@databricks/sdk-networking 0.1.0-dev.4 → 0.2.0

package/dist/v1/model.js

@@ -2,13 +2,6 @@
 import { Temporal } from '@js-temporal/polyfill';
 import { FieldMask } from '@databricks/sdk-core/wkt';
 import { z } from 'zod';
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingVpcEndpointUseCase = {
-    WORKSPACE_ACCESS: 'WORKSPACE_ACCESS',
-    DATAPLANE_RELAY_ACCESS: 'DATAPLANE_RELAY_ACCESS',
-    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
-    GENERAL_ACCESS: 'GENERAL_ACCESS',
-};
 /**
  * The target resources that are supported by Network Connectivity Config.
  * Note: some egress types can support general types that are not defined in EgressResourceType.
@@ -50,6 +43,13 @@ export const PrivateAccessLevel = {
     ACCOUNT: 'ACCOUNT',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const VpcEndpointUseCase = {
+    WORKSPACE_ACCESS: 'WORKSPACE_ACCESS',
+    DATAPLANE_RELAY_ACCESS: 'DATAPLANE_RELAY_ACCESS',
+    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
+    GENERAL_ACCESS: 'GENERAL_ACCESS',
+};
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
 export const VpcStatus = {
     VALID: 'VALID',
     BROKEN: 'BROKEN',
@@ -70,48 +70,99 @@ export const AccountIpAccessListType_IpAccessListType = {
     /** Blocks the associated CIDRs. */
     BLOCK: 'BLOCK',
 };
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = {
+    INTERNET_DESTINATION_TYPE_UNSPECIFIED: 'INTERNET_DESTINATION_TYPE_UNSPECIFIED',
+    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
+    DNS_NAME: 'DNS_NAME',
+};
+/** The values should match the list of workloads used in networkconfig.proto */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = {
+    DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: 'DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED',
+    /** SQL Warehouse product */
+    DBSQL: 'DBSQL',
+    /** Machine Learning serving product */
+    ML_SERVING: 'ML_SERVING',
+};
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = {
+    ENFORCEMENT_MODE_UNSPECIFIED: 'ENFORCEMENT_MODE_UNSPECIFIED',
+    /** Blocks traffic that violates network policy. This is the default mode. */
+    ENFORCED: 'ENFORCED',
+    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
+    DRY_RUN: 'DRY_RUN',
+};
+/**
+ * At which level can <Databricks> and <Databricks> managed compute access Internet.
+ * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
+ * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
+ * as well as UC connections and external locations.
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = {
+    RESTRICTION_MODE_UNSPECIFIED: 'RESTRICTION_MODE_UNSPECIFIED',
+    FULL_ACCESS: 'FULL_ACCESS',
+    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
+};
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = {
+    STORAGE_DESTINATION_TYPE_UNSPECIFIED: 'STORAGE_DESTINATION_TYPE_UNSPECIFIED',
+    /**
+     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
+     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
+     */
+    AWS_S3: 'AWS_S3',
+    AZURE_STORAGE: 'AZURE_STORAGE',
+    GOOGLE_CLOUD_STORAGE: 'GOOGLE_CLOUD_STORAGE',
+};
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
+export const EndpointUseCase_EndpointUseCase = {
+    /** service-direct frontend private link connectivity. */
+    SERVICE_DIRECT: 'SERVICE_DIRECT',
+};
 /**
  * Qualifies the breadth of API access permitted by an ingress network policy rule.
  * API_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;
  * API_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.
  */
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_ApiScopeQualifier = {
+export const IngressNetworkPolicy_ApiScopeQualifier = {
     /** Narrows matching to read-only variants of the listed scopes (e.g. GET/HEAD requests). */
     API_SCOPE_QUALIFIER_READ: 'API_SCOPE_QUALIFIER_READ',
     /** Matches any scope regardless of access level. */
     API_SCOPE_QUALIFIER_ALL: 'API_SCOPE_QUALIFIER_ALL',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_Authentication_IdentityType = {
+export const IngressNetworkPolicy_Authentication_IdentityType = {
     IDENTITY_TYPE_UNSPECIFIED: 'IDENTITY_TYPE_UNSPECIFIED',
     IDENTITY_TYPE_ALL_USERS: 'IDENTITY_TYPE_ALL_USERS',
     IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS: 'IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS',
     IDENTITY_TYPE_SELECTED_IDENTITIES: 'IDENTITY_TYPE_SELECTED_IDENTITIES',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType = {
+export const IngressNetworkPolicy_AuthenticationIdentity_PrincipalType = {
     PRINCIPAL_TYPE_UNSPECIFIED: 'PRINCIPAL_TYPE_UNSPECIFIED',
     PRINCIPAL_TYPE_USER: 'PRINCIPAL_TYPE_USER',
     PRINCIPAL_TYPE_SERVICE_PRINCIPAL: 'PRINCIPAL_TYPE_SERVICE_PRINCIPAL',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = {
+export const IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = {
     FULL_ACCESS: 'FULL_ACCESS',
     RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode = {
+export const IngressNetworkPolicy_PrivateAccess_RestrictionMode = {
     ALLOW_ALL_REGISTERED_ENDPOINTS: 'ALLOW_ALL_REGISTERED_ENDPOINTS',
     RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode = {
+export const IngressNetworkPolicy_PublicAccess_RestrictionMode = {
     FULL_ACCESS: 'FULL_ACCESS',
     RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = {
+export const NccPrivateEndpointRule_PrivateLinkConnectionState = {
     PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     ESTABLISHED: 'ESTABLISHED',
@@ -122,7 +173,7 @@ export const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_Priva
      * be deleted for clean-up.
      */
     DISCONNECTED: 'DISCONNECTED',
-    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
+    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
     EXPIRED: 'EXPIRED',
     /** The endpoint has been created and pending approval. */
     PENDING: 'PENDING',
@@ -132,10 +183,8 @@ export const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_Priva
     CREATE_FAILED: 'CREATE_FAILED',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = {
+export const NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = {
     PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
-    /** The endpoint has been created and pending approval. */
-    INIT: 'INIT',
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     ESTABLISHED: 'ESTABLISHED',
     /** Connection was rejected by the private link resource owner. */
@@ -145,7 +194,7 @@ export const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_Pri
      * be deleted for clean-up.
      */
     DISCONNECTED: 'DISCONNECTED',
-    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
+    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
     EXPIRED: 'EXPIRED',
     /** The endpoint has been created and pending approval. */
     PENDING: 'PENDING',
@@ -155,59 +204,10 @@ export const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_Pri
     CREATE_FAILED: 'CREATE_FAILED',
 };
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = {
-    INTERNET_DESTINATION_TYPE_UNSPECIFIED: 'INTERNET_DESTINATION_TYPE_UNSPECIFIED',
-    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
-    DNS_NAME: 'DNS_NAME',
-};
-/** The values should match the list of workloads used in networkconfig.proto */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = {
-    DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: 'DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED',
-    /** SQL Warehouse product */
-    DBSQL: 'DBSQL',
-    /** Machine Learning serving product */
-    ML_SERVING: 'ML_SERVING',
-};
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = {
-    ENFORCEMENT_MODE_UNSPECIFIED: 'ENFORCEMENT_MODE_UNSPECIFIED',
-    /** Blocks traffic that violates network policy. This is the default mode. */
-    ENFORCED: 'ENFORCED',
-    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
-    DRY_RUN: 'DRY_RUN',
-};
-/**
- * At which level can <Databricks> and <Databricks> managed compute access Internet.
- * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
- * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
- * as well as UC connections and external locations.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = {
-    RESTRICTION_MODE_UNSPECIFIED: 'RESTRICTION_MODE_UNSPECIFIED',
-    FULL_ACCESS: 'FULL_ACCESS',
-    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
-};
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = {
-    STORAGE_DESTINATION_TYPE_UNSPECIFIED: 'STORAGE_DESTINATION_TYPE_UNSPECIFIED',
-    /**
-     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
-     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
-     */
-    AWS_S3: 'AWS_S3',
-    AZURE_STORAGE: 'AZURE_STORAGE',
-    GOOGLE_CLOUD_STORAGE: 'GOOGLE_CLOUD_STORAGE',
-};
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EndpointUseCase_EndpointUseCase = {
-    /** service-direct frontend private link connectivity. */
-    SERVICE_DIRECT: 'SERVICE_DIRECT',
-};
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const NccPrivateEndpointRule_PrivateLinkConnectionState = {
+export const NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = {
     PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
+    /** The endpoint has been created and pending approval. */
+    INIT: 'INIT',
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     ESTABLISHED: 'ESTABLISHED',
     /** Connection was rejected by the private link resource owner. */
@@ -268,11 +268,9 @@ export const unmarshalAccountNetworkPolicySchema = z
     network_policy_id: z.string().optional(),
     account_id: z.string().optional(),
     egress: z.lazy(() => unmarshalEgressNetworkPolicySchema).optional(),
-    ingress: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicySchema)
-        .optional(),
+    ingress: z.lazy(() => unmarshalIngressNetworkPolicySchema).optional(),
     ingress_dry_run: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicySchema)
+        .lazy(() => unmarshalIngressNetworkPolicySchema)
         .optional(),
 })
     .transform(d => ({
@@ -311,124 +309,316 @@ export const unmarshalCreateIpAccessListResponseSchema = z
     .transform(d => ({
     ipAccessList: d.ip_access_list,
 }));
-export const unmarshalCustomerFacingGcpVpcEndpointInfoSchema = z
+export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
     .object({
-    psc_connection_id: z.string().optional(),
-    project_id: z.string().optional(),
-    psc_endpoint_name: z.string().optional(),
-    endpoint_region: z.string().optional(),
-    service_attachment_id: z.string().optional(),
+    default_rules: z
+        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
+        .optional(),
+    target_rules: z
+        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
+        .optional(),
 })
     .transform(d => ({
-    pscConnectionId: d.psc_connection_id,
-    projectId: d.project_id,
-    pscEndpointName: d.psc_endpoint_name,
-    endpointRegion: d.endpoint_region,
-    serviceAttachmentId: d.service_attachment_id,
+    defaultRules: d.default_rules,
+    targetRules: d.target_rules,
 }));
-export const unmarshalCustomerFacingIngressNetworkPolicySchema = z
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
     .object({
-    public_access: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema)
-        .optional(),
-    private_access: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema)
+    azure_private_endpoint_rules: z
+        .array(z.lazy(() => unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
         .optional(),
-    cross_workspace_access: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema)
+    aws_private_endpoint_rules: z
+        .array(z.lazy(() => unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
         .optional(),
 })
     .transform(d => ({
-    publicAccess: d.public_access,
-    privateAccess: d.private_access,
-    crossWorkspaceAccess: d.cross_workspace_access,
+    azurePrivateEndpointRules: d.azure_private_endpoint_rules,
+    awsPrivateEndpointRules: d.aws_private_endpoint_rules,
 }));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema = z
+export const unmarshalDeleteAccountIpAccessListResponseSchema = z.object({});
+export const unmarshalDeleteIpAccessListResponseSchema = z.object({});
+export const unmarshalEgressNetworkPolicySchema = z
     .object({
-    scopes: z.array(z.string()).optional(),
-    scope_qualifier: z.string().optional(),
+    network_access: z
+        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema)
+        .optional(),
 })
     .transform(d => ({
-    scopes: d.scopes,
-    scopeQualifier: d.scope_qualifier,
+    networkAccess: d.network_access,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
     .object({
-    all_destinations: z.boolean().optional(),
+    restriction_mode: z.string().optional(),
+    allowed_internet_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowed_storage_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
+        .optional(),
+    policy_enforcement: z
+        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
+        .optional(),
+    blocked_internet_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowed_databricks_destinations: z
+        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
+        .optional(),
 })
     .transform(d => ({
-    allDestinations: d.all_destinations,
+    restrictionMode: d.restriction_mode,
+    allowedInternetDestinations: d.allowed_internet_destinations,
+    allowedStorageDestinations: d.allowed_storage_destinations,
+    policyEnforcement: d.policy_enforcement,
+    blockedInternetDestinations: d.blocked_internet_destinations,
+    allowedDatabricksDestinations: d.allowed_databricks_destinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema = z
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
     .object({
-    all_destinations: z.boolean().optional(),
+    workspace_ids: z
+        .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
+        .optional(),
 })
     .transform(d => ({
-    allDestinations: d.all_destinations,
+    workspaceIds: d.workspace_ids,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
     .object({
-    all_destinations: z.boolean().optional(),
+    destination: z.string().optional(),
+    internet_destination_type: z.string().optional(),
 })
     .transform(d => ({
-    allDestinations: d.all_destinations,
+    destination: d.destination,
+    internetDestinationType: d.internet_destination_type,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema = z
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
     .object({
-    identity_type: z.string().optional(),
-    identities: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema))
-        .optional(),
+    enforcement_mode: z.string().optional(),
+    dry_run_mode_product_filter: z.array(z.string()).optional(),
 })
     .transform(d => ({
-    identityType: d.identity_type,
-    identities: d.identities,
+    enforcementMode: d.enforcement_mode,
+    dryRunModeProductFilter: d.dry_run_mode_product_filter,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema = z
+export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
     .object({
-    principal_type: z.string().optional(),
-    principal_id: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
+    bucket_name: z.string().optional(),
+    region: z.string().optional(),
+    storage_destination_type: z.string().optional(),
+    azure_storage_account: z.string().optional(),
+    azure_storage_service: z.string().optional(),
 })
     .transform(d => ({
-    principalType: d.principal_type,
-    principalId: d.principal_id,
+    bucketName: d.bucket_name,
+    region: d.region,
+    storageDestinationType: d.storage_destination_type,
+    azureStorageAccount: d.azure_storage_account,
+    azureStorageService: d.azure_storage_service,
 }));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
+export const unmarshalEndpointSchema = z
     .object({
-    restriction_mode: z.string().optional(),
-    deny_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+    name: z.string().optional(),
+    endpoint_id: z.string().optional(),
+    account_id: z.string().optional(),
+    display_name: z.string().optional(),
+    use_case: z.string().optional(),
+    region: z.string().optional(),
+    state: z.string().optional(),
+    azure_private_endpoint_info: z
+        .lazy(() => unmarshalAzurePrivateEndpointInfoSchema)
         .optional(),
-    allow_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+    create_time: z
+        .string()
+        .transform(s => Temporal.Instant.from(s))
         .optional(),
 })
     .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    denyRules: d.deny_rules,
-    allowRules: d.allow_rules,
+    name: d.name,
+    endpointId: d.endpoint_id,
+    accountId: d.account_id,
+    displayName: d.display_name,
+    useCase: d.use_case,
+    region: d.region,
+    state: d.state,
+    endpointInfo: d.azure_private_endpoint_info !== undefined
+        ? {
+            $case: 'azurePrivateEndpointInfo',
+            azurePrivateEndpointInfo: d.azure_private_endpoint_info,
+        }
+        : undefined,
+    createTime: d.create_time,
+}));
+export const unmarshalGcpEndpointSchema = z
+    .object({
+    psc_endpoint_uri: z.string().optional(),
+    service_attachment: z.string().optional(),
+})
+    .transform(d => ({
+    pscEndpointUri: d.psc_endpoint_uri,
+    targetServices: d.service_attachment !== undefined
+        ? {
+            $case: 'serviceAttachment',
+            serviceAttachment: d.service_attachment,
+        }
+        : undefined,
+}));
+export const unmarshalGcpNetworkInfoSchema = z
+    .object({
+    network_project_id: z.string().optional(),
+    vpc_id: z.string().optional(),
+    subnet_id: z.string().optional(),
+    subnet_region: z.string().optional(),
+    pod_ip_range_name: z.string().optional(),
+    service_ip_range_name: z.string().optional(),
+})
+    .transform(d => ({
+    networkProjectId: d.network_project_id,
+    vpcId: d.vpc_id,
+    subnetId: d.subnet_id,
+    subnetRegion: d.subnet_region,
+    podIpRangeName: d.pod_ip_range_name,
+    serviceIpRangeName: d.service_ip_range_name,
+}));
+export const unmarshalGcpVpcEndpointInfoSchema = z
+    .object({
+    psc_connection_id: z.string().optional(),
+    project_id: z.string().optional(),
+    psc_endpoint_name: z.string().optional(),
+    endpoint_region: z.string().optional(),
+    service_attachment_id: z.string().optional(),
+})
+    .transform(d => ({
+    pscConnectionId: d.psc_connection_id,
+    projectId: d.project_id,
+    pscEndpointName: d.psc_endpoint_name,
+    endpointRegion: d.endpoint_region,
+    serviceAttachmentId: d.service_attachment_id,
+}));
+export const unmarshalGetAccountIpAccessListResponseSchema = z
+    .object({
+    ip_access_list: z
+        .lazy(() => unmarshalAccountIpAccessListSchema)
+        .optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+export const unmarshalGetIpAccessListResponseSchema = z
+    .object({
+    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
+})
+    .transform(d => ({
+    ipAccessList: d.ip_access_list,
+}));
+export const unmarshalIngressNetworkPolicySchema = z
+    .object({
+    public_access: z
+        .lazy(() => unmarshalIngressNetworkPolicy_PublicAccessSchema)
+        .optional(),
+    private_access: z
+        .lazy(() => unmarshalIngressNetworkPolicy_PrivateAccessSchema)
+        .optional(),
+    cross_workspace_access: z
+        .lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema)
+        .optional(),
+})
+    .transform(d => ({
+    publicAccess: d.public_access,
+    privateAccess: d.private_access,
+    crossWorkspaceAccess: d.cross_workspace_access,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_AccountApiDestinationSchema = z
+    .object({
+    scopes: z.array(z.string()).optional(),
+    scope_qualifier: z.string().optional(),
+})
+    .transform(d => ({
+    scopes: d.scopes,
+    scopeQualifier: d.scope_qualifier,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_AccountUiDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
+    .object({
+    all_destinations: z.boolean().optional(),
+})
+    .transform(d => ({
+    allDestinations: d.all_destinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_AuthenticationSchema = z
+    .object({
+    identity_type: z.string().optional(),
+    identities: z
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema))
+        .optional(),
+})
+    .transform(d => ({
+    identityType: d.identity_type,
+    identities: d.identities,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
+export const unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema = z
+    .object({
+    principal_type: z.string().optional(),
+    principal_id: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+})
+    .transform(d => ({
+    principalType: d.principal_type,
+    principalId: d.principal_id,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
+    .object({
+    restriction_mode: z.string().optional(),
+    deny_rules: z
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+    allow_rules: z
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restrictionMode: d.restriction_mode,
+    denyRules: d.deny_rules,
+    allowRules: d.allow_rules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -439,11 +629,11 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRu
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
+export const unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
     .object({
     all_source_workspaces: z.boolean().optional(),
     selected_workspaces: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceIdListSchema)
         .optional(),
 })
     .transform(d => ({
@@ -460,7 +650,7 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOr
             : undefined,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
+export const unmarshalIngressNetworkPolicy_EndpointsSchema = z
     .object({
     endpoint_ids: z.array(z.string()).optional(),
 })
@@ -468,7 +658,7 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
     endpointIds: d.endpoint_ids,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
+export const unmarshalIngressNetworkPolicy_IpRangesSchema = z
     .object({
     ip_ranges: z.array(z.string()).optional(),
 })
@@ -476,7 +666,7 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
     ipRanges: d.ip_ranges,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
+export const unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
     .object({
     all_destinations: z.boolean().optional(),
 })
@@ -484,14 +674,14 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinat
     allDestinations: d.all_destinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
+export const unmarshalIngressNetworkPolicy_PrivateAccessSchema = z
     .object({
     restriction_mode: z.string().optional(),
     deny_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema))
         .optional(),
     allow_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema))
         .optional(),
 })
     .transform(d => ({
@@ -500,16 +690,16 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
     allowRules: d.allow_rules,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema = z
+export const unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -520,10 +710,10 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchem
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema = z
+export const unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema = z
     .object({
     endpoints: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_EndpointsSchema)
         .optional(),
     all_registered_endpoints: z.boolean().optional(),
     azure_workspace_private_link: z.boolean().optional(),
@@ -550,14 +740,14 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSch
                     : undefined,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
+export const unmarshalIngressNetworkPolicy_PublicAccessSchema = z
     .object({
     restriction_mode: z.string().optional(),
     deny_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema))
         .optional(),
     allow_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema))
         .optional(),
 })
     .transform(d => ({
@@ -566,16 +756,16 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
     allowRules: d.allow_rules,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema = z
+export const unmarshalIngressNetworkPolicy_PublicIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_PublicRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -586,14 +776,14 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema = z
+export const unmarshalIngressNetworkPolicy_PublicRequestOriginSchema = z
     .object({
     all_ip_ranges: z.boolean().optional(),
     included_ip_ranges: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema)
         .optional(),
     excluded_ip_ranges: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema)
         .optional(),
 })
     .transform(d => ({
@@ -612,29 +802,29 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSche
                 : undefined,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema = z
+export const unmarshalIngressNetworkPolicy_RequestDestinationSchema = z
     .object({
     all_destinations: z.boolean().optional(),
     workspace_ui: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema)
         .optional(),
     workspace_api: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema)
         .optional(),
     apps_runtime: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema)
         .optional(),
     lakebase_runtime: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
         .optional(),
     account_ui: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AccountUiDestinationSchema)
         .optional(),
     account_api: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AccountApiDestinationSchema)
         .optional(),
     account_databricks_one: z
-        .lazy(() => unmarshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
+        .lazy(() => unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
         .optional(),
 })
     .transform(d => ({
@@ -648,7 +838,7 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchem
     accountDatabricksOne: d.account_databricks_one,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
+export const unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
     .object({
     scopes: z.array(z.string()).optional(),
     scope_qualifier: z.string().optional(),
@@ -658,7 +848,7 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestination
     scopeQualifier: d.scope_qualifier,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema = z
+export const unmarshalIngressNetworkPolicy_WorkspaceIdListSchema = z
     .object({
     workspace_ids: z
         .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
@@ -668,404 +858,54 @@ export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema =
     workspaceIds: d.workspace_ids,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
+export const unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
     .object({
     all_destinations: z.boolean().optional(),
 })
     .transform(d => ({
     allDestinations: d.all_destinations,
 }));
-export const unmarshalCustomerFacingNetworkConnectivityConfigSchema = z
+export const unmarshalIpAccessListSchema = z
     .object({
-    network_connectivity_config_id: z.string().optional(),
-    account_id: z.string().optional(),
-    name: z.string().optional(),
-    region: z.string().optional(),
-    egress_config: z
-        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    creation_time: z
+    list_id: z.string().optional(),
+    label: z.string().optional(),
+    ip_addresses: z.array(z.string()).optional(),
+    address_count: z.number().optional(),
+    list_type: z.string().optional(),
+    created_at: z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
-})
-    .transform(d => ({
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    accountId: d.account_id,
-    name: d.name,
-    region: d.region,
-    egressConfig: d.egress_config,
-    updatedTime: d.updated_time,
-    creationTime: d.creation_time,
-}));
-export const unmarshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
-    .object({
-    rule_id: z.string().optional(),
-    network_connectivity_config_id: z.string().optional(),
-    account_id: z.string().optional(),
-    endpoint_service: z.string().optional(),
-    domain_names: z.array(z.string()).optional(),
-    resource_names: z.array(z.string()).optional(),
-    vpc_endpoint_id: z.string().optional(),
-    connection_state: z.string().optional(),
-    creation_time: z
+    created_by: z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
-    updated_time: z
+    updated_at: z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
-    deactivated: z.boolean().optional(),
-    deactivated_at: z
+    updated_by: z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
     enabled: z.boolean().optional(),
-    error_message: z.string().optional(),
 })
     .transform(d => ({
-    ruleId: d.rule_id,
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    accountId: d.account_id,
-    endpointService: d.endpoint_service,
-    domainNames: d.domain_names,
-    resourceNames: d.resource_names,
-    vpcEndpointId: d.vpc_endpoint_id,
-    connectionState: d.connection_state,
-    creationTime: d.creation_time,
-    updatedTime: d.updated_time,
-    deactivated: d.deactivated,
-    deactivatedAt: d.deactivated_at,
+    listId: d.list_id,
+    label: d.label,
+    ipAddresses: d.ip_addresses,
+    addressCount: d.address_count,
+    listType: d.list_type,
+    createdAt: d.created_at,
+    createdBy: d.created_by,
+    updatedAt: d.updated_at,
+    updatedBy: d.updated_by,
     enabled: d.enabled,
-    errorMessage: d.error_message,
 }));
-export const unmarshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
+export const unmarshalListAccountIpAccessListsResponseSchema = z
     .object({
-    rule_id: z.string().optional(),
-    network_connectivity_config_id: z.string().optional(),
-    resource_id: z.string().optional(),
-    group_id: z.string().optional(),
-    endpoint_name: z.string().optional(),
-    connection_state: z.string().optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    deactivated: z.boolean().optional(),
-    deactivated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    domain_names: z.array(z.string()).optional(),
-    error_message: z.string().optional(),
-})
-    .transform(d => ({
-    ruleId: d.rule_id,
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    resourceId: d.resource_id,
-    groupId: d.group_id,
-    endpointName: d.endpoint_name,
-    connectionState: d.connection_state,
-    creationTime: d.creation_time,
-    updatedTime: d.updated_time,
-    deactivated: d.deactivated,
-    deactivatedAt: d.deactivated_at,
-    domainNames: d.domain_names,
-    errorMessage: d.error_message,
-}));
-export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
-    .object({
-    default_rules: z
-        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
-        .optional(),
-    target_rules: z
-        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    defaultRules: d.default_rules,
-    targetRules: d.target_rules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
-    .object({
-    azure_private_endpoint_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
-        .optional(),
-    aws_private_endpoint_rules: z
-        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    azurePrivateEndpointRules: d.azure_private_endpoint_rules,
-    awsPrivateEndpointRules: d.aws_private_endpoint_rules,
-}));
-export const unmarshalCustomerFacingPrivateAccessSettingsSchema = z
-    .object({
-    private_access_settings_id: z.string().optional(),
-    account_id: z.string().optional(),
-    private_access_settings_name: z.string().optional(),
-    region: z.string().optional(),
-    public_access_enabled: z.boolean().optional(),
-    private_access_level: z.string().optional(),
-    allowed_vpc_endpoint_ids: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    privateAccessSettingsId: d.private_access_settings_id,
-    accountId: d.account_id,
-    privateAccessSettingsName: d.private_access_settings_name,
-    region: d.region,
-    publicAccessEnabled: d.public_access_enabled,
-    privateAccessLevel: d.private_access_level,
-    allowedVpcEndpointIds: d.allowed_vpc_endpoint_ids,
-}));
-export const unmarshalCustomerFacingVpcEndpointSchema = z
-    .object({
-    vpc_endpoint_id: z.string().optional(),
-    account_id: z.string().optional(),
-    vpc_endpoint_name: z.string().optional(),
-    aws_vpc_endpoint_id: z.string().optional(),
-    aws_endpoint_service_id: z.string().optional(),
-    use_case: z.string().optional(),
-    region: z.string().optional(),
-    aws_account_id: z.string().optional(),
-    state: z.string().optional(),
-    gcp_vpc_endpoint_info: z
-        .lazy(() => unmarshalCustomerFacingGcpVpcEndpointInfoSchema)
-        .optional(),
-})
-    .transform(d => ({
-    vpcEndpointId: d.vpc_endpoint_id,
-    accountId: d.account_id,
-    vpcEndpointName: d.vpc_endpoint_name,
-    awsVpcEndpointId: d.aws_vpc_endpoint_id,
-    awsEndpointServiceId: d.aws_endpoint_service_id,
-    useCase: d.use_case,
-    region: d.region,
-    awsAccountId: d.aws_account_id,
-    state: d.state,
-    vpcEndpointInfo: d.gcp_vpc_endpoint_info !== undefined
-        ? {
-            $case: 'gcpVpcEndpointInfo',
-            gcpVpcEndpointInfo: d.gcp_vpc_endpoint_info,
-        }
-        : undefined,
-}));
-export const unmarshalDeleteAccountIpAccessListResponseSchema = z.object({});
-export const unmarshalDeleteIpAccessListResponseSchema = z.object({});
-export const unmarshalEgressNetworkPolicySchema = z
-    .object({
-    network_access: z
-        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema)
-        .optional(),
-})
-    .transform(d => ({
-    networkAccess: d.network_access,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
-    .object({
-    restriction_mode: z.string().optional(),
-    allowed_internet_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowed_storage_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
-        .optional(),
-    policy_enforcement: z
-        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
-        .optional(),
-    blocked_internet_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowed_databricks_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    allowedInternetDestinations: d.allowed_internet_destinations,
-    allowedStorageDestinations: d.allowed_storage_destinations,
-    policyEnforcement: d.policy_enforcement,
-    blockedInternetDestinations: d.blocked_internet_destinations,
-    allowedDatabricksDestinations: d.allowed_databricks_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
-    .object({
-    workspace_ids: z
-        .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
-        .optional(),
-})
-    .transform(d => ({
-    workspaceIds: d.workspace_ids,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
-    .object({
-    destination: z.string().optional(),
-    internet_destination_type: z.string().optional(),
-})
-    .transform(d => ({
-    destination: d.destination,
-    internetDestinationType: d.internet_destination_type,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
-    .object({
-    enforcement_mode: z.string().optional(),
-    dry_run_mode_product_filter: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    enforcementMode: d.enforcement_mode,
-    dryRunModeProductFilter: d.dry_run_mode_product_filter,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
-    .object({
-    bucket_name: z.string().optional(),
-    region: z.string().optional(),
-    storage_destination_type: z.string().optional(),
-    azure_storage_account: z.string().optional(),
-    azure_storage_service: z.string().optional(),
-})
-    .transform(d => ({
-    bucketName: d.bucket_name,
-    region: d.region,
-    storageDestinationType: d.storage_destination_type,
-    azureStorageAccount: d.azure_storage_account,
-    azureStorageService: d.azure_storage_service,
-}));
-export const unmarshalEndpointSchema = z
-    .object({
-    name: z.string().optional(),
-    endpoint_id: z.string().optional(),
-    account_id: z.string().optional(),
-    display_name: z.string().optional(),
-    use_case: z.string().optional(),
-    region: z.string().optional(),
-    state: z.string().optional(),
-    azure_private_endpoint_info: z
-        .lazy(() => unmarshalAzurePrivateEndpointInfoSchema)
-        .optional(),
-    create_time: z
-        .string()
-        .transform(s => Temporal.Instant.from(s))
-        .optional(),
-})
-    .transform(d => ({
-    name: d.name,
-    endpointId: d.endpoint_id,
-    accountId: d.account_id,
-    displayName: d.display_name,
-    useCase: d.use_case,
-    region: d.region,
-    state: d.state,
-    endpointInfo: d.azure_private_endpoint_info !== undefined
-        ? {
-            $case: 'azurePrivateEndpointInfo',
-            azurePrivateEndpointInfo: d.azure_private_endpoint_info,
-        }
-        : undefined,
-    createTime: d.create_time,
-}));
-export const unmarshalGcpEndpointSchema = z
-    .object({
-    psc_endpoint_uri: z.string().optional(),
-    service_attachment: z.string().optional(),
-})
-    .transform(d => ({
-    pscEndpointUri: d.psc_endpoint_uri,
-    targetServices: d.service_attachment !== undefined
-        ? {
-            $case: 'serviceAttachment',
-            serviceAttachment: d.service_attachment,
-        }
-        : undefined,
-}));
-export const unmarshalGcpNetworkInfoSchema = z
-    .object({
-    network_project_id: z.string().optional(),
-    vpc_id: z.string().optional(),
-    subnet_id: z.string().optional(),
-    subnet_region: z.string().optional(),
-    pod_ip_range_name: z.string().optional(),
-    service_ip_range_name: z.string().optional(),
-})
-    .transform(d => ({
-    networkProjectId: d.network_project_id,
-    vpcId: d.vpc_id,
-    subnetId: d.subnet_id,
-    subnetRegion: d.subnet_region,
-    podIpRangeName: d.pod_ip_range_name,
-    serviceIpRangeName: d.service_ip_range_name,
-}));
-export const unmarshalGetAccountIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z
-        .lazy(() => unmarshalAccountIpAccessListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalGetIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalIpAccessListSchema = z
-    .object({
-    list_id: z.string().optional(),
-    label: z.string().optional(),
-    ip_addresses: z.array(z.string()).optional(),
-    address_count: z.number().optional(),
-    list_type: z.string().optional(),
-    created_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    created_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    listId: d.list_id,
-    label: d.label,
-    ipAddresses: d.ip_addresses,
-    addressCount: d.address_count,
-    listType: d.list_type,
-    createdAt: d.created_at,
-    createdBy: d.created_by,
-    updatedAt: d.updated_at,
-    updatedBy: d.updated_by,
-    enabled: d.enabled,
-}));
-export const unmarshalListAccountIpAccessListsResponseSchema = z
-    .object({
-    ip_access_lists: z
-        .array(z.lazy(() => unmarshalAccountIpAccessListSchema))
+    ip_access_lists: z
+        .array(z.lazy(() => unmarshalAccountIpAccessListSchema))
         .optional(),
 })
     .transform(d => ({
@@ -1103,7 +943,7 @@ export const unmarshalListNccPrivateEndpointRulesResponseSchema = z
 export const unmarshalListNetworkConnectivityConfigsResponseSchema = z
     .object({
     items: z
-        .array(z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigSchema))
+        .array(z.lazy(() => unmarshalNetworkConnectivityConfigSchema))
         .optional(),
     next_page_token: z.string().optional(),
 })
@@ -1182,40 +1022,147 @@ export const unmarshalNetworkSchema = z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
-    vpc_id: z.string().optional(),
-    subnet_ids: z.array(z.string()).optional(),
-    security_group_ids: z.array(z.string()).optional(),
-    vpc_status: z.string().optional(),
-    error_messages: z
-        .array(z.lazy(() => unmarshalNetworkHealthSchema))
-        .optional(),
-    network_name: z.string().optional(),
-    creation_time: z
+    vpc_id: z.string().optional(),
+    subnet_ids: z.array(z.string()).optional(),
+    security_group_ids: z.array(z.string()).optional(),
+    vpc_status: z.string().optional(),
+    error_messages: z
+        .array(z.lazy(() => unmarshalNetworkHealthSchema))
+        .optional(),
+    network_name: z.string().optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    warning_messages: z
+        .array(z.lazy(() => unmarshalNetworkWarningSchema))
+        .optional(),
+    vpc_endpoints: z.lazy(() => unmarshalNetworkVpcEndpointsSchema).optional(),
+    gcp_network_info: z.lazy(() => unmarshalGcpNetworkInfoSchema).optional(),
+})
+    .transform(d => ({
+    networkId: d.network_id,
+    accountId: d.account_id,
+    workspaceId: d.workspace_id,
+    vpcId: d.vpc_id,
+    subnetIds: d.subnet_ids,
+    securityGroupIds: d.security_group_ids,
+    vpcStatus: d.vpc_status,
+    errorMessages: d.error_messages,
+    networkName: d.network_name,
+    creationTime: d.creation_time,
+    warningMessages: d.warning_messages,
+    vpcEndpoints: d.vpc_endpoints,
+    networkInfo: d.gcp_network_info !== undefined
+        ? { $case: 'gcpNetworkInfo', gcpNetworkInfo: d.gcp_network_info }
+        : undefined,
+}));
+export const unmarshalNetworkConnectivityConfigSchema = z
+    .object({
+    network_connectivity_config_id: z.string().optional(),
+    account_id: z.string().optional(),
+    name: z.string().optional(),
+    region: z.string().optional(),
+    egress_config: z
+        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+})
+    .transform(d => ({
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    accountId: d.account_id,
+    name: d.name,
+    region: d.region,
+    egressConfig: d.egress_config,
+    updatedTime: d.updated_time,
+    creationTime: d.creation_time,
+}));
+export const unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
+    .object({
+    rule_id: z.string().optional(),
+    network_connectivity_config_id: z.string().optional(),
+    account_id: z.string().optional(),
+    endpoint_service: z.string().optional(),
+    domain_names: z.array(z.string()).optional(),
+    resource_names: z.array(z.string()).optional(),
+    vpc_endpoint_id: z.string().optional(),
+    connection_state: z.string().optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    deactivated: z.boolean().optional(),
+    deactivated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    enabled: z.boolean().optional(),
+    error_message: z.string().optional(),
+})
+    .transform(d => ({
+    ruleId: d.rule_id,
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    accountId: d.account_id,
+    endpointService: d.endpoint_service,
+    domainNames: d.domain_names,
+    resourceNames: d.resource_names,
+    vpcEndpointId: d.vpc_endpoint_id,
+    connectionState: d.connection_state,
+    creationTime: d.creation_time,
+    updatedTime: d.updated_time,
+    deactivated: d.deactivated,
+    deactivatedAt: d.deactivated_at,
+    enabled: d.enabled,
+    errorMessage: d.error_message,
+}));
+export const unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
+    .object({
+    rule_id: z.string().optional(),
+    network_connectivity_config_id: z.string().optional(),
+    resource_id: z.string().optional(),
+    group_id: z.string().optional(),
+    endpoint_name: z.string().optional(),
+    connection_state: z.string().optional(),
+    creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+    updated_time: z
         .union([z.number(), z.bigint()])
         .transform(v => BigInt(v))
         .optional(),
-    warning_messages: z
-        .array(z.lazy(() => unmarshalNetworkWarningSchema))
+    deactivated: z.boolean().optional(),
+    deactivated_at: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
         .optional(),
-    vpc_endpoints: z.lazy(() => unmarshalNetworkVpcEndpointsSchema).optional(),
-    gcp_network_info: z.lazy(() => unmarshalGcpNetworkInfoSchema).optional(),
+    domain_names: z.array(z.string()).optional(),
+    error_message: z.string().optional(),
 })
     .transform(d => ({
-    networkId: d.network_id,
-    accountId: d.account_id,
-    workspaceId: d.workspace_id,
-    vpcId: d.vpc_id,
-    subnetIds: d.subnet_ids,
-    securityGroupIds: d.security_group_ids,
-    vpcStatus: d.vpc_status,
-    errorMessages: d.error_messages,
-    networkName: d.network_name,
+    ruleId: d.rule_id,
+    networkConnectivityConfigId: d.network_connectivity_config_id,
+    resourceId: d.resource_id,
+    groupId: d.group_id,
+    endpointName: d.endpoint_name,
+    connectionState: d.connection_state,
     creationTime: d.creation_time,
-    warningMessages: d.warning_messages,
-    vpcEndpoints: d.vpc_endpoints,
-    networkInfo: d.gcp_network_info !== undefined
-        ? { $case: 'gcpNetworkInfo', gcpNetworkInfo: d.gcp_network_info }
-        : undefined,
+    updatedTime: d.updated_time,
+    deactivated: d.deactivated,
+    deactivatedAt: d.deactivated_at,
+    domainNames: d.domain_names,
+    errorMessage: d.error_message,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
 export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
@@ -1278,6 +1225,25 @@ export const unmarshalNetworkWarningSchema = z
     warningType: d.warning_type,
     warningMessage: d.warning_message,
 }));
+export const unmarshalPrivateAccessSettingsSchema = z
+    .object({
+    private_access_settings_id: z.string().optional(),
+    account_id: z.string().optional(),
+    private_access_settings_name: z.string().optional(),
+    region: z.string().optional(),
+    public_access_enabled: z.boolean().optional(),
+    private_access_level: z.string().optional(),
+    allowed_vpc_endpoint_ids: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    privateAccessSettingsId: d.private_access_settings_id,
+    accountId: d.account_id,
+    privateAccessSettingsName: d.private_access_settings_name,
+    region: d.region,
+    publicAccessEnabled: d.public_access_enabled,
+    privateAccessLevel: d.private_access_level,
+    allowedVpcEndpointIds: d.allowed_vpc_endpoint_ids,
+}));
 export const unmarshalReplaceAccountIpAccessListResponseSchema = z
     .object({
     ip_access_list: z
@@ -1310,6 +1276,38 @@ export const unmarshalUpdateIpAccessListResponseSchema = z
     .transform(d => ({
     ipAccessList: d.ip_access_list,
 }));
+export const unmarshalVpcEndpointSchema = z
+    .object({
+    vpc_endpoint_id: z.string().optional(),
+    account_id: z.string().optional(),
+    vpc_endpoint_name: z.string().optional(),
+    aws_vpc_endpoint_id: z.string().optional(),
+    aws_endpoint_service_id: z.string().optional(),
+    use_case: z.string().optional(),
+    region: z.string().optional(),
+    aws_account_id: z.string().optional(),
+    state: z.string().optional(),
+    gcp_vpc_endpoint_info: z
+        .lazy(() => unmarshalGcpVpcEndpointInfoSchema)
+        .optional(),
+})
+    .transform(d => ({
+    vpcEndpointId: d.vpc_endpoint_id,
+    accountId: d.account_id,
+    vpcEndpointName: d.vpc_endpoint_name,
+    awsVpcEndpointId: d.aws_vpc_endpoint_id,
+    awsEndpointServiceId: d.aws_endpoint_service_id,
+    useCase: d.use_case,
+    region: d.region,
+    awsAccountId: d.aws_account_id,
+    state: d.state,
+    vpcEndpointInfo: d.gcp_vpc_endpoint_info !== undefined
+        ? {
+            $case: 'gcpVpcEndpointInfo',
+            gcpVpcEndpointInfo: d.gcp_vpc_endpoint_info,
+        }
+        : undefined,
+}));
 export const unmarshalWorkspaceNetworkOptionSchema = z
     .object({
     network_policy_id: z.string().optional(),
@@ -1327,12 +1325,8 @@ export const marshalAccountNetworkPolicySchema = z
     networkPolicyId: z.string().optional(),
     accountId: z.string().optional(),
     egress: z.lazy(() => marshalEgressNetworkPolicySchema).optional(),
-    ingress: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicySchema)
-        .optional(),
-    ingressDryRun: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicySchema)
-        .optional(),
+    ingress: z.lazy(() => marshalIngressNetworkPolicySchema).optional(),
+    ingressDryRun: z.lazy(() => marshalIngressNetworkPolicySchema).optional(),
 })
     .transform(d => ({
     network_policy_id: d.networkPolicyId,
@@ -1367,7 +1361,7 @@ export const marshalCreateAccountIpAccessListRequestSchema = z
     list_type: d.listType,
     ip_addresses: d.ipAddresses,
 }));
-export const marshalCreateIpAccessListSchema = z
+export const marshalCreateIpAccessListRequestSchema = z
     .object({
     label: z.string().optional(),
     listType: z.string().optional(),
@@ -1485,31 +1479,209 @@ export const marshalCreatePrivateEndpointRuleSchema = z
         gcp_endpoint: d.endpoint.gcpEndpoint,
     }),
 }));
-export const marshalCreateVpcEndpointRequestSchema = z
+export const marshalCreateVpcEndpointRequestSchema = z
+    .object({
+    accountId: z.string().optional(),
+    vpcEndpointName: z.string().optional(),
+    region: z.string().optional(),
+    awsVpcEndpointId: z.string().optional(),
+    vpcEndpointInfo: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('gcpVpcEndpointInfo'),
+            gcpVpcEndpointInfo: z.lazy(() => marshalGcpVpcEndpointInfoSchema),
+        }),
+    ])
+        .optional(),
+})
+    .transform(d => ({
+    account_id: d.accountId,
+    vpc_endpoint_name: d.vpcEndpointName,
+    region: d.region,
+    aws_vpc_endpoint_id: d.awsVpcEndpointId,
+    ...(d.vpcEndpointInfo?.$case === 'gcpVpcEndpointInfo' && {
+        gcp_vpc_endpoint_info: d.vpcEndpointInfo.gcpVpcEndpointInfo,
+    }),
+}));
+export const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
+    .object({
+    defaultRules: z
+        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
+        .optional(),
+    targetRules: z
+        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
+        .optional(),
+})
+    .transform(d => ({
+    default_rules: d.defaultRules,
+    target_rules: d.targetRules,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
+    .object({
+    azurePrivateEndpointRules: z
+        .array(z.lazy(() => marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
+        .optional(),
+    awsPrivateEndpointRules: z
+        .array(z.lazy(() => marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
+        .optional(),
+})
+    .transform(d => ({
+    azure_private_endpoint_rules: d.azurePrivateEndpointRules,
+    aws_private_endpoint_rules: d.awsPrivateEndpointRules,
+}));
+export const marshalEgressNetworkPolicySchema = z
+    .object({
+    networkAccess: z
+        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicySchema)
+        .optional(),
+})
+    .transform(d => ({
+    network_access: d.networkAccess,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
+    .object({
+    restrictionMode: z.string().optional(),
+    allowedInternetDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowedStorageDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
+        .optional(),
+    policyEnforcement: z
+        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
+        .optional(),
+    blockedInternetDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
+        .optional(),
+    allowedDatabricksDestinations: z
+        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
+        .optional(),
+})
+    .transform(d => ({
+    restriction_mode: d.restrictionMode,
+    allowed_internet_destinations: d.allowedInternetDestinations,
+    allowed_storage_destinations: d.allowedStorageDestinations,
+    policy_enforcement: d.policyEnforcement,
+    blocked_internet_destinations: d.blockedInternetDestinations,
+    allowed_databricks_destinations: d.allowedDatabricksDestinations,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
+    .object({
+    workspaceIds: z.array(z.bigint()).optional(),
+})
+    .transform(d => ({
+    workspace_ids: d.workspaceIds,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
+    .object({
+    destination: z.string().optional(),
+    internetDestinationType: z.string().optional(),
+})
+    .transform(d => ({
+    destination: d.destination,
+    internet_destination_type: d.internetDestinationType,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
+    .object({
+    enforcementMode: z.string().optional(),
+    dryRunModeProductFilter: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    enforcement_mode: d.enforcementMode,
+    dry_run_mode_product_filter: d.dryRunModeProductFilter,
+}));
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
+export const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
+    .object({
+    bucketName: z.string().optional(),
+    region: z.string().optional(),
+    storageDestinationType: z.string().optional(),
+    azureStorageAccount: z.string().optional(),
+    azureStorageService: z.string().optional(),
+})
+    .transform(d => ({
+    bucket_name: d.bucketName,
+    region: d.region,
+    storage_destination_type: d.storageDestinationType,
+    azure_storage_account: d.azureStorageAccount,
+    azure_storage_service: d.azureStorageService,
+}));
+export const marshalEndpointSchema = z
+    .object({
+    name: z.string().optional(),
+    endpointId: z.string().optional(),
+    accountId: z.string().optional(),
+    displayName: z.string().optional(),
+    useCase: z.string().optional(),
+    region: z.string().optional(),
+    state: z.string().optional(),
+    endpointInfo: z
+        .discriminatedUnion('$case', [
+        z.object({
+            $case: z.literal('azurePrivateEndpointInfo'),
+            azurePrivateEndpointInfo: z.lazy(() => marshalAzurePrivateEndpointInfoSchema),
+        }),
+    ])
+        .optional(),
+    createTime: z
+        .any()
+        .transform((d) => d.toString())
+        .optional(),
+})
+    .transform(d => ({
+    name: d.name,
+    endpoint_id: d.endpointId,
+    account_id: d.accountId,
+    display_name: d.displayName,
+    use_case: d.useCase,
+    region: d.region,
+    state: d.state,
+    ...(d.endpointInfo?.$case === 'azurePrivateEndpointInfo' && {
+        azure_private_endpoint_info: d.endpointInfo.azurePrivateEndpointInfo,
+    }),
+    create_time: d.createTime,
+}));
+export const marshalGcpEndpointSchema = z
     .object({
-    accountId: z.string().optional(),
-    vpcEndpointName: z.string().optional(),
-    region: z.string().optional(),
-    awsVpcEndpointId: z.string().optional(),
-    vpcEndpointInfo: z
+    pscEndpointUri: z.string().optional(),
+    targetServices: z
         .discriminatedUnion('$case', [
         z.object({
-            $case: z.literal('gcpVpcEndpointInfo'),
-            gcpVpcEndpointInfo: z.lazy(() => marshalCustomerFacingGcpVpcEndpointInfoSchema),
+            $case: z.literal('serviceAttachment'),
+            serviceAttachment: z.string(),
         }),
     ])
         .optional(),
 })
     .transform(d => ({
-    account_id: d.accountId,
-    vpc_endpoint_name: d.vpcEndpointName,
-    region: d.region,
-    aws_vpc_endpoint_id: d.awsVpcEndpointId,
-    ...(d.vpcEndpointInfo?.$case === 'gcpVpcEndpointInfo' && {
-        gcp_vpc_endpoint_info: d.vpcEndpointInfo.gcpVpcEndpointInfo,
+    psc_endpoint_uri: d.pscEndpointUri,
+    ...(d.targetServices?.$case === 'serviceAttachment' && {
+        service_attachment: d.targetServices.serviceAttachment,
     }),
 }));
-export const marshalCustomerFacingGcpVpcEndpointInfoSchema = z
+export const marshalGcpNetworkInfoSchema = z
+    .object({
+    networkProjectId: z.string().optional(),
+    vpcId: z.string().optional(),
+    subnetId: z.string().optional(),
+    subnetRegion: z.string().optional(),
+    podIpRangeName: z.string().optional(),
+    serviceIpRangeName: z.string().optional(),
+})
+    .transform(d => ({
+    network_project_id: d.networkProjectId,
+    vpc_id: d.vpcId,
+    subnet_id: d.subnetId,
+    subnet_region: d.subnetRegion,
+    pod_ip_range_name: d.podIpRangeName,
+    service_ip_range_name: d.serviceIpRangeName,
+}));
+export const marshalGcpVpcEndpointInfoSchema = z
     .object({
     pscConnectionId: z.string().optional(),
     projectId: z.string().optional(),
@@ -1524,16 +1696,16 @@ export const marshalCustomerFacingGcpVpcEndpointInfoSchema = z
     endpoint_region: d.endpointRegion,
     service_attachment_id: d.serviceAttachmentId,
 }));
-export const marshalCustomerFacingIngressNetworkPolicySchema = z
+export const marshalIngressNetworkPolicySchema = z
     .object({
     publicAccess: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema)
+        .lazy(() => marshalIngressNetworkPolicy_PublicAccessSchema)
         .optional(),
     privateAccess: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema)
+        .lazy(() => marshalIngressNetworkPolicy_PrivateAccessSchema)
         .optional(),
     crossWorkspaceAccess: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema)
+        .lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema)
         .optional(),
 })
     .transform(d => ({
@@ -1542,7 +1714,7 @@ export const marshalCustomerFacingIngressNetworkPolicySchema = z
     cross_workspace_access: d.crossWorkspaceAccess,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema = z
+export const marshalIngressNetworkPolicy_AccountApiDestinationSchema = z
     .object({
     scopes: z.array(z.string()).optional(),
     scopeQualifier: z.string().optional(),
@@ -1552,7 +1724,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSche
     scope_qualifier: d.scopeQualifier,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
+export const marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
 })
@@ -1560,7 +1732,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDesti
     all_destinations: d.allDestinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema = z
+export const marshalIngressNetworkPolicy_AccountUiDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
 })
@@ -1568,7 +1740,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchem
     all_destinations: d.allDestinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
+export const marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
 })
@@ -1576,11 +1748,11 @@ export const marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSch
     all_destinations: d.allDestinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema = z
+export const marshalIngressNetworkPolicy_AuthenticationSchema = z
     .object({
     identityType: z.string().optional(),
     identities: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_AuthenticationIdentitySchema))
         .optional(),
 })
     .transform(d => ({
@@ -1588,7 +1760,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema = z
     identities: d.identities,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema = z
+export const marshalIngressNetworkPolicy_AuthenticationIdentitySchema = z
     .object({
     principalType: z.string().optional(),
     principalId: z.bigint().optional(),
@@ -1598,14 +1770,14 @@ export const marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySch
     principal_id: d.principalId,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
+export const marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
     .object({
     restrictionMode: z.string().optional(),
     denyRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
         .optional(),
     allowRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
         .optional(),
 })
     .transform(d => ({
@@ -1614,16 +1786,16 @@ export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchem
     allow_rules: d.allowRules,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
+export const marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
+        .lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -1634,7 +1806,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRule
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
+export const marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
     .object({
     source: z
         .discriminatedUnion('$case', [
@@ -1644,7 +1816,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOrig
         }),
         z.object({
             $case: z.literal('selectedWorkspaces'),
-            selectedWorkspaces: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema),
+            selectedWorkspaces: z.lazy(() => marshalIngressNetworkPolicy_WorkspaceIdListSchema),
         }),
     ])
         .optional(),
@@ -1658,7 +1830,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOrig
     }),
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
+export const marshalIngressNetworkPolicy_EndpointsSchema = z
     .object({
     endpointIds: z.array(z.string()).optional(),
 })
@@ -1666,7 +1838,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema = z
     endpoint_ids: d.endpointIds,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
+export const marshalIngressNetworkPolicy_IpRangesSchema = z
     .object({
     ipRanges: z.array(z.string()).optional(),
 })
@@ -1674,7 +1846,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema = z
     ip_ranges: d.ipRanges,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
+export const marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
 })
@@ -1682,14 +1854,14 @@ export const marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinatio
     all_destinations: d.allDestinations,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
+export const marshalIngressNetworkPolicy_PrivateAccessSchema = z
     .object({
     restrictionMode: z.string().optional(),
     denyRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema))
         .optional(),
     allowRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema))
         .optional(),
 })
     .transform(d => ({
@@ -1698,16 +1870,16 @@ export const marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema = z
     allow_rules: d.allowRules,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema = z
+export const marshalIngressNetworkPolicy_PrivateIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema)
+        .lazy(() => marshalIngressNetworkPolicy_PrivateRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -1718,13 +1890,13 @@ export const marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema = z
+export const marshalIngressNetworkPolicy_PrivateRequestOriginSchema = z
     .object({
     source: z
         .discriminatedUnion('$case', [
         z.object({
             $case: z.literal('endpoints'),
-            endpoints: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema),
+            endpoints: z.lazy(() => marshalIngressNetworkPolicy_EndpointsSchema),
         }),
         z.object({
             $case: z.literal('allRegisteredEndpoints'),
@@ -1754,14 +1926,14 @@ export const marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchem
     }),
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
+export const marshalIngressNetworkPolicy_PublicAccessSchema = z
     .object({
     restrictionMode: z.string().optional(),
     denyRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema))
         .optional(),
     allowRules: z
-        .array(z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema))
+        .array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema))
         .optional(),
 })
     .transform(d => ({
@@ -1770,16 +1942,16 @@ export const marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema = z
     allow_rules: d.allowRules,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema = z
+export const marshalIngressNetworkPolicy_PublicIngressRuleSchema = z
     .object({
     origin: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema)
+        .lazy(() => marshalIngressNetworkPolicy_PublicRequestOriginSchema)
         .optional(),
     destination: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
         .optional(),
     authentication: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
         .optional(),
     label: z.string().optional(),
 })
@@ -1790,18 +1962,18 @@ export const marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema =
     label: d.label,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema = z
+export const marshalIngressNetworkPolicy_PublicRequestOriginSchema = z
     .object({
     source: z
         .discriminatedUnion('$case', [
         z.object({ $case: z.literal('allIpRanges'), allIpRanges: z.boolean() }),
         z.object({
             $case: z.literal('includedIpRanges'),
-            includedIpRanges: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema),
+            includedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema),
         }),
         z.object({
             $case: z.literal('excludedIpRanges'),
-            excludedIpRanges: z.lazy(() => marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema),
+            excludedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema),
         }),
     ])
         .optional(),
@@ -1818,29 +1990,29 @@ export const marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema
     }),
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema = z
+export const marshalIngressNetworkPolicy_RequestDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
     workspaceUi: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema)
         .optional(),
     workspaceApi: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema)
         .optional(),
     appsRuntime: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema)
         .optional(),
     lakebaseRuntime: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
         .optional(),
     accountUi: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AccountUiDestinationSchema)
         .optional(),
     accountApi: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AccountApiDestinationSchema)
         .optional(),
     accountDatabricksOne: z
-        .lazy(() => marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
+        .lazy(() => marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
         .optional(),
 })
     .transform(d => ({
@@ -1854,7 +2026,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema
     account_databricks_one: d.accountDatabricksOne,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
+export const marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
     .object({
     scopes: z.array(z.string()).optional(),
     scopeQualifier: z.string().optional(),
@@ -1864,7 +2036,7 @@ export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSc
     scope_qualifier: d.scopeQualifier,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema = z
+export const marshalIngressNetworkPolicy_WorkspaceIdListSchema = z
     .object({
     workspaceIds: z.array(z.bigint()).optional(),
 })
@@ -1872,14 +2044,14 @@ export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema = z
     workspace_ids: d.workspaceIds,
 }));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
+export const marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
     .object({
     allDestinations: z.boolean().optional(),
 })
     .transform(d => ({
     all_destinations: d.allDestinations,
 }));
-export const marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
+export const marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
     .object({
     ruleId: z.string().optional(),
     networkConnectivityConfigId: z.string().optional(),
@@ -1912,7 +2084,7 @@ export const marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRul
     enabled: d.enabled,
     error_message: d.errorMessage,
 }));
-export const marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
+export const marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
     .object({
     ruleId: z.string().optional(),
     networkConnectivityConfigId: z.string().optional(),
@@ -1941,203 +2113,6 @@ export const marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointR
     domain_names: d.domainNames,
     error_message: d.errorMessage,
 }));
-export const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
-    .object({
-    defaultRules: z
-        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
-        .optional(),
-    targetRules: z
-        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    default_rules: d.defaultRules,
-    target_rules: d.targetRules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
-    .object({
-    azurePrivateEndpointRules: z
-        .array(z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
-        .optional(),
-    awsPrivateEndpointRules: z
-        .array(z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    azure_private_endpoint_rules: d.azurePrivateEndpointRules,
-    aws_private_endpoint_rules: d.awsPrivateEndpointRules,
-}));
-export const marshalCustomerFacingPrivateAccessSettingsSchema = z
-    .object({
-    privateAccessSettingsId: z.string().optional(),
-    accountId: z.string().optional(),
-    privateAccessSettingsName: z.string().optional(),
-    region: z.string().optional(),
-    publicAccessEnabled: z.boolean().optional(),
-    privateAccessLevel: z.string().optional(),
-    allowedVpcEndpointIds: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    private_access_settings_id: d.privateAccessSettingsId,
-    account_id: d.accountId,
-    private_access_settings_name: d.privateAccessSettingsName,
-    region: d.region,
-    public_access_enabled: d.publicAccessEnabled,
-    private_access_level: d.privateAccessLevel,
-    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
-}));
-export const marshalEgressNetworkPolicySchema = z
-    .object({
-    networkAccess: z
-        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicySchema)
-        .optional(),
-})
-    .transform(d => ({
-    network_access: d.networkAccess,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
-    .object({
-    restrictionMode: z.string().optional(),
-    allowedInternetDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowedStorageDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
-        .optional(),
-    policyEnforcement: z
-        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
-        .optional(),
-    blockedInternetDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowedDatabricksDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restriction_mode: d.restrictionMode,
-    allowed_internet_destinations: d.allowedInternetDestinations,
-    allowed_storage_destinations: d.allowedStorageDestinations,
-    policy_enforcement: d.policyEnforcement,
-    blocked_internet_destinations: d.blockedInternetDestinations,
-    allowed_databricks_destinations: d.allowedDatabricksDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
-    .object({
-    workspaceIds: z.array(z.bigint()).optional(),
-})
-    .transform(d => ({
-    workspace_ids: d.workspaceIds,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
-    .object({
-    destination: z.string().optional(),
-    internetDestinationType: z.string().optional(),
-})
-    .transform(d => ({
-    destination: d.destination,
-    internet_destination_type: d.internetDestinationType,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
-    .object({
-    enforcementMode: z.string().optional(),
-    dryRunModeProductFilter: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    enforcement_mode: d.enforcementMode,
-    dry_run_mode_product_filter: d.dryRunModeProductFilter,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
-    .object({
-    bucketName: z.string().optional(),
-    region: z.string().optional(),
-    storageDestinationType: z.string().optional(),
-    azureStorageAccount: z.string().optional(),
-    azureStorageService: z.string().optional(),
-})
-    .transform(d => ({
-    bucket_name: d.bucketName,
-    region: d.region,
-    storage_destination_type: d.storageDestinationType,
-    azure_storage_account: d.azureStorageAccount,
-    azure_storage_service: d.azureStorageService,
-}));
-export const marshalEndpointSchema = z
-    .object({
-    name: z.string().optional(),
-    endpointId: z.string().optional(),
-    accountId: z.string().optional(),
-    displayName: z.string().optional(),
-    useCase: z.string().optional(),
-    region: z.string().optional(),
-    state: z.string().optional(),
-    endpointInfo: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('azurePrivateEndpointInfo'),
-            azurePrivateEndpointInfo: z.lazy(() => marshalAzurePrivateEndpointInfoSchema),
-        }),
-    ])
-        .optional(),
-    createTime: z
-        .any()
-        .transform((d) => d.toString())
-        .optional(),
-})
-    .transform(d => ({
-    name: d.name,
-    endpoint_id: d.endpointId,
-    account_id: d.accountId,
-    display_name: d.displayName,
-    use_case: d.useCase,
-    region: d.region,
-    state: d.state,
-    ...(d.endpointInfo?.$case === 'azurePrivateEndpointInfo' && {
-        azure_private_endpoint_info: d.endpointInfo.azurePrivateEndpointInfo,
-    }),
-    create_time: d.createTime,
-}));
-export const marshalGcpEndpointSchema = z
-    .object({
-    pscEndpointUri: z.string().optional(),
-    targetServices: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('serviceAttachment'),
-            serviceAttachment: z.string(),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    psc_endpoint_uri: d.pscEndpointUri,
-    ...(d.targetServices?.$case === 'serviceAttachment' && {
-        service_attachment: d.targetServices.serviceAttachment,
-    }),
-}));
-export const marshalGcpNetworkInfoSchema = z
-    .object({
-    networkProjectId: z.string().optional(),
-    vpcId: z.string().optional(),
-    subnetId: z.string().optional(),
-    subnetRegion: z.string().optional(),
-    podIpRangeName: z.string().optional(),
-    serviceIpRangeName: z.string().optional(),
-})
-    .transform(d => ({
-    network_project_id: d.networkProjectId,
-    vpc_id: d.vpcId,
-    subnet_id: d.subnetId,
-    subnet_region: d.subnetRegion,
-    pod_ip_range_name: d.podIpRangeName,
-    service_ip_range_name: d.serviceIpRangeName,
-}));
 // eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
 export const marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
     .object({
@@ -2181,6 +2156,25 @@ export const marshalNetworkVpcEndpointsSchema = z
     rest_api: d.restApi,
     dataplane_relay: d.dataplaneRelay,
 }));
+export const marshalPrivateAccessSettingsSchema = z
+    .object({
+    privateAccessSettingsId: z.string().optional(),
+    accountId: z.string().optional(),
+    privateAccessSettingsName: z.string().optional(),
+    region: z.string().optional(),
+    publicAccessEnabled: z.boolean().optional(),
+    privateAccessLevel: z.string().optional(),
+    allowedVpcEndpointIds: z.array(z.string()).optional(),
+})
+    .transform(d => ({
+    private_access_settings_id: d.privateAccessSettingsId,
+    account_id: d.accountId,
+    private_access_settings_name: d.privateAccessSettingsName,
+    region: d.region,
+    public_access_enabled: d.publicAccessEnabled,
+    private_access_level: d.privateAccessLevel,
+    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
+}));
 export const marshalReplaceAccountIpAccessListRequestSchema = z
     .object({
     accountId: z.string().optional(),
@@ -2198,7 +2192,7 @@ export const marshalReplaceAccountIpAccessListRequestSchema = z
     ip_addresses: d.ipAddresses,
     enabled: d.enabled,
 }));
-export const marshalReplaceIpAccessListSchema = z
+export const marshalReplaceIpAccessListRequestSchema = z
     .object({
     listId: z.string().optional(),
     label: z.string().optional(),
@@ -2230,7 +2224,7 @@ export const marshalUpdateAccountIpAccessListRequestSchema = z
     ip_addresses: d.ipAddresses,
     enabled: d.enabled,
 }));
-export const marshalUpdateIpAccessListSchema = z
+export const marshalUpdateIpAccessListRequestSchema = z
     .object({
     listId: z.string().optional(),
     label: z.string().optional(),