Revendor correctly googleapis

41 files changed, 7783 insertions, 0 deletions

diff --git a/third_party/googleapis/google/appengine/BUILD.bazel b/third_party/googleapis/google/appengine/BUILD.bazel
new file mode 100644
index 0000000..8a194ed
--- /dev/null
+++ b/third_party/googleapis/google/appengine/BUILD.bazel
@@ -0,0 +1,40 @@
+# This build file includes a target for the Ruby wrapper library for
+# google-cloud-app_engine.
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+# Export yaml configs.
+exports_files(glob(["*.yaml"]))
+
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_cloud_gapic_library",
+    "ruby_gapic_assembly_pkg",
+)
+
+# Generates a Ruby wrapper client for appengine.
+# Ruby wrapper clients are versionless, but are generated from source protos
+# for a particular service version, v1 in this case.
+ruby_cloud_gapic_library(
+    name = "appengine_ruby_wrapper",
+    srcs = ["//google/appengine/v1:appengine_proto_with_info"],
+    extra_protoc_parameters = [
+        "ruby-cloud-gem-name=google-cloud-app_engine",
+        "ruby-cloud-env-prefix=APP_ENGINE",
+        "ruby-cloud-wrapper-of=v1:0.3",
+        "ruby-cloud-product-url=https://cloud.google.com/appengine/docs/admin-api/",
+        "ruby-cloud-api-id=appengine.googleapis.com",
+        "ruby-cloud-api-shortname=appengine",
+    ],
+    ruby_cloud_description = "The App Engine Admin API provisions and manages your App Engine applications.",
+    ruby_cloud_title = "App Engine Admin",
+)
+
+# Open Source package.
+ruby_gapic_assembly_pkg(
+    name = "google-cloud-appengine-ruby",
+    deps = [
+        ":appengine_ruby_wrapper",
+    ],
+)
diff --git a/third_party/googleapis/google/appengine/README.md b/third_party/googleapis/google/appengine/README.md
new file mode 100644
index 0000000..54e45e6
--- /dev/null
+++ b/third_party/googleapis/google/appengine/README.md
@@ -0,0 +1,12 @@
+# Google App Engine Admin API
+
+## Overview
+
+The Google App Engine Admin API is a RESTful API for managing App Engine
+applications. The Admin API provides programmatic access to several of the App
+Engine administrative operations that are found in the
+[Google Cloud Platform Console](https://cloud.google.com/appengine/docs/developers-console).
+
+## Documentation
+
+[Google App Engine Admin API Documentation](https://cloud.google.com/appengine/docs/admin-api/)
\ No newline at end of file
diff --git a/third_party/googleapis/google/appengine/legacy/BUILD.bazel b/third_party/googleapis/google/appengine/legacy/BUILD.bazel
new file mode 100644
index 0000000..bea806a
--- /dev/null
+++ b/third_party/googleapis/google/appengine/legacy/BUILD.bazel
@@ -0,0 +1,177 @@
+# This file was automatically generated by BuildFileGenerator
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+##############################################################################
+# Common
+##############################################################################
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "legacy_proto",
+    srcs = [
+        "audit_data.proto",
+    ],
+    deps = [
+        "//google/api:annotations_proto",
+    ],
+)
+
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
+java_proto_library(
+    name = "legacy_java_proto",
+    deps = [":legacy_proto"],
+)
+
+java_grpc_library(
+    name = "legacy_java_grpc",
+    srcs = [":legacy_proto"],
+    deps = [":legacy_java_proto"],
+)
+
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_proto_library",
+)
+
+go_proto_library(
+    name = "legacy_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "google.golang.org/genproto/googleapis/appengine/legacy",
+    protos = [":legacy_proto"],
+    deps = [
+        "//google/api:annotations_go_proto",
+    ],
+)
+
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "moved_proto_library",
+    "py_grpc_library",
+    "py_proto_library",
+)
+
+moved_proto_library(
+    name = "legacy_moved_proto",
+    srcs = [":legacy_proto"],
+    deps = [
+        "//google/api:annotations_proto",
+    ],
+)
+
+py_proto_library(
+    name = "legacy_py_proto",
+    deps = [":legacy_moved_proto"],
+)
+
+py_grpc_library(
+    name = "legacy_py_grpc",
+    srcs = [":legacy_moved_proto"],
+    deps = [":legacy_py_proto"],
+)
+
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_grpc_library",
+    "php_proto_library",
+)
+
+php_proto_library(
+    name = "legacy_php_proto",
+    deps = [":legacy_proto"],
+)
+
+php_grpc_library(
+    name = "legacy_php_grpc",
+    srcs = [":legacy_proto"],
+    deps = [":legacy_php_proto"],
+)
+
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
+
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
+ruby_proto_library(
+    name = "legacy_ruby_proto",
+    deps = [":legacy_proto"],
+)
+
+ruby_grpc_library(
+    name = "legacy_ruby_grpc",
+    srcs = [":legacy_proto"],
+    deps = [":legacy_ruby_proto"],
+)
+
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
+csharp_proto_library(
+    name = "legacy_csharp_proto",
+    deps = [":legacy_proto"],
+)
+
+csharp_grpc_library(
+    name = "legacy_csharp_grpc",
+    srcs = [":legacy_proto"],
+    deps = [":legacy_csharp_proto"],
+)
+
+##############################################################################
+# C++
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "cc_grpc_library",
+    "cc_proto_library",
+)
+
+cc_proto_library(
+    name = "legacy_cc_proto",
+    deps = [":legacy_proto"],
+)
+
+cc_grpc_library(
+    name = "legacy_cc_grpc",
+    srcs = [":legacy_proto"],
+    grpc_only = True,
+    deps = [":legacy_cc_proto"],
+)
diff --git a/third_party/googleapis/google/appengine/legacy/audit_data.proto b/third_party/googleapis/google/appengine/legacy/audit_data.proto
new file mode 100644
index 0000000..e521726
--- /dev/null
+++ b/third_party/googleapis/google/appengine/legacy/audit_data.proto
@@ -0,0 +1,33 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.legacy;
+
+option go_package = "google.golang.org/genproto/googleapis/appengine/legacy;legacy";
+option java_multiple_files = true;
+option java_outer_classname = "AuditDataProto";
+option java_package = "com.google.appengine.legacy";
+
+// Admin Console legacy audit log.
+message AuditData {
+  // Text description of the admin event.
+  // This is the "Event" column in Admin Console's Admin Logs.
+  string event_message = 1;
+
+  // Arbitrary event data.
+  // This is the "Result" column in Admin Console's Admin Logs.
+  map<string, string> event_data = 2;
+}
diff --git a/third_party/googleapis/google/appengine/logging/v1/BUILD.bazel b/third_party/googleapis/google/appengine/logging/v1/BUILD.bazel
new file mode 100644
index 0000000..2ea7513
--- /dev/null
+++ b/third_party/googleapis/google/appengine/logging/v1/BUILD.bazel
@@ -0,0 +1,177 @@
+# This file was automatically generated by BuildFileGenerator
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+##############################################################################
+# Common
+##############################################################################
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "logging_proto",
+    srcs = [
+        "request_log.proto",
+    ],
+    deps = [
+        "//google/logging/type:type_proto",
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
+java_proto_library(
+    name = "logging_java_proto",
+    deps = [":logging_proto"],
+)
+
+java_grpc_library(
+    name = "logging_java_grpc",
+    srcs = [":logging_proto"],
+    deps = [":logging_java_proto"],
+)
+
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_proto_library",
+)
+
+go_proto_library(
+    name = "logging_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "google.golang.org/genproto/googleapis/appengine/logging/v1",
+    protos = [":logging_proto"],
+    deps = [
+        "//google/logging/type:type_go_proto",
+    ],
+)
+
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "py_gapic_assembly_pkg",
+    "py_gapic_library",
+)
+
+py_gapic_library(
+    name = "logging_py_gapic",
+    srcs = [":logging_proto"],
+    opt_args = [
+        "warehouse-package-name=google-cloud-appengine-logging",
+        "python-gapic-namespace=google.cloud",
+        "python-gapic-name=appengine_logging",
+    ],
+    transport = "grpc",
+)
+
+# Open Source Packages
+py_gapic_assembly_pkg(
+    name = "google-cloud-appengine-logging-v1-py",
+    deps = [
+        ":logging_py_gapic",
+    ],
+)
+
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_grpc_library",
+    "php_proto_library",
+)
+
+php_proto_library(
+    name = "logging_php_proto",
+    deps = [":logging_proto"],
+)
+
+php_grpc_library(
+    name = "logging_php_grpc",
+    srcs = [":logging_proto"],
+    deps = [":logging_php_proto"],
+)
+
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
+ruby_proto_library(
+    name = "logging_ruby_proto",
+    deps = [":logging_proto"],
+)
+
+ruby_grpc_library(
+    name = "logging_ruby_grpc",
+    srcs = [":logging_proto"],
+    deps = [":logging_ruby_proto"],
+)
+
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
+csharp_proto_library(
+    name = "logging_csharp_proto",
+    deps = [":logging_proto"],
+)
+
+csharp_grpc_library(
+    name = "logging_csharp_grpc",
+    srcs = [":logging_proto"],
+    deps = [":logging_csharp_proto"],
+)
+
+##############################################################################
+# C++
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "cc_grpc_library",
+    "cc_proto_library",
+)
+
+cc_proto_library(
+    name = "logging_cc_proto",
+    deps = [":logging_proto"],
+)
+
+cc_grpc_library(
+    name = "logging_cc_grpc",
+    srcs = [":logging_proto"],
+    grpc_only = True,
+    deps = [":logging_cc_proto"],
+)
diff --git a/third_party/googleapis/google/appengine/logging/v1/request_log.proto b/third_party/googleapis/google/appengine/logging/v1/request_log.proto
new file mode 100644
index 0000000..f44d31e
--- /dev/null
+++ b/third_party/googleapis/google/appengine/logging/v1/request_log.proto
@@ -0,0 +1,196 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.logging.v1;
+
+import "google/logging/type/log_severity.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.Logging.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/logging/v1;logging";
+option java_multiple_files = true;
+option java_outer_classname = "RequestLogProto";
+option java_package = "com.google.appengine.logging.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\Logging\\V1";
+option ruby_package = "Google::Cloud::AppEngine::Logging::V1";
+
+// Application log line emitted while processing a request.
+message LogLine {
+  // Approximate time when this log entry was made.
+  google.protobuf.Timestamp time = 1;
+
+  // Severity of this log entry.
+  google.logging.type.LogSeverity severity = 2;
+
+  // App-provided log message.
+  string log_message = 3;
+
+  // Where in the source code this log message was written.
+  SourceLocation source_location = 4;
+}
+
+// Specifies a location in a source code file.
+message SourceLocation {
+  // Source file name. Depending on the runtime environment, this might be a
+  // simple name or a fully-qualified name.
+  string file = 1;
+
+  // Line within the source file.
+  int64 line = 2;
+
+  // Human-readable name of the function or method being invoked, with optional
+  // context such as the class or package name. This information is used in
+  // contexts such as the logs viewer, where a file and line number are less
+  // meaningful. The format can vary by language. For example:
+  // `qual.if.ied.Class.method` (Java), `dir/package.func` (Go), `function`
+  // (Python).
+  string function_name = 3;
+}
+
+// A reference to a particular snapshot of the source tree used to build and
+// deploy an application.
+message SourceReference {
+  // Optional. A URI string identifying the repository.
+  // Example: "https://github.com/GoogleCloudPlatform/kubernetes.git"
+  string repository = 1;
+
+  // The canonical and persistent identifier of the deployed revision.
+  // Example (git): "0035781c50ec7aa23385dc841529ce8a4b70db1b"
+  string revision_id = 2;
+}
+
+// Complete log information about a single HTTP request to an App Engine
+// application.
+message RequestLog {
+  // Application that handled this request.
+  string app_id = 1;
+
+  // Module of the application that handled this request.
+  string module_id = 37;
+
+  // Version of the application that handled this request.
+  string version_id = 2;
+
+  // Globally unique identifier for a request, which is based on the request
+  // start time.  Request IDs for requests which started later will compare
+  // greater as strings than those for requests which started earlier.
+  string request_id = 3;
+
+  // Origin IP address.
+  string ip = 4;
+
+  // Time when the request started.
+  google.protobuf.Timestamp start_time = 6;
+
+  // Time when the request finished.
+  google.protobuf.Timestamp end_time = 7;
+
+  // Latency of the request.
+  google.protobuf.Duration latency = 8;
+
+  // Number of CPU megacycles used to process request.
+  int64 mega_cycles = 9;
+
+  // Request method. Example: `"GET"`, `"HEAD"`, `"PUT"`, `"POST"`, `"DELETE"`.
+  string method = 10;
+
+  // Contains the path and query portion of the URL that was requested. For
+  // example, if the URL was "http://example.com/app?name=val", the resource
+  // would be "/app?name=val".  The fragment identifier, which is identified by
+  // the `#` character, is not included.
+  string resource = 11;
+
+  // HTTP version of request. Example: `"HTTP/1.1"`.
+  string http_version = 12;
+
+  // HTTP response status code. Example: 200, 404.
+  int32 status = 13;
+
+  // Size in bytes sent back to client by request.
+  int64 response_size = 14;
+
+  // Referrer URL of request.
+  string referrer = 15;
+
+  // User agent that made the request.
+  string user_agent = 16;
+
+  // The logged-in user who made the request.
+  //
+  // Most likely, this is the part of the user's email before the `@` sign.  The
+  // field value is the same for different requests from the same user, but
+  // different users can have similar names.  This information is also
+  // available to the application via the App Engine Users API.
+  //
+  // This field will be populated starting with App Engine 1.9.21.
+  string nickname = 40;
+
+  // File or class that handled the request.
+  string url_map_entry = 17;
+
+  // Internet host and port number of the resource being requested.
+  string host = 20;
+
+  // An indication of the relative cost of serving this request.
+  double cost = 21;
+
+  // Queue name of the request, in the case of an offline request.
+  string task_queue_name = 22;
+
+  // Task name of the request, in the case of an offline request.
+  string task_name = 23;
+
+  // Whether this was a loading request for the instance.
+  bool was_loading_request = 24;
+
+  // Time this request spent in the pending request queue.
+  google.protobuf.Duration pending_time = 25;
+
+  // If the instance processing this request belongs to a manually scaled
+  // module, then this is the 0-based index of the instance. Otherwise, this
+  // value is -1.
+  int32 instance_index = 26;
+
+  // Whether this request is finished or active.
+  bool finished = 27;
+
+  // Whether this is the first `RequestLog` entry for this request.  If an
+  // active request has several `RequestLog` entries written to Stackdriver
+  // Logging, then this field will be set for one of them.
+  bool first = 42;
+
+  // An identifier for the instance that handled the request.
+  string instance_id = 28;
+
+  // A list of log lines emitted by the application while serving this request.
+  repeated LogLine line = 29;
+
+  // App Engine release version.
+  string app_engine_release = 38;
+
+  // Stackdriver Trace identifier for this request.
+  string trace_id = 39;
+
+  // If true, the value in the 'trace_id' field was sampled for storage in a
+  // trace backend.
+  bool trace_sampled = 43;
+
+  // Source code for the application that handled this request. There can be
+  // more than one source reference per deployed application if source code is
+  // distributed among multiple repositories.
+  repeated SourceReference source_reference = 41;
+}
diff --git a/third_party/googleapis/google/appengine/v1/BUILD.bazel b/third_party/googleapis/google/appengine/v1/BUILD.bazel
new file mode 100644
index 0000000..37463b6
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/BUILD.bazel
@@ -0,0 +1,414 @@
+# This file was automatically generated by BuildFileGenerator
+# https://github.com/googleapis/rules_gapic/tree/master/bazel
+
+# Most of the manual changes to this file will be overwritten.
+# It's **only** allowed to change the following rule attribute values:
+# - names of *_gapic_assembly_* rules
+# - certain parameters of *_gapic_library rules, including but not limited to:
+#    * extra_protoc_parameters
+#    * extra_protoc_file_parameters
+# The complete list of preserved parameters can be found in the source code.
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+##############################################################################
+# Common
+##############################################################################
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
+
+proto_library(
+    name = "appengine_proto",
+    srcs = [
+        "app_yaml.proto",
+        "appengine.proto",
+        "application.proto",
+        "audit_data.proto",
+        "certificate.proto",
+        "deploy.proto",
+        "deployed_files.proto",
+        "domain.proto",
+        "domain_mapping.proto",
+        "firewall.proto",
+        "instance.proto",
+        "location.proto",
+        "network_settings.proto",
+        "operation.proto",
+        "service.proto",
+        "version.proto",
+    ],
+    deps = [
+        "//google/api:annotations_proto",
+        "//google/api:client_proto",
+        "//google/api:field_behavior_proto",
+        "//google/api:resource_proto",
+        "//google/longrunning:operations_proto",
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:empty_proto",
+        "@com_google_protobuf//:field_mask_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+proto_library_with_info(
+    name = "appengine_proto_with_info",
+    deps = [
+        ":appengine_proto",
+        "//google/cloud:common_resources_proto",
+    ],
+)
+
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_gapic_assembly_gradle_pkg",
+    "java_gapic_library",
+    "java_gapic_test",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
+java_proto_library(
+    name = "appengine_java_proto",
+    deps = [":appengine_proto"],
+)
+
+java_grpc_library(
+    name = "appengine_java_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_java_proto"],
+)
+
+java_gapic_library(
+    name = "appengine_java_gapic",
+    srcs = [":appengine_proto_with_info"],
+    grpc_service_config = "appengine_grpc_service_config.json",
+    test_deps = [
+        ":appengine_java_grpc",
+    ],
+    transport = "grpc+rest",
+    deps = [
+        ":appengine_java_proto",
+    ],
+)
+
+java_gapic_test(
+    name = "appengine_java_gapic_test_suite",
+    test_classes = [
+        "com.google.appengine.v1.ApplicationsClientHttpJsonTest",
+        "com.google.appengine.v1.ApplicationsClientTest",
+        "com.google.appengine.v1.AuthorizedCertificatesClientHttpJsonTest",
+        "com.google.appengine.v1.AuthorizedCertificatesClientTest",
+        "com.google.appengine.v1.AuthorizedDomainsClientHttpJsonTest",
+        "com.google.appengine.v1.AuthorizedDomainsClientTest",
+        "com.google.appengine.v1.DomainMappingsClientHttpJsonTest",
+        "com.google.appengine.v1.DomainMappingsClientTest",
+        "com.google.appengine.v1.FirewallClientHttpJsonTest",
+        "com.google.appengine.v1.FirewallClientTest",
+        "com.google.appengine.v1.InstancesClientHttpJsonTest",
+        "com.google.appengine.v1.InstancesClientTest",
+        "com.google.appengine.v1.ServicesClientHttpJsonTest",
+        "com.google.appengine.v1.ServicesClientTest",
+        "com.google.appengine.v1.VersionsClientHttpJsonTest",
+        "com.google.appengine.v1.VersionsClientTest",
+    ],
+    runtime_deps = [":appengine_java_gapic_test"],
+)
+
+# Open Source Packages
+java_gapic_assembly_gradle_pkg(
+    name = "google-cloud-appengine-v1-java",
+    transport = "grpc+rest",
+    deps = [
+        ":appengine_java_gapic",
+        ":appengine_java_grpc",
+        ":appengine_java_proto",
+        ":appengine_proto",
+    ],
+)
+
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_gapic_assembly_pkg",
+    "go_gapic_library",
+    "go_proto_library",
+    "go_test",
+)
+
+go_proto_library(
+    name = "appengine_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "google.golang.org/genproto/googleapis/appengine/v1",
+    protos = [":appengine_proto"],
+    deps = [
+        "//google/api:annotations_go_proto",
+        "//google/longrunning:longrunning_go_proto",
+    ],
+)
+
+go_gapic_library(
+    name = "appengine_go_gapic",
+    srcs = [":appengine_proto_with_info"],
+    grpc_service_config = "appengine_grpc_service_config.json",
+    importpath = "cloud.google.com/go/appengine/apiv1;appengine",
+    metadata = True,
+    service_yaml = "appengine_v1.yaml",
+    transport = "grpc+rest",
+    deps = [
+        ":appengine_go_proto",
+        "//google/longrunning:longrunning_go_proto",
+        "@com_google_cloud_go//longrunning:go_default_library",
+        "@com_google_cloud_go//longrunning/autogen:go_default_library",
+        "@io_bazel_rules_go//proto/wkt:duration_go_proto",
+    ],
+)
+
+go_test(
+    name = "appengine_go_gapic_test",
+    srcs = [":appengine_go_gapic_srcjar_test"],
+    embed = [":appengine_go_gapic"],
+    importpath = "cloud.google.com/go/appengine/apiv1",
+)
+
+# Open Source Packages
+go_gapic_assembly_pkg(
+    name = "gapi-cloud-appengine-v1-go",
+    deps = [
+        ":appengine_go_gapic",
+        ":appengine_go_gapic_srcjar-metadata.srcjar",
+        ":appengine_go_gapic_srcjar-test.srcjar",
+        ":appengine_go_proto",
+    ],
+)
+
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "py_gapic_assembly_pkg",
+    "py_gapic_library",
+    "py_test",
+)
+
+py_gapic_library(
+    name = "appengine_py_gapic",
+    srcs = [":appengine_proto"],
+    grpc_service_config = "appengine_grpc_service_config.json",
+    opt_args = [
+        "warehouse-package-name=google-cloud-appengine-admin",
+        "python-gapic-namespace=google.cloud",
+        "python-gapic-name=appengine_admin",
+    ],
+    transport = "grpc",
+)
+
+py_test(
+    name = "appengine_py_gapic_test",
+    srcs = [
+        "appengine_py_gapic_pytest.py",
+        "appengine_py_gapic_test.py",
+    ],
+    legacy_create_init = False,
+    deps = [":appengine_py_gapic"],
+)
+
+# Open Source Packages
+py_gapic_assembly_pkg(
+    name = "google-cloud-appengine-v1-py",
+    deps = [
+        ":appengine_py_gapic",
+    ],
+)
+
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_gapic_assembly_pkg",
+    "php_gapic_library",
+    "php_grpc_library",
+    "php_proto_library",
+)
+
+php_proto_library(
+    name = "appengine_php_proto",
+    deps = [":appengine_proto"],
+)
+
+php_grpc_library(
+    name = "appengine_php_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_php_proto"],
+)
+
+php_gapic_library(
+    name = "appengine_php_gapic",
+    srcs = [":appengine_proto_with_info"],
+    grpc_service_config = "appengine_grpc_service_config.json",
+    service_yaml = "appengine_v1.yaml",
+    deps = [
+        ":appengine_php_grpc",
+        ":appengine_php_proto",
+    ],
+)
+
+# Open Source Packages
+php_gapic_assembly_pkg(
+    name = "google-cloud-appengine-v1-php",
+    deps = [
+        ":appengine_php_gapic",
+        ":appengine_php_grpc",
+        ":appengine_php_proto",
+    ],
+)
+
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
+nodejs_gapic_library(
+    name = "appengine_nodejs_gapic",
+    package_name = "@google-cloud/appengine-admin",
+    src = ":appengine_proto_with_info",
+    extra_protoc_parameters = ["metadata"],
+    grpc_service_config = "appengine_grpc_service_config.json",
+    package = "google.appengine.v1",
+    service_yaml = "appengine_v1.yaml",
+    deps = [],
+)
+
+nodejs_gapic_assembly_pkg(
+    name = "appengine-v1-nodejs",
+    deps = [
+        ":appengine_nodejs_gapic",
+        ":appengine_proto",
+    ],
+)
+
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_cloud_gapic_library",
+    "ruby_gapic_assembly_pkg",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
+ruby_proto_library(
+    name = "appengine_ruby_proto",
+    deps = [":appengine_proto"],
+)
+
+ruby_grpc_library(
+    name = "appengine_ruby_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_ruby_proto"],
+)
+
+ruby_cloud_gapic_library(
+    name = "appengine_ruby_gapic",
+    srcs = [":appengine_proto_with_info"],
+    extra_protoc_parameters = [
+        "ruby-cloud-gem-name=google-cloud-app_engine-v1",
+        "ruby-cloud-env-prefix=APP_ENGINE",
+        "ruby-cloud-product-url=https://cloud.google.com/appengine/docs/admin-api/",
+        "ruby-cloud-api-id=appengine.googleapis.com",
+        "ruby-cloud-api-shortname=appengine",
+    ],
+    ruby_cloud_description = "The App Engine Admin API provisions and manages your App Engine applications.",
+    ruby_cloud_title = "App Engine Admin V1",
+    deps = [
+        ":appengine_ruby_grpc",
+        ":appengine_ruby_proto",
+    ],
+)
+
+# Open Source Packages
+ruby_gapic_assembly_pkg(
+    name = "google-cloud-appengine-v1-ruby",
+    deps = [
+        ":appengine_ruby_gapic",
+        ":appengine_ruby_grpc",
+        ":appengine_ruby_proto",
+    ],
+)
+
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_gapic_assembly_pkg",
+    "csharp_gapic_library",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
+csharp_proto_library(
+    name = "appengine_csharp_proto",
+    deps = [":appengine_proto"],
+)
+
+csharp_grpc_library(
+    name = "appengine_csharp_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_csharp_proto"],
+)
+
+csharp_gapic_library(
+    name = "appengine_csharp_gapic",
+    srcs = [":appengine_proto_with_info"],
+    common_resources_config = "@gax_dotnet//:Google.Api.Gax/ResourceNames/CommonResourcesConfig.json",
+    grpc_service_config = "appengine_grpc_service_config.json",
+    service_yaml = "appengine_v1.yaml",
+    deps = [
+        ":appengine_csharp_grpc",
+        ":appengine_csharp_proto",
+    ],
+)
+
+# Open Source Packages
+csharp_gapic_assembly_pkg(
+    name = "google-cloud-appengine-v1-csharp",
+    deps = [
+        ":appengine_csharp_gapic",
+        ":appengine_csharp_grpc",
+        ":appengine_csharp_proto",
+    ],
+)
+
+##############################################################################
+# C++
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "cc_grpc_library",
+    "cc_proto_library",
+)
+
+cc_proto_library(
+    name = "appengine_cc_proto",
+    deps = [":appengine_proto"],
+)
+
+cc_grpc_library(
+    name = "appengine_cc_grpc",
+    srcs = [":appengine_proto"],
+    grpc_only = True,
+    deps = [":appengine_cc_proto"],
+)
diff --git a/third_party/googleapis/google/appengine/v1/app_yaml.proto b/third_party/googleapis/google/appengine/v1/app_yaml.proto
new file mode 100644
index 0000000..8821853
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/app_yaml.proto
@@ -0,0 +1,348 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AppYamlProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// [Google Cloud Endpoints](https://cloud.google.com/appengine/docs/python/endpoints/)
+// configuration for API handlers.
+message ApiConfigHandler {
+  // Action to take when users access resources that require
+  // authentication. Defaults to `redirect`.
+  AuthFailAction auth_fail_action = 1;
+
+  // Level of login required to access this resource. Defaults to
+  // `optional`.
+  LoginRequirement login = 2;
+
+  // Path to the script from the application root directory.
+  string script = 3;
+
+  // Security (HTTPS) enforcement for this URL.
+  SecurityLevel security_level = 4;
+
+  // URL to serve the endpoint at.
+  string url = 5;
+}
+
+// Custom static error page to be served when an error occurs.
+message ErrorHandler {
+  // Error codes.
+  enum ErrorCode {
+    option allow_alias = true;
+
+    // Not specified. ERROR_CODE_DEFAULT is assumed.
+    ERROR_CODE_UNSPECIFIED = 0;
+
+    // All other error types.
+    ERROR_CODE_DEFAULT = 0;
+
+    // Application has exceeded a resource quota.
+    ERROR_CODE_OVER_QUOTA = 1;
+
+    // Client blocked by the application's Denial of Service protection
+    // configuration.
+    ERROR_CODE_DOS_API_DENIAL = 2;
+
+    // Deadline reached before the application responds.
+    ERROR_CODE_TIMEOUT = 3;
+  }
+
+  // Error condition this handler applies to.
+  ErrorCode error_code = 1;
+
+  // Static file content to be served for this error.
+  string static_file = 2;
+
+  // MIME type of file. Defaults to `text/html`.
+  string mime_type = 3;
+}
+
+// URL pattern and description of how the URL should be handled. App Engine can
+// handle URLs by executing application code or by serving static files
+// uploaded with the version, such as images, CSS, or JavaScript.
+message UrlMap {
+  // Redirect codes.
+  enum RedirectHttpResponseCode {
+    // Not specified. `302` is assumed.
+    REDIRECT_HTTP_RESPONSE_CODE_UNSPECIFIED = 0;
+
+    // `301 Moved Permanently` code.
+    REDIRECT_HTTP_RESPONSE_CODE_301 = 1;
+
+    // `302 Moved Temporarily` code.
+    REDIRECT_HTTP_RESPONSE_CODE_302 = 2;
+
+    // `303 See Other` code.
+    REDIRECT_HTTP_RESPONSE_CODE_303 = 3;
+
+    // `307 Temporary Redirect` code.
+    REDIRECT_HTTP_RESPONSE_CODE_307 = 4;
+  }
+
+  // URL prefix. Uses regular expression syntax, which means regexp
+  // special characters must be escaped, but should not contain groupings.
+  // All URLs that begin with this prefix are handled by this handler, using the
+  // portion of the URL after the prefix as part of the file path.
+  string url_regex = 1;
+
+  // Type of handler for this URL pattern.
+  oneof handler_type {
+    // Returns the contents of a file, such as an image, as the response.
+    StaticFilesHandler static_files = 2;
+
+    // Executes a script to handle the requests that match this URL
+    // pattern. Only the `auto` value is supported for Node.js in the
+    // App Engine standard environment, for example `"script": "auto"`.
+    ScriptHandler script = 3;
+
+    // Uses API Endpoints to handle requests.
+    ApiEndpointHandler api_endpoint = 4;
+  }
+
+  // Security (HTTPS) enforcement for this URL.
+  SecurityLevel security_level = 5;
+
+  // Level of login required to access this resource. Not supported for Node.js
+  // in the App Engine standard environment.
+  LoginRequirement login = 6;
+
+  // Action to take when users access resources that require
+  // authentication. Defaults to `redirect`.
+  AuthFailAction auth_fail_action = 7;
+
+  // `30x` code to use when performing redirects for the `secure` field.
+  // Defaults to `302`.
+  RedirectHttpResponseCode redirect_http_response_code = 8;
+}
+
+// Files served directly to the user for a given URL, such as images, CSS
+// stylesheets, or JavaScript source files. Static file handlers describe which
+// files in the application directory are static files, and which URLs serve
+// them.
+message StaticFilesHandler {
+  // Path to the static files matched by the URL pattern, from the
+  // application root directory. The path can refer to text matched in groupings
+  // in the URL pattern.
+  string path = 1;
+
+  // Regular expression that matches the file paths for all files that should be
+  // referenced by this handler.
+  string upload_path_regex = 2;
+
+  // HTTP headers to use for all responses from these URLs.
+  map<string, string> http_headers = 3;
+
+  // MIME type used to serve all files served by this handler.
+  //
+  // Defaults to file-specific MIME types, which are derived from each file's
+  // filename extension.
+  string mime_type = 4;
+
+  // Time a static file served by this handler should be cached
+  // by web proxies and browsers.
+  google.protobuf.Duration expiration = 5;
+
+  // Whether this handler should match the request if the file
+  // referenced by the handler does not exist.
+  bool require_matching_file = 6;
+
+  // Whether files should also be uploaded as code data. By default, files
+  // declared in static file handlers are uploaded as static
+  // data and are only served to end users; they cannot be read by the
+  // application. If enabled, uploads are charged against both your code and
+  // static data storage resource quotas.
+  bool application_readable = 7;
+}
+
+// Executes a script to handle the request that matches the URL pattern.
+message ScriptHandler {
+  // Path to the script from the application root directory.
+  string script_path = 1;
+}
+
+// Uses Google Cloud Endpoints to handle requests.
+message ApiEndpointHandler {
+  // Path to the script from the application root directory.
+  string script_path = 1;
+}
+
+// Health checking configuration for VM instances. Unhealthy instances
+// are killed and replaced with new instances. Only applicable for
+// instances in App Engine flexible environment.
+message HealthCheck {
+  // Whether to explicitly disable health checks for this instance.
+  bool disable_health_check = 1;
+
+  // Host header to send when performing an HTTP health check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive successful health checks required before receiving
+  // traffic.
+  uint32 healthy_threshold = 3;
+
+  // Number of consecutive failed health checks required before removing
+  // traffic.
+  uint32 unhealthy_threshold = 4;
+
+  // Number of consecutive failed health checks required before an instance is
+  // restarted.
+  uint32 restart_threshold = 5;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 6;
+
+  // Time before the health check is considered failed.
+  google.protobuf.Duration timeout = 7;
+}
+
+// Readiness checking configuration for VM instances. Unhealthy instances
+// are removed from traffic rotation.
+message ReadinessCheck {
+  // The request path.
+  string path = 1;
+
+  // Host header to send when performing a HTTP Readiness check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive failed checks required before removing
+  // traffic.
+  uint32 failure_threshold = 3;
+
+  // Number of consecutive successful checks required before receiving
+  // traffic.
+  uint32 success_threshold = 4;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 5;
+
+  // Time before the check is considered failed.
+  google.protobuf.Duration timeout = 6;
+
+  // A maximum time limit on application initialization, measured from moment
+  // the application successfully replies to a healthcheck until it is ready to
+  // serve traffic.
+  google.protobuf.Duration app_start_timeout = 7;
+}
+
+// Health checking configuration for VM instances. Unhealthy instances
+// are killed and replaced with new instances.
+message LivenessCheck {
+  // The request path.
+  string path = 1;
+
+  // Host header to send when performing a HTTP Liveness check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive failed checks required before considering the
+  // VM unhealthy.
+  uint32 failure_threshold = 3;
+
+  // Number of consecutive successful checks required before considering
+  // the VM healthy.
+  uint32 success_threshold = 4;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 5;
+
+  // Time before the check is considered failed.
+  google.protobuf.Duration timeout = 6;
+
+  // The initial delay before starting to execute the checks.
+  google.protobuf.Duration initial_delay = 7;
+}
+
+// Third-party Python runtime library that is required by the application.
+message Library {
+  // Name of the library. Example: "django".
+  string name = 1;
+
+  // Version of the library to select, or "latest".
+  string version = 2;
+}
+
+// Actions to take when the user is not logged in.
+enum AuthFailAction {
+  // Not specified. `AUTH_FAIL_ACTION_REDIRECT` is assumed.
+  AUTH_FAIL_ACTION_UNSPECIFIED = 0;
+
+  // Redirects user to "accounts.google.com". The user is redirected back to the
+  // application URL after signing in or creating an account.
+  AUTH_FAIL_ACTION_REDIRECT = 1;
+
+  // Rejects request with a `401` HTTP status code and an error
+  // message.
+  AUTH_FAIL_ACTION_UNAUTHORIZED = 2;
+}
+
+// Methods to restrict access to a URL based on login status.
+enum LoginRequirement {
+  // Not specified. `LOGIN_OPTIONAL` is assumed.
+  LOGIN_UNSPECIFIED = 0;
+
+  // Does not require that the user is signed in.
+  LOGIN_OPTIONAL = 1;
+
+  // If the user is not signed in, the `auth_fail_action` is taken.
+  // In addition, if the user is not an administrator for the
+  // application, they are given an error message regardless of
+  // `auth_fail_action`. If the user is an administrator, the handler
+  // proceeds.
+  LOGIN_ADMIN = 2;
+
+  // If the user has signed in, the handler proceeds normally. Otherwise, the
+  // auth_fail_action is taken.
+  LOGIN_REQUIRED = 3;
+}
+
+// Methods to enforce security (HTTPS) on a URL.
+enum SecurityLevel {
+  option allow_alias = true;
+
+  // Not specified.
+  SECURE_UNSPECIFIED = 0;
+
+  // Both HTTP and HTTPS requests with URLs that match the handler succeed
+  // without redirects. The application can examine the request to determine
+  // which protocol was used, and respond accordingly.
+  SECURE_DEFAULT = 0;
+
+  // Requests for a URL that match this handler that use HTTPS are automatically
+  // redirected to the HTTP equivalent URL.
+  SECURE_NEVER = 1;
+
+  // Both HTTP and HTTPS requests with URLs that match the handler succeed
+  // without redirects. The application can examine the request to determine
+  // which protocol was used and respond accordingly.
+  SECURE_OPTIONAL = 2;
+
+  // Requests for a URL that match this handler that do not use HTTPS are
+  // automatically redirected to the HTTPS URL with the same path. Query
+  // parameters are reserved for the redirect.
+  SECURE_ALWAYS = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1/appengine.proto b/third_party/googleapis/google/appengine/v1/appengine.proto
new file mode 100644
index 0000000..76eb230
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/appengine.proto
@@ -0,0 +1,1008 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/appengine/v1/application.proto";
+import "google/appengine/v1/certificate.proto";
+import "google/appengine/v1/domain.proto";
+import "google/appengine/v1/domain_mapping.proto";
+import "google/appengine/v1/firewall.proto";
+import "google/appengine/v1/instance.proto";
+import "google/appengine/v1/service.proto";
+import "google/appengine/v1/version.proto";
+import "google/longrunning/operations.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AppengineProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// Manages App Engine applications.
+service Applications {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Gets information about an application.
+  rpc GetApplication(GetApplicationRequest) returns (Application) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates an App Engine application for a Google Cloud Platform project.
+  // Required fields:
+  //
+  // * `id` - The ID of the target Cloud Platform project.
+  // * *location* - The [region](https://cloud.google.com/appengine/docs/locations) where you want the App Engine application located.
+  //
+  // For more information about App Engine applications, see [Managing Projects, Applications, and Billing](https://cloud.google.com/appengine/docs/standard/python/console/).
+  rpc CreateApplication(CreateApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/apps"
+      body: "application"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Updates the specified Application resource.
+  // You can update the following fields:
+  //
+  // * `auth_domain` - Google authentication domain for controlling user access to the application.
+  // * `default_cookie_expiration` - Cookie expiration policy for the application.
+  // * `iap` - Identity-Aware Proxy properties for the application.
+  rpc UpdateApplication(UpdateApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*}"
+      body: "application"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Recreates the required App Engine features for the specified App Engine
+  // application, for example a Cloud Storage bucket or App Engine service
+  // account.
+  // Use this method if you receive an error message about a missing feature,
+  // for example, *Error retrieving the App Engine service account*.
+  // If you have deleted your App Engine service account, this will
+  // not be able to recreate it. Instead, you should attempt to use the
+  // IAM undelete API if possible at https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/undelete?apix_params=%7B"name"%3A"projects%2F-%2FserviceAccounts%2Funique_id"%2C"resource"%3A%7B%7D%7D .
+  // If the deletion was recent, the numeric ID can be found in the Cloud
+  // Console Activity Log.
+  rpc RepairApplication(RepairApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{name=apps/*}:repair"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+}
+
+// Request message for `Applications.GetApplication`.
+message GetApplicationRequest {
+  // Name of the Application resource to get. Example: `apps/myapp`.
+  string name = 1;
+}
+
+// Request message for `Applications.CreateApplication`.
+message CreateApplicationRequest {
+  // Application configuration.
+  Application application = 2;
+}
+
+// Request message for `Applications.UpdateApplication`.
+message UpdateApplicationRequest {
+  // Name of the Application resource to update. Example: `apps/myapp`.
+  string name = 1;
+
+  // An Application containing the updated resource.
+  Application application = 2;
+
+  // Required. Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for 'Applications.RepairApplication'.
+message RepairApplicationRequest {
+  // Name of the application to repair. Example: `apps/myapp`
+  string name = 1;
+}
+
+// Manages services of an application.
+service Services {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all the services in the application.
+  rpc ListServices(ListServicesRequest) returns (ListServicesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*}/services"
+    };
+  }
+
+  // Gets the current configuration of the specified service.
+  rpc GetService(GetServiceRequest) returns (Service) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/services/*}"
+    };
+  }
+
+  // Updates the configuration of the specified service.
+  rpc UpdateService(UpdateServiceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*/services/*}"
+      body: "service"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Service"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Deletes the specified service and all enclosed versions.
+  rpc DeleteService(DeleteServiceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/services/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+}
+
+// Request message for `Services.ListServices`.
+message ListServicesRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `Services.ListServices`.
+message ListServicesResponse {
+  // The services belonging to the requested application.
+  repeated Service services = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Services.GetService`.
+message GetServiceRequest {
+  // Name of the resource requested. Example: `apps/myapp/services/default`.
+  string name = 1;
+}
+
+// Request message for `Services.UpdateService`.
+message UpdateServiceRequest {
+  // Name of the resource to update. Example: `apps/myapp/services/default`.
+  string name = 1;
+
+  // A Service resource containing the updated service. Only fields set in the
+  // field mask will be updated.
+  Service service = 2;
+
+  // Required. Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+
+  // Set to `true` to gradually shift traffic to one or more versions that you
+  // specify. By default, traffic is shifted immediately.
+  // For gradual traffic migration, the target versions
+  // must be located within instances that are configured for both
+  // [warmup requests](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#InboundServiceType)
+  // and
+  // [automatic scaling](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#AutomaticScaling).
+  // You must specify the
+  // [`shardBy`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services#ShardBy)
+  // field in the Service resource. Gradual traffic migration is not
+  // supported in the App Engine flexible environment. For examples, see
+  // [Migrating and Splitting Traffic](https://cloud.google.com/appengine/docs/admin-api/migrating-splitting-traffic).
+  bool migrate_traffic = 4;
+}
+
+// Request message for `Services.DeleteService`.
+message DeleteServiceRequest {
+  // Name of the resource requested. Example: `apps/myapp/services/default`.
+  string name = 1;
+}
+
+// Manages versions of a service.
+service Versions {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the versions of a service.
+  rpc ListVersions(ListVersionsRequest) returns (ListVersionsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*/services/*}/versions"
+    };
+  }
+
+  // Gets the specified Version resource.
+  // By default, only a `BASIC_VIEW` will be returned.
+  // Specify the `FULL_VIEW` parameter to get the full resource.
+  rpc GetVersion(GetVersionRequest) returns (Version) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/services/*/versions/*}"
+    };
+  }
+
+  // Deploys code and resource files to a new version.
+  rpc CreateVersion(CreateVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=apps/*/services/*}/versions"
+      body: "version"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Version"
+      metadata_type: "CreateVersionMetadataV1"
+    };
+  }
+
+  // Updates the specified Version resource.
+  // You can specify the following fields depending on the App Engine
+  // environment and type of scaling that the version resource uses:
+  //
+  // **Standard environment**
+  //
+  // * [`instance_class`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.instance_class)
+  //
+  // *automatic scaling* in the standard environment:
+  //
+  // * [`automatic_scaling.min_idle_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.max_idle_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automaticScaling.standard_scheduler_settings.max_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.min_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.target_cpu_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.target_throughput_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#StandardSchedulerSettings)
+  //
+  // *basic scaling* or *manual scaling* in the standard environment:
+  //
+  // * [`serving_status`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.serving_status)
+  // * [`manual_scaling.instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#manualscaling)
+  //
+  // **Flexible environment**
+  //
+  // * [`serving_status`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.serving_status)
+  //
+  // *automatic scaling* in the flexible environment:
+  //
+  // * [`automatic_scaling.min_total_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.max_total_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.cool_down_period_sec`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.cpu_utilization.target_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#Version.FIELDS.automatic_scaling)
+  //
+  // *manual scaling* in the flexible environment:
+  //
+  // * [`manual_scaling.instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#manualscaling)
+  rpc UpdateVersion(UpdateVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*/services/*/versions/*}"
+      body: "version"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Version"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Deletes an existing Version resource.
+  rpc DeleteVersion(DeleteVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/services/*/versions/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+}
+
+// Request message for `Versions.ListVersions`.
+message ListVersionsRequest {
+  // Name of the parent Service resource. Example:
+  // `apps/myapp/services/default`.
+  string parent = 1;
+
+  // Controls the set of fields returned in the `List` response.
+  VersionView view = 2;
+
+  // Maximum results to return per page.
+  int32 page_size = 3;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 4;
+}
+
+// Response message for `Versions.ListVersions`.
+message ListVersionsResponse {
+  // The versions belonging to the requested service.
+  repeated Version versions = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Fields that should be returned when [Version][google.appengine.v1.Version] resources
+// are retrieved.
+enum VersionView {
+  // Basic version information including scaling and inbound services,
+  // but not detailed deployment information.
+  BASIC = 0;
+
+  // The information from `BASIC`, plus detailed information about the
+  // deployment. This format is required when creating resources, but
+  // is not returned in `Get` or `List` by default.
+  FULL = 1;
+}
+
+// Request message for `Versions.GetVersion`.
+message GetVersionRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string name = 1;
+
+  // Controls the set of fields returned in the `Get` response.
+  VersionView view = 2;
+}
+
+// Request message for `Versions.CreateVersion`.
+message CreateVersionRequest {
+  // Name of the parent resource to create this version under. Example:
+  // `apps/myapp/services/default`.
+  string parent = 1;
+
+  // Application deployment configuration.
+  Version version = 2;
+}
+
+// Request message for `Versions.UpdateVersion`.
+message UpdateVersionRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/services/default/versions/1`.
+  string name = 1;
+
+  // A Version containing the updated resource. Only fields set in the field
+  // mask will be updated.
+  Version version = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `Versions.DeleteVersion`.
+message DeleteVersionRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string name = 1;
+}
+
+// Manages instances of a version.
+service Instances {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the instances of a version.
+  //
+  // Tip: To aggregate details about instances over time, see the
+  // [Stackdriver Monitoring API](https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list).
+  rpc ListInstances(ListInstancesRequest) returns (ListInstancesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*/services/*/versions/*}/instances"
+    };
+  }
+
+  // Gets instance information.
+  rpc GetInstance(GetInstanceRequest) returns (Instance) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/services/*/versions/*/instances/*}"
+    };
+  }
+
+  // Stops a running instance.
+  //
+  // The instance might be automatically recreated based on the scaling settings
+  // of the version. For more information, see "How Instances are Managed"
+  // ([standard environment](https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed) |
+  // [flexible environment](https://cloud.google.com/appengine/docs/flexible/python/how-instances-are-managed)).
+  //
+  // To ensure that instances are not re-created and avoid getting billed, you
+  // can stop all instances within the target version by changing the serving
+  // status of the version to `STOPPED` with the
+  // [`apps.services.versions.patch`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions/patch)
+  // method.
+  rpc DeleteInstance(DeleteInstanceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/services/*/versions/*/instances/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Enables debugging on a VM instance. This allows you to use the SSH
+  // command to connect to the virtual machine where the instance lives.
+  // While in "debug mode", the instance continues to serve live traffic.
+  // You should delete the instance when you are done debugging and then
+  // allow the system to take over and determine if another instance
+  // should be started.
+  //
+  // Only applicable for instances in App Engine flexible environment.
+  rpc DebugInstance(DebugInstanceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{name=apps/*/services/*/versions/*/instances/*}:debug"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Instance"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+}
+
+// Request message for `Instances.ListInstances`.
+message ListInstancesRequest {
+  // Name of the parent Version resource. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `Instances.ListInstances`.
+message ListInstancesResponse {
+  // The instances belonging to the requested version.
+  repeated Instance instances = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Instances.GetInstance`.
+message GetInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+}
+
+// Request message for `Instances.DeleteInstance`.
+message DeleteInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+}
+
+// Request message for `Instances.DebugInstance`.
+message DebugInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+
+  // Public SSH key to add to the instance. Examples:
+  //
+  // * `[USERNAME]:ssh-rsa [KEY_VALUE] [USERNAME]`
+  // * `[USERNAME]:ssh-rsa [KEY_VALUE] google-ssh {"userName":"[USERNAME]","expireOn":"[EXPIRE_TIME]"}`
+  //
+  // For more information, see
+  // [Adding and Removing SSH Keys](https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys).
+  string ssh_key = 2;
+}
+
+// Firewall resources are used to define a collection of access control rules
+// for an Application. Each rule is defined with a position which specifies
+// the rule's order in the sequence of rules, an IP range to be matched against
+// requests, and an action to take upon matching requests.
+//
+// Every request is evaluated against the Firewall rules in priority order.
+// Processesing stops at the first rule which matches the request's IP address.
+// A final rule always specifies an action that applies to all remaining
+// IP addresses. The default final rule for a newly-created application will be
+// set to "allow" if not otherwise specified by the user.
+service Firewall {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the firewall rules of an application.
+  rpc ListIngressRules(ListIngressRulesRequest) returns (ListIngressRulesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*}/firewall/ingressRules"
+    };
+  }
+
+  // Replaces the entire firewall ruleset in one bulk operation. This overrides
+  // and replaces the rules of an existing firewall with the new rules.
+  //
+  // If the final rule does not match traffic with the '*' wildcard IP range,
+  // then an "allow all" rule is explicitly added to the end of the list.
+  rpc BatchUpdateIngressRules(BatchUpdateIngressRulesRequest) returns (BatchUpdateIngressRulesResponse) {
+    option (google.api.http) = {
+      post: "/v1/{name=apps/*/firewall/ingressRules}:batchUpdate"
+      body: "*"
+    };
+  }
+
+  // Creates a firewall rule for the application.
+  rpc CreateIngressRule(CreateIngressRuleRequest) returns (google.appengine.v1.FirewallRule) {
+    option (google.api.http) = {
+      post: "/v1/{parent=apps/*}/firewall/ingressRules"
+      body: "rule"
+    };
+  }
+
+  // Gets the specified firewall rule.
+  rpc GetIngressRule(GetIngressRuleRequest) returns (google.appengine.v1.FirewallRule) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/firewall/ingressRules/*}"
+    };
+  }
+
+  // Updates the specified firewall rule.
+  rpc UpdateIngressRule(UpdateIngressRuleRequest) returns (google.appengine.v1.FirewallRule) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*/firewall/ingressRules/*}"
+      body: "rule"
+    };
+  }
+
+  // Deletes the specified firewall rule.
+  rpc DeleteIngressRule(DeleteIngressRuleRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/firewall/ingressRules/*}"
+    };
+  }
+}
+
+// Request message for `Firewall.ListIngressRules`.
+message ListIngressRulesRequest {
+  // Name of the Firewall collection to retrieve.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+
+  // A valid IP Address. If set, only rules matching this address will be
+  // returned. The first returned rule will be the rule that fires on requests
+  // from this IP.
+  string matching_address = 4;
+}
+
+// Response message for `Firewall.ListIngressRules`.
+message ListIngressRulesResponse {
+  // The ingress FirewallRules for this application.
+  repeated google.appengine.v1.FirewallRule ingress_rules = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Firewall.BatchUpdateIngressRules`.
+message BatchUpdateIngressRulesRequest {
+  // Name of the Firewall collection to set.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string name = 1;
+
+  // A list of FirewallRules to replace the existing set.
+  repeated google.appengine.v1.FirewallRule ingress_rules = 2;
+}
+
+// Response message for `Firewall.UpdateAllIngressRules`.
+message BatchUpdateIngressRulesResponse {
+  // The full list of ingress FirewallRules for this application.
+  repeated google.appengine.v1.FirewallRule ingress_rules = 1;
+}
+
+// Request message for `Firewall.CreateIngressRule`.
+message CreateIngressRuleRequest {
+  // Name of the parent Firewall collection in which to create a new rule.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string parent = 1;
+
+  // A FirewallRule containing the new resource.
+  //
+  // The user may optionally provide a position at which the new rule will be
+  // placed. The positions define a sequential list starting at 1. If a rule
+  // already exists at the given position, rules greater than the provided
+  // position will be moved forward by one.
+  //
+  // If no position is provided, the server will place the rule as the second to
+  // last rule in the sequence before the required default allow-all or deny-all
+  // rule.
+  google.appengine.v1.FirewallRule rule = 2;
+}
+
+// Request message for `Firewall.GetIngressRule`.
+message GetIngressRuleRequest {
+  // Name of the Firewall resource to retrieve.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+}
+
+// Request message for `Firewall.UpdateIngressRule`.
+message UpdateIngressRuleRequest {
+  // Name of the Firewall resource to update.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+
+  // A FirewallRule containing the updated resource
+  google.appengine.v1.FirewallRule rule = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `Firewall.DeleteIngressRule`.
+message DeleteIngressRuleRequest {
+  // Name of the Firewall resource to delete.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+}
+
+// Manages domains a user is authorized to administer. To authorize use of a
+// domain, verify ownership via
+// [Webmaster Central](https://www.google.com/webmasters/verification/home).
+service AuthorizedDomains {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all domains the user is authorized to administer.
+  rpc ListAuthorizedDomains(ListAuthorizedDomainsRequest) returns (ListAuthorizedDomainsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*}/authorizedDomains"
+    };
+  }
+}
+
+// Request message for `AuthorizedDomains.ListAuthorizedDomains`.
+message ListAuthorizedDomainsRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `AuthorizedDomains.ListAuthorizedDomains`.
+message ListAuthorizedDomainsResponse {
+  // The authorized domains belonging to the user.
+  repeated google.appengine.v1.AuthorizedDomain domains = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Manages SSL certificates a user is authorized to administer. A user can
+// administer any SSL certificates applicable to their authorized domains.
+service AuthorizedCertificates {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all SSL certificates the user is authorized to administer.
+  rpc ListAuthorizedCertificates(ListAuthorizedCertificatesRequest) returns (ListAuthorizedCertificatesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*}/authorizedCertificates"
+    };
+  }
+
+  // Gets the specified SSL certificate.
+  rpc GetAuthorizedCertificate(GetAuthorizedCertificateRequest) returns (google.appengine.v1.AuthorizedCertificate) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/authorizedCertificates/*}"
+    };
+  }
+
+  // Uploads the specified SSL certificate.
+  rpc CreateAuthorizedCertificate(CreateAuthorizedCertificateRequest) returns (google.appengine.v1.AuthorizedCertificate) {
+    option (google.api.http) = {
+      post: "/v1/{parent=apps/*}/authorizedCertificates"
+      body: "certificate"
+    };
+  }
+
+  // Updates the specified SSL certificate. To renew a certificate and maintain
+  // its existing domain mappings, update `certificate_data` with a new
+  // certificate. The new certificate must be applicable to the same domains as
+  // the original certificate. The certificate `display_name` may also be
+  // updated.
+  rpc UpdateAuthorizedCertificate(UpdateAuthorizedCertificateRequest) returns (google.appengine.v1.AuthorizedCertificate) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*/authorizedCertificates/*}"
+      body: "certificate"
+    };
+  }
+
+  // Deletes the specified SSL certificate.
+  rpc DeleteAuthorizedCertificate(DeleteAuthorizedCertificateRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/authorizedCertificates/*}"
+    };
+  }
+}
+
+// Request message for `AuthorizedCertificates.ListAuthorizedCertificates`.
+message ListAuthorizedCertificatesRequest {
+  // Name of the parent `Application` resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Controls the set of fields returned in the `LIST` response.
+  AuthorizedCertificateView view = 4;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `AuthorizedCertificates.ListAuthorizedCertificates`.
+message ListAuthorizedCertificatesResponse {
+  // The SSL certificates the user is authorized to administer.
+  repeated google.appengine.v1.AuthorizedCertificate certificates = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `AuthorizedCertificates.GetAuthorizedCertificate`.
+message GetAuthorizedCertificateRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+
+  // Controls the set of fields returned in the `GET` response.
+  AuthorizedCertificateView view = 2;
+}
+
+// Fields that should be returned when an AuthorizedCertificate resource is
+// retrieved.
+enum AuthorizedCertificateView {
+  // Basic certificate information, including applicable domains and expiration
+  // date.
+  BASIC_CERTIFICATE = 0;
+
+  // The information from `BASIC_CERTIFICATE`, plus detailed information on the
+  // domain mappings that have this certificate mapped.
+  FULL_CERTIFICATE = 1;
+}
+
+// Request message for `AuthorizedCertificates.CreateAuthorizedCertificate`.
+message CreateAuthorizedCertificateRequest {
+  // Name of the parent `Application` resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // SSL certificate data.
+  google.appengine.v1.AuthorizedCertificate certificate = 2;
+}
+
+// Request message for `AuthorizedCertificates.UpdateAuthorizedCertificate`.
+message UpdateAuthorizedCertificateRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+
+  // An `AuthorizedCertificate` containing the updated resource. Only fields set
+  // in the field mask will be updated.
+  google.appengine.v1.AuthorizedCertificate certificate = 2;
+
+  // Standard field mask for the set of fields to be updated. Updates are only
+  // supported on the `certificate_raw_data` and `display_name` fields.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `AuthorizedCertificates.DeleteAuthorizedCertificate`.
+message DeleteAuthorizedCertificateRequest {
+  // Name of the resource to delete. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+}
+
+// Manages domains serving an application.
+service DomainMappings {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the domain mappings on an application.
+  rpc ListDomainMappings(ListDomainMappingsRequest) returns (ListDomainMappingsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=apps/*}/domainMappings"
+    };
+  }
+
+  // Gets the specified domain mapping.
+  rpc GetDomainMapping(GetDomainMappingRequest) returns (google.appengine.v1.DomainMapping) {
+    option (google.api.http) = {
+      get: "/v1/{name=apps/*/domainMappings/*}"
+    };
+  }
+
+  // Maps a domain to an application. A user must be authorized to administer a
+  // domain in order to map it to an application. For a list of available
+  // authorized domains, see [`AuthorizedDomains.ListAuthorizedDomains`]().
+  rpc CreateDomainMapping(CreateDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=apps/*}/domainMappings"
+      body: "domain_mapping"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "DomainMapping"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Updates the specified domain mapping. To map an SSL certificate to a
+  // domain mapping, update `certificate_id` to point to an `AuthorizedCertificate`
+  // resource. A user must be authorized to administer the associated domain
+  // in order to update a `DomainMapping` resource.
+  rpc UpdateDomainMapping(UpdateDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{name=apps/*/domainMappings/*}"
+      body: "domain_mapping"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "DomainMapping"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+
+  // Deletes the specified domain mapping. A user must be authorized to
+  // administer the associated domain in order to delete a `DomainMapping`
+  // resource.
+  rpc DeleteDomainMapping(DeleteDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=apps/*/domainMappings/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1"
+    };
+  }
+}
+
+// Request message for `DomainMappings.ListDomainMappings`.
+message ListDomainMappingsRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `DomainMappings.ListDomainMappings`.
+message ListDomainMappingsResponse {
+  // The domain mappings for the application.
+  repeated google.appengine.v1.DomainMapping domain_mappings = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `DomainMappings.GetDomainMapping`.
+message GetDomainMappingRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+}
+
+// Override strategy for mutating an existing mapping.
+enum DomainOverrideStrategy {
+  // Strategy unspecified. Defaults to `STRICT`.
+  UNSPECIFIED_DOMAIN_OVERRIDE_STRATEGY = 0;
+
+  // Overrides not allowed. If a mapping already exists for the
+  // specified domain, the request will return an ALREADY_EXISTS (409).
+  STRICT = 1;
+
+  // Overrides allowed. If a mapping already exists for the specified domain,
+  // the request will overwrite it. Note that this might stop another
+  // Google product from serving. For example, if the domain is
+  // mapped to another App Engine application, that app will no
+  // longer serve from that domain.
+  OVERRIDE = 2;
+}
+
+// Request message for `DomainMappings.CreateDomainMapping`.
+message CreateDomainMappingRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Domain mapping configuration.
+  google.appengine.v1.DomainMapping domain_mapping = 2;
+
+  // Whether the domain creation should override any existing mappings for this
+  // domain. By default, overrides are rejected.
+  DomainOverrideStrategy override_strategy = 4;
+}
+
+// Request message for `DomainMappings.UpdateDomainMapping`.
+message UpdateDomainMappingRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+
+  // A domain mapping containing the updated resource. Only fields set
+  // in the field mask will be updated.
+  google.appengine.v1.DomainMapping domain_mapping = 2;
+
+  // Required. Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `DomainMappings.DeleteDomainMapping`.
+message DeleteDomainMappingRequest {
+  // Name of the resource to delete. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1/appengine_grpc_service_config.json b/third_party/googleapis/google/appengine/v1/appengine_grpc_service_config.json
new file mode 100644
index 0000000..03e4427
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/appengine_grpc_service_config.json
@@ -0,0 +1,17 @@
+{
+  "methodConfig": [{
+    "name": [
+      { "service": "google.appengine.v1.Applications" },
+      { "service": "google.appengine.v1.Services" },
+      { "service": "google.appengine.v1.Versions" },
+      { "service": "google.appengine.v1.DeployedFiles" },
+      { "service": "google.appengine.v1.Instances" },
+      { "service": "google.appengine.v1.EmailSenders" },
+      { "service": "google.appengine.v1.Firewall" },
+      { "service": "google.appengine.v1.AuthorizedDomains" },
+      { "service": "google.appengine.v1.AuthorizedCertificates" },
+      { "service": "google.appengine.v1.DomainMappings" }
+    ],
+    "timeout": "60s"
+  }]
+}
diff --git a/third_party/googleapis/google/appengine/v1/appengine_v1.yaml b/third_party/googleapis/google/appengine/v1/appengine_v1.yaml
new file mode 100644
index 0000000..d357318
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/appengine_v1.yaml
@@ -0,0 +1,236 @@
+type: google.api.Service
+config_version: 3
+name: appengine.googleapis.com
+title: App Engine Admin API
+
+apis:
+- name: google.appengine.v1.Applications
+- name: google.appengine.v1.AuthorizedCertificates
+- name: google.appengine.v1.AuthorizedDomains
+- name: google.appengine.v1.DomainMappings
+- name: google.appengine.v1.Firewall
+- name: google.appengine.v1.Instances
+- name: google.appengine.v1.Services
+- name: google.appengine.v1.Versions
+
+types:
+- name: google.appengine.v1.LocationMetadata
+- name: google.appengine.v1.OperationMetadataV1
+
+documentation:
+  summary: Provisions and manages developers' App Engine applications.
+  overview: |-
+    # Google App Engine Admin API
+
+    ## Overview
+
+    The Google App Engine Admin API is a RESTful API for managing App Engine
+    applications. The Admin API provides programmatic access to several of the
+    App Engine administrative operations that are found in the [Google Cloud
+    Platform Console](https://console.cloud.google.com/appengine).
+
+    ## Documentation
+
+    [Google App Engine Admin API
+    Documentation](https://cloud.google.com/appengine/docs/admin-api/)
+  rules:
+  - selector: google.cloud.location.Locations.GetLocation
+    description: Gets information about a location.
+
+  - selector: google.cloud.location.Locations.ListLocations
+    description: Lists information about the supported locations for this service.
+
+backend:
+  rules:
+  - selector: 'google.appengine.v1.Applications.*'
+    deadline: 30.0
+  - selector: 'google.appengine.v1.AuthorizedCertificates.*'
+    deadline: 30.0
+  - selector: google.appengine.v1.AuthorizedCertificates.GetAuthorizedCertificate
+    deadline: 60.0
+  - selector: google.appengine.v1.AuthorizedDomains.ListAuthorizedDomains
+    deadline: 30.0
+  - selector: 'google.appengine.v1.DomainMappings.*'
+    deadline: 30.0
+  - selector: google.appengine.v1.DomainMappings.GetDomainMapping
+    deadline: 60.0
+  - selector: google.appengine.v1.DomainMappings.ListDomainMappings
+    deadline: 60.0
+  - selector: 'google.appengine.v1.Firewall.*'
+    deadline: 30.0
+  - selector: 'google.appengine.v1.Instances.*'
+    deadline: 30.0
+  - selector: google.appengine.v1.Instances.ListInstances
+    deadline: 60.0
+  - selector: 'google.appengine.v1.Services.*'
+    deadline: 30.0
+  - selector: 'google.appengine.v1.Versions.*'
+    deadline: 30.0
+  - selector: google.cloud.location.Locations.GetLocation
+    deadline: 30.0
+  - selector: google.cloud.location.Locations.ListLocations
+    deadline: 30.0
+  - selector: 'google.longrunning.Operations.*'
+    deadline: 30.0
+
+http:
+  rules:
+  - selector: google.cloud.location.Locations.GetLocation
+    get: '/v1/{name=apps/*/locations/*}'
+  - selector: google.cloud.location.Locations.ListLocations
+    get: '/v1/{name=apps/*}/locations'
+  - selector: google.longrunning.Operations.GetOperation
+    get: '/v1/{name=apps/*/operations/*}'
+  - selector: google.longrunning.Operations.ListOperations
+    get: '/v1/{name=apps/*}/operations'
+
+authentication:
+  rules:
+  - selector: 'google.appengine.v1.Applications.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Applications.GetApplication
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: 'google.appengine.v1.AuthorizedCertificates.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.AuthorizedCertificates.GetAuthorizedCertificate
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.AuthorizedCertificates.ListAuthorizedCertificates
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.AuthorizedDomains.ListAuthorizedDomains
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: 'google.appengine.v1.DomainMappings.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.DomainMappings.GetDomainMapping
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.DomainMappings.ListDomainMappings
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: 'google.appengine.v1.Firewall.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Firewall.GetIngressRule
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Firewall.ListIngressRules
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Instances.DebugInstance
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Instances.DeleteInstance
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Instances.GetInstance
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Instances.ListInstances
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Services.DeleteService
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Services.GetService
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Services.ListServices
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Services.UpdateService
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: 'google.appengine.v1.Versions.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.appengine.v1.Versions.GetVersion
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.appengine.v1.Versions.ListVersions
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.cloud.location.Locations.GetLocation
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.cloud.location.Locations.ListLocations
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.longrunning.Operations.GetOperation
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.longrunning.Operations.ListOperations
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/appengine.admin,
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/cloud-platform.read-only
+  - selector: google.longrunning.Operations.WaitOperation
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
diff --git a/third_party/googleapis/google/appengine/v1/application.proto b/third_party/googleapis/google/appengine/v1/application.proto
new file mode 100644
index 0000000..bc9c3f5
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/application.proto
@@ -0,0 +1,198 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "ApplicationProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// An Application resource contains the top-level configuration of an App
+// Engine application.
+message Application {
+  enum ServingStatus {
+    // Serving status is unspecified.
+    UNSPECIFIED = 0;
+
+    // Application is serving.
+    SERVING = 1;
+
+    // Application has been disabled by the user.
+    USER_DISABLED = 2;
+
+    // Application has been disabled by the system.
+    SYSTEM_DISABLED = 3;
+  }
+
+  // Identity-Aware Proxy
+  message IdentityAwareProxy {
+    // Whether the serving infrastructure will authenticate and
+    // authorize all incoming requests.
+    //
+    // If true, the `oauth2_client_id` and `oauth2_client_secret`
+    // fields must be non-empty.
+    bool enabled = 1;
+
+    // OAuth2 client ID to use for the authentication flow.
+    string oauth2_client_id = 2;
+
+    // OAuth2 client secret to use for the authentication flow.
+    //
+    // For security reasons, this value cannot be retrieved via the API.
+    // Instead, the SHA-256 hash of the value is returned in the
+    // `oauth2_client_secret_sha256` field.
+    //
+    // @InputOnly
+    string oauth2_client_secret = 3;
+
+    // Hex-encoded SHA-256 hash of the client secret.
+    //
+    // @OutputOnly
+    string oauth2_client_secret_sha256 = 4;
+  }
+
+  enum DatabaseType {
+    // Database type is unspecified.
+    DATABASE_TYPE_UNSPECIFIED = 0;
+
+    // Cloud Datastore
+    CLOUD_DATASTORE = 1;
+
+    // Cloud Firestore Native
+    CLOUD_FIRESTORE = 2;
+
+    // Cloud Firestore in Datastore Mode
+    CLOUD_DATASTORE_COMPATIBILITY = 3;
+  }
+
+  // The feature specific settings to be used in the application. These define
+  // behaviors that are user configurable.
+  message FeatureSettings {
+    // Boolean value indicating if split health checks should be used instead
+    // of the legacy health checks. At an app.yaml level, this means defaulting
+    // to 'readiness_check' and 'liveness_check' values instead of
+    // 'health_check' ones. Once the legacy 'health_check' behavior is
+    // deprecated, and this value is always true, this setting can
+    // be removed.
+    bool split_health_checks = 1;
+
+    // If true, use [Container-Optimized OS](https://cloud.google.com/container-optimized-os/)
+    // base image for VMs, rather than a base Debian image.
+    bool use_container_optimized_os = 2;
+  }
+
+  // Full path to the Application resource in the API.
+  // Example: `apps/myapp`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Identifier of the Application resource. This identifier is equivalent
+  // to the project ID of the Google Cloud Platform project where you want to
+  // deploy your application.
+  // Example: `myapp`.
+  string id = 2;
+
+  // HTTP path dispatch rules for requests to the application that do not
+  // explicitly target a service or version. Rules are order-dependent.
+  // Up to 20 dispatch rules can be supported.
+  repeated UrlDispatchRule dispatch_rules = 3;
+
+  // Google Apps authentication domain that controls which users can access
+  // this application.
+  //
+  // Defaults to open access for any Google Account.
+  string auth_domain = 6;
+
+  // Location from which this application runs. Application instances
+  // run out of the data centers in the specified location, which is also where
+  // all of the application's end user content is stored.
+  //
+  // Defaults to `us-central`.
+  //
+  // View the list of
+  // [supported locations](https://cloud.google.com/appengine/docs/locations).
+  string location_id = 7;
+
+  // Google Cloud Storage bucket that can be used for storing files
+  // associated with this application. This bucket is associated with the
+  // application and can be used by the gcloud deployment commands.
+  //
+  // @OutputOnly
+  string code_bucket = 8;
+
+  // Cookie expiration policy for this application.
+  google.protobuf.Duration default_cookie_expiration = 9;
+
+  // Serving status of this application.
+  ServingStatus serving_status = 10;
+
+  // Hostname used to reach this application, as resolved by App Engine.
+  //
+  // @OutputOnly
+  string default_hostname = 11;
+
+  // Google Cloud Storage bucket that can be used by this application to store
+  // content.
+  //
+  // @OutputOnly
+  string default_bucket = 12;
+
+  // The service account associated with the application.
+  // This is the app-level default identity. If no identity provided during
+  // create version, Admin API will fallback to this one.
+  string service_account = 13;
+
+  IdentityAwareProxy iap = 14;
+
+  // The Google Container Registry domain used for storing managed build docker
+  // images for this application.
+  string gcr_domain = 16;
+
+  // The type of the Cloud Firestore or Cloud Datastore database associated with
+  // this application.
+  DatabaseType database_type = 17;
+
+  // The feature specific settings to be used in the application.
+  FeatureSettings feature_settings = 18;
+}
+
+// Rules to match an HTTP request and dispatch that request to a service.
+message UrlDispatchRule {
+  // Domain name to match against. The wildcard "`*`" is supported if
+  // specified before a period: "`*.`".
+  //
+  // Defaults to matching all domains: "`*`".
+  string domain = 1;
+
+  // Pathname within the host. Must start with a "`/`". A
+  // single "`*`" can be included at the end of the path.
+  //
+  // The sum of the lengths of the domain and path may not
+  // exceed 100 characters.
+  string path = 2;
+
+  // Resource ID of a service in this application that should
+  // serve the matched request. The service must already
+  // exist. Example: `default`.
+  string service = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1/audit_data.proto b/third_party/googleapis/google/appengine/v1/audit_data.proto
new file mode 100644
index 0000000..d839280
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/audit_data.proto
@@ -0,0 +1,54 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/appengine/v1/appengine.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AuditDataProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// App Engine admin service audit log.
+message AuditData {
+  // Detailed information about methods that require it. Does not include
+  // simple Get, List or Delete methods because all significant information
+  // (resource name, number of returned elements for List operations) is already
+  // included in parent audit log message.
+  oneof method {
+    // Detailed information about UpdateService call.
+    UpdateServiceMethod update_service = 1;
+
+    // Detailed information about CreateVersion call.
+    CreateVersionMethod create_version = 2;
+  }
+}
+
+// Detailed information about UpdateService call.
+message UpdateServiceMethod {
+  // Update service request.
+  UpdateServiceRequest request = 1;
+}
+
+// Detailed information about CreateVersion call.
+message CreateVersionMethod {
+  // Create version request.
+  CreateVersionRequest request = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1/certificate.proto b/third_party/googleapis/google/appengine/v1/certificate.proto
new file mode 100644
index 0000000..037465b
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/certificate.proto
@@ -0,0 +1,172 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "CertificateProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// An SSL certificate that a user has been authorized to administer. A user
+// is authorized to administer any certificate that applies to one of their
+// authorized domains.
+message AuthorizedCertificate {
+  // Full path to the `AuthorizedCertificate` resource in the API. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the certificate. This is a unique value autogenerated
+  // on `AuthorizedCertificate` resource creation. Example: `12345`.
+  //
+  // @OutputOnly
+  string id = 2;
+
+  // The user-specified display name of the certificate. This is not
+  // guaranteed to be unique. Example: `My Certificate`.
+  string display_name = 3;
+
+  // Topmost applicable domains of this certificate. This certificate
+  // applies to these domains and their subdomains. Example: `example.com`.
+  //
+  // @OutputOnly
+  repeated string domain_names = 4;
+
+  // The time when this certificate expires. To update the renewal time on this
+  // certificate, upload an SSL certificate with a different expiration time
+  // using [`AuthorizedCertificates.UpdateAuthorizedCertificate`]().
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp expire_time = 5;
+
+  // The SSL certificate serving the `AuthorizedCertificate` resource. This
+  // must be obtained independently from a certificate authority.
+  CertificateRawData certificate_raw_data = 6;
+
+  // Only applicable if this certificate is managed by App Engine. Managed
+  // certificates are tied to the lifecycle of a `DomainMapping` and cannot be
+  // updated or deleted via the `AuthorizedCertificates` API. If this
+  // certificate is manually administered by the user, this field will be empty.
+  //
+  // @OutputOnly
+  ManagedCertificate managed_certificate = 7;
+
+  // The full paths to user visible Domain Mapping resources that have this
+  // certificate mapped. Example: `apps/myapp/domainMappings/example.com`.
+  //
+  // This may not represent the full list of mapped domain mappings if the user
+  // does not have `VIEWER` permissions on all of the applications that have
+  // this certificate mapped. See `domain_mappings_count` for a complete count.
+  //
+  // Only returned by `GET` or `LIST` requests when specifically requested by
+  // the `view=FULL_CERTIFICATE` option.
+  //
+  // @OutputOnly
+  repeated string visible_domain_mappings = 8;
+
+  // Aggregate count of the domain mappings with this certificate mapped. This
+  // count includes domain mappings on applications for which the user does not
+  // have `VIEWER` permissions.
+  //
+  // Only returned by `GET` or `LIST` requests when specifically requested by
+  // the `view=FULL_CERTIFICATE` option.
+  //
+  // @OutputOnly
+  int32 domain_mappings_count = 9;
+}
+
+// An SSL certificate obtained from a certificate authority.
+message CertificateRawData {
+  // PEM encoded x.509 public key certificate. This field is set once on
+  // certificate creation. Must include the header and footer. Example:
+  // <pre>
+  // -----BEGIN CERTIFICATE-----
+  // <certificate_value>
+  // -----END CERTIFICATE-----
+  // </pre>
+  string public_certificate = 1;
+
+  // Unencrypted PEM encoded RSA private key. This field is set once on
+  // certificate creation and then encrypted. The key size must be 2048
+  // bits or fewer. Must include the header and footer. Example:
+  // <pre>
+  // -----BEGIN RSA PRIVATE KEY-----
+  // <unencrypted_key_value>
+  // -----END RSA PRIVATE KEY-----
+  // </pre>
+  // @InputOnly
+  string private_key = 2;
+}
+
+// State of certificate management. Refers to the most recent certificate
+// acquisition or renewal attempt.
+enum ManagementStatus {
+  MANAGEMENT_STATUS_UNSPECIFIED = 0;
+
+  // Certificate was successfully obtained and inserted into the serving
+  // system.
+  OK = 1;
+
+  // Certificate is under active attempts to acquire or renew.
+  PENDING = 2;
+
+  // Most recent renewal failed due to an invalid DNS setup and will be
+  // retried. Renewal attempts will continue to fail until the certificate
+  // domain's DNS configuration is fixed. The last successfully provisioned
+  // certificate may still be serving.
+  FAILED_RETRYING_NOT_VISIBLE = 4;
+
+  // All renewal attempts have been exhausted, likely due to an invalid DNS
+  // setup.
+  FAILED_PERMANENT = 6;
+
+  // Most recent renewal failed due to an explicit CAA record that does not
+  // include one of the in-use CAs (Google CA and Let's Encrypt). Renewals will
+  // continue to fail until the CAA is reconfigured. The last successfully
+  // provisioned certificate may still be serving.
+  FAILED_RETRYING_CAA_FORBIDDEN = 7;
+
+  // Most recent renewal failed due to a CAA retrieval failure. This means that
+  // the domain's DNS provider does not properly handle CAA records, failing
+  // requests for CAA records when no CAA records are defined. Renewals will
+  // continue to fail until the DNS provider is changed or a CAA record is
+  // added for the given domain. The last successfully provisioned certificate
+  // may still be serving.
+  FAILED_RETRYING_CAA_CHECKING = 8;
+}
+
+// A certificate managed by App Engine.
+message ManagedCertificate {
+  // Time at which the certificate was last renewed. The renewal process is
+  // fully managed. Certificate renewal will automatically occur before the
+  // certificate expires. Renewal errors can be tracked via `ManagementStatus`.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp last_renewal_time = 1;
+
+  // Status of certificate management. Refers to the most recent certificate
+  // acquisition or renewal attempt.
+  //
+  // @OutputOnly
+  ManagementStatus status = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1/deploy.proto b/third_party/googleapis/google/appengine/v1/deploy.proto
new file mode 100644
index 0000000..8796ec1
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/deploy.proto
@@ -0,0 +1,107 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DeployProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// Code and application artifacts used to deploy a version to App Engine.
+message Deployment {
+  // Manifest of the files stored in Google Cloud Storage that are included
+  // as part of this version. All files must be readable using the
+  // credentials supplied with this call.
+  map<string, FileInfo> files = 1;
+
+  // The Docker image for the container that runs the version.
+  // Only applicable for instances running in the App Engine flexible environment.
+  ContainerInfo container = 2;
+
+  // The zip file for this deployment, if this is a zip deployment.
+  ZipInfo zip = 3;
+
+  // Options for any Google Cloud Build builds created as a part of this
+  // deployment.
+  //
+  // These options will only be used if a new build is created, such as when
+  // deploying to the App Engine flexible environment using files or zip.
+  CloudBuildOptions cloud_build_options = 6;
+}
+
+// Single source file that is part of the version to be deployed. Each source
+// file that is deployed must be specified separately.
+message FileInfo {
+  // URL source to use to fetch this file. Must be a URL to a resource in
+  // Google Cloud Storage in the form
+  // 'http(s)://storage.googleapis.com/\<bucket\>/\<object\>'.
+  string source_url = 1;
+
+  // The SHA1 hash of the file, in hex.
+  string sha1_sum = 2;
+
+  // The MIME type of the file.
+  //
+  // Defaults to the value from Google Cloud Storage.
+  string mime_type = 3;
+}
+
+// Docker image that is used to create a container and start a VM instance for
+// the version that you deploy. Only applicable for instances running in the App
+// Engine flexible environment.
+message ContainerInfo {
+  // URI to the hosted container image in Google Container Registry. The URI
+  // must be fully qualified and include a tag or digest.
+  // Examples: "gcr.io/my-project/image:tag" or "gcr.io/my-project/image@digest"
+  string image = 1;
+}
+
+// Options for the build operations performed as a part of the version
+// deployment. Only applicable for App Engine flexible environment when creating
+// a version using source code directly.
+message CloudBuildOptions {
+  // Path to the yaml file used in deployment, used to determine runtime
+  // configuration details.
+  //
+  // Required for flexible environment builds.
+  //
+  // See https://cloud.google.com/appengine/docs/standard/python/config/appref
+  // for more details.
+  string app_yaml_path = 1;
+
+  // The Cloud Build timeout used as part of any dependent builds performed by
+  // version creation. Defaults to 10 minutes.
+  google.protobuf.Duration cloud_build_timeout = 2;
+}
+
+// The zip file information for a zip deployment.
+message ZipInfo {
+  // URL of the zip file to deploy from. Must be a URL to a resource in
+  // Google Cloud Storage in the form
+  // 'http(s)://storage.googleapis.com/\<bucket\>/\<object\>'.
+  string source_url = 3;
+
+  // An estimate of the number of files in a zip for a zip deployment.
+  // If set, must be greater than or equal to the actual number of files.
+  // Used for optimizing performance; if not provided, deployment may be slow.
+  int32 files_count = 4;
+}
diff --git a/third_party/googleapis/google/appengine/v1/deployed_files.proto b/third_party/googleapis/google/appengine/v1/deployed_files.proto
new file mode 100644
index 0000000..67e9b70
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/deployed_files.proto
@@ -0,0 +1,25 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DeployedFilesProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
diff --git a/third_party/googleapis/google/appengine/v1/domain.proto b/third_party/googleapis/google/appengine/v1/domain.proto
new file mode 100644
index 0000000..cd39adf
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/domain.proto
@@ -0,0 +1,40 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DomainProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A domain that a user has been authorized to administer. To authorize use
+// of a domain, verify ownership via
+// [Webmaster Central](https://www.google.com/webmasters/verification/home).
+message AuthorizedDomain {
+  // Full path to the `AuthorizedDomain` resource in the API. Example:
+  // `apps/myapp/authorizedDomains/example.com`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Fully qualified domain name of the domain authorized for use. Example:
+  // `example.com`.
+  string id = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1/domain_mapping.proto b/third_party/googleapis/google/appengine/v1/domain_mapping.proto
new file mode 100644
index 0000000..f307217
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/domain_mapping.proto
@@ -0,0 +1,123 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DomainMappingProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A domain serving an App Engine application.
+message DomainMapping {
+  // Full path to the `DomainMapping` resource in the API. Example:
+  // `apps/myapp/domainMapping/example.com`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the domain serving the application. Example:
+  // `example.com`.
+  string id = 2;
+
+  // SSL configuration for this domain. If unconfigured, this domain will not
+  // serve with SSL.
+  SslSettings ssl_settings = 3;
+
+  // The resource records required to configure this domain mapping. These
+  // records must be added to the domain's DNS configuration in order to
+  // serve the application via this domain mapping.
+  //
+  // @OutputOnly
+  repeated ResourceRecord resource_records = 4;
+}
+
+// SSL configuration for a `DomainMapping` resource.
+message SslSettings {
+  // The SSL management type for this domain.
+  enum SslManagementType {
+    // Defaults to `AUTOMATIC`.
+    SSL_MANAGEMENT_TYPE_UNSPECIFIED = 0;
+
+    // SSL support for this domain is configured automatically. The mapped SSL
+    // certificate will be automatically renewed.
+    AUTOMATIC = 1;
+
+    // SSL support for this domain is configured manually by the user. Either
+    // the domain has no SSL support or a user-obtained SSL certificate has been
+    // explictly mapped to this domain.
+    MANUAL = 2;
+  }
+
+  // ID of the `AuthorizedCertificate` resource configuring SSL for the
+  // application. Clearing this field will remove SSL support.
+  //
+  // By default, a managed certificate is automatically created for every
+  // domain mapping. To omit SSL support or to configure SSL manually, specify
+  // `SslManagementType.MANUAL` on a `CREATE` or `UPDATE` request. You must
+  // be authorized to administer the `AuthorizedCertificate` resource to
+  // manually map it to a `DomainMapping` resource.
+  // Example: `12345`.
+  string certificate_id = 1;
+
+  // SSL management type for this domain. If `AUTOMATIC`, a managed certificate
+  // is automatically provisioned. If `MANUAL`, `certificate_id` must be
+  // manually specified in order to configure SSL for this domain.
+  SslManagementType ssl_management_type = 3;
+
+  // ID of the managed `AuthorizedCertificate` resource currently being
+  // provisioned, if applicable. Until the new managed certificate has been
+  // successfully provisioned, the previous SSL state will be preserved. Once
+  // the provisioning process completes, the `certificate_id` field will reflect
+  // the new managed certificate and this field will be left empty. To remove
+  // SSL support while there is still a pending managed certificate, clear the
+  // `certificate_id` field with an `UpdateDomainMappingRequest`.
+  //
+  // @OutputOnly
+  string pending_managed_certificate_id = 4;
+}
+
+// A DNS resource record.
+message ResourceRecord {
+  // A resource record type.
+  enum RecordType {
+    // An unknown resource record.
+    RECORD_TYPE_UNSPECIFIED = 0;
+
+    // An A resource record. Data is an IPv4 address.
+    A = 1;
+
+    // An AAAA resource record. Data is an IPv6 address.
+    AAAA = 2;
+
+    // A CNAME resource record. Data is a domain name to be aliased.
+    CNAME = 3;
+  }
+
+  // Relative name of the object affected by this record. Only applicable for
+  // `CNAME` records. Example: 'www'.
+  string name = 1;
+
+  // Data for this record. Values vary by record type, as defined in RFC 1035
+  // (section 5) and RFC 1034 (section 3.6.1).
+  string rrdata = 2;
+
+  // Resource record type. Example: `AAAA`.
+  RecordType type = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1/firewall.proto b/third_party/googleapis/google/appengine/v1/firewall.proto
new file mode 100644
index 0000000..d7172f7
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/firewall.proto
@@ -0,0 +1,68 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "FirewallProto";
+option java_package = "com.google.appengine.v1.firewall";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A single firewall rule that is evaluated against incoming traffic
+// and provides an action to take on matched requests.
+message FirewallRule {
+  // Available actions to take on matching requests.
+  enum Action {
+    UNSPECIFIED_ACTION = 0;
+
+    // Matching requests are allowed.
+    ALLOW = 1;
+
+    // Matching requests are denied.
+    DENY = 2;
+  }
+
+  // A positive integer between [1, Int32.MaxValue-1] that defines the order of
+  // rule evaluation. Rules with the lowest priority are evaluated first.
+  //
+  // A default rule at priority Int32.MaxValue matches all IPv4 and IPv6 traffic
+  // when no previous rule matches. Only the action of this rule can be modified
+  // by the user.
+  int32 priority = 1;
+
+  // The action to take on matched requests.
+  Action action = 2;
+
+  // IP address or range, defined using CIDR notation, of requests that this
+  // rule applies to. You can use the wildcard character "*" to match all IPs
+  // equivalent to "0/0" and "::/0" together.
+  // Examples: `192.168.1.1` or `192.168.0.0/16` or `2001:db8::/32`
+  //           or `2001:0db8:0000:0042:0000:8a2e:0370:7334`.
+  //
+  //
+  // <p>Truncation will be silently performed on addresses which are not
+  // properly truncated. For example, `1.2.3.4/24` is accepted as the same
+  // address as `1.2.3.0/24`. Similarly, for IPv6, `2001:db8::1/32` is accepted
+  // as the same address as `2001:db8::/32`.
+  string source_range = 3;
+
+  // An optional string description of this rule.
+  // This field has a maximum length of 100 characters.
+  string description = 4;
+}
diff --git a/third_party/googleapis/google/appengine/v1/instance.proto b/third_party/googleapis/google/appengine/v1/instance.proto
new file mode 100644
index 0000000..59b2e5c
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/instance.proto
@@ -0,0 +1,143 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "InstanceProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// An Instance resource is the computing unit that App Engine uses to
+// automatically scale an application.
+message Instance {
+  option (google.api.resource) = {
+    type: "appengine.googleapis.com/Instance"
+    pattern: "apps/{app}/services/{service}/versions/{version}/instances/{instance}"
+  };
+
+  // Availability of the instance.
+  enum Availability {
+    UNSPECIFIED = 0;
+
+    RESIDENT = 1;
+
+    DYNAMIC = 2;
+  }
+
+  // Wrapper for LivenessState enum.
+  message Liveness {
+    // Liveness health check status for Flex instances.
+    enum LivenessState {
+      // There is no liveness health check for the instance. Only applicable for
+      // instances in App Engine standard environment.
+      LIVENESS_STATE_UNSPECIFIED = 0;
+
+      // The health checking system is aware of the instance but its health is
+      // not known at the moment.
+      UNKNOWN = 1;
+
+      // The instance is reachable i.e. a connection to the application health
+      // checking endpoint can be established, and conforms to the requirements
+      // defined by the health check.
+      HEALTHY = 2;
+
+      // The instance is reachable, but does not conform to the requirements
+      // defined by the health check.
+      UNHEALTHY = 3;
+
+      // The instance is being drained. The existing connections to the instance
+      // have time to complete, but the new ones are being refused.
+      DRAINING = 4;
+
+      // The instance is unreachable i.e. a connection to the application health
+      // checking endpoint cannot be established, or the server does not respond
+      // within the specified timeout.
+      TIMEOUT = 5;
+    }
+
+
+  }
+
+  // Output only. Full path to the Instance resource in the API.
+  // Example: `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Relative name of the instance within the version.
+  // Example: `instance-1`.
+  string id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. App Engine release this instance is running on.
+  string app_engine_release = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Availability of the instance.
+  Availability availability = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Name of the virtual machine where this instance lives. Only applicable
+  // for instances in App Engine flexible environment.
+  string vm_name = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Zone where the virtual machine is located. Only applicable for instances
+  // in App Engine flexible environment.
+  string vm_zone_name = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Virtual machine ID of this instance. Only applicable for instances in
+  // App Engine flexible environment.
+  string vm_id = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time that this instance was started.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp start_time = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Number of requests since this instance was started.
+  int32 requests = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Number of errors since this instance was started.
+  int32 errors = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Average queries per second (QPS) over the last minute.
+  float qps = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Average latency (ms) over the last minute.
+  int32 average_latency = 12 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Total memory in use (bytes).
+  int64 memory_usage = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Status of the virtual machine where this instance lives. Only applicable
+  // for instances in App Engine flexible environment.
+  string vm_status = 14 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Whether this instance is in debug mode. Only applicable for instances in
+  // App Engine flexible environment.
+  bool vm_debug_enabled = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The IP address of this instance. Only applicable for instances in App
+  // Engine flexible environment.
+  string vm_ip = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The liveness health check of this instance. Only applicable for instances
+  // in App Engine flexible environment.
+  Liveness.LivenessState vm_liveness = 17 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
diff --git a/third_party/googleapis/google/appengine/v1/location.proto b/third_party/googleapis/google/appengine/v1/location.proto
new file mode 100644
index 0000000..995a5ff
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/location.proto
@@ -0,0 +1,44 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/api/field_behavior.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "LocationProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// Metadata for the given [google.cloud.location.Location][google.cloud.location.Location].
+message LocationMetadata {
+  // App Engine standard environment is available in the given location.
+  //
+  // @OutputOnly
+  bool standard_environment_available = 2;
+
+  // App Engine flexible environment is available in the given location.
+  //
+  // @OutputOnly
+  bool flexible_environment_available = 4;
+
+  // Output only. [Search API](https://cloud.google.com/appengine/docs/standard/python/search)
+  // is available in the given location.
+  bool search_api_available = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
diff --git a/third_party/googleapis/google/appengine/v1/network_settings.proto b/third_party/googleapis/google/appengine/v1/network_settings.proto
new file mode 100644
index 0000000..2645e8c
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/network_settings.proto
@@ -0,0 +1,47 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "NetworkSettingsProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A NetworkSettings resource is a container for ingress settings for a version
+// or service.
+message NetworkSettings {
+  // If unspecified, INGRESS_TRAFFIC_ALLOWED_ALL will be used.
+  enum IngressTrafficAllowed {
+    // Unspecified
+    INGRESS_TRAFFIC_ALLOWED_UNSPECIFIED = 0;
+
+    // Allow HTTP traffic from public and private sources.
+    INGRESS_TRAFFIC_ALLOWED_ALL = 1;
+
+    // Allow HTTP traffic from only private VPC sources.
+    INGRESS_TRAFFIC_ALLOWED_INTERNAL_ONLY = 2;
+
+    // Allow HTTP traffic from private VPC sources and through load balancers.
+    INGRESS_TRAFFIC_ALLOWED_INTERNAL_AND_LB = 3;
+  }
+
+  // The ingress settings for version or service.
+  IngressTrafficAllowed ingress_traffic_allowed = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1/operation.proto b/third_party/googleapis/google/appengine/v1/operation.proto
new file mode 100644
index 0000000..a2636cb
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/operation.proto
@@ -0,0 +1,79 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "OperationProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// Metadata for the given [google.longrunning.Operation][google.longrunning.Operation].
+message OperationMetadataV1 {
+  // API method that initiated this operation. Example:
+  // `google.appengine.v1.Versions.CreateVersion`.
+  //
+  // @OutputOnly
+  string method = 1;
+
+  // Time that this operation was created.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp insert_time = 2;
+
+  // Time that this operation completed.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp end_time = 3;
+
+  // User who requested this operation.
+  //
+  // @OutputOnly
+  string user = 4;
+
+  // Name of the resource that this operation is acting on. Example:
+  // `apps/myapp/services/default`.
+  //
+  // @OutputOnly
+  string target = 5;
+
+  // Ephemeral message that may change every time the operation is polled.
+  // @OutputOnly
+  string ephemeral_message = 6;
+
+  // Durable messages that persist on every operation poll.
+  // @OutputOnly
+  repeated string warning = 7;
+
+  // Metadata specific to the type of operation in progress.
+  // @OutputOnly
+  oneof method_metadata {
+    CreateVersionMetadataV1 create_version_metadata = 8;
+  }
+}
+
+// Metadata for the given [google.longrunning.Operation][google.longrunning.Operation] during a
+// [google.appengine.v1.CreateVersionRequest][google.appengine.v1.CreateVersionRequest].
+message CreateVersionMetadataV1 {
+  // The Cloud Build ID if one was created as part of the version create.
+  // @OutputOnly
+  string cloud_build_id = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1/service.proto b/third_party/googleapis/google/appengine/v1/service.proto
new file mode 100644
index 0000000..b3ed6de
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/service.proto
@@ -0,0 +1,106 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/appengine/v1/network_settings.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "ServiceProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A Service resource is a logical component of an application that can share
+// state and communicate in a secure fashion with other services.
+// For example, an application that handles customer requests might
+// include separate services to handle tasks such as backend data
+// analysis or API requests from mobile devices. Each service has a
+// collection of versions that define a specific set of code used to
+// implement the functionality of that service.
+message Service {
+  // Full path to the Service resource in the API.
+  // Example: `apps/myapp/services/default`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the service within the application.
+  // Example: `default`.
+  //
+  // @OutputOnly
+  string id = 2;
+
+  // Mapping that defines fractional HTTP traffic diversion to
+  // different versions within the service.
+  TrafficSplit split = 3;
+
+  // A set of labels to apply to this service. Labels are key/value pairs that
+  // describe the service and all resources that belong to it (e.g.,
+  // versions). The labels can be used to search and group resources, and are
+  // propagated to the usage and billing reports, enabling fine-grain analysis
+  // of costs. An example of using labels is to tag resources belonging to
+  // different environments (e.g., "env=prod", "env=qa").
+  //
+  // <p>Label keys and values can be no longer than 63 characters and can only
+  // contain lowercase letters, numeric characters, underscores, dashes, and
+  // international characters. Label keys must start with a lowercase letter
+  // or an international character. Each service can have at most 32 labels.
+  map<string, string> labels = 4;
+
+  // Ingress settings for this service. Will apply to all versions.
+  NetworkSettings network_settings = 6;
+}
+
+// Traffic routing configuration for versions within a single service. Traffic
+// splits define how traffic directed to the service is assigned to versions.
+message TrafficSplit {
+  // Available sharding mechanisms.
+  enum ShardBy {
+    // Diversion method unspecified.
+    UNSPECIFIED = 0;
+
+    // Diversion based on a specially named cookie, "GOOGAPPUID." The cookie
+    // must be set by the application itself or no diversion will occur.
+    COOKIE = 1;
+
+    // Diversion based on applying the modulus operation to a fingerprint
+    // of the IP address.
+    IP = 2;
+
+    // Diversion based on weighted random assignment. An incoming request is
+    // randomly routed to a version in the traffic split, with probability
+    // proportional to the version's traffic share.
+    RANDOM = 3;
+  }
+
+  // Mechanism used to determine which version a request is sent to.
+  // The traffic selection algorithm will
+  // be stable for either type until allocations are changed.
+  ShardBy shard_by = 1;
+
+  // Mapping from version IDs within the service to fractional
+  // (0.000, 1] allocations of traffic for that version. Each version can
+  // be specified only once, but some versions in the service may not
+  // have any traffic allocation. Services that have traffic allocated
+  // cannot be deleted until either the service is deleted or
+  // their traffic allocation is removed. Allocations must sum to 1.
+  // Up to two decimal place precision is supported for IP-based splits and
+  // up to three decimal places is supported for cookie-based splits.
+  map<string, double> allocations = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1/version.proto b/third_party/googleapis/google/appengine/v1/version.proto
new file mode 100644
index 0000000..2caab51
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1/version.proto
@@ -0,0 +1,594 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1;
+
+import "google/appengine/v1/app_yaml.proto";
+import "google/appengine/v1/deploy.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "VersionProto";
+option java_package = "com.google.appengine.v1";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1";
+option ruby_package = "Google::Cloud::AppEngine::V1";
+
+// A Version resource is a specific set of source code and configuration files
+// that are deployed into a service.
+message Version {
+  // Full path to the Version resource in the API.  Example:
+  // `apps/myapp/services/default/versions/v1`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the version within the service.  Example: `v1`.
+  // Version names can contain only lowercase letters, numbers, or hyphens.
+  // Reserved names: "default", "latest", and any name with the prefix "ah-".
+  string id = 2;
+
+  // Controls how instances are created, scaled, and reaped.
+  //
+  // Defaults to `AutomaticScaling`.
+  oneof scaling {
+    // Automatic scaling is based on request rate, response latencies, and other
+    // application metrics. Instances are dynamically created and destroyed as
+    // needed in order to handle traffic.
+    AutomaticScaling automatic_scaling = 3;
+
+    // A service with basic scaling will create an instance when the application
+    // receives a request. The instance will be turned down when the app becomes
+    // idle. Basic scaling is ideal for work that is intermittent or driven by
+    // user activity.
+    BasicScaling basic_scaling = 4;
+
+    // A service with manual scaling runs continuously, allowing you to perform
+    // complex initialization and rely on the state of its memory over time.
+    // Manually scaled versions are sometimes referred to as "backends".
+    ManualScaling manual_scaling = 5;
+  }
+
+  // Before an application can receive email or XMPP messages, the application
+  // must be configured to enable the service.
+  repeated InboundServiceType inbound_services = 6;
+
+  // Instance class that is used to run this version. Valid values are:
+  //
+  // * AutomaticScaling: `F1`, `F2`, `F4`, `F4_1G`
+  // * ManualScaling or BasicScaling: `B1`, `B2`, `B4`, `B8`, `B4_1G`
+  //
+  // Defaults to `F1` for AutomaticScaling and `B1` for ManualScaling or
+  // BasicScaling.
+  string instance_class = 7;
+
+  // Extra network settings.
+  // Only applicable in the App Engine flexible environment.
+  Network network = 8;
+
+  // The Google Compute Engine zones that are supported by this version in the
+  // App Engine flexible environment. Deprecated.
+  repeated string zones = 118;
+
+  // Machine resources for this version.
+  // Only applicable in the App Engine flexible environment.
+  Resources resources = 9;
+
+  // Desired runtime. Example: `python27`.
+  string runtime = 10;
+
+  // The channel of the runtime to use. Only available for some
+  // runtimes. Defaults to the `default` channel.
+  string runtime_channel = 117;
+
+  // Whether multiple requests can be dispatched to this version at once.
+  bool threadsafe = 11;
+
+  // Whether to deploy this version in a container on a virtual machine.
+  bool vm = 12;
+
+  // Allows App Engine second generation runtimes to access the legacy bundled
+  // services.
+  bool app_engine_apis = 128;
+
+  // Metadata settings that are supplied to this version to enable
+  // beta runtime features.
+  map<string, string> beta_settings = 13;
+
+  // App Engine execution environment for this version.
+  //
+  // Defaults to `standard`.
+  string env = 14;
+
+  // Current serving status of this version. Only the versions with a
+  // `SERVING` status create instances and can be billed.
+  //
+  // `SERVING_STATUS_UNSPECIFIED` is an invalid value. Defaults to `SERVING`.
+  ServingStatus serving_status = 15;
+
+  // Email address of the user who created this version.
+  //
+  // @OutputOnly
+  string created_by = 16;
+
+  // Time that this version was created.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp create_time = 17;
+
+  // Total size in bytes of all the files that are included in this version
+  // and currently hosted on the App Engine disk.
+  //
+  // @OutputOnly
+  int64 disk_usage_bytes = 18;
+
+  // The version of the API in the given runtime environment. Please see the
+  // app.yaml reference for valid values at
+  // https://cloud.google.com/appengine/docs/standard/<language>/config/appref
+  string runtime_api_version = 21;
+
+  // The path or name of the app's main executable.
+  string runtime_main_executable_path = 22;
+
+  // The identity that the deployed version will run as.
+  // Admin API will use the App Engine Appspot service account as default if
+  // this field is neither provided in app.yaml file nor through CLI flag.
+  string service_account = 127;
+
+  // An ordered list of URL-matching patterns that should be applied to incoming
+  // requests. The first matching URL handles the request and other request
+  // handlers are not attempted.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated UrlMap handlers = 100;
+
+  // Custom static error pages. Limited to 10KB per page.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated ErrorHandler error_handlers = 101;
+
+  // Configuration for third-party Python runtime libraries that are required
+  // by the application.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated Library libraries = 102;
+
+  // Serving configuration for
+  // [Google Cloud Endpoints](https://cloud.google.com/appengine/docs/python/endpoints/).
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  ApiConfigHandler api_config = 103;
+
+  // Environment variables available to the application.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  map<string, string> env_variables = 104;
+
+  // Environment variables available to the build environment.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  map<string, string> build_env_variables = 125;
+
+  // Duration that static files should be cached by web proxies and browsers.
+  // Only applicable if the corresponding
+  // [StaticFilesHandler](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions#StaticFilesHandler)
+  // does not specify its own expiration time.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  google.protobuf.Duration default_expiration = 105;
+
+  // Configures health checking for instances. Unhealthy instances are
+  // stopped and replaced with new instances.
+  // Only applicable in the App Engine flexible environment.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  HealthCheck health_check = 106;
+
+  // Configures readiness health checking for instances.
+  // Unhealthy instances are not put into the backend traffic rotation.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  ReadinessCheck readiness_check = 112;
+
+  // Configures liveness health checking for instances.
+  // Unhealthy instances are stopped and replaced with new instances
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  LivenessCheck liveness_check = 113;
+
+  // Files that match this pattern will not be built into this version.
+  // Only applicable for Go runtimes.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  string nobuild_files_regex = 107;
+
+  // Code and application artifacts that make up this version.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  Deployment deployment = 108;
+
+  // Serving URL for this version. Example:
+  // "https://myversion-dot-myservice-dot-myapp.appspot.com"
+  //
+  // @OutputOnly
+  string version_url = 109;
+
+  // Cloud Endpoints configuration.
+  //
+  // If endpoints_api_service is set, the Cloud Endpoints Extensible Service
+  // Proxy will be provided to serve the API implemented by the app.
+  EndpointsApiService endpoints_api_service = 110;
+
+  // The entrypoint for the application.
+  Entrypoint entrypoint = 122;
+
+  // Enables VPC connectivity for standard apps.
+  VpcAccessConnector vpc_access_connector = 121;
+}
+
+// [Cloud Endpoints](https://cloud.google.com/endpoints) configuration.
+// The Endpoints API Service provides tooling for serving Open API and gRPC
+// endpoints via an NGINX proxy. Only valid for App Engine Flexible environment
+// deployments.
+//
+// The fields here refer to the name and configuration ID of a "service"
+// resource in the [Service Management API](https://cloud.google.com/service-management/overview).
+message EndpointsApiService {
+  // Available rollout strategies.
+  enum RolloutStrategy {
+    // Not specified. Defaults to `FIXED`.
+    UNSPECIFIED_ROLLOUT_STRATEGY = 0;
+
+    // Endpoints service configuration ID will be fixed to the configuration ID
+    // specified by `config_id`.
+    FIXED = 1;
+
+    // Endpoints service configuration ID will be updated with each rollout.
+    MANAGED = 2;
+  }
+
+  // Endpoints service name which is the name of the "service" resource in the
+  // Service Management API. For example "myapi.endpoints.myproject.cloud.goog"
+  string name = 1;
+
+  // Endpoints service configuration ID as specified by the Service Management
+  // API. For example "2016-09-19r1".
+  //
+  // By default, the rollout strategy for Endpoints is `RolloutStrategy.FIXED`.
+  // This means that Endpoints starts up with a particular configuration ID.
+  // When a new configuration is rolled out, Endpoints must be given the new
+  // configuration ID. The `config_id` field is used to give the configuration
+  // ID and is required in this case.
+  //
+  // Endpoints also has a rollout strategy called `RolloutStrategy.MANAGED`.
+  // When using this, Endpoints fetches the latest configuration and does not
+  // need the configuration ID. In this case, `config_id` must be omitted.
+  string config_id = 2;
+
+  // Endpoints rollout strategy. If `FIXED`, `config_id` must be specified. If
+  // `MANAGED`, `config_id` must be omitted.
+  RolloutStrategy rollout_strategy = 3;
+
+  // Enable or disable trace sampling. By default, this is set to false for
+  // enabled.
+  bool disable_trace_sampling = 4;
+}
+
+// Automatic scaling is based on request rate, response latencies, and other
+// application metrics.
+message AutomaticScaling {
+  // The time period that the
+  // [Autoscaler](https://cloud.google.com/compute/docs/autoscaler/)
+  // should wait before it starts collecting information from a new instance.
+  // This prevents the autoscaler from collecting information when the instance
+  // is initializing, during which the collected usage would not be reliable.
+  // Only applicable in the App Engine flexible environment.
+  google.protobuf.Duration cool_down_period = 1;
+
+  // Target scaling by CPU usage.
+  CpuUtilization cpu_utilization = 2;
+
+  // Number of concurrent requests an automatic scaling instance can accept
+  // before the scheduler spawns a new instance.
+  //
+  // Defaults to a runtime-specific value.
+  int32 max_concurrent_requests = 3;
+
+  // Maximum number of idle instances that should be maintained for this
+  // version.
+  int32 max_idle_instances = 4;
+
+  // Maximum number of instances that should be started to handle requests for
+  // this version.
+  int32 max_total_instances = 5;
+
+  // Maximum amount of time that a request should wait in the pending queue
+  // before starting a new instance to handle it.
+  google.protobuf.Duration max_pending_latency = 6;
+
+  // Minimum number of idle instances that should be maintained for
+  // this version. Only applicable for the default version of a service.
+  int32 min_idle_instances = 7;
+
+  // Minimum number of running instances that should be maintained for this
+  // version.
+  int32 min_total_instances = 8;
+
+  // Minimum amount of time a request should wait in the pending queue before
+  // starting a new instance to handle it.
+  google.protobuf.Duration min_pending_latency = 9;
+
+  // Target scaling by request utilization.
+  RequestUtilization request_utilization = 10;
+
+  // Target scaling by disk usage.
+  DiskUtilization disk_utilization = 11;
+
+  // Target scaling by network usage.
+  NetworkUtilization network_utilization = 12;
+
+  // Scheduler settings for standard environment.
+  StandardSchedulerSettings standard_scheduler_settings = 20;
+}
+
+// A service with basic scaling will create an instance when the application
+// receives a request. The instance will be turned down when the app becomes
+// idle. Basic scaling is ideal for work that is intermittent or driven by
+// user activity.
+message BasicScaling {
+  // Duration of time after the last request that an instance must wait before
+  // the instance is shut down.
+  google.protobuf.Duration idle_timeout = 1;
+
+  // Maximum number of instances to create for this version.
+  int32 max_instances = 2;
+}
+
+// A service with manual scaling runs continuously, allowing you to perform
+// complex initialization and rely on the state of its memory over time.
+message ManualScaling {
+  // Number of instances to assign to the service at the start. This number
+  // can later be altered by using the
+  // [Modules API](https://cloud.google.com/appengine/docs/python/modules/functions)
+  // `set_num_instances()` function.
+  int32 instances = 1;
+}
+
+// Target scaling by CPU usage.
+message CpuUtilization {
+  // Period of time over which CPU utilization is calculated.
+  google.protobuf.Duration aggregation_window_length = 1;
+
+  // Target CPU utilization ratio to maintain when scaling. Must be between 0
+  // and 1.
+  double target_utilization = 2;
+}
+
+// Target scaling by request utilization.
+// Only applicable in the App Engine flexible environment.
+message RequestUtilization {
+  // Target requests per second.
+  int32 target_request_count_per_second = 1;
+
+  // Target number of concurrent requests.
+  int32 target_concurrent_requests = 2;
+}
+
+// Target scaling by disk usage.
+// Only applicable in the App Engine flexible environment.
+message DiskUtilization {
+  // Target bytes written per second.
+  int32 target_write_bytes_per_second = 14;
+
+  // Target ops written per second.
+  int32 target_write_ops_per_second = 15;
+
+  // Target bytes read per second.
+  int32 target_read_bytes_per_second = 16;
+
+  // Target ops read per seconds.
+  int32 target_read_ops_per_second = 17;
+}
+
+// Target scaling by network usage.
+// Only applicable in the App Engine flexible environment.
+message NetworkUtilization {
+  // Target bytes sent per second.
+  int32 target_sent_bytes_per_second = 1;
+
+  // Target packets sent per second.
+  int32 target_sent_packets_per_second = 11;
+
+  // Target bytes received per second.
+  int32 target_received_bytes_per_second = 12;
+
+  // Target packets received per second.
+  int32 target_received_packets_per_second = 13;
+}
+
+// Scheduler settings for standard environment.
+message StandardSchedulerSettings {
+  // Target CPU utilization ratio to maintain when scaling.
+  double target_cpu_utilization = 1;
+
+  // Target throughput utilization ratio to maintain when scaling
+  double target_throughput_utilization = 2;
+
+  // Minimum number of instances to run for this version. Set to zero to disable
+  // `min_instances` configuration.
+  int32 min_instances = 3;
+
+  // Maximum number of instances to run for this version. Set to zero to disable
+  // `max_instances` configuration.
+  int32 max_instances = 4;
+}
+
+// Extra network settings.
+// Only applicable in the App Engine flexible environment.
+message Network {
+  // List of ports, or port pairs, to forward from the virtual machine to the
+  // application container.
+  // Only applicable in the App Engine flexible environment.
+  repeated string forwarded_ports = 1;
+
+  // Tag to apply to the instance during creation.
+  // Only applicable in the App Engine flexible environment.
+  string instance_tag = 2;
+
+  // Google Compute Engine network where the virtual machines are created.
+  // Specify the short name, not the resource path.
+  //
+  // Defaults to `default`.
+  string name = 3;
+
+  // Google Cloud Platform sub-network where the virtual machines are created.
+  // Specify the short name, not the resource path.
+  //
+  // If a subnetwork name is specified, a network name will also be required
+  // unless it is for the default network.
+  //
+  // * If the network that the instance is being created in is a Legacy network,
+  // then the IP address is allocated from the IPv4Range.
+  // * If the network that the instance is being created in is an auto Subnet
+  // Mode Network, then only network name should be specified (not the
+  // subnetwork_name) and the IP address is created from the IPCidrRange of the
+  // subnetwork that exists in that zone for that network.
+  // * If the network that the instance is being created in is a custom Subnet
+  // Mode Network, then the subnetwork_name must be specified and the
+  // IP address is created from the IPCidrRange of the subnetwork.
+  //
+  // If specified, the subnetwork must exist in the same region as the
+  // App Engine flexible environment application.
+  string subnetwork_name = 4;
+
+  // Enable session affinity.
+  // Only applicable in the App Engine flexible environment.
+  bool session_affinity = 5;
+}
+
+// Volumes mounted within the app container.
+// Only applicable in the App Engine flexible environment.
+message Volume {
+  // Unique name for the volume.
+  string name = 1;
+
+  // Underlying volume type, e.g. 'tmpfs'.
+  string volume_type = 2;
+
+  // Volume size in gigabytes.
+  double size_gb = 3;
+}
+
+// Machine resources for a version.
+message Resources {
+  // Number of CPU cores needed.
+  double cpu = 1;
+
+  // Disk size (GB) needed.
+  double disk_gb = 2;
+
+  // Memory (GB) needed.
+  double memory_gb = 3;
+
+  // User specified volumes.
+  repeated Volume volumes = 4;
+
+  // The name of the encryption key that is stored in Google Cloud KMS.
+  // Only should be used by Cloud Composer to encrypt the vm disk
+  string kms_key_reference = 5;
+}
+
+// Available inbound services.
+enum InboundServiceType {
+  // Not specified.
+  INBOUND_SERVICE_UNSPECIFIED = 0;
+
+  // Allows an application to receive mail.
+  INBOUND_SERVICE_MAIL = 1;
+
+  // Allows an application to receive email-bound notifications.
+  INBOUND_SERVICE_MAIL_BOUNCE = 2;
+
+  // Allows an application to receive error stanzas.
+  INBOUND_SERVICE_XMPP_ERROR = 3;
+
+  // Allows an application to receive instant messages.
+  INBOUND_SERVICE_XMPP_MESSAGE = 4;
+
+  // Allows an application to receive user subscription POSTs.
+  INBOUND_SERVICE_XMPP_SUBSCRIBE = 5;
+
+  // Allows an application to receive a user's chat presence.
+  INBOUND_SERVICE_XMPP_PRESENCE = 6;
+
+  // Registers an application for notifications when a client connects or
+  // disconnects from a channel.
+  INBOUND_SERVICE_CHANNEL_PRESENCE = 7;
+
+  // Enables warmup requests.
+  INBOUND_SERVICE_WARMUP = 9;
+}
+
+// Run states of a version.
+enum ServingStatus {
+  // Not specified.
+  SERVING_STATUS_UNSPECIFIED = 0;
+
+  // Currently serving. Instances are created according to the
+  // scaling settings of the version.
+  SERVING = 1;
+
+  // Disabled. No instances will be created and the scaling
+  // settings are ignored until the state of the version changes
+  // to `SERVING`.
+  STOPPED = 2;
+}
+
+// VPC access connector specification.
+message VpcAccessConnector {
+  // Available egress settings.
+  //
+  // This controls what traffic is diverted through the VPC Access Connector
+  // resource. By default PRIVATE_IP_RANGES will be used.
+  enum EgressSetting {
+    EGRESS_SETTING_UNSPECIFIED = 0;
+
+    // Force the use of VPC Access for all egress traffic from the function.
+    ALL_TRAFFIC = 1;
+
+    // Use the VPC Access Connector for private IP space from RFC1918.
+    PRIVATE_IP_RANGES = 2;
+  }
+
+  // Full Serverless VPC Access Connector name e.g.
+  // /projects/my-project/locations/us-central1/connectors/c1.
+  string name = 1;
+
+  // The egress setting for the connector, controlling what traffic is diverted
+  // through it.
+  EgressSetting egress_setting = 2;
+}
+
+// The entrypoint for the application.
+message Entrypoint {
+  // The command to run.
+  oneof command {
+    // The format should be a shell command that can be fed to `bash -c`.
+    string shell = 1;
+  }
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/BUILD.bazel b/third_party/googleapis/google/appengine/v1beta/BUILD.bazel
new file mode 100644
index 0000000..e79f083
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/BUILD.bazel
@@ -0,0 +1,192 @@
+# This file was automatically generated by BuildFileGenerator
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+##############################################################################
+# Common
+##############################################################################
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "appengine_proto",
+    srcs = [
+        "app_yaml.proto",
+        "appengine.proto",
+        "application.proto",
+        "audit_data.proto",
+        "certificate.proto",
+        "deploy.proto",
+        "domain.proto",
+        "domain_mapping.proto",
+        "firewall.proto",
+        "instance.proto",
+        "location.proto",
+        "network_settings.proto",
+        "operation.proto",
+        "service.proto",
+        "version.proto",
+    ],
+    deps = [
+        "//google/api:annotations_proto",
+        "//google/api:client_proto",
+        "//google/api:field_behavior_proto",
+        "//google/api:resource_proto",
+        "//google/longrunning:operations_proto",
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:empty_proto",
+        "@com_google_protobuf//:field_mask_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
+java_proto_library(
+    name = "appengine_java_proto",
+    deps = [":appengine_proto"],
+)
+
+java_grpc_library(
+    name = "appengine_java_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_java_proto"],
+)
+
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_proto_library",
+)
+
+go_proto_library(
+    name = "appengine_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "google.golang.org/genproto/googleapis/appengine/v1beta",
+    protos = [":appengine_proto"],
+    deps = [
+        "//google/api:annotations_go_proto",
+        "//google/longrunning:longrunning_go_proto",
+    ],
+)
+
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "moved_proto_library",
+    "py_grpc_library",
+    "py_proto_library",
+)
+
+moved_proto_library(
+    name = "appengine_moved_proto",
+    srcs = [":appengine_proto"],
+    deps = [
+        "//google/api:annotations_proto",
+        "//google/api:client_proto",
+        "//google/api:field_behavior_proto",
+        "//google/api:resource_proto",
+        "//google/longrunning:operations_proto",
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:empty_proto",
+        "@com_google_protobuf//:field_mask_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+py_proto_library(
+    name = "appengine_py_proto",
+    deps = [":appengine_moved_proto"],
+)
+
+py_grpc_library(
+    name = "appengine_py_grpc",
+    srcs = [":appengine_moved_proto"],
+    deps = [":appengine_py_proto"],
+)
+
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_grpc_library",
+    "php_proto_library",
+)
+
+php_proto_library(
+    name = "appengine_php_proto",
+    deps = [":appengine_proto"],
+)
+
+php_grpc_library(
+    name = "appengine_php_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_php_proto"],
+)
+
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
+
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
+ruby_proto_library(
+    name = "appengine_ruby_proto",
+    deps = [":appengine_proto"],
+)
+
+ruby_grpc_library(
+    name = "appengine_ruby_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_ruby_proto"],
+)
+
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
+csharp_proto_library(
+    name = "appengine_csharp_proto",
+    deps = [":appengine_proto"],
+)
+
+csharp_grpc_library(
+    name = "appengine_csharp_grpc",
+    srcs = [":appengine_proto"],
+    deps = [":appengine_csharp_proto"],
+)
+
+##############################################################################
+# C++
+##############################################################################
+# Put your C++ code here
diff --git a/third_party/googleapis/google/appengine/v1beta/app_yaml.proto b/third_party/googleapis/google/appengine/v1beta/app_yaml.proto
new file mode 100644
index 0000000..a18e9d5
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/app_yaml.proto
@@ -0,0 +1,348 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AppYamlProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// [Google Cloud Endpoints](https://cloud.google.com/appengine/docs/python/endpoints/)
+// configuration for API handlers.
+message ApiConfigHandler {
+  // Action to take when users access resources that require
+  // authentication. Defaults to `redirect`.
+  AuthFailAction auth_fail_action = 1;
+
+  // Level of login required to access this resource. Defaults to
+  // `optional`.
+  LoginRequirement login = 2;
+
+  // Path to the script from the application root directory.
+  string script = 3;
+
+  // Security (HTTPS) enforcement for this URL.
+  SecurityLevel security_level = 4;
+
+  // URL to serve the endpoint at.
+  string url = 5;
+}
+
+// Custom static error page to be served when an error occurs.
+message ErrorHandler {
+  // Error codes.
+  enum ErrorCode {
+    option allow_alias = true;
+
+    // Not specified. ERROR_CODE_DEFAULT is assumed.
+    ERROR_CODE_UNSPECIFIED = 0;
+
+    // All other error types.
+    ERROR_CODE_DEFAULT = 0;
+
+    // Application has exceeded a resource quota.
+    ERROR_CODE_OVER_QUOTA = 1;
+
+    // Client blocked by the application's Denial of Service protection
+    // configuration.
+    ERROR_CODE_DOS_API_DENIAL = 2;
+
+    // Deadline reached before the application responds.
+    ERROR_CODE_TIMEOUT = 3;
+  }
+
+  // Error condition this handler applies to.
+  ErrorCode error_code = 1;
+
+  // Static file content to be served for this error.
+  string static_file = 2;
+
+  // MIME type of file. Defaults to `text/html`.
+  string mime_type = 3;
+}
+
+// URL pattern and description of how the URL should be handled. App Engine can
+// handle URLs by executing application code or by serving static files
+// uploaded with the version, such as images, CSS, or JavaScript.
+message UrlMap {
+  // Redirect codes.
+  enum RedirectHttpResponseCode {
+    // Not specified. `302` is assumed.
+    REDIRECT_HTTP_RESPONSE_CODE_UNSPECIFIED = 0;
+
+    // `301 Moved Permanently` code.
+    REDIRECT_HTTP_RESPONSE_CODE_301 = 1;
+
+    // `302 Moved Temporarily` code.
+    REDIRECT_HTTP_RESPONSE_CODE_302 = 2;
+
+    // `303 See Other` code.
+    REDIRECT_HTTP_RESPONSE_CODE_303 = 3;
+
+    // `307 Temporary Redirect` code.
+    REDIRECT_HTTP_RESPONSE_CODE_307 = 4;
+  }
+
+  // URL prefix. Uses regular expression syntax, which means regexp
+  // special characters must be escaped, but should not contain groupings.
+  // All URLs that begin with this prefix are handled by this handler, using the
+  // portion of the URL after the prefix as part of the file path.
+  string url_regex = 1;
+
+  // Type of handler for this URL pattern.
+  oneof handler_type {
+    // Returns the contents of a file, such as an image, as the response.
+    StaticFilesHandler static_files = 2;
+
+    // Executes a script to handle the requests that match this URL
+    // pattern. Only the `auto` value is supported for Node.js in the
+    // App Engine standard environment, for example `"script": "auto"`.
+    ScriptHandler script = 3;
+
+    // Uses API Endpoints to handle requests.
+    ApiEndpointHandler api_endpoint = 4;
+  }
+
+  // Security (HTTPS) enforcement for this URL.
+  SecurityLevel security_level = 5;
+
+  // Level of login required to access this resource. Not supported for Node.js
+  // in the App Engine standard environment.
+  LoginRequirement login = 6;
+
+  // Action to take when users access resources that require
+  // authentication. Defaults to `redirect`.
+  AuthFailAction auth_fail_action = 7;
+
+  // `30x` code to use when performing redirects for the `secure` field.
+  // Defaults to `302`.
+  RedirectHttpResponseCode redirect_http_response_code = 8;
+}
+
+// Files served directly to the user for a given URL, such as images, CSS
+// stylesheets, or JavaScript source files. Static file handlers describe which
+// files in the application directory are static files, and which URLs serve
+// them.
+message StaticFilesHandler {
+  // Path to the static files matched by the URL pattern, from the
+  // application root directory. The path can refer to text matched in groupings
+  // in the URL pattern.
+  string path = 1;
+
+  // Regular expression that matches the file paths for all files that should be
+  // referenced by this handler.
+  string upload_path_regex = 2;
+
+  // HTTP headers to use for all responses from these URLs.
+  map<string, string> http_headers = 3;
+
+  // MIME type used to serve all files served by this handler.
+  //
+  // Defaults to file-specific MIME types, which are derived from each file's
+  // filename extension.
+  string mime_type = 4;
+
+  // Time a static file served by this handler should be cached
+  // by web proxies and browsers.
+  google.protobuf.Duration expiration = 5;
+
+  // Whether this handler should match the request if the file
+  // referenced by the handler does not exist.
+  bool require_matching_file = 6;
+
+  // Whether files should also be uploaded as code data. By default, files
+  // declared in static file handlers are uploaded as static
+  // data and are only served to end users; they cannot be read by the
+  // application. If enabled, uploads are charged against both your code and
+  // static data storage resource quotas.
+  bool application_readable = 7;
+}
+
+// Executes a script to handle the request that matches the URL pattern.
+message ScriptHandler {
+  // Path to the script from the application root directory.
+  string script_path = 1;
+}
+
+// Uses Google Cloud Endpoints to handle requests.
+message ApiEndpointHandler {
+  // Path to the script from the application root directory.
+  string script_path = 1;
+}
+
+// Health checking configuration for VM instances. Unhealthy instances
+// are killed and replaced with new instances. Only applicable for
+// instances in App Engine flexible environment.
+message HealthCheck {
+  // Whether to explicitly disable health checks for this instance.
+  bool disable_health_check = 1;
+
+  // Host header to send when performing an HTTP health check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive successful health checks required before receiving
+  // traffic.
+  uint32 healthy_threshold = 3;
+
+  // Number of consecutive failed health checks required before removing
+  // traffic.
+  uint32 unhealthy_threshold = 4;
+
+  // Number of consecutive failed health checks required before an instance is
+  // restarted.
+  uint32 restart_threshold = 5;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 6;
+
+  // Time before the health check is considered failed.
+  google.protobuf.Duration timeout = 7;
+}
+
+// Readiness checking configuration for VM instances. Unhealthy instances
+// are removed from traffic rotation.
+message ReadinessCheck {
+  // The request path.
+  string path = 1;
+
+  // Host header to send when performing a HTTP Readiness check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive failed checks required before removing
+  // traffic.
+  uint32 failure_threshold = 3;
+
+  // Number of consecutive successful checks required before receiving
+  // traffic.
+  uint32 success_threshold = 4;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 5;
+
+  // Time before the check is considered failed.
+  google.protobuf.Duration timeout = 6;
+
+  // A maximum time limit on application initialization, measured from moment
+  // the application successfully replies to a healthcheck until it is ready to
+  // serve traffic.
+  google.protobuf.Duration app_start_timeout = 7;
+}
+
+// Health checking configuration for VM instances. Unhealthy instances
+// are killed and replaced with new instances.
+message LivenessCheck {
+  // The request path.
+  string path = 1;
+
+  // Host header to send when performing a HTTP Liveness check.
+  // Example: "myapp.appspot.com"
+  string host = 2;
+
+  // Number of consecutive failed checks required before considering the
+  // VM unhealthy.
+  uint32 failure_threshold = 3;
+
+  // Number of consecutive successful checks required before considering
+  // the VM healthy.
+  uint32 success_threshold = 4;
+
+  // Interval between health checks.
+  google.protobuf.Duration check_interval = 5;
+
+  // Time before the check is considered failed.
+  google.protobuf.Duration timeout = 6;
+
+  // The initial delay before starting to execute the checks.
+  google.protobuf.Duration initial_delay = 7;
+}
+
+// Third-party Python runtime library that is required by the application.
+message Library {
+  // Name of the library. Example: "django".
+  string name = 1;
+
+  // Version of the library to select, or "latest".
+  string version = 2;
+}
+
+// Actions to take when the user is not logged in.
+enum AuthFailAction {
+  // Not specified. `AUTH_FAIL_ACTION_REDIRECT` is assumed.
+  AUTH_FAIL_ACTION_UNSPECIFIED = 0;
+
+  // Redirects user to "accounts.google.com". The user is redirected back to the
+  // application URL after signing in or creating an account.
+  AUTH_FAIL_ACTION_REDIRECT = 1;
+
+  // Rejects request with a `401` HTTP status code and an error
+  // message.
+  AUTH_FAIL_ACTION_UNAUTHORIZED = 2;
+}
+
+// Methods to restrict access to a URL based on login status.
+enum LoginRequirement {
+  // Not specified. `LOGIN_OPTIONAL` is assumed.
+  LOGIN_UNSPECIFIED = 0;
+
+  // Does not require that the user is signed in.
+  LOGIN_OPTIONAL = 1;
+
+  // If the user is not signed in, the `auth_fail_action` is taken.
+  // In addition, if the user is not an administrator for the
+  // application, they are given an error message regardless of
+  // `auth_fail_action`. If the user is an administrator, the handler
+  // proceeds.
+  LOGIN_ADMIN = 2;
+
+  // If the user has signed in, the handler proceeds normally. Otherwise, the
+  // auth_fail_action is taken.
+  LOGIN_REQUIRED = 3;
+}
+
+// Methods to enforce security (HTTPS) on a URL.
+enum SecurityLevel {
+  option allow_alias = true;
+
+  // Not specified.
+  SECURE_UNSPECIFIED = 0;
+
+  // Both HTTP and HTTPS requests with URLs that match the handler succeed
+  // without redirects. The application can examine the request to determine
+  // which protocol was used, and respond accordingly.
+  SECURE_DEFAULT = 0;
+
+  // Requests for a URL that match this handler that use HTTPS are automatically
+  // redirected to the HTTP equivalent URL.
+  SECURE_NEVER = 1;
+
+  // Both HTTP and HTTPS requests with URLs that match the handler succeed
+  // without redirects. The application can examine the request to determine
+  // which protocol was used and respond accordingly.
+  SECURE_OPTIONAL = 2;
+
+  // Requests for a URL that match this handler that do not use HTTPS are
+  // automatically redirected to the HTTPS URL with the same path. Query
+  // parameters are reserved for the redirect.
+  SECURE_ALWAYS = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/appengine.proto b/third_party/googleapis/google/appengine/v1beta/appengine.proto
new file mode 100644
index 0000000..9b26dab
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/appengine.proto
@@ -0,0 +1,1006 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/appengine/v1beta/application.proto";
+import "google/appengine/v1beta/certificate.proto";
+import "google/appengine/v1beta/domain.proto";
+import "google/appengine/v1beta/domain_mapping.proto";
+import "google/appengine/v1beta/firewall.proto";
+import "google/appengine/v1beta/instance.proto";
+import "google/appengine/v1beta/version.proto";
+import "google/appengine/v1beta/service.proto";
+import "google/api/annotations.proto";
+import "google/longrunning/operations.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/api/client.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AppengineProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// Manages App Engine applications.
+service Applications {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Gets information about an application.
+  rpc GetApplication(GetApplicationRequest) returns (Application) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*}"
+    };
+  }
+
+  // Creates an App Engine application for a Google Cloud Platform project.
+  // Required fields:
+  //
+  // * `id` - The ID of the target Cloud Platform project.
+  // * *location* - The [region](https://cloud.google.com/appengine/docs/locations) where you want the App Engine application located.
+  //
+  // For more information about App Engine applications, see [Managing Projects, Applications, and Billing](https://cloud.google.com/appengine/docs/standard/python/console/).
+  rpc CreateApplication(CreateApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1beta/apps"
+      body: "application"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Updates the specified Application resource.
+  // You can update the following fields:
+  //
+  // * `auth_domain` - Google authentication domain for controlling user access to the application.
+  // * `default_cookie_expiration` - Cookie expiration policy for the application.
+  rpc UpdateApplication(UpdateApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*}"
+      body: "application"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Recreates the required App Engine features for the specified App Engine
+  // application, for example a Cloud Storage bucket or App Engine service
+  // account.
+  // Use this method if you receive an error message about a missing feature,
+  // for example, *Error retrieving the App Engine service account*.
+  // If you have deleted your App Engine service account, this will
+  // not be able to recreate it. Instead, you should attempt to use the
+  // IAM undelete API if possible at https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/undelete?apix_params=%7B"name"%3A"projects%2F-%2FserviceAccounts%2Funique_id"%2C"resource"%3A%7B%7D%7D .
+  // If the deletion was recent, the numeric ID can be found in the Cloud
+  // Console Activity Log.
+  rpc RepairApplication(RepairApplicationRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1beta/{name=apps/*}:repair"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Application"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+}
+
+// Request message for `Applications.GetApplication`.
+message GetApplicationRequest {
+  // Name of the Application resource to get. Example: `apps/myapp`.
+  string name = 1;
+}
+
+// Request message for `Applications.CreateApplication`.
+message CreateApplicationRequest {
+  // Application configuration.
+  Application application = 2;
+}
+
+// Request message for `Applications.UpdateApplication`.
+message UpdateApplicationRequest {
+  // Name of the Application resource to update. Example: `apps/myapp`.
+  string name = 1;
+
+  // An Application containing the updated resource.
+  Application application = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for 'Applications.RepairApplication'.
+message RepairApplicationRequest {
+  // Name of the application to repair. Example: `apps/myapp`
+  string name = 1;
+}
+
+// Manages services of an application.
+service Services {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all the services in the application.
+  rpc ListServices(ListServicesRequest) returns (ListServicesResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*}/services"
+    };
+  }
+
+  // Gets the current configuration of the specified service.
+  rpc GetService(GetServiceRequest) returns (Service) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/services/*}"
+    };
+  }
+
+  // Updates the configuration of the specified service.
+  rpc UpdateService(UpdateServiceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*/services/*}"
+      body: "service"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Service"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Deletes the specified service and all enclosed versions.
+  rpc DeleteService(DeleteServiceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/services/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+}
+
+// Request message for `Services.ListServices`.
+message ListServicesRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `Services.ListServices`.
+message ListServicesResponse {
+  // The services belonging to the requested application.
+  repeated Service services = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Services.GetService`.
+message GetServiceRequest {
+  // Name of the resource requested. Example: `apps/myapp/services/default`.
+  string name = 1;
+}
+
+// Request message for `Services.UpdateService`.
+message UpdateServiceRequest {
+  // Name of the resource to update. Example: `apps/myapp/services/default`.
+  string name = 1;
+
+  // A Service resource containing the updated service. Only fields set in the
+  // field mask will be updated.
+  Service service = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+
+  // Set to `true` to gradually shift traffic to one or more versions that you
+  // specify. By default, traffic is shifted immediately.
+  // For gradual traffic migration, the target versions
+  // must be located within instances that are configured for both
+  // [warmup requests](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#InboundServiceType)
+  // and
+  // [automatic scaling](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#AutomaticScaling).
+  // You must specify the
+  // [`shardBy`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services#ShardBy)
+  // field in the Service resource. Gradual traffic migration is not
+  // supported in the App Engine flexible environment. For examples, see
+  // [Migrating and Splitting Traffic](https://cloud.google.com/appengine/docs/admin-api/migrating-splitting-traffic).
+  bool migrate_traffic = 4;
+}
+
+// Request message for `Services.DeleteService`.
+message DeleteServiceRequest {
+  // Name of the resource requested. Example: `apps/myapp/services/default`.
+  string name = 1;
+}
+
+// Manages versions of a service.
+service Versions {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the versions of a service.
+  rpc ListVersions(ListVersionsRequest) returns (ListVersionsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*/services/*}/versions"
+    };
+  }
+
+  // Gets the specified Version resource.
+  // By default, only a `BASIC_VIEW` will be returned.
+  // Specify the `FULL_VIEW` parameter to get the full resource.
+  rpc GetVersion(GetVersionRequest) returns (Version) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/services/*/versions/*}"
+    };
+  }
+
+  // Deploys code and resource files to a new version.
+  rpc CreateVersion(CreateVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1beta/{parent=apps/*/services/*}/versions"
+      body: "version"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Version"
+      metadata_type: "CreateVersionMetadataV1Beta"
+    };
+  }
+
+  // Updates the specified Version resource.
+  // You can specify the following fields depending on the App Engine
+  // environment and type of scaling that the version resource uses:
+  //
+  // **Standard environment**
+  //
+  // * [`instance_class`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.instance_class)
+  //
+  // *automatic scaling* in the standard environment:
+  //
+  // * [`automatic_scaling.min_idle_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.max_idle_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automaticScaling.standard_scheduler_settings.max_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.min_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.target_cpu_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#StandardSchedulerSettings)
+  // * [`automaticScaling.standard_scheduler_settings.target_throughput_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#StandardSchedulerSettings)
+  //
+  // *basic scaling* or *manual scaling* in the standard environment:
+  //
+  // * [`serving_status`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.serving_status)
+  // * [`manual_scaling.instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#manualscaling)
+  //
+  // **Flexible environment**
+  //
+  // * [`serving_status`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.serving_status)
+  //
+  // *automatic scaling* in the flexible environment:
+  //
+  // * [`automatic_scaling.min_total_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.max_total_instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.cool_down_period_sec`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  // * [`automatic_scaling.cpu_utilization.target_utilization`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#Version.FIELDS.automatic_scaling)
+  //
+  // *manual scaling* in the flexible environment:
+  //
+  // * [`manual_scaling.instances`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#manualscaling)
+  rpc UpdateVersion(UpdateVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*/services/*/versions/*}"
+      body: "version"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Version"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Deletes an existing Version resource.
+  rpc DeleteVersion(DeleteVersionRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/services/*/versions/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+}
+
+// Request message for `Versions.ListVersions`.
+message ListVersionsRequest {
+  // Name of the parent Service resource. Example:
+  // `apps/myapp/services/default`.
+  string parent = 1;
+
+  // Controls the set of fields returned in the `List` response.
+  VersionView view = 2;
+
+  // Maximum results to return per page.
+  int32 page_size = 3;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 4;
+}
+
+// Response message for `Versions.ListVersions`.
+message ListVersionsResponse {
+  // The versions belonging to the requested service.
+  repeated Version versions = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Versions.GetVersion`.
+message GetVersionRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string name = 1;
+
+  // Controls the set of fields returned in the `Get` response.
+  VersionView view = 2;
+}
+
+// Request message for `Versions.CreateVersion`.
+message CreateVersionRequest {
+  // Name of the parent resource to create this version under. Example:
+  // `apps/myapp/services/default`.
+  string parent = 1;
+
+  // Application deployment configuration.
+  Version version = 2;
+}
+
+// Request message for `Versions.UpdateVersion`.
+message UpdateVersionRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/services/default/versions/1`.
+  string name = 1;
+
+  // A Version containing the updated resource. Only fields set in the field
+  // mask will be updated.
+  Version version = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Fields that should be returned when [Version][google.appengine.v1beta.Version] resources
+// are retrieved.
+enum VersionView {
+  // Basic version information including scaling and inbound services,
+  // but not detailed deployment information.
+  BASIC = 0;
+
+  // The information from `BASIC`, plus detailed information about the
+  // deployment. This format is required when creating resources, but
+  // is not returned in `Get` or `List` by default.
+  FULL = 1;
+}
+
+// Request message for `Versions.DeleteVersion`.
+message DeleteVersionRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string name = 1;
+}
+
+// Request message for `Instances.ListInstances`.
+message ListInstancesRequest {
+  // Name of the parent Version resource. Example:
+  // `apps/myapp/services/default/versions/v1`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `Instances.ListInstances`.
+message ListInstancesResponse {
+  // The instances belonging to the requested version.
+  repeated Instance instances = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Instances.GetInstance`.
+message GetInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+}
+
+// Request message for `Instances.DeleteInstance`.
+message DeleteInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+}
+
+// Request message for `Instances.DebugInstance`.
+message DebugInstanceRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1;
+
+  // Public SSH key to add to the instance. Examples:
+  //
+  // * `[USERNAME]:ssh-rsa [KEY_VALUE] [USERNAME]`
+  // * `[USERNAME]:ssh-rsa [KEY_VALUE] google-ssh {"userName":"[USERNAME]","expireOn":"[EXPIRE_TIME]"}`
+  //
+  // For more information, see
+  // [Adding and Removing SSH Keys](https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys).
+  string ssh_key = 2;
+}
+
+// Request message for `Firewall.ListIngressRules`.
+message ListIngressRulesRequest {
+  // Name of the Firewall collection to retrieve.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+
+  // A valid IP Address. If set, only rules matching this address will be
+  // returned. The first returned rule will be the rule that fires on requests
+  // from this IP.
+  string matching_address = 4;
+}
+
+// Manages instances of a version.
+service Instances {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the instances of a version.
+  //
+  // Tip: To aggregate details about instances over time, see the
+  // [Stackdriver Monitoring API](https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list).
+  rpc ListInstances(ListInstancesRequest) returns (ListInstancesResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*/services/*/versions/*}/instances"
+    };
+  }
+
+  // Gets instance information.
+  rpc GetInstance(GetInstanceRequest) returns (Instance) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/services/*/versions/*/instances/*}"
+    };
+  }
+
+  // Stops a running instance.
+  //
+  // The instance might be automatically recreated based on the scaling settings
+  // of the version. For more information, see "How Instances are Managed"
+  // ([standard environment](https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed) |
+  // [flexible environment](https://cloud.google.com/appengine/docs/flexible/python/how-instances-are-managed)).
+  //
+  // To ensure that instances are not re-created and avoid getting billed, you
+  // can stop all instances within the target version by changing the serving
+  // status of the version to `STOPPED` with the
+  // [`apps.services.versions.patch`](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.services.versions/patch)
+  // method.
+  rpc DeleteInstance(DeleteInstanceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/services/*/versions/*/instances/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Enables debugging on a VM instance. This allows you to use the SSH
+  // command to connect to the virtual machine where the instance lives.
+  // While in "debug mode", the instance continues to serve live traffic.
+  // You should delete the instance when you are done debugging and then
+  // allow the system to take over and determine if another instance
+  // should be started.
+  //
+  // Only applicable for instances in App Engine flexible environment.
+  rpc DebugInstance(DebugInstanceRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1beta/{name=apps/*/services/*/versions/*/instances/*}:debug"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "Instance"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+}
+
+// Response message for `Firewall.ListIngressRules`.
+message ListIngressRulesResponse {
+  // The ingress FirewallRules for this application.
+  repeated FirewallRule ingress_rules = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `Firewall.BatchUpdateIngressRules`.
+message BatchUpdateIngressRulesRequest {
+  // Name of the Firewall collection to set.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string name = 1;
+
+  // A list of FirewallRules to replace the existing set.
+  repeated FirewallRule ingress_rules = 2;
+}
+
+// Response message for `Firewall.UpdateAllIngressRules`.
+message BatchUpdateIngressRulesResponse {
+  // The full list of ingress FirewallRules for this application.
+  repeated FirewallRule ingress_rules = 1;
+}
+
+// Request message for `Firewall.CreateIngressRule`.
+message CreateIngressRuleRequest {
+  // Name of the parent Firewall collection in which to create a new rule.
+  // Example: `apps/myapp/firewall/ingressRules`.
+  string parent = 1;
+
+  // A FirewallRule containing the new resource.
+  //
+  // The user may optionally provide a position at which the new rule will be
+  // placed. The positions define a sequential list starting at 1. If a rule
+  // already exists at the given position, rules greater than the provided
+  // position will be moved forward by one.
+  //
+  // If no position is provided, the server will place the rule as the second to
+  // last rule in the sequence before the required default allow-all or deny-all
+  // rule.
+  FirewallRule rule = 2;
+}
+
+// Request message for `Firewall.GetIngressRule`.
+message GetIngressRuleRequest {
+  // Name of the Firewall resource to retrieve.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+}
+
+// Request message for `Firewall.UpdateIngressRule`.
+message UpdateIngressRuleRequest {
+  // Name of the Firewall resource to update.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+
+  // A FirewallRule containing the updated resource
+  FirewallRule rule = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `Firewall.DeleteIngressRule`.
+message DeleteIngressRuleRequest {
+  // Name of the Firewall resource to delete.
+  // Example: `apps/myapp/firewall/ingressRules/100`.
+  string name = 1;
+}
+
+// Request message for `AuthorizedDomains.ListAuthorizedDomains`.
+message ListAuthorizedDomainsRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `AuthorizedDomains.ListAuthorizedDomains`.
+message ListAuthorizedDomainsResponse {
+  // The authorized domains belonging to the user.
+  repeated AuthorizedDomain domains = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `AuthorizedCertificates.ListAuthorizedCertificates`.
+message ListAuthorizedCertificatesRequest {
+  // Name of the parent `Application` resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Controls the set of fields returned in the `LIST` response.
+  AuthorizedCertificateView view = 4;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `AuthorizedCertificates.ListAuthorizedCertificates`.
+message ListAuthorizedCertificatesResponse {
+  // The SSL certificates the user is authorized to administer.
+  repeated AuthorizedCertificate certificates = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Firewall resources are used to define a collection of access control rules
+// for an Application. Each rule is defined with a position which specifies
+// the rule's order in the sequence of rules, an IP range to be matched against
+// requests, and an action to take upon matching requests.
+//
+// Every request is evaluated against the Firewall rules in priority order.
+// Processesing stops at the first rule which matches the request's IP address.
+// A final rule always specifies an action that applies to all remaining
+// IP addresses. The default final rule for a newly-created application will be
+// set to "allow" if not otherwise specified by the user.
+service Firewall {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the firewall rules of an application.
+  rpc ListIngressRules(ListIngressRulesRequest) returns (ListIngressRulesResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*}/firewall/ingressRules"
+    };
+  }
+
+  // Replaces the entire firewall ruleset in one bulk operation. This overrides
+  // and replaces the rules of an existing firewall with the new rules.
+  //
+  // If the final rule does not match traffic with the '*' wildcard IP range,
+  // then an "allow all" rule is explicitly added to the end of the list.
+  rpc BatchUpdateIngressRules(BatchUpdateIngressRulesRequest) returns (BatchUpdateIngressRulesResponse) {
+    option (google.api.http) = {
+      post: "/v1beta/{name=apps/*/firewall/ingressRules}:batchUpdate"
+      body: "*"
+    };
+  }
+
+  // Creates a firewall rule for the application.
+  rpc CreateIngressRule(CreateIngressRuleRequest) returns (FirewallRule) {
+    option (google.api.http) = {
+      post: "/v1beta/{parent=apps/*}/firewall/ingressRules"
+      body: "rule"
+    };
+  }
+
+  // Gets the specified firewall rule.
+  rpc GetIngressRule(GetIngressRuleRequest) returns (FirewallRule) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/firewall/ingressRules/*}"
+    };
+  }
+
+  // Updates the specified firewall rule.
+  rpc UpdateIngressRule(UpdateIngressRuleRequest) returns (FirewallRule) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*/firewall/ingressRules/*}"
+      body: "rule"
+    };
+  }
+
+  // Deletes the specified firewall rule.
+  rpc DeleteIngressRule(DeleteIngressRuleRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/firewall/ingressRules/*}"
+    };
+  }
+}
+
+// Request message for `AuthorizedCertificates.GetAuthorizedCertificate`.
+message GetAuthorizedCertificateRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+
+  // Controls the set of fields returned in the `GET` response.
+  AuthorizedCertificateView view = 2;
+}
+
+// Request message for `AuthorizedCertificates.CreateAuthorizedCertificate`.
+message CreateAuthorizedCertificateRequest {
+  // Name of the parent `Application` resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // SSL certificate data.
+  AuthorizedCertificate certificate = 2;
+}
+
+// Request message for `AuthorizedCertificates.UpdateAuthorizedCertificate`.
+message UpdateAuthorizedCertificateRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+
+  // An `AuthorizedCertificate` containing the updated resource. Only fields set
+  // in the field mask will be updated.
+  AuthorizedCertificate certificate = 2;
+
+  // Standard field mask for the set of fields to be updated. Updates are only
+  // supported on the `certificate_raw_data` and `display_name` fields.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `AuthorizedCertificates.DeleteAuthorizedCertificate`.
+message DeleteAuthorizedCertificateRequest {
+  // Name of the resource to delete. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  string name = 1;
+}
+
+// Request message for `DomainMappings.ListDomainMappings`.
+message ListDomainMappingsRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Maximum results to return per page.
+  int32 page_size = 2;
+
+  // Continuation token for fetching the next page of results.
+  string page_token = 3;
+}
+
+// Response message for `DomainMappings.ListDomainMappings`.
+message ListDomainMappingsResponse {
+  // The domain mappings for the application.
+  repeated DomainMapping domain_mappings = 1;
+
+  // Continuation token for fetching the next page of results.
+  string next_page_token = 2;
+}
+
+// Request message for `DomainMappings.GetDomainMapping`.
+message GetDomainMappingRequest {
+  // Name of the resource requested. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+}
+
+// Request message for `DomainMappings.CreateDomainMapping`.
+message CreateDomainMappingRequest {
+  // Name of the parent Application resource. Example: `apps/myapp`.
+  string parent = 1;
+
+  // Domain mapping configuration.
+  DomainMapping domain_mapping = 2;
+
+  // Whether the domain creation should override any existing mappings for this
+  // domain. By default, overrides are rejected.
+  DomainOverrideStrategy override_strategy = 4;
+}
+
+// Manages domains a user is authorized to administer. To authorize use of a
+// domain, verify ownership via
+// [Webmaster Central](https://www.google.com/webmasters/verification/home).
+service AuthorizedDomains {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all domains the user is authorized to administer.
+  rpc ListAuthorizedDomains(ListAuthorizedDomainsRequest) returns (ListAuthorizedDomainsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*}/authorizedDomains"
+    };
+  }
+}
+
+// Request message for `DomainMappings.UpdateDomainMapping`.
+message UpdateDomainMappingRequest {
+  // Name of the resource to update. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+
+  // A domain mapping containing the updated resource. Only fields set
+  // in the field mask will be updated.
+  DomainMapping domain_mapping = 2;
+
+  // Standard field mask for the set of fields to be updated.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+// Request message for `DomainMappings.DeleteDomainMapping`.
+message DeleteDomainMappingRequest {
+  // Name of the resource to delete. Example:
+  // `apps/myapp/domainMappings/example.com`.
+  string name = 1;
+}
+
+// Manages SSL certificates a user is authorized to administer. A user can
+// administer any SSL certificates applicable to their authorized domains.
+service AuthorizedCertificates {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists all SSL certificates the user is authorized to administer.
+  rpc ListAuthorizedCertificates(ListAuthorizedCertificatesRequest) returns (ListAuthorizedCertificatesResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*}/authorizedCertificates"
+    };
+  }
+
+  // Gets the specified SSL certificate.
+  rpc GetAuthorizedCertificate(GetAuthorizedCertificateRequest) returns (AuthorizedCertificate) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/authorizedCertificates/*}"
+    };
+  }
+
+  // Uploads the specified SSL certificate.
+  rpc CreateAuthorizedCertificate(CreateAuthorizedCertificateRequest) returns (AuthorizedCertificate) {
+    option (google.api.http) = {
+      post: "/v1beta/{parent=apps/*}/authorizedCertificates"
+      body: "certificate"
+    };
+  }
+
+  // Updates the specified SSL certificate. To renew a certificate and maintain
+  // its existing domain mappings, update `certificate_data` with a new
+  // certificate. The new certificate must be applicable to the same domains as
+  // the original certificate. The certificate `display_name` may also be
+  // updated.
+  rpc UpdateAuthorizedCertificate(UpdateAuthorizedCertificateRequest) returns (AuthorizedCertificate) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*/authorizedCertificates/*}"
+      body: "certificate"
+    };
+  }
+
+  // Deletes the specified SSL certificate.
+  rpc DeleteAuthorizedCertificate(DeleteAuthorizedCertificateRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/authorizedCertificates/*}"
+    };
+  }
+}
+
+// Fields that should be returned when an AuthorizedCertificate resource is
+// retrieved.
+enum AuthorizedCertificateView {
+  // Basic certificate information, including applicable domains and expiration
+  // date.
+  BASIC_CERTIFICATE = 0;
+
+  // The information from `BASIC_CERTIFICATE`, plus detailed information on the
+  // domain mappings that have this certificate mapped.
+  FULL_CERTIFICATE = 1;
+}
+
+// Override strategy for mutating an existing mapping.
+enum DomainOverrideStrategy {
+  // Strategy unspecified. Defaults to `STRICT`.
+  UNSPECIFIED_DOMAIN_OVERRIDE_STRATEGY = 0;
+
+  // Overrides not allowed. If a mapping already exists for the
+  // specified domain, the request will return an ALREADY_EXISTS (409).
+  STRICT = 1;
+
+  // Overrides allowed. If a mapping already exists for the specified domain,
+  // the request will overwrite it. Note that this might stop another
+  // Google product from serving. For example, if the domain is
+  // mapped to another App Engine application, that app will no
+  // longer serve from that domain.
+  OVERRIDE = 2;
+}
+
+// Manages domains serving an application.
+service DomainMappings {
+  option (google.api.default_host) = "appengine.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/appengine.admin,"
+      "https://www.googleapis.com/auth/cloud-platform,"
+      "https://www.googleapis.com/auth/cloud-platform.read-only";
+
+  // Lists the domain mappings on an application.
+  rpc ListDomainMappings(ListDomainMappingsRequest) returns (ListDomainMappingsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=apps/*}/domainMappings"
+    };
+  }
+
+  // Gets the specified domain mapping.
+  rpc GetDomainMapping(GetDomainMappingRequest) returns (DomainMapping) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=apps/*/domainMappings/*}"
+    };
+  }
+
+  // Maps a domain to an application. A user must be authorized to administer a
+  // domain in order to map it to an application. For a list of available
+  // authorized domains, see [`AuthorizedDomains.ListAuthorizedDomains`]().
+  rpc CreateDomainMapping(CreateDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1beta/{parent=apps/*}/domainMappings"
+      body: "domain_mapping"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "DomainMapping"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Updates the specified domain mapping. To map an SSL certificate to a
+  // domain mapping, update `certificate_id` to point to an `AuthorizedCertificate`
+  // resource. A user must be authorized to administer the associated domain
+  // in order to update a `DomainMapping` resource.
+  rpc UpdateDomainMapping(UpdateDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1beta/{name=apps/*/domainMappings/*}"
+      body: "domain_mapping"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "DomainMapping"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+
+  // Deletes the specified domain mapping. A user must be authorized to
+  // administer the associated domain in order to delete a `DomainMapping`
+  // resource.
+  rpc DeleteDomainMapping(DeleteDomainMappingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1beta/{name=apps/*/domainMappings/*}"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadataV1Beta"
+    };
+  }
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/application.proto b/third_party/googleapis/google/appengine/v1beta/application.proto
new file mode 100644
index 0000000..f99046d
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/application.proto
@@ -0,0 +1,193 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "ApplicationProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// An Application resource contains the top-level configuration of an App
+// Engine application.
+message Application {
+  // Identity-Aware Proxy
+  message IdentityAwareProxy {
+    // Whether the serving infrastructure will authenticate and
+    // authorize all incoming requests.
+    //
+    // If true, the `oauth2_client_id` and `oauth2_client_secret`
+    // fields must be non-empty.
+    bool enabled = 1;
+
+    // OAuth2 client ID to use for the authentication flow.
+    string oauth2_client_id = 2;
+
+    // OAuth2 client secret to use for the authentication flow.
+    //
+    // For security reasons, this value cannot be retrieved via the API.
+    // Instead, the SHA-256 hash of the value is returned in the
+    // `oauth2_client_secret_sha256` field.
+    //
+    // @InputOnly
+    string oauth2_client_secret = 3;
+
+    // Hex-encoded SHA-256 hash of the client secret.
+    //
+    // @OutputOnly
+    string oauth2_client_secret_sha256 = 4;
+  }
+
+  // The feature specific settings to be used in the application. These define
+  // behaviors that are user configurable.
+  message FeatureSettings {
+    // Boolean value indicating if split health checks should be used instead
+    // of the legacy health checks. At an app.yaml level, this means defaulting
+    // to 'readiness_check' and 'liveness_check' values instead of
+    // 'health_check' ones. Once the legacy 'health_check' behavior is
+    // deprecated, and this value is always true, this setting can
+    // be removed.
+    bool split_health_checks = 1;
+
+    // If true, use [Container-Optimized OS](https://cloud.google.com/container-optimized-os/)
+    // base image for VMs, rather than a base Debian image.
+    bool use_container_optimized_os = 2;
+  }
+
+  enum ServingStatus {
+    // Serving status is unspecified.
+    UNSPECIFIED = 0;
+
+    // Application is serving.
+    SERVING = 1;
+
+    // Application has been disabled by the user.
+    USER_DISABLED = 2;
+
+    // Application has been disabled by the system.
+    SYSTEM_DISABLED = 3;
+  }
+
+  enum DatabaseType {
+    // Database type is unspecified.
+    DATABASE_TYPE_UNSPECIFIED = 0;
+
+    // Cloud Datastore
+    CLOUD_DATASTORE = 1;
+
+    // Cloud Firestore Native
+    CLOUD_FIRESTORE = 2;
+
+    // Cloud Firestore in Datastore Mode
+    CLOUD_DATASTORE_COMPATIBILITY = 3;
+  }
+
+  // Full path to the Application resource in the API.
+  // Example: `apps/myapp`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Identifier of the Application resource. This identifier is equivalent
+  // to the project ID of the Google Cloud Platform project where you want to
+  // deploy your application.
+  // Example: `myapp`.
+  string id = 2;
+
+  // HTTP path dispatch rules for requests to the application that do not
+  // explicitly target a service or version. Rules are order-dependent.
+  // Up to 20 dispatch rules can be supported.
+  repeated UrlDispatchRule dispatch_rules = 3;
+
+  // Google Apps authentication domain that controls which users can access
+  // this application.
+  //
+  // Defaults to open access for any Google Account.
+  string auth_domain = 6;
+
+  // Location from which this application runs. Application instances
+  // run out of the data centers in the specified location, which is also where
+  // all of the application's end user content is stored.
+  //
+  // Defaults to `us-central`.
+  //
+  // View the list of
+  // [supported locations](https://cloud.google.com/appengine/docs/locations).
+  string location_id = 7;
+
+  // Google Cloud Storage bucket that can be used for storing files
+  // associated with this application. This bucket is associated with the
+  // application and can be used by the gcloud deployment commands.
+  //
+  // @OutputOnly
+  string code_bucket = 8;
+
+  // Cookie expiration policy for this application.
+  google.protobuf.Duration default_cookie_expiration = 9;
+
+  // Serving status of this application.
+  ServingStatus serving_status = 10;
+
+  // Hostname used to reach this application, as resolved by App Engine.
+  //
+  // @OutputOnly
+  string default_hostname = 11;
+
+  // Google Cloud Storage bucket that can be used by this application to store
+  // content.
+  //
+  // @OutputOnly
+  string default_bucket = 12;
+
+  IdentityAwareProxy iap = 14;
+
+  // The Google Container Registry domain used for storing managed build docker
+  // images for this application.
+  string gcr_domain = 16;
+
+  // The type of the Cloud Firestore or Cloud Datastore database associated with
+  // this application.
+  DatabaseType database_type = 17;
+
+  // The feature specific settings to be used in the application.
+  FeatureSettings feature_settings = 18;
+}
+
+// Rules to match an HTTP request and dispatch that request to a service.
+message UrlDispatchRule {
+  // Domain name to match against. The wildcard "`*`" is supported if
+  // specified before a period: "`*.`".
+  //
+  // Defaults to matching all domains: "`*`".
+  string domain = 1;
+
+  // Pathname within the host. Must start with a "`/`". A
+  // single "`*`" can be included at the end of the path.
+  //
+  // The sum of the lengths of the domain and path may not
+  // exceed 100 characters.
+  string path = 2;
+
+  // Resource ID of a service in this application that should
+  // serve the matched request. The service must already
+  // exist. Example: `default`.
+  string service = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/audit_data.proto b/third_party/googleapis/google/appengine/v1beta/audit_data.proto
new file mode 100644
index 0000000..254a46d
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/audit_data.proto
@@ -0,0 +1,54 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/appengine/v1beta/appengine.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "AuditDataProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// App Engine admin service audit log.
+message AuditData {
+  // Detailed information about methods that require it. Does not include
+  // simple Get, List or Delete methods because all significant information
+  // (resource name, number of returned elements for List operations) is already
+  // included in parent audit log message.
+  oneof method {
+    // Detailed information about UpdateService call.
+    UpdateServiceMethod update_service = 1;
+
+    // Detailed information about CreateVersion call.
+    CreateVersionMethod create_version = 2;
+  }
+}
+
+// Detailed information about UpdateService call.
+message UpdateServiceMethod {
+  // Update service request.
+  UpdateServiceRequest request = 1;
+}
+
+// Detailed information about CreateVersion call.
+message CreateVersionMethod {
+  // Create version request.
+  CreateVersionRequest request = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/certificate.proto b/third_party/googleapis/google/appengine/v1beta/certificate.proto
new file mode 100644
index 0000000..fda072d
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/certificate.proto
@@ -0,0 +1,172 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "CertificateProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// An SSL certificate that a user has been authorized to administer. A user
+// is authorized to administer any certificate that applies to one of their
+// authorized domains.
+message AuthorizedCertificate {
+  // Full path to the `AuthorizedCertificate` resource in the API. Example:
+  // `apps/myapp/authorizedCertificates/12345`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the certificate. This is a unique value autogenerated
+  // on `AuthorizedCertificate` resource creation. Example: `12345`.
+  //
+  // @OutputOnly
+  string id = 2;
+
+  // The user-specified display name of the certificate. This is not
+  // guaranteed to be unique. Example: `My Certificate`.
+  string display_name = 3;
+
+  // Topmost applicable domains of this certificate. This certificate
+  // applies to these domains and their subdomains. Example: `example.com`.
+  //
+  // @OutputOnly
+  repeated string domain_names = 4;
+
+  // The time when this certificate expires. To update the renewal time on this
+  // certificate, upload an SSL certificate with a different expiration time
+  // using [`AuthorizedCertificates.UpdateAuthorizedCertificate`]().
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp expire_time = 5;
+
+  // The SSL certificate serving the `AuthorizedCertificate` resource. This
+  // must be obtained independently from a certificate authority.
+  CertificateRawData certificate_raw_data = 6;
+
+  // Only applicable if this certificate is managed by App Engine. Managed
+  // certificates are tied to the lifecycle of a `DomainMapping` and cannot be
+  // updated or deleted via the `AuthorizedCertificates` API. If this
+  // certificate is manually administered by the user, this field will be empty.
+  //
+  // @OutputOnly
+  ManagedCertificate managed_certificate = 7;
+
+  // The full paths to user visible Domain Mapping resources that have this
+  // certificate mapped. Example: `apps/myapp/domainMappings/example.com`.
+  //
+  // This may not represent the full list of mapped domain mappings if the user
+  // does not have `VIEWER` permissions on all of the applications that have
+  // this certificate mapped. See `domain_mappings_count` for a complete count.
+  //
+  // Only returned by `GET` or `LIST` requests when specifically requested by
+  // the `view=FULL_CERTIFICATE` option.
+  //
+  // @OutputOnly
+  repeated string visible_domain_mappings = 8;
+
+  // Aggregate count of the domain mappings with this certificate mapped. This
+  // count includes domain mappings on applications for which the user does not
+  // have `VIEWER` permissions.
+  //
+  // Only returned by `GET` or `LIST` requests when specifically requested by
+  // the `view=FULL_CERTIFICATE` option.
+  //
+  // @OutputOnly
+  int32 domain_mappings_count = 9;
+}
+
+// An SSL certificate obtained from a certificate authority.
+message CertificateRawData {
+  // PEM encoded x.509 public key certificate. This field is set once on
+  // certificate creation. Must include the header and footer. Example:
+  // <pre>
+  // -----BEGIN CERTIFICATE-----
+  // <certificate_value>
+  // -----END CERTIFICATE-----
+  // </pre>
+  string public_certificate = 1;
+
+  // Unencrypted PEM encoded RSA private key. This field is set once on
+  // certificate creation and then encrypted. The key size must be 2048
+  // bits or fewer. Must include the header and footer. Example:
+  // <pre>
+  // -----BEGIN RSA PRIVATE KEY-----
+  // <unencrypted_key_value>
+  // -----END RSA PRIVATE KEY-----
+  // </pre>
+  // @InputOnly
+  string private_key = 2;
+}
+
+// State of certificate management. Refers to the most recent certificate
+// acquisition or renewal attempt.
+enum ManagementStatus {
+  MANAGEMENT_STATUS_UNSPECIFIED = 0;
+
+  // Certificate was successfully obtained and inserted into the serving
+  // system.
+  OK = 1;
+
+  // Certificate is under active attempts to acquire or renew.
+  PENDING = 2;
+
+  // Most recent renewal failed due to an invalid DNS setup and will be
+  // retried. Renewal attempts will continue to fail until the certificate
+  // domain's DNS configuration is fixed. The last successfully provisioned
+  // certificate may still be serving.
+  FAILED_RETRYING_NOT_VISIBLE = 4;
+
+  // All renewal attempts have been exhausted, likely due to an invalid DNS
+  // setup.
+  FAILED_PERMANENT = 6;
+
+  // Most recent renewal failed due to an explicit CAA record that does not
+  // include one of the in-use CAs (Google CA and Let's Encrypt). Renewals will
+  // continue to fail until the CAA is reconfigured. The last successfully
+  // provisioned certificate may still be serving.
+  FAILED_RETRYING_CAA_FORBIDDEN = 7;
+
+  // Most recent renewal failed due to a CAA retrieval failure. This means that
+  // the domain's DNS provider does not properly handle CAA records, failing
+  // requests for CAA records when no CAA records are defined. Renewals will
+  // continue to fail until the DNS provider is changed or a CAA record is
+  // added for the given domain. The last successfully provisioned certificate
+  // may still be serving.
+  FAILED_RETRYING_CAA_CHECKING = 8;
+}
+
+// A certificate managed by App Engine.
+message ManagedCertificate {
+  // Time at which the certificate was last renewed. The renewal process is
+  // fully managed. Certificate renewal will automatically occur before the
+  // certificate expires. Renewal errors can be tracked via `ManagementStatus`.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp last_renewal_time = 1;
+
+  // Status of certificate management. Refers to the most recent certificate
+  // acquisition or renewal attempt.
+  //
+  // @OutputOnly
+  ManagementStatus status = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/deploy.proto b/third_party/googleapis/google/appengine/v1beta/deploy.proto
new file mode 100644
index 0000000..4714915
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/deploy.proto
@@ -0,0 +1,118 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DeployProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// Code and application artifacts used to deploy a version to App Engine.
+message Deployment {
+  // Manifest of the files stored in Google Cloud Storage that are included
+  // as part of this version. All files must be readable using the
+  // credentials supplied with this call.
+  map<string, FileInfo> files = 1;
+
+  // The Docker image for the container that runs the version.
+  // Only applicable for instances running in the App Engine flexible environment.
+  ContainerInfo container = 2;
+
+  // The zip file for this deployment, if this is a zip deployment.
+  ZipInfo zip = 3;
+
+  // Google Cloud Build build information. Only applicable for instances running
+  // in the App Engine flexible environment.
+  BuildInfo build = 5;
+
+  // Options for any Google Cloud Build builds created as a part of this
+  // deployment.
+  //
+  // These options will only be used if a new build is created, such as when
+  // deploying to the App Engine flexible environment using files or zip.
+  CloudBuildOptions cloud_build_options = 6;
+}
+
+// Single source file that is part of the version to be deployed. Each source
+// file that is deployed must be specified separately.
+message FileInfo {
+  // URL source to use to fetch this file. Must be a URL to a resource in
+  // Google Cloud Storage in the form
+  // 'http(s)://storage.googleapis.com/\<bucket\>/\<object\>'.
+  string source_url = 1;
+
+  // The SHA1 hash of the file, in hex.
+  string sha1_sum = 2;
+
+  // The MIME type of the file.
+  //
+  // Defaults to the value from Google Cloud Storage.
+  string mime_type = 3;
+}
+
+// Docker image that is used to create a container and start a VM instance for
+// the version that you deploy. Only applicable for instances running in the App
+// Engine flexible environment.
+message ContainerInfo {
+  // URI to the hosted container image in Google Container Registry. The URI
+  // must be fully qualified and include a tag or digest.
+  // Examples: "gcr.io/my-project/image:tag" or "gcr.io/my-project/image@digest"
+  string image = 1;
+}
+
+// Google Cloud Build information.
+message BuildInfo {
+  // The Google Cloud Build id.
+  // Example: "f966068f-08b2-42c8-bdfe-74137dff2bf9"
+  string cloud_build_id = 1;
+}
+
+// Options for the build operations performed as a part of the version
+// deployment. Only applicable for App Engine flexible environment when creating
+// a version using source code directly.
+message CloudBuildOptions {
+  // Path to the yaml file used in deployment, used to determine runtime
+  // configuration details.
+  //
+  // Required for flexible environment builds.
+  //
+  // See https://cloud.google.com/appengine/docs/standard/python/config/appref
+  // for more details.
+  string app_yaml_path = 1;
+
+  // The Cloud Build timeout used as part of any dependent builds performed by
+  // version creation. Defaults to 10 minutes.
+  google.protobuf.Duration cloud_build_timeout = 2;
+}
+
+// The zip file information for a zip deployment.
+message ZipInfo {
+  // URL of the zip file to deploy from. Must be a URL to a resource in
+  // Google Cloud Storage in the form
+  // 'http(s)://storage.googleapis.com/\<bucket\>/\<object\>'.
+  string source_url = 3;
+
+  // An estimate of the number of files in a zip for a zip deployment.
+  // If set, must be greater than or equal to the actual number of files.
+  // Used for optimizing performance; if not provided, deployment may be slow.
+  int32 files_count = 4;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/domain.proto b/third_party/googleapis/google/appengine/v1beta/domain.proto
new file mode 100644
index 0000000..94bbcd9
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/domain.proto
@@ -0,0 +1,41 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DomainProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A domain that a user has been authorized to administer. To authorize use
+// of a domain, verify ownership via
+// [Webmaster Central](https://www.google.com/webmasters/verification/home).
+message AuthorizedDomain {
+  // Full path to the `AuthorizedDomain` resource in the API. Example:
+  // `apps/myapp/authorizedDomains/example.com`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Fully qualified domain name of the domain authorized for use. Example:
+  // `example.com`.
+  string id = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/domain_mapping.proto b/third_party/googleapis/google/appengine/v1beta/domain_mapping.proto
new file mode 100644
index 0000000..9a0bebc
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/domain_mapping.proto
@@ -0,0 +1,118 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "DomainMappingProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A domain serving an App Engine application.
+message DomainMapping {
+  // Full path to the `DomainMapping` resource in the API. Example:
+  // `apps/myapp/domainMapping/example.com`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the domain serving the application. Example:
+  // `example.com`.
+  string id = 2;
+
+  // SSL configuration for this domain. If unconfigured, this domain will not
+  // serve with SSL.
+  SslSettings ssl_settings = 3;
+
+  // The resource records required to configure this domain mapping. These
+  // records must be added to the domain's DNS configuration in order to
+  // serve the application via this domain mapping.
+  //
+  // @OutputOnly
+  repeated ResourceRecord resource_records = 4;
+}
+
+// SSL configuration for a `DomainMapping` resource.
+message SslSettings {
+  // The SSL management type for this domain.
+  enum SslManagementType {
+    // SSL support for this domain is configured automatically. The mapped SSL
+    // certificate will be automatically renewed.
+    AUTOMATIC = 0;
+
+    // SSL support for this domain is configured manually by the user. Either
+    // the domain has no SSL support or a user-obtained SSL certificate has been
+    // explictly mapped to this domain.
+    MANUAL = 1;
+  }
+
+  // ID of the `AuthorizedCertificate` resource configuring SSL for the
+  // application. Clearing this field will remove SSL support.
+  //
+  // By default, a managed certificate is automatically created for every
+  // domain mapping. To omit SSL support or to configure SSL manually, specify
+  // `SslManagementType.MANUAL` on a `CREATE` or `UPDATE` request. You must
+  // be authorized to administer the `AuthorizedCertificate` resource to
+  // manually map it to a `DomainMapping` resource.
+  // Example: `12345`.
+  string certificate_id = 1;
+
+  // SSL management type for this domain. If `AUTOMATIC`, a managed certificate
+  // is automatically provisioned. If `MANUAL`, `certificate_id` must be
+  // manually specified in order to configure SSL for this domain.
+  SslManagementType ssl_management_type = 3;
+
+  // ID of the managed `AuthorizedCertificate` resource currently being
+  // provisioned, if applicable. Until the new managed certificate has been
+  // successfully provisioned, the previous SSL state will be preserved. Once
+  // the provisioning process completes, the `certificate_id` field will reflect
+  // the new managed certificate and this field will be left empty. To remove
+  // SSL support while there is still a pending managed certificate, clear the
+  // `certificate_id` field with an `UpdateDomainMappingRequest`.
+  //
+  // @OutputOnly
+  string pending_managed_certificate_id = 4;
+}
+
+// A DNS resource record.
+message ResourceRecord {
+  // A resource record type.
+  enum RecordType {
+    // An A resource record. Data is an IPv4 address.
+    A = 0;
+
+    // An AAAA resource record. Data is an IPv6 address.
+    AAAA = 1;
+
+    // A CNAME resource record. Data is a domain name to be aliased.
+    CNAME = 2;
+  }
+
+  // Relative name of the object affected by this record. Only applicable for
+  // `CNAME` records. Example: 'www'.
+  string name = 1;
+
+  // Data for this record. Values vary by record type, as defined in RFC 1035
+  // (section 5) and RFC 1034 (section 3.6.1).
+  string rrdata = 2;
+
+  // Resource record type. Example: `AAAA`.
+  RecordType type = 3;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/firewall.proto b/third_party/googleapis/google/appengine/v1beta/firewall.proto
new file mode 100644
index 0000000..f853327
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/firewall.proto
@@ -0,0 +1,69 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "FirewallProto";
+option java_package = "com.google.appengine.v1beta.firewall";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A single firewall rule that is evaluated against incoming traffic
+// and provides an action to take on matched requests.
+message FirewallRule {
+  // Available actions to take on matching requests.
+  enum Action {
+    UNSPECIFIED_ACTION = 0;
+
+    // Matching requests are allowed.
+    ALLOW = 1;
+
+    // Matching requests are denied.
+    DENY = 2;
+  }
+
+  // A positive integer between [1, Int32.MaxValue-1] that defines the order of
+  // rule evaluation. Rules with the lowest priority are evaluated first.
+  //
+  // A default rule at priority Int32.MaxValue matches all IPv4 and IPv6 traffic
+  // when no previous rule matches. Only the action of this rule can be modified
+  // by the user.
+  int32 priority = 1;
+
+  // The action to take on matched requests.
+  Action action = 2;
+
+  // IP address or range, defined using CIDR notation, of requests that this
+  // rule applies to. You can use the wildcard character "*" to match all IPs
+  // equivalent to "0/0" and "::/0" together.
+  // Examples: `192.168.1.1` or `192.168.0.0/16` or `2001:db8::/32`
+  //           or `2001:0db8:0000:0042:0000:8a2e:0370:7334`.
+  //
+  //
+  // <p>Truncation will be silently performed on addresses which are not
+  // properly truncated. For example, `1.2.3.4/24` is accepted as the same
+  // address as `1.2.3.0/24`. Similarly, for IPv6, `2001:db8::1/32` is accepted
+  // as the same address as `2001:db8::/32`.
+  string source_range = 3;
+
+  // An optional string description of this rule.
+  // This field has a maximum length of 100 characters.
+  string description = 4;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/instance.proto b/third_party/googleapis/google/appengine/v1beta/instance.proto
new file mode 100644
index 0000000..f544450
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/instance.proto
@@ -0,0 +1,143 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "InstanceProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// An Instance resource is the computing unit that App Engine uses to
+// automatically scale an application.
+message Instance {
+  option (google.api.resource) = {
+    type: "appengine.googleapis.com/Instance"
+    pattern: "apps/{app}/services/{service}/versions/{version}/instances/{instance}"
+  };
+
+  // Wrapper for LivenessState enum.
+  message Liveness {
+    // Liveness health check status for Flex instances.
+    enum LivenessState {
+      // There is no liveness health check for the instance. Only applicable for
+      // instances in App Engine standard environment.
+      LIVENESS_STATE_UNSPECIFIED = 0;
+
+      // The health checking system is aware of the instance but its health is
+      // not known at the moment.
+      UNKNOWN = 1;
+
+      // The instance is reachable i.e. a connection to the application health
+      // checking endpoint can be established, and conforms to the requirements
+      // defined by the health check.
+      HEALTHY = 2;
+
+      // The instance is reachable, but does not conform to the requirements
+      // defined by the health check.
+      UNHEALTHY = 3;
+
+      // The instance is being drained. The existing connections to the instance
+      // have time to complete, but the new ones are being refused.
+      DRAINING = 4;
+
+      // The instance is unreachable i.e. a connection to the application health
+      // checking endpoint cannot be established, or the server does not respond
+      // within the specified timeout.
+      TIMEOUT = 5;
+    }
+
+
+  }
+
+  // Availability of the instance.
+  enum Availability {
+    UNSPECIFIED = 0;
+
+    RESIDENT = 1;
+
+    DYNAMIC = 2;
+  }
+
+  // Output only. Full path to the Instance resource in the API.
+  // Example: `apps/myapp/services/default/versions/v1/instances/instance-1`.
+  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Relative name of the instance within the version.
+  // Example: `instance-1`.
+  string id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. App Engine release this instance is running on.
+  string app_engine_release = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Availability of the instance.
+  Availability availability = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Name of the virtual machine where this instance lives. Only applicable
+  // for instances in App Engine flexible environment.
+  string vm_name = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Zone where the virtual machine is located. Only applicable for instances
+  // in App Engine flexible environment.
+  string vm_zone_name = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Virtual machine ID of this instance. Only applicable for instances in
+  // App Engine flexible environment.
+  string vm_id = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time that this instance was started.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp start_time = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Number of requests since this instance was started.
+  int32 requests = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Number of errors since this instance was started.
+  int32 errors = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Average queries per second (QPS) over the last minute.
+  float qps = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Average latency (ms) over the last minute.
+  int32 average_latency = 12 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Total memory in use (bytes).
+  int64 memory_usage = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Status of the virtual machine where this instance lives. Only applicable
+  // for instances in App Engine flexible environment.
+  string vm_status = 14 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Whether this instance is in debug mode. Only applicable for instances in
+  // App Engine flexible environment.
+  bool vm_debug_enabled = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The IP address of this instance. Only applicable for instances in App
+  // Engine flexible environment.
+  string vm_ip = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The liveness health check of this instance. Only applicable for instances
+  // in App Engine flexible environment.
+  Liveness.LivenessState vm_liveness = 17 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/location.proto b/third_party/googleapis/google/appengine/v1beta/location.proto
new file mode 100644
index 0000000..e4689d2
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/location.proto
@@ -0,0 +1,44 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/api/field_behavior.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "LocationProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// Metadata for the given [google.cloud.location.Location][google.cloud.location.Location].
+message LocationMetadata {
+  // App Engine standard environment is available in the given location.
+  //
+  // @OutputOnly
+  bool standard_environment_available = 2;
+
+  // App Engine flexible environment is available in the given location.
+  //
+  // @OutputOnly
+  bool flexible_environment_available = 4;
+
+  // Output only. [Search API](https://cloud.google.com/appengine/docs/standard/python/search)
+  // is available in the given location.
+  bool search_api_available = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/network_settings.proto b/third_party/googleapis/google/appengine/v1beta/network_settings.proto
new file mode 100644
index 0000000..1e84f69
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/network_settings.proto
@@ -0,0 +1,48 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "NetworkSettingsProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A NetworkSettings resource is a container for ingress settings for a version
+// or service.
+message NetworkSettings {
+  // If unspecified, INGRESS_TRAFFIC_ALLOWED_ALL will be used.
+  enum IngressTrafficAllowed {
+    // Unspecified
+    INGRESS_TRAFFIC_ALLOWED_UNSPECIFIED = 0;
+
+    // Allow HTTP traffic from public and private sources.
+    INGRESS_TRAFFIC_ALLOWED_ALL = 1;
+
+    // Allow HTTP traffic from only private VPC sources.
+    INGRESS_TRAFFIC_ALLOWED_INTERNAL_ONLY = 2;
+
+    // Allow HTTP traffic from private VPC sources and through load balancers.
+    INGRESS_TRAFFIC_ALLOWED_INTERNAL_AND_LB = 3;
+  }
+
+  // The ingress settings for version or service.
+  IngressTrafficAllowed ingress_traffic_allowed = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/operation.proto b/third_party/googleapis/google/appengine/v1beta/operation.proto
new file mode 100644
index 0000000..10c5ea3
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/operation.proto
@@ -0,0 +1,79 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "OperationProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// Metadata for the given [google.longrunning.Operation][google.longrunning.Operation].
+message OperationMetadataV1Beta {
+  // API method that initiated this operation. Example:
+  // `google.appengine.v1beta.Versions.CreateVersion`.
+  //
+  // @OutputOnly
+  string method = 1;
+
+  // Time that this operation was created.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp insert_time = 2;
+
+  // Time that this operation completed.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp end_time = 3;
+
+  // User who requested this operation.
+  //
+  // @OutputOnly
+  string user = 4;
+
+  // Name of the resource that this operation is acting on. Example:
+  // `apps/myapp/services/default`.
+  //
+  // @OutputOnly
+  string target = 5;
+
+  // Ephemeral message that may change every time the operation is polled.
+  // @OutputOnly
+  string ephemeral_message = 6;
+
+  // Durable messages that persist on every operation poll.
+  // @OutputOnly
+  repeated string warning = 7;
+
+  // Metadata specific to the type of operation in progress.
+  // @OutputOnly
+  oneof method_metadata {
+    CreateVersionMetadataV1Beta create_version_metadata = 8;
+  }
+}
+
+// Metadata for the given [google.longrunning.Operation][google.longrunning.Operation] during a
+// [google.appengine.v1beta.CreateVersionRequest][google.appengine.v1beta.CreateVersionRequest].
+message CreateVersionMetadataV1Beta {
+  // The Cloud Build ID if one was created as part of the version create.
+  // @OutputOnly
+  string cloud_build_id = 1;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/service.proto b/third_party/googleapis/google/appengine/v1beta/service.proto
new file mode 100644
index 0000000..7c4a2a8
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/service.proto
@@ -0,0 +1,93 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/appengine/v1beta/network_settings.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "ServiceProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A Service resource is a logical component of an application that can share
+// state and communicate in a secure fashion with other services.
+// For example, an application that handles customer requests might
+// include separate services to handle tasks such as backend data
+// analysis or API requests from mobile devices. Each service has a
+// collection of versions that define a specific set of code used to
+// implement the functionality of that service.
+message Service {
+  // Full path to the Service resource in the API.
+  // Example: `apps/myapp/services/default`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the service within the application.
+  // Example: `default`.
+  //
+  // @OutputOnly
+  string id = 2;
+
+  // Mapping that defines fractional HTTP traffic diversion to
+  // different versions within the service.
+  TrafficSplit split = 3;
+
+  // Ingress settings for this service. Will apply to all versions.
+  NetworkSettings network_settings = 6;
+}
+
+// Traffic routing configuration for versions within a single service. Traffic
+// splits define how traffic directed to the service is assigned to versions.
+message TrafficSplit {
+  // Available sharding mechanisms.
+  enum ShardBy {
+    // Diversion method unspecified.
+    UNSPECIFIED = 0;
+
+    // Diversion based on a specially named cookie, "GOOGAPPUID." The cookie
+    // must be set by the application itself or no diversion will occur.
+    COOKIE = 1;
+
+    // Diversion based on applying the modulus operation to a fingerprint
+    // of the IP address.
+    IP = 2;
+
+    // Diversion based on weighted random assignment. An incoming request is
+    // randomly routed to a version in the traffic split, with probability
+    // proportional to the version's traffic share.
+    RANDOM = 3;
+  }
+
+  // Mechanism used to determine which version a request is sent to.
+  // The traffic selection algorithm will
+  // be stable for either type until allocations are changed.
+  ShardBy shard_by = 1;
+
+  // Mapping from version IDs within the service to fractional
+  // (0.000, 1] allocations of traffic for that version. Each version can
+  // be specified only once, but some versions in the service may not
+  // have any traffic allocation. Services that have traffic allocated
+  // cannot be deleted until either the service is deleted or
+  // their traffic allocation is removed. Allocations must sum to 1.
+  // Up to two decimal place precision is supported for IP-based splits and
+  // up to three decimal places is supported for cookie-based splits.
+  map<string, double> allocations = 2;
+}
diff --git a/third_party/googleapis/google/appengine/v1beta/version.proto b/third_party/googleapis/google/appengine/v1beta/version.proto
new file mode 100644
index 0000000..e32f2d2
--- /dev/null
+++ b/third_party/googleapis/google/appengine/v1beta/version.proto
@@ -0,0 +1,607 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.appengine.v1beta;
+
+import "google/appengine/v1beta/app_yaml.proto";
+import "google/appengine/v1beta/deploy.proto";
+import "google/appengine/v1beta/network_settings.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.AppEngine.V1Beta";
+option go_package = "google.golang.org/genproto/googleapis/appengine/v1beta;appengine";
+option java_multiple_files = true;
+option java_outer_classname = "VersionProto";
+option java_package = "com.google.appengine.v1beta";
+option php_namespace = "Google\\Cloud\\AppEngine\\V1beta";
+option ruby_package = "Google::Cloud::AppEngine::V1beta";
+
+// A Version resource is a specific set of source code and configuration files
+// that are deployed into a service.
+message Version {
+  // Full path to the Version resource in the API.  Example:
+  // `apps/myapp/services/default/versions/v1`.
+  //
+  // @OutputOnly
+  string name = 1;
+
+  // Relative name of the version within the service.  Example: `v1`.
+  // Version names can contain only lowercase letters, numbers, or hyphens.
+  // Reserved names: "default", "latest", and any name with the prefix "ah-".
+  string id = 2;
+
+  // Controls how instances are created, scaled, and reaped.
+  //
+  // Defaults to `AutomaticScaling`.
+  oneof scaling {
+    // Automatic scaling is based on request rate, response latencies, and other
+    // application metrics. Instances are dynamically created and destroyed as
+    // needed in order to handle traffic.
+    AutomaticScaling automatic_scaling = 3;
+
+    // A service with basic scaling will create an instance when the application
+    // receives a request. The instance will be turned down when the app becomes
+    // idle. Basic scaling is ideal for work that is intermittent or driven by
+    // user activity.
+    BasicScaling basic_scaling = 4;
+
+    // A service with manual scaling runs continuously, allowing you to perform
+    // complex initialization and rely on the state of its memory over time.
+    // Manually scaled versions are sometimes referred to as "backends".
+    ManualScaling manual_scaling = 5;
+  }
+
+  // Before an application can receive email or XMPP messages, the application
+  // must be configured to enable the service.
+  repeated InboundServiceType inbound_services = 6;
+
+  // Instance class that is used to run this version. Valid values are:
+  //
+  // * AutomaticScaling: `F1`, `F2`, `F4`, `F4_1G`
+  // * ManualScaling or BasicScaling: `B1`, `B2`, `B4`, `B8`, `B4_1G`
+  //
+  // Defaults to `F1` for AutomaticScaling and `B1` for ManualScaling or
+  // BasicScaling.
+  string instance_class = 7;
+
+  // Extra network settings.
+  // Only applicable in the App Engine flexible environment.
+  Network network = 8;
+
+  // The Google Compute Engine zones that are supported by this version in the
+  // App Engine flexible environment. Deprecated.
+  repeated string zones = 118;
+
+  // Machine resources for this version.
+  // Only applicable in the App Engine flexible environment.
+  Resources resources = 9;
+
+  // Desired runtime. Example: `python27`.
+  string runtime = 10;
+
+  // The channel of the runtime to use. Only available for some
+  // runtimes. Defaults to the `default` channel.
+  string runtime_channel = 117;
+
+  // Whether multiple requests can be dispatched to this version at once.
+  bool threadsafe = 11;
+
+  // Whether to deploy this version in a container on a virtual machine.
+  bool vm = 12;
+
+  // app_engine_apis allows second generation runtimes to access the
+  // App Engine APIs.
+  bool app_engine_apis = 128;
+
+  // Metadata settings that are supplied to this version to enable
+  // beta runtime features.
+  map<string, string> beta_settings = 13;
+
+  // App Engine execution environment for this version.
+  //
+  // Defaults to `standard`.
+  string env = 14;
+
+  // Current serving status of this version. Only the versions with a
+  // `SERVING` status create instances and can be billed.
+  //
+  // `SERVING_STATUS_UNSPECIFIED` is an invalid value. Defaults to `SERVING`.
+  ServingStatus serving_status = 15;
+
+  // Email address of the user who created this version.
+  //
+  // @OutputOnly
+  string created_by = 16;
+
+  // Time that this version was created.
+  //
+  // @OutputOnly
+  google.protobuf.Timestamp create_time = 17;
+
+  // Total size in bytes of all the files that are included in this version
+  // and currently hosted on the App Engine disk.
+  //
+  // @OutputOnly
+  int64 disk_usage_bytes = 18;
+
+  // The version of the API in the given runtime environment. Please see the
+  // app.yaml reference for valid values at
+  // https://cloud.google.com/appengine/docs/standard/<language>/config/appref
+  string runtime_api_version = 21;
+
+  // The path or name of the app's main executable.
+  string runtime_main_executable_path = 22;
+
+  // The identity that the deployed version will run as.
+  // Admin API will use the App Engine Appspot service account as default if
+  // this field is neither provided in app.yaml file nor through CLI flag.
+  string service_account = 127;
+
+  // An ordered list of URL-matching patterns that should be applied to incoming
+  // requests. The first matching URL handles the request and other request
+  // handlers are not attempted.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated UrlMap handlers = 100;
+
+  // Custom static error pages. Limited to 10KB per page.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated ErrorHandler error_handlers = 101;
+
+  // Configuration for third-party Python runtime libraries that are required
+  // by the application.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  repeated Library libraries = 102;
+
+  // Serving configuration for
+  // [Google Cloud Endpoints](https://cloud.google.com/appengine/docs/python/endpoints/).
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  ApiConfigHandler api_config = 103;
+
+  // Environment variables available to the application.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  map<string, string> env_variables = 104;
+
+  // Environment variables available to the build environment.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  map<string, string> build_env_variables = 125;
+
+  // Duration that static files should be cached by web proxies and browsers.
+  // Only applicable if the corresponding
+  // [StaticFilesHandler](https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1beta/apps.services.versions#StaticFilesHandler)
+  // does not specify its own expiration time.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  google.protobuf.Duration default_expiration = 105;
+
+  // Configures health checking for instances. Unhealthy instances are
+  // stopped and replaced with new instances.
+  // Only applicable in the App Engine flexible environment.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  HealthCheck health_check = 106;
+
+  // Configures readiness health checking for instances.
+  // Unhealthy instances are not put into the backend traffic rotation.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  ReadinessCheck readiness_check = 112;
+
+  // Configures liveness health checking for instances.
+  // Unhealthy instances are stopped and replaced with new instances
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  LivenessCheck liveness_check = 113;
+
+  // Files that match this pattern will not be built into this version.
+  // Only applicable for Go runtimes.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  string nobuild_files_regex = 107;
+
+  // Code and application artifacts that make up this version.
+  //
+  // Only returned in `GET` requests if `view=FULL` is set.
+  Deployment deployment = 108;
+
+  // Serving URL for this version. Example:
+  // "https://myversion-dot-myservice-dot-myapp.appspot.com"
+  //
+  // @OutputOnly
+  string version_url = 109;
+
+  // Cloud Endpoints configuration.
+  //
+  // If endpoints_api_service is set, the Cloud Endpoints Extensible Service
+  // Proxy will be provided to serve the API implemented by the app.
+  EndpointsApiService endpoints_api_service = 110;
+
+  // The entrypoint for the application.
+  Entrypoint entrypoint = 122;
+
+  // Enables VPC connectivity for standard apps.
+  VpcAccessConnector vpc_access_connector = 121;
+}
+
+// [Cloud Endpoints](https://cloud.google.com/endpoints) configuration.
+// The Endpoints API Service provides tooling for serving Open API and gRPC
+// endpoints via an NGINX proxy. Only valid for App Engine Flexible environment
+// deployments.
+//
+// The fields here refer to the name and configuration ID of a "service"
+// resource in the [Service Management API](https://cloud.google.com/service-management/overview).
+message EndpointsApiService {
+  // Available rollout strategies.
+  enum RolloutStrategy {
+    // Not specified. Defaults to `FIXED`.
+    UNSPECIFIED_ROLLOUT_STRATEGY = 0;
+
+    // Endpoints service configuration ID will be fixed to the configuration ID
+    // specified by `config_id`.
+    FIXED = 1;
+
+    // Endpoints service configuration ID will be updated with each rollout.
+    MANAGED = 2;
+  }
+
+  // Endpoints service name which is the name of the "service" resource in the
+  // Service Management API. For example "myapi.endpoints.myproject.cloud.goog"
+  string name = 1;
+
+  // Endpoints service configuration ID as specified by the Service Management
+  // API. For example "2016-09-19r1".
+  //
+  // By default, the rollout strategy for Endpoints is `RolloutStrategy.FIXED`.
+  // This means that Endpoints starts up with a particular configuration ID.
+  // When a new configuration is rolled out, Endpoints must be given the new
+  // configuration ID. The `config_id` field is used to give the configuration
+  // ID and is required in this case.
+  //
+  // Endpoints also has a rollout strategy called `RolloutStrategy.MANAGED`.
+  // When using this, Endpoints fetches the latest configuration and does not
+  // need the configuration ID. In this case, `config_id` must be omitted.
+  string config_id = 2;
+
+  // Endpoints rollout strategy. If `FIXED`, `config_id` must be specified. If
+  // `MANAGED`, `config_id` must be omitted.
+  RolloutStrategy rollout_strategy = 3;
+
+  // Enable or disable trace sampling. By default, this is set to false for
+  // enabled.
+  bool disable_trace_sampling = 4;
+}
+
+// Automatic scaling is based on request rate, response latencies, and other
+// application metrics.
+message AutomaticScaling {
+  // The time period that the
+  // [Autoscaler](https://cloud.google.com/compute/docs/autoscaler/)
+  // should wait before it starts collecting information from a new instance.
+  // This prevents the autoscaler from collecting information when the instance
+  // is initializing, during which the collected usage would not be reliable.
+  // Only applicable in the App Engine flexible environment.
+  google.protobuf.Duration cool_down_period = 1;
+
+  // Target scaling by CPU usage.
+  CpuUtilization cpu_utilization = 2;
+
+  // Number of concurrent requests an automatic scaling instance can accept
+  // before the scheduler spawns a new instance.
+  //
+  // Defaults to a runtime-specific value.
+  int32 max_concurrent_requests = 3;
+
+  // Maximum number of idle instances that should be maintained for this
+  // version.
+  int32 max_idle_instances = 4;
+
+  // Maximum number of instances that should be started to handle requests for
+  // this version.
+  int32 max_total_instances = 5;
+
+  // Maximum amount of time that a request should wait in the pending queue
+  // before starting a new instance to handle it.
+  google.protobuf.Duration max_pending_latency = 6;
+
+  // Minimum number of idle instances that should be maintained for
+  // this version. Only applicable for the default version of a service.
+  int32 min_idle_instances = 7;
+
+  // Minimum number of running instances that should be maintained for this
+  // version.
+  int32 min_total_instances = 8;
+
+  // Minimum amount of time a request should wait in the pending queue before
+  // starting a new instance to handle it.
+  google.protobuf.Duration min_pending_latency = 9;
+
+  // Target scaling by request utilization.
+  RequestUtilization request_utilization = 10;
+
+  // Target scaling by disk usage.
+  DiskUtilization disk_utilization = 11;
+
+  // Target scaling by network usage.
+  NetworkUtilization network_utilization = 12;
+
+  // Target scaling by user-provided metrics.
+  // Only applicable in the App Engine flexible environment.
+  repeated CustomMetric custom_metrics = 21;
+
+  // Scheduler settings for standard environment.
+  StandardSchedulerSettings standard_scheduler_settings = 20;
+}
+
+// A service with basic scaling will create an instance when the application
+// receives a request. The instance will be turned down when the app becomes
+// idle. Basic scaling is ideal for work that is intermittent or driven by
+// user activity.
+message BasicScaling {
+  // Duration of time after the last request that an instance must wait before
+  // the instance is shut down.
+  google.protobuf.Duration idle_timeout = 1;
+
+  // Maximum number of instances to create for this version.
+  int32 max_instances = 2;
+}
+
+// A service with manual scaling runs continuously, allowing you to perform
+// complex initialization and rely on the state of its memory over time.
+message ManualScaling {
+  // Number of instances to assign to the service at the start. This number
+  // can later be altered by using the
+  // [Modules API](https://cloud.google.com/appengine/docs/python/modules/functions)
+  // `set_num_instances()` function.
+  int32 instances = 1;
+}
+
+// Target scaling by CPU usage.
+message CpuUtilization {
+  // Period of time over which CPU utilization is calculated.
+  google.protobuf.Duration aggregation_window_length = 1;
+
+  // Target CPU utilization ratio to maintain when scaling. Must be between 0
+  // and 1.
+  double target_utilization = 2;
+}
+
+// Target scaling by request utilization.
+// Only applicable in the App Engine flexible environment.
+message RequestUtilization {
+  // Target requests per second.
+  int32 target_request_count_per_second = 1;
+
+  // Target number of concurrent requests.
+  int32 target_concurrent_requests = 2;
+}
+
+// Target scaling by disk usage.
+// Only applicable in the App Engine flexible environment.
+message DiskUtilization {
+  // Target bytes written per second.
+  int32 target_write_bytes_per_second = 14;
+
+  // Target ops written per second.
+  int32 target_write_ops_per_second = 15;
+
+  // Target bytes read per second.
+  int32 target_read_bytes_per_second = 16;
+
+  // Target ops read per seconds.
+  int32 target_read_ops_per_second = 17;
+}
+
+// Target scaling by network usage.
+// Only applicable in the App Engine flexible environment.
+message NetworkUtilization {
+  // Target bytes sent per second.
+  int32 target_sent_bytes_per_second = 1;
+
+  // Target packets sent per second.
+  int32 target_sent_packets_per_second = 11;
+
+  // Target bytes received per second.
+  int32 target_received_bytes_per_second = 12;
+
+  // Target packets received per second.
+  int32 target_received_packets_per_second = 13;
+}
+
+// Allows autoscaling based on Stackdriver metrics.
+message CustomMetric {
+  // The name of the metric.
+  string metric_name = 1;
+
+  // The type of the metric. Must be a string representing a Stackdriver
+  // metric type e.g. GAGUE, DELTA_PER_SECOND, etc.
+  string target_type = 2;
+
+  // The target spec.
+  oneof target_spec {
+    // The target value for the metric.
+    double target_utilization = 3;
+
+    // May be used instead of `target_utilization` when an instance can handle a
+    // specific amount of work/resources and the metric value is equal to the
+    // current amount of work remaining. The autoscaler will try to keep the
+    // number of instances equal to the metric value divided by
+    // `single_instance_assignment`.
+    double single_instance_assignment = 4;
+  }
+
+  // Allows filtering on the metric's fields.
+  string filter = 5;
+}
+
+// Scheduler settings for standard environment.
+message StandardSchedulerSettings {
+  // Target CPU utilization ratio to maintain when scaling.
+  double target_cpu_utilization = 1;
+
+  // Target throughput utilization ratio to maintain when scaling
+  double target_throughput_utilization = 2;
+
+  // Minimum number of instances to run for this version. Set to zero to disable
+  // `min_instances` configuration.
+  int32 min_instances = 3;
+
+  // Maximum number of instances to run for this version. Set to zero to disable
+  // `max_instances` configuration.
+  int32 max_instances = 4;
+}
+
+// Extra network settings.
+// Only applicable in the App Engine flexible environment.
+message Network {
+  // List of ports, or port pairs, to forward from the virtual machine to the
+  // application container.
+  // Only applicable in the App Engine flexible environment.
+  repeated string forwarded_ports = 1;
+
+  // Tag to apply to the instance during creation.
+  // Only applicable in the App Engine flexible environment.
+  string instance_tag = 2;
+
+  // Google Compute Engine network where the virtual machines are created.
+  // Specify the short name, not the resource path.
+  //
+  // Defaults to `default`.
+  string name = 3;
+
+  // Google Cloud Platform sub-network where the virtual machines are created.
+  // Specify the short name, not the resource path.
+  //
+  // If a subnetwork name is specified, a network name will also be required
+  // unless it is for the default network.
+  //
+  // * If the network that the instance is being created in is a Legacy network,
+  // then the IP address is allocated from the IPv4Range.
+  // * If the network that the instance is being created in is an auto Subnet
+  // Mode Network, then only network name should be specified (not the
+  // subnetwork_name) and the IP address is created from the IPCidrRange of the
+  // subnetwork that exists in that zone for that network.
+  // * If the network that the instance is being created in is a custom Subnet
+  // Mode Network, then the subnetwork_name must be specified and the
+  // IP address is created from the IPCidrRange of the subnetwork.
+  //
+  // If specified, the subnetwork must exist in the same region as the
+  // App Engine flexible environment application.
+  string subnetwork_name = 4;
+
+  // Enable session affinity.
+  // Only applicable in the App Engine flexible environment.
+  bool session_affinity = 5;
+}
+
+// Volumes mounted within the app container.
+// Only applicable in the App Engine flexible environment.
+message Volume {
+  // Unique name for the volume.
+  string name = 1;
+
+  // Underlying volume type, e.g. 'tmpfs'.
+  string volume_type = 2;
+
+  // Volume size in gigabytes.
+  double size_gb = 3;
+}
+
+// Machine resources for a version.
+message Resources {
+  // Number of CPU cores needed.
+  double cpu = 1;
+
+  // Disk size (GB) needed.
+  double disk_gb = 2;
+
+  // Memory (GB) needed.
+  double memory_gb = 3;
+
+  // User specified volumes.
+  repeated Volume volumes = 4;
+
+  // The name of the encryption key that is stored in Google Cloud KMS.
+  // Only should be used by Cloud Composer to encrypt the vm disk
+  string kms_key_reference = 5;
+}
+
+// VPC access connector specification.
+message VpcAccessConnector {
+  // Full Serverless VPC Access Connector name e.g.
+  // /projects/my-project/locations/us-central1/connectors/c1.
+  string name = 1;
+}
+
+// The entrypoint for the application.
+message Entrypoint {
+  // The command to run.
+  oneof command {
+    // The format should be a shell command that can be fed to `bash -c`.
+    string shell = 1;
+  }
+}
+
+// Available inbound services.
+enum InboundServiceType {
+  // Not specified.
+  INBOUND_SERVICE_UNSPECIFIED = 0;
+
+  // Allows an application to receive mail.
+  INBOUND_SERVICE_MAIL = 1;
+
+  // Allows an application to receive email-bound notifications.
+  INBOUND_SERVICE_MAIL_BOUNCE = 2;
+
+  // Allows an application to receive error stanzas.
+  INBOUND_SERVICE_XMPP_ERROR = 3;
+
+  // Allows an application to receive instant messages.
+  INBOUND_SERVICE_XMPP_MESSAGE = 4;
+
+  // Allows an application to receive user subscription POSTs.
+  INBOUND_SERVICE_XMPP_SUBSCRIBE = 5;
+
+  // Allows an application to receive a user's chat presence.
+  INBOUND_SERVICE_XMPP_PRESENCE = 6;
+
+  // Registers an application for notifications when a client connects or
+  // disconnects from a channel.
+  INBOUND_SERVICE_CHANNEL_PRESENCE = 7;
+
+  // Enables warmup requests.
+  INBOUND_SERVICE_WARMUP = 9;
+}
+
+// Run states of a version.
+enum ServingStatus {
+  // Not specified.
+  SERVING_STATUS_UNSPECIFIED = 0;
+
+  // Currently serving. Instances are created according to the
+  // scaling settings of the version.
+  SERVING = 1;
+
+  // Disabled. No instances will be created and the scaling
+  // settings are ignored until the state of the version changes
+  // to `SERVING`.
+  STOPPED = 2;
+}