@databricks/sdk-networking 0.34.0 → 0.36.0

package/dist/v1/model.js

@@ -1,2428 +1,1568 @@
-// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
-import { Temporal } from '@js-temporal/polyfill';
-import { FieldMask } from '@databricks/sdk-core/wkt';
-import { z } from 'zod';
+import { z } from "zod";
+import { Temporal } from "@js-temporal/polyfill";
+import { FieldMask } from "@databricks/sdk-core/wkt";
+
+//#region src/v1/model.ts
 /**
- * The target resources that are supported by Network Connectivity Config.
- * Note: some egress types can support general types that are not defined in EgressResourceType.
- * E.g.: Azure private endpoint supports private link enabled Azure services.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressResourceType = {
-    EGRESS_RESOURCE_TYPE_UNSPECIFIED: 'EGRESS_RESOURCE_TYPE_UNSPECIFIED',
-    AZURE_BLOB_STORAGE: 'AZURE_BLOB_STORAGE',
+* The target resources that are supported by Network Connectivity Config.
+* Note: some egress types can support general types that are not defined in EgressResourceType.
+* E.g.: Azure private endpoint supports private link enabled Azure services.
+*/
+const EgressResourceType = {
+	EGRESS_RESOURCE_TYPE_UNSPECIFIED: "EGRESS_RESOURCE_TYPE_UNSPECIFIED",
+	AZURE_BLOB_STORAGE: "AZURE_BLOB_STORAGE"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EndpointState = {
-    /** The endpoint is pending approval. */
-    PENDING: 'PENDING',
-    /** The endpoint has been approved and is ready for use. */
-    APPROVED: 'APPROVED',
-    /** The endpoint encountered some issues during setup. */
-    FAILED: 'FAILED',
-    /** The endpoint was once established but later disconnected. This endpoint doesn't provide connectivity. */
-    DISCONNECTED: 'DISCONNECTED',
+const EndpointState = {
+	PENDING: "PENDING",
+	APPROVED: "APPROVED",
+	FAILED: "FAILED",
+	DISCONNECTED: "DISCONNECTED"
 };
 /**
- * Type of IP access list. Valid values are as follows and are case-sensitive:
- *
- * * `ALLOW`: An allow list. Include this IP or range.
- * * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IpAccessListType = {
-    ALLOW: 'ALLOW',
-    /** Blocks the associated CIDRs. */
-    BLOCK: 'BLOCK',
+* Type of IP access list. Valid values are as follows and are case-sensitive:
+*
+* * `ALLOW`: An allow list. Include this IP or range.
+* * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
+*/
+const IpAccessListType = {
+	ALLOW: "ALLOW",
+	BLOCK: "BLOCK"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const PrivateAccessLevel = {
-    /** Only specifically listed endpoints can access my workspace */
-    ENDPOINT: 'ENDPOINT',
-    /** Only endpoints in the same account can access my workspace */
-    ACCOUNT: 'ACCOUNT',
+const PrivateAccessLevel = {
+	ENDPOINT: "ENDPOINT",
+	ACCOUNT: "ACCOUNT"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const VpcEndpointUseCase = {
-    WORKSPACE_ACCESS: 'WORKSPACE_ACCESS',
-    DATAPLANE_RELAY_ACCESS: 'DATAPLANE_RELAY_ACCESS',
-    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
-    GENERAL_ACCESS: 'GENERAL_ACCESS',
+const VpcEndpointUseCase = {
+	WORKSPACE_ACCESS: "WORKSPACE_ACCESS",
+	DATAPLANE_RELAY_ACCESS: "DATAPLANE_RELAY_ACCESS",
+	GENERAL_ACCESS: "GENERAL_ACCESS"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const VpcStatus = {
-    VALID: 'VALID',
-    BROKEN: 'BROKEN',
-    UNATTACHED: 'UNATTACHED',
-    /** Some optional tests are failing for this Vpc, see NetworkWarning for more information */
-    WARNED: 'WARNED',
+const VpcStatus = {
+	VALID: "VALID",
+	BROKEN: "BROKEN",
+	UNATTACHED: "UNATTACHED",
+	WARNED: "WARNED"
 };
 /**
- * Type of IP access list. Valid values are as follows and are case-sensitive:
- *
- * * `ALLOW`: An allow list. Include this IP or range.
- * * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const AccountIpAccessListType_IpAccessListType = {
-    /** Allows the associated CIDRs. */
-    ALLOW: 'ALLOW',
-    /** Blocks the associated CIDRs. */
-    BLOCK: 'BLOCK',
+* Type of IP access list. Valid values are as follows and are case-sensitive:
+*
+* * `ALLOW`: An allow list. Include this IP or range.
+* * `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.
+*/
+const AccountIpAccessListType_IpAccessListType = {
+	ALLOW: "ALLOW",
+	BLOCK: "BLOCK"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = {
-    INTERNET_DESTINATION_TYPE_UNSPECIFIED: 'INTERNET_DESTINATION_TYPE_UNSPECIFIED',
-    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
-    DNS_NAME: 'DNS_NAME',
+const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = {
+	INTERNET_DESTINATION_TYPE_UNSPECIFIED: "INTERNET_DESTINATION_TYPE_UNSPECIFIED",
+	DNS_NAME: "DNS_NAME"
 };
 /** The values should match the list of workloads used in networkconfig.proto */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = {
-    DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: 'DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED',
-    /** SQL Warehouse product */
-    DBSQL: 'DBSQL',
-    /** Machine Learning serving product */
-    ML_SERVING: 'ML_SERVING',
+const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = {
+	DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: "DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED",
+	DBSQL: "DBSQL",
+	ML_SERVING: "ML_SERVING"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = {
-    ENFORCEMENT_MODE_UNSPECIFIED: 'ENFORCEMENT_MODE_UNSPECIFIED',
-    /** Blocks traffic that violates network policy. This is the default mode. */
-    ENFORCED: 'ENFORCED',
-    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
-    DRY_RUN: 'DRY_RUN',
+const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = {
+	ENFORCEMENT_MODE_UNSPECIFIED: "ENFORCEMENT_MODE_UNSPECIFIED",
+	ENFORCED: "ENFORCED",
+	DRY_RUN: "DRY_RUN"
 };
 /**
- * At which level can <Databricks> and <Databricks> managed compute access Internet.
- * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
- * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
- * as well as UC connections and external locations.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = {
-    RESTRICTION_MODE_UNSPECIFIED: 'RESTRICTION_MODE_UNSPECIFIED',
-    FULL_ACCESS: 'FULL_ACCESS',
-    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
+* At which level can <Databricks> and <Databricks> managed compute access Internet.
+* FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
+* RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
+* as well as UC connections and external locations.
+*/
+const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = {
+	RESTRICTION_MODE_UNSPECIFIED: "RESTRICTION_MODE_UNSPECIFIED",
+	FULL_ACCESS: "FULL_ACCESS",
+	RESTRICTED_ACCESS: "RESTRICTED_ACCESS"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = {
-    STORAGE_DESTINATION_TYPE_UNSPECIFIED: 'STORAGE_DESTINATION_TYPE_UNSPECIFIED',
-    /**
-     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
-     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
-     */
-    AWS_S3: 'AWS_S3',
-    AZURE_STORAGE: 'AZURE_STORAGE',
-    GOOGLE_CLOUD_STORAGE: 'GOOGLE_CLOUD_STORAGE',
-};
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const EndpointUseCase_EndpointUseCase = {
-    /** service-direct frontend private link connectivity. */
-    SERVICE_DIRECT: 'SERVICE_DIRECT',
+const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = {
+	STORAGE_DESTINATION_TYPE_UNSPECIFIED: "STORAGE_DESTINATION_TYPE_UNSPECIFIED",
+	AWS_S3: "AWS_S3",
+	AZURE_STORAGE: "AZURE_STORAGE",
+	GOOGLE_CLOUD_STORAGE: "GOOGLE_CLOUD_STORAGE"
 };
+const EndpointUseCase_EndpointUseCase = { SERVICE_DIRECT: "SERVICE_DIRECT" };
 /**
- * Qualifies the breadth of API access permitted by an ingress network policy rule.
- * API_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;
- * API_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_ApiScopeQualifier = {
-    /** Narrows matching to read-only variants of the listed scopes (e.g. GET/HEAD requests). */
-    API_SCOPE_QUALIFIER_READ: 'API_SCOPE_QUALIFIER_READ',
-    /** Matches any scope regardless of access level. */
-    API_SCOPE_QUALIFIER_ALL: 'API_SCOPE_QUALIFIER_ALL',
+* Qualifies the breadth of API access permitted by an ingress network policy rule.
+* API_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;
+* API_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.
+*/
+const IngressNetworkPolicy_ApiScopeQualifier = {
+	API_SCOPE_QUALIFIER_READ: "API_SCOPE_QUALIFIER_READ",
+	API_SCOPE_QUALIFIER_ALL: "API_SCOPE_QUALIFIER_ALL"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_Authentication_IdentityType = {
-    IDENTITY_TYPE_UNSPECIFIED: 'IDENTITY_TYPE_UNSPECIFIED',
-    IDENTITY_TYPE_ALL_USERS: 'IDENTITY_TYPE_ALL_USERS',
-    IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS: 'IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS',
-    IDENTITY_TYPE_SELECTED_IDENTITIES: 'IDENTITY_TYPE_SELECTED_IDENTITIES',
+const IngressNetworkPolicy_Authentication_IdentityType = {
+	IDENTITY_TYPE_UNSPECIFIED: "IDENTITY_TYPE_UNSPECIFIED",
+	IDENTITY_TYPE_ALL_USERS: "IDENTITY_TYPE_ALL_USERS",
+	IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS: "IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS",
+	IDENTITY_TYPE_SELECTED_IDENTITIES: "IDENTITY_TYPE_SELECTED_IDENTITIES"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_AuthenticationIdentity_PrincipalType = {
-    PRINCIPAL_TYPE_UNSPECIFIED: 'PRINCIPAL_TYPE_UNSPECIFIED',
-    PRINCIPAL_TYPE_USER: 'PRINCIPAL_TYPE_USER',
-    PRINCIPAL_TYPE_SERVICE_PRINCIPAL: 'PRINCIPAL_TYPE_SERVICE_PRINCIPAL',
+const IngressNetworkPolicy_AuthenticationIdentity_PrincipalType = {
+	PRINCIPAL_TYPE_UNSPECIFIED: "PRINCIPAL_TYPE_UNSPECIFIED",
+	PRINCIPAL_TYPE_USER: "PRINCIPAL_TYPE_USER",
+	PRINCIPAL_TYPE_SERVICE_PRINCIPAL: "PRINCIPAL_TYPE_SERVICE_PRINCIPAL"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = {
-    FULL_ACCESS: 'FULL_ACCESS',
-    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
+const IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = {
+	FULL_ACCESS: "FULL_ACCESS",
+	RESTRICTED_ACCESS: "RESTRICTED_ACCESS",
+	LEGACY_MODE: "LEGACY_MODE"
 };
 /**
- * The restriction mode for private access. In ALLOW_ALL_REGISTERED_ENDPOINTS mode,
- * requests arriving through any endpoint registered to the account are allowed, and
- * deny rules and allow rules cannot be set. In RESTRICTED_ACCESS mode, access is
- * restricted based on deny rules and allow rules; requests that do not match any
- * allow rule are denied.
- */
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_PrivateAccess_RestrictionMode = {
-    /**
-     * Allows requests arriving through any endpoint registered to the account.
-     * Deny rules and allow rules cannot be set in this mode.
-     */
-    ALLOW_ALL_REGISTERED_ENDPOINTS: 'ALLOW_ALL_REGISTERED_ENDPOINTS',
-    /**
-     * Restricts access based on deny rules and allow rules. Requests that do not
-     * match any allow rule are denied.
-     */
-    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
+* The restriction mode for private access. In ALLOW_ALL_REGISTERED_ENDPOINTS mode,
+* requests arriving through any endpoint registered to the account are allowed, and
+* deny rules and allow rules cannot be set. In RESTRICTED_ACCESS mode, access is
+* restricted based on deny rules and allow rules; requests that do not match any
+* allow rule are denied.
+*/
+const IngressNetworkPolicy_PrivateAccess_RestrictionMode = {
+	ALLOW_ALL_REGISTERED_ENDPOINTS: "ALLOW_ALL_REGISTERED_ENDPOINTS",
+	RESTRICTED_ACCESS: "RESTRICTED_ACCESS"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const IngressNetworkPolicy_PublicAccess_RestrictionMode = {
-    FULL_ACCESS: 'FULL_ACCESS',
-    RESTRICTED_ACCESS: 'RESTRICTED_ACCESS',
+const IngressNetworkPolicy_PublicAccess_RestrictionMode = {
+	FULL_ACCESS: "FULL_ACCESS",
+	RESTRICTED_ACCESS: "RESTRICTED_ACCESS"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const NccPrivateEndpointRule_PrivateLinkConnectionState = {
-    PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
-    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
-    ESTABLISHED: 'ESTABLISHED',
-    /** Connection was rejected by the private link resource owner. */
-    REJECTED: 'REJECTED',
-    /**
-     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
-     * be deleted for clean-up.
-     */
-    DISCONNECTED: 'DISCONNECTED',
-    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
-    EXPIRED: 'EXPIRED',
-    /** The endpoint has been created and pending approval. */
-    PENDING: 'PENDING',
-    /** The endpoint creation is in progress. */
-    CREATING: 'CREATING',
-    /** The endpoint creation failed. */
-    CREATE_FAILED: 'CREATE_FAILED',
+const NccPrivateEndpointRule_PrivateLinkConnectionState = {
+	PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED",
+	ESTABLISHED: "ESTABLISHED",
+	REJECTED: "REJECTED",
+	DISCONNECTED: "DISCONNECTED",
+	EXPIRED: "EXPIRED",
+	PENDING: "PENDING",
+	CREATING: "CREATING",
+	CREATE_FAILED: "CREATE_FAILED"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = {
-    PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
-    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
-    ESTABLISHED: 'ESTABLISHED',
-    /** Connection was rejected by the private link resource owner. */
-    REJECTED: 'REJECTED',
-    /**
-     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
-     * be deleted for clean-up.
-     */
-    DISCONNECTED: 'DISCONNECTED',
-    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
-    EXPIRED: 'EXPIRED',
-    /** The endpoint has been created and pending approval. */
-    PENDING: 'PENDING',
-    /** The endpoint creation is in progress. */
-    CREATING: 'CREATING',
-    /** The endpoint creation failed. */
-    CREATE_FAILED: 'CREATE_FAILED',
+const NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = {
+	PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED",
+	ESTABLISHED: "ESTABLISHED",
+	REJECTED: "REJECTED",
+	DISCONNECTED: "DISCONNECTED",
+	EXPIRED: "EXPIRED",
+	PENDING: "PENDING",
+	CREATING: "CREATING",
+	CREATE_FAILED: "CREATE_FAILED"
 };
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Enum-style const object.
-export const NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = {
-    PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: 'PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED',
-    /** The endpoint has been created and pending approval. */
-    INIT: 'INIT',
-    /** The endpoint has been approved and is ready to use in your serverless compute resources. */
-    ESTABLISHED: 'ESTABLISHED',
-    /** Connection was rejected by the private link resource owner. */
-    REJECTED: 'REJECTED',
-    /**
-     * Connection was removed by the private link resource owner, the private endpoint becomes informative and should
-     * be deleted for clean-up.
-     */
-    DISCONNECTED: 'DISCONNECTED',
-    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
-    EXPIRED: 'EXPIRED',
-    /** The endpoint has been created and pending approval. */
-    PENDING: 'PENDING',
-    /** The endpoint creation is in progress. */
-    CREATING: 'CREATING',
-    /** The endpoint creation failed. */
-    CREATE_FAILED: 'CREATE_FAILED',
+const NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = {
+	PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED",
+	INIT: "INIT",
+	ESTABLISHED: "ESTABLISHED",
+	REJECTED: "REJECTED",
+	DISCONNECTED: "DISCONNECTED",
+	EXPIRED: "EXPIRED",
+	PENDING: "PENDING",
+	CREATING: "CREATING",
+	CREATE_FAILED: "CREATE_FAILED"
 };
-export const unmarshalAccountIpAccessListSchema = z
-    .object({
-    list_id: z.string().optional(),
-    label: z.string().optional(),
-    ip_addresses: z.array(z.string()).optional(),
-    address_count: z.number().optional(),
-    list_type: z.string().optional(),
-    created_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    created_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    listId: d.list_id,
-    label: d.label,
-    ipAddresses: d.ip_addresses,
-    addressCount: d.address_count,
-    listType: d.list_type,
-    createdAt: d.created_at,
-    createdBy: d.created_by,
-    updatedAt: d.updated_at,
-    updatedBy: d.updated_by,
-    enabled: d.enabled,
-}));
-export const unmarshalAccountNetworkPolicySchema = z
-    .object({
-    network_policy_id: z.string().optional(),
-    account_id: z.string().optional(),
-    egress: z.lazy(() => unmarshalEgressNetworkPolicySchema).optional(),
-    ingress: z.lazy(() => unmarshalIngressNetworkPolicySchema).optional(),
-    ingress_dry_run: z
-        .lazy(() => unmarshalIngressNetworkPolicySchema)
-        .optional(),
-})
-    .transform(d => ({
-    networkPolicyId: d.network_policy_id,
-    accountId: d.account_id,
-    egress: d.egress,
-    ingress: d.ingress,
-    ingressDryRun: d.ingress_dry_run,
-}));
-export const unmarshalAwsVpcEndpointInfoSchema = z
-    .object({
-    aws_vpc_endpoint_id: z.string().optional(),
-    aws_endpoint_service_id: z.string().optional(),
-    aws_account_id: z.string().optional(),
-})
-    .transform(d => ({
-    awsVpcEndpointId: d.aws_vpc_endpoint_id,
-    awsEndpointServiceId: d.aws_endpoint_service_id,
-    awsAccountId: d.aws_account_id,
-}));
-export const unmarshalAzurePrivateEndpointInfoSchema = z
-    .object({
-    private_endpoint_name: z.string().optional(),
-    private_endpoint_resource_guid: z.string().optional(),
-    private_endpoint_resource_id: z.string().optional(),
-    private_link_service_id: z.string().optional(),
-})
-    .transform(d => ({
-    privateEndpointName: d.private_endpoint_name,
-    privateEndpointResourceGuid: d.private_endpoint_resource_guid,
-    privateEndpointResourceId: d.private_endpoint_resource_id,
-    privateLinkServiceId: d.private_link_service_id,
-}));
-export const unmarshalCreateAccountIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z
-        .lazy(() => unmarshalAccountIpAccessListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalCreateIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
-    .object({
-    default_rules: z
-        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
-        .optional(),
-    target_rules: z
-        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    defaultRules: d.default_rules,
-    targetRules: d.target_rules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
-    .object({
-    azure_private_endpoint_rules: z
-        .array(z.lazy(() => unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
-        .optional(),
-    aws_private_endpoint_rules: z
-        .array(z.lazy(() => unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    azurePrivateEndpointRules: d.azure_private_endpoint_rules,
-    awsPrivateEndpointRules: d.aws_private_endpoint_rules,
-}));
-export const unmarshalDeleteAccountIpAccessListResponseSchema = z.object({});
-export const unmarshalDeleteIpAccessListResponseSchema = z.object({});
-export const unmarshalEgressNetworkPolicySchema = z
-    .object({
-    network_access: z
-        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema)
-        .optional(),
-})
-    .transform(d => ({
-    networkAccess: d.network_access,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
-    .object({
-    restriction_mode: z.string().optional(),
-    allowed_internet_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowed_storage_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
-        .optional(),
-    policy_enforcement: z
-        .lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
-        .optional(),
-    blocked_internet_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowed_databricks_destinations: z
-        .array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    allowedInternetDestinations: d.allowed_internet_destinations,
-    allowedStorageDestinations: d.allowed_storage_destinations,
-    policyEnforcement: d.policy_enforcement,
-    blockedInternetDestinations: d.blocked_internet_destinations,
-    allowedDatabricksDestinations: d.allowed_databricks_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
-    .object({
-    workspace_ids: z
-        .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
-        .optional(),
-})
-    .transform(d => ({
-    workspaceIds: d.workspace_ids,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
-    .object({
-    destination: z.string().optional(),
-    internet_destination_type: z.string().optional(),
-})
-    .transform(d => ({
-    destination: d.destination,
-    internetDestinationType: d.internet_destination_type,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
-    .object({
-    enforcement_mode: z.string().optional(),
-    dry_run_mode_product_filter: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    enforcementMode: d.enforcement_mode,
-    dryRunModeProductFilter: d.dry_run_mode_product_filter,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
-    .object({
-    bucket_name: z.string().optional(),
-    region: z.string().optional(),
-    storage_destination_type: z.string().optional(),
-    azure_storage_account: z.string().optional(),
-    azure_storage_service: z.string().optional(),
-})
-    .transform(d => ({
-    bucketName: d.bucket_name,
-    region: d.region,
-    storageDestinationType: d.storage_destination_type,
-    azureStorageAccount: d.azure_storage_account,
-    azureStorageService: d.azure_storage_service,
-}));
-export const unmarshalEndpointSchema = z
-    .object({
-    name: z.string().optional(),
-    endpoint_id: z.string().optional(),
-    account_id: z.string().optional(),
-    display_name: z.string().optional(),
-    use_case: z.string().optional(),
-    region: z.string().optional(),
-    state: z.string().optional(),
-    azure_private_endpoint_info: z
-        .lazy(() => unmarshalAzurePrivateEndpointInfoSchema)
-        .optional(),
-    aws_vpc_endpoint_info: z
-        .lazy(() => unmarshalAwsVpcEndpointInfoSchema)
-        .optional(),
-    gcp_psc_endpoint_info: z
-        .lazy(() => unmarshalGcpPscEndpointInfoSchema)
-        .optional(),
-    create_time: z
-        .string()
-        .transform(s => Temporal.Instant.from(s))
-        .optional(),
-})
-    .transform(d => ({
-    name: d.name,
-    endpointId: d.endpoint_id,
-    accountId: d.account_id,
-    displayName: d.display_name,
-    useCase: d.use_case,
-    region: d.region,
-    state: d.state,
-    endpointInfo: d.azure_private_endpoint_info !== undefined
-        ? {
-            $case: 'azurePrivateEndpointInfo',
-            azurePrivateEndpointInfo: d.azure_private_endpoint_info,
-        }
-        : d.aws_vpc_endpoint_info !== undefined
-            ? {
-                $case: 'awsVpcEndpointInfo',
-                awsVpcEndpointInfo: d.aws_vpc_endpoint_info,
-            }
-            : d.gcp_psc_endpoint_info !== undefined
-                ? {
-                    $case: 'gcpPscEndpointInfo',
-                    gcpPscEndpointInfo: d.gcp_psc_endpoint_info,
-                }
-                : undefined,
-    createTime: d.create_time,
-}));
-export const unmarshalGcpEndpointSchema = z
-    .object({
-    psc_endpoint_uri: z.string().optional(),
-    service_attachment: z.string().optional(),
-})
-    .transform(d => ({
-    pscEndpointUri: d.psc_endpoint_uri,
-    targetServices: d.service_attachment !== undefined
-        ? {
-            $case: 'serviceAttachment',
-            serviceAttachment: d.service_attachment,
-        }
-        : undefined,
-}));
-export const unmarshalGcpNetworkInfoSchema = z
-    .object({
-    network_project_id: z.string().optional(),
-    vpc_id: z.string().optional(),
-    subnet_id: z.string().optional(),
-    subnet_region: z.string().optional(),
-    pod_ip_range_name: z.string().optional(),
-    service_ip_range_name: z.string().optional(),
-})
-    .transform(d => ({
-    networkProjectId: d.network_project_id,
-    vpcId: d.vpc_id,
-    subnetId: d.subnet_id,
-    subnetRegion: d.subnet_region,
-    podIpRangeName: d.pod_ip_range_name,
-    serviceIpRangeName: d.service_ip_range_name,
-}));
-export const unmarshalGcpPscEndpointInfoSchema = z
-    .object({
-    psc_connection_id: z.string().optional(),
-    project_id: z.string().optional(),
-    psc_endpoint: z.string().optional(),
-    endpoint_region: z.string().optional(),
-    service_attachment_id: z.string().optional(),
-})
-    .transform(d => ({
-    pscConnectionId: d.psc_connection_id,
-    projectId: d.project_id,
-    pscEndpoint: d.psc_endpoint,
-    endpointRegion: d.endpoint_region,
-    serviceAttachmentId: d.service_attachment_id,
-}));
-export const unmarshalGcpVpcEndpointInfoSchema = z
-    .object({
-    psc_connection_id: z.string().optional(),
-    project_id: z.string().optional(),
-    psc_endpoint_name: z.string().optional(),
-    endpoint_region: z.string().optional(),
-    service_attachment_id: z.string().optional(),
-})
-    .transform(d => ({
-    pscConnectionId: d.psc_connection_id,
-    projectId: d.project_id,
-    pscEndpointName: d.psc_endpoint_name,
-    endpointRegion: d.endpoint_region,
-    serviceAttachmentId: d.service_attachment_id,
-}));
-export const unmarshalGetAccountIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z
-        .lazy(() => unmarshalAccountIpAccessListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalGetIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalIngressNetworkPolicySchema = z
-    .object({
-    public_access: z
-        .lazy(() => unmarshalIngressNetworkPolicy_PublicAccessSchema)
-        .optional(),
-    private_access: z
-        .lazy(() => unmarshalIngressNetworkPolicy_PrivateAccessSchema)
-        .optional(),
-    cross_workspace_access: z
-        .lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema)
-        .optional(),
-})
-    .transform(d => ({
-    publicAccess: d.public_access,
-    privateAccess: d.private_access,
-    crossWorkspaceAccess: d.cross_workspace_access,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AccountApiDestinationSchema = z
-    .object({
-    scopes: z.array(z.string()).optional(),
-    scope_qualifier: z.string().optional(),
-})
-    .transform(d => ({
-    scopes: d.scopes,
-    scopeQualifier: d.scope_qualifier,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AccountUiDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AuthenticationSchema = z
-    .object({
-    identity_type: z.string().optional(),
-    identities: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema))
-        .optional(),
-})
-    .transform(d => ({
-    identityType: d.identity_type,
-    identities: d.identities,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema = z
-    .object({
-    principal_type: z.string().optional(),
-    principal_id: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-})
-    .transform(d => ({
-    principalType: d.principal_type,
-    principalId: d.principal_id,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
-    .object({
-    restriction_mode: z.string().optional(),
-    deny_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
-        .optional(),
-    allow_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    denyRules: d.deny_rules,
-    allowRules: d.allow_rules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
-    .object({
-    all_source_workspaces: z.boolean().optional(),
-    selected_workspaces: z
-        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceIdListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    source: d.all_source_workspaces !== undefined
-        ? {
-            $case: 'allSourceWorkspaces',
-            allSourceWorkspaces: d.all_source_workspaces,
-        }
-        : d.selected_workspaces !== undefined
-            ? {
-                $case: 'selectedWorkspaces',
-                selectedWorkspaces: d.selected_workspaces,
-            }
-            : undefined,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_EndpointsSchema = z
-    .object({
-    endpoint_ids: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    endpointIds: d.endpoint_ids,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_IpRangesSchema = z
-    .object({
-    ip_ranges: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    ipRanges: d.ip_ranges,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PrivateAccessSchema = z
-    .object({
-    restriction_mode: z.string().optional(),
-    deny_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema))
-        .optional(),
-    allow_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    denyRules: d.deny_rules,
-    allowRules: d.allow_rules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema = z
-    .object({
-    endpoints: z
-        .lazy(() => unmarshalIngressNetworkPolicy_EndpointsSchema)
-        .optional(),
-    all_registered_endpoints: z.boolean().optional(),
-    azure_workspace_private_link: z.boolean().optional(),
-    all_private_access: z.boolean().optional(),
-})
-    .transform(d => ({
-    source: d.endpoints !== undefined
-        ? { $case: 'endpoints', endpoints: d.endpoints }
-        : d.all_registered_endpoints !== undefined
-            ? {
-                $case: 'allRegisteredEndpoints',
-                allRegisteredEndpoints: d.all_registered_endpoints,
-            }
-            : d.azure_workspace_private_link !== undefined
-                ? {
-                    $case: 'azureWorkspacePrivateLink',
-                    azureWorkspacePrivateLink: d.azure_workspace_private_link,
-                }
-                : d.all_private_access !== undefined
-                    ? {
-                        $case: 'allPrivateAccess',
-                        allPrivateAccess: d.all_private_access,
-                    }
-                    : undefined,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PublicAccessSchema = z
-    .object({
-    restriction_mode: z.string().optional(),
-    deny_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema))
-        .optional(),
-    allow_rules: z
-        .array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restrictionMode: d.restriction_mode,
-    denyRules: d.deny_rules,
-    allowRules: d.allow_rules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PublicIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => unmarshalIngressNetworkPolicy_PublicRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_PublicRequestOriginSchema = z
-    .object({
-    all_ip_ranges: z.boolean().optional(),
-    included_ip_ranges: z
-        .lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema)
-        .optional(),
-    excluded_ip_ranges: z
-        .lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema)
-        .optional(),
-})
-    .transform(d => ({
-    source: d.all_ip_ranges !== undefined
-        ? { $case: 'allIpRanges', allIpRanges: d.all_ip_ranges }
-        : d.included_ip_ranges !== undefined
-            ? {
-                $case: 'includedIpRanges',
-                includedIpRanges: d.included_ip_ranges,
-            }
-            : d.excluded_ip_ranges !== undefined
-                ? {
-                    $case: 'excludedIpRanges',
-                    excludedIpRanges: d.excluded_ip_ranges,
-                }
-                : undefined,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_RequestDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-    workspace_ui: z
-        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema)
-        .optional(),
-    workspace_api: z
-        .lazy(() => unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema)
-        .optional(),
-    apps_runtime: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema)
-        .optional(),
-    lakebase_runtime: z
-        .lazy(() => unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
-        .optional(),
-    account_ui: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AccountUiDestinationSchema)
-        .optional(),
-    account_api: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AccountApiDestinationSchema)
-        .optional(),
-    account_databricks_one: z
-        .lazy(() => unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
-        .optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-    workspaceUi: d.workspace_ui,
-    workspaceApi: d.workspace_api,
-    appsRuntime: d.apps_runtime,
-    lakebaseRuntime: d.lakebase_runtime,
-    accountUi: d.account_ui,
-    accountApi: d.account_api,
-    accountDatabricksOne: d.account_databricks_one,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
-    .object({
-    scopes: z.array(z.string()).optional(),
-    scope_qualifier: z.string().optional(),
-})
-    .transform(d => ({
-    scopes: d.scopes,
-    scopeQualifier: d.scope_qualifier,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_WorkspaceIdListSchema = z
-    .object({
-    workspace_ids: z
-        .array(z.union([z.number(), z.bigint()]).transform(v => BigInt(v)))
-        .optional(),
-})
-    .transform(d => ({
-    workspaceIds: d.workspace_ids,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
-    .object({
-    all_destinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    allDestinations: d.all_destinations,
-}));
-export const unmarshalIpAccessListSchema = z
-    .object({
-    list_id: z.string().optional(),
-    label: z.string().optional(),
-    ip_addresses: z.array(z.string()).optional(),
-    address_count: z.number().optional(),
-    list_type: z.string().optional(),
-    created_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    created_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_by: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    listId: d.list_id,
-    label: d.label,
-    ipAddresses: d.ip_addresses,
-    addressCount: d.address_count,
-    listType: d.list_type,
-    createdAt: d.created_at,
-    createdBy: d.created_by,
-    updatedAt: d.updated_at,
-    updatedBy: d.updated_by,
-    enabled: d.enabled,
-}));
-export const unmarshalListAccountIpAccessListsResponseSchema = z
-    .object({
-    ip_access_lists: z
-        .array(z.lazy(() => unmarshalAccountIpAccessListSchema))
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessLists: d.ip_access_lists,
-}));
-export const unmarshalListEndpointsResponseSchema = z
-    .object({
-    items: z.array(z.lazy(() => unmarshalEndpointSchema)).optional(),
-    next_page_token: z.string().optional(),
-})
-    .transform(d => ({
-    items: d.items,
-    nextPageToken: d.next_page_token,
-}));
-export const unmarshalListIpAccessListsResponseSchema = z
-    .object({
-    ip_access_lists: z
-        .array(z.lazy(() => unmarshalIpAccessListSchema))
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessLists: d.ip_access_lists,
-}));
-export const unmarshalListNccPrivateEndpointRulesResponseSchema = z
-    .object({
-    items: z
-        .array(z.lazy(() => unmarshalNccPrivateEndpointRuleSchema))
-        .optional(),
-    next_page_token: z.string().optional(),
-})
-    .transform(d => ({
-    items: d.items,
-    nextPageToken: d.next_page_token,
-}));
-export const unmarshalListNetworkConnectivityConfigsResponseSchema = z
-    .object({
-    items: z
-        .array(z.lazy(() => unmarshalNetworkConnectivityConfigSchema))
-        .optional(),
-    next_page_token: z.string().optional(),
-})
-    .transform(d => ({
-    items: d.items,
-    nextPageToken: d.next_page_token,
-}));
-export const unmarshalListNetworkPoliciesResponseSchema = z
-    .object({
-    items: z
-        .array(z.lazy(() => unmarshalAccountNetworkPolicySchema))
-        .optional(),
-    next_page_token: z.string().optional(),
-})
-    .transform(d => ({
-    items: d.items,
-    nextPageToken: d.next_page_token,
-}));
-export const unmarshalNccPrivateEndpointRuleSchema = z
-    .object({
-    rule_id: z.string().optional(),
-    network_connectivity_config_id: z.string().optional(),
-    connection_state: z.string().optional(),
-    domain_names: z.array(z.string()).optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    deactivated: z.boolean().optional(),
-    deactivated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    error_message: z.string().optional(),
-    resource_id: z.string().optional(),
-    group_id: z.string().optional(),
-    endpoint_name: z.string().optional(),
-    account_id: z.string().optional(),
-    endpoint_service: z.string().optional(),
-    resource_names: z.array(z.string()).optional(),
-    vpc_endpoint_id: z.string().optional(),
-    enabled: z.boolean().optional(),
-    gcp_endpoint: z.lazy(() => unmarshalGcpEndpointSchema).optional(),
-})
-    .transform(d => ({
-    ruleId: d.rule_id,
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    connectionState: d.connection_state,
-    domainNames: d.domain_names,
-    creationTime: d.creation_time,
-    updatedTime: d.updated_time,
-    deactivated: d.deactivated,
-    deactivatedAt: d.deactivated_at,
-    errorMessage: d.error_message,
-    resourceId: d.resource_id,
-    groupId: d.group_id,
-    endpointName: d.endpoint_name,
-    accountId: d.account_id,
-    endpointService: d.endpoint_service,
-    resourceNames: d.resource_names,
-    vpcEndpointId: d.vpc_endpoint_id,
-    enabled: d.enabled,
-    endpoint: d.gcp_endpoint !== undefined
-        ? { $case: 'gcpEndpoint', gcpEndpoint: d.gcp_endpoint }
-        : undefined,
-}));
-export const unmarshalNetworkSchema = z
-    .object({
-    network_id: z.string().optional(),
-    account_id: z.string().optional(),
-    workspace_id: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    vpc_id: z.string().optional(),
-    subnet_ids: z.array(z.string()).optional(),
-    security_group_ids: z.array(z.string()).optional(),
-    vpc_status: z.string().optional(),
-    error_messages: z
-        .array(z.lazy(() => unmarshalNetworkHealthSchema))
-        .optional(),
-    network_name: z.string().optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    warning_messages: z
-        .array(z.lazy(() => unmarshalNetworkWarningSchema))
-        .optional(),
-    vpc_endpoints: z.lazy(() => unmarshalNetworkVpcEndpointsSchema).optional(),
-    gcp_network_info: z.lazy(() => unmarshalGcpNetworkInfoSchema).optional(),
-})
-    .transform(d => ({
-    networkId: d.network_id,
-    accountId: d.account_id,
-    workspaceId: d.workspace_id,
-    vpcId: d.vpc_id,
-    subnetIds: d.subnet_ids,
-    securityGroupIds: d.security_group_ids,
-    vpcStatus: d.vpc_status,
-    errorMessages: d.error_messages,
-    networkName: d.network_name,
-    creationTime: d.creation_time,
-    warningMessages: d.warning_messages,
-    vpcEndpoints: d.vpc_endpoints,
-    networkInfo: d.gcp_network_info !== undefined
-        ? { $case: 'gcpNetworkInfo', gcpNetworkInfo: d.gcp_network_info }
-        : undefined,
-}));
-export const unmarshalNetworkConnectivityConfigSchema = z
-    .object({
-    network_connectivity_config_id: z.string().optional(),
-    account_id: z.string().optional(),
-    name: z.string().optional(),
-    region: z.string().optional(),
-    egress_config: z
-        .lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-})
-    .transform(d => ({
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    accountId: d.account_id,
-    name: d.name,
-    region: d.region,
-    egressConfig: d.egress_config,
-    updatedTime: d.updated_time,
-    creationTime: d.creation_time,
-}));
-export const unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
-    .object({
-    rule_id: z.string().optional(),
-    network_connectivity_config_id: z.string().optional(),
-    account_id: z.string().optional(),
-    endpoint_service: z.string().optional(),
-    domain_names: z.array(z.string()).optional(),
-    resource_names: z.array(z.string()).optional(),
-    vpc_endpoint_id: z.string().optional(),
-    connection_state: z.string().optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    deactivated: z.boolean().optional(),
-    deactivated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    enabled: z.boolean().optional(),
-    error_message: z.string().optional(),
-})
-    .transform(d => ({
-    ruleId: d.rule_id,
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    accountId: d.account_id,
-    endpointService: d.endpoint_service,
-    domainNames: d.domain_names,
-    resourceNames: d.resource_names,
-    vpcEndpointId: d.vpc_endpoint_id,
-    connectionState: d.connection_state,
-    creationTime: d.creation_time,
-    updatedTime: d.updated_time,
-    deactivated: d.deactivated,
-    deactivatedAt: d.deactivated_at,
-    enabled: d.enabled,
-    errorMessage: d.error_message,
-}));
-export const unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
-    .object({
-    rule_id: z.string().optional(),
-    network_connectivity_config_id: z.string().optional(),
-    resource_id: z.string().optional(),
-    group_id: z.string().optional(),
-    endpoint_name: z.string().optional(),
-    connection_state: z.string().optional(),
-    creation_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    updated_time: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    deactivated: z.boolean().optional(),
-    deactivated_at: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-    domain_names: z.array(z.string()).optional(),
-    error_message: z.string().optional(),
-})
-    .transform(d => ({
-    ruleId: d.rule_id,
-    networkConnectivityConfigId: d.network_connectivity_config_id,
-    resourceId: d.resource_id,
-    groupId: d.group_id,
-    endpointName: d.endpoint_name,
-    connectionState: d.connection_state,
-    creationTime: d.creation_time,
-    updatedTime: d.updated_time,
-    deactivated: d.deactivated,
-    deactivatedAt: d.deactivated_at,
-    domainNames: d.domain_names,
-    errorMessage: d.error_message,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
-    .object({
-    azure_service_endpoint_rule: z
-        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema)
-        .optional(),
-    aws_stable_ip_rule: z
-        .lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    azureServiceEndpointRule: d.azure_service_endpoint_rule,
-    awsStableIpRule: d.aws_stable_ip_rule,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z
-    .object({
-    cidr_blocks: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    cidrBlocks: d.cidr_blocks,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z
-    .object({
-    target_region: z.string().optional(),
-    target_services: z.array(z.string()).optional(),
-    subnets: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    targetRegion: d.target_region,
-    targetServices: d.target_services,
-    subnets: d.subnets,
-}));
-export const unmarshalNetworkHealthSchema = z
-    .object({
-    error_type: z.string().optional(),
-    error_message: z.string().optional(),
-})
-    .transform(d => ({
-    errorType: d.error_type,
-    errorMessage: d.error_message,
-}));
-export const unmarshalNetworkVpcEndpointsSchema = z
-    .object({
-    rest_api: z.array(z.string()).optional(),
-    dataplane_relay: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    restApi: d.rest_api,
-    dataplaneRelay: d.dataplane_relay,
-}));
-export const unmarshalNetworkWarningSchema = z
-    .object({
-    warning_type: z.string().optional(),
-    warning_message: z.string().optional(),
-})
-    .transform(d => ({
-    warningType: d.warning_type,
-    warningMessage: d.warning_message,
-}));
-export const unmarshalPrivateAccessSettingsSchema = z
-    .object({
-    private_access_settings_id: z.string().optional(),
-    account_id: z.string().optional(),
-    private_access_settings_name: z.string().optional(),
-    region: z.string().optional(),
-    public_access_enabled: z.boolean().optional(),
-    private_access_level: z.string().optional(),
-    allowed_vpc_endpoint_ids: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    privateAccessSettingsId: d.private_access_settings_id,
-    accountId: d.account_id,
-    privateAccessSettingsName: d.private_access_settings_name,
-    region: d.region,
-    publicAccessEnabled: d.public_access_enabled,
-    privateAccessLevel: d.private_access_level,
-    allowedVpcEndpointIds: d.allowed_vpc_endpoint_ids,
-}));
-export const unmarshalReplaceAccountIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z
-        .lazy(() => unmarshalAccountIpAccessListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalReplaceIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalUpdateAccountIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z
-        .lazy(() => unmarshalAccountIpAccessListSchema)
-        .optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalUpdateIpAccessListResponseSchema = z
-    .object({
-    ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional(),
-})
-    .transform(d => ({
-    ipAccessList: d.ip_access_list,
-}));
-export const unmarshalVpcEndpointSchema = z
-    .object({
-    vpc_endpoint_id: z.string().optional(),
-    account_id: z.string().optional(),
-    vpc_endpoint_name: z.string().optional(),
-    aws_vpc_endpoint_id: z.string().optional(),
-    aws_endpoint_service_id: z.string().optional(),
-    use_case: z.string().optional(),
-    region: z.string().optional(),
-    aws_account_id: z.string().optional(),
-    state: z.string().optional(),
-    gcp_vpc_endpoint_info: z
-        .lazy(() => unmarshalGcpVpcEndpointInfoSchema)
-        .optional(),
-})
-    .transform(d => ({
-    vpcEndpointId: d.vpc_endpoint_id,
-    accountId: d.account_id,
-    vpcEndpointName: d.vpc_endpoint_name,
-    awsVpcEndpointId: d.aws_vpc_endpoint_id,
-    awsEndpointServiceId: d.aws_endpoint_service_id,
-    useCase: d.use_case,
-    region: d.region,
-    awsAccountId: d.aws_account_id,
-    state: d.state,
-    vpcEndpointInfo: d.gcp_vpc_endpoint_info !== undefined
-        ? {
-            $case: 'gcpVpcEndpointInfo',
-            gcpVpcEndpointInfo: d.gcp_vpc_endpoint_info,
-        }
-        : undefined,
-}));
-export const unmarshalWorkspaceNetworkOptionSchema = z
-    .object({
-    network_policy_id: z.string().optional(),
-    workspace_id: z
-        .union([z.number(), z.bigint()])
-        .transform(v => BigInt(v))
-        .optional(),
-})
-    .transform(d => ({
-    networkPolicyId: d.network_policy_id,
-    workspaceId: d.workspace_id,
-}));
-export const marshalAccountNetworkPolicySchema = z
-    .object({
-    networkPolicyId: z.string().optional(),
-    accountId: z.string().optional(),
-    egress: z.lazy(() => marshalEgressNetworkPolicySchema).optional(),
-    ingress: z.lazy(() => marshalIngressNetworkPolicySchema).optional(),
-    ingressDryRun: z.lazy(() => marshalIngressNetworkPolicySchema).optional(),
-})
-    .transform(d => ({
-    network_policy_id: d.networkPolicyId,
-    account_id: d.accountId,
-    egress: d.egress,
-    ingress: d.ingress,
-    ingress_dry_run: d.ingressDryRun,
-}));
-export const marshalAwsVpcEndpointInfoSchema = z
-    .object({
-    awsVpcEndpointId: z.string().optional(),
-    awsEndpointServiceId: z.string().optional(),
-    awsAccountId: z.string().optional(),
-})
-    .transform(d => ({
-    aws_vpc_endpoint_id: d.awsVpcEndpointId,
-    aws_endpoint_service_id: d.awsEndpointServiceId,
-    aws_account_id: d.awsAccountId,
-}));
-export const marshalAzurePrivateEndpointInfoSchema = z
-    .object({
-    privateEndpointName: z.string().optional(),
-    privateEndpointResourceGuid: z.string().optional(),
-    privateEndpointResourceId: z.string().optional(),
-    privateLinkServiceId: z.string().optional(),
-})
-    .transform(d => ({
-    private_endpoint_name: d.privateEndpointName,
-    private_endpoint_resource_guid: d.privateEndpointResourceGuid,
-    private_endpoint_resource_id: d.privateEndpointResourceId,
-    private_link_service_id: d.privateLinkServiceId,
-}));
-export const marshalCreateAccountIpAccessListRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-}));
-export const marshalCreateIpAccessListRequestSchema = z
-    .object({
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-}));
-export const marshalCreateNetworkConnectivityConfigurationSchema = z
-    .object({
-    networkConnectivityConfigId: z.string().optional(),
-    accountId: z.string().optional(),
-    name: z.string().optional(),
-    region: z.string().optional(),
-    egressConfig: z
-        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema)
-        .optional(),
-    updatedTime: z.bigint().optional(),
-    creationTime: z.bigint().optional(),
-})
-    .transform(d => ({
-    network_connectivity_config_id: d.networkConnectivityConfigId,
-    account_id: d.accountId,
-    name: d.name,
-    region: d.region,
-    egress_config: d.egressConfig,
-    updated_time: d.updatedTime,
-    creation_time: d.creationTime,
-}));
-export const marshalCreateNetworkRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    networkName: z.string().optional(),
-    vpcId: z.string().optional(),
-    subnetIds: z.array(z.string()).optional(),
-    securityGroupIds: z.array(z.string()).optional(),
-    vpcEndpoints: z.lazy(() => marshalNetworkVpcEndpointsSchema).optional(),
-    gcpNetworkInfo: z.lazy(() => marshalGcpNetworkInfoSchema).optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    network_name: d.networkName,
-    vpc_id: d.vpcId,
-    subnet_ids: d.subnetIds,
-    security_group_ids: d.securityGroupIds,
-    vpc_endpoints: d.vpcEndpoints,
-    gcp_network_info: d.gcpNetworkInfo,
-}));
-export const marshalCreatePrivateAccessSettingsRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    privateAccessSettingsName: z.string().optional(),
-    region: z.string().optional(),
-    publicAccessEnabled: z.boolean().optional(),
-    privateAccessLevel: z.string().optional(),
-    allowedVpcEndpointIds: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    private_access_settings_name: d.privateAccessSettingsName,
-    region: d.region,
-    public_access_enabled: d.publicAccessEnabled,
-    private_access_level: d.privateAccessLevel,
-    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
-}));
-export const marshalCreatePrivateEndpointRuleSchema = z
-    .object({
-    ruleId: z.string().optional(),
-    networkConnectivityConfigId: z.string().optional(),
-    connectionState: z.string().optional(),
-    domainNames: z.array(z.string()).optional(),
-    creationTime: z.bigint().optional(),
-    updatedTime: z.bigint().optional(),
-    deactivated: z.boolean().optional(),
-    deactivatedAt: z.bigint().optional(),
-    errorMessage: z.string().optional(),
-    resourceId: z.string().optional(),
-    groupId: z.string().optional(),
-    endpointName: z.string().optional(),
-    accountId: z.string().optional(),
-    endpointService: z.string().optional(),
-    resourceNames: z.array(z.string()).optional(),
-    vpcEndpointId: z.string().optional(),
-    enabled: z.boolean().optional(),
-    endpoint: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('gcpEndpoint'),
-            gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    rule_id: d.ruleId,
-    network_connectivity_config_id: d.networkConnectivityConfigId,
-    connection_state: d.connectionState,
-    domain_names: d.domainNames,
-    creation_time: d.creationTime,
-    updated_time: d.updatedTime,
-    deactivated: d.deactivated,
-    deactivated_at: d.deactivatedAt,
-    error_message: d.errorMessage,
-    resource_id: d.resourceId,
-    group_id: d.groupId,
-    endpoint_name: d.endpointName,
-    account_id: d.accountId,
-    endpoint_service: d.endpointService,
-    resource_names: d.resourceNames,
-    vpc_endpoint_id: d.vpcEndpointId,
-    enabled: d.enabled,
-    ...(d.endpoint?.$case === 'gcpEndpoint' && {
-        gcp_endpoint: d.endpoint.gcpEndpoint,
-    }),
-}));
-export const marshalCreateVpcEndpointRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    vpcEndpointName: z.string().optional(),
-    region: z.string().optional(),
-    awsVpcEndpointId: z.string().optional(),
-    vpcEndpointInfo: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('gcpVpcEndpointInfo'),
-            gcpVpcEndpointInfo: z.lazy(() => marshalGcpVpcEndpointInfoSchema),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    vpc_endpoint_name: d.vpcEndpointName,
-    region: d.region,
-    aws_vpc_endpoint_id: d.awsVpcEndpointId,
-    ...(d.vpcEndpointInfo?.$case === 'gcpVpcEndpointInfo' && {
-        gcp_vpc_endpoint_info: d.vpcEndpointInfo.gcpVpcEndpointInfo,
-    }),
-}));
-export const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z
-    .object({
-    defaultRules: z
-        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema)
-        .optional(),
-    targetRules: z
-        .lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    default_rules: d.defaultRules,
-    target_rules: d.targetRules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z
-    .object({
-    azurePrivateEndpointRules: z
-        .array(z.lazy(() => marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema))
-        .optional(),
-    awsPrivateEndpointRules: z
-        .array(z.lazy(() => marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    azure_private_endpoint_rules: d.azurePrivateEndpointRules,
-    aws_private_endpoint_rules: d.awsPrivateEndpointRules,
-}));
-export const marshalEgressNetworkPolicySchema = z
-    .object({
-    networkAccess: z
-        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicySchema)
-        .optional(),
-})
-    .transform(d => ({
-    network_access: d.networkAccess,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicySchema = z
-    .object({
-    restrictionMode: z.string().optional(),
-    allowedInternetDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowedStorageDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema))
-        .optional(),
-    policyEnforcement: z
-        .lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema)
-        .optional(),
-    blockedInternetDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema))
-        .optional(),
-    allowedDatabricksDestinations: z
-        .array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restriction_mode: d.restrictionMode,
-    allowed_internet_destinations: d.allowedInternetDestinations,
-    allowed_storage_destinations: d.allowedStorageDestinations,
-    policy_enforcement: d.policyEnforcement,
-    blocked_internet_destinations: d.blockedInternetDestinations,
-    allowed_databricks_destinations: d.allowedDatabricksDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z
-    .object({
-    workspaceIds: z.array(z.bigint()).optional(),
-})
-    .transform(d => ({
-    workspace_ids: d.workspaceIds,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z
-    .object({
-    destination: z.string().optional(),
-    internetDestinationType: z.string().optional(),
-})
-    .transform(d => ({
-    destination: d.destination,
-    internet_destination_type: d.internetDestinationType,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z
-    .object({
-    enforcementMode: z.string().optional(),
-    dryRunModeProductFilter: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    enforcement_mode: d.enforcementMode,
-    dry_run_mode_product_filter: d.dryRunModeProductFilter,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z
-    .object({
-    bucketName: z.string().optional(),
-    region: z.string().optional(),
-    storageDestinationType: z.string().optional(),
-    azureStorageAccount: z.string().optional(),
-    azureStorageService: z.string().optional(),
-})
-    .transform(d => ({
-    bucket_name: d.bucketName,
-    region: d.region,
-    storage_destination_type: d.storageDestinationType,
-    azure_storage_account: d.azureStorageAccount,
-    azure_storage_service: d.azureStorageService,
-}));
-export const marshalEndpointSchema = z
-    .object({
-    name: z.string().optional(),
-    endpointId: z.string().optional(),
-    accountId: z.string().optional(),
-    displayName: z.string().optional(),
-    useCase: z.string().optional(),
-    region: z.string().optional(),
-    state: z.string().optional(),
-    endpointInfo: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('azurePrivateEndpointInfo'),
-            azurePrivateEndpointInfo: z.lazy(() => marshalAzurePrivateEndpointInfoSchema),
-        }),
-        z.object({
-            $case: z.literal('awsVpcEndpointInfo'),
-            awsVpcEndpointInfo: z.lazy(() => marshalAwsVpcEndpointInfoSchema),
-        }),
-        z.object({
-            $case: z.literal('gcpPscEndpointInfo'),
-            gcpPscEndpointInfo: z.lazy(() => marshalGcpPscEndpointInfoSchema),
-        }),
-    ])
-        .optional(),
-    createTime: z
-        .any()
-        .transform((d) => d.toString())
-        .optional(),
-})
-    .transform(d => ({
-    name: d.name,
-    endpoint_id: d.endpointId,
-    account_id: d.accountId,
-    display_name: d.displayName,
-    use_case: d.useCase,
-    region: d.region,
-    state: d.state,
-    ...(d.endpointInfo?.$case === 'azurePrivateEndpointInfo' && {
-        azure_private_endpoint_info: d.endpointInfo.azurePrivateEndpointInfo,
-    }),
-    ...(d.endpointInfo?.$case === 'awsVpcEndpointInfo' && {
-        aws_vpc_endpoint_info: d.endpointInfo.awsVpcEndpointInfo,
-    }),
-    ...(d.endpointInfo?.$case === 'gcpPscEndpointInfo' && {
-        gcp_psc_endpoint_info: d.endpointInfo.gcpPscEndpointInfo,
-    }),
-    create_time: d.createTime,
-}));
-export const marshalGcpEndpointSchema = z
-    .object({
-    pscEndpointUri: z.string().optional(),
-    targetServices: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('serviceAttachment'),
-            serviceAttachment: z.string(),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    psc_endpoint_uri: d.pscEndpointUri,
-    ...(d.targetServices?.$case === 'serviceAttachment' && {
-        service_attachment: d.targetServices.serviceAttachment,
-    }),
-}));
-export const marshalGcpNetworkInfoSchema = z
-    .object({
-    networkProjectId: z.string().optional(),
-    vpcId: z.string().optional(),
-    subnetId: z.string().optional(),
-    subnetRegion: z.string().optional(),
-    podIpRangeName: z.string().optional(),
-    serviceIpRangeName: z.string().optional(),
-})
-    .transform(d => ({
-    network_project_id: d.networkProjectId,
-    vpc_id: d.vpcId,
-    subnet_id: d.subnetId,
-    subnet_region: d.subnetRegion,
-    pod_ip_range_name: d.podIpRangeName,
-    service_ip_range_name: d.serviceIpRangeName,
-}));
-export const marshalGcpPscEndpointInfoSchema = z
-    .object({
-    pscConnectionId: z.string().optional(),
-    projectId: z.string().optional(),
-    pscEndpoint: z.string().optional(),
-    endpointRegion: z.string().optional(),
-    serviceAttachmentId: z.string().optional(),
-})
-    .transform(d => ({
-    psc_connection_id: d.pscConnectionId,
-    project_id: d.projectId,
-    psc_endpoint: d.pscEndpoint,
-    endpoint_region: d.endpointRegion,
-    service_attachment_id: d.serviceAttachmentId,
-}));
-export const marshalGcpVpcEndpointInfoSchema = z
-    .object({
-    pscConnectionId: z.string().optional(),
-    projectId: z.string().optional(),
-    pscEndpointName: z.string().optional(),
-    endpointRegion: z.string().optional(),
-    serviceAttachmentId: z.string().optional(),
-})
-    .transform(d => ({
-    psc_connection_id: d.pscConnectionId,
-    project_id: d.projectId,
-    psc_endpoint_name: d.pscEndpointName,
-    endpoint_region: d.endpointRegion,
-    service_attachment_id: d.serviceAttachmentId,
-}));
-export const marshalIngressNetworkPolicySchema = z
-    .object({
-    publicAccess: z
-        .lazy(() => marshalIngressNetworkPolicy_PublicAccessSchema)
-        .optional(),
-    privateAccess: z
-        .lazy(() => marshalIngressNetworkPolicy_PrivateAccessSchema)
-        .optional(),
-    crossWorkspaceAccess: z
-        .lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema)
-        .optional(),
-})
-    .transform(d => ({
-    public_access: d.publicAccess,
-    private_access: d.privateAccess,
-    cross_workspace_access: d.crossWorkspaceAccess,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AccountApiDestinationSchema = z
-    .object({
-    scopes: z.array(z.string()).optional(),
-    scopeQualifier: z.string().optional(),
-})
-    .transform(d => ({
-    scopes: d.scopes,
-    scope_qualifier: d.scopeQualifier,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AccountUiDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AuthenticationSchema = z
-    .object({
-    identityType: z.string().optional(),
-    identities: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_AuthenticationIdentitySchema))
-        .optional(),
-})
-    .transform(d => ({
-    identity_type: d.identityType,
-    identities: d.identities,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_AuthenticationIdentitySchema = z
-    .object({
-    principalType: z.string().optional(),
-    principalId: z.bigint().optional(),
-})
-    .transform(d => ({
-    principal_type: d.principalType,
-    principal_id: d.principalId,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z
-    .object({
-    restrictionMode: z.string().optional(),
-    denyRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
-        .optional(),
-    allowRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restriction_mode: d.restrictionMode,
-    deny_rules: d.denyRules,
-    allow_rules: d.allowRules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z
-    .object({
-    source: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('allSourceWorkspaces'),
-            allSourceWorkspaces: z.boolean(),
-        }),
-        z.object({
-            $case: z.literal('selectedWorkspaces'),
-            selectedWorkspaces: z.lazy(() => marshalIngressNetworkPolicy_WorkspaceIdListSchema),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    ...(d.source?.$case === 'allSourceWorkspaces' && {
-        all_source_workspaces: d.source.allSourceWorkspaces,
-    }),
-    ...(d.source?.$case === 'selectedWorkspaces' && {
-        selected_workspaces: d.source.selectedWorkspaces,
-    }),
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_EndpointsSchema = z
-    .object({
-    endpointIds: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    endpoint_ids: d.endpointIds,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_IpRangesSchema = z
-    .object({
-    ipRanges: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    ip_ranges: d.ipRanges,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PrivateAccessSchema = z
-    .object({
-    restrictionMode: z.string().optional(),
-    denyRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema))
-        .optional(),
-    allowRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restriction_mode: d.restrictionMode,
-    deny_rules: d.denyRules,
-    allow_rules: d.allowRules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PrivateIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => marshalIngressNetworkPolicy_PrivateRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PrivateRequestOriginSchema = z
-    .object({
-    source: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('endpoints'),
-            endpoints: z.lazy(() => marshalIngressNetworkPolicy_EndpointsSchema),
-        }),
-        z.object({
-            $case: z.literal('allRegisteredEndpoints'),
-            allRegisteredEndpoints: z.boolean(),
-        }),
-        z.object({
-            $case: z.literal('azureWorkspacePrivateLink'),
-            azureWorkspacePrivateLink: z.boolean(),
-        }),
-        z.object({
-            $case: z.literal('allPrivateAccess'),
-            allPrivateAccess: z.boolean(),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    ...(d.source?.$case === 'endpoints' && { endpoints: d.source.endpoints }),
-    ...(d.source?.$case === 'allRegisteredEndpoints' && {
-        all_registered_endpoints: d.source.allRegisteredEndpoints,
-    }),
-    ...(d.source?.$case === 'azureWorkspacePrivateLink' && {
-        azure_workspace_private_link: d.source.azureWorkspacePrivateLink,
-    }),
-    ...(d.source?.$case === 'allPrivateAccess' && {
-        all_private_access: d.source.allPrivateAccess,
-    }),
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PublicAccessSchema = z
-    .object({
-    restrictionMode: z.string().optional(),
-    denyRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema))
-        .optional(),
-    allowRules: z
-        .array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema))
-        .optional(),
-})
-    .transform(d => ({
-    restriction_mode: d.restrictionMode,
-    deny_rules: d.denyRules,
-    allow_rules: d.allowRules,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PublicIngressRuleSchema = z
-    .object({
-    origin: z
-        .lazy(() => marshalIngressNetworkPolicy_PublicRequestOriginSchema)
-        .optional(),
-    destination: z
-        .lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema)
-        .optional(),
-    authentication: z
-        .lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema)
-        .optional(),
-    label: z.string().optional(),
-})
-    .transform(d => ({
-    origin: d.origin,
-    destination: d.destination,
-    authentication: d.authentication,
-    label: d.label,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_PublicRequestOriginSchema = z
-    .object({
-    source: z
-        .discriminatedUnion('$case', [
-        z.object({ $case: z.literal('allIpRanges'), allIpRanges: z.boolean() }),
-        z.object({
-            $case: z.literal('includedIpRanges'),
-            includedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema),
-        }),
-        z.object({
-            $case: z.literal('excludedIpRanges'),
-            excludedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    ...(d.source?.$case === 'allIpRanges' && {
-        all_ip_ranges: d.source.allIpRanges,
-    }),
-    ...(d.source?.$case === 'includedIpRanges' && {
-        included_ip_ranges: d.source.includedIpRanges,
-    }),
-    ...(d.source?.$case === 'excludedIpRanges' && {
-        excluded_ip_ranges: d.source.excludedIpRanges,
-    }),
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_RequestDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-    workspaceUi: z
-        .lazy(() => marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema)
-        .optional(),
-    workspaceApi: z
-        .lazy(() => marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema)
-        .optional(),
-    appsRuntime: z
-        .lazy(() => marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema)
-        .optional(),
-    lakebaseRuntime: z
-        .lazy(() => marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema)
-        .optional(),
-    accountUi: z
-        .lazy(() => marshalIngressNetworkPolicy_AccountUiDestinationSchema)
-        .optional(),
-    accountApi: z
-        .lazy(() => marshalIngressNetworkPolicy_AccountApiDestinationSchema)
-        .optional(),
-    accountDatabricksOne: z
-        .lazy(() => marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema)
-        .optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-    workspace_ui: d.workspaceUi,
-    workspace_api: d.workspaceApi,
-    apps_runtime: d.appsRuntime,
-    lakebase_runtime: d.lakebaseRuntime,
-    account_ui: d.accountUi,
-    account_api: d.accountApi,
-    account_databricks_one: d.accountDatabricksOne,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z
-    .object({
-    scopes: z.array(z.string()).optional(),
-    scopeQualifier: z.string().optional(),
-})
-    .transform(d => ({
-    scopes: d.scopes,
-    scope_qualifier: d.scopeQualifier,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_WorkspaceIdListSchema = z
-    .object({
-    workspaceIds: z.array(z.bigint()).optional(),
-})
-    .transform(d => ({
-    workspace_ids: d.workspaceIds,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z
-    .object({
-    allDestinations: z.boolean().optional(),
-})
-    .transform(d => ({
-    all_destinations: d.allDestinations,
-}));
-export const marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z
-    .object({
-    ruleId: z.string().optional(),
-    networkConnectivityConfigId: z.string().optional(),
-    accountId: z.string().optional(),
-    endpointService: z.string().optional(),
-    domainNames: z.array(z.string()).optional(),
-    resourceNames: z.array(z.string()).optional(),
-    vpcEndpointId: z.string().optional(),
-    connectionState: z.string().optional(),
-    creationTime: z.bigint().optional(),
-    updatedTime: z.bigint().optional(),
-    deactivated: z.boolean().optional(),
-    deactivatedAt: z.bigint().optional(),
-    enabled: z.boolean().optional(),
-    errorMessage: z.string().optional(),
-})
-    .transform(d => ({
-    rule_id: d.ruleId,
-    network_connectivity_config_id: d.networkConnectivityConfigId,
-    account_id: d.accountId,
-    endpoint_service: d.endpointService,
-    domain_names: d.domainNames,
-    resource_names: d.resourceNames,
-    vpc_endpoint_id: d.vpcEndpointId,
-    connection_state: d.connectionState,
-    creation_time: d.creationTime,
-    updated_time: d.updatedTime,
-    deactivated: d.deactivated,
-    deactivated_at: d.deactivatedAt,
-    enabled: d.enabled,
-    error_message: d.errorMessage,
-}));
-export const marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z
-    .object({
-    ruleId: z.string().optional(),
-    networkConnectivityConfigId: z.string().optional(),
-    resourceId: z.string().optional(),
-    groupId: z.string().optional(),
-    endpointName: z.string().optional(),
-    connectionState: z.string().optional(),
-    creationTime: z.bigint().optional(),
-    updatedTime: z.bigint().optional(),
-    deactivated: z.boolean().optional(),
-    deactivatedAt: z.bigint().optional(),
-    domainNames: z.array(z.string()).optional(),
-    errorMessage: z.string().optional(),
-})
-    .transform(d => ({
-    rule_id: d.ruleId,
-    network_connectivity_config_id: d.networkConnectivityConfigId,
-    resource_id: d.resourceId,
-    group_id: d.groupId,
-    endpoint_name: d.endpointName,
-    connection_state: d.connectionState,
-    creation_time: d.creationTime,
-    updated_time: d.updatedTime,
-    deactivated: d.deactivated,
-    deactivated_at: d.deactivatedAt,
-    domain_names: d.domainNames,
-    error_message: d.errorMessage,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z
-    .object({
-    azureServiceEndpointRule: z
-        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema)
-        .optional(),
-    awsStableIpRule: z
-        .lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema)
-        .optional(),
-})
-    .transform(d => ({
-    azure_service_endpoint_rule: d.azureServiceEndpointRule,
-    aws_stable_ip_rule: d.awsStableIpRule,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z
-    .object({
-    cidrBlocks: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    cidr_blocks: d.cidrBlocks,
-}));
-// eslint-disable-next-line @typescript-eslint/naming-convention -- Proto-style nested message name.
-export const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z
-    .object({
-    targetRegion: z.string().optional(),
-    targetServices: z.array(z.string()).optional(),
-    subnets: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    target_region: d.targetRegion,
-    target_services: d.targetServices,
-    subnets: d.subnets,
-}));
-export const marshalNetworkVpcEndpointsSchema = z
-    .object({
-    restApi: z.array(z.string()).optional(),
-    dataplaneRelay: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    rest_api: d.restApi,
-    dataplane_relay: d.dataplaneRelay,
-}));
-export const marshalPrivateAccessSettingsSchema = z
-    .object({
-    privateAccessSettingsId: z.string().optional(),
-    accountId: z.string().optional(),
-    privateAccessSettingsName: z.string().optional(),
-    region: z.string().optional(),
-    publicAccessEnabled: z.boolean().optional(),
-    privateAccessLevel: z.string().optional(),
-    allowedVpcEndpointIds: z.array(z.string()).optional(),
-})
-    .transform(d => ({
-    private_access_settings_id: d.privateAccessSettingsId,
-    account_id: d.accountId,
-    private_access_settings_name: d.privateAccessSettingsName,
-    region: d.region,
-    public_access_enabled: d.publicAccessEnabled,
-    private_access_level: d.privateAccessLevel,
-    allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds,
-}));
-export const marshalReplaceAccountIpAccessListRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    listId: z.string().optional(),
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    list_id: d.listId,
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-    enabled: d.enabled,
-}));
-export const marshalReplaceIpAccessListRequestSchema = z
-    .object({
-    listId: z.string().optional(),
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    list_id: d.listId,
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-    enabled: d.enabled,
-}));
-export const marshalUpdateAccountIpAccessListRequestSchema = z
-    .object({
-    accountId: z.string().optional(),
-    listId: z.string().optional(),
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    account_id: d.accountId,
-    list_id: d.listId,
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-    enabled: d.enabled,
-}));
-export const marshalUpdateIpAccessListRequestSchema = z
-    .object({
-    listId: z.string().optional(),
-    label: z.string().optional(),
-    listType: z.string().optional(),
-    ipAddresses: z.array(z.string()).optional(),
-    enabled: z.boolean().optional(),
-})
-    .transform(d => ({
-    list_id: d.listId,
-    label: d.label,
-    list_type: d.listType,
-    ip_addresses: d.ipAddresses,
-    enabled: d.enabled,
-}));
-export const marshalUpdatePrivateEndpointRuleSchema = z
-    .object({
-    ruleId: z.string().optional(),
-    networkConnectivityConfigId: z.string().optional(),
-    connectionState: z.string().optional(),
-    domainNames: z.array(z.string()).optional(),
-    creationTime: z.bigint().optional(),
-    updatedTime: z.bigint().optional(),
-    deactivated: z.boolean().optional(),
-    deactivatedAt: z.bigint().optional(),
-    errorMessage: z.string().optional(),
-    resourceId: z.string().optional(),
-    groupId: z.string().optional(),
-    endpointName: z.string().optional(),
-    accountId: z.string().optional(),
-    endpointService: z.string().optional(),
-    resourceNames: z.array(z.string()).optional(),
-    vpcEndpointId: z.string().optional(),
-    enabled: z.boolean().optional(),
-    endpoint: z
-        .discriminatedUnion('$case', [
-        z.object({
-            $case: z.literal('gcpEndpoint'),
-            gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema),
-        }),
-    ])
-        .optional(),
-})
-    .transform(d => ({
-    rule_id: d.ruleId,
-    network_connectivity_config_id: d.networkConnectivityConfigId,
-    connection_state: d.connectionState,
-    domain_names: d.domainNames,
-    creation_time: d.creationTime,
-    updated_time: d.updatedTime,
-    deactivated: d.deactivated,
-    deactivated_at: d.deactivatedAt,
-    error_message: d.errorMessage,
-    resource_id: d.resourceId,
-    group_id: d.groupId,
-    endpoint_name: d.endpointName,
-    account_id: d.accountId,
-    endpoint_service: d.endpointService,
-    resource_names: d.resourceNames,
-    vpc_endpoint_id: d.vpcEndpointId,
-    enabled: d.enabled,
-    ...(d.endpoint?.$case === 'gcpEndpoint' && {
-        gcp_endpoint: d.endpoint.gcpEndpoint,
-    }),
-}));
-export const marshalWorkspaceNetworkOptionSchema = z
-    .object({
-    networkPolicyId: z.string().optional(),
-    workspaceId: z.bigint().optional(),
-})
-    .transform(d => ({
-    network_policy_id: d.networkPolicyId,
-    workspace_id: d.workspaceId,
+const unmarshalAccountIpAccessListSchema = z.object({
+	list_id: z.string().optional(),
+	label: z.string().optional(),
+	ip_addresses: z.array(z.string()).optional(),
+	address_count: z.number().optional(),
+	list_type: z.string().optional(),
+	created_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	created_by: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_by: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	listId: d.list_id,
+	label: d.label,
+	ipAddresses: d.ip_addresses,
+	addressCount: d.address_count,
+	listType: d.list_type,
+	createdAt: d.created_at,
+	createdBy: d.created_by,
+	updatedAt: d.updated_at,
+	updatedBy: d.updated_by,
+	enabled: d.enabled
+}));
+const unmarshalAccountNetworkPolicySchema = z.object({
+	network_policy_id: z.string().optional(),
+	account_id: z.string().optional(),
+	egress: z.lazy(() => unmarshalEgressNetworkPolicySchema).optional(),
+	ingress: z.lazy(() => unmarshalIngressNetworkPolicySchema).optional(),
+	ingress_dry_run: z.lazy(() => unmarshalIngressNetworkPolicySchema).optional()
+}).transform((d) => ({
+	networkPolicyId: d.network_policy_id,
+	accountId: d.account_id,
+	egress: d.egress,
+	ingress: d.ingress,
+	ingressDryRun: d.ingress_dry_run
+}));
+const unmarshalAwsVpcEndpointInfoSchema = z.object({
+	aws_vpc_endpoint_id: z.string().optional(),
+	aws_endpoint_service_id: z.string().optional(),
+	aws_account_id: z.string().optional()
+}).transform((d) => ({
+	awsVpcEndpointId: d.aws_vpc_endpoint_id,
+	awsEndpointServiceId: d.aws_endpoint_service_id,
+	awsAccountId: d.aws_account_id
+}));
+const unmarshalAzurePrivateEndpointInfoSchema = z.object({
+	private_endpoint_name: z.string().optional(),
+	private_endpoint_resource_guid: z.string().optional(),
+	private_endpoint_resource_id: z.string().optional(),
+	private_link_service_id: z.string().optional()
+}).transform((d) => ({
+	privateEndpointName: d.private_endpoint_name,
+	privateEndpointResourceGuid: d.private_endpoint_resource_guid,
+	privateEndpointResourceId: d.private_endpoint_resource_id,
+	privateLinkServiceId: d.private_link_service_id
+}));
+const unmarshalCreateAccountIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalAccountIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalCreateIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z.object({
+	default_rules: z.lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema).optional(),
+	target_rules: z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema).optional()
+}).transform((d) => ({
+	defaultRules: d.default_rules,
+	targetRules: d.target_rules
+}));
+const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z.object({
+	azure_private_endpoint_rules: z.array(z.lazy(() => unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema)).optional(),
+	aws_private_endpoint_rules: z.array(z.lazy(() => unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema)).optional()
+}).transform((d) => ({
+	azurePrivateEndpointRules: d.azure_private_endpoint_rules,
+	awsPrivateEndpointRules: d.aws_private_endpoint_rules
+}));
+const unmarshalDeleteAccountIpAccessListResponseSchema = z.object({});
+const unmarshalDeleteIpAccessListResponseSchema = z.object({});
+const unmarshalEgressNetworkPolicySchema = z.object({ network_access: z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema).optional() }).transform((d) => ({ networkAccess: d.network_access }));
+const unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema = z.object({
+	restriction_mode: z.string().optional(),
+	allowed_internet_destinations: z.array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema)).optional(),
+	allowed_storage_destinations: z.array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema)).optional(),
+	policy_enforcement: z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema).optional(),
+	blocked_internet_destinations: z.array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema)).optional(),
+	allowed_databricks_destinations: z.array(z.lazy(() => unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema)).optional()
+}).transform((d) => ({
+	restrictionMode: d.restriction_mode,
+	allowedInternetDestinations: d.allowed_internet_destinations,
+	allowedStorageDestinations: d.allowed_storage_destinations,
+	policyEnforcement: d.policy_enforcement,
+	blockedInternetDestinations: d.blocked_internet_destinations,
+	allowedDatabricksDestinations: d.allowed_databricks_destinations
+}));
+const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z.object({ workspace_ids: z.array(z.union([z.number(), z.bigint()]).transform((v) => BigInt(v))).optional() }).transform((d) => ({ workspaceIds: d.workspace_ids }));
+const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z.object({
+	destination: z.string().optional(),
+	internet_destination_type: z.string().optional()
+}).transform((d) => ({
+	destination: d.destination,
+	internetDestinationType: d.internet_destination_type
+}));
+const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z.object({
+	enforcement_mode: z.string().optional(),
+	dry_run_mode_product_filter: z.array(z.string()).optional()
+}).transform((d) => ({
+	enforcementMode: d.enforcement_mode,
+	dryRunModeProductFilter: d.dry_run_mode_product_filter
+}));
+const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z.object({
+	bucket_name: z.string().optional(),
+	region: z.string().optional(),
+	storage_destination_type: z.string().optional(),
+	azure_storage_account: z.string().optional(),
+	azure_storage_service: z.string().optional()
+}).transform((d) => ({
+	bucketName: d.bucket_name,
+	region: d.region,
+	storageDestinationType: d.storage_destination_type,
+	azureStorageAccount: d.azure_storage_account,
+	azureStorageService: d.azure_storage_service
+}));
+const unmarshalEndpointSchema = z.object({
+	name: z.string().optional(),
+	endpoint_id: z.string().optional(),
+	account_id: z.string().optional(),
+	display_name: z.string().optional(),
+	use_case: z.string().optional(),
+	region: z.string().optional(),
+	state: z.string().optional(),
+	azure_private_endpoint_info: z.lazy(() => unmarshalAzurePrivateEndpointInfoSchema).optional(),
+	aws_vpc_endpoint_info: z.lazy(() => unmarshalAwsVpcEndpointInfoSchema).optional(),
+	gcp_psc_endpoint_info: z.lazy(() => unmarshalGcpPscEndpointInfoSchema).optional(),
+	create_time: z.string().transform((s) => Temporal.Instant.from(s)).optional()
+}).transform((d) => ({
+	name: d.name,
+	endpointId: d.endpoint_id,
+	accountId: d.account_id,
+	displayName: d.display_name,
+	useCase: d.use_case,
+	region: d.region,
+	state: d.state,
+	endpointInfo: d.azure_private_endpoint_info !== void 0 ? {
+		$case: "azurePrivateEndpointInfo",
+		azurePrivateEndpointInfo: d.azure_private_endpoint_info
+	} : d.aws_vpc_endpoint_info !== void 0 ? {
+		$case: "awsVpcEndpointInfo",
+		awsVpcEndpointInfo: d.aws_vpc_endpoint_info
+	} : d.gcp_psc_endpoint_info !== void 0 ? {
+		$case: "gcpPscEndpointInfo",
+		gcpPscEndpointInfo: d.gcp_psc_endpoint_info
+	} : void 0,
+	createTime: d.create_time
+}));
+const unmarshalGcpEndpointSchema = z.object({
+	psc_endpoint_uri: z.string().optional(),
+	service_attachment: z.string().optional(),
+	google_api_endpoints: z.lazy(() => unmarshalGoogleApiEndpointsSchema).optional(),
+	all_vpc_sc_services: z.boolean().optional()
+}).transform((d) => ({
+	pscEndpointUri: d.psc_endpoint_uri,
+	targetServices: d.service_attachment !== void 0 ? {
+		$case: "serviceAttachment",
+		serviceAttachment: d.service_attachment
+	} : d.google_api_endpoints !== void 0 ? {
+		$case: "googleApiEndpoints",
+		googleApiEndpoints: d.google_api_endpoints
+	} : d.all_vpc_sc_services !== void 0 ? {
+		$case: "allVpcScServices",
+		allVpcScServices: d.all_vpc_sc_services
+	} : void 0
+}));
+const unmarshalGcpNetworkInfoSchema = z.object({
+	network_project_id: z.string().optional(),
+	vpc_id: z.string().optional(),
+	subnet_id: z.string().optional(),
+	subnet_region: z.string().optional(),
+	pod_ip_range_name: z.string().optional(),
+	service_ip_range_name: z.string().optional()
+}).transform((d) => ({
+	networkProjectId: d.network_project_id,
+	vpcId: d.vpc_id,
+	subnetId: d.subnet_id,
+	subnetRegion: d.subnet_region,
+	podIpRangeName: d.pod_ip_range_name,
+	serviceIpRangeName: d.service_ip_range_name
+}));
+const unmarshalGcpPscEndpointInfoSchema = z.object({
+	psc_connection_id: z.string().optional(),
+	project_id: z.string().optional(),
+	psc_endpoint: z.string().optional(),
+	endpoint_region: z.string().optional(),
+	service_attachment_id: z.string().optional()
+}).transform((d) => ({
+	pscConnectionId: d.psc_connection_id,
+	projectId: d.project_id,
+	pscEndpoint: d.psc_endpoint,
+	endpointRegion: d.endpoint_region,
+	serviceAttachmentId: d.service_attachment_id
+}));
+const unmarshalGcpVpcEndpointInfoSchema = z.object({
+	psc_connection_id: z.string().optional(),
+	project_id: z.string().optional(),
+	psc_endpoint_name: z.string().optional(),
+	endpoint_region: z.string().optional(),
+	service_attachment_id: z.string().optional()
+}).transform((d) => ({
+	pscConnectionId: d.psc_connection_id,
+	projectId: d.project_id,
+	pscEndpointName: d.psc_endpoint_name,
+	endpointRegion: d.endpoint_region,
+	serviceAttachmentId: d.service_attachment_id
+}));
+const unmarshalGetAccountIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalAccountIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalGetIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalGoogleApiEndpointsSchema = z.object({ endpoints: z.array(z.string()).optional() }).transform((d) => ({ endpoints: d.endpoints }));
+const unmarshalIngressNetworkPolicySchema = z.object({
+	public_access: z.lazy(() => unmarshalIngressNetworkPolicy_PublicAccessSchema).optional(),
+	private_access: z.lazy(() => unmarshalIngressNetworkPolicy_PrivateAccessSchema).optional(),
+	cross_workspace_access: z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema).optional()
+}).transform((d) => ({
+	publicAccess: d.public_access,
+	privateAccess: d.private_access,
+	crossWorkspaceAccess: d.cross_workspace_access
+}));
+const unmarshalIngressNetworkPolicy_AccountApiDestinationSchema = z.object({
+	scopes: z.array(z.string()).optional(),
+	scope_qualifier: z.string().optional()
+}).transform((d) => ({
+	scopes: d.scopes,
+	scopeQualifier: d.scope_qualifier
+}));
+const unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z.object({ all_destinations: z.boolean().optional() }).transform((d) => ({ allDestinations: d.all_destinations }));
+const unmarshalIngressNetworkPolicy_AccountUiDestinationSchema = z.object({ all_destinations: z.boolean().optional() }).transform((d) => ({ allDestinations: d.all_destinations }));
+const unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z.object({ all_destinations: z.boolean().optional() }).transform((d) => ({ allDestinations: d.all_destinations }));
+const unmarshalIngressNetworkPolicy_AuthenticationSchema = z.object({
+	identity_type: z.string().optional(),
+	identities: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema)).optional()
+}).transform((d) => ({
+	identityType: d.identity_type,
+	identities: d.identities
+}));
+const unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema = z.object({
+	principal_type: z.string().optional(),
+	principal_id: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional()
+}).transform((d) => ({
+	principalType: d.principal_type,
+	principalId: d.principal_id
+}));
+const unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z.object({
+	restriction_mode: z.string().optional(),
+	deny_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema)).optional(),
+	allow_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restrictionMode: d.restriction_mode,
+	denyRules: d.deny_rules,
+	allowRules: d.allow_rules
+}));
+const unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z.object({
+	origin: z.lazy(() => unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema).optional(),
+	destination: z.lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z.object({
+	all_source_workspaces: z.boolean().optional(),
+	selected_workspaces: z.lazy(() => unmarshalIngressNetworkPolicy_WorkspaceIdListSchema).optional()
+}).transform((d) => ({ source: d.all_source_workspaces !== void 0 ? {
+	$case: "allSourceWorkspaces",
+	allSourceWorkspaces: d.all_source_workspaces
+} : d.selected_workspaces !== void 0 ? {
+	$case: "selectedWorkspaces",
+	selectedWorkspaces: d.selected_workspaces
+} : void 0 }));
+const unmarshalIngressNetworkPolicy_EndpointsSchema = z.object({ endpoint_ids: z.array(z.string()).optional() }).transform((d) => ({ endpointIds: d.endpoint_ids }));
+const unmarshalIngressNetworkPolicy_IpRangesSchema = z.object({ ip_ranges: z.array(z.string()).optional() }).transform((d) => ({ ipRanges: d.ip_ranges }));
+const unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z.object({ all_destinations: z.boolean().optional() }).transform((d) => ({ allDestinations: d.all_destinations }));
+const unmarshalIngressNetworkPolicy_PrivateAccessSchema = z.object({
+	restriction_mode: z.string().optional(),
+	deny_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema)).optional(),
+	allow_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restrictionMode: d.restriction_mode,
+	denyRules: d.deny_rules,
+	allowRules: d.allow_rules
+}));
+const unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema = z.object({
+	origin: z.lazy(() => unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema).optional(),
+	destination: z.lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema = z.object({
+	endpoints: z.lazy(() => unmarshalIngressNetworkPolicy_EndpointsSchema).optional(),
+	all_registered_endpoints: z.boolean().optional(),
+	azure_workspace_private_link: z.boolean().optional(),
+	all_private_access: z.boolean().optional()
+}).transform((d) => ({ source: d.endpoints !== void 0 ? {
+	$case: "endpoints",
+	endpoints: d.endpoints
+} : d.all_registered_endpoints !== void 0 ? {
+	$case: "allRegisteredEndpoints",
+	allRegisteredEndpoints: d.all_registered_endpoints
+} : d.azure_workspace_private_link !== void 0 ? {
+	$case: "azureWorkspacePrivateLink",
+	azureWorkspacePrivateLink: d.azure_workspace_private_link
+} : d.all_private_access !== void 0 ? {
+	$case: "allPrivateAccess",
+	allPrivateAccess: d.all_private_access
+} : void 0 }));
+const unmarshalIngressNetworkPolicy_PublicAccessSchema = z.object({
+	restriction_mode: z.string().optional(),
+	deny_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema)).optional(),
+	allow_rules: z.array(z.lazy(() => unmarshalIngressNetworkPolicy_PublicIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restrictionMode: d.restriction_mode,
+	denyRules: d.deny_rules,
+	allowRules: d.allow_rules
+}));
+const unmarshalIngressNetworkPolicy_PublicIngressRuleSchema = z.object({
+	origin: z.lazy(() => unmarshalIngressNetworkPolicy_PublicRequestOriginSchema).optional(),
+	destination: z.lazy(() => unmarshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => unmarshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const unmarshalIngressNetworkPolicy_PublicRequestOriginSchema = z.object({
+	all_ip_ranges: z.boolean().optional(),
+	included_ip_ranges: z.lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema).optional(),
+	excluded_ip_ranges: z.lazy(() => unmarshalIngressNetworkPolicy_IpRangesSchema).optional()
+}).transform((d) => ({ source: d.all_ip_ranges !== void 0 ? {
+	$case: "allIpRanges",
+	allIpRanges: d.all_ip_ranges
+} : d.included_ip_ranges !== void 0 ? {
+	$case: "includedIpRanges",
+	includedIpRanges: d.included_ip_ranges
+} : d.excluded_ip_ranges !== void 0 ? {
+	$case: "excludedIpRanges",
+	excludedIpRanges: d.excluded_ip_ranges
+} : void 0 }));
+const unmarshalIngressNetworkPolicy_RequestDestinationSchema = z.object({
+	all_destinations: z.boolean().optional(),
+	workspace_ui: z.lazy(() => unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema).optional(),
+	workspace_api: z.lazy(() => unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema).optional(),
+	apps_runtime: z.lazy(() => unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema).optional(),
+	lakebase_runtime: z.lazy(() => unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema).optional(),
+	account_ui: z.lazy(() => unmarshalIngressNetworkPolicy_AccountUiDestinationSchema).optional(),
+	account_api: z.lazy(() => unmarshalIngressNetworkPolicy_AccountApiDestinationSchema).optional(),
+	account_databricks_one: z.lazy(() => unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema).optional()
+}).transform((d) => ({
+	allDestinations: d.all_destinations,
+	workspaceUi: d.workspace_ui,
+	workspaceApi: d.workspace_api,
+	appsRuntime: d.apps_runtime,
+	lakebaseRuntime: d.lakebase_runtime,
+	accountUi: d.account_ui,
+	accountApi: d.account_api,
+	accountDatabricksOne: d.account_databricks_one
+}));
+const unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z.object({
+	scopes: z.array(z.string()).optional(),
+	scope_qualifier: z.string().optional()
+}).transform((d) => ({
+	scopes: d.scopes,
+	scopeQualifier: d.scope_qualifier
+}));
+const unmarshalIngressNetworkPolicy_WorkspaceIdListSchema = z.object({ workspace_ids: z.array(z.union([z.number(), z.bigint()]).transform((v) => BigInt(v))).optional() }).transform((d) => ({ workspaceIds: d.workspace_ids }));
+const unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z.object({ all_destinations: z.boolean().optional() }).transform((d) => ({ allDestinations: d.all_destinations }));
+const unmarshalIpAccessListSchema = z.object({
+	list_id: z.string().optional(),
+	label: z.string().optional(),
+	ip_addresses: z.array(z.string()).optional(),
+	address_count: z.number().optional(),
+	list_type: z.string().optional(),
+	created_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	created_by: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_by: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	listId: d.list_id,
+	label: d.label,
+	ipAddresses: d.ip_addresses,
+	addressCount: d.address_count,
+	listType: d.list_type,
+	createdAt: d.created_at,
+	createdBy: d.created_by,
+	updatedAt: d.updated_at,
+	updatedBy: d.updated_by,
+	enabled: d.enabled
+}));
+const unmarshalListAccountIpAccessListsResponseSchema = z.object({ ip_access_lists: z.array(z.lazy(() => unmarshalAccountIpAccessListSchema)).optional() }).transform((d) => ({ ipAccessLists: d.ip_access_lists }));
+const unmarshalListEndpointsResponseSchema = z.object({
+	items: z.array(z.lazy(() => unmarshalEndpointSchema)).optional(),
+	next_page_token: z.string().optional()
+}).transform((d) => ({
+	items: d.items,
+	nextPageToken: d.next_page_token
+}));
+const unmarshalListIpAccessListsResponseSchema = z.object({ ip_access_lists: z.array(z.lazy(() => unmarshalIpAccessListSchema)).optional() }).transform((d) => ({ ipAccessLists: d.ip_access_lists }));
+const unmarshalListNccPrivateEndpointRulesResponseSchema = z.object({
+	items: z.array(z.lazy(() => unmarshalNccPrivateEndpointRuleSchema)).optional(),
+	next_page_token: z.string().optional()
+}).transform((d) => ({
+	items: d.items,
+	nextPageToken: d.next_page_token
+}));
+const unmarshalListNetworkConnectivityConfigsResponseSchema = z.object({
+	items: z.array(z.lazy(() => unmarshalNetworkConnectivityConfigSchema)).optional(),
+	next_page_token: z.string().optional()
+}).transform((d) => ({
+	items: d.items,
+	nextPageToken: d.next_page_token
+}));
+const unmarshalListNetworkPoliciesResponseSchema = z.object({
+	items: z.array(z.lazy(() => unmarshalAccountNetworkPolicySchema)).optional(),
+	next_page_token: z.string().optional()
+}).transform((d) => ({
+	items: d.items,
+	nextPageToken: d.next_page_token
+}));
+const unmarshalNccPrivateEndpointRuleSchema = z.object({
+	rule_id: z.string().optional(),
+	network_connectivity_config_id: z.string().optional(),
+	connection_state: z.string().optional(),
+	domain_names: z.array(z.string()).optional(),
+	creation_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	deactivated: z.boolean().optional(),
+	deactivated_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	error_message: z.string().optional(),
+	resource_id: z.string().optional(),
+	group_id: z.string().optional(),
+	endpoint_name: z.string().optional(),
+	account_id: z.string().optional(),
+	endpoint_service: z.string().optional(),
+	resource_names: z.array(z.string()).optional(),
+	vpc_endpoint_id: z.string().optional(),
+	enabled: z.boolean().optional(),
+	gcp_endpoint: z.lazy(() => unmarshalGcpEndpointSchema).optional()
+}).transform((d) => ({
+	ruleId: d.rule_id,
+	networkConnectivityConfigId: d.network_connectivity_config_id,
+	connectionState: d.connection_state,
+	domainNames: d.domain_names,
+	creationTime: d.creation_time,
+	updatedTime: d.updated_time,
+	deactivated: d.deactivated,
+	deactivatedAt: d.deactivated_at,
+	errorMessage: d.error_message,
+	resourceId: d.resource_id,
+	groupId: d.group_id,
+	endpointName: d.endpoint_name,
+	accountId: d.account_id,
+	endpointService: d.endpoint_service,
+	resourceNames: d.resource_names,
+	vpcEndpointId: d.vpc_endpoint_id,
+	enabled: d.enabled,
+	endpoint: d.gcp_endpoint !== void 0 ? {
+		$case: "gcpEndpoint",
+		gcpEndpoint: d.gcp_endpoint
+	} : void 0
+}));
+const unmarshalNetworkSchema = z.object({
+	network_id: z.string().optional(),
+	account_id: z.string().optional(),
+	workspace_id: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	vpc_id: z.string().optional(),
+	subnet_ids: z.array(z.string()).optional(),
+	security_group_ids: z.array(z.string()).optional(),
+	vpc_status: z.string().optional(),
+	error_messages: z.array(z.lazy(() => unmarshalNetworkHealthSchema)).optional(),
+	network_name: z.string().optional(),
+	creation_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	warning_messages: z.array(z.lazy(() => unmarshalNetworkWarningSchema)).optional(),
+	vpc_endpoints: z.lazy(() => unmarshalNetworkVpcEndpointsSchema).optional(),
+	gcp_network_info: z.lazy(() => unmarshalGcpNetworkInfoSchema).optional()
+}).transform((d) => ({
+	networkId: d.network_id,
+	accountId: d.account_id,
+	workspaceId: d.workspace_id,
+	vpcId: d.vpc_id,
+	subnetIds: d.subnet_ids,
+	securityGroupIds: d.security_group_ids,
+	vpcStatus: d.vpc_status,
+	errorMessages: d.error_messages,
+	networkName: d.network_name,
+	creationTime: d.creation_time,
+	warningMessages: d.warning_messages,
+	vpcEndpoints: d.vpc_endpoints,
+	networkInfo: d.gcp_network_info !== void 0 ? {
+		$case: "gcpNetworkInfo",
+		gcpNetworkInfo: d.gcp_network_info
+	} : void 0
+}));
+const unmarshalNetworkConnectivityConfigSchema = z.object({
+	network_connectivity_config_id: z.string().optional(),
+	account_id: z.string().optional(),
+	name: z.string().optional(),
+	region: z.string().optional(),
+	egress_config: z.lazy(() => unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema).optional(),
+	updated_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	creation_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional()
+}).transform((d) => ({
+	networkConnectivityConfigId: d.network_connectivity_config_id,
+	accountId: d.account_id,
+	name: d.name,
+	region: d.region,
+	egressConfig: d.egress_config,
+	updatedTime: d.updated_time,
+	creationTime: d.creation_time
+}));
+const unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z.object({
+	rule_id: z.string().optional(),
+	network_connectivity_config_id: z.string().optional(),
+	account_id: z.string().optional(),
+	endpoint_service: z.string().optional(),
+	domain_names: z.array(z.string()).optional(),
+	resource_names: z.array(z.string()).optional(),
+	vpc_endpoint_id: z.string().optional(),
+	connection_state: z.string().optional(),
+	creation_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	deactivated: z.boolean().optional(),
+	deactivated_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	enabled: z.boolean().optional(),
+	error_message: z.string().optional()
+}).transform((d) => ({
+	ruleId: d.rule_id,
+	networkConnectivityConfigId: d.network_connectivity_config_id,
+	accountId: d.account_id,
+	endpointService: d.endpoint_service,
+	domainNames: d.domain_names,
+	resourceNames: d.resource_names,
+	vpcEndpointId: d.vpc_endpoint_id,
+	connectionState: d.connection_state,
+	creationTime: d.creation_time,
+	updatedTime: d.updated_time,
+	deactivated: d.deactivated,
+	deactivatedAt: d.deactivated_at,
+	enabled: d.enabled,
+	errorMessage: d.error_message
+}));
+const unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z.object({
+	rule_id: z.string().optional(),
+	network_connectivity_config_id: z.string().optional(),
+	resource_id: z.string().optional(),
+	group_id: z.string().optional(),
+	endpoint_name: z.string().optional(),
+	connection_state: z.string().optional(),
+	creation_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	updated_time: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	deactivated: z.boolean().optional(),
+	deactivated_at: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional(),
+	domain_names: z.array(z.string()).optional(),
+	error_message: z.string().optional()
+}).transform((d) => ({
+	ruleId: d.rule_id,
+	networkConnectivityConfigId: d.network_connectivity_config_id,
+	resourceId: d.resource_id,
+	groupId: d.group_id,
+	endpointName: d.endpoint_name,
+	connectionState: d.connection_state,
+	creationTime: d.creation_time,
+	updatedTime: d.updated_time,
+	deactivated: d.deactivated,
+	deactivatedAt: d.deactivated_at,
+	domainNames: d.domain_names,
+	errorMessage: d.error_message
+}));
+const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z.object({
+	azure_service_endpoint_rule: z.lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema).optional(),
+	aws_stable_ip_rule: z.lazy(() => unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema).optional()
+}).transform((d) => ({
+	azureServiceEndpointRule: d.azure_service_endpoint_rule,
+	awsStableIpRule: d.aws_stable_ip_rule
+}));
+const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z.object({ cidr_blocks: z.array(z.string()).optional() }).transform((d) => ({ cidrBlocks: d.cidr_blocks }));
+const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z.object({
+	target_region: z.string().optional(),
+	target_services: z.array(z.string()).optional(),
+	subnets: z.array(z.string()).optional()
+}).transform((d) => ({
+	targetRegion: d.target_region,
+	targetServices: d.target_services,
+	subnets: d.subnets
+}));
+const unmarshalNetworkHealthSchema = z.object({
+	error_type: z.string().optional(),
+	error_message: z.string().optional()
+}).transform((d) => ({
+	errorType: d.error_type,
+	errorMessage: d.error_message
+}));
+const unmarshalNetworkVpcEndpointsSchema = z.object({
+	rest_api: z.array(z.string()).optional(),
+	dataplane_relay: z.array(z.string()).optional()
+}).transform((d) => ({
+	restApi: d.rest_api,
+	dataplaneRelay: d.dataplane_relay
+}));
+const unmarshalNetworkWarningSchema = z.object({
+	warning_type: z.string().optional(),
+	warning_message: z.string().optional()
+}).transform((d) => ({
+	warningType: d.warning_type,
+	warningMessage: d.warning_message
+}));
+const unmarshalPrivateAccessSettingsSchema = z.object({
+	private_access_settings_id: z.string().optional(),
+	account_id: z.string().optional(),
+	private_access_settings_name: z.string().optional(),
+	region: z.string().optional(),
+	public_access_enabled: z.boolean().optional(),
+	private_access_level: z.string().optional(),
+	allowed_vpc_endpoint_ids: z.array(z.string()).optional()
+}).transform((d) => ({
+	privateAccessSettingsId: d.private_access_settings_id,
+	accountId: d.account_id,
+	privateAccessSettingsName: d.private_access_settings_name,
+	region: d.region,
+	publicAccessEnabled: d.public_access_enabled,
+	privateAccessLevel: d.private_access_level,
+	allowedVpcEndpointIds: d.allowed_vpc_endpoint_ids
+}));
+const unmarshalReplaceAccountIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalAccountIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalReplaceIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalUpdateAccountIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalAccountIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalUpdateIpAccessListResponseSchema = z.object({ ip_access_list: z.lazy(() => unmarshalIpAccessListSchema).optional() }).transform((d) => ({ ipAccessList: d.ip_access_list }));
+const unmarshalVpcEndpointSchema = z.object({
+	vpc_endpoint_id: z.string().optional(),
+	account_id: z.string().optional(),
+	vpc_endpoint_name: z.string().optional(),
+	aws_vpc_endpoint_id: z.string().optional(),
+	aws_endpoint_service_id: z.string().optional(),
+	use_case: z.string().optional(),
+	region: z.string().optional(),
+	aws_account_id: z.string().optional(),
+	state: z.string().optional(),
+	gcp_vpc_endpoint_info: z.lazy(() => unmarshalGcpVpcEndpointInfoSchema).optional()
+}).transform((d) => ({
+	vpcEndpointId: d.vpc_endpoint_id,
+	accountId: d.account_id,
+	vpcEndpointName: d.vpc_endpoint_name,
+	awsVpcEndpointId: d.aws_vpc_endpoint_id,
+	awsEndpointServiceId: d.aws_endpoint_service_id,
+	useCase: d.use_case,
+	region: d.region,
+	awsAccountId: d.aws_account_id,
+	state: d.state,
+	vpcEndpointInfo: d.gcp_vpc_endpoint_info !== void 0 ? {
+		$case: "gcpVpcEndpointInfo",
+		gcpVpcEndpointInfo: d.gcp_vpc_endpoint_info
+	} : void 0
+}));
+const unmarshalWorkspaceNetworkOptionSchema = z.object({
+	network_policy_id: z.string().optional(),
+	workspace_id: z.union([z.number(), z.bigint()]).transform((v) => BigInt(v)).optional()
+}).transform((d) => ({
+	networkPolicyId: d.network_policy_id,
+	workspaceId: d.workspace_id
+}));
+const marshalAccountNetworkPolicySchema = z.object({
+	networkPolicyId: z.string().optional(),
+	accountId: z.string().optional(),
+	egress: z.lazy(() => marshalEgressNetworkPolicySchema).optional(),
+	ingress: z.lazy(() => marshalIngressNetworkPolicySchema).optional(),
+	ingressDryRun: z.lazy(() => marshalIngressNetworkPolicySchema).optional()
+}).transform((d) => ({
+	network_policy_id: d.networkPolicyId,
+	account_id: d.accountId,
+	egress: d.egress,
+	ingress: d.ingress,
+	ingress_dry_run: d.ingressDryRun
+}));
+const marshalAwsVpcEndpointInfoSchema = z.object({
+	awsVpcEndpointId: z.string().optional(),
+	awsEndpointServiceId: z.string().optional(),
+	awsAccountId: z.string().optional()
+}).transform((d) => ({
+	aws_vpc_endpoint_id: d.awsVpcEndpointId,
+	aws_endpoint_service_id: d.awsEndpointServiceId,
+	aws_account_id: d.awsAccountId
+}));
+const marshalAzurePrivateEndpointInfoSchema = z.object({
+	privateEndpointName: z.string().optional(),
+	privateEndpointResourceGuid: z.string().optional(),
+	privateEndpointResourceId: z.string().optional(),
+	privateLinkServiceId: z.string().optional()
+}).transform((d) => ({
+	private_endpoint_name: d.privateEndpointName,
+	private_endpoint_resource_guid: d.privateEndpointResourceGuid,
+	private_endpoint_resource_id: d.privateEndpointResourceId,
+	private_link_service_id: d.privateLinkServiceId
+}));
+const marshalCreateAccountIpAccessListRequestSchema = z.object({
+	accountId: z.string().optional(),
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses
+}));
+const marshalCreateIpAccessListRequestSchema = z.object({
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional()
+}).transform((d) => ({
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses
+}));
+const marshalCreateNetworkConnectivityConfigurationSchema = z.object({
+	networkConnectivityConfigId: z.string().optional(),
+	accountId: z.string().optional(),
+	name: z.string().optional(),
+	region: z.string().optional(),
+	egressConfig: z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema).optional(),
+	updatedTime: z.bigint().optional(),
+	creationTime: z.bigint().optional()
+}).transform((d) => ({
+	network_connectivity_config_id: d.networkConnectivityConfigId,
+	account_id: d.accountId,
+	name: d.name,
+	region: d.region,
+	egress_config: d.egressConfig,
+	updated_time: d.updatedTime,
+	creation_time: d.creationTime
+}));
+const marshalCreateNetworkRequestSchema = z.object({
+	accountId: z.string().optional(),
+	networkName: z.string().optional(),
+	vpcId: z.string().optional(),
+	subnetIds: z.array(z.string()).optional(),
+	securityGroupIds: z.array(z.string()).optional(),
+	vpcEndpoints: z.lazy(() => marshalNetworkVpcEndpointsSchema).optional(),
+	gcpNetworkInfo: z.lazy(() => marshalGcpNetworkInfoSchema).optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	network_name: d.networkName,
+	vpc_id: d.vpcId,
+	subnet_ids: d.subnetIds,
+	security_group_ids: d.securityGroupIds,
+	vpc_endpoints: d.vpcEndpoints,
+	gcp_network_info: d.gcpNetworkInfo
+}));
+const marshalCreatePrivateAccessSettingsRequestSchema = z.object({
+	accountId: z.string().optional(),
+	privateAccessSettingsName: z.string().optional(),
+	region: z.string().optional(),
+	publicAccessEnabled: z.boolean().optional(),
+	privateAccessLevel: z.string().optional(),
+	allowedVpcEndpointIds: z.array(z.string()).optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	private_access_settings_name: d.privateAccessSettingsName,
+	region: d.region,
+	public_access_enabled: d.publicAccessEnabled,
+	private_access_level: d.privateAccessLevel,
+	allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds
+}));
+const marshalCreatePrivateEndpointRuleSchema = z.object({
+	ruleId: z.string().optional(),
+	networkConnectivityConfigId: z.string().optional(),
+	connectionState: z.string().optional(),
+	domainNames: z.array(z.string()).optional(),
+	creationTime: z.bigint().optional(),
+	updatedTime: z.bigint().optional(),
+	deactivated: z.boolean().optional(),
+	deactivatedAt: z.bigint().optional(),
+	errorMessage: z.string().optional(),
+	resourceId: z.string().optional(),
+	groupId: z.string().optional(),
+	endpointName: z.string().optional(),
+	accountId: z.string().optional(),
+	endpointService: z.string().optional(),
+	resourceNames: z.array(z.string()).optional(),
+	vpcEndpointId: z.string().optional(),
+	enabled: z.boolean().optional(),
+	endpoint: z.discriminatedUnion("$case", [z.object({
+		$case: z.literal("gcpEndpoint"),
+		gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema)
+	})]).optional()
+}).transform((d) => ({
+	rule_id: d.ruleId,
+	network_connectivity_config_id: d.networkConnectivityConfigId,
+	connection_state: d.connectionState,
+	domain_names: d.domainNames,
+	creation_time: d.creationTime,
+	updated_time: d.updatedTime,
+	deactivated: d.deactivated,
+	deactivated_at: d.deactivatedAt,
+	error_message: d.errorMessage,
+	resource_id: d.resourceId,
+	group_id: d.groupId,
+	endpoint_name: d.endpointName,
+	account_id: d.accountId,
+	endpoint_service: d.endpointService,
+	resource_names: d.resourceNames,
+	vpc_endpoint_id: d.vpcEndpointId,
+	enabled: d.enabled,
+	...d.endpoint?.$case === "gcpEndpoint" && { gcp_endpoint: d.endpoint.gcpEndpoint }
+}));
+const marshalCreateVpcEndpointRequestSchema = z.object({
+	accountId: z.string().optional(),
+	vpcEndpointName: z.string().optional(),
+	region: z.string().optional(),
+	awsVpcEndpointId: z.string().optional(),
+	vpcEndpointInfo: z.discriminatedUnion("$case", [z.object({
+		$case: z.literal("gcpVpcEndpointInfo"),
+		gcpVpcEndpointInfo: z.lazy(() => marshalGcpVpcEndpointInfoSchema)
+	})]).optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	vpc_endpoint_name: d.vpcEndpointName,
+	region: d.region,
+	aws_vpc_endpoint_id: d.awsVpcEndpointId,
+	...d.vpcEndpointInfo?.$case === "gcpVpcEndpointInfo" && { gcp_vpc_endpoint_info: d.vpcEndpointInfo.gcpVpcEndpointInfo }
+}));
+const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema = z.object({
+	defaultRules: z.lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema).optional(),
+	targetRules: z.lazy(() => marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema).optional()
+}).transform((d) => ({
+	default_rules: d.defaultRules,
+	target_rules: d.targetRules
+}));
+const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema = z.object({
+	azurePrivateEndpointRules: z.array(z.lazy(() => marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema)).optional(),
+	awsPrivateEndpointRules: z.array(z.lazy(() => marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema)).optional()
+}).transform((d) => ({
+	azure_private_endpoint_rules: d.azurePrivateEndpointRules,
+	aws_private_endpoint_rules: d.awsPrivateEndpointRules
+}));
+const marshalEgressNetworkPolicySchema = z.object({ networkAccess: z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicySchema).optional() }).transform((d) => ({ network_access: d.networkAccess }));
+const marshalEgressNetworkPolicy_NetworkAccessPolicySchema = z.object({
+	restrictionMode: z.string().optional(),
+	allowedInternetDestinations: z.array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema)).optional(),
+	allowedStorageDestinations: z.array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema)).optional(),
+	policyEnforcement: z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema).optional(),
+	blockedInternetDestinations: z.array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema)).optional(),
+	allowedDatabricksDestinations: z.array(z.lazy(() => marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema)).optional()
+}).transform((d) => ({
+	restriction_mode: d.restrictionMode,
+	allowed_internet_destinations: d.allowedInternetDestinations,
+	allowed_storage_destinations: d.allowedStorageDestinations,
+	policy_enforcement: d.policyEnforcement,
+	blocked_internet_destinations: d.blockedInternetDestinations,
+	allowed_databricks_destinations: d.allowedDatabricksDestinations
+}));
+const marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema = z.object({ workspaceIds: z.array(z.bigint()).optional() }).transform((d) => ({ workspace_ids: d.workspaceIds }));
+const marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema = z.object({
+	destination: z.string().optional(),
+	internetDestinationType: z.string().optional()
+}).transform((d) => ({
+	destination: d.destination,
+	internet_destination_type: d.internetDestinationType
+}));
+const marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema = z.object({
+	enforcementMode: z.string().optional(),
+	dryRunModeProductFilter: z.array(z.string()).optional()
+}).transform((d) => ({
+	enforcement_mode: d.enforcementMode,
+	dry_run_mode_product_filter: d.dryRunModeProductFilter
+}));
+const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema = z.object({
+	bucketName: z.string().optional(),
+	region: z.string().optional(),
+	storageDestinationType: z.string().optional(),
+	azureStorageAccount: z.string().optional(),
+	azureStorageService: z.string().optional()
+}).transform((d) => ({
+	bucket_name: d.bucketName,
+	region: d.region,
+	storage_destination_type: d.storageDestinationType,
+	azure_storage_account: d.azureStorageAccount,
+	azure_storage_service: d.azureStorageService
+}));
+const marshalEndpointSchema = z.object({
+	name: z.string().optional(),
+	endpointId: z.string().optional(),
+	accountId: z.string().optional(),
+	displayName: z.string().optional(),
+	useCase: z.string().optional(),
+	region: z.string().optional(),
+	state: z.string().optional(),
+	endpointInfo: z.discriminatedUnion("$case", [
+		z.object({
+			$case: z.literal("azurePrivateEndpointInfo"),
+			azurePrivateEndpointInfo: z.lazy(() => marshalAzurePrivateEndpointInfoSchema)
+		}),
+		z.object({
+			$case: z.literal("awsVpcEndpointInfo"),
+			awsVpcEndpointInfo: z.lazy(() => marshalAwsVpcEndpointInfoSchema)
+		}),
+		z.object({
+			$case: z.literal("gcpPscEndpointInfo"),
+			gcpPscEndpointInfo: z.lazy(() => marshalGcpPscEndpointInfoSchema)
+		})
+	]).optional(),
+	createTime: z.any().transform((d) => d.toString()).optional()
+}).transform((d) => ({
+	name: d.name,
+	endpoint_id: d.endpointId,
+	account_id: d.accountId,
+	display_name: d.displayName,
+	use_case: d.useCase,
+	region: d.region,
+	state: d.state,
+	...d.endpointInfo?.$case === "azurePrivateEndpointInfo" && { azure_private_endpoint_info: d.endpointInfo.azurePrivateEndpointInfo },
+	...d.endpointInfo?.$case === "awsVpcEndpointInfo" && { aws_vpc_endpoint_info: d.endpointInfo.awsVpcEndpointInfo },
+	...d.endpointInfo?.$case === "gcpPscEndpointInfo" && { gcp_psc_endpoint_info: d.endpointInfo.gcpPscEndpointInfo },
+	create_time: d.createTime
+}));
+const marshalGcpEndpointSchema = z.object({
+	pscEndpointUri: z.string().optional(),
+	targetServices: z.discriminatedUnion("$case", [
+		z.object({
+			$case: z.literal("serviceAttachment"),
+			serviceAttachment: z.string()
+		}),
+		z.object({
+			$case: z.literal("googleApiEndpoints"),
+			googleApiEndpoints: z.lazy(() => marshalGoogleApiEndpointsSchema)
+		}),
+		z.object({
+			$case: z.literal("allVpcScServices"),
+			allVpcScServices: z.boolean()
+		})
+	]).optional()
+}).transform((d) => ({
+	psc_endpoint_uri: d.pscEndpointUri,
+	...d.targetServices?.$case === "serviceAttachment" && { service_attachment: d.targetServices.serviceAttachment },
+	...d.targetServices?.$case === "googleApiEndpoints" && { google_api_endpoints: d.targetServices.googleApiEndpoints },
+	...d.targetServices?.$case === "allVpcScServices" && { all_vpc_sc_services: d.targetServices.allVpcScServices }
+}));
+const marshalGcpNetworkInfoSchema = z.object({
+	networkProjectId: z.string().optional(),
+	vpcId: z.string().optional(),
+	subnetId: z.string().optional(),
+	subnetRegion: z.string().optional(),
+	podIpRangeName: z.string().optional(),
+	serviceIpRangeName: z.string().optional()
+}).transform((d) => ({
+	network_project_id: d.networkProjectId,
+	vpc_id: d.vpcId,
+	subnet_id: d.subnetId,
+	subnet_region: d.subnetRegion,
+	pod_ip_range_name: d.podIpRangeName,
+	service_ip_range_name: d.serviceIpRangeName
+}));
+const marshalGcpPscEndpointInfoSchema = z.object({
+	pscConnectionId: z.string().optional(),
+	projectId: z.string().optional(),
+	pscEndpoint: z.string().optional(),
+	endpointRegion: z.string().optional(),
+	serviceAttachmentId: z.string().optional()
+}).transform((d) => ({
+	psc_connection_id: d.pscConnectionId,
+	project_id: d.projectId,
+	psc_endpoint: d.pscEndpoint,
+	endpoint_region: d.endpointRegion,
+	service_attachment_id: d.serviceAttachmentId
+}));
+const marshalGcpVpcEndpointInfoSchema = z.object({
+	pscConnectionId: z.string().optional(),
+	projectId: z.string().optional(),
+	pscEndpointName: z.string().optional(),
+	endpointRegion: z.string().optional(),
+	serviceAttachmentId: z.string().optional()
+}).transform((d) => ({
+	psc_connection_id: d.pscConnectionId,
+	project_id: d.projectId,
+	psc_endpoint_name: d.pscEndpointName,
+	endpoint_region: d.endpointRegion,
+	service_attachment_id: d.serviceAttachmentId
+}));
+const marshalGoogleApiEndpointsSchema = z.object({ endpoints: z.array(z.string()).optional() }).transform((d) => ({ endpoints: d.endpoints }));
+const marshalIngressNetworkPolicySchema = z.object({
+	publicAccess: z.lazy(() => marshalIngressNetworkPolicy_PublicAccessSchema).optional(),
+	privateAccess: z.lazy(() => marshalIngressNetworkPolicy_PrivateAccessSchema).optional(),
+	crossWorkspaceAccess: z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema).optional()
+}).transform((d) => ({
+	public_access: d.publicAccess,
+	private_access: d.privateAccess,
+	cross_workspace_access: d.crossWorkspaceAccess
+}));
+const marshalIngressNetworkPolicy_AccountApiDestinationSchema = z.object({
+	scopes: z.array(z.string()).optional(),
+	scopeQualifier: z.string().optional()
+}).transform((d) => ({
+	scopes: d.scopes,
+	scope_qualifier: d.scopeQualifier
+}));
+const marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema = z.object({ allDestinations: z.boolean().optional() }).transform((d) => ({ all_destinations: d.allDestinations }));
+const marshalIngressNetworkPolicy_AccountUiDestinationSchema = z.object({ allDestinations: z.boolean().optional() }).transform((d) => ({ all_destinations: d.allDestinations }));
+const marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema = z.object({ allDestinations: z.boolean().optional() }).transform((d) => ({ all_destinations: d.allDestinations }));
+const marshalIngressNetworkPolicy_AuthenticationSchema = z.object({
+	identityType: z.string().optional(),
+	identities: z.array(z.lazy(() => marshalIngressNetworkPolicy_AuthenticationIdentitySchema)).optional()
+}).transform((d) => ({
+	identity_type: d.identityType,
+	identities: d.identities
+}));
+const marshalIngressNetworkPolicy_AuthenticationIdentitySchema = z.object({
+	principalType: z.string().optional(),
+	principalId: z.bigint().optional()
+}).transform((d) => ({
+	principal_type: d.principalType,
+	principal_id: d.principalId
+}));
+const marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema = z.object({
+	restrictionMode: z.string().optional(),
+	denyRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema)).optional(),
+	allowRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restriction_mode: d.restrictionMode,
+	deny_rules: d.denyRules,
+	allow_rules: d.allowRules
+}));
+const marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema = z.object({
+	origin: z.lazy(() => marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema).optional(),
+	destination: z.lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema = z.object({ source: z.discriminatedUnion("$case", [z.object({
+	$case: z.literal("allSourceWorkspaces"),
+	allSourceWorkspaces: z.boolean()
+}), z.object({
+	$case: z.literal("selectedWorkspaces"),
+	selectedWorkspaces: z.lazy(() => marshalIngressNetworkPolicy_WorkspaceIdListSchema)
+})]).optional() }).transform((d) => ({
+	...d.source?.$case === "allSourceWorkspaces" && { all_source_workspaces: d.source.allSourceWorkspaces },
+	...d.source?.$case === "selectedWorkspaces" && { selected_workspaces: d.source.selectedWorkspaces }
+}));
+const marshalIngressNetworkPolicy_EndpointsSchema = z.object({ endpointIds: z.array(z.string()).optional() }).transform((d) => ({ endpoint_ids: d.endpointIds }));
+const marshalIngressNetworkPolicy_IpRangesSchema = z.object({ ipRanges: z.array(z.string()).optional() }).transform((d) => ({ ip_ranges: d.ipRanges }));
+const marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema = z.object({ allDestinations: z.boolean().optional() }).transform((d) => ({ all_destinations: d.allDestinations }));
+const marshalIngressNetworkPolicy_PrivateAccessSchema = z.object({
+	restrictionMode: z.string().optional(),
+	denyRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema)).optional(),
+	allowRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_PrivateIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restriction_mode: d.restrictionMode,
+	deny_rules: d.denyRules,
+	allow_rules: d.allowRules
+}));
+const marshalIngressNetworkPolicy_PrivateIngressRuleSchema = z.object({
+	origin: z.lazy(() => marshalIngressNetworkPolicy_PrivateRequestOriginSchema).optional(),
+	destination: z.lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const marshalIngressNetworkPolicy_PrivateRequestOriginSchema = z.object({ source: z.discriminatedUnion("$case", [
+	z.object({
+		$case: z.literal("endpoints"),
+		endpoints: z.lazy(() => marshalIngressNetworkPolicy_EndpointsSchema)
+	}),
+	z.object({
+		$case: z.literal("allRegisteredEndpoints"),
+		allRegisteredEndpoints: z.boolean()
+	}),
+	z.object({
+		$case: z.literal("azureWorkspacePrivateLink"),
+		azureWorkspacePrivateLink: z.boolean()
+	}),
+	z.object({
+		$case: z.literal("allPrivateAccess"),
+		allPrivateAccess: z.boolean()
+	})
+]).optional() }).transform((d) => ({
+	...d.source?.$case === "endpoints" && { endpoints: d.source.endpoints },
+	...d.source?.$case === "allRegisteredEndpoints" && { all_registered_endpoints: d.source.allRegisteredEndpoints },
+	...d.source?.$case === "azureWorkspacePrivateLink" && { azure_workspace_private_link: d.source.azureWorkspacePrivateLink },
+	...d.source?.$case === "allPrivateAccess" && { all_private_access: d.source.allPrivateAccess }
+}));
+const marshalIngressNetworkPolicy_PublicAccessSchema = z.object({
+	restrictionMode: z.string().optional(),
+	denyRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema)).optional(),
+	allowRules: z.array(z.lazy(() => marshalIngressNetworkPolicy_PublicIngressRuleSchema)).optional()
+}).transform((d) => ({
+	restriction_mode: d.restrictionMode,
+	deny_rules: d.denyRules,
+	allow_rules: d.allowRules
+}));
+const marshalIngressNetworkPolicy_PublicIngressRuleSchema = z.object({
+	origin: z.lazy(() => marshalIngressNetworkPolicy_PublicRequestOriginSchema).optional(),
+	destination: z.lazy(() => marshalIngressNetworkPolicy_RequestDestinationSchema).optional(),
+	authentication: z.lazy(() => marshalIngressNetworkPolicy_AuthenticationSchema).optional(),
+	label: z.string().optional()
+}).transform((d) => ({
+	origin: d.origin,
+	destination: d.destination,
+	authentication: d.authentication,
+	label: d.label
+}));
+const marshalIngressNetworkPolicy_PublicRequestOriginSchema = z.object({ source: z.discriminatedUnion("$case", [
+	z.object({
+		$case: z.literal("allIpRanges"),
+		allIpRanges: z.boolean()
+	}),
+	z.object({
+		$case: z.literal("includedIpRanges"),
+		includedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema)
+	}),
+	z.object({
+		$case: z.literal("excludedIpRanges"),
+		excludedIpRanges: z.lazy(() => marshalIngressNetworkPolicy_IpRangesSchema)
+	})
+]).optional() }).transform((d) => ({
+	...d.source?.$case === "allIpRanges" && { all_ip_ranges: d.source.allIpRanges },
+	...d.source?.$case === "includedIpRanges" && { included_ip_ranges: d.source.includedIpRanges },
+	...d.source?.$case === "excludedIpRanges" && { excluded_ip_ranges: d.source.excludedIpRanges }
+}));
+const marshalIngressNetworkPolicy_RequestDestinationSchema = z.object({
+	allDestinations: z.boolean().optional(),
+	workspaceUi: z.lazy(() => marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema).optional(),
+	workspaceApi: z.lazy(() => marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema).optional(),
+	appsRuntime: z.lazy(() => marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema).optional(),
+	lakebaseRuntime: z.lazy(() => marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema).optional(),
+	accountUi: z.lazy(() => marshalIngressNetworkPolicy_AccountUiDestinationSchema).optional(),
+	accountApi: z.lazy(() => marshalIngressNetworkPolicy_AccountApiDestinationSchema).optional(),
+	accountDatabricksOne: z.lazy(() => marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema).optional()
+}).transform((d) => ({
+	all_destinations: d.allDestinations,
+	workspace_ui: d.workspaceUi,
+	workspace_api: d.workspaceApi,
+	apps_runtime: d.appsRuntime,
+	lakebase_runtime: d.lakebaseRuntime,
+	account_ui: d.accountUi,
+	account_api: d.accountApi,
+	account_databricks_one: d.accountDatabricksOne
+}));
+const marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema = z.object({
+	scopes: z.array(z.string()).optional(),
+	scopeQualifier: z.string().optional()
+}).transform((d) => ({
+	scopes: d.scopes,
+	scope_qualifier: d.scopeQualifier
+}));
+const marshalIngressNetworkPolicy_WorkspaceIdListSchema = z.object({ workspaceIds: z.array(z.bigint()).optional() }).transform((d) => ({ workspace_ids: d.workspaceIds }));
+const marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema = z.object({ allDestinations: z.boolean().optional() }).transform((d) => ({ all_destinations: d.allDestinations }));
+const marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema = z.object({
+	ruleId: z.string().optional(),
+	networkConnectivityConfigId: z.string().optional(),
+	accountId: z.string().optional(),
+	endpointService: z.string().optional(),
+	domainNames: z.array(z.string()).optional(),
+	resourceNames: z.array(z.string()).optional(),
+	vpcEndpointId: z.string().optional(),
+	connectionState: z.string().optional(),
+	creationTime: z.bigint().optional(),
+	updatedTime: z.bigint().optional(),
+	deactivated: z.boolean().optional(),
+	deactivatedAt: z.bigint().optional(),
+	enabled: z.boolean().optional(),
+	errorMessage: z.string().optional()
+}).transform((d) => ({
+	rule_id: d.ruleId,
+	network_connectivity_config_id: d.networkConnectivityConfigId,
+	account_id: d.accountId,
+	endpoint_service: d.endpointService,
+	domain_names: d.domainNames,
+	resource_names: d.resourceNames,
+	vpc_endpoint_id: d.vpcEndpointId,
+	connection_state: d.connectionState,
+	creation_time: d.creationTime,
+	updated_time: d.updatedTime,
+	deactivated: d.deactivated,
+	deactivated_at: d.deactivatedAt,
+	enabled: d.enabled,
+	error_message: d.errorMessage
+}));
+const marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema = z.object({
+	ruleId: z.string().optional(),
+	networkConnectivityConfigId: z.string().optional(),
+	resourceId: z.string().optional(),
+	groupId: z.string().optional(),
+	endpointName: z.string().optional(),
+	connectionState: z.string().optional(),
+	creationTime: z.bigint().optional(),
+	updatedTime: z.bigint().optional(),
+	deactivated: z.boolean().optional(),
+	deactivatedAt: z.bigint().optional(),
+	domainNames: z.array(z.string()).optional(),
+	errorMessage: z.string().optional()
+}).transform((d) => ({
+	rule_id: d.ruleId,
+	network_connectivity_config_id: d.networkConnectivityConfigId,
+	resource_id: d.resourceId,
+	group_id: d.groupId,
+	endpoint_name: d.endpointName,
+	connection_state: d.connectionState,
+	creation_time: d.creationTime,
+	updated_time: d.updatedTime,
+	deactivated: d.deactivated,
+	deactivated_at: d.deactivatedAt,
+	domain_names: d.domainNames,
+	error_message: d.errorMessage
+}));
+const marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema = z.object({
+	azureServiceEndpointRule: z.lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema).optional(),
+	awsStableIpRule: z.lazy(() => marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema).optional()
+}).transform((d) => ({
+	azure_service_endpoint_rule: d.azureServiceEndpointRule,
+	aws_stable_ip_rule: d.awsStableIpRule
+}));
+const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema = z.object({ cidrBlocks: z.array(z.string()).optional() }).transform((d) => ({ cidr_blocks: d.cidrBlocks }));
+const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema = z.object({
+	targetRegion: z.string().optional(),
+	targetServices: z.array(z.string()).optional(),
+	subnets: z.array(z.string()).optional()
+}).transform((d) => ({
+	target_region: d.targetRegion,
+	target_services: d.targetServices,
+	subnets: d.subnets
+}));
+const marshalNetworkVpcEndpointsSchema = z.object({
+	restApi: z.array(z.string()).optional(),
+	dataplaneRelay: z.array(z.string()).optional()
+}).transform((d) => ({
+	rest_api: d.restApi,
+	dataplane_relay: d.dataplaneRelay
+}));
+const marshalPrivateAccessSettingsSchema = z.object({
+	privateAccessSettingsId: z.string().optional(),
+	accountId: z.string().optional(),
+	privateAccessSettingsName: z.string().optional(),
+	region: z.string().optional(),
+	publicAccessEnabled: z.boolean().optional(),
+	privateAccessLevel: z.string().optional(),
+	allowedVpcEndpointIds: z.array(z.string()).optional()
+}).transform((d) => ({
+	private_access_settings_id: d.privateAccessSettingsId,
+	account_id: d.accountId,
+	private_access_settings_name: d.privateAccessSettingsName,
+	region: d.region,
+	public_access_enabled: d.publicAccessEnabled,
+	private_access_level: d.privateAccessLevel,
+	allowed_vpc_endpoint_ids: d.allowedVpcEndpointIds
+}));
+const marshalReplaceAccountIpAccessListRequestSchema = z.object({
+	accountId: z.string().optional(),
+	listId: z.string().optional(),
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	list_id: d.listId,
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses,
+	enabled: d.enabled
+}));
+const marshalReplaceIpAccessListRequestSchema = z.object({
+	listId: z.string().optional(),
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	list_id: d.listId,
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses,
+	enabled: d.enabled
+}));
+const marshalUpdateAccountIpAccessListRequestSchema = z.object({
+	accountId: z.string().optional(),
+	listId: z.string().optional(),
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	account_id: d.accountId,
+	list_id: d.listId,
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses,
+	enabled: d.enabled
+}));
+const marshalUpdateIpAccessListRequestSchema = z.object({
+	listId: z.string().optional(),
+	label: z.string().optional(),
+	listType: z.string().optional(),
+	ipAddresses: z.array(z.string()).optional(),
+	enabled: z.boolean().optional()
+}).transform((d) => ({
+	list_id: d.listId,
+	label: d.label,
+	list_type: d.listType,
+	ip_addresses: d.ipAddresses,
+	enabled: d.enabled
+}));
+const marshalUpdatePrivateEndpointRuleSchema = z.object({
+	ruleId: z.string().optional(),
+	networkConnectivityConfigId: z.string().optional(),
+	connectionState: z.string().optional(),
+	domainNames: z.array(z.string()).optional(),
+	creationTime: z.bigint().optional(),
+	updatedTime: z.bigint().optional(),
+	deactivated: z.boolean().optional(),
+	deactivatedAt: z.bigint().optional(),
+	errorMessage: z.string().optional(),
+	resourceId: z.string().optional(),
+	groupId: z.string().optional(),
+	endpointName: z.string().optional(),
+	accountId: z.string().optional(),
+	endpointService: z.string().optional(),
+	resourceNames: z.array(z.string()).optional(),
+	vpcEndpointId: z.string().optional(),
+	enabled: z.boolean().optional(),
+	endpoint: z.discriminatedUnion("$case", [z.object({
+		$case: z.literal("gcpEndpoint"),
+		gcpEndpoint: z.lazy(() => marshalGcpEndpointSchema)
+	})]).optional()
+}).transform((d) => ({
+	rule_id: d.ruleId,
+	network_connectivity_config_id: d.networkConnectivityConfigId,
+	connection_state: d.connectionState,
+	domain_names: d.domainNames,
+	creation_time: d.creationTime,
+	updated_time: d.updatedTime,
+	deactivated: d.deactivated,
+	deactivated_at: d.deactivatedAt,
+	error_message: d.errorMessage,
+	resource_id: d.resourceId,
+	group_id: d.groupId,
+	endpoint_name: d.endpointName,
+	account_id: d.accountId,
+	endpoint_service: d.endpointService,
+	resource_names: d.resourceNames,
+	vpc_endpoint_id: d.vpcEndpointId,
+	enabled: d.enabled,
+	...d.endpoint?.$case === "gcpEndpoint" && { gcp_endpoint: d.endpoint.gcpEndpoint }
+}));
+const marshalWorkspaceNetworkOptionSchema = z.object({
+	networkPolicyId: z.string().optional(),
+	workspaceId: z.bigint().optional()
+}).transform((d) => ({
+	network_policy_id: d.networkPolicyId,
+	workspace_id: d.workspaceId
 }));
 const gcpEndpointFieldMaskSchema = {
-    pscEndpointUri: { wire: 'psc_endpoint_uri' },
-    serviceAttachment: { wire: 'service_attachment' },
+	allVpcScServices: { wire: "all_vpc_sc_services" },
+	googleApiEndpoints: {
+		wire: "google_api_endpoints",
+		children: () => googleApiEndpointsFieldMaskSchema
+	},
+	pscEndpointUri: { wire: "psc_endpoint_uri" },
+	serviceAttachment: { wire: "service_attachment" }
 };
+const googleApiEndpointsFieldMaskSchema = { endpoints: { wire: "endpoints" } };
 const updatePrivateEndpointRuleFieldMaskSchema = {
-    accountId: { wire: 'account_id' },
-    connectionState: { wire: 'connection_state' },
-    creationTime: { wire: 'creation_time' },
-    deactivated: { wire: 'deactivated' },
-    deactivatedAt: { wire: 'deactivated_at' },
-    domainNames: { wire: 'domain_names' },
-    enabled: { wire: 'enabled' },
-    endpointName: { wire: 'endpoint_name' },
-    endpointService: { wire: 'endpoint_service' },
-    errorMessage: { wire: 'error_message' },
-    gcpEndpoint: {
-        wire: 'gcp_endpoint',
-        children: () => gcpEndpointFieldMaskSchema,
-    },
-    groupId: { wire: 'group_id' },
-    networkConnectivityConfigId: { wire: 'network_connectivity_config_id' },
-    resourceId: { wire: 'resource_id' },
-    resourceNames: { wire: 'resource_names' },
-    ruleId: { wire: 'rule_id' },
-    updatedTime: { wire: 'updated_time' },
-    vpcEndpointId: { wire: 'vpc_endpoint_id' },
+	accountId: { wire: "account_id" },
+	connectionState: { wire: "connection_state" },
+	creationTime: { wire: "creation_time" },
+	deactivated: { wire: "deactivated" },
+	deactivatedAt: { wire: "deactivated_at" },
+	domainNames: { wire: "domain_names" },
+	enabled: { wire: "enabled" },
+	endpointName: { wire: "endpoint_name" },
+	endpointService: { wire: "endpoint_service" },
+	errorMessage: { wire: "error_message" },
+	gcpEndpoint: {
+		wire: "gcp_endpoint",
+		children: () => gcpEndpointFieldMaskSchema
+	},
+	groupId: { wire: "group_id" },
+	networkConnectivityConfigId: { wire: "network_connectivity_config_id" },
+	resourceId: { wire: "resource_id" },
+	resourceNames: { wire: "resource_names" },
+	ruleId: { wire: "rule_id" },
+	updatedTime: { wire: "updated_time" },
+	vpcEndpointId: { wire: "vpc_endpoint_id" }
 };
-export function updatePrivateEndpointRuleFieldMask(...paths) {
-    return FieldMask.build(paths, updatePrivateEndpointRuleFieldMaskSchema);
+function updatePrivateEndpointRuleFieldMask(...paths) {
+	return FieldMask.build(paths, updatePrivateEndpointRuleFieldMaskSchema);
 }
+
+//#endregion
+export { AccountIpAccessListType_IpAccessListType, EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType, EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter, EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode, EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode, EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType, EgressResourceType, EndpointState, EndpointUseCase_EndpointUseCase, IngressNetworkPolicy_ApiScopeQualifier, IngressNetworkPolicy_AuthenticationIdentity_PrincipalType, IngressNetworkPolicy_Authentication_IdentityType, IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode, IngressNetworkPolicy_PrivateAccess_RestrictionMode, IngressNetworkPolicy_PublicAccess_RestrictionMode, IpAccessListType, NccPrivateEndpointRule_PrivateLinkConnectionState, NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState, NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState, PrivateAccessLevel, VpcEndpointUseCase, VpcStatus, marshalAccountNetworkPolicySchema, marshalAwsVpcEndpointInfoSchema, marshalAzurePrivateEndpointInfoSchema, marshalCreateAccountIpAccessListRequestSchema, marshalCreateIpAccessListRequestSchema, marshalCreateNetworkConnectivityConfigurationSchema, marshalCreateNetworkRequestSchema, marshalCreatePrivateAccessSettingsRequestSchema, marshalCreatePrivateEndpointRuleSchema, marshalCreateVpcEndpointRequestSchema, marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema, marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema, marshalEgressNetworkPolicySchema, marshalEgressNetworkPolicy_NetworkAccessPolicySchema, marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema, marshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema, marshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema, marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema, marshalEndpointSchema, marshalGcpEndpointSchema, marshalGcpNetworkInfoSchema, marshalGcpPscEndpointInfoSchema, marshalGcpVpcEndpointInfoSchema, marshalGoogleApiEndpointsSchema, marshalIngressNetworkPolicySchema, marshalIngressNetworkPolicy_AccountApiDestinationSchema, marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema, marshalIngressNetworkPolicy_AccountUiDestinationSchema, marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema, marshalIngressNetworkPolicy_AuthenticationIdentitySchema, marshalIngressNetworkPolicy_AuthenticationSchema, marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema, marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema, marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema, marshalIngressNetworkPolicy_EndpointsSchema, marshalIngressNetworkPolicy_IpRangesSchema, marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema, marshalIngressNetworkPolicy_PrivateAccessSchema, marshalIngressNetworkPolicy_PrivateIngressRuleSchema, marshalIngressNetworkPolicy_PrivateRequestOriginSchema, marshalIngressNetworkPolicy_PublicAccessSchema, marshalIngressNetworkPolicy_PublicIngressRuleSchema, marshalIngressNetworkPolicy_PublicRequestOriginSchema, marshalIngressNetworkPolicy_RequestDestinationSchema, marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema, marshalIngressNetworkPolicy_WorkspaceIdListSchema, marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema, marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema, marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema, marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema, marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema, marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema, marshalNetworkVpcEndpointsSchema, marshalPrivateAccessSettingsSchema, marshalReplaceAccountIpAccessListRequestSchema, marshalReplaceIpAccessListRequestSchema, marshalUpdateAccountIpAccessListRequestSchema, marshalUpdateIpAccessListRequestSchema, marshalUpdatePrivateEndpointRuleSchema, marshalWorkspaceNetworkOptionSchema, unmarshalAccountIpAccessListSchema, unmarshalAccountNetworkPolicySchema, unmarshalAwsVpcEndpointInfoSchema, unmarshalAzurePrivateEndpointInfoSchema, unmarshalCreateAccountIpAccessListResponseSchema, unmarshalCreateIpAccessListResponseSchema, unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema, unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema, unmarshalDeleteAccountIpAccessListResponseSchema, unmarshalDeleteIpAccessListResponseSchema, unmarshalEgressNetworkPolicySchema, unmarshalEgressNetworkPolicy_NetworkAccessPolicySchema, unmarshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema, unmarshalEgressNetworkPolicy_NetworkAccessPolicy_InternetDestinationSchema, unmarshalEgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcementSchema, unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDestinationSchema, unmarshalEndpointSchema, unmarshalGcpEndpointSchema, unmarshalGcpNetworkInfoSchema, unmarshalGcpPscEndpointInfoSchema, unmarshalGcpVpcEndpointInfoSchema, unmarshalGetAccountIpAccessListResponseSchema, unmarshalGetIpAccessListResponseSchema, unmarshalGoogleApiEndpointsSchema, unmarshalIngressNetworkPolicySchema, unmarshalIngressNetworkPolicy_AccountApiDestinationSchema, unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema, unmarshalIngressNetworkPolicy_AccountUiDestinationSchema, unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema, unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema, unmarshalIngressNetworkPolicy_AuthenticationSchema, unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema, unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema, unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema, unmarshalIngressNetworkPolicy_EndpointsSchema, unmarshalIngressNetworkPolicy_IpRangesSchema, unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema, unmarshalIngressNetworkPolicy_PrivateAccessSchema, unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema, unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema, unmarshalIngressNetworkPolicy_PublicAccessSchema, unmarshalIngressNetworkPolicy_PublicIngressRuleSchema, unmarshalIngressNetworkPolicy_PublicRequestOriginSchema, unmarshalIngressNetworkPolicy_RequestDestinationSchema, unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema, unmarshalIngressNetworkPolicy_WorkspaceIdListSchema, unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema, unmarshalIpAccessListSchema, unmarshalListAccountIpAccessListsResponseSchema, unmarshalListEndpointsResponseSchema, unmarshalListIpAccessListsResponseSchema, unmarshalListNccPrivateEndpointRulesResponseSchema, unmarshalListNetworkConnectivityConfigsResponseSchema, unmarshalListNetworkPoliciesResponseSchema, unmarshalNccPrivateEndpointRuleSchema, unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema, unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema, unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema, unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema, unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema, unmarshalNetworkConnectivityConfigSchema, unmarshalNetworkHealthSchema, unmarshalNetworkSchema, unmarshalNetworkVpcEndpointsSchema, unmarshalNetworkWarningSchema, unmarshalPrivateAccessSettingsSchema, unmarshalReplaceAccountIpAccessListResponseSchema, unmarshalReplaceIpAccessListResponseSchema, unmarshalUpdateAccountIpAccessListResponseSchema, unmarshalUpdateIpAccessListResponseSchema, unmarshalVpcEndpointSchema, unmarshalWorkspaceNetworkOptionSchema, updatePrivateEndpointRuleFieldMask };
 //# sourceMappingURL=model.js.map