@databricks/sdk-networking 0.0.0-dev → 0.1.0-dev.2

package/dist/v1/model.js

@@ -0,0 +1,2401 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+import { Temporal } from '@js-temporal/polyfill';
+import { FieldMask } from '@databricks/sdk-core/wkt';
+import { z } from 'zod';
+export var CustomerFacingVpcEndpointUseCase;
+(function (CustomerFacingVpcEndpointUseCase) {
+    CustomerFacingVpcEndpointUseCase["WORKSPACE_ACCESS"] = "WORKSPACE_ACCESS";
+    CustomerFacingVpcEndpointUseCase["DATAPLANE_RELAY_ACCESS"] = "DATAPLANE_RELAY_ACCESS";
+    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
+    CustomerFacingVpcEndpointUseCase["GENERAL_ACCESS"] = "GENERAL_ACCESS";
+})(CustomerFacingVpcEndpointUseCase || (CustomerFacingVpcEndpointUseCase = {}));
+/**
+ * The target resources that are supported by Network Connectivity Config.
+ * Note: some egress types can support general types that are not defined in EgressResourceType.
+ * E.g.: Azure private endpoint supports private link enabled Azure services.
+ */
+export var EgressResourceType;
+(function (EgressResourceType) {
+    EgressResourceType["EGRESS_RESOURCE_TYPE_UNSPECIFIED"] = "EGRESS_RESOURCE_TYPE_UNSPECIFIED";
+    EgressResourceType["AZURE_BLOB_STORAGE"] = "AZURE_BLOB_STORAGE";
+})(EgressResourceType || (EgressResourceType = {}));
+export var EndpointState;
+(function (EndpointState) {
+    /** The endpoint is pending approval. */
+    EndpointState["PENDING"] = "PENDING";
+    /** The endpoint has been approved and is ready for use. */
+    EndpointState["APPROVED"] = "APPROVED";
+    /** The endpoint encountered some issues during setup. */
+    EndpointState["FAILED"] = "FAILED";
+    /** The endpoint was once established but later disconnected. This endpoint doesn't provide connectivity. */
+    EndpointState["DISCONNECTED"] = "DISCONNECTED";
+})(EndpointState || (EndpointState = {}));
+/**
+ * Type of IP access list. Valid values are as follows and are case-sensitive:
+ *
+ * * `ALLOW`: An allow list. Include this IP or range.
+ * * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
+ */
+export var IpAccessListType;
+(function (IpAccessListType) {
+    IpAccessListType["ALLOW"] = "ALLOW";
+    /** Blocks the associated CIDRs. */
+    IpAccessListType["BLOCK"] = "BLOCK";
+})(IpAccessListType || (IpAccessListType = {}));
+export var PrivateAccessLevel;
+(function (PrivateAccessLevel) {
+    /** Only specifically listed endpoints can access my workspace */
+    PrivateAccessLevel["ENDPOINT"] = "ENDPOINT";
+    /** Only endpoints in the same account can access my workspace */
+    PrivateAccessLevel["ACCOUNT"] = "ACCOUNT";
+})(PrivateAccessLevel || (PrivateAccessLevel = {}));
+export var VpcStatus;
+(function (VpcStatus) {
+    VpcStatus["VALID"] = "VALID";
+    VpcStatus["BROKEN"] = "BROKEN";
+    VpcStatus["UNATTACHED"] = "UNATTACHED";
+    /** Some optional tests are failing for this Vpc, see NetworkWarning for more information */
+    VpcStatus["WARNED"] = "WARNED";
+})(VpcStatus || (VpcStatus = {}));
+/**
+ * Type of IP access list. Valid values are as follows and are case-sensitive:
+ *
+ * * `ALLOW`: An allow list. Include this IP or range.
+ * * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var AccountIpAccessListType_IpAccessListType;
+(function (AccountIpAccessListType_IpAccessListType) {
+    /** Allows the associated CIDRs. */
+    AccountIpAccessListType_IpAccessListType["ALLOW"] = "ALLOW";
+    /** Blocks the associated CIDRs. */
+    AccountIpAccessListType_IpAccessListType["BLOCK"] = "BLOCK";
+})(AccountIpAccessListType_IpAccessListType || (AccountIpAccessListType_IpAccessListType = {}));
+/**
+ * Qualifies the breadth of API access permitted by an ingress network policy rule.
+ * API_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;
+ * API_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_ApiScopeQualifier;
+(function (CustomerFacingIngressNetworkPolicy_ApiScopeQualifier) {
+    /** Narrows matching to read-only variants of the listed scopes (e.g. GET/HEAD requests). */
+    CustomerFacingIngressNetworkPolicy_ApiScopeQualifier["API_SCOPE_QUALIFIER_READ"] = "API_SCOPE_QUALIFIER_READ";
+    /** Matches any scope regardless of access level. */
+    CustomerFacingIngressNetworkPolicy_ApiScopeQualifier["API_SCOPE_QUALIFIER_ALL"] = "API_SCOPE_QUALIFIER_ALL";
+})(CustomerFacingIngressNetworkPolicy_ApiScopeQualifier || (CustomerFacingIngressNetworkPolicy_ApiScopeQualifier = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_Authentication_IdentityType;
+(function (CustomerFacingIngressNetworkPolicy_Authentication_IdentityType) {
+    CustomerFacingIngressNetworkPolicy_Authentication_IdentityType["IDENTITY_TYPE_UNSPECIFIED"] = "IDENTITY_TYPE_UNSPECIFIED";
+    CustomerFacingIngressNetworkPolicy_Authentication_IdentityType["IDENTITY_TYPE_ALL_USERS"] = "IDENTITY_TYPE_ALL_USERS";
+    CustomerFacingIngressNetworkPolicy_Authentication_IdentityType["IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS"] = "IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS";
+    CustomerFacingIngressNetworkPolicy_Authentication_IdentityType["IDENTITY_TYPE_SELECTED_IDENTITIES"] = "IDENTITY_TYPE_SELECTED_IDENTITIES";
+})(CustomerFacingIngressNetworkPolicy_Authentication_IdentityType || (CustomerFacingIngressNetworkPolicy_Authentication_IdentityType = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType;
+(function (CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType) {
+    CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType["PRINCIPAL_TYPE_UNSPECIFIED"] = "PRINCIPAL_TYPE_UNSPECIFIED";
+    CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType["PRINCIPAL_TYPE_USER"] = "PRINCIPAL_TYPE_USER";
+    CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType["PRINCIPAL_TYPE_SERVICE_PRINCIPAL"] = "PRINCIPAL_TYPE_SERVICE_PRINCIPAL";
+})(CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType || (CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode;
+(function (CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode) {
+    CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode["FULL_ACCESS"] = "FULL_ACCESS";
+    CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode["RESTRICTED_ACCESS"] = "RESTRICTED_ACCESS";
+})(CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode || (CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode;
+(function (CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode) {
+    CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode["ALLOW_ALL_REGISTERED_ENDPOINTS"] = "ALLOW_ALL_REGISTERED_ENDPOINTS";
+    CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode["RESTRICTED_ACCESS"] = "RESTRICTED_ACCESS";
+})(CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode || (CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode;
+(function (CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode) {
+    CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode["FULL_ACCESS"] = "FULL_ACCESS";
+    CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode["RESTRICTED_ACCESS"] = "RESTRICTED_ACCESS";
+})(CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode || (CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState;
+(function (CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState) {
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED"] = "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
+    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["ESTABLISHED"] = "ESTABLISHED";
+    /** Connection was rejected by the private link resource owner. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["REJECTED"] = "REJECTED";
+    /**
+     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
+     * be deleted for clean-up.
+     */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["DISCONNECTED"] = "DISCONNECTED";
+    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["EXPIRED"] = "EXPIRED";
+    /** The endpoint has been created and pending approval. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["PENDING"] = "PENDING";
+    /** The endpoint creation is in progress. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["CREATING"] = "CREATING";
+    /** The endpoint creation failed. */
+    CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState["CREATE_FAILED"] = "CREATE_FAILED";
+})(CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState || (CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState;
+(function (CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState) {
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED"] = "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
+    /** The endpoint has been created and pending approval. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["INIT"] = "INIT";
+    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["ESTABLISHED"] = "ESTABLISHED";
+    /** Connection was rejected by the private link resource owner. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["REJECTED"] = "REJECTED";
+    /**
+     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
+     * be deleted for clean-up.
+     */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["DISCONNECTED"] = "DISCONNECTED";
+    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["EXPIRED"] = "EXPIRED";
+    /** The endpoint has been created and pending approval. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["PENDING"] = "PENDING";
+    /** The endpoint creation is in progress. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["CREATING"] = "CREATING";
+    /** The endpoint creation failed. */
+    CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState["CREATE_FAILED"] = "CREATE_FAILED";
+})(CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState || (CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType;
+(function (EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType) {
+    EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType["INTERNET_DESTINATION_TYPE_UNSPECIFIED"] = "INTERNET_DESTINATION_TYPE_UNSPECIFIED";
+    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
+    EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType["DNS_NAME"] = "DNS_NAME";
+})(EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType || (EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = {}));
+/** The values should match the list of workloads used in networkconfig.proto */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter;
+(function (EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter) {
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter["DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED"] = "DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED";
+    /** SQL Warehouse product */
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter["DBSQL"] = "DBSQL";
+    /** Machine Learning serving product */
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter["ML_SERVING"] = "ML_SERVING";
+})(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter || (EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode;
+(function (EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode) {
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode["ENFORCEMENT_MODE_UNSPECIFIED"] = "ENFORCEMENT_MODE_UNSPECIFIED";
+    /** Blocks traffic that violates network policy. This is the default mode. */
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode["ENFORCED"] = "ENFORCED";
+    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
+    EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode["DRY_RUN"] = "DRY_RUN";
+})(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode || (EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = {}));
+/**
+ * At which level can <Databricks> and <Databricks> managed compute access Internet.
+ * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
+ * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
+ * as well as UC connections and external locations.
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode;
+(function (EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode) {
+    EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode["RESTRICTION_MODE_UNSPECIFIED"] = "RESTRICTION_MODE_UNSPECIFIED";
+    EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode["FULL_ACCESS"] = "FULL_ACCESS";
+    EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode["RESTRICTED_ACCESS"] = "RESTRICTED_ACCESS";
+})(EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode || (EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType;
+(function (EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType) {
+    EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType["STORAGE_DESTINATION_TYPE_UNSPECIFIED"] = "STORAGE_DESTINATION_TYPE_UNSPECIFIED";
+    /**
+     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
+     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
+     */
+    EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType["AWS_S3"] = "AWS_S3";
+    EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType["AZURE_STORAGE"] = "AZURE_STORAGE";
+    EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType["GOOGLE_CLOUD_STORAGE"] = "GOOGLE_CLOUD_STORAGE";
+})(EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType || (EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var EndpointUseCase_EndpointUseCase;
+(function (EndpointUseCase_EndpointUseCase) {
+    /** service-direct frontend private link connectivity. */
+    EndpointUseCase_EndpointUseCase["SERVICE_DIRECT"] = "SERVICE_DIRECT";
+})(EndpointUseCase_EndpointUseCase || (EndpointUseCase_EndpointUseCase = {}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested enum name.
+export var NccPrivateEndpointRule_PrivateLinkConnectionState;
+(function (NccPrivateEndpointRule_PrivateLinkConnectionState) {
+    NccPrivateEndpointRule_PrivateLinkConnectionState["PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED"] = "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
+    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["ESTABLISHED"] = "ESTABLISHED";
+    /** Connection was rejected by the private link resource owner. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["REJECTED"] = "REJECTED";
+    /**
+     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
+     * be deleted for clean-up.
+     */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["DISCONNECTED"] = "DISCONNECTED";
+    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["EXPIRED"] = "EXPIRED";
+    /** The endpoint has been created and pending approval. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["PENDING"] = "PENDING";
+    /** The endpoint creation is in progress. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["CREATING"] = "CREATING";
+    /** The endpoint creation failed. */
+    NccPrivateEndpointRule_PrivateLinkConnectionState["CREATE_FAILED"] = "CREATE_FAILED";
+})(NccPrivateEndpointRule_PrivateLinkConnectionState || (NccPrivateEndpointRule_PrivateLinkConnectionState = {}));
+export const unmarshalAccountIpAccessListSchema = z
+    .object({
+    list_id: z.string().optional(),
+    label: z.string().optional(),
+    ip_addresses: z.array(z.string()).optional(),
+    address_count: z.number().optional(),
+    list_type: z.enum(AccountIpAccessListType_IpAccessListType).optional(),
+    created_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    created_by: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_by: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    listId: d.list_id,
+    label: d.label,
+    ipAddresses: d.ip_addresses,
+    addressCount: d.address_count,
+    listType: d.list_type,
+    createdAt: d.created_at,
+    createdBy: d.created_by,
+    updatedAt: d.updated_at,
+    updatedBy: d.updated_by,
+    enabled: d.enabled,
+}));
+export const unmarshalAccountNetworkPolicySchema = z
+    .object({
+    network_policy_id: z.string().optional(),
+    account_id: z.string().optional(),
+    egress: z.lazy(() => unmarshalEgressNetworkPolicySchema).optional(),
+    ingress: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicySchema)
+        .optional(),
+    ingress_dry_run: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicySchema)
+        .optional(),
+})
+    .transform(d => ({
+    networkPolicyId: d.network_policy_id,
+    accountId: d.account_id,
+    egress: d.egress,
+    ingress: d.ingress,
+    ingressDryRun: d.ingress_dry_run,
+}));
+export const unmarshalAzurePrivateEndpointInfoSchema = z
+    .object({
+    private_endpoint_name: z.string().optional(),
+    private_endpoint_resource_guid: z.string().optional(),
+    private_endpoint_resource_id: z.string().optional(),
+    private_link_service_id: z.string().optional(),
+})
+    .transform(d => ({
+    privateEndpointName: d.private_endpoint_name,
+    privateEndpointResourceGuid: d.private_endpoint_resource_guid,
+    privateEndpointResourceId: d.private_endpoint_resource_id,
+    privateLinkServiceId: d.private_link_service_id,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCreateAccountIpAccessListRequest_ResponseSchema = z
+    .object({
+    ip_access_list: z
+        .lazy(() => unmarshalAccountIpAccessListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCreateIpAccessList_ResponseSchema = z
+    .object({
+    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+export const unmarshalCustomerFacingGcpVpcEndpointInfoSchema = z
+    .object({
+    psc_connection_id: z.string().optional(),
+    project_id: z.string().optional(),
+    psc_endpoint_name: z.string().optional(),
+    endpoint_region: z.string().optional(),
+    service_attachment_id: z.string().optional(),
+})
+    .transform(d => ({
+    pscConnectionId: d.psc_connection_id,
+    projectId: d.project_id,
+    pscEndpointName: d.psc_endpoint_name,
+    endpointRegion: d.endpoint_region,
+    serviceAttachmentId: d.service_attachment_id,
+}));
+export const unmarshalCustomerFacingIngressNetworkPolicySchema = z
+    .object({
+    public_access: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema)
+        .optional(),
+    private_access: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema)
+        .optional(),
+    cross_workspace_access: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema)
+        .optional(),
+})
+    .transform(d => ({
+    publicAccess: d.public_access,
+    privateAccess: d.private_access,
+    crossWorkspaceAccess: d.cross_workspace_access,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema = z
+    .object({
+    scopes: z.array(z.string()).optional(),
+    scope_qualifier: z
+        .enum(CustomerFacingIngressNetworkPolicy_ApiScopeQualifier)
+        .optional(),
+})
+    .transform(d => ({
+    scopes: d.scopes,
+    scopeQualifier: d.scope_qualifier,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema = z
+    .object({
+    identity_type: z
+        .enum(CustomerFacingIngressNetworkPolicy_Authentication_IdentityType)
+        .optional(),
+    identities: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema))
+        .optional(),
+})
+    .transform(d => ({
+    identityType: d.identity_type,
+    identities: d.identities,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema = z
+    .object({
+    principal_type: z
+        .enum(CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType)
+        .optional(),
+    principal_id: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+})
+    .transform(d => ({
+    principalType: d.principal_type,
+    principalId: d.principal_id,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
+    .object({
+    restriction_mode: z
+        .enum(CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode)
+        .optional(),
+    deny_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+    allow_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restrictionMode: d.restriction_mode,
+    denyRules: d.deny_rules,
+    allowRules: d.allow_rules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
+    .object({
+    all_source_workspaces: z.boolean().optional(),
+    selected_workspaces: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    source: d.all_source_workspaces !== undefined
+        ? {
+            $case: 'allSourceWorkspaces',
+            allSourceWorkspaces: d.all_source_workspaces,
+        }
+        : d.selected_workspaces !== undefined
+            ? {
+                $case: 'selectedWorkspaces',
+                selectedWorkspaces: d.selected_workspaces,
+            }
+            : undefined,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
+    .object({
+    endpoint_ids: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    endpointIds: d.endpoint_ids,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
+    .object({
+    ip_ranges: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    ipRanges: d.ip_ranges,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
+    .object({
+    restriction_mode: z
+        .enum(CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode)
+        .optional(),
+    deny_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .optional(),
+    allow_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restrictionMode: d.restriction_mode,
+    denyRules: d.deny_rules,
+    allowRules: d.allow_rules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema = z
+    .object({
+    endpoints: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema)
+        .optional(),
+    all_registered_endpoints: z.boolean().optional(),
+    azure_workspace_private_link: z.boolean().optional(),
+    all_private_access: z.boolean().optional(),
+})
+    .transform(d => ({
+    source: d.endpoints !== undefined
+        ? { $case: 'endpoints', endpoints: d.endpoints }
+        : d.all_registered_endpoints !== undefined
+            ? {
+                $case: 'allRegisteredEndpoints',
+                allRegisteredEndpoints: d.all_registered_endpoints,
+            }
+            : d.azure_workspace_private_link !== undefined
+                ? {
+                    $case: 'azureWorkspacePrivateLink',
+                    azureWorkspacePrivateLink: d.azure_workspace_private_link,
+                }
+                : d.all_private_access !== undefined
+                    ? {
+                        $case: 'allPrivateAccess',
+                        allPrivateAccess: d.all_private_access,
+                    }
+                    : undefined,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
+    .object({
+    restriction_mode: z
+        .enum(CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode)
+        .optional(),
+    deny_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .optional(),
+    allow_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restrictionMode: d.restriction_mode,
+    denyRules: d.deny_rules,
+    allowRules: d.allow_rules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema = z
+    .object({
+    all_ip_ranges: z.boolean().optional(),
+    included_ip_ranges: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema)
+        .optional(),
+    excluded_ip_ranges: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema)
+        .optional(),
+})
+    .transform(d => ({
+    source: d.all_ip_ranges !== undefined
+        ? { $case: 'allIpRanges', allIpRanges: d.all_ip_ranges }
+        : d.included_ip_ranges !== undefined
+            ? {
+                $case: 'includedIpRanges',
+                includedIpRanges: d.included_ip_ranges,
+            }
+            : d.excluded_ip_ranges !== undefined
+                ? {
+                    $case: 'excludedIpRanges',
+                    excludedIpRanges: d.excluded_ip_ranges,
+                }
+                : undefined,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+    workspace_ui: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema)
+        .optional(),
+    workspace_api: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema)
+        .optional(),
+    apps_runtime: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema)
+        .optional(),
+    lakebase_runtime: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
+        .optional(),
+    account_ui: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema)
+        .optional(),
+    account_api: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema)
+        .optional(),
+    account_databricks_one: z
+        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
+        .optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+    workspaceUi: d.workspace_ui,
+    workspaceApi: d.workspace_api,
+    appsRuntime: d.apps_runtime,
+    lakebaseRuntime: d.lakebase_runtime,
+    accountUi: d.account_ui,
+    accountApi: d.account_api,
+    accountDatabricksOne: d.account_databricks_one,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
+    .object({
+    scopes: z.array(z.string()).optional(),
+    scope_qualifier: z
+        .enum(CustomerFacingIngressNetworkPolicy_ApiScopeQualifier)
+        .optional(),
+})
+    .transform(d => ({
+    scopes: d.scopes,
+    scopeQualifier: d.scope_qualifier,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema = z
+    .object({
+    workspace_ids: z
+        .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
+        .optional(),
+})
+    .transform(d => ({
+    workspaceIds: d.workspace_ids,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+export const unmarshalCustomerFacingNetworkConnectivityConfigSchema = z
+    .object({
+    network_connectivity_config_id: z.string().optional(),
+    account_id: z.string().optional(),
+    name: z.string().optional(),
+    region: z.string().optional(),
+    egress_config: z
+        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+})
+    .transform(d => ({
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    accountId: d.account_id,
+    name: d.name,
+    region: d.region,
+    egressConfig: d.egress_config,
+    updatedTime: d.updated_time,
+    creationTime: d.creation_time,
+}));
+export const unmarshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
+    .object({
+    rule_id: z.string().optional(),
+    network_connectivity_config_id: z.string().optional(),
+    account_id: z.string().optional(),
+    endpoint_service: z.string().optional(),
+    domain_names: z.array(z.string()).optional(),
+    resource_names: z.array(z.string()).optional(),
+    vpc_endpoint_id: z.string().optional(),
+    connection_state: z
+        .enum(CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    deactivated: z.boolean().optional(),
+    deactivated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    enabled: z.boolean().optional(),
+    error_message: z.string().optional(),
+})
+    .transform(d => ({
+    ruleId: d.rule_id,
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    accountId: d.account_id,
+    endpointService: d.endpoint_service,
+    domainNames: d.domain_names,
+    resourceNames: d.resource_names,
+    vpcEndpointId: d.vpc_endpoint_id,
+    connectionState: d.connection_state,
+    creationTime: d.creation_time,
+    updatedTime: d.updated_time,
+    deactivated: d.deactivated,
+    deactivatedAt: d.deactivated_at,
+    enabled: d.enabled,
+    errorMessage: d.error_message,
+}));
+export const unmarshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
+    .object({
+    rule_id: z.string().optional(),
+    network_connectivity_config_id: z.string().optional(),
+    resource_id: z.string().optional(),
+    group_id: z.string().optional(),
+    endpoint_name: z.string().optional(),
+    connection_state: z
+        .enum(CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    deactivated: z.boolean().optional(),
+    deactivated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    domain_names: z.array(z.string()).optional(),
+    error_message: z.string().optional(),
+})
+    .transform(d => ({
+    ruleId: d.rule_id,
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    resourceId: d.resource_id,
+    groupId: d.group_id,
+    endpointName: d.endpoint_name,
+    connectionState: d.connection_state,
+    creationTime: d.creation_time,
+    updatedTime: d.updated_time,
+    deactivated: d.deactivated,
+    deactivatedAt: d.deactivated_at,
+    domainNames: d.domain_names,
+    errorMessage: d.error_message,
+}));
+export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
+    .object({
+    default_rules: z
+        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
+        .optional(),
+    target_rules: z
+        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
+        .optional(),
+})
+    .transform(d => ({
+    defaultRules: d.default_rules,
+    targetRules: d.target_rules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
+    .object({
+    azure_private_endpoint_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
+        .optional(),
+    aws_private_endpoint_rules: z
+        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    azurePrivateEndpointRules: d.azure_private_endpoint_rules,
+    awsPrivateEndpointRules: d.aws_private_endpoint_rules,
+}));
+export const unmarshalCustomerFacingPrivateAccessSettingsSchema = z
+    .object({
+    private_access_settings_id: z.string().optional(),
+    account_id: z.string().optional(),
+    private_access_settings_name: z.string().optional(),
+    region: z.string().optional(),
+    public_access_enabled: z.boolean().optional(),
+    private_access_level: z.enum(PrivateAccessLevel).optional(),
+    allowed_vpc_endpoint_ids: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    privateAccessSettingsId: d.private_access_settings_id,
+    accountId: d.account_id,
+    privateAccessSettingsName: d.private_access_settings_name,
+    region: d.region,
+    publicAccessEnabled: d.public_access_enabled,
+    privateAccessLevel: d.private_access_level,
+    allowedVpcEndpointIds: d.allowed_vpc_endpoint_ids,
+}));
+export const unmarshalCustomerFacingVpcEndpointSchema = z
+    .object({
+    vpc_endpoint_id: z.string().optional(),
+    account_id: z.string().optional(),
+    vpc_endpoint_name: z.string().optional(),
+    aws_vpc_endpoint_id: z.string().optional(),
+    aws_endpoint_service_id: z.string().optional(),
+    use_case: z.enum(CustomerFacingVpcEndpointUseCase).optional(),
+    region: z.string().optional(),
+    aws_account_id: z.string().optional(),
+    state: z.string().optional(),
+    gcp_vpc_endpoint_info: z
+        .lazy(() => unmarshalCustomerFacingGcpVpcEndpointInfoSchema)
+        .optional(),
+})
+    .transform(d => ({
+    vpcEndpointId: d.vpc_endpoint_id,
+    accountId: d.account_id,
+    vpcEndpointName: d.vpc_endpoint_name,
+    awsVpcEndpointId: d.aws_vpc_endpoint_id,
+    awsEndpointServiceId: d.aws_endpoint_service_id,
+    useCase: d.use_case,
+    region: d.region,
+    awsAccountId: d.aws_account_id,
+    state: d.state,
+    vpcEndpointInfo: d.gcp_vpc_endpoint_info !== undefined
+        ? {
+            $case: 'gcpVpcEndpointInfo',
+            gcpVpcEndpointInfo: d.gcp_vpc_endpoint_info,
+        }
+        : undefined,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalDeleteAccountIpAccessListRequest_ResponseSchema = z.object({});
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalDeleteIpAccessList_ResponseSchema = z.object({});
+export const unmarshalEgressNetworkPolicySchema = z
+    .object({
+    network_access: z
+        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema)
+        .optional(),
+})
+    .transform(d => ({
+    networkAccess: d.network_access,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
+    .object({
+    restriction_mode: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode)
+        .optional(),
+    allowed_internet_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowed_storage_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
+        .optional(),
+    policy_enforcement: z
+        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
+        .optional(),
+    blocked_internet_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restrictionMode: d.restriction_mode,
+    allowedInternetDestinations: d.allowed_internet_destinations,
+    allowedStorageDestinations: d.allowed_storage_destinations,
+    policyEnforcement: d.policy_enforcement,
+    blockedInternetDestinations: d.blocked_internet_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
+    .object({
+    destination: z.string().optional(),
+    internet_destination_type: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType)
+        .optional(),
+})
+    .transform(d => ({
+    destination: d.destination,
+    internetDestinationType: d.internet_destination_type,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
+    .object({
+    enforcement_mode: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode)
+        .optional(),
+    dry_run_mode_product_filter: z
+        .array(z.enum(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter))
+        .optional(),
+})
+    .transform(d => ({
+    enforcementMode: d.enforcement_mode,
+    dryRunModeProductFilter: d.dry_run_mode_product_filter,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
+    .object({
+    bucket_name: z.string().optional(),
+    region: z.string().optional(),
+    storage_destination_type: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType)
+        .optional(),
+    azure_storage_account: z.string().optional(),
+    azure_storage_service: z.string().optional(),
+})
+    .transform(d => ({
+    bucketName: d.bucket_name,
+    region: d.region,
+    storageDestinationType: d.storage_destination_type,
+    azureStorageAccount: d.azure_storage_account,
+    azureStorageService: d.azure_storage_service,
+}));
+export const unmarshalEndpointSchema = z
+    .object({
+    name: z.string().optional(),
+    endpoint_id: z.string().optional(),
+    account_id: z.string().optional(),
+    display_name: z.string().optional(),
+    use_case: z.enum(EndpointUseCase_EndpointUseCase).optional(),
+    region: z.string().optional(),
+    state: z.enum(EndpointState).optional(),
+    azure_private_endpoint_info: z
+        .lazy(() => unmarshalAzurePrivateEndpointInfoSchema)
+        .optional(),
+    create_time: z
+        .string()
+        .transform(s => Temporal.Instant.from(s))
+        .optional(),
+})
+    .transform(d => ({
+    name: d.name,
+    endpointId: d.endpoint_id,
+    accountId: d.account_id,
+    displayName: d.display_name,
+    useCase: d.use_case,
+    region: d.region,
+    state: d.state,
+    endpointInfo: d.azure_private_endpoint_info !== undefined
+        ? {
+            $case: 'azurePrivateEndpointInfo',
+            azurePrivateEndpointInfo: d.azure_private_endpoint_info,
+        }
+        : undefined,
+    createTime: d.create_time,
+}));
+export const unmarshalGcpEndpointSchema = z
+    .object({
+    psc_endpoint_uri: z.string().optional(),
+    service_attachment: z.string().optional(),
+})
+    .transform(d => ({
+    pscEndpointUri: d.psc_endpoint_uri,
+    targetServices: d.service_attachment !== undefined
+        ? {
+            $case: 'serviceAttachment',
+            serviceAttachment: d.service_attachment,
+        }
+        : undefined,
+}));
+export const unmarshalGcpNetworkInfoSchema = z
+    .object({
+    network_project_id: z.string().optional(),
+    vpc_id: z.string().optional(),
+    subnet_id: z.string().optional(),
+    subnet_region: z.string().optional(),
+    pod_ip_range_name: z.string().optional(),
+    service_ip_range_name: z.string().optional(),
+})
+    .transform(d => ({
+    networkProjectId: d.network_project_id,
+    vpcId: d.vpc_id,
+    subnetId: d.subnet_id,
+    subnetRegion: d.subnet_region,
+    podIpRangeName: d.pod_ip_range_name,
+    serviceIpRangeName: d.service_ip_range_name,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalGetAccountIpAccessListRequest_ResponseSchema = z
+    .object({
+    ip_access_list: z
+        .lazy(() => unmarshalAccountIpAccessListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalGetIpAccessList_ResponseSchema = z
+    .object({
+    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+export const unmarshalIpAccessListSchema = z
+    .object({
+    list_id: z.string().optional(),
+    label: z.string().optional(),
+    ip_addresses: z.array(z.string()).optional(),
+    address_count: z.number().optional(),
+    list_type: z.enum(IpAccessListType).optional(),
+    created_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    created_by: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_by: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    listId: d.list_id,
+    label: d.label,
+    ipAddresses: d.ip_addresses,
+    addressCount: d.address_count,
+    listType: d.list_type,
+    createdAt: d.created_at,
+    createdBy: d.created_by,
+    updatedAt: d.updated_at,
+    updatedBy: d.updated_by,
+    enabled: d.enabled,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalListAccountIpAccessListsRequest_ResponseSchema = z
+    .object({
+    ip_access_lists: z
+        .array(z.lazy(() => unmarshalAccountIpAccessListSchema))
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessLists: d.ip_access_lists,
+}));
+export const unmarshalListEndpointsResponseSchema = z
+    .object({
+    items: z.array(z.lazy(() => unmarshalEndpointSchema)).optional(),
+    next_page_token: z.string().optional(),
+})
+    .transform(d => ({
+    items: d.items,
+    nextPageToken: d.next_page_token,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalListIpAccessLists_ResponseSchema = z
+    .object({
+    ip_access_lists: z
+        .array(z.lazy(() => unmarshalIpAccessListSchema))
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessLists: d.ip_access_lists,
+}));
+export const unmarshalListNccPrivateEndpointRulesResponseSchema = z
+    .object({
+    items: z
+        .array(z.lazy(() => unmarshalNccPrivateEndpointRuleSchema))
+        .optional(),
+    next_page_token: z.string().optional(),
+})
+    .transform(d => ({
+    items: d.items,
+    nextPageToken: d.next_page_token,
+}));
+export const unmarshalListNetworkConnectivityConfigsResponseSchema = z
+    .object({
+    items: z
+        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigSchema))
+        .optional(),
+    next_page_token: z.string().optional(),
+})
+    .transform(d => ({
+    items: d.items,
+    nextPageToken: d.next_page_token,
+}));
+export const unmarshalListNetworkPoliciesResponseSchema = z
+    .object({
+    items: z
+        .array(z.lazy(() => unmarshalAccountNetworkPolicySchema))
+        .optional(),
+    next_page_token: z.string().optional(),
+})
+    .transform(d => ({
+    items: d.items,
+    nextPageToken: d.next_page_token,
+}));
+export const unmarshalNccPrivateEndpointRuleSchema = z
+    .object({
+    rule_id: z.string().optional(),
+    network_connectivity_config_id: z.string().optional(),
+    connection_state: z
+        .enum(NccPrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    domain_names: z.array(z.string()).optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    deactivated: z.boolean().optional(),
+    deactivated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    error_message: z.string().optional(),
+    resource_id: z.string().optional(),
+    group_id: z.string().optional(),
+    endpoint_name: z.string().optional(),
+    account_id: z.string().optional(),
+    endpoint_service: z.string().optional(),
+    resource_names: z.array(z.string()).optional(),
+    vpc_endpoint_id: z.string().optional(),
+    enabled: z.boolean().optional(),
+    gcp_endpoint: z.lazy(() => unmarshalGcpEndpointSchema).optional(),
+})
+    .transform(d => ({
+    ruleId: d.rule_id,
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    connectionState: d.connection_state,
+    domainNames: d.domain_names,
+    creationTime: d.creation_time,
+    updatedTime: d.updated_time,
+    deactivated: d.deactivated,
+    deactivatedAt: d.deactivated_at,
+    errorMessage: d.error_message,
+    resourceId: d.resource_id,
+    groupId: d.group_id,
+    endpointName: d.endpoint_name,
+    accountId: d.account_id,
+    endpointService: d.endpoint_service,
+    resourceNames: d.resource_names,
+    vpcEndpointId: d.vpc_endpoint_id,
+    enabled: d.enabled,
+    endpoint: d.gcp_endpoint !== undefined
+        ? { $case: 'gcpEndpoint', gcpEndpoint: d.gcp_endpoint }
+        : undefined,
+}));
+export const unmarshalNetworkSchema = z
+    .object({
+    network_id: z.string().optional(),
+    account_id: z.string().optional(),
+    workspace_id: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    vpc_id: z.string().optional(),
+    subnet_ids: z.array(z.string()).optional(),
+    security_group_ids: z.array(z.string()).optional(),
+    vpc_status: z.enum(VpcStatus).optional(),
+    error_messages: z
+        .array(z.lazy(() => unmarshalNetworkHealthSchema))
+        .optional(),
+    network_name: z.string().optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    warning_messages: z
+        .array(z.lazy(() => unmarshalNetworkWarningSchema))
+        .optional(),
+    vpc_endpoints: z.lazy(() => unmarshalNetworkVpcEndpointsSchema).optional(),
+    gcp_network_info: z.lazy(() => unmarshalGcpNetworkInfoSchema).optional(),
+})
+    .transform(d => ({
+    networkId: d.network_id,
+    accountId: d.account_id,
+    workspaceId: d.workspace_id,
+    vpcId: d.vpc_id,
+    subnetIds: d.subnet_ids,
+    securityGroupIds: d.security_group_ids,
+    vpcStatus: d.vpc_status,
+    errorMessages: d.error_messages,
+    networkName: d.network_name,
+    creationTime: d.creation_time,
+    warningMessages: d.warning_messages,
+    vpcEndpoints: d.vpc_endpoints,
+    networkInfo: d.gcp_network_info !== undefined
+        ? { $case: 'gcpNetworkInfo', gcpNetworkInfo: d.gcp_network_info }
+        : undefined,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
+    .object({
+    azure_service_endpoint_rule: z
+        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema)
+        .optional(),
+    aws_stable_ip_rule: z
+        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema)
+        .optional(),
+})
+    .transform(d => ({
+    azureServiceEndpointRule: d.azure_service_endpoint_rule,
+    awsStableIpRule: d.aws_stable_ip_rule,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z
+    .object({
+    cidr_blocks: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    cidrBlocks: d.cidr_blocks,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z
+    .object({
+    target_region: z.string().optional(),
+    target_services: z.array(z.enum(EgressResourceType)).optional(),
+    subnets: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    targetRegion: d.target_region,
+    targetServices: d.target_services,
+    subnets: d.subnets,
+}));
+export const unmarshalNetworkHealthSchema = z
+    .object({
+    error_type: z.string().optional(),
+    error_message: z.string().optional(),
+})
+    .transform(d => ({
+    errorType: d.error_type,
+    errorMessage: d.error_message,
+}));
+export const unmarshalNetworkVpcEndpointsSchema = z
+    .object({
+    rest_api: z.array(z.string()).optional(),
+    dataplane_relay: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    restApi: d.rest_api,
+    dataplaneRelay: d.dataplane_relay,
+}));
+export const unmarshalNetworkWarningSchema = z
+    .object({
+    warning_type: z.string().optional(),
+    warning_message: z.string().optional(),
+})
+    .transform(d => ({
+    warningType: d.warning_type,
+    warningMessage: d.warning_message,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalReplaceAccountIpAccessListRequest_ResponseSchema = z
+    .object({
+    ip_access_list: z
+        .lazy(() => unmarshalAccountIpAccessListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalReplaceIpAccessList_ResponseSchema = z
+    .object({
+    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalUpdateAccountIpAccessListRequest_ResponseSchema = z
+    .object({
+    ip_access_list: z
+        .lazy(() => unmarshalAccountIpAccessListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalUpdateIpAccessList_ResponseSchema = z
+    .object({
+    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+export const unmarshalWorkspaceNetworkOptionSchema = z
+    .object({
+    network_policy_id: z.string().optional(),
+    workspace_id: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+})
+    .transform(d => ({
+    networkPolicyId: d.network_policy_id,
+    workspaceId: d.workspace_id,
+}));
+export const marshalAccountNetworkPolicySchema = z
+    .object({
+    networkPolicyId: z.string().optional(),
+    accountId: z.string().optional(),
+    egress: z.lazy(() => marshalEgressNetworkPolicySchema).optional(),
+    ingress: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicySchema)
+        .optional(),
+    ingressDryRun: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicySchema)
+        .optional(),
+})
+    .transform(d => ({
+    network_policy_id: d.networkPolicyId,
+    account_id: d.accountId,
+    egress: d.egress,
+    ingress: d.ingress,
+    ingress_dry_run: d.ingressDryRun,
+}));
+export const marshalAzurePrivateEndpointInfoSchema = z
+    .object({
+    privateEndpointName: z.string().optional(),
+    privateEndpointResourceGuid: z.string().optional(),
+    privateEndpointResourceId: z.string().optional(),
+    privateLinkServiceId: z.string().optional(),
+})
+    .transform(d => ({
+    private_endpoint_name: d.privateEndpointName,
+    private_endpoint_resource_guid: d.privateEndpointResourceGuid,
+    private_endpoint_resource_id: d.privateEndpointResourceId,
+    private_link_service_id: d.privateLinkServiceId,
+}));
+export const marshalCreateAccountIpAccessListRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    label: z.string().optional(),
+    listType: z.enum(AccountIpAccessListType_IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+}));
+export const marshalCreateIpAccessListSchema = z
+    .object({
+    label: z.string().optional(),
+    listType: z.enum(IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+}));
+export const marshalCreateNetworkConnectivityConfigurationSchema = z
+    .object({
+    networkConnectivityConfigId: z.string().optional(),
+    accountId: z.string().optional(),
+    name: z.string().optional(),
+    region: z.string().optional(),
+    egressConfig: z
+        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
+        .optional(),
+    updatedTime: z.bigint().optional(),
+    creationTime: z.bigint().optional(),
+})
+    .transform(d => ({
+    network_connectivity_config_id: d.networkConnectivityConfigId,
+    account_id: d.accountId,
+    name: d.name,
+    region: d.region,
+    egress_config: d.egressConfig,
+    updated_time: d.updatedTime,
+    creation_time: d.creationTime,
+}));
+export const marshalCreateNetworkRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    networkName: z.string().optional(),
+    vpcId: z.string().optional(),
+    subnetIds: z.array(z.string()).optional(),
+    securityGroupIds: z.array(z.string()).optional(),
+    vpcEndpoints: z.lazy(() => marshalNetworkVpcEndpointsSchema).optional(),
+    gcpNetworkInfo: z.lazy(() => marshalGcpNetworkInfoSchema).optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    network_name: d.networkName,
+    vpc_id: d.vpcId,
+    subnet_ids: d.subnetIds,
+    security_group_ids: d.securityGroupIds,
+    vpc_endpoints: d.vpcEndpoints,
+    gcp_network_info: d.gcpNetworkInfo,
+}));
+export const marshalCreatePrivateAccessSettingsRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    privateAccessSettingsName: z.string().optional(),
+    region: z.string().optional(),
+    publicAccessEnabled: z.boolean().optional(),
+    privateAccessLevel: z.enum(PrivateAccessLevel).optional(),
+    allowedVpcEndpointIds: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    private_access_settings_name: d.privateAccessSettingsName,
+    region: d.region,
+    public_access_enabled: d.publicAccessEnabled,
+    private_access_level: d.privateAccessLevel,
+    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
+}));
+export const marshalCreatePrivateEndpointRuleSchema = z
+    .object({
+    ruleId: z.string().optional(),
+    networkConnectivityConfigId: z.string().optional(),
+    connectionState: z
+        .enum(NccPrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    domainNames: z.array(z.string()).optional(),
+    creationTime: z.bigint().optional(),
+    updatedTime: z.bigint().optional(),
+    deactivated: z.boolean().optional(),
+    deactivatedAt: z.bigint().optional(),
+    errorMessage: z.string().optional(),
+    resourceId: z.string().optional(),
+    groupId: z.string().optional(),
+    endpointName: z.string().optional(),
+    accountId: z.string().optional(),
+    endpointService: z.string().optional(),
+    resourceNames: z.array(z.string()).optional(),
+    vpcEndpointId: z.string().optional(),
+    enabled: z.boolean().optional(),
+    endpoint: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('gcpEndpoint'),
+            gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    rule_id: d.ruleId,
+    network_connectivity_config_id: d.networkConnectivityConfigId,
+    connection_state: d.connectionState,
+    domain_names: d.domainNames,
+    creation_time: d.creationTime,
+    updated_time: d.updatedTime,
+    deactivated: d.deactivated,
+    deactivated_at: d.deactivatedAt,
+    error_message: d.errorMessage,
+    resource_id: d.resourceId,
+    group_id: d.groupId,
+    endpoint_name: d.endpointName,
+    account_id: d.accountId,
+    endpoint_service: d.endpointService,
+    resource_names: d.resourceNames,
+    vpc_endpoint_id: d.vpcEndpointId,
+    enabled: d.enabled,
+    ...(d.endpoint?.$case === 'gcpEndpoint' && {
+        gcp_endpoint: d.endpoint.gcpEndpoint,
+    }),
+}));
+export const marshalCreateVpcEndpointRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    vpcEndpointName: z.string().optional(),
+    region: z.string().optional(),
+    awsVpcEndpointId: z.string().optional(),
+    vpcEndpointInfo: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('gcpVpcEndpointInfo'),
+            gcpVpcEndpointInfo: z.lazy(() => marshalCustomerFacingGcpVpcEndpointInfoSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    vpc_endpoint_name: d.vpcEndpointName,
+    region: d.region,
+    aws_vpc_endpoint_id: d.awsVpcEndpointId,
+    ...(d.vpcEndpointInfo?.$case === 'gcpVpcEndpointInfo' && {
+        gcp_vpc_endpoint_info: d.vpcEndpointInfo.gcpVpcEndpointInfo,
+    }),
+}));
+export const marshalCustomerFacingGcpVpcEndpointInfoSchema = z
+    .object({
+    pscConnectionId: z.string().optional(),
+    projectId: z.string().optional(),
+    pscEndpointName: z.string().optional(),
+    endpointRegion: z.string().optional(),
+    serviceAttachmentId: z.string().optional(),
+})
+    .transform(d => ({
+    psc_connection_id: d.pscConnectionId,
+    project_id: d.projectId,
+    psc_endpoint_name: d.pscEndpointName,
+    endpoint_region: d.endpointRegion,
+    service_attachment_id: d.serviceAttachmentId,
+}));
+export const marshalCustomerFacingIngressNetworkPolicySchema = z
+    .object({
+    publicAccess: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema)
+        .optional(),
+    privateAccess: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema)
+        .optional(),
+    crossWorkspaceAccess: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema)
+        .optional(),
+})
+    .transform(d => ({
+    public_access: d.publicAccess,
+    private_access: d.privateAccess,
+    cross_workspace_access: d.crossWorkspaceAccess,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema = z
+    .object({
+    scopes: z.array(z.string()).optional(),
+    scopeQualifier: z
+        .enum(CustomerFacingIngressNetworkPolicy_ApiScopeQualifier)
+        .optional(),
+})
+    .transform(d => ({
+    scopes: d.scopes,
+    scope_qualifier: d.scopeQualifier,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema = z
+    .object({
+    identityType: z
+        .enum(CustomerFacingIngressNetworkPolicy_Authentication_IdentityType)
+        .optional(),
+    identities: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema))
+        .optional(),
+})
+    .transform(d => ({
+    identity_type: d.identityType,
+    identities: d.identities,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema = z
+    .object({
+    principalType: z
+        .enum(CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType)
+        .optional(),
+    principalId: z.bigint().optional(),
+})
+    .transform(d => ({
+    principal_type: d.principalType,
+    principal_id: d.principalId,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
+    .object({
+    restrictionMode: z
+        .enum(CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode)
+        .optional(),
+    denyRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+    allowRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restriction_mode: d.restrictionMode,
+    deny_rules: d.denyRules,
+    allow_rules: d.allowRules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
+    .object({
+    source: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('allSourceWorkspaces'),
+            allSourceWorkspaces: z.boolean(),
+        }),
+        z.object({
+            $case: z.literal('selectedWorkspaces'),
+            selectedWorkspaces: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    ...(d.source?.$case === 'allSourceWorkspaces' && {
+        all_source_workspaces: d.source.allSourceWorkspaces,
+    }),
+    ...(d.source?.$case === 'selectedWorkspaces' && {
+        selected_workspaces: d.source.selectedWorkspaces,
+    }),
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
+    .object({
+    endpointIds: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    endpoint_ids: d.endpointIds,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
+    .object({
+    ipRanges: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    ip_ranges: d.ipRanges,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
+    .object({
+    restrictionMode: z
+        .enum(CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode)
+        .optional(),
+    denyRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .optional(),
+    allowRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restriction_mode: d.restrictionMode,
+    deny_rules: d.denyRules,
+    allow_rules: d.allowRules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema = z
+    .object({
+    source: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('endpoints'),
+            endpoints: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema),
+        }),
+        z.object({
+            $case: z.literal('allRegisteredEndpoints'),
+            allRegisteredEndpoints: z.boolean(),
+        }),
+        z.object({
+            $case: z.literal('azureWorkspacePrivateLink'),
+            azureWorkspacePrivateLink: z.boolean(),
+        }),
+        z.object({
+            $case: z.literal('allPrivateAccess'),
+            allPrivateAccess: z.boolean(),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    ...(d.source?.$case === 'endpoints' && { endpoints: d.source.endpoints }),
+    ...(d.source?.$case === 'allRegisteredEndpoints' && {
+        all_registered_endpoints: d.source.allRegisteredEndpoints,
+    }),
+    ...(d.source?.$case === 'azureWorkspacePrivateLink' && {
+        azure_workspace_private_link: d.source.azureWorkspacePrivateLink,
+    }),
+    ...(d.source?.$case === 'allPrivateAccess' && {
+        all_private_access: d.source.allPrivateAccess,
+    }),
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
+    .object({
+    restrictionMode: z
+        .enum(CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode)
+        .optional(),
+    denyRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .optional(),
+    allowRules: z
+        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restriction_mode: d.restrictionMode,
+    deny_rules: d.denyRules,
+    allow_rules: d.allowRules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema = z
+    .object({
+    origin: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema)
+        .optional(),
+    destination: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .optional(),
+    authentication: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .optional(),
+    label: z.string().optional(),
+})
+    .transform(d => ({
+    origin: d.origin,
+    destination: d.destination,
+    authentication: d.authentication,
+    label: d.label,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema = z
+    .object({
+    source: z
+        .discriminatedUnion('$case', [
+        z.object({ $case: z.literal('allIpRanges'), allIpRanges: z.boolean() }),
+        z.object({
+            $case: z.literal('includedIpRanges'),
+            includedIpRanges: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema),
+        }),
+        z.object({
+            $case: z.literal('excludedIpRanges'),
+            excludedIpRanges: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    ...(d.source?.$case === 'allIpRanges' && {
+        all_ip_ranges: d.source.allIpRanges,
+    }),
+    ...(d.source?.$case === 'includedIpRanges' && {
+        included_ip_ranges: d.source.includedIpRanges,
+    }),
+    ...(d.source?.$case === 'excludedIpRanges' && {
+        excluded_ip_ranges: d.source.excludedIpRanges,
+    }),
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+    workspaceUi: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema)
+        .optional(),
+    workspaceApi: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema)
+        .optional(),
+    appsRuntime: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema)
+        .optional(),
+    lakebaseRuntime: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
+        .optional(),
+    accountUi: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema)
+        .optional(),
+    accountApi: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema)
+        .optional(),
+    accountDatabricksOne: z
+        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
+        .optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+    workspace_ui: d.workspaceUi,
+    workspace_api: d.workspaceApi,
+    apps_runtime: d.appsRuntime,
+    lakebase_runtime: d.lakebaseRuntime,
+    account_ui: d.accountUi,
+    account_api: d.accountApi,
+    account_databricks_one: d.accountDatabricksOne,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
+    .object({
+    scopes: z.array(z.string()).optional(),
+    scopeQualifier: z
+        .enum(CustomerFacingIngressNetworkPolicy_ApiScopeQualifier)
+        .optional(),
+})
+    .transform(d => ({
+    scopes: d.scopes,
+    scope_qualifier: d.scopeQualifier,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema = z
+    .object({
+    workspaceIds: z.array(z.bigint()).optional(),
+})
+    .transform(d => ({
+    workspace_ids: d.workspaceIds,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
+    .object({
+    allDestinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    all_destinations: d.allDestinations,
+}));
+export const marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
+    .object({
+    ruleId: z.string().optional(),
+    networkConnectivityConfigId: z.string().optional(),
+    accountId: z.string().optional(),
+    endpointService: z.string().optional(),
+    domainNames: z.array(z.string()).optional(),
+    resourceNames: z.array(z.string()).optional(),
+    vpcEndpointId: z.string().optional(),
+    connectionState: z
+        .enum(CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    creationTime: z.bigint().optional(),
+    updatedTime: z.bigint().optional(),
+    deactivated: z.boolean().optional(),
+    deactivatedAt: z.bigint().optional(),
+    enabled: z.boolean().optional(),
+    errorMessage: z.string().optional(),
+})
+    .transform(d => ({
+    rule_id: d.ruleId,
+    network_connectivity_config_id: d.networkConnectivityConfigId,
+    account_id: d.accountId,
+    endpoint_service: d.endpointService,
+    domain_names: d.domainNames,
+    resource_names: d.resourceNames,
+    vpc_endpoint_id: d.vpcEndpointId,
+    connection_state: d.connectionState,
+    creation_time: d.creationTime,
+    updated_time: d.updatedTime,
+    deactivated: d.deactivated,
+    deactivated_at: d.deactivatedAt,
+    enabled: d.enabled,
+    error_message: d.errorMessage,
+}));
+export const marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
+    .object({
+    ruleId: z.string().optional(),
+    networkConnectivityConfigId: z.string().optional(),
+    resourceId: z.string().optional(),
+    groupId: z.string().optional(),
+    endpointName: z.string().optional(),
+    connectionState: z
+        .enum(CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    creationTime: z.bigint().optional(),
+    updatedTime: z.bigint().optional(),
+    deactivated: z.boolean().optional(),
+    deactivatedAt: z.bigint().optional(),
+    domainNames: z.array(z.string()).optional(),
+    errorMessage: z.string().optional(),
+})
+    .transform(d => ({
+    rule_id: d.ruleId,
+    network_connectivity_config_id: d.networkConnectivityConfigId,
+    resource_id: d.resourceId,
+    group_id: d.groupId,
+    endpoint_name: d.endpointName,
+    connection_state: d.connectionState,
+    creation_time: d.creationTime,
+    updated_time: d.updatedTime,
+    deactivated: d.deactivated,
+    deactivated_at: d.deactivatedAt,
+    domain_names: d.domainNames,
+    error_message: d.errorMessage,
+}));
+export const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
+    .object({
+    defaultRules: z
+        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
+        .optional(),
+    targetRules: z
+        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
+        .optional(),
+})
+    .transform(d => ({
+    default_rules: d.defaultRules,
+    target_rules: d.targetRules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
+    .object({
+    azurePrivateEndpointRules: z
+        .array(z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
+        .optional(),
+    awsPrivateEndpointRules: z
+        .array(z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    azure_private_endpoint_rules: d.azurePrivateEndpointRules,
+    aws_private_endpoint_rules: d.awsPrivateEndpointRules,
+}));
+export const marshalCustomerFacingPrivateAccessSettingsSchema = z
+    .object({
+    privateAccessSettingsId: z.string().optional(),
+    accountId: z.string().optional(),
+    privateAccessSettingsName: z.string().optional(),
+    region: z.string().optional(),
+    publicAccessEnabled: z.boolean().optional(),
+    privateAccessLevel: z.enum(PrivateAccessLevel).optional(),
+    allowedVpcEndpointIds: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    private_access_settings_id: d.privateAccessSettingsId,
+    account_id: d.accountId,
+    private_access_settings_name: d.privateAccessSettingsName,
+    region: d.region,
+    public_access_enabled: d.publicAccessEnabled,
+    private_access_level: d.privateAccessLevel,
+    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
+}));
+export const marshalEgressNetworkPolicySchema = z
+    .object({
+    networkAccess: z
+        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicySchema)
+        .optional(),
+})
+    .transform(d => ({
+    network_access: d.networkAccess,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
+    .object({
+    restrictionMode: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode)
+        .optional(),
+    allowedInternetDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowedStorageDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
+        .optional(),
+    policyEnforcement: z
+        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
+        .optional(),
+    blockedInternetDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restriction_mode: d.restrictionMode,
+    allowed_internet_destinations: d.allowedInternetDestinations,
+    allowed_storage_destinations: d.allowedStorageDestinations,
+    policy_enforcement: d.policyEnforcement,
+    blocked_internet_destinations: d.blockedInternetDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
+    .object({
+    destination: z.string().optional(),
+    internetDestinationType: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType)
+        .optional(),
+})
+    .transform(d => ({
+    destination: d.destination,
+    internet_destination_type: d.internetDestinationType,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
+    .object({
+    enforcementMode: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode)
+        .optional(),
+    dryRunModeProductFilter: z
+        .array(z.enum(EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter))
+        .optional(),
+})
+    .transform(d => ({
+    enforcement_mode: d.enforcementMode,
+    dry_run_mode_product_filter: d.dryRunModeProductFilter,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
+    .object({
+    bucketName: z.string().optional(),
+    region: z.string().optional(),
+    storageDestinationType: z
+        .enum(EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType)
+        .optional(),
+    azureStorageAccount: z.string().optional(),
+    azureStorageService: z.string().optional(),
+})
+    .transform(d => ({
+    bucket_name: d.bucketName,
+    region: d.region,
+    storage_destination_type: d.storageDestinationType,
+    azure_storage_account: d.azureStorageAccount,
+    azure_storage_service: d.azureStorageService,
+}));
+export const marshalEndpointSchema = z
+    .object({
+    name: z.string().optional(),
+    endpointId: z.string().optional(),
+    accountId: z.string().optional(),
+    displayName: z.string().optional(),
+    useCase: z.enum(EndpointUseCase_EndpointUseCase).optional(),
+    region: z.string().optional(),
+    state: z.enum(EndpointState).optional(),
+    endpointInfo: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('azurePrivateEndpointInfo'),
+            azurePrivateEndpointInfo: z.lazy(() => marshalAzurePrivateEndpointInfoSchema),
+        }),
+    ])
+        .optional(),
+    createTime: z
+        .any()
+        .transform((d) => d.toString())
+        .optional(),
+})
+    .transform(d => ({
+    name: d.name,
+    endpoint_id: d.endpointId,
+    account_id: d.accountId,
+    display_name: d.displayName,
+    use_case: d.useCase,
+    region: d.region,
+    state: d.state,
+    ...(d.endpointInfo?.$case === 'azurePrivateEndpointInfo' && {
+        azure_private_endpoint_info: d.endpointInfo.azurePrivateEndpointInfo,
+    }),
+    create_time: d.createTime,
+}));
+export const marshalGcpEndpointSchema = z
+    .object({
+    pscEndpointUri: z.string().optional(),
+    targetServices: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('serviceAttachment'),
+            serviceAttachment: z.string(),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    psc_endpoint_uri: d.pscEndpointUri,
+    ...(d.targetServices?.$case === 'serviceAttachment' && {
+        service_attachment: d.targetServices.serviceAttachment,
+    }),
+}));
+export const marshalGcpNetworkInfoSchema = z
+    .object({
+    networkProjectId: z.string().optional(),
+    vpcId: z.string().optional(),
+    subnetId: z.string().optional(),
+    subnetRegion: z.string().optional(),
+    podIpRangeName: z.string().optional(),
+    serviceIpRangeName: z.string().optional(),
+})
+    .transform(d => ({
+    network_project_id: d.networkProjectId,
+    vpc_id: d.vpcId,
+    subnet_id: d.subnetId,
+    subnet_region: d.subnetRegion,
+    pod_ip_range_name: d.podIpRangeName,
+    service_ip_range_name: d.serviceIpRangeName,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
+    .object({
+    azureServiceEndpointRule: z
+        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema)
+        .optional(),
+    awsStableIpRule: z
+        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema)
+        .optional(),
+})
+    .transform(d => ({
+    azure_service_endpoint_rule: d.azureServiceEndpointRule,
+    aws_stable_ip_rule: d.awsStableIpRule,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z
+    .object({
+    cidrBlocks: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    cidr_blocks: d.cidrBlocks,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z
+    .object({
+    targetRegion: z.string().optional(),
+    targetServices: z.array(z.enum(EgressResourceType)).optional(),
+    subnets: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    target_region: d.targetRegion,
+    target_services: d.targetServices,
+    subnets: d.subnets,
+}));
+export const marshalNetworkVpcEndpointsSchema = z
+    .object({
+    restApi: z.array(z.string()).optional(),
+    dataplaneRelay: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    rest_api: d.restApi,
+    dataplane_relay: d.dataplaneRelay,
+}));
+export const marshalReplaceAccountIpAccessListRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    listId: z.string().optional(),
+    label: z.string().optional(),
+    listType: z.enum(AccountIpAccessListType_IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    list_id: d.listId,
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+    enabled: d.enabled,
+}));
+export const marshalReplaceIpAccessListSchema = z
+    .object({
+    listId: z.string().optional(),
+    label: z.string().optional(),
+    listType: z.enum(IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    list_id: d.listId,
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+    enabled: d.enabled,
+}));
+export const marshalUpdateAccountIpAccessListRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    listId: z.string().optional(),
+    label: z.string().optional(),
+    listType: z.enum(AccountIpAccessListType_IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    list_id: d.listId,
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+    enabled: d.enabled,
+}));
+export const marshalUpdateIpAccessListSchema = z
+    .object({
+    listId: z.string().optional(),
+    label: z.string().optional(),
+    listType: z.enum(IpAccessListType).optional(),
+    ipAddresses: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+})
+    .transform(d => ({
+    list_id: d.listId,
+    label: d.label,
+    list_type: d.listType,
+    ip_addresses: d.ipAddresses,
+    enabled: d.enabled,
+}));
+export const marshalUpdatePrivateEndpointRuleSchema = z
+    .object({
+    ruleId: z.string().optional(),
+    networkConnectivityConfigId: z.string().optional(),
+    connectionState: z
+        .enum(NccPrivateEndpointRule_PrivateLinkConnectionState)
+        .optional(),
+    domainNames: z.array(z.string()).optional(),
+    creationTime: z.bigint().optional(),
+    updatedTime: z.bigint().optional(),
+    deactivated: z.boolean().optional(),
+    deactivatedAt: z.bigint().optional(),
+    errorMessage: z.string().optional(),
+    resourceId: z.string().optional(),
+    groupId: z.string().optional(),
+    endpointName: z.string().optional(),
+    accountId: z.string().optional(),
+    endpointService: z.string().optional(),
+    resourceNames: z.array(z.string()).optional(),
+    vpcEndpointId: z.string().optional(),
+    enabled: z.boolean().optional(),
+    endpoint: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('gcpEndpoint'),
+            gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    rule_id: d.ruleId,
+    network_connectivity_config_id: d.networkConnectivityConfigId,
+    connection_state: d.connectionState,
+    domain_names: d.domainNames,
+    creation_time: d.creationTime,
+    updated_time: d.updatedTime,
+    deactivated: d.deactivated,
+    deactivated_at: d.deactivatedAt,
+    error_message: d.errorMessage,
+    resource_id: d.resourceId,
+    group_id: d.groupId,
+    endpoint_name: d.endpointName,
+    account_id: d.accountId,
+    endpoint_service: d.endpointService,
+    resource_names: d.resourceNames,
+    vpc_endpoint_id: d.vpcEndpointId,
+    enabled: d.enabled,
+    ...(d.endpoint?.$case === 'gcpEndpoint' && {
+        gcp_endpoint: d.endpoint.gcpEndpoint,
+    }),
+}));
+export const marshalWorkspaceNetworkOptionSchema = z
+    .object({
+    networkPolicyId: z.string().optional(),
+    workspaceId: z.bigint().optional(),
+})
+    .transform(d => ({
+    network_policy_id: d.networkPolicyId,
+    workspace_id: d.workspaceId,
+}));
+const gcpEndpointFieldMaskSchema = {
+    pscEndpointUri: { wire: 'psc_endpoint_uri' },
+    serviceAttachment: { wire: 'service_attachment' },
+};
+const updatePrivateEndpointRuleFieldMaskSchema = {
+    accountId: { wire: 'account_id' },
+    connectionState: { wire: 'connection_state' },
+    creationTime: { wire: 'creation_time' },
+    deactivated: { wire: 'deactivated' },
+    deactivatedAt: { wire: 'deactivated_at' },
+    domainNames: { wire: 'domain_names' },
+    enabled: { wire: 'enabled' },
+    endpointName: { wire: 'endpoint_name' },
+    endpointService: { wire: 'endpoint_service' },
+    errorMessage: { wire: 'error_message' },
+    gcpEndpoint: {
+        wire: 'gcp_endpoint',
+        children: () => gcpEndpointFieldMaskSchema,
+    },
+    groupId: { wire: 'group_id' },
+    networkConnectivityConfigId: { wire: 'network_connectivity_config_id' },
+    resourceId: { wire: 'resource_id' },
+    resourceNames: { wire: 'resource_names' },
+    ruleId: { wire: 'rule_id' },
+    updatedTime: { wire: 'updated_time' },
+    vpcEndpointId: { wire: 'vpc_endpoint_id' },
+};
+export function updatePrivateEndpointRuleFieldMask(...paths) {
+    return FieldMask.build(paths, updatePrivateEndpointRuleFieldMaskSchema);
+}
+//# sourceMappingURL=model.js.map