// Copyright 2022 Luca Casonato. All rights reserved. MIT license.
/**
 * Security Posture API Client for Deno
 * ====================================
 * 
 * Defines, assesses, and monitors the overall status of your security in Google Cloud. You can use security postures to evaluate your current cloud security against defined benchmarks and help maintain the level of security that your organization requires. 
 * 
 * Docs: https://cloud.google.com/security-command-center
 * Source: https://googleapis.deno.dev/v1/securityposture:v1.ts
 */

import { auth, CredentialsClient, GoogleAuth, request } from "/_/base@v1/mod.ts";
export { auth, GoogleAuth };
export type { CredentialsClient };

/**
 * Defines, assesses, and monitors the overall status of your security in
 * Google Cloud. You can use security postures to evaluate your current cloud
 * security against defined benchmarks and help maintain the level of security
 * that your organization requires.
 */
export class SecurityPosture {
  #client: CredentialsClient | undefined;
  #baseUrl: string;

  constructor(client?: CredentialsClient, baseUrl: string = "https://securityposture.googleapis.com/") {
    this.#client = client;
    this.#baseUrl = baseUrl;
  }

  /**
   * Starts asynchronous cancellation on a long-running operation. The server
   * makes a best effort to cancel the operation, but success is not guaranteed.
   * If the server doesn't support this method, it returns
   * `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or
   * other methods to check whether the cancellation succeeded or whether the
   * operation completed despite cancellation. On successful cancellation, the
   * operation is not deleted; instead, it becomes an operation with an
   * Operation.error value with a google.rpc.Status.code of `1`, corresponding
   * to `Code.CANCELLED`.
   *
   * @param name The name of the operation resource to be cancelled.
   */
  async organizationsLocationsOperationsCancel(name: string, req: CancelOperationRequest): Promise<Empty> {
    const url = new URL(`${this.#baseUrl}v1/${ name }:cancel`);
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "POST",
      body,
    });
    return data as Empty;
  }

  /**
   * Deletes a long-running operation. This method indicates that the client is
   * no longer interested in the operation result. It does not cancel the
   * operation. If the server doesn't support this method, it returns
   * `google.rpc.Code.UNIMPLEMENTED`.
   *
   * @param name The name of the operation resource to be deleted.
   */
  async organizationsLocationsOperationsDelete(name: string): Promise<Empty> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    const data = await request(url.href, {
      client: this.#client,
      method: "DELETE",
    });
    return data as Empty;
  }

  /**
   * Gets the latest state of a long-running operation. Clients can use this
   * method to poll the operation result at intervals as recommended by the API
   * service.
   *
   * @param name The name of the operation resource.
   */
  async organizationsLocationsOperationsGet(name: string): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as Operation;
  }

  /**
   * Lists operations that match the specified filter in the request. If the
   * server doesn't support this method, it returns `UNIMPLEMENTED`.
   *
   * @param name The name of the operation's parent resource.
   */
  async organizationsLocationsOperationsList(name: string, opts: OrganizationsLocationsOperationsListOptions = {}): Promise<ListOperationsResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ name }/operations`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListOperationsResponse;
  }

  /**
   * Creates a new PostureDeployment in a given project and location.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPostureDeploymentsCreate(parent: string, req: PostureDeployment, opts: OrganizationsLocationsPostureDeploymentsCreateOptions = {}): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postureDeployments`);
    if (opts.postureDeploymentId !== undefined) {
      url.searchParams.append("postureDeploymentId", String(opts.postureDeploymentId));
    }
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "POST",
      body,
    });
    return data as Operation;
  }

  /**
   * Deletes a PostureDeployment.
   *
   * @param name Required. The name of the posture deployment, in the format `organizations/{organization}/locations/global/postureDeployments/{posture_id}`.
   */
  async organizationsLocationsPostureDeploymentsDelete(name: string, opts: OrganizationsLocationsPostureDeploymentsDeleteOptions = {}): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.etag !== undefined) {
      url.searchParams.append("etag", String(opts.etag));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "DELETE",
    });
    return data as Operation;
  }

  /**
   * Gets details for a PostureDeployment.
   *
   * @param name Required. The name of the PostureDeployment, in the format `organizations/{organization}/locations/global/postureDeployments/{posture_deployment_id}`.
   */
  async organizationsLocationsPostureDeploymentsGet(name: string): Promise<PostureDeployment> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as PostureDeployment;
  }

  /**
   * Lists every PostureDeployment in a project and location.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPostureDeploymentsList(parent: string, opts: OrganizationsLocationsPostureDeploymentsListOptions = {}): Promise<ListPostureDeploymentsResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postureDeployments`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListPostureDeploymentsResponse;
  }

  /**
   * Updates an existing PostureDeployment. To prevent concurrent updates from
   * overwriting each other, always follow the read-modify-write pattern when
   * you update a posture deployment: 1. Call GetPostureDeployment to get the
   * current version of the deployment. 2. Update the fields in the deployment
   * as needed. 3. Call UpdatePostureDeployment to update the deployment. Ensure
   * that your request includes the `etag` value from the GetPostureDeployment
   * response. **Important:** If you omit the `etag` when you call
   * UpdatePostureDeployment, then the updated deployment unconditionally
   * overwrites the existing deployment.
   *
   * @param name Required. Identifier. The name of the posture deployment, in the format `organizations/{organization}/locations/global/postureDeployments/{deployment_id}`.
   */
  async organizationsLocationsPostureDeploymentsPatch(name: string, req: PostureDeployment, opts: OrganizationsLocationsPostureDeploymentsPatchOptions = {}): Promise<Operation> {
    opts = serializeOrganizationsLocationsPostureDeploymentsPatchOptions(opts);
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.updateMask !== undefined) {
      url.searchParams.append("updateMask", String(opts.updateMask));
    }
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "PATCH",
      body,
    });
    return data as Operation;
  }

  /**
   * Creates a new Posture.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPosturesCreate(parent: string, req: Posture, opts: OrganizationsLocationsPosturesCreateOptions = {}): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postures`);
    if (opts.postureId !== undefined) {
      url.searchParams.append("postureId", String(opts.postureId));
    }
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "POST",
      body,
    });
    return data as Operation;
  }

  /**
   * Deletes all revisions of a Posture. You can only delete a posture if none
   * of its revisions are deployed.
   *
   * @param name Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  async organizationsLocationsPosturesDelete(name: string, opts: OrganizationsLocationsPosturesDeleteOptions = {}): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.etag !== undefined) {
      url.searchParams.append("etag", String(opts.etag));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "DELETE",
    });
    return data as Operation;
  }

  /**
   * Extracts existing policies from an organization, folder, or project, and
   * applies them to another organization, folder, or project as a Posture. If
   * the other organization, folder, or project already has a posture, then the
   * result of the long-running operation is an ALREADY_EXISTS error.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPosturesExtract(parent: string, req: ExtractPostureRequest): Promise<Operation> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postures:extract`);
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "POST",
      body,
    });
    return data as Operation;
  }

  /**
   * Gets a single revision of a Posture.
   *
   * @param name Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  async organizationsLocationsPosturesGet(name: string, opts: OrganizationsLocationsPosturesGetOptions = {}): Promise<Posture> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.revisionId !== undefined) {
      url.searchParams.append("revisionId", String(opts.revisionId));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as Posture;
  }

  /**
   * Lists the most recent revisions of all Posture resources in a specified
   * organization and location.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPosturesList(parent: string, opts: OrganizationsLocationsPosturesListOptions = {}): Promise<ListPosturesResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postures`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListPosturesResponse;
  }

  /**
   * Lists all revisions of a single Posture.
   *
   * @param name Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  async organizationsLocationsPosturesListRevisions(name: string, opts: OrganizationsLocationsPosturesListRevisionsOptions = {}): Promise<ListPostureRevisionsResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ name }:listRevisions`);
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListPostureRevisionsResponse;
  }

  /**
   * Updates a revision of an existing Posture. If the posture revision that
   * you update is currently deployed, then a new revision of the posture is
   * created. To prevent concurrent updates from overwriting each other, always
   * follow the read-modify-write pattern when you update a posture: 1. Call
   * GetPosture to get the current version of the posture. 2. Update the fields
   * in the posture as needed. 3. Call UpdatePosture to update the posture.
   * Ensure that your request includes the `etag` value from the GetPosture
   * response. **Important:** If you omit the `etag` when you call
   * UpdatePosture, then the updated posture unconditionally overwrites the
   * existing posture.
   *
   * @param name Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  async organizationsLocationsPosturesPatch(name: string, req: Posture, opts: OrganizationsLocationsPosturesPatchOptions = {}): Promise<Operation> {
    opts = serializeOrganizationsLocationsPosturesPatchOptions(opts);
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.revisionId !== undefined) {
      url.searchParams.append("revisionId", String(opts.revisionId));
    }
    if (opts.updateMask !== undefined) {
      url.searchParams.append("updateMask", String(opts.updateMask));
    }
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "PATCH",
      body,
    });
    return data as Operation;
  }

  /**
   * Gets a single revision of a PostureTemplate.
   *
   * @param name Required. The name of the PostureTemplate, in the format `organizations/{organization}/locations/global/postureTemplates/{posture_template}`.
   */
  async organizationsLocationsPostureTemplatesGet(name: string, opts: OrganizationsLocationsPostureTemplatesGetOptions = {}): Promise<PostureTemplate> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    if (opts.revisionId !== undefined) {
      url.searchParams.append("revisionId", String(opts.revisionId));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as PostureTemplate;
  }

  /**
   * Lists every PostureTemplate in a given organization and location.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsPostureTemplatesList(parent: string, opts: OrganizationsLocationsPostureTemplatesListOptions = {}): Promise<ListPostureTemplatesResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/postureTemplates`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListPostureTemplatesResponse;
  }

  /**
   * Validates a specified infrastructure-as-code (IaC) configuration, and
   * creates a Report with the validation results. Only Terraform configurations
   * are supported. Only modified assets are validated.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsReportsCreateIaCValidationReport(parent: string, req: CreateIaCValidationReportRequest): Promise<Operation> {
    req = serializeCreateIaCValidationReportRequest(req);
    const url = new URL(`${this.#baseUrl}v1/${ parent }/reports:createIaCValidationReport`);
    const body = JSON.stringify(req);
    const data = await request(url.href, {
      client: this.#client,
      method: "POST",
      body,
    });
    return data as Operation;
  }

  /**
   * Gets details for a Report.
   *
   * @param name Required. The name of the report, in the format `organizations/{organization}/locations/global/reports/{report_id}`.
   */
  async organizationsLocationsReportsGet(name: string): Promise<Report> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as Report;
  }

  /**
   * Lists every Report in a given organization and location.
   *
   * @param parent Required. The parent resource name, in the format `organizations/{organization}/locations/global`.
   */
  async organizationsLocationsReportsList(parent: string, opts: OrganizationsLocationsReportsListOptions = {}): Promise<ListReportsResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ parent }/reports`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListReportsResponse;
  }

  /**
   * Gets information about a location.
   *
   * @param name Resource name for the location.
   */
  async projectsLocationsGet(name: string): Promise<Location> {
    const url = new URL(`${this.#baseUrl}v1/${ name }`);
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as Location;
  }

  /**
   * Lists information about the supported locations for this service.
   *
   * @param name The resource that owns the locations collection, if applicable.
   */
  async projectsLocationsList(name: string, opts: ProjectsLocationsListOptions = {}): Promise<ListLocationsResponse> {
    const url = new URL(`${this.#baseUrl}v1/${ name }/locations`);
    if (opts.filter !== undefined) {
      url.searchParams.append("filter", String(opts.filter));
    }
    if (opts.pageSize !== undefined) {
      url.searchParams.append("pageSize", String(opts.pageSize));
    }
    if (opts.pageToken !== undefined) {
      url.searchParams.append("pageToken", String(opts.pageToken));
    }
    const data = await request(url.href, {
      client: this.#client,
      method: "GET",
    });
    return data as ListLocationsResponse;
  }
}

/**
 * Details of a Cloud Asset Inventory asset that caused a violation.
 */
export interface AssetDetails {
  /**
   * Information about the Cloud Asset Inventory asset that violated a policy.
   * The format of this information can change at any time without prior notice.
   * Your application must not depend on this information in any way.
   */
  asset?: string;
  /**
   * The type of Cloud Asset Inventory asset. For a list of asset types, see
   * [Supported asset
   * types](https://cloud.google.com/asset-inventory/docs/supported-asset-types).
   */
  assetType?: string;
}

/**
 * The request message for Operations.CancelOperation.
 */
export interface CancelOperationRequest {
}

/**
 * Information about a compliance standard that the policy helps enforce.
 */
export interface ComplianceStandard {
  /**
   * Optional. The control in the compliance standard that the policy helps
   * enforce. For example, `AC-3`.
   */
  control?: string;
  /**
   * Optional. The compliance standard that the policy helps enforce. For
   * example, `NIST SP 800-53`.
   */
  standard?: string;
}

/**
 * Metadata for a constraint in a Policy.
 */
export interface Constraint {
  /**
   * Optional. A predefined organization policy constraint.
   */
  orgPolicyConstraint?: OrgPolicyConstraint;
  /**
   * Optional. A custom organization policy constraint.
   */
  orgPolicyConstraintCustom?: OrgPolicyConstraintCustom;
  /**
   * Optional. A custom module for Security Health Analytics.
   */
  securityHealthAnalyticsCustomModule?: SecurityHealthAnalyticsCustomModule;
  /**
   * Optional. A built-in detector for Security Health Analytics.
   */
  securityHealthAnalyticsModule?: SecurityHealthAnalyticsModule;
}

/**
 * Request message for CreateIaCValidationReport.
 */
export interface CreateIaCValidationReportRequest {
  /**
   * Required. The infrastructure-as-code (IaC) configuration to validate.
   */
  iac?: IaC;
}

function serializeCreateIaCValidationReportRequest(data: any): CreateIaCValidationReportRequest {
  return {
    ...data,
    iac: data["iac"] !== undefined ? serializeIaC(data["iac"]) : undefined,
  };
}

function deserializeCreateIaCValidationReportRequest(data: any): CreateIaCValidationReportRequest {
  return {
    ...data,
    iac: data["iac"] !== undefined ? deserializeIaC(data["iac"]) : undefined,
  };
}

/**
 * A custom module configuration for Security Health Analytics. Use
 * `CustomConfig` to create custom detectors that generate custom findings for
 * resources that you specify.
 */
export interface CustomConfig {
  /**
   * Optional. Definitions of custom source properties to include in findings.
   */
  customOutput?: CustomOutputSpec;
  /**
   * Optional. A description of the vulnerability or misconfiguration that the
   * custom module detects. The description appears in each finding. Provide
   * enough information to help an investigator understand the finding. The
   * value must be enclosed in quotation marks.
   */
  description?: string;
  /**
   * Required. The Common Expression Language (CEL) expression to evaluate.
   * When the expression evaluates to `true` for a resource, a finding is
   * generated.
   */
  predicate?: Expr;
  /**
   * Required. An explanation of the steps that security teams can take to
   * resolve the detected issue. The explanation appears in each finding.
   */
  recommendation?: string;
  /**
   * Required. The resource types that the custom module operates on.
   */
  resourceSelector?: ResourceSelector;
  /**
   * Required. The severity of findings generated by the custom module.
   */
  severity?:  | "SEVERITY_UNSPECIFIED" | "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
}

/**
 * Definitions of custom source properties that can appear in findings.
 */
export interface CustomOutputSpec {
  /**
   * Optional. The custom source properties that can appear in findings.
   */
  properties?: Property[];
}

/**
 * A generic empty message that you can re-use to avoid defining duplicated
 * empty messages in your APIs. A typical example is to use it as the request or
 * the response type of an API method. For instance: service Foo { rpc
 * Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
 */
export interface Empty {
}

/**
 * Represents a textual expression in the Common Expression Language (CEL)
 * syntax. CEL is a C-like expression language. The syntax and semantics of CEL
 * are documented at https://github.com/google/cel-spec. Example (Comparison):
 * title: "Summary size limit" description: "Determines if a summary is less
 * than 100 chars" expression: "document.summary.size() < 100" Example
 * (Equality): title: "Requestor is owner" description: "Determines if requestor
 * is the document owner" expression: "document.owner ==
 * request.auth.claims.email" Example (Logic): title: "Public documents"
 * description: "Determine whether the document should be publicly visible"
 * expression: "document.type != 'private' && document.type != 'internal'"
 * Example (Data Manipulation): title: "Notification string" description:
 * "Create a notification string with a timestamp." expression: "'New message
 * received at ' + string(document.create_time)" The exact variables and
 * functions that may be referenced within an expression are determined by the
 * service that evaluates it. See the service documentation for additional
 * information.
 */
export interface Expr {
  /**
   * Optional. Description of the expression. This is a longer text which
   * describes the expression, e.g. when hovered over it in a UI.
   */
  description?: string;
  /**
   * Textual representation of an expression in Common Expression Language
   * syntax.
   */
  expression?: string;
  /**
   * Optional. String indicating the location of the expression for error
   * reporting, e.g. a file name and a position in the file.
   */
  location?: string;
  /**
   * Optional. Title for the expression, i.e. a short string describing its
   * purpose. This can be used e.g. in UIs which allow to enter the expression.
   */
  title?: string;
}

/**
 * Request message for ExtractPosture.
 */
export interface ExtractPostureRequest {
  /**
   * Required. An identifier for the posture.
   */
  postureId?: string;
  /**
   * Required. The organization, folder, or project from which policies are
   * extracted. Must be within the organization defined in parent. Use one of
   * the following formats: * `organization/{organization_number}` *
   * `folder/{folder_number}` * `project/{project_number}`
   */
  workload?: string;
}

/**
 * A custom, user-defined constraint. You can apply the constraint only to the
 * resource types specified in the constraint, and only within the organization
 * where the constraint is defined. _When you create a custom constraint, it is
 * not enforced automatically._ You must use an organization policy to [enforce
 * the
 * constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce).
 */
export interface GoogleCloudSecuritypostureV1CustomConstraint {
  /**
   * Whether to allow or deny the action.
   */
  actionType?:  | "ACTION_TYPE_UNSPECIFIED" | "ALLOW" | "DENY";
  /**
   * A Common Expression Language (CEL) condition expression that must evaluate
   * to `true` for the constraint to be enforced. The maximum length is 1000
   * characters. For example: +
   * `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates
   * to `true` if the resource's `instanceName` attribute contains the
   * following: + The prefix `production` or `test` + An underscore (`_`) +
   * Optional: One or more characters, followed by an underscore (`_`) + One or
   * more digits + `resource.management.auto_upgrade == true`: Evaluates to
   * `true` if the resource's `management.auto_upgrade` attribute is `true`.
   */
  condition?: string;
  /**
   * A description of the constraint. The maximum length is 2000 characters.
   */
  description?: string;
  /**
   * A display name for the constraint. The maximum length is 200 characters.
   */
  displayName?: string;
  /**
   * The types of operations that the constraint applies to.
   */
  methodTypes?:  | "METHOD_TYPE_UNSPECIFIED" | "CREATE" | "UPDATE" | "DELETE"[];
  /**
   * Immutable. The name of the constraint, in the format
   * `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`.
   * For example,
   * `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`.
   * Must contain 1 to 62 characters, excluding the prefix
   * `organizations/{organization_id}/customConstraints/custom.`.
   */
  name?: string;
  /**
   * Immutable. The resource type that the constraint applies to, in the format
   * `{canonical_service_name}/{resource_type_name}`. For example,
   * `compute.googleapis.com/Instance`.
   */
  resourceTypes?: string[];
  /**
   * Output only. The last time at which the constraint was updated or created.
   */
  readonly updateTime?: Date;
}

/**
 * A rule that defines the allowed and denied values for an organization policy
 * constraint.
 */
export interface GoogleCloudSecuritypostureV1PolicyRule {
  /**
   * Whether to allow any value for a list constraint. Valid only for list
   * constraints.
   */
  allowAll?: boolean;
  /**
   * A condition that determines whether this rule is used to evaluate the
   * policy. When set, the google.type.Expr.expression field must contain 1 to
   * 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression
   * must use the `resource.matchTag()` or `resource.matchTagId()` Common
   * Expression Language (CEL) function. The `resource.matchTag()` function
   * takes the following arguments: * `key_name`: the namespaced name of the tag
   * key, with the organization ID and a slash (`/`) as a prefix; for example,
   * `123456789012/environment` * `value_name`: the short name of the tag value
   * For example: `resource.matchTag('123456789012/environment, 'prod')` The
   * `resource.matchTagId()` function takes the following arguments: * `key_id`:
   * the permanent ID of the tag key; for example, `tagKeys/123456789012` *
   * `value_id`: the permanent ID of the tag value; for example,
   * `tagValues/567890123456` For example:
   * `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
   */
  condition?: Expr;
  /**
   * Whether to deny all values for a list constraint. Valid only for list
   * constraints.
   */
  denyAll?: boolean;
  /**
   * Whether to enforce the constraint. Valid only for boolean constraints.
   */
  enforce?: boolean;
  /**
   * Optional. Required for GMCs if parameters defined in constraints. Pass
   * parameter values when policy enforcement is enabled. Ensure that parameter
   * value types match those defined in the constraint definition. For example:
   * { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
   */
  parameters?: {
    [key: string]: any
  };
  /**
   * Optional. The resource types policy can support, only used for Google
   * managed constraint and method type is GOVERN_TAGS.
   */
  resourceTypes?: ResourceTypes;
  /**
   * The allowed and denied values for a list constraint. Valid only for list
   * constraints.
   */
  values?: GoogleCloudSecuritypostureV1PolicyRuleStringValues;
}

/**
 * The allowed and denied values for a list constraint. For all constraints,
 * these fields can contain literal values. Optionally, you can add the `is:`
 * prefix to these values. If the value contains a colon (`:`), then the `is:`
 * prefix is required. Some constraints allow you to specify a portion of the
 * resource hierarchy, known as a [_hierarchy
 * subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree),
 * that the constraint applies to. To specify a hierarchy subtree, use the
 * `under:` prefix, followed by a value with one of these formats: -
 * `projects/{project_id}` (for example, `projects/tokyo-rain-123`) -
 * `folders/{folder_id}` (for example, `folders/1234567890123`) -
 * `organizations/{organization_id}` (for example, `organizations/123456789012`)
 * A constraint's `supports_under` field indicates whether you can specify a
 * hierarchy subtree. To learn which predefined constraints let you specify a
 * hierarchy subtree, see the [constraints
 * reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference).
 */
export interface GoogleCloudSecuritypostureV1PolicyRuleStringValues {
  /**
   * The allowed values for the constraint.
   */
  allowedValues?: string[];
  /**
   * The denied values for the constraint.
   */
  deniedValues?: string[];
}

/**
 * Details of an infrastructure-as-code (IaC) configuration.
 */
export interface IaC {
  /**
   * Optional. A Terraform plan file, formatted as a stringified JSON object.
   * To learn how to generate a Terraform plan file in JSON format, see [JSON
   * output
   * format](https://developer.hashicorp.com/terraform/internals/json-format) in
   * the Terraform documentation.
   */
  tfPlan?: Uint8Array;
}

function serializeIaC(data: any): IaC {
  return {
    ...data,
    tfPlan: data["tfPlan"] !== undefined ? encodeBase64(data["tfPlan"]) : undefined,
  };
}

function deserializeIaC(data: any): IaC {
  return {
    ...data,
    tfPlan: data["tfPlan"] !== undefined ? decodeBase64(data["tfPlan"] as string) : undefined,
  };
}

/**
 * Details of an infrastructure-as-code (IaC) validation report.
 */
export interface IaCValidationReport {
  /**
   * Additional information about the report.
   */
  note?: string;
  /**
   * A list of every Violation found in the IaC configuration.
   */
  violations?: Violation[];
}

/**
 * The response message for Locations.ListLocations.
 */
export interface ListLocationsResponse {
  /**
   * A list of locations that matches the specified filter in the request.
   */
  locations?: Location[];
  /**
   * The standard List next-page token.
   */
  nextPageToken?: string;
}

/**
 * The response message for Operations.ListOperations.
 */
export interface ListOperationsResponse {
  /**
   * The standard List next-page token.
   */
  nextPageToken?: string;
  /**
   * A list of operations that matches the specified filter in the request.
   */
  operations?: Operation[];
}

/**
 * Response message for ListPostureDeployments.
 */
export interface ListPostureDeploymentsResponse {
  /**
   * A pagination token. To retrieve the next page of results, call the method
   * again with this token.
   */
  nextPageToken?: string;
  /**
   * The list of PostureDeployment resources.
   */
  postureDeployments?: PostureDeployment[];
  /**
   * Locations that were temporarily unavailable and could not be reached.
   */
  unreachable?: string[];
}

/**
 * Response message for ListPostureRevisions.
 */
export interface ListPostureRevisionsResponse {
  /**
   * A pagination token. To retrieve the next page of results, call the method
   * again with this token.
   */
  nextPageToken?: string;
  /**
   * The list of revisions for the Posture.
   */
  revisions?: Posture[];
}

/**
 * Response message for ListPostures.
 */
export interface ListPosturesResponse {
  /**
   * A pagination token. To retrieve the next page of results, call the method
   * again with this token.
   */
  nextPageToken?: string;
  /**
   * The list of Posture resources.
   */
  postures?: Posture[];
  /**
   * Locations that were temporarily unavailable and could not be reached.
   */
  unreachable?: string[];
}

/**
 * Response message for ListPostureTemplates.
 */
export interface ListPostureTemplatesResponse {
  /**
   * A pagination token. To retrieve the next page of results, call the method
   * again with this token.
   */
  nextPageToken?: string;
  /**
   * The list of PostureTemplate resources.
   */
  postureTemplates?: PostureTemplate[];
}

/**
 * Response message for ListReports.
 */
export interface ListReportsResponse {
  /**
   * A pagination token. To retrieve the next page of results, call the method
   * again with this token.
   */
  nextPageToken?: string;
  /**
   * The list of Report resources.
   */
  reports?: Report[];
  /**
   * Locations that were temporarily unavailable and could not be reached.
   */
  unreachable?: string[];
}

/**
 * A resource that represents a Google Cloud location.
 */
export interface Location {
  /**
   * The friendly name for this location, typically a nearby city name. For
   * example, "Tokyo".
   */
  displayName?: string;
  /**
   * Cross-service attributes for the location. For example
   * {"cloud.googleapis.com/region": "us-east1"}
   */
  labels?: {
    [key: string]: string
  };
  /**
   * The canonical id for this location. For example: `"us-east1"`.
   */
  locationId?: string;
  /**
   * Service-specific metadata. For example the available capacity at the given
   * location.
   */
  metadata?: {
    [key: string]: any
  };
  /**
   * Resource name for the location, which may vary between implementations.
   * For example: `"projects/example-project/locations/us-east1"`
   */
  name?: string;
}

/**
 * This resource represents a long-running operation that is the result of a
 * network API call.
 */
export interface Operation {
  /**
   * If the value is `false`, it means the operation is still in progress. If
   * `true`, the operation is completed, and either `error` or `response` is
   * available.
   */
  done?: boolean;
  /**
   * The error result of the operation in case of failure or cancellation.
   */
  error?: Status;
  /**
   * Service-specific metadata associated with the operation. It typically
   * contains progress information and common metadata such as create time. Some
   * services might not provide such metadata. Any method that returns a
   * long-running operation should document the metadata type, if any.
   */
  metadata?: {
    [key: string]: any
  };
  /**
   * The server-assigned name, which is only unique within the same service
   * that originally returns it. If you use the default HTTP mapping, the `name`
   * should be a resource name ending with `operations/{unique_id}`.
   */
  name?: string;
  /**
   * The normal, successful response of the operation. If the original method
   * returns no data on success, such as `Delete`, the response is
   * `google.protobuf.Empty`. If the original method is standard
   * `Get`/`Create`/`Update`, the response should be the resource. For other
   * methods, the response should have the type `XxxResponse`, where `Xxx` is
   * the original method name. For example, if the original method name is
   * `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
   */
  response?: {
    [key: string]: any
  };
}

/**
 * Metadata for an Operation.
 */
export interface OperationMetadata {
  /**
   * Output only. The API version used to start the operation.
   */
  readonly apiVersion?: string;
  /**
   * Output only. The time at which the operation was created.
   */
  readonly createTime?: Date;
  /**
   * Output only. The time at which the operation finished running.
   */
  readonly endTime?: Date;
  /**
   * Output only. An error message. Returned when a PostureDeployment enters a
   * failure state like UPDATE_FAILED.
   */
  readonly errorMessage?: string;
  /**
   * Output only. Whether a request to cancel the operation has been received.
   * For operations that have been cancelled successfully, the Operation.error
   * field contains the error code CANCELLED.
   */
  readonly requestedCancellation?: boolean;
  /**
   * Output only. The status of the operation, if any.
   */
  readonly statusMessage?: string;
  /**
   * Output only. The server-defined resource path for the target of the
   * operation.
   */
  readonly target?: string;
  /**
   * Output only. The name of the action executed by the operation.
   */
  readonly verb?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsOperationsList.
 */
export interface OrganizationsLocationsOperationsListOptions {
  /**
   * The standard list filter.
   */
  filter?: string;
  /**
   * The standard list page size.
   */
  pageSize?: number;
  /**
   * The standard list page token.
   */
  pageToken?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureDeploymentsCreate.
 */
export interface OrganizationsLocationsPostureDeploymentsCreateOptions {
  /**
   * Required. An identifier for the posture deployment.
   */
  postureDeploymentId?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureDeploymentsDelete.
 */
export interface OrganizationsLocationsPostureDeploymentsDeleteOptions {
  /**
   * Optional. An opaque identifier for the current version of the posture
   * deployment. If you provide this value, then it must match the existing
   * value. If the values don't match, then the request fails with an ABORTED
   * error. If you omit this value, then the posture deployment is deleted
   * regardless of its current `etag` value.
   */
  etag?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureDeploymentsList.
 */
export interface OrganizationsLocationsPostureDeploymentsListOptions {
  /**
   * Optional. A filter to apply to the list of postures, in the format defined
   * in [AIP-160: Filtering](https://google.aip.dev/160).
   */
  filter?: string;
  /**
   * Optional. The maximum number of posture deployments to return. The default
   * value is `500`. If you exceed the maximum value of `1000`, then the service
   * uses the maximum value.
   */
  pageSize?: number;
  /**
   * Optional. A pagination token returned from a previous request to list
   * posture deployments. Provide this token to retrieve the next page of
   * results.
   */
  pageToken?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureDeploymentsPatch.
 */
export interface OrganizationsLocationsPostureDeploymentsPatchOptions {
  /**
   * Required. The fields in the PostureDeployment to update. You can update
   * only the following fields: * PostureDeployment.posture_id *
   * PostureDeployment.posture_revision_id
   */
  updateMask?: string /* FieldMask */;
}

function serializeOrganizationsLocationsPostureDeploymentsPatchOptions(data: any): OrganizationsLocationsPostureDeploymentsPatchOptions {
  return {
    ...data,
    updateMask: data["updateMask"] !== undefined ? data["updateMask"] : undefined,
  };
}

function deserializeOrganizationsLocationsPostureDeploymentsPatchOptions(data: any): OrganizationsLocationsPostureDeploymentsPatchOptions {
  return {
    ...data,
    updateMask: data["updateMask"] !== undefined ? data["updateMask"] : undefined,
  };
}

/**
 * Additional options for SecurityPosture#organizationsLocationsPosturesCreate.
 */
export interface OrganizationsLocationsPosturesCreateOptions {
  /**
   * Required. An identifier for the posture.
   */
  postureId?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsPosturesDelete.
 */
export interface OrganizationsLocationsPosturesDeleteOptions {
  /**
   * Optional. An opaque identifier for the current version of the posture. If
   * you provide this value, then it must match the existing value. If the
   * values don't match, then the request fails with an ABORTED error. If you
   * omit this value, then the posture is deleted regardless of its current
   * `etag` value.
   */
  etag?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsPosturesGet.
 */
export interface OrganizationsLocationsPosturesGetOptions {
  /**
   * Optional. The posture revision to retrieve. If not specified, the most
   * recently updated revision is retrieved.
   */
  revisionId?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsPosturesList.
 */
export interface OrganizationsLocationsPosturesListOptions {
  /**
   * Optional. A filter to apply to the list of postures, in the format defined
   * in [AIP-160: Filtering](https://google.aip.dev/160).
   */
  filter?: string;
  /**
   * The maximum number of postures to return. The default value is `500`. If
   * you exceed the maximum value of `1000`, then the service uses the maximum
   * value.
   */
  pageSize?: number;
  /**
   * A pagination token returned from a previous request to list postures.
   * Provide this token to retrieve the next page of results.
   */
  pageToken?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPosturesListRevisions.
 */
export interface OrganizationsLocationsPosturesListRevisionsOptions {
  /**
   * Optional. The maximum number of posture revisions to return. The default
   * value is `500`. If you exceed the maximum value of `1000`, then the service
   * uses the maximum value.
   */
  pageSize?: number;
  /**
   * Optional. A pagination token from a previous request to list posture
   * revisions. Provide this token to retrieve the next page of results.
   */
  pageToken?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsPosturesPatch.
 */
export interface OrganizationsLocationsPosturesPatchOptions {
  /**
   * Required. The revision ID of the posture to update. If the posture
   * revision that you update is currently deployed, then a new revision of the
   * posture is created.
   */
  revisionId?: string;
  /**
   * Required. The fields in the Posture to update. You can update only the
   * following fields: * Posture.description * Posture.policy_sets *
   * Posture.state
   */
  updateMask?: string /* FieldMask */;
}

function serializeOrganizationsLocationsPosturesPatchOptions(data: any): OrganizationsLocationsPosturesPatchOptions {
  return {
    ...data,
    updateMask: data["updateMask"] !== undefined ? data["updateMask"] : undefined,
  };
}

function deserializeOrganizationsLocationsPosturesPatchOptions(data: any): OrganizationsLocationsPosturesPatchOptions {
  return {
    ...data,
    updateMask: data["updateMask"] !== undefined ? data["updateMask"] : undefined,
  };
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureTemplatesGet.
 */
export interface OrganizationsLocationsPostureTemplatesGetOptions {
  /**
   * Optional. The posture template revision to retrieve. If not specified, the
   * most recently updated revision is retrieved.
   */
  revisionId?: string;
}

/**
 * Additional options for
 * SecurityPosture#organizationsLocationsPostureTemplatesList.
 */
export interface OrganizationsLocationsPostureTemplatesListOptions {
  /**
   * Optional. A filter to apply to the list of postures, in the format defined
   * in [AIP-160: Filtering](https://google.aip.dev/160).
   */
  filter?: string;
  /**
   * Optional. The maximum number of posture templates to return. The default
   * value is `500`. If you exceed the maximum value of `1000`, then the service
   * uses the maximum value.
   */
  pageSize?: number;
  /**
   * Optional. A pagination token returned from a previous request to list
   * posture templates. Provide this token to retrieve the next page of results.
   */
  pageToken?: string;
}

/**
 * Additional options for SecurityPosture#organizationsLocationsReportsList.
 */
export interface OrganizationsLocationsReportsListOptions {
  /**
   * Optional. A filter to apply to the list of reports, in the format defined
   * in [AIP-160: Filtering](https://google.aip.dev/160).
   */
  filter?: string;
  /**
   * Optional. The maximum number of reports to return. The default value is
   * `500`. If you exceed the maximum value of `1000`, then the service uses the
   * maximum value.
   */
  pageSize?: number;
  /**
   * Optional. A pagination token returned from a previous request to list
   * reports. Provide this token to retrieve the next page of results.
   */
  pageToken?: string;
}

/**
 * A predefined organization policy constraint.
 */
export interface OrgPolicyConstraint {
  /**
   * Required. A unique identifier for the constraint.
   */
  cannedConstraintId?: string;
  /**
   * Required. The rules enforced by the constraint.
   */
  policyRules?: GoogleCloudSecuritypostureV1PolicyRule[];
}

/**
 * A custom organization policy constraint.
 */
export interface OrgPolicyConstraintCustom {
  /**
   * Required. Metadata for the constraint.
   */
  customConstraint?: GoogleCloudSecuritypostureV1CustomConstraint;
  /**
   * Required. The rules enforced by the constraint.
   */
  policyRules?: GoogleCloudSecuritypostureV1PolicyRule[];
}

/**
 * The details of a policy, including the constraints that it includes.
 */
export interface Policy {
  /**
   * Optional. The compliance standards that the policy helps enforce.
   */
  complianceStandards?: ComplianceStandard[];
  /**
   * Required. The constraints that the policy includes.
   */
  constraint?: Constraint;
  /**
   * Optional. A description of the policy.
   */
  description?: string;
  /**
   * Required. A user-specified identifier for the policy. In a PolicySet, each
   * policy must have a unique identifier.
   */
  policyId?: string;
}

/**
 * Details of a policy that was violated.
 */
export interface PolicyDetails {
  /**
   * The compliance standards that the policy maps to. For example, `CIS-2.0
   * 1.15`.
   */
  complianceStandards?: string[];
  /**
   * Information about the constraint that was violated. The format of this
   * information can change at any time without prior notice. Your application
   * must not depend on this information in any way.
   */
  constraint?: string;
  /**
   * The type of constraint that was violated.
   */
  constraintType?:  | "CONSTRAINT_TYPE_UNSPECIFIED" | "SECURITY_HEALTH_ANALYTICS_CUSTOM_MODULE" | "ORG_POLICY_CUSTOM" | "SECURITY_HEALTH_ANALYTICS_MODULE" | "ORG_POLICY" | "REGO_POLICY";
  /**
   * A description of the policy.
   */
  description?: string;
}

/**
 * A group of one or more Policy resources.
 */
export interface PolicySet {
  /**
   * Optional. A description of the policy set.
   */
  description?: string;
  /**
   * Required. The Policy resources in the policy set. Each policy must have a
   * policy_id that's unique within the policy set.
   */
  policies?: Policy[];
  /**
   * Required. An identifier for the policy set.
   */
  policySetId?: string;
}

/**
 * The details of a posture.
 */
export interface Posture {
  /**
   * Optional. The user-specified annotations for the posture. For details
   * about the values you can use in an annotation, see [AIP-148: Standard
   * fields](https://google.aip.dev/148#annotations).
   */
  annotations?: {
    [key: string]: string
  };
  /**
   * Output only. The categories that the posture belongs to, as determined by
   * the Security Posture API.
   */
  readonly categories?:  | "CATEGORY_UNSPECIFIED" | "AI" | "AWS" | "GCP" | "AZURE"[];
  /**
   * Output only. The time at which the posture was created.
   */
  readonly createTime?: Date;
  /**
   * Optional. A description of the posture.
   */
  description?: string;
  /**
   * Optional. An opaque identifier for the current version of the posture at
   * the specified `revision_id`. To prevent concurrent updates from overwriting
   * each other, always provide the `etag` when you update a posture. You can
   * also provide the `etag` when you delete a posture, to help ensure that
   * you're deleting the intended version of the posture.
   */
  etag?: string;
  /**
   * Required. Identifier. The name of the posture, in the format
   * `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  name?: string;
  /**
   * Required. The PolicySet resources that the posture includes.
   */
  policySets?: PolicySet[];
  /**
   * Output only. Whether the posture is in the process of being updated.
   */
  readonly reconciling?: boolean;
  /**
   * Output only. Immutable. An opaque eight-character string that identifies
   * the revision of the posture. A posture can have multiple revisions; when
   * you deploy a posture, you deploy a specific revision of the posture.
   */
  readonly revisionId?: string;
  /**
   * Required. The state of the posture at the specified `revision_id`.
   */
  state?:  | "STATE_UNSPECIFIED" | "DEPRECATED" | "DRAFT" | "ACTIVE";
  /**
   * Output only. The time at which the posture was last updated.
   */
  readonly updateTime?: Date;
}

/**
 * Details for a Posture deployment on an organization, folder, or project. You
 * can deploy at most one posture to each organization, folder, or project. The
 * parent resource for a posture deployment is always the organization, even if
 * the deployment applies to a folder or project.
 */
export interface PostureDeployment {
  /**
   * Optional. The user-specified annotations for the posture deployment. For
   * details about the values you can use in an annotation, see [AIP-148:
   * Standard fields](https://google.aip.dev/148#annotations).
   */
  annotations?: {
    [key: string]: string
  };
  /**
   * Output only. The categories that the posture deployment belongs to, as
   * determined by the Security Posture API.
   */
  readonly categories?:  | "CATEGORY_UNSPECIFIED" | "AI" | "AWS" | "GCP" | "AZURE"[];
  /**
   * Output only. The time at which the posture deployment was created.
   */
  readonly createTime?: Date;
  /**
   * Optional. A description of the posture deployment.
   */
  description?: string;
  /**
   * Output only. The posture ID that was specified for the deployment. Present
   * only if the posture deployment is in a failed state.
   */
  readonly desiredPostureId?: string;
  /**
   * Output only. The revision ID of the posture that was specified for the
   * deployment. Present only if the deployment is in a failed state.
   */
  readonly desiredPostureRevisionId?: string;
  /**
   * Optional. An opaque identifier for the current version of the posture
   * deployment. To prevent concurrent updates from overwriting each other,
   * always provide the `etag` when you update a posture deployment. You can
   * also provide the `etag` when you delete a posture deployment, to help
   * ensure that you're deleting the intended posture deployment.
   */
  etag?: string;
  /**
   * Output only. A description of why the posture deployment failed. Present
   * only if the deployment is in a failed state.
   */
  readonly failureMessage?: string;
  /**
   * Required. Identifier. The name of the posture deployment, in the format
   * `organizations/{organization}/locations/global/postureDeployments/{deployment_id}`.
   */
  name?: string;
  /**
   * Required. The posture used in the deployment, in the format
   * `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  postureId?: string;
  /**
   * Required. The revision ID of the posture used in the deployment.
   */
  postureRevisionId?: string;
  /**
   * Output only. Whether the posture deployment is in the process of being
   * updated.
   */
  readonly reconciling?: boolean;
  /**
   * Output only. The state of the posture deployment.
   */
  readonly state?:  | "STATE_UNSPECIFIED" | "CREATING" | "DELETING" | "UPDATING" | "ACTIVE" | "CREATE_FAILED" | "UPDATE_FAILED" | "DELETE_FAILED";
  /**
   * Required. The organization, folder, or project where the posture is
   * deployed. Uses one of the following formats: *
   * `organizations/{organization_number}` * `folders/{folder_number}` *
   * `projects/{project_number}`
   */
  targetResource?: string;
  /**
   * Output only. The time at which the posture deployment was last updated.
   */
  readonly updateTime?: Date;
}

/**
 * Details of a posture deployment.
 */
export interface PostureDetails {
  /**
   * The identifier for the PolicySet that the relevant policy belongs to.
   */
  policySet?: string;
  /**
   * The posture used in the deployment, in the format
   * `organizations/{organization}/locations/global/postures/{posture_id}`.
   */
  posture?: string;
  /**
   * The name of the posture deployment, in the format
   * `organizations/{organization}/locations/global/postureDeployments/{deployment_id}`.
   */
  postureDeployment?: string;
  /**
   * The organization, folder, or project where the posture is deployed. Uses
   * one of the following formats: * `organizations/{organization_number}` *
   * `folders/{folder_number}` * `projects/{project_number}`
   */
  postureDeploymentTargetResource?: string;
  /**
   * The revision ID of the posture used in the deployment.
   */
  postureRevisionId?: string;
}

/**
 * The details of a posture template.
 */
export interface PostureTemplate {
  /**
   * Output only. The categories that the posture template belongs to, as
   * determined by the Security Posture API.
   */
  readonly categories?:  | "CATEGORY_UNSPECIFIED" | "AI" | "AWS" | "GCP" | "AZURE"[];
  /**
   * Output only. A description of the posture template.
   */
  readonly description?: string;
  /**
   * Output only. Identifier. The name of the posture template, in the format
   * `organizations/{organization}/locations/global/postureTemplates/{posture_template}`.
   */
  readonly name?: string;
  /**
   * Output only. The PolicySet resources that the posture template includes.
   */
  readonly policySets?: PolicySet[];
  /**
   * Output only. A string that identifies the revision of the posture
   * template.
   */
  readonly revisionId?: string;
  /**
   * Output only. The state of the posture template at the specified
   * `revision_id`.
   */
  readonly state?:  | "STATE_UNSPECIFIED" | "ACTIVE" | "DEPRECATED";
}

/**
 * Additional options for SecurityPosture#projectsLocationsList.
 */
export interface ProjectsLocationsListOptions {
  /**
   * A filter to narrow down results to a preferred subset. The filtering
   * language accepts strings like `"displayName=tokyo"`, and is documented in
   * more detail in [AIP-160](https://google.aip.dev/160).
   */
  filter?: string;
  /**
   * The maximum number of results to return. If not set, the service selects a
   * default.
   */
  pageSize?: number;
  /**
   * A page token received from the `next_page_token` field in the response.
   * Send that page token to receive the subsequent page.
   */
  pageToken?: string;
}

/**
 * A name-value pair used as a custom source property.
 */
export interface Property {
  /**
   * Required. The name of the custom source property.
   */
  name?: string;
  /**
   * Optional. The CEL expression for the value of the custom source property.
   * For resource properties, you can return the value of the property or a
   * string enclosed in quotation marks.
   */
  valueExpression?: Expr;
}

/**
 * Details of a report.
 */
export interface Report {
  /**
   * Output only. The time at which the report was created.
   */
  readonly createTime?: Date;
  /**
   * Output only. An infrastructure-as-code (IaC) validation report.
   */
  readonly iacValidationReport?: IaCValidationReport;
  /**
   * Required. The name of the report, in the format
   * `organizations/{organization}/locations/global/reports/{report_id}`.
   */
  name?: string;
  /**
   * Output only. The time at which the report was last updated.
   */
  readonly updateTime?: Date;
}

/**
 * A selector for the resource types to run the detector on.
 */
export interface ResourceSelector {
  /**
   * Required. The resource types to run the detector on. Each custom module
   * can specify up to 5 resource types.
   */
  resourceTypes?: string[];
}

/**
 * Set multiple resource types for one policy, eg: resourceTypes: included: -
 * compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint
 * definition contains an empty resource type in order to support multiple
 * resource types in the policy. Only support Google managed constriaint and
 * method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to
 * get more details.
 */
export interface ResourceTypes {
  /**
   * Optional. The resource type we currently support.
   * cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
   */
  included?: string[];
}

/**
 * A custom module for Security Health Analytics.
 */
export interface SecurityHealthAnalyticsCustomModule {
  /**
   * Required. Configuration settings for the custom module.
   */
  config?: CustomConfig;
  /**
   * Optional. The display name of the custom module. This value is used as the
   * finding category for all the asset violation findings that the custom
   * module returns. The display name must contain between 1 and 128
   * alphanumeric characters or underscores, and it must start with a lowercase
   * letter.
   */
  displayName?: string;
  /**
   * Output only. Immutable. The unique identifier for the custom module.
   * Contains 1 to 20 digits.
   */
  readonly id?: string;
  /**
   * Whether the custom module is enabled at a specified level of the resource
   * hierarchy.
   */
  moduleEnablementState?:  | "ENABLEMENT_STATE_UNSPECIFIED" | "ENABLED" | "DISABLED";
}

/**
 * A built-in detector for Security Health Analytics.
 */
export interface SecurityHealthAnalyticsModule {
  /**
   * Whether the detector is enabled at a specified level of the resource
   * hierarchy.
   */
  moduleEnablementState?:  | "ENABLEMENT_STATE_UNSPECIFIED" | "ENABLED" | "DISABLED";
  /**
   * Required. The name of the detector. For example,
   * `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding
   * category for all the asset violation findings that the detector returns.
   */
  moduleName?: string;
}

/**
 * The `Status` type defines a logical error model that is suitable for
 * different programming environments, including REST APIs and RPC APIs. It is
 * used by [gRPC](https://github.com/grpc). Each `Status` message contains three
 * pieces of data: error code, error message, and error details. You can find
 * out more about this error model and how to work with it in the [API Design
 * Guide](https://cloud.google.com/apis/design/errors).
 */
export interface Status {
  /**
   * The status code, which should be an enum value of google.rpc.Code.
   */
  code?: number;
  /**
   * A list of messages that carry the error details. There is a common set of
   * message types for APIs to use.
   */
  details?: {
    [key: string]: any
  }[];
  /**
   * A developer-facing error message, which should be in English. Any
   * user-facing error message should be localized and sent in the
   * google.rpc.Status.details field, or localized by the client.
   */
  message?: string;
}

/**
 * Details of a violation.
 */
export interface Violation {
  /**
   * The full resource name of the asset that caused the violation. For details
   * about the format of the full resource name for each asset type, see
   * [Resource name
   * format](https://cloud.google.com/asset-inventory/docs/resource-name-format).
   */
  assetId?: string;
  /**
   * A description of the steps that you can take to fix the violation.
   */
  nextSteps?: string;
  /**
   * The policy that was violated.
   */
  policyId?: string;
  /**
   * The severity of the violation.
   */
  severity?:  | "SEVERITY_UNSPECIFIED" | "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
  /**
   * Details of the Cloud Asset Inventory asset that caused the violation.
   */
  violatedAsset?: AssetDetails;
  /**
   * Details of the policy that was violated.
   */
  violatedPolicy?: PolicyDetails;
  /**
   * Details for the posture that was violated. This field is present only if
   * the violated policy belongs to a deployed posture.
   */
  violatedPosture?: PostureDetails;
}

function decodeBase64(b64: string): Uint8Array {
  const binString = atob(b64);
  const size = binString.length;
  const bytes = new Uint8Array(size);
  for (let i = 0; i < size; i++) {
    bytes[i] = binString.charCodeAt(i);
  }
  return bytes;
}

const base64abc = ["A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","0","1","2","3","4","5","6","7","8","9","+","/"];
/**
 * CREDIT: https://gist.github.com/enepomnyaschih/72c423f727d395eeaa09697058238727
 * Encodes a given Uint8Array, ArrayBuffer or string into RFC4648 base64 representation
 * @param data
 */
function encodeBase64(uint8: Uint8Array): string {
  let result = "", i;
  const l = uint8.length;
  for (i = 2; i < l; i += 3) {
    result += base64abc[uint8[i - 2] >> 2];
    result += base64abc[((uint8[i - 2] & 0x03) << 4) | (uint8[i - 1] >> 4)];
    result += base64abc[((uint8[i - 1] & 0x0f) << 2) | (uint8[i] >> 6)];
    result += base64abc[uint8[i] & 0x3f];
  }
  if (i === l + 1) {
    // 1 octet yet to write
    result += base64abc[uint8[i - 2] >> 2];
    result += base64abc[(uint8[i - 2] & 0x03) << 4];
    result += "==";
  }
  if (i === l) {
    // 2 octets yet to write
    result += base64abc[uint8[i - 2] >> 2];
    result += base64abc[((uint8[i - 2] & 0x03) << 4) | (uint8[i - 1] >> 4)];
    result += base64abc[(uint8[i - 1] & 0x0f) << 2];
    result += "=";
  }
  return result;
}