the current user. */
         oauth_token?: string;
-        /** Required. Name of the resource project to the show effective Cloud KMS Autokey configuration for. This may be helpful for interrogating the effect of nested folder configurations on a given resource project. */
+        /** Required. Name of the resource project or folder to show the effective Cloud KMS Autokey configuration for. This may be helpful for interrogating the effect of nested folder configurations on a given resource project. Format: * projects/{project} * folders/{folder} */
         parent: string;
         /** Returns response with indentations and line breaks. */
         prettyPrint?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxim_mazurok/gapi.client.cloudkms-v1",
-  "version": "0.2.20260611",
+  "version": "0.3.20260702",
   "description": "TypeScript typings for Cloud Key Management Service (KMS) API v1",
   "repository": {
     "type": "git",

package/readme.md

@@ -94,6 +94,13 @@ Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, o
 */
 await gapi.client.cloudkms.folders.getKajPolicyConfig({name: 'name'});
 
+/*
+Returns the effective Cloud KMS Autokey configuration for a given project or folder.
+*/
+await gapi.client.cloudkms.folders.showEffectiveAutokeyConfig({
+  parent: 'parent',
+});
+
 /*
 Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.
 */
@@ -125,7 +132,7 @@ Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, o
 await gapi.client.cloudkms.projects.getKajPolicyConfig({name: 'name'});
 
 /*
-Returns the effective Cloud KMS Autokey configuration for a given project.
+Returns the effective Cloud KMS Autokey configuration for a given project or folder.
 */
 await gapi.client.cloudkms.projects.showEffectiveAutokeyConfig({
   parent: 'parent',