@pulumi/gcp 10.0.0-beta.1 → 10.0.0

package/types/output.d.ts

@@ -2657,6 +2657,10 @@ export declare namespace agenticapplications {
          * Options for document generation.
          */
         documentGenerationOptions?: outputs.agenticapplications.AnalystAgentPersonaArtifactsConfigDocumentGenerationOptions;
+        /**
+         * Options for methodology export.
+         */
+        methodologyExportOptions?: outputs.agenticapplications.AnalystAgentPersonaArtifactsConfigMethodologyExportOptions;
         /**
          * Options for slide generation.
          */
@@ -2805,6 +2809,24 @@ export declare namespace agenticapplications {
          */
         mimeType: string;
     }
+    interface AnalystAgentPersonaArtifactsConfigMethodologyExportOptions {
+        /**
+         * If true, append the detailed methodology to the final response.
+         */
+        appendMethodology?: boolean;
+        /**
+         * Format for methodology export.
+         * Possible values:
+         * MARKDOWN
+         * HTML
+         * PDF
+         */
+        exportFormat?: string;
+        /**
+         * If true, export the detailed methodology as a separate artifact.
+         */
+        exportMethodologyArtifact?: boolean;
+    }
     interface AnalystAgentPersonaArtifactsConfigSlideGenerationOptions {
         /**
          * Format for slide export.
@@ -3360,6 +3382,13 @@ export declare namespace agenticapplications {
          */
         name: string;
     }
+    interface AnalystAgentPersonaWebSearchConfig {
+        /**
+         * List of domains to be excluded from Google Search / Enterprise Web Search
+         * grounding.
+         */
+        excludedDomains?: string[];
+    }
 }
 export declare namespace agentidentity {
     interface AuthProviderAuthProviderTypeParams {
@@ -11515,7 +11544,20 @@ export declare namespace bigquery {
          * Password for database.
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
-        password: string;
+        password?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * Password for database.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `password` or `passwordWo` can only be set.
+         */
+        passwordWo?: string;
+        /**
+         * Triggers update of `passwordWo` write-only. Increment this value when an update to `passwordWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        passwordWoVersion?: string;
         /**
          * Username for database.
          */
@@ -18178,6 +18220,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18193,6 +18244,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18208,6 +18268,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18223,6 +18292,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18238,6 +18316,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18253,6 +18340,15 @@ export declare namespace ces {
          * agent.
          */
         disabled?: boolean;
+        /**
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled?: boolean;
         /**
          * The python code to execute for the callback.
          */
@@ -18271,9 +18367,231 @@ export declare namespace ces {
          * controls the randomness of the model's responses. Lower temperatures
          * produce responses that are more predictable. Higher temperatures produce
          * responses that are more creative.
+         *
+         * <a name="nestedRemoteA2aAgent"></a>The `remoteA2aAgent` block supports:
          */
         temperature?: number;
     }
+    interface AgentRemoteA2aAgent {
+        /**
+         * The A2A connection configuration.
+         */
+        a2aConfig: outputs.ces.AgentRemoteA2aAgentA2aConfig;
+    }
+    interface AgentRemoteA2aAgentA2aConfig {
+        /**
+         * The full agent card defined inline.
+         */
+        agentCard?: outputs.ces.AgentRemoteA2aAgentA2aConfigAgentCard;
+        /**
+         * Reference to the agent in the Agent Registry.
+         * Format: 'projects/{project}/locations/{location}/agents/{agent}'
+         */
+        agentRegistry?: string;
+        /**
+         * Authentication configuration for calling the remote agent.
+         * Optional if the registry reference already handles authentication.
+         */
+        apiAuthentication?: outputs.ces.AgentRemoteA2aAgentA2aConfigApiAuthentication;
+        /**
+         * If not empty, interactions with the remote A2A agent will use this context
+         * ID. This contextId field can refer to a session variable like
+         * '$context.variables.order_agent_session_id'.
+         */
+        contextId?: string;
+        /**
+         * Mapping of input variable names of remote agent to GECX variable names.
+         */
+        inputVariableMapping?: {
+            [key: string]: string;
+        };
+        /**
+         * Mapping of output variable names of remote agent to GECX variable names.
+         */
+        outputVariableMapping?: {
+            [key: string]: string;
+        };
+        /**
+         * Whether streaming is enabled for the remote agent.
+         */
+        streamingEnabled?: boolean;
+    }
+    interface AgentRemoteA2aAgentA2aConfigAgentCard {
+        /**
+         * A description of the agent's domain of action/solution space.
+         */
+        description: string;
+        /**
+         * A human-readable name for the agent.
+         */
+        name: string;
+        /**
+         * Skills represent a unit of ability an agent can perform. This may
+         * somewhat abstract but represents a more focused set of actions that the
+         * agent is highly likely to succeed at.
+         * Structure is documented below.
+         */
+        skills: outputs.ces.AgentRemoteA2aAgentA2aConfigAgentCardSkill[];
+        /**
+         * Ordered list of supported interfaces. The first entry is preferred.
+         * Structure is documented below.
+         */
+        supportedInterfaces: outputs.ces.AgentRemoteA2aAgentA2aConfigAgentCardSupportedInterface[];
+        /**
+         * The version of the agent.
+         */
+        version: string;
+    }
+    interface AgentRemoteA2aAgentA2aConfigAgentCardSkill {
+        /**
+         * A detailed description of the skill.
+         */
+        description: string;
+        /**
+         * Example prompts or scenarios that this skill can handle.
+         */
+        examples?: string[];
+        /**
+         * A unique identifier for the agent's skill.
+         */
+        id: string;
+        /**
+         * The set of supported input media types for this skill, overriding the
+         * agent's defaults.
+         */
+        inputModes?: string[];
+        /**
+         * A human-readable name for the skill.
+         */
+        name: string;
+        /**
+         * The set of supported output media types for this skill, overriding the
+         * agent's defaults.
+         */
+        outputModes?: string[];
+        /**
+         * A set of keywords describing the skill's capabilities.
+         */
+        tags: string[];
+    }
+    interface AgentRemoteA2aAgentA2aConfigAgentCardSupportedInterface {
+        /**
+         * The protocol binding supported at this URL. The core ones officially
+         * supported are JSONRPC, GRPC and HTTP+JSON.
+         */
+        protocolBinding: string;
+        /**
+         * The version of the A2A protocol this interface exposes.
+         * Examples: "0.3", "1.0"
+         */
+        protocolVersion: string;
+        /**
+         * Tenant ID to be used in the request when calling the agent.
+         */
+        tenant?: string;
+        /**
+         * The URL where this interface is available. Must be a valid absolute HTTPS
+         * URL in production.
+         */
+        url: string;
+    }
+    interface AgentRemoteA2aAgentA2aConfigApiAuthentication {
+        /**
+         * Configurations for authentication with API key.
+         * Structure is documented below.
+         */
+        apiKeyConfig?: outputs.ces.AgentRemoteA2aAgentA2aConfigApiAuthenticationApiKeyConfig;
+        /**
+         * Configurations for authentication with a bearer token.
+         * Structure is documented below.
+         */
+        bearerTokenConfig?: outputs.ces.AgentRemoteA2aAgentA2aConfigApiAuthenticationBearerTokenConfig;
+        /**
+         * Configurations for authentication with OAuth.
+         * Structure is documented below.
+         */
+        oauthConfig?: outputs.ces.AgentRemoteA2aAgentA2aConfigApiAuthenticationOauthConfig;
+        /**
+         * Configurations for authentication using a custom service account.
+         * Structure is documented below.
+         */
+        serviceAccountAuthConfig?: outputs.ces.AgentRemoteA2aAgentA2aConfigApiAuthenticationServiceAccountAuthConfig;
+    }
+    interface AgentRemoteA2aAgentA2aConfigApiAuthenticationApiKeyConfig {
+        /**
+         * The name of the SecretManager secret version resource storing the API key.
+         * Format: `projects/{project}/secrets/{secret}/versions/{version}`
+         * Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
+         * service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        apiKeySecretVersion: string;
+        /**
+         * The parameter name or the header name of the API key.
+         * E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.
+         */
+        keyName: string;
+        /**
+         * Key location in the request.
+         * Possible values:
+         * HEADER
+         * QUERY_STRING
+         */
+        requestLocation: string;
+    }
+    interface AgentRemoteA2aAgentA2aConfigApiAuthenticationBearerTokenConfig {
+        /**
+         * The bearer token.
+         * Must be in the format `$context.variables.<name_of_variable>`.
+         */
+        token: string;
+    }
+    interface AgentRemoteA2aAgentA2aConfigApiAuthenticationOauthConfig {
+        /**
+         * The client ID from the OAuth provider.
+         */
+        clientId: string;
+        /**
+         * The name of the SecretManager secret version resource storing the
+         * client secret.
+         * Format: `projects/{project}/secrets/{secret}/versions/{version}`
+         * Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
+         * service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        clientSecretVersion: string;
+        /**
+         * OAuth grant types.
+         * Possible values:
+         * CLIENT_CREDENTIAL
+         */
+        oauthGrantType: string;
+        /**
+         * The OAuth scopes to grant.
+         */
+        scopes?: string[];
+        /**
+         * The token endpoint in the OAuth provider to exchange for an access token.
+         */
+        tokenEndpoint: string;
+    }
+    interface AgentRemoteA2aAgentA2aConfigApiAuthenticationServiceAccountAuthConfig {
+        /**
+         * The OAuth scopes to grant. If not specified, the default scope
+         * `https://www.googleapis.com/auth/cloud-platform` is used.
+         */
+        scopes?: string[];
+        /**
+         * The email address of the service account used for authenticatation. CES
+         * uses this service account to exchange an access token and the access token
+         * is then sent in the `Authorization` header of the request.
+         * The service account must have the
+         * `roles/iam.serviceAccountTokenCreator` role granted to the
+         * CES service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        serviceAccount: string;
+    }
     interface AgentRemoteDialogflowAgent {
         /**
          * The
@@ -19256,6 +19574,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -19272,6 +19600,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -19288,6 +19626,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -19304,6 +19652,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -19320,6 +19678,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -19336,6 +19704,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -20752,6 +21130,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -20768,6 +21156,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -20784,6 +21182,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -20800,6 +21208,16 @@ export declare namespace ces {
          * Whether summarization is disabled.
          */
         disabled: boolean;
+        /**
+         * (Output)
+         * If enabled, the callback will also be executed on intermediate model
+         * outputs. This setting only affects after model callback.
+         * **ENABLE WITH CAUTION**. Typically after model callback only needs to be
+         * executed after receiving all model responses. Enabling proactive execution
+         * may have negative implication on the execution cost and latency, and
+         * should only be enabled in rare situations.
+         */
+        proactiveExecutionEnabled: boolean;
         /**
          * (Output)
          * The Python code to execute for the tool.
@@ -23219,6 +23637,11 @@ export declare namespace ces {
          * Structure is documented below.
          */
         agentTransfer?: outputs.ces.ExampleMessageChunkAgentTransfer;
+        /**
+         * Represents a blob input or output in the conversation.
+         * Structure is documented below.
+         */
+        blob?: outputs.ces.ExampleMessageChunkBlob;
         /**
          * Represents an image input or output in the conversation.
          * Structure is documented below.
@@ -23257,7 +23680,21 @@ export declare namespace ces {
          */
         targetAgent: string;
     }
+    interface ExampleMessageChunkBlob {
+        /**
+         * Raw bytes of the blob.
+         */
+        data: string;
+        /**
+         * The IANA standard MIME type of the source data.
+         */
+        mimeType: string;
+    }
     interface ExampleMessageChunkImage {
+        /**
+         * The alternative text for the image.
+         */
+        altText?: string;
         /**
          * Raw bytes of the image.
          */
@@ -24722,6 +25159,12 @@ export declare namespace ces {
         tokenEndpoint: string;
     }
     interface ToolMcpToolApiAuthenticationServiceAccountAuthConfig {
+        /**
+         * (Output)
+         * The OAuth scopes to grant. If not specified, the default scope
+         * `https://www.googleapis.com/auth/cloud-platform` is used.
+         */
+        scopes: string[];
         /**
          * (Output)
          * The email address of the service account used for authenticatation. CES
@@ -24922,6 +25365,12 @@ export declare namespace ces {
         tokenEndpoint: string;
     }
     interface ToolOpenApiToolApiAuthenticationServiceAccountAuthConfig {
+        /**
+         * (Output)
+         * The OAuth scopes to grant. If not specified, the default scope
+         * `https://www.googleapis.com/auth/cloud-platform` is used.
+         */
+        scopes: string[];
         /**
          * (Output)
          * The email address of the service account used for authenticatation. CES
@@ -32027,6 +32476,44 @@ export declare namespace cloudbuild {
          */
         state: string;
     }
+    interface GetWorkerPoolNetworkConfig {
+        /**
+         * Required. Immutable. The network definition that the workers are peered to. If this section is left empty, the workers will be peered to `WorkerPool.project_id` on the service producer network. Must be in the format `projects/{project}/global/networks/{network}`, where `{project}` is a project number, such as `12345`, and `{network}` is the name of a VPC network in the project. See [Understanding network configuration options](https://cloud.google.com/cloud-build/docs/custom-workers/set-up-custom-worker-pool-environment#understanding_the_network_configuration_options)
+         */
+        peeredNetwork: string;
+        /**
+         * Optional. Immutable. Subnet IP range within the peered network. This is specified in CIDR notation with a slash and the subnet prefix size. You can optionally specify an IP address before the subnet prefix value. e.g. `192.168.0.0/29` would specify an IP range starting at 192.168.0.0 with a prefix size of 29 bits. `/16` would specify a prefix size of 16 bits, with an automatically determined IP within the peered VPC. If unspecified, a value of `/24` will be used.
+         */
+        peeredNetworkIpRange: string;
+    }
+    interface GetWorkerPoolPrivateServiceConnect {
+        /**
+         * Required. Immutable. The network attachment that the worker network interface is connected to. Must be in the format `projects/{project}/regions/{region}/networkAttachments/{networkAttachment}`. The region of network attachment must be the same as the worker pool. See [Network Attachments](https://cloud.google.com/vpc/docs/about-network-attachments)
+         */
+        networkAttachment: string;
+        /**
+         * Immutable. Route all traffic through PSC interface. Enable this if you want full control of traffic in the private pool. Configure Cloud NAT for the subnet of network attachment if you need to access public Internet. If false, Only route private IPs, e.g. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 through PSC interface.
+         */
+        routeAllTraffic: boolean;
+    }
+    interface GetWorkerPoolWorkerConfig {
+        /**
+         * Size of the disk attached to the worker, in GB. See [Worker pool config file](https://cloud.google.com/cloud-build/docs/custom-workers/worker-pool-config-file). Specify a value of up to 1000. If `0` is specified, Cloud Build will use a standard disk size.
+         */
+        diskSizeGb: number;
+        /**
+         * Enable nested virtualization on the worker, if supported by the machine type. See [Worker pool config file](https://cloud.google.com/build/docs/private-pools/worker-pool-config-file-schema). If left blank, Cloud Build will set this to false.
+         */
+        enableNestedVirtualization: boolean;
+        /**
+         * Machine type of a worker, such as `n1-standard-1`. See [Worker pool config file](https://cloud.google.com/cloud-build/docs/custom-workers/worker-pool-config-file). If left blank, Cloud Build will use `n1-standard-1`.
+         */
+        machineType: string;
+        /**
+         * If true, workers are created without any public address, which prevents network egress to public IPs.
+         */
+        noExternalIp: boolean;
+    }
     interface TriggerApprovalConfig {
         /**
          * Whether or not approval is needed. If this is set on a build, it will become pending when run,
@@ -38447,6 +38934,10 @@ export declare namespace cloudrunv2 {
         annotations: {
             [key: string]: string;
         };
+        /**
+         * If true, the system will start the execution within the next 12 hours depending on available capacity.
+         */
+        delayExecution: boolean;
         /**
          * Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
          * or break down billing charges by team, component, environment, state, etc. For more information, visit https://docs.cloud.google.com/resource-manager/docs/creating-managing-labels or
@@ -38550,6 +39041,10 @@ export declare namespace cloudrunv2 {
          * Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
          */
         resources: outputs.cloudrunv2.GetJobTemplateTemplateContainerResource[];
+        /**
+         * Indicates that this container can act as a sandbox supervisor and launch sandboxes.
+         */
+        sandboxLauncher: boolean;
         /**
          * Startup probe of application within the container.
          * All other probes are disabled if a startup probe is provided, until it
@@ -39088,6 +39583,10 @@ export declare namespace cloudrunv2 {
          * VPC Access configuration to use for this Task. For more information, visit https://cloud.google.com/run/docs/configuring/connecting-vpc.
          */
         vpcAccesses: outputs.cloudrunv2.GetServiceTemplateVpcAccess[];
+        /**
+         * Workload identity settings for this Revision.
+         */
+        workloadIdentityConfigs: outputs.cloudrunv2.GetServiceTemplateWorkloadIdentityConfig[];
     }
     interface GetServiceTemplateContainer {
         /**
@@ -39689,6 +40188,20 @@ export declare namespace cloudrunv2 {
          */
         tags: string[];
     }
+    interface GetServiceTemplateWorkloadIdentityConfig {
+        /**
+         * The Revision's SPIFFE workload identity. Enables provisioning of SPIFFE workload certificates.
+         */
+        identity: string;
+        /**
+         * Controls whether an instance receives a MWLID certificate.
+         */
+        identityCertificateEnabled: boolean;
+        /**
+         * The type of identity to use. Possible values: ["IDENTITY_TYPE_SERVICE_ACCOUNT", "IDENTITY_TYPE_WORKLOAD_IDENTITY", "IDENTITY_TYPE_AGENT_IDENTITY"]
+         */
+        identityType: string;
+    }
     interface GetServiceTerminalCondition {
         /**
          * A reason for the execution condition.
@@ -40440,6 +40953,10 @@ export declare namespace cloudrunv2 {
         annotations?: {
             [key: string]: string;
         };
+        /**
+         * If true, the system will start the execution within the next 12 hours depending on available capacity.
+         */
+        delayExecution?: boolean;
         /**
          * Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
          * or break down billing charges by team, component, environment, state, etc. For more information, visit https://docs.cloud.google.com/resource-manager/docs/creating-managing-labels or
@@ -40549,6 +41066,10 @@ export declare namespace cloudrunv2 {
          * Structure is documented below.
          */
         resources: outputs.cloudrunv2.JobTemplateTemplateContainerResources;
+        /**
+         * Indicates that this container can act as a sandbox supervisor and launch sandboxes.
+         */
+        sandboxLauncher?: boolean;
         /**
          * Startup probe of application within the container.
          * All other probes are disabled if a startup probe is provided, until it
@@ -41137,6 +41658,11 @@ export declare namespace cloudrunv2 {
          * Structure is documented below.
          */
         vpcAccess?: outputs.cloudrunv2.ServiceTemplateVpcAccess;
+        /**
+         * Workload identity settings for this Revision.
+         * Structure is documented below.
+         */
+        workloadIdentityConfig?: outputs.cloudrunv2.ServiceTemplateWorkloadIdentityConfig;
     }
     interface ServiceTemplateContainer {
         /**
@@ -41615,12 +42141,10 @@ export declare namespace cloudrunv2 {
     }
     interface ServiceTemplateScaling {
         /**
-         * (Optional, Beta)
          * Determines a threshold for concurrency utilization before scaling begins. Accepted values are between 0.1 and 0.95 (inclusive) or 0.0 to disable concurrency utilization as threshold for scaling. CPU and concurrency scaling cannot both be disabled.
          */
         concurrencyUtilization?: number;
         /**
-         * (Optional, Beta)
          * Determines a threshold for CPU utilization before scaling begins. Accepted values are between 0.1 and 0.95 (inclusive) or 0.0 to disable CPU utilization as threshold for scaling. CPU and concurrency scaling cannot both be disabled.
          */
         cpuUtilization?: number;
@@ -41780,6 +42304,21 @@ export declare namespace cloudrunv2 {
          */
         tags?: string[];
     }
+    interface ServiceTemplateWorkloadIdentityConfig {
+        /**
+         * The Revision's SPIFFE workload identity. Enables provisioning of SPIFFE workload certificates.
+         */
+        identity?: string;
+        /**
+         * Controls whether an instance receives a MWLID certificate.
+         */
+        identityCertificateEnabled?: boolean;
+        /**
+         * The type of identity to use.
+         * Possible values are: `IDENTITY_TYPE_SERVICE_ACCOUNT`, `IDENTITY_TYPE_WORKLOAD_IDENTITY`, `IDENTITY_TYPE_AGENT_IDENTITY`.
+         */
+        identityType?: string;
+    }
     interface ServiceTerminalCondition {
         /**
          * (Output)
@@ -47031,6 +47570,20 @@ export declare namespace compute {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         rawKey?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * Specifies a 256-bit customer-supplied encryption key, encoded in
+         * RFC 4648 base64 to either encrypt or decrypt this resource.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `rawKey` or `rawKeyWo` can only be set.
+         */
+        rawKeyWo?: string;
+        /**
+         * Triggers update of `rawKeyWo` write-only. Increment this value when an update to `rawKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rawKeyWoVersion?: string;
         /**
          * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
          * customer-supplied encryption key to either encrypt or decrypt
@@ -47038,6 +47591,21 @@ export declare namespace compute {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         rsaEncryptedKey?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
+         * customer-supplied encryption key to either encrypt or decrypt
+         * this resource. You can provide either the rawKey or the rsaEncryptedKey.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `rsaEncryptedKey` or `rsaEncryptedKeyWo` can only be set.
+         */
+        rsaEncryptedKeyWo?: string;
+        /**
+         * Triggers update of `rsaEncryptedKeyWo` write-only. Increment this value when an update to `rsaEncryptedKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rsaEncryptedKeyWoVersion?: string;
         /**
          * (Output)
          * The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
@@ -49122,12 +49690,31 @@ export declare namespace compute {
          * RFC 4648 base64 to either encrypt or decrypt this resource.
          */
         rawKey: string;
+        /**
+         * Specifies a 256-bit customer-supplied encryption key, encoded in
+         * RFC 4648 base64 to either encrypt or decrypt this resource.
+         */
+        rawKeyWo: string;
+        /**
+         * Triggers update of 'raw_key_wo' write-only. Increment this value when an update to 'raw_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rawKeyWoVersion: string;
         /**
          * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
          * customer-supplied encryption key to either encrypt or decrypt
          * this resource. You can provide either the rawKey or the rsaEncryptedKey.
          */
         rsaEncryptedKey: string;
+        /**
+         * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
+         * customer-supplied encryption key to either encrypt or decrypt
+         * this resource. You can provide either the rawKey or the rsaEncryptedKey.
+         */
+        rsaEncryptedKeyWo: string;
+        /**
+         * Triggers update of 'rsa_encrypted_key_wo' write-only. Increment this value when an update to 'rsa_encrypted_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rsaEncryptedKeyWoVersion: string;
         /**
          * The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
          * encryption key that protects this resource.
@@ -52652,12 +53239,31 @@ export declare namespace compute {
          * RFC 4648 base64 to either encrypt or decrypt this resource.
          */
         rawKey: string;
+        /**
+         * Specifies a 256-bit customer-supplied encryption key, encoded in
+         * RFC 4648 base64 to either encrypt or decrypt this resource.
+         */
+        rawKeyWo: string;
+        /**
+         * Triggers update of 'raw_key_wo' write-only. Increment this value when an update to 'raw_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rawKeyWoVersion: string;
         /**
          * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
          * customer-supplied encryption key to either encrypt or decrypt
          * this resource. You can provide either the rawKey or the rsaEncryptedKey.
          */
         rsaEncryptedKey: string;
+        /**
+         * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
+         * customer-supplied encryption key to either encrypt or decrypt
+         * this resource. You can provide either the rawKey or the rsaEncryptedKey.
+         */
+        rsaEncryptedKeyWo: string;
+        /**
+         * Triggers update of 'rsa_encrypted_key_wo' write-only. Increment this value when an update to 'rsa_encrypted_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rsaEncryptedKeyWoVersion: string;
         /**
          * The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
          * encryption key that protects this resource.
@@ -55973,6 +56579,10 @@ export declare namespace compute {
          * The name of the service attachment.
          */
         name: string;
+        /**
+         * The number of NAT IPs allocated per connected endpoint.
+         */
+        natIpsPerEndpoint: number;
         /**
          * A list of URLs of subnetworks used for NAT in this service attachment.
          */
@@ -63347,6 +63957,20 @@ export declare namespace compute {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         rawKey?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * Specifies a 256-bit customer-supplied encryption key, encoded in
+         * RFC 4648 base64 to either encrypt or decrypt this resource.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `rawKey` or `rawKeyWo` can only be set.
+         */
+        rawKeyWo?: string;
+        /**
+         * Triggers update of `rawKeyWo` write-only. Increment this value when an update to `rawKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rawKeyWoVersion?: string;
         /**
          * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
          * customer-supplied encryption key to either encrypt or decrypt
@@ -63354,6 +63978,21 @@ export declare namespace compute {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         rsaEncryptedKey?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit
+         * customer-supplied encryption key to either encrypt or decrypt
+         * this resource. You can provide either the rawKey or the rsaEncryptedKey.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `rsaEncryptedKey` or `rsaEncryptedKeyWo` can only be set.
+         */
+        rsaEncryptedKeyWo?: string;
+        /**
+         * Triggers update of `rsaEncryptedKeyWo` write-only. Increment this value when an update to `rsaEncryptedKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        rsaEncryptedKeyWoVersion?: string;
         /**
          * (Output)
          * The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
@@ -75894,18 +76533,10 @@ export declare namespace container {
          */
         podSnapshotConfig: outputs.container.ClusterAddonsConfigPodSnapshotConfig;
         /**
-         * . The status of the [Ray Operator
+         * The status of the [Ray Operator
          * addon](https://cloud.google.com/kubernetes-engine/docs/add-on/ray-on-gke/concepts/overview).
          * It is disabled by default. Set `enabled = true` to enable. The minimum
-         * cluster version to enable Ray is 1.30.0-gke.1747000.
-         *
-         * Ray Operator config has optional subfields
-         * `ray_cluster_logging_config.enabled` and
-         * `ray_cluster_monitoring_config.enabled` which control Ray Cluster logging
-         * and monitoring respectively. See [Collect and view logs and metrics for Ray
-         * clusters on
-         * GKE](https://cloud.google.com/kubernetes-engine/docs/add-on/ray-on-gke/how-to/collect-view-logs-metrics)
-         * for more information.
+         * cluster version to enable Ray is 1.30.0-gke.1747000. Structure is documented below.
          */
         rayOperatorConfigs: outputs.container.ClusterAddonsConfigRayOperatorConfig[];
         /**
@@ -76035,20 +76666,29 @@ export declare namespace container {
         enabled: boolean;
     }
     interface ClusterAddonsConfigRayOperatorConfig {
+        /**
+         * Whether the Ray Operator addon is enabled.
+         */
         enabled: boolean;
         /**
-         * The status of Ray Logging, which scrapes Ray cluster logs to Cloud Logging. Defaults to disabled; set enabled = true to enable.
+         * The status of Ray Logging, which scrapes Ray cluster logs to Cloud Logging. Structure is documented below.
          */
         rayClusterLoggingConfig: outputs.container.ClusterAddonsConfigRayOperatorConfigRayClusterLoggingConfig;
         /**
-         * The status of Ray Cluster monitoring, which shows Ray cluster metrics in Cloud Console. Defaults to disabled; set enabled = true to enable.
+         * The status of Ray Cluster monitoring, which shows Ray cluster metrics in Cloud Console. Structure is documented below.
          */
         rayClusterMonitoringConfig: outputs.container.ClusterAddonsConfigRayOperatorConfigRayClusterMonitoringConfig;
     }
     interface ClusterAddonsConfigRayOperatorConfigRayClusterLoggingConfig {
+        /**
+         * Whether Ray Cluster logging is enabled.
+         */
         enabled: boolean;
     }
     interface ClusterAddonsConfigRayOperatorConfigRayClusterMonitoringConfig {
+        /**
+         * Whether Ray Cluster monitoring is enabled.
+         */
         enabled: boolean;
     }
     interface ClusterAddonsConfigSliceControllerConfig {
@@ -76162,7 +76802,6 @@ export declare namespace container {
          */
         management: outputs.container.ClusterClusterAutoscalingAutoProvisioningDefaultsManagement;
         /**
-         * )
          * Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the
          * specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such
          * as "Intel Haswell" or "Intel Sandy Bridge".
@@ -76480,12 +77119,10 @@ export declare namespace container {
         clusterSecondaryRangeName: string;
         /**
          * Contains network tier information. Structure is documented below
-         *
-         * <a name="nestedAutoIpamConfig"></a>The auto ipam config supports:
          */
         networkTierConfig: outputs.container.ClusterIpAllocationPolicyNetworkTierConfig;
         /**
-         * Configuration for cluster level pod cidr overprovision. Default is disabled=false.
+         * Configuration for cluster level pod cidr overprovision. Default is `disabled = false`. Structure is documented below.
          */
         podCidrOverprovisionConfig: outputs.container.ClusterIpAllocationPolicyPodCidrOverprovisionConfig;
         /**
@@ -76551,9 +77188,9 @@ export declare namespace container {
     }
     interface ClusterIpAllocationPolicyPodCidrOverprovisionConfig {
         /**
-         * Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled.When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic
+         * Whether Pod CIDR overprovisioning is disabled.
          *
-         * <a name="nestedClusterTelemetry"></a>The `clusterTelemetry` block supports
+         * <a name="nestedAutoIpamConfig"></a>The auto ipam config supports:
          */
         disabled: boolean;
     }
@@ -76625,6 +77262,9 @@ export declare namespace container {
          * Duration will be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format "PTnHnMnS".
          */
         duration: string;
+        /**
+         * The start time of the exclusion window, in RFC3339 format.
+         */
         startTime: string;
     }
     interface ClusterMaintenancePolicyDisruptionBudget {
@@ -76648,12 +77288,21 @@ export declare namespace container {
         patchVersionDisruptionInterval?: string;
     }
     interface ClusterMaintenancePolicyMaintenanceExclusion {
+        /**
+         * The end time of the exclusion window, in RFC3339 format. Exactly one of `endTime` and `exclusion_options.end_time_behavior` should be specified.
+         */
         endTime?: string;
+        /**
+         * The name of the maintenance exclusion.
+         */
         exclusionName: string;
         /**
-         * MaintenanceExclusionOptions provides maintenance exclusion related options.
+         * MaintenanceExclusionOptions provides maintenance exclusion related options. Structure is documented below.
          */
         exclusionOptions?: outputs.container.ClusterMaintenancePolicyMaintenanceExclusionExclusionOptions;
+        /**
+         * The start time of the exclusion window, in RFC3339 format.
+         */
         startTime: string;
     }
     interface ClusterMaintenancePolicyMaintenanceExclusionExclusionOptions {
@@ -76785,6 +77434,9 @@ export declare namespace container {
         seconds: number;
     }
     interface ClusterMaintenancePolicyRecurringWindow {
+        /**
+         * The end time of the exclusion window, in RFC3339 format. Exactly one of `endTime` and `exclusion_options.end_time_behavior` should be specified.
+         */
         endTime: string;
         /**
          * Defines when the window recurs, using the [RFC5545](https://tools.ietf.org/html/rfc5545#section-3.8.5.3) RRULE format.
@@ -76829,6 +77481,9 @@ export declare namespace container {
          * ```
          */
         recurrence: string;
+        /**
+         * The start time of the exclusion window, in RFC3339 format.
+         */
         startTime: string;
     }
     interface ClusterManagedMachineLearningDiagnosticsConfig {
@@ -77046,7 +77701,7 @@ export declare namespace container {
          */
         gvnic?: outputs.container.ClusterNodeConfigGvnic;
         /**
-         * The maintenance policy for the hosts on which the GKE VMs run on. Structure is documented below.
+         * ) The maintenance policy for the hosts on which the GKE VMs run on. Structure is documented below.
          */
         hostMaintenancePolicy?: outputs.container.ClusterNodeConfigHostMaintenancePolicy;
         /**
@@ -77208,7 +77863,7 @@ export declare namespace container {
          */
         taints?: outputs.container.ClusterNodeConfigTaint[];
         /**
-         * Windows node configuration, currently supporting OSVersion [attribute](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/NodeConfig#osversion). The value must be one of [OS_VERSION_UNSPECIFIED, OS_VERSION_LTSC2019, OS_VERSION_LTSC2022]. For example:
+         * Windows node configuration. Structure is documented below.
          */
         windowsNodeConfig: outputs.container.ClusterNodeConfigWindowsNodeConfig;
         /**
@@ -77224,6 +77879,8 @@ export declare namespace container {
         enableNestedVirtualization?: boolean;
         /**
          * Defines the performance monitoring unit [PMU](https://cloud.google.com/compute/docs/pmu-overview) level. Valid values are `ARCHITECTURAL`, `STANDARD`, or `ENHANCED`. Defaults to off.
+         *
+         * > **Note:** Early 8.x provider versions dropped an explicitly configured `STANDARD` value when creating the resource. On affected node pools the diff stays suppressed and this field cannot be updated in place, so enabling `STANDARD` requires recreating the node pool.
          */
         performanceMonitoringUnit?: string;
         /**
@@ -77269,7 +77926,7 @@ export declare namespace container {
          */
         privateRegistryAccessConfig?: outputs.container.ClusterNodeConfigContainerdConfigPrivateRegistryAccessConfig;
         /**
-         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail. Example:
+         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail.
          */
         registryHosts?: outputs.container.ClusterNodeConfigContainerdConfigRegistryHost[];
         /**
@@ -77279,7 +77936,7 @@ export declare namespace container {
     }
     interface ClusterNodeConfigContainerdConfigPrivateRegistryAccessConfig {
         /**
-         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail. Example:
+         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail.
          */
         certificateAuthorityDomainConfigs?: outputs.container.ClusterNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfig[];
         /**
@@ -77293,19 +77950,21 @@ export declare namespace container {
          */
         fqdns: string[];
         /**
-         * Parameters for configuring a certificate hosted in GCP SecretManager.
+         * Parameters for configuring a certificate hosted in GCP SecretManager:
          */
         gcpSecretManagerCertificateConfig: outputs.container.ClusterNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig;
     }
     interface ClusterNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig {
         /**
-         * URI for the secret that hosts a certificate. Must be in the format 'projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST'.
+         * URI for the secret that hosts a certificate. Must be in the format `projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST`.
+         *
+         * Example:
          */
         secretUri: string;
     }
     interface ClusterNodeConfigContainerdConfigRegistryHost {
         /**
-         * Configures a list of host-specific configurations for the server.
+         * Configures a list of host-specific configurations for the server:
          */
         hosts?: outputs.container.ClusterNodeConfigContainerdConfigRegistryHostHost[];
         /**
@@ -77315,15 +77974,17 @@ export declare namespace container {
     }
     interface ClusterNodeConfigContainerdConfigRegistryHostHost {
         /**
-         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing.
+         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing. Valid values include `HOST_CAPABILITY_PULL`, `HOST_CAPABILITY_RESOLVE`, `HOST_CAPABILITY_PUSH`.
          */
         capabilities?: string[];
         /**
-         * Configures the registry host certificate.
+         * Configures the registry host certificate. Contains `gcpSecretManagerSecretUri` (Optional).
          */
         cas?: outputs.container.ClusterNodeConfigContainerdConfigRegistryHostHostCa[];
         /**
-         * Configures the registry host client certificate and key.
+         * Configures the registry host client certificate and key. Contains `cert` (Required) with `gcpSecretManagerSecretUri` (Optional) and `key` (Optional) with `gcpSecretManagerSecretUri` (Optional).
+         *
+         * Example:
          */
         clients?: outputs.container.ClusterNodeConfigContainerdConfigRegistryHostHostClient[];
         /**
@@ -77331,7 +77992,7 @@ export declare namespace container {
          */
         dialTimeout?: string;
         /**
-         * Configures the registry host headers.
+         * Configures the registry host headers. Each header contains `key` (Required, string) and `value` (Required, list of strings).
          */
         headers?: outputs.container.ClusterNodeConfigContainerdConfigRegistryHostHostHeader[];
         /**
@@ -77339,7 +78000,7 @@ export declare namespace container {
          */
         host: string;
         /**
-         * Indicate the host's API root endpoint is defined in the URL path rather than by the API specification.
+         * Indicates the host's API root endpoint is defined in the URL path rather than by the API specification.
          */
         overridePath?: boolean;
     }
@@ -77994,7 +78655,7 @@ export declare namespace container {
     }
     interface ClusterNodeConfigWindowsNodeConfig {
         /**
-         * The OS Version of the windows nodepool.Values are OS_VERSION_UNSPECIFIED,OS_VERSION_LTSC2019 and OS_VERSION_LTSC2022
+         * OSVersion [attribute](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/NodeConfig#osversion). The value must be one of `OS_VERSION_UNSPECIFIED`, `OS_VERSION_LTSC2019`, or `OS_VERSION_LTSC2022`.
          */
         osversion?: string;
     }
@@ -78221,7 +78882,7 @@ export declare namespace container {
          */
         privateRegistryAccessConfig?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigPrivateRegistryAccessConfig;
         /**
-         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail. Example:
+         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail.
          */
         registryHosts?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHost[];
         /**
@@ -78231,7 +78892,7 @@ export declare namespace container {
     }
     interface ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigPrivateRegistryAccessConfig {
         /**
-         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail. Example:
+         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail.
          */
         certificateAuthorityDomainConfigs?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfig[];
         /**
@@ -78245,19 +78906,21 @@ export declare namespace container {
          */
         fqdns: string[];
         /**
-         * Parameters for configuring a certificate hosted in GCP SecretManager.
+         * Parameters for configuring a certificate hosted in GCP SecretManager:
          */
         gcpSecretManagerCertificateConfig: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig;
     }
     interface ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig {
         /**
-         * URI for the secret that hosts a certificate. Must be in the format 'projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST'.
+         * URI for the secret that hosts a certificate. Must be in the format `projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST`.
+         *
+         * Example:
          */
         secretUri: string;
     }
     interface ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHost {
         /**
-         * Configures a list of host-specific configurations for the server.
+         * Configures a list of host-specific configurations for the server:
          */
         hosts?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHostHost[];
         /**
@@ -78267,15 +78930,17 @@ export declare namespace container {
     }
     interface ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHostHost {
         /**
-         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing.
+         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing. Valid values include `HOST_CAPABILITY_PULL`, `HOST_CAPABILITY_RESOLVE`, `HOST_CAPABILITY_PUSH`.
          */
         capabilities?: string[];
         /**
-         * Configures the registry host certificate.
+         * Configures the registry host certificate. Contains `gcpSecretManagerSecretUri` (Optional).
          */
         cas?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHostHostCa[];
         /**
-         * Configures the registry host client certificate and key.
+         * Configures the registry host client certificate and key. Contains `cert` (Required) with `gcpSecretManagerSecretUri` (Optional) and `key` (Optional) with `gcpSecretManagerSecretUri` (Optional).
+         *
+         * Example:
          */
         clients?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHostHostClient[];
         /**
@@ -78283,7 +78948,7 @@ export declare namespace container {
          */
         dialTimeout?: string;
         /**
-         * Configures the registry host headers.
+         * Configures the registry host headers. Each header contains `key` (Required, string) and `value` (Required, list of strings).
          */
         headers?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsContainerdConfigRegistryHostHostHeader[];
         /**
@@ -78291,7 +78956,7 @@ export declare namespace container {
          */
         host: string;
         /**
-         * Indicate the host's API root endpoint is defined in the URL path rather than by the API specification.
+         * Indicates the host's API root endpoint is defined in the URL path rather than by the API specification.
          */
         overridePath?: boolean;
     }
@@ -78427,6 +79092,10 @@ export declare namespace container {
          * shared network.
          */
         network: string;
+        /**
+         * The IP stack type of the additional node interface. Possible values are IPV4, IPV4_IPV6 and IPV6. If unset, the value is inferred from the additional subnetwork.
+         */
+        stackType: string;
         /**
          * The name or selfLink of the Google Compute Engine
          * subnetwork in which the cluster's instances are launched.
@@ -78456,9 +79125,9 @@ export declare namespace container {
     }
     interface ClusterNodePoolNetworkConfigPodCidrOverprovisionConfig {
         /**
-         * Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled.When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic
+         * Whether Pod CIDR overprovisioning is disabled.
          *
-         * <a name="nestedClusterTelemetry"></a>The `clusterTelemetry` block supports
+         * <a name="nestedAutoIpamConfig"></a>The auto ipam config supports:
          */
         disabled: boolean;
     }
@@ -78549,7 +79218,7 @@ export declare namespace container {
          */
         gvnic?: outputs.container.ClusterNodePoolNodeConfigGvnic;
         /**
-         * The maintenance policy for the hosts on which the GKE VMs run on. Structure is documented below.
+         * ) The maintenance policy for the hosts on which the GKE VMs run on. Structure is documented below.
          */
         hostMaintenancePolicy?: outputs.container.ClusterNodePoolNodeConfigHostMaintenancePolicy;
         /**
@@ -78711,7 +79380,7 @@ export declare namespace container {
          */
         taints?: outputs.container.ClusterNodePoolNodeConfigTaint[];
         /**
-         * Windows node configuration, currently supporting OSVersion [attribute](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/NodeConfig#osversion). The value must be one of [OS_VERSION_UNSPECIFIED, OS_VERSION_LTSC2019, OS_VERSION_LTSC2022]. For example:
+         * Windows node configuration. Structure is documented below.
          */
         windowsNodeConfig: outputs.container.ClusterNodePoolNodeConfigWindowsNodeConfig;
         /**
@@ -78727,6 +79396,8 @@ export declare namespace container {
         enableNestedVirtualization?: boolean;
         /**
          * Defines the performance monitoring unit [PMU](https://cloud.google.com/compute/docs/pmu-overview) level. Valid values are `ARCHITECTURAL`, `STANDARD`, or `ENHANCED`. Defaults to off.
+         *
+         * > **Note:** Early 8.x provider versions dropped an explicitly configured `STANDARD` value when creating the resource. On affected node pools the diff stays suppressed and this field cannot be updated in place, so enabling `STANDARD` requires recreating the node pool.
          */
         performanceMonitoringUnit?: string;
         /**
@@ -78772,7 +79443,7 @@ export declare namespace container {
          */
         privateRegistryAccessConfig?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigPrivateRegistryAccessConfig;
         /**
-         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail. Example:
+         * Defines containerd registry host configuration. Each `registryHosts` entry represents a `hosts.toml` file. See [customize containerd configuration in GKE nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/customize-containerd-configuration#registryHosts) for more detail.
          */
         registryHosts?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigRegistryHost[];
         /**
@@ -78782,7 +79453,7 @@ export declare namespace container {
     }
     interface ClusterNodePoolNodeConfigContainerdConfigPrivateRegistryAccessConfig {
         /**
-         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail. Example:
+         * List of configuration objects for CA and domains. Each object identifies a certificate and its assigned domains. See [how to configure for private container registries](https://cloud.google.com/kubernetes-engine/docs/how-to/access-private-registries-private-certificates) for more detail.
          */
         certificateAuthorityDomainConfigs?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfig[];
         /**
@@ -78796,19 +79467,21 @@ export declare namespace container {
          */
         fqdns: string[];
         /**
-         * Parameters for configuring a certificate hosted in GCP SecretManager.
+         * Parameters for configuring a certificate hosted in GCP SecretManager:
          */
         gcpSecretManagerCertificateConfig: outputs.container.ClusterNodePoolNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig;
     }
     interface ClusterNodePoolNodeConfigContainerdConfigPrivateRegistryAccessConfigCertificateAuthorityDomainConfigGcpSecretManagerCertificateConfig {
         /**
-         * URI for the secret that hosts a certificate. Must be in the format 'projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST'.
+         * URI for the secret that hosts a certificate. Must be in the format `projects/PROJECT_NUM/secrets/SECRET_NAME/versions/VERSION_OR_LATEST`.
+         *
+         * Example:
          */
         secretUri: string;
     }
     interface ClusterNodePoolNodeConfigContainerdConfigRegistryHost {
         /**
-         * Configures a list of host-specific configurations for the server.
+         * Configures a list of host-specific configurations for the server:
          */
         hosts?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigRegistryHostHost[];
         /**
@@ -78818,15 +79491,17 @@ export declare namespace container {
     }
     interface ClusterNodePoolNodeConfigContainerdConfigRegistryHostHost {
         /**
-         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing.
+         * Represent the capabilities of the registry host, specifying what operations a host is capable of performing. Valid values include `HOST_CAPABILITY_PULL`, `HOST_CAPABILITY_RESOLVE`, `HOST_CAPABILITY_PUSH`.
          */
         capabilities?: string[];
         /**
-         * Configures the registry host certificate.
+         * Configures the registry host certificate. Contains `gcpSecretManagerSecretUri` (Optional).
          */
         cas?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigRegistryHostHostCa[];
         /**
-         * Configures the registry host client certificate and key.
+         * Configures the registry host client certificate and key. Contains `cert` (Required) with `gcpSecretManagerSecretUri` (Optional) and `key` (Optional) with `gcpSecretManagerSecretUri` (Optional).
+         *
+         * Example:
          */
         clients?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigRegistryHostHostClient[];
         /**
@@ -78834,7 +79509,7 @@ export declare namespace container {
          */
         dialTimeout?: string;
         /**
-         * Configures the registry host headers.
+         * Configures the registry host headers. Each header contains `key` (Required, string) and `value` (Required, list of strings).
          */
         headers?: outputs.container.ClusterNodePoolNodeConfigContainerdConfigRegistryHostHostHeader[];
         /**
@@ -78842,7 +79517,7 @@ export declare namespace container {
          */
         host: string;
         /**
-         * Indicate the host's API root endpoint is defined in the URL path rather than by the API specification.
+         * Indicates the host's API root endpoint is defined in the URL path rather than by the API specification.
          */
         overridePath?: boolean;
     }
@@ -79497,7 +80172,7 @@ export declare namespace container {
     }
     interface ClusterNodePoolNodeConfigWindowsNodeConfig {
         /**
-         * The OS Version of the windows nodepool.Values are OS_VERSION_UNSPECIFIED,OS_VERSION_LTSC2019 and OS_VERSION_LTSC2022
+         * OSVersion [attribute](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/NodeConfig#osversion). The value must be one of `OS_VERSION_UNSPECIFIED`, `OS_VERSION_LTSC2019`, or `OS_VERSION_LTSC2022`.
          */
         osversion?: string;
     }
@@ -79829,15 +80504,15 @@ export declare namespace container {
     }
     interface ClusterTpuConfig {
         /**
-         * Whether Cloud TPU integration is enabled or not
+         * Whether Cloud TPU integration is enabled or not.
          */
         enabled: boolean;
         /**
-         * IPv4 CIDR block reserved for Cloud TPU in the VPC.
+         * The IPv4 CIDR block reserved for Cloud TPU in the VPC.
          */
         ipv4CidrBlock: string;
         /**
-         * Whether to use service networking for Cloud TPU or not
+         * Whether to use service networking for Cloud TPU or not.
          */
         useServiceNetworking?: boolean;
     }
@@ -80940,7 +81615,7 @@ export declare namespace container {
          */
         enableNestedVirtualization: boolean;
         /**
-         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed.
+         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed. For existing node pools with no PMU, setting STANDARD may not produce a diff; recreate the node pool to apply it.
          */
         performanceMonitoringUnit: string;
         /**
@@ -81188,7 +81863,7 @@ export declare namespace container {
     }
     interface GetClusterNodeConfigHostMaintenancePolicy {
         /**
-         * .
+         * Specifies the frequency of planned maintenance events. One of: "MAINTENANCE_INTERVAL_UNSPECIFIED", "AS_NEEDED", "PERIODIC".
          */
         maintenanceInterval: string;
         /**
@@ -82044,6 +82719,10 @@ export declare namespace container {
          * Name of the VPC where the additional interface belongs.
          */
         network: string;
+        /**
+         * The IP stack type of the additional node interface. Possible values are IPV4, IPV4_IPV6 and IPV6. If unset, the value is inferred from the additional subnetwork.
+         */
+        stackType: string;
         /**
          * Name of the subnetwork where the additional interface belongs.
          */
@@ -82284,7 +82963,7 @@ export declare namespace container {
          */
         enableNestedVirtualization: boolean;
         /**
-         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed.
+         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed. For existing node pools with no PMU, setting STANDARD may not produce a diff; recreate the node pool to apply it.
          */
         performanceMonitoringUnit: string;
         /**
@@ -82532,7 +83211,7 @@ export declare namespace container {
     }
     interface GetClusterNodePoolNodeConfigHostMaintenancePolicy {
         /**
-         * .
+         * Specifies the frequency of planned maintenance events. One of: "MAINTENANCE_INTERVAL_UNSPECIFIED", "AS_NEEDED", "PERIODIC".
          */
         maintenanceInterval: string;
         /**
@@ -83420,7 +84099,7 @@ export declare namespace container {
     }
     interface NodePoolNetworkConfig {
         /**
-         * ) - Specifies the accelerator network profile for nodes in this node pool. Setting to `"auto"` enables GKE to automatically configure high-performance networking settings for nodes with accelerators (like GPUs). GKE manages the underlying resources (like VPCs and subnets) for this configuration.
+         * Specifies the accelerator network profile for nodes in this node pool. Setting to `"auto"` enables GKE to automatically configure high-performance networking settings for nodes with accelerators (like GPUs). GKE manages the underlying resources (like VPCs and subnets) for this configuration.
          */
         acceleratorNetworkProfile?: string;
         /**
@@ -83467,6 +84146,10 @@ export declare namespace container {
          * Name of the VPC where the additional interface belongs.
          */
         network: string;
+        /**
+         * ) The IP stack type of the additional node interface. Possible values are `IPV4`, `IPV4_IPV6` and `IPV6`. If unset, the value is inferred from the additional subnetwork.
+         */
+        stackType: string;
         /**
          * Name of the subnetwork where the additional interface belongs.
          */
@@ -83568,7 +84251,7 @@ export declare namespace container {
          */
         gvnic?: outputs.container.NodePoolNodeConfigGvnic;
         /**
-         * The maintenance policy for the hosts on which the GKE VMs run on.
+         * ) The maintenance policy for the hosts on which the GKE VMs run on. Structure is documented below.
          */
         hostMaintenancePolicy?: outputs.container.NodePoolNodeConfigHostMaintenancePolicy;
         /**
@@ -83710,7 +84393,7 @@ export declare namespace container {
          */
         enableNestedVirtualization?: boolean;
         /**
-         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed.
+         * Level of Performance Monitoring Unit (PMU) requested. If unset, no access to the PMU is assumed. For existing node pools with no PMU, setting STANDARD may not produce a diff; recreate the node pool to apply it.
          */
         performanceMonitoringUnit?: string;
         /**
@@ -83958,17 +84641,17 @@ export declare namespace container {
     }
     interface NodePoolNodeConfigHostMaintenancePolicy {
         /**
-         * .
+         * Specifies the frequency of planned maintenance events. Possible values are `MAINTENANCE_INTERVAL_UNSPECIFIED`, `AS_NEEDED`, and `PERIODIC`.
          */
         maintenanceInterval: string;
         /**
-         * Strategy that will trigger maintenance on behalf of the customer.
+         * Strategy that will trigger maintenance on behalf of the customer. Structure is documented below.
          */
         opportunisticMaintenanceStrategy?: outputs.container.NodePoolNodeConfigHostMaintenancePolicyOpportunisticMaintenanceStrategy;
     }
     interface NodePoolNodeConfigHostMaintenancePolicyOpportunisticMaintenanceStrategy {
         /**
-         * The window of time that opportunistic maintenance can run. Example: A setting of 14 days implies that opportunistic maintenance can only be ran in the 2 weeks leading up to the scheduled maintenance date. Setting 28 days allows opportunistic maintenance to run at any time in the scheduled maintenance window (all PERIODIC maintenance is set 28 days in advance).
+         * The window of time that opportunistic maintenance can run. Example: A setting of 14 days (`"1209600s"`) implies that opportunistic maintenance can only be ran in the 2 weeks leading up to the scheduled maintenance date. Setting 28 days (`"2419200s"`) allows opportunistic maintenance to run at any time in the scheduled maintenance window (all `PERIODIC` maintenance is set 28 days in advance).
          */
         maintenanceAvailabilityWindow: string;
         /**
@@ -83976,7 +84659,7 @@ export declare namespace container {
          */
         minNodesPerPool: number;
         /**
-         * The amount of time that a node can remain idle (no customer owned workloads running), before triggering maintenance.
+         * The amount of time that a node can remain idle (no customer owned workloads running), before triggering maintenance. Format is a duration terminated by `s`, e.g. `"600s"`.
          */
         nodeIdleTimeWindow: string;
     }
@@ -86319,6 +87002,12 @@ export declare namespace dataloss {
         ruleSets?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSet[];
     }
     interface PreventionContentPolicyInspectConfigCustomInfoType {
+        /**
+         * Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order
+         * that they are specified. Only supported for the dictionary, regex, and storedType CustomInfoTypes.
+         * Structure is documented below.
+         */
+        detectionRules?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRule[];
         /**
          * Dictionary which defines the rule.
          * Structure is documented below.
@@ -86329,6 +87018,11 @@ export declare namespace dataloss {
          * Possible values are: `EXCLUSION_TYPE_EXCLUDE`.
          */
         exclusionType?: string;
+        /**
+         * Configuration for a custom infoType that detects file labels.
+         * Structure is documented below.
+         */
+        fileLabelInfoType?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoType;
         /**
          * CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing
          * infoTypes and that infoType is specified in `infoTypes` field. Specifying the latter adds findings to the
@@ -86344,6 +87038,11 @@ export declare namespace dataloss {
          * Possible values are: `VERY_UNLIKELY`, `UNLIKELY`, `POSSIBLE`, `LIKELY`, `VERY_LIKELY`.
          */
         likelihood?: string;
+        /**
+         * Configuration for a custom infoType that detects key-value pairs in the metadata matching the specified regular expressions.
+         * Structure is documented below.
+         */
+        metadataKeyValueExpression?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeMetadataKeyValueExpression;
         /**
          * Regular expression which defines the rule.
          * Structure is documented below.
@@ -86364,6 +87063,64 @@ export declare namespace dataloss {
          */
         surrogateType?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeSurrogateType;
     }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRule {
+        /**
+         * Hotword-based detection rule.
+         * Structure is documented below.
+         */
+        hotwordRule?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRule;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRule {
+        /**
+         * Regular expression pattern defining what qualifies as a hotword.
+         * Structure is documented below.
+         */
+        hotwordRegex: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleHotwordRegex;
+        /**
+         * Likelihood adjustment to apply to all matching findings.
+         * Structure is documented below.
+         */
+        likelihoodAdjustment: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleLikelihoodAdjustment;
+        /**
+         * Proximity of the finding within which the entire hotword must reside. The total length of the window cannot
+         * exceed 1000 characters.
+         * Structure is documented below.
+         */
+        proximity: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleProximity;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleHotwordRegex {
+        /**
+         * The index of the submatch to extract as findings. When not specified,
+         * the entire match is returned. No more than 3 may be included.
+         */
+        groupIndexes?: number[];
+        /**
+         * Pattern defining the regular expression. Its syntax
+         * (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
+         */
+        pattern: string;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleLikelihoodAdjustment {
+        /**
+         * Set the likelihood of a finding to a fixed value. Either this or relativeLikelihood can be set.
+         * Possible values are: `VERY_UNLIKELY`, `UNLIKELY`, `POSSIBLE`, `LIKELY`, `VERY_LIKELY`.
+         */
+        fixedLikelihood?: string;
+        /**
+         * Increase or decrease the likelihood by the specified number of levels.
+         */
+        relativeLikelihood?: number;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeDetectionRuleHotwordRuleProximity {
+        /**
+         * Number of characters after the finding to consider.
+         */
+        windowAfter?: number;
+        /**
+         * Number of characters before the finding to consider.
+         */
+        windowBefore?: number;
+    }
     interface PreventionContentPolicyInspectConfigCustomInfoTypeDictionary {
         /**
          * Newline-delimited file of words in Cloud Storage. Only a single file is accepted.
@@ -86389,6 +87146,45 @@ export declare namespace dataloss {
          */
         words: string[];
     }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoType {
+        /**
+         * Google Drive labels published by Google.
+         * Structure is documented below.
+         */
+        googleDriveLabel?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeGoogleDriveLabel;
+        /**
+         * Sensitivity labels published by Microsoft.
+         * Structure is documented below.
+         */
+        sensitivityLabel?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeSensitivityLabel;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeGoogleDriveLabel {
+        /**
+         * The field values of the Google Drive label to match.
+         * Structure is documented below.
+         */
+        labelFieldsToMatches?: outputs.dataloss.PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeGoogleDriveLabelLabelFieldsToMatch[];
+        /**
+         * The label ID of the Google Drive label.
+         */
+        labelId: string;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeGoogleDriveLabelLabelFieldsToMatch {
+        /**
+         * The identifier of the Label Field.
+         */
+        id: string;
+        /**
+         * The value of the Label Field to match.
+         */
+        value: string;
+    }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeFileLabelInfoTypeSensitivityLabel {
+        /**
+         * The GUID of the sensitivity label.
+         */
+        guid: string;
+    }
     interface PreventionContentPolicyInspectConfigCustomInfoTypeInfoType {
         /**
          * Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names
@@ -86412,6 +87208,16 @@ export declare namespace dataloss {
          */
         score: string;
     }
+    interface PreventionContentPolicyInspectConfigCustomInfoTypeMetadataKeyValueExpression {
+        /**
+         * The regular expression for the key.
+         */
+        keyRegex: string;
+        /**
+         * The regular expression for the value.
+         */
+        valueRegex: string;
+    }
     interface PreventionContentPolicyInspectConfigCustomInfoTypeRegex {
         /**
          * The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.
@@ -86431,6 +87237,11 @@ export declare namespace dataloss {
         score: string;
     }
     interface PreventionContentPolicyInspectConfigCustomInfoTypeStoredType {
+        /**
+         * (Output)
+         * Output only. Timestamp indicating when the version of the StoredInfoType used for inspection was created.
+         */
+        createTime: string;
         /**
          * Resource name of the requested StoredInfoType, for example `organizations/433245324/storedInfoTypes/432452342`
          * or `projects/project-id/storedInfoTypes/432452342`.
@@ -86441,12 +87252,11 @@ export declare namespace dataloss {
     }
     interface PreventionContentPolicyInspectConfigInfoType {
         /**
-         * Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
-         * at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
+         * Name of the information type.
          */
         name: string;
         /**
-         * Optional custom sensitivity for this InfoType. This only applies to data profiling.
+         * Optional custom sensitivity for this InfoType.
          * Structure is documented below.
          */
         sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigInfoTypeSensitivityScore;
@@ -86532,11 +87342,23 @@ export declare namespace dataloss {
          * listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
          */
         name: string;
+        /**
+         * Optional custom sensitivity for this InfoType. This only applies to data profiling.
+         * Structure is documented below.
+         */
+        sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigMinLikelihoodPerInfoTypeInfoTypeSensitivityScore;
         /**
          * Version name for this InfoType.
          */
         version?: string;
     }
+    interface PreventionContentPolicyInspectConfigMinLikelihoodPerInfoTypeInfoTypeSensitivityScore {
+        /**
+         * The sensitivity score applied to the resource.
+         * Possible values are: `SENSITIVITY_LOW`, `SENSITIVITY_MODERATE`, `SENSITIVITY_HIGH`.
+         */
+        score: string;
+    }
     interface PreventionContentPolicyInspectConfigRuleSet {
         /**
          * List of infoTypes this rule set is applied to.
@@ -86551,12 +87373,11 @@ export declare namespace dataloss {
     }
     interface PreventionContentPolicyInspectConfigRuleSetInfoType {
         /**
-         * Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
-         * at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
+         * Name of the information type.
          */
         name: string;
         /**
-         * Optional custom sensitivity for this InfoType. This only applies to data profiling.
+         * Optional custom sensitivity for this InfoType.
          * Structure is documented below.
          */
         sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetInfoTypeSensitivityScore;
@@ -86573,6 +87394,11 @@ export declare namespace dataloss {
         score: string;
     }
     interface PreventionContentPolicyInspectConfigRuleSetRule {
+        /**
+         * Rule that specifies conditions when a certain infoType's finding details should be adjusted.
+         * Structure is documented below.
+         */
+        adjustmentRule?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRule;
         /**
          * The rule that specifies conditions when findings of infoTypes specified in InspectionRuleSet are removed from results.
          * Structure is documented below.
@@ -86584,6 +87410,128 @@ export declare namespace dataloss {
          */
         hotwordRule?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleHotwordRule;
     }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRule {
+        /**
+         * AdjustmentRule condition for image findings.
+         * Structure is documented below.
+         */
+        adjustByImageFindings?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindings;
+        /**
+         * AdjustmentRule condition for matching infoTypes.
+         * Structure is documented below.
+         */
+        adjustByMatchingInfoTypes?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypes;
+        /**
+         * Likelihood adjustment to apply to all matching findings.
+         * Structure is documented below.
+         */
+        likelihoodAdjustment: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleLikelihoodAdjustment;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindings {
+        /**
+         * Specifies the required spatial relationship between the bounding boxes of the target finding and the context infoType findings.
+         * Structure is documented below.
+         */
+        imageContainmentType?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentType;
+        /**
+         * A list of image-supported infoTypes to be used as context for the adjustment rule.
+         * Structure is documented below.
+         */
+        infoTypes: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsInfoType[];
+        /**
+         * Minimum likelihood of the adjustByImageFindings infoTypes finding.
+         * Possible values are: `VERY_UNLIKELY`, `UNLIKELY`, `POSSIBLE`, `LIKELY`, `VERY_LIKELY`.
+         */
+        minLikelihood: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentType {
+        /**
+         * Defines a condition where one bounding box encloses another.
+         */
+        encloses?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeEncloses;
+        /**
+         * Defines a condition where one bounding box is fully inside another.
+         */
+        fullyInside?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeFullyInside;
+        /**
+         * Defines a condition for overlapping bounding boxes.
+         */
+        overlaps?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeOverlaps;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeEncloses {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeFullyInside {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsImageContainmentTypeOverlaps {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsInfoType {
+        /**
+         * Name of the information type.
+         */
+        name: string;
+        /**
+         * Optional custom sensitivity for this InfoType.
+         * Structure is documented below.
+         */
+        sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsInfoTypeSensitivityScore;
+        /**
+         * Version name for this InfoType.
+         */
+        version?: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByImageFindingsInfoTypeSensitivityScore {
+        /**
+         * The sensitivity score applied to the resource.
+         * Possible values are: `SENSITIVITY_LOW`, `SENSITIVITY_MODERATE`, `SENSITIVITY_HIGH`.
+         */
+        score: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypes {
+        /**
+         * Sensitive Data Protection adjusts the likelihood of a finding if that finding also matches one of these infoTypes.
+         * Structure is documented below.
+         */
+        infoTypes: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypesInfoType[];
+        /**
+         * How the adjustment rule is applied.
+         * Possible values are: `MATCHING_TYPE_FULL_MATCH`, `MATCHING_TYPE_PARTIAL_MATCH`, `MATCHING_TYPE_INVERSE_MATCH`.
+         */
+        matchingType: string;
+        /**
+         * Minimum likelihood of the adjustByMatchingInfoTypes infoTypes finding.
+         * Possible values are: `VERY_UNLIKELY`, `UNLIKELY`, `POSSIBLE`, `LIKELY`, `VERY_LIKELY`.
+         */
+        minLikelihood: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypesInfoType {
+        /**
+         * Name of the information type.
+         */
+        name: string;
+        /**
+         * Optional custom sensitivity for this InfoType.
+         * Structure is documented below.
+         */
+        sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypesInfoTypeSensitivityScore;
+        /**
+         * Version name for this InfoType.
+         */
+        version?: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleAdjustByMatchingInfoTypesInfoTypeSensitivityScore {
+        /**
+         * The sensitivity score applied to the resource.
+         * Possible values are: `SENSITIVITY_LOW`, `SENSITIVITY_MODERATE`, `SENSITIVITY_HIGH`.
+         */
+        score: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleAdjustmentRuleLikelihoodAdjustment {
+        /**
+         * Set the likelihood of a finding to a fixed value. Either this or relativeLikelihood can be set.
+         * Possible values are: `VERY_UNLIKELY`, `UNLIKELY`, `POSSIBLE`, `LIKELY`, `VERY_LIKELY`.
+         */
+        fixedLikelihood: string;
+    }
     interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRule {
         /**
          * Dictionary which defines the rule.
@@ -86596,6 +87544,11 @@ export declare namespace dataloss {
          * Structure is documented below.
          */
         excludeByHotword?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByHotword;
+        /**
+         * The rule to exclude image findings based on spatial relationships with other image findings.
+         * Structure is documented below.
+         */
+        excludeByImageFindings?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindings;
         /**
          * Set of infoTypes for which findings would affect this rule.
          * Structure is documented below.
@@ -86603,7 +87556,7 @@ export declare namespace dataloss {
         excludeInfoTypes?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeInfoTypes;
         /**
          * How the rule is applied. See the documentation for more information: https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#MatchingType
-         * Possible values are: `MATCHING_TYPE_FULL_MATCH`, `MATCHING_TYPE_PARTIAL_MATCH`, `MATCHING_TYPE_INVERSE_MATCH`.
+         * Possible values are: `MATCHING_TYPE_FULL_MATCH`, `MATCHING_TYPE_PARTIAL_MATCH`, `MATCHING_TYPE_INVERSE_MATCH`, `MATCHING_TYPE_RULE_SPECIFIC`.
          */
         matchingType: string;
         /**
@@ -86675,6 +87628,60 @@ export declare namespace dataloss {
          */
         windowBefore?: number;
     }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindings {
+        /**
+         * Specifies the required spatial relationship between the bounding boxes of the target finding and the context infoType findings.
+         * Structure is documented below.
+         */
+        imageContainmentType?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentType;
+        /**
+         * A list of image-supported infoTypes to be used as context for the exclusion rule.
+         * Structure is documented below.
+         */
+        infoTypes: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsInfoType[];
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentType {
+        /**
+         * Defines a condition where one bounding box encloses another.
+         */
+        encloses?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeEncloses;
+        /**
+         * Defines a condition where one bounding box is fully inside another.
+         */
+        fullyInside?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeFullyInside;
+        /**
+         * Defines a condition for overlapping bounding boxes.
+         */
+        overlaps?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeOverlaps;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeEncloses {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeFullyInside {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsImageContainmentTypeOverlaps {
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsInfoType {
+        /**
+         * Name of the information type.
+         */
+        name: string;
+        /**
+         * Optional custom sensitivity for this InfoType.
+         * Structure is documented below.
+         */
+        sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsInfoTypeSensitivityScore;
+        /**
+         * Version name for this InfoType.
+         */
+        version?: string;
+    }
+    interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeByImageFindingsInfoTypeSensitivityScore {
+        /**
+         * The sensitivity score applied to the resource.
+         * Possible values are: `SENSITIVITY_LOW`, `SENSITIVITY_MODERATE`, `SENSITIVITY_HIGH`.
+         */
+        score: string;
+    }
     interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeInfoTypes {
         /**
          * If a finding is matched by any of the infoType detectors listed here, the finding will be excluded from the scan results.
@@ -86684,12 +87691,11 @@ export declare namespace dataloss {
     }
     interface PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeInfoTypesInfoType {
         /**
-         * Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed
-         * at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type.
+         * Name of the information type.
          */
         name: string;
         /**
-         * Optional custom sensitivity for this InfoType. This only applies to data profiling.
+         * Optional custom sensitivity for this InfoType.
          * Structure is documented below.
          */
         sensitivityScore?: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleExclusionRuleExcludeInfoTypesInfoTypeSensitivityScore;
@@ -86729,10 +87735,7 @@ export declare namespace dataloss {
         likelihoodAdjustment: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleHotwordRuleLikelihoodAdjustment;
         /**
          * Proximity of the finding within which the entire hotword must reside. The total length of the window cannot
-         * exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be
-         * used to match substrings of the finding itself. For example, the certainty of a phone number regex
-         * `(\d{3}) \d{3}-\d{4}` could be adjusted upwards if the area code is known to be the local area code of a company
-         * office using the hotword regex `(xxx)`, where `xxx` is the area code in question.
+         * exceed 1000 characters.
          * Structure is documented below.
          */
         proximity: outputs.dataloss.PreventionContentPolicyInspectConfigRuleSetRuleHotwordRuleProximity;
@@ -86756,12 +87759,7 @@ export declare namespace dataloss {
          */
         fixedLikelihood?: string;
         /**
-         * Increase or decrease the likelihood by the specified number of levels. For example,
-         * if a finding would be POSSIBLE without the detection rule and relativeLikelihood is 1,
-         * then it is upgraded to LIKELY, while a value of -1 would downgrade it to UNLIKELY.
-         * Likelihood may never drop below VERY_UNLIKELY or exceed VERY_LIKELY, so applying an
-         * adjustment of 1 followed by an adjustment of -1 when base likelihood is VERY_LIKELY
-         * will result in a final likelihood of LIKELY. Either this or fixedLikelihood can be set.
+         * Increase or decrease the likelihood by the specified number of levels.
          */
         relativeLikelihood?: number;
     }
@@ -97445,11 +98443,11 @@ export declare namespace dataproc {
     }
     interface WorkflowTemplatePlacementManagedClusterConfigMasterConfig {
         /**
-         * The Compute Engine accelerator configuration for these instances.
+         * The Compute Engine accelerator configuration for these instances. Structure is documented below.
          */
         accelerators: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigMasterConfigAccelerator[];
         /**
-         * Disk option config settings.
+         * Disk option config settings. Structure is documented below.
          */
         diskConfig: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigMasterConfigDiskConfig;
         /**
@@ -97500,19 +98498,53 @@ export declare namespace dataproc {
         acceleratorType?: string;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigMasterConfigDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigInstanceFlexibilityPolicy {
         /**
          * Output only. A map of instance names to their machine types.
@@ -97544,19 +98576,53 @@ export declare namespace dataproc {
         rank: number;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionResult {
         /**
          * Output only. Full machine-type names, e.g. `n1-standard-16`.
@@ -97640,19 +98706,53 @@ export declare namespace dataproc {
         acceleratorType?: string;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigInstanceFlexibilityPolicy {
         /**
          * Output only. A map of instance names to their machine types.
@@ -97688,19 +98788,53 @@ export declare namespace dataproc {
         rank: number;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigSecondaryWorkerConfigInstanceFlexibilityPolicyInstanceSelectionResult {
         /**
          * Output only. Full machine-type names, e.g. `n1-standard-16`.
@@ -97886,19 +99020,53 @@ export declare namespace dataproc {
         acceleratorType?: string;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigWorkerConfigDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigInstanceFlexibilityPolicy {
         /**
          * Output only. A map of instance names to their machine types.
@@ -97930,19 +99098,53 @@ export declare namespace dataproc {
         rank: number;
     }
     interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfig {
+        /**
+         * Optional. Attached disk configuration. Structure is documented below.
+         */
+        attachedDiskConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig[];
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle. Values must be greater than or equal to 3000. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be greater than or equal to 140. Supported only if `bootDiskType` is `hyperdisk-balanced`.
+         */
+        bootDiskProvisionedThroughput: number;
         /**
          * Size in GB of the boot disk (default is 500GB).
          */
         bootDiskSizeGb: number;
         /**
-         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
+         * Type of the boot disk (default is "pd-standard"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive), "pd-standard" (Persistent Disk Hard Disk Drive), or "hyperdisk-balanced".
          */
         bootDiskType: string;
         /**
-         * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
+         * Interface type of local SSDs (default is "scsi"). Valid values: "scsi" (Small Computer System Interface), "nvme" (Non-Volatile Memory Express).
+         */
+        localSsdInterface: string;
+        /**
+         * Number of attached SSDs, from 0 to 8 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
          */
         numLocalSsds: number;
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionListDiskConfigAttachedDiskConfig {
+        /**
+         * Size of the attached disk, specified in GB.
+         */
+        diskSizeGb: number;
+        /**
+         * The disk type of the attached disk. Currently only supports Hyperdisks: `hyperdisk-balanced`, `hyperdisk-extreme`, `hyperdisk-ml`, `hyperdisk-throughput`.
+         */
+        diskType: string;
+        /**
+         * Indicates how many IOPS to provision for the disk. This sets the number of I/O operations per second that the disk can handle.
+         */
+        provisionedIops: number;
+        /**
+         * Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle.
+         */
+        provisionedThroughput: number;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionResult {
         /**
          * Output only. Full machine-type names, e.g. `n1-standard-16`.
@@ -105628,6 +106830,11 @@ export declare namespace diagflow {
          * Structure is documented below.
          */
         summarySuggestion?: outputs.diagflow.GeneratorSummarizationContextFewShotExampleOutputSummarySuggestion;
+        /**
+         * List of request and response for tool calls executed.
+         * Structure is documented below.
+         */
+        toolCallInfos?: outputs.diagflow.GeneratorSummarizationContextFewShotExampleOutputToolCallInfo[];
     }
     interface GeneratorSummarizationContextFewShotExampleOutputSummarySuggestion {
         /**
@@ -105646,6 +106853,49 @@ export declare namespace diagflow {
          */
         summary: string;
     }
+    interface GeneratorSummarizationContextFewShotExampleOutputToolCallInfo {
+        /**
+         * Request for a tool call.
+         * Structure is documented below.
+         */
+        toolCall: outputs.diagflow.GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCall;
+        /**
+         * Response for a tool call.
+         * Structure is documented below.
+         */
+        toolCallResult: outputs.diagflow.GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCallResult;
+    }
+    interface GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCall {
+        /**
+         * The name of the tool's action associated with this call.
+         */
+        action?: string;
+        /**
+         * The tool associated with this call.
+         */
+        tool?: string;
+    }
+    interface GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCallResult {
+        /**
+         * The name of the tool's action associated with this call.
+         */
+        action?: string;
+        /**
+         * An error produced by the tool call.
+         * Structure is documented below.
+         */
+        error?: outputs.diagflow.GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCallResultError;
+    }
+    interface GeneratorSummarizationContextFewShotExampleOutputToolCallInfoToolCallResultError {
+        /**
+         * The error message of the function.
+         */
+        message?: string;
+        /**
+         * Specifies whether the tool call is retryable.
+         */
+        retryable?: boolean;
+    }
     interface GeneratorSummarizationContextFewShotExampleSummarizationSectionList {
         /**
          * Optional. Summarization sections.
@@ -106132,6 +107382,28 @@ export declare namespace discoveryengine {
          */
         message: string;
     }
+    interface DataConnectorMetadata {
+        /**
+         * The party that authored the connector, e.g. "Google" or a third-party provider name.
+         */
+        author: string;
+        /**
+         * Human-readable description of the connector.
+         */
+        description: string;
+        /**
+         * Free-form, multi-line note about the connector's capabilities.
+         */
+        note: string;
+        /**
+         * Short, subtitle-length description of the connector.
+         */
+        shortDescription: string;
+        /**
+         * Display title of the connector.
+         */
+        title: string;
+    }
     interface DataStoreAdvancedSiteSearchConfig {
         /**
          * If set true, automatic refresh is disabled for the DataStore.
@@ -106848,6 +108120,19 @@ export declare namespace discoveryengine {
          * Possible values are: `SNIPPET`, `EXTRACTIVE_ANSWER`.
          */
         resultDescriptionType?: string;
+        /**
+         * SearchAddonSpec is used to disable add-ons for search. By default, if this
+         * field is not specified, add-ons are enabled wherever applicable.
+         * This field is only supported for search requests.
+         * Structure is documented below.
+         */
+        searchAddonSpec?: outputs.discoveryengine.WidgetConfigUiSettingsSearchAddonSpec;
+        /**
+         * Whether to show the admin-configured display name for data connectors in
+         * the widget sources UI (instead of the connector kind). Opt-in; defaults
+         * to false.
+         */
+        sourceAdminDisplayNameEnabled?: boolean;
     }
     interface WidgetConfigUiSettingsDataStoreUiConfig {
         /**
@@ -106950,6 +108235,23 @@ export declare namespace discoveryengine {
          */
         resultCount?: number;
     }
+    interface WidgetConfigUiSettingsSearchAddonSpec {
+        /**
+         * If true, generative answer add-on is disabled. Generative answer
+         * add-on includes natural language to filters and simple answers.
+         */
+        generativeAnswerAddOnDisabled?: boolean;
+        /**
+         * If true, disables event re-ranking and personalization to optimize KPIs
+         * & personalize results.
+         */
+        kpiPersonalizationAddOnDisabled?: boolean;
+        /**
+         * If true, semantic add-on is disabled. Semantic add-on includes
+         * embeddings and jetstream.
+         */
+        semanticAddOnDisabled?: boolean;
+    }
 }
 export declare namespace dns {
     interface DnsManagedZoneIamBindingCondition {
@@ -108925,8 +110227,13 @@ export declare namespace filestore {
     }
     interface GetInstanceFileShare {
         /**
-         * File share capacity in GiB. This must be at least 1024 GiB
-         * for the standard tier, or 2560 GiB for the premium tier.
+         * File share capacity in GiB. Acceptable instance capacities for each tier are as follows:
+         * * BASIC_HDD: 1024-65433 GiB in 1 GiB increments or its multiples.
+         * * BASIC_SSD: 2560-65433 GiB in 1 GiB increments or its multiples.
+         * * HIGH_SCALE_SSD: 10240-102400 GiB in 2560 GiB increments or its multiples.
+         * * ZONAL: 100-102400 GiB (100-10239 GiB in 1 GiB increments or its multiples; 10240-102400 GiB in 2560 GiB increments or its multiples).
+         * * ENTERPRISE: 1024-10240 GiB in 256 GiB increments or its multiples.
+         * * REGIONAL: 1024-102400 GiB (100-102400 GiB in supported regions): ((100 or 1024)-10239 GiB in 1 GiB increments or its multiples; 10240-102400 GiB in 2560 GiB increments or its multiples).
          */
         capacityGb: number;
         /**
@@ -109145,8 +110452,13 @@ export declare namespace filestore {
     }
     interface InstanceFileShares {
         /**
-         * File share capacity in GiB. This must be at least 1024 GiB
-         * for the standard tier, or 2560 GiB for the premium tier.
+         * File share capacity in GiB. Acceptable instance capacities for each tier are as follows:
+         * * BASIC_HDD: 1024-65433 GiB in 1 GiB increments or its multiples.
+         * * BASIC_SSD: 2560-65433 GiB in 1 GiB increments or its multiples.
+         * * HIGH_SCALE_SSD: 10240-102400 GiB in 2560 GiB increments or its multiples.
+         * * ZONAL: 100-102400 GiB (100-10239 GiB in 1 GiB increments or its multiples; 10240-102400 GiB in 2560 GiB increments or its multiples).
+         * * ENTERPRISE: 1024-10240 GiB in 256 GiB increments or its multiples.
+         * * REGIONAL: 1024-102400 GiB (100-102400 GiB in supported regions): ((100 or 1024)-10239 GiB in 1 GiB increments or its multiples; 10240-102400 GiB in 2560 GiB increments or its multiples).
          */
         capacityGb: number;
         /**
@@ -109311,22 +110623,21 @@ export declare namespace filestore {
 export declare namespace firebase {
     interface AiLogicConfigGenerativeLanguageConfig {
         /**
-         * The value of the API key. The API key must have
-         * `generativelanguage.googleapis.com` in its "API restrictions" allowlist.
-         * Note that this API is sometimes called the *Generative Language API* in
-         * the Google Cloud console.
-         * Do **not** add this Gemini API key into your app's codebase
+         * (Optional, Deprecated)
+         * The value of the API key. Firebase AI Logic no longer requires API key
+         * material; values provided here may be silently ignored on input.
          * **Note**: This property is sensitive and will not be displayed in the plan.
+         *
+         * > **Warning:** `generative_language_config.api_key` is deprecated and will be removed in a future major release. Firebase AI Logic now uses a Google-managed service account to authenticate requests to the Gemini Developer API and no longer requires an API key.
+         *
+         * @deprecated `generative_language_config.api_key` is deprecated and will be removed in a future major release. Firebase AI Logic now uses a Google-managed service account to authenticate requests to the Gemini Developer API and no longer requires an API key.
          */
         apiKey?: string;
         /**
          * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
          * (Optional, Write-Only)
-         * The value of the API key. The API key must have
-         * `generativelanguage.googleapis.com` in its "API restrictions" allowlist.
-         * Note that this API is sometimes called the *Generative Language API* in
-         * the Google Cloud console.
-         * Do **not** add this Gemini API key into your app's codebase
+         * The value of the API key. Firebase AI Logic no longer requires API key
+         * material; values provided here may be silently ignored on input.
          * **Note**: This property is write-only and will not be read from the API.
          *
          * > **Note:** One of `apiKey` or `apiKeyWo` can only be set.
@@ -110961,6 +112272,24 @@ export declare namespace gemini {
          */
         tracesEnabled?: boolean;
     }
+    interface GibqObservabilitySettingConversationalAnalyticsSetting {
+        /**
+         * Whether to enable feedback.
+         */
+        feedbackEnabled?: boolean;
+        /**
+         * Whether to enable logging.
+         */
+        loggingEnabled?: boolean;
+        /**
+         * Whether to enable metrics.
+         */
+        metricsEnabled?: boolean;
+        /**
+         * Whether to enable traces.
+         */
+        tracesEnabled?: boolean;
+    }
     interface RepositoryGroupIamBindingCondition {
         description?: string;
         expression: string;
@@ -130040,6 +131369,66 @@ export declare namespace networksecurity {
     }
 }
 export declare namespace networkservices {
+    interface AgentConnectivityTemplateEgressNetworkConfig {
+        /**
+         * DNS peering configuration for the AgentConnectivityTemplate.
+         * When set, the gateway will resolve queries for the configured
+         * `domains` via Cloud DNS in the specified `targetNetwork`.
+         * Structure is documented below.
+         */
+        dnsPeeringConfig?: outputs.networkservices.AgentConnectivityTemplateEgressNetworkConfigDnsPeeringConfig;
+        /**
+         * The network attachment resource name.
+         * Format: projects/{project}/regions/{region}/networkAttachments/{network_attachment_id}
+         */
+        networkAttachment?: string;
+        /**
+         * The TLS configuration for the egress traffic.
+         * Structure is documented below.
+         */
+        tlsConfig?: outputs.networkservices.AgentConnectivityTemplateEgressNetworkConfigTlsConfig;
+        /**
+         * The VPC egress setting.
+         * Possible values are: `ALL_TRAFFIC`, `PRIVATE_RANGES_ONLY`.
+         */
+        vpcEgress?: string;
+    }
+    interface AgentConnectivityTemplateEgressNetworkConfigDnsPeeringConfig {
+        /**
+         * (Optional, Deprecated)
+         * The domain name to peer for DNS resolution. Must be a fully
+         * qualified domain name ending with a dot (for example, `example.com.`).
+         *
+         * > **Warning:** `domain` is deprecated and will be removed in a future major release. Use `domains` instead.
+         *
+         * @deprecated `domain` is deprecated and will be removed in a future major release. Use `domains` instead.
+         */
+        domain?: string;
+        /**
+         * The list of domain names to peer for DNS resolution. Each entry
+         * must be a fully qualified domain name ending with a dot
+         * (for example, `example.com.`). At least one domain must be
+         * specified between `domain` and `domains`.
+         */
+        domains?: string[];
+        /**
+         * The URI of the target VPC network for DNS peering. Must be of the
+         * form `projects/{project}/global/networks/{network}`.
+         */
+        targetNetwork: string;
+    }
+    interface AgentConnectivityTemplateEgressNetworkConfigTlsConfig {
+        /**
+         * Defines whether additional roots should be trusted.
+         * Possible values are: `NO_ADDITIONAL_ROOTS`, `PUBLICLY_TRUSTED_ROOTS`.
+         */
+        additionalRoots: string;
+        /**
+         * The trust config resource name.
+         * Format: projects/{project}/locations/{location}/trustConfigs/{trust_config}
+         */
+        trustConfig?: string;
+    }
     interface AgentGatewayAgentGatewayCard {
         /**
          * (Output)
@@ -148704,6 +150093,11 @@ export declare namespace secretmanager {
          * The unique name of the resource.
          */
         secretId: string;
+        /**
+         * This defines the type of the secret. Enforces certain structural requirements on the SecretVersions.
+         * For secret of type UNSPECIFIED, the SecretVersions can be of any type.
+         */
+        secretType: string;
         /**
          * A map of resource manager tags.
          * Resource manager tag keys and values have the same definition as resource manager tags.
@@ -148897,6 +150291,11 @@ export declare namespace secretmanager {
          * This must be unique within the project.
          */
         secretId: string;
+        /**
+         * This defines the type of the secret. Enforces certain structural requirements on the SecretVersions.
+         * For secret of type UNSPECIFIED, the SecretVersions can be of any type.
+         */
+        secretType: string;
         /**
          * A map of resource manager tags.
          * Resource manager tag keys and values have the same definition as resource manager tags.
@@ -152240,7 +153639,7 @@ export declare namespace sql {
          */
         diskAutoresizeLimit: number;
         /**
-         * The size of data disk, in GB. Size of a running instance cannot be reduced but can be increased. The minimum value is 10GB for PD_SSD, PD_HDD and 20GB for HYPERDISK_BALANCED.
+         * The size of data disk, in GB. The size of a running instance can be increased, or reduced when diskAutoresize is disabled (this triggers an in-place storage shrink, which restarts the instance). The minimum value is 10GB for PD_SSD, PD_HDD and 20GB for HYPERDISK_BALANCED.
          */
         diskSize: number;
         /**
@@ -152816,6 +154215,10 @@ export declare namespace sql {
          * The list of DNS names used by this instance. Different connection types for an instance may have different DNS names. DNS names can apply to an individual instance or a cluster of instances.
          */
         dnsNames: outputs.sql.GetDatabaseInstancesInstanceDnsName[];
+        /**
+         * Enables Confidential Mode on Hyperdisk storage for enhanced security. Only supported on Zonal C4A PG and MySQL instances.
+         */
+        encryptionConfidentialMode: boolean;
         encryptionKeyName: string;
         /**
          * Whether to enforce the new SQL network architecture.
@@ -153154,7 +154557,7 @@ export declare namespace sql {
          */
         diskAutoresizeLimit: number;
         /**
-         * The size of data disk, in GB. Size of a running instance cannot be reduced but can be increased. The minimum value is 10GB for PD_SSD, PD_HDD and 20GB for HYPERDISK_BALANCED.
+         * The size of data disk, in GB. The size of a running instance can be increased, or reduced when diskAutoresize is disabled (this triggers an in-place storage shrink, which restarts the instance). The minimum value is 10GB for PD_SSD, PD_HDD and 20GB for HYPERDISK_BALANCED.
          */
         diskSize: number;
         /**
@@ -154453,6 +155856,11 @@ export declare namespace storage {
          * A list of allowed IPv4 or IPv6 CIDR block ranges that can connect to this server.
          */
         allowedCidrBlocks?: string[];
+        /**
+         * (Output)
+         * The public IP address of the external load balancer for the SFTP server.
+         */
+        ipAddress: string;
     }
     interface FtpServerInternalConfig {
         /**
@@ -154465,6 +155873,11 @@ export declare namespace storage {
          * Structure is documented below.
          */
         consumerRejectLists?: outputs.storage.FtpServerInternalConfigConsumerRejectList[];
+        /**
+         * (Output)
+         * The Private Service Connect service attachment URI for the SFTP server.
+         */
+        serviceAttachment: string;
     }
     interface FtpServerInternalConfigConsumerAcceptList {
         /**
@@ -154501,7 +155914,7 @@ export declare namespace storage {
          */
         permission?: string;
     }
-    interface FtpUserUserCredentials {
+    interface FtpUserUserCredential {
         /**
          * The name of the credential.
          */
@@ -154886,6 +156299,10 @@ export declare namespace storage {
          * The [StorageClass](https://cloud.google.com/storage/docs/storage-classes) of the bucket object.
          */
         storageClass: string;
+        /**
+         * The modification time of the object metadata in RFC 3339 format.
+         */
+        updated: string;
     }
     interface GetBucketRetentionPolicy {
         /**
@@ -161012,6 +162429,16 @@ export declare namespace vertex {
         kmsKeyName: string;
     }
     interface AiRagCorpusVectorDbConfig {
+        /**
+         * Authentication config for the chosen Vector DB.
+         * Structure is documented below.
+         */
+        apiAuth?: outputs.vertex.AiRagCorpusVectorDbConfigApiAuth;
+        /**
+         * The config for the Pinecone.
+         * Structure is documented below.
+         */
+        pinecone?: outputs.vertex.AiRagCorpusVectorDbConfigPinecone;
         /**
          * Optional. Immutable. The embedding model config of the Vector DB.
          * Structure is documented below.
@@ -161022,6 +162449,36 @@ export declare namespace vertex {
          * Structure is documented below.
          */
         ragManagedDb?: outputs.vertex.AiRagCorpusVectorDbConfigRagManagedDb;
+        /**
+         * The config for the Vertex Vector Search.
+         * Structure is documented below.
+         */
+        vertexVectorSearch?: outputs.vertex.AiRagCorpusVectorDbConfigVertexVectorSearch;
+    }
+    interface AiRagCorpusVectorDbConfigApiAuth {
+        /**
+         * The API secret.
+         * Structure is documented below.
+         */
+        apiKeyConfig?: outputs.vertex.AiRagCorpusVectorDbConfigApiAuthApiKeyConfig;
+    }
+    interface AiRagCorpusVectorDbConfigApiAuthApiKeyConfig {
+        /**
+         * The SecretManager secret version resource name storing API key.
+         * e.g. projects/{project}/secrets/{secret}/versions/{version}
+         */
+        apiKeySecretVersion?: string;
+        /**
+         * The API key string.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        apiKeyString?: string;
+    }
+    interface AiRagCorpusVectorDbConfigPinecone {
+        /**
+         * Pinecone index name. This value cannot be changed after it's set.
+         */
+        indexName: string;
     }
     interface AiRagCorpusVectorDbConfigRagEmbeddingModelConfig {
         /**
@@ -161071,6 +162528,27 @@ export declare namespace vertex {
     }
     interface AiRagCorpusVectorDbConfigRagManagedDbKnn {
     }
+    interface AiRagCorpusVectorDbConfigVertexVectorSearch {
+        /**
+         * The resource name of the Index.
+         * Format: projects/{project}/locations/{location}/indexes/{index}
+         */
+        index: string;
+        /**
+         * The resource name of the Index Endpoint.
+         * Format: projects/{project}/locations/{location}/indexEndpoints/{index_endpoint}
+         */
+        indexEndpoint: string;
+    }
+    interface AiRagCorpusVertexAiSearchConfig {
+        /**
+         * Vertex AI Search Serving Config resource full name. For example,
+         * projects/{project}/locations/{location}/collections/{collection}/engines/{engine}/servingConfigs/{serving_config}
+         * or
+         * projects/{project}/locations/{location}/collections/{collection}/dataStores/{data_store}/servingConfigs/{serving_config}.
+         */
+        servingConfig: string;
+    }
     interface AiRagEngineConfigRagManagedDbConfig {
         /**
          * Basic tier is a cost-effective and low compute tier suitable for the following cases: Experimenting with RagManagedDb, Small data size, Latency insensitive workload, Only using RAG Engine with external vector DBs.
@@ -162014,6 +163492,13 @@ export declare namespace vertex {
          */
         runtimeRevisionName: string;
     }
+    interface AiSemanticGovernancePolicyAgentResponseCustomization {
+        /**
+         * Custom message shown to the end user when the policy check results in a denial. Use this
+         * to explain the rationale to the user. Max 1000 characters.
+         */
+        denialMessage?: string;
+    }
     interface AiSemanticGovernancePolicyEngineGatewayConfig {
         /**
          * Additional consumer projects permitted to attach their own PSC endpoint
@@ -162080,6 +163565,18 @@ export declare namespace vertex {
          */
         subnetwork?: string;
     }
+    interface AiSemanticGovernancePolicyMcpTools {
+        /**
+         * The resource name of the McpServer in Agent Registry that is affected by this policy.
+         * Format: `projects/{project}/locations/{location}/mcpServers/{mcpServer}`
+         */
+        mcpServer: string;
+        /**
+         * The resource names of the McpTools used by the Agent that is affected by this policy.
+         * At least one tool must be listed.
+         */
+        tools: string[];
+    }
     interface AiTensorboardEncryptionSpec {
         /**
          * The Cloud KMS resource identifier of the customer managed encryption key used to protect a resource.