@distilled.cloud/stackit 0.0.0-stage → 1.0.0-rc.14

package/src/services/vpn.ts

@@ -0,0 +1,2365 @@
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-stackit). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import { UnknownStackitError } from "../errors.ts";
+import { StackitProtocol, type StackitOpError, type StackitOpContext } from "../protocol.ts";
+import * as Retry from "../retry.ts";
+import * as T from "../traits.ts";
+
+export type { StackitOpError, StackitOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+/** The region in which the resource is located. */
+export type CreateGatewayRequestRegion = "eu01" | "eu02";
+export const CreateGatewayRequestRegion = S.String;
+
+export interface CreateGatewayRequestAvailabilityZones {
+  tunnel1: string;
+  tunnel2: string;
+}
+export const CreateGatewayRequestAvailabilityZones = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tunnel1: S.String,
+    tunnel2: S.String,
+  }),
+).annotate({
+  identifier: "CreateGatewayRequestAvailabilityZones",
+}) as any as S.Schema<CreateGatewayRequestAvailabilityZones>;
+
+/** A list of IPv4 Prefixes to advertise via BGP. If omitted, the SNA network ranges will be advertised. */
+export type BGPGatewayConfigOverrideAdvertisedRoutesList = Array<string>;
+export const BGPGatewayConfigOverrideAdvertisedRoutesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<BGPGatewayConfigOverrideAdvertisedRoutesList>;
+
+/** BGP configuration effects all connections. (only for routingMode=BGP_ROUTE_BASED) */
+export interface BGPGatewayConfig {
+  localAsn: number;
+  /** A list of IPv4 Prefixes to advertise via BGP. If omitted, the SNA network ranges will be advertised. */
+  overrideAdvertisedRoutes?: BGPGatewayConfigOverrideAdvertisedRoutesList;
+}
+export const BGPGatewayConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    localAsn: S.Number,
+    overrideAdvertisedRoutes: S.optional(BGPGatewayConfigOverrideAdvertisedRoutesList),
+  }),
+).annotate({ identifier: "BGPGatewayConfig" }) as any as S.Schema<BGPGatewayConfig>;
+
+/** Map of custom labels. Key and values must be a string with max 63 chars, start/end with alphanumeric. The key of a label follows the same rules as the `LabelValue` except that it cannot be empty. */
+export type Label = { [key: string]: string | undefined };
+export const Label = /*@__PURE__*/ S.Record(S.String, S.String) as any as S.Schema<Label>;
+
+export interface NetworkConfig {
+  /** The IPv4 network prefix (CIDR notation) allocated for the VPN gateway. Must have a prefix length of /28 or larger. Once the gateway is created, is not possible to change this attribute. */
+  predefinedNetworkPrefix?: string;
+  /** Custom routing table ID for the VPN gateway */
+  routingTableId?: string;
+}
+export const NetworkConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    predefinedNetworkPrefix: S.optional(S.String),
+    routingTableId: S.optional(S.String),
+  }),
+).annotate({ identifier: "NetworkConfig" }) as any as S.Schema<NetworkConfig>;
+
+/** Once the gateway is created, it is not possible to change this attribute. */
+export type RoutingType = "POLICY_BASED" | "ROUTE_BASED" | "BGP_ROUTE_BASED";
+export const RoutingType = S.String;
+
+export interface CreateGatewayRequest {
+  projectId: string;
+  region: CreateGatewayRequestRegion | (string & {});
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType | (string & {});
+}
+export const CreateGatewayRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: CreateGatewayRequestRegion.pipe(T.Label()),
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "CreateGatewayRequest" }) as any as S.Schema<CreateGatewayRequest>;
+
+export type CreateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export const CreateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+
+/** The current lifecycle state of the gateway infrastructure. - `PENDING`: Provisioning or update is in progress. - `READY`: The gateway is fully operational. - `ERROR`: A failure occurred. - `DELETING`: The resource is being removed. */
+export type GatewayStatus = "PENDING" | "READY" | "ERROR" | "DELETING";
+export const GatewayStatus = S.String;
+
+export interface CreateGatewayResponse {
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType;
+  /** The server-generated UUID of the VPN gateway. */
+  id?: string;
+  state?: GatewayStatus;
+}
+export const CreateGatewayResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+    id: S.optional(S.String),
+    state: S.optional(GatewayStatus),
+  }),
+).annotate({ identifier: "CreateGatewayResponse" }) as any as S.Schema<CreateGatewayResponse>;
+
+/** The region in which the resource is located. */
+export type CreateGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export const CreateGatewayBGPFilterRequestRegion = S.String;
+
+export interface CreateGatewayBGPFilterRequest {
+  projectId: string;
+  region: CreateGatewayBGPFilterRequestRegion | (string & {});
+  gatewayId: string;
+  /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+  displayName: string;
+}
+export const CreateGatewayBGPFilterRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: CreateGatewayBGPFilterRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    displayName: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateGatewayBGPFilterRequest",
+}) as any as S.Schema<CreateGatewayBGPFilterRequest>;
+
+/** A named BGP route filter. Internally a BGPFilter holds an ordered set of rules (managed via the nested /rules sub-resource); a route is evaluated against each rule in 'sequence' order and the first match decides the outcome. An implicit DENY is applied after the last rule, so a route that matches no PERMIT rule is dropped. Attaching an empty filter to a tunnel therefore denies every route. Resource limits: the maximum number of filters per gateway equals the gateway plan's maxConnections value; the maximum number of rules per filter is 10. */
+export interface BGPFilter {
+  /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+  displayName: string;
+  /** The server-generated UUID of the filter. */
+  id?: string;
+}
+export const BGPFilter = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    displayName: S.String,
+    id: S.optional(S.String),
+  }),
+).annotate({ identifier: "BGPFilter" }) as any as S.Schema<BGPFilter>;
+
+/** The region in which the resource is located. */
+export type CreateGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export const CreateGatewayBGPFilterRuleRequestRegion = S.String;
+
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type CreateGatewayBGPFilterRuleRequestAction = "PERMIT" | "DENY";
+export const CreateGatewayBGPFilterRuleRequestAction = S.String;
+
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = Array<number>;
+export const CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList>;
+
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type CreateGatewayBGPFilterRuleRequestMatchCommunitiesList = Array<string>;
+export const CreateGatewayBGPFilterRuleRequestMatchCommunitiesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateGatewayBGPFilterRuleRequestMatchCommunitiesList>;
+
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type CreateGatewayBGPFilterRuleRequestMatchPrefixesList = Array<string>;
+export const CreateGatewayBGPFilterRuleRequestMatchPrefixesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateGatewayBGPFilterRuleRequestMatchPrefixesList>;
+
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface CreateGatewayBGPFilterRuleRequestMatch {
+  /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+  asPathContainsAny?: CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList;
+  /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+  communities?: CreateGatewayBGPFilterRuleRequestMatchCommunitiesList;
+  /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+  firstASN?: number;
+  /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+  maxPrefixLength?: number;
+  /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+  minPrefixLength?: number;
+  /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+  peer?: string;
+  /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+  prefixes?: CreateGatewayBGPFilterRuleRequestMatchPrefixesList;
+}
+export const CreateGatewayBGPFilterRuleRequestMatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    asPathContainsAny: S.optional(CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList),
+    communities: S.optional(CreateGatewayBGPFilterRuleRequestMatchCommunitiesList),
+    firstASN: S.optional(S.Number),
+    maxPrefixLength: S.optional(S.Number),
+    minPrefixLength: S.optional(S.Number),
+    peer: S.optional(S.String),
+    prefixes: S.optional(CreateGatewayBGPFilterRuleRequestMatchPrefixesList),
+  }),
+).annotate({
+  identifier: "CreateGatewayBGPFilterRuleRequestMatch",
+}) as any as S.Schema<CreateGatewayBGPFilterRuleRequestMatch>;
+
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export interface CreateGatewayBGPFilterRuleRequestSet {
+  /** BGP LOCAL_PREF to set on the route. Higher values are preferred during best-path selection. Default BGP LOCAL_PREF is 100; any value here overrides. */
+  localPreference?: number;
+}
+export const CreateGatewayBGPFilterRuleRequestSet = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    localPreference: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "CreateGatewayBGPFilterRuleRequestSet",
+}) as any as S.Schema<CreateGatewayBGPFilterRuleRequestSet>;
+
+export interface CreateGatewayBGPFilterRuleRequest {
+  projectId: string;
+  region: CreateGatewayBGPFilterRuleRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+  /** The action to take if the route matches all criteria. Case-sensitive. */
+  action: CreateGatewayBGPFilterRuleRequestAction | (string & {});
+  /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+  match?: CreateGatewayBGPFilterRuleRequestMatch;
+  /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+  sequence?: number;
+  /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+  set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export const CreateGatewayBGPFilterRuleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: CreateGatewayBGPFilterRuleRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+    action: CreateGatewayBGPFilterRuleRequestAction,
+    match: S.optional(CreateGatewayBGPFilterRuleRequestMatch),
+    sequence: S.optional(S.Number),
+    set: S.optional(CreateGatewayBGPFilterRuleRequestSet),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}/rules",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateGatewayBGPFilterRuleRequest",
+}) as any as S.Schema<CreateGatewayBGPFilterRuleRequest>;
+
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type BGPFilterRuleAction = "PERMIT" | "DENY";
+export const BGPFilterRuleAction = S.String;
+
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type BGPFilterRuleMatchAsPathContainsAnyList = Array<number>;
+export const BGPFilterRuleMatchAsPathContainsAnyList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<BGPFilterRuleMatchAsPathContainsAnyList>;
+
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type BGPFilterRuleMatchCommunitiesList = Array<string>;
+export const BGPFilterRuleMatchCommunitiesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<BGPFilterRuleMatchCommunitiesList>;
+
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type BGPFilterRuleMatchPrefixesList = Array<string>;
+export const BGPFilterRuleMatchPrefixesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<BGPFilterRuleMatchPrefixesList>;
+
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface BGPFilterRuleMatch {
+  /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+  asPathContainsAny?: BGPFilterRuleMatchAsPathContainsAnyList;
+  /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+  communities?: BGPFilterRuleMatchCommunitiesList;
+  /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+  firstASN?: number;
+  /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+  maxPrefixLength?: number;
+  /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+  minPrefixLength?: number;
+  /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+  peer?: string;
+  /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+  prefixes?: BGPFilterRuleMatchPrefixesList;
+}
+export const BGPFilterRuleMatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    asPathContainsAny: S.optional(BGPFilterRuleMatchAsPathContainsAnyList),
+    communities: S.optional(BGPFilterRuleMatchCommunitiesList),
+    firstASN: S.optional(S.Number),
+    maxPrefixLength: S.optional(S.Number),
+    minPrefixLength: S.optional(S.Number),
+    peer: S.optional(S.String),
+    prefixes: S.optional(BGPFilterRuleMatchPrefixesList),
+  }),
+).annotate({ identifier: "BGPFilterRuleMatch" }) as any as S.Schema<BGPFilterRuleMatch>;
+
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export type BGPFilterRuleSet = CreateGatewayBGPFilterRuleRequestSet;
+export const BGPFilterRuleSet = CreateGatewayBGPFilterRuleRequestSet;
+
+/** A single rule within a BGPFilter. All non-empty fields within the 'match' block are AND-combined. Rules within a filter are evaluated in 'sequence' order; the first matching rule decides the outcome (logical OR across rules). An implicit DENY follows the last rule. */
+export interface BGPFilterRule {
+  /** The action to take if the route matches all criteria. Case-sensitive. */
+  action: BGPFilterRuleAction;
+  /** The server-generated UUID of the specific rule. */
+  id?: string;
+  /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+  match?: BGPFilterRuleMatch;
+  /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+  sequence?: number;
+  /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+  set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export const BGPFilterRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    action: BGPFilterRuleAction,
+    id: S.optional(S.String),
+    match: S.optional(BGPFilterRuleMatch),
+    sequence: S.optional(S.Number),
+    set: S.optional(CreateGatewayBGPFilterRuleRequestSet),
+  }),
+).annotate({ identifier: "BGPFilterRule" }) as any as S.Schema<BGPFilterRule>;
+
+/** The region in which the resource is located. */
+export type CreateGatewayConnectionRequestRegion = "eu01" | "eu02";
+export const CreateGatewayConnectionRequestRegion = S.String;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type CreateGatewayConnectionRequestLocalSubnetsList = Array<string>;
+export const CreateGatewayConnectionRequestLocalSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateGatewayConnectionRequestLocalSubnetsList>;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type CreateGatewayConnectionRequestRemoteSubnetsList = Array<string>;
+export const CreateGatewayConnectionRequestRemoteSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateGatewayConnectionRequestRemoteSubnetsList>;
+
+/** Optional. Use this for route-based VPN. */
+export type CreateGatewayConnectionRequestStaticRoutesList = Array<string>;
+export const CreateGatewayConnectionRequestStaticRoutesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateGatewayConnectionRequestStaticRoutesList>;
+
+export interface BGPTunnelConfig {
+  /** UUID of the BGPFilter to apply to incoming routes from this tunnel's BGP neighbor. The filter must exist in the same gateway. Multiple tunnels may reference the same BGPFilter; in that case the rules' 'match.peer' field can be used to scope behavior per neighbor. Outbound filtering is not yet supported; use gateway.bgp.overrideAdvertisedRoutes to control what is advertised. */
+  inboundFilterId?: string | null;
+  remoteAsn: number;
+}
+export const BGPTunnelConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    inboundFilterId: S.optional(S.NullOr(S.String)),
+    remoteAsn: S.Number,
+  }),
+).annotate({ identifier: "BGPTunnelConfig" }) as any as S.Schema<BGPTunnelConfig>;
+
+/** The peering object defines the point-to-point IP configuration for the Tunnel Interface. These addresses serve as next-hop identifiers and are used for BGP peering sessions and can be used in Static Route-Based connectivity. */
+export interface PeeringConfig {
+  localAddress?: string;
+  remoteAddress?: string;
+}
+export const PeeringConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    localAddress: S.optional(S.String),
+    remoteAddress: S.optional(S.String),
+  }),
+).annotate({ identifier: "PeeringConfig" }) as any as S.Schema<PeeringConfig>;
+
+export type TunnelConfigurationPhase1DhGroupsItem =
+  | "modp1024"
+  | "modp2048"
+  | "ecp256"
+  | "ecp384"
+  | "modp2048s256";
+export const TunnelConfigurationPhase1DhGroupsItem = S.String;
+
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationPhase1DhGroupsList = Array<
+  TunnelConfigurationPhase1DhGroupsItem | (string & {})
+>;
+export const TunnelConfigurationPhase1DhGroupsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase1DhGroupsItem,
+) as any as S.Schema<TunnelConfigurationPhase1DhGroupsList>;
+
+export type TunnelConfigurationPhase1EncryptionAlgorithmsItem =
+  | "aes256"
+  | "aes128gcm16"
+  | "aes256gcm16";
+export const TunnelConfigurationPhase1EncryptionAlgorithmsItem = S.String;
+
+export type TunnelConfigurationPhase1EncryptionAlgorithmsList = Array<
+  TunnelConfigurationPhase1EncryptionAlgorithmsItem | (string & {})
+>;
+export const TunnelConfigurationPhase1EncryptionAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase1EncryptionAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationPhase1EncryptionAlgorithmsList>;
+
+export type TunnelConfigurationPhase1IntegrityAlgorithmsItem =
+  | "sha1"
+  | "sha2_256"
+  | "sha2_384"
+  | "sha2_512";
+export const TunnelConfigurationPhase1IntegrityAlgorithmsItem = S.String;
+
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationPhase1IntegrityAlgorithmsList = Array<
+  TunnelConfigurationPhase1IntegrityAlgorithmsItem | (string & {})
+>;
+export const TunnelConfigurationPhase1IntegrityAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase1IntegrityAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationPhase1IntegrityAlgorithmsList>;
+
+export interface TunnelConfigurationPhase1 {
+  /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+  dhGroups?: TunnelConfigurationPhase1DhGroupsList;
+  encryptionAlgorithms: TunnelConfigurationPhase1EncryptionAlgorithmsList;
+  /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+  integrityAlgorithms: TunnelConfigurationPhase1IntegrityAlgorithmsList;
+  /** Time to schedule a IKE re-keying (in seconds). */
+  rekeyTime?: number;
+}
+export const TunnelConfigurationPhase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dhGroups: S.optional(TunnelConfigurationPhase1DhGroupsList),
+    encryptionAlgorithms: TunnelConfigurationPhase1EncryptionAlgorithmsList,
+    integrityAlgorithms: TunnelConfigurationPhase1IntegrityAlgorithmsList,
+    rekeyTime: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "TunnelConfigurationPhase1",
+}) as any as S.Schema<TunnelConfigurationPhase1>;
+
+export type TunnelConfigurationPhase2DhGroupsItem =
+  | "modp1024"
+  | "modp2048"
+  | "ecp256"
+  | "ecp384"
+  | "modp2048s256";
+export const TunnelConfigurationPhase2DhGroupsItem = S.String;
+
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationPhase2DhGroupsList = Array<
+  TunnelConfigurationPhase2DhGroupsItem | (string & {})
+>;
+export const TunnelConfigurationPhase2DhGroupsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase2DhGroupsItem,
+) as any as S.Schema<TunnelConfigurationPhase2DhGroupsList>;
+
+export type TunnelConfigurationPhase2EncryptionAlgorithmsItem =
+  | "aes256"
+  | "aes128gcm16"
+  | "aes256gcm16";
+export const TunnelConfigurationPhase2EncryptionAlgorithmsItem = S.String;
+
+export type TunnelConfigurationPhase2EncryptionAlgorithmsList = Array<
+  TunnelConfigurationPhase2EncryptionAlgorithmsItem | (string & {})
+>;
+export const TunnelConfigurationPhase2EncryptionAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase2EncryptionAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationPhase2EncryptionAlgorithmsList>;
+
+export type TunnelConfigurationPhase2IntegrityAlgorithmsItem =
+  | "sha1"
+  | "sha2_256"
+  | "sha2_384"
+  | "sha2_512";
+export const TunnelConfigurationPhase2IntegrityAlgorithmsItem = S.String;
+
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationPhase2IntegrityAlgorithmsList = Array<
+  TunnelConfigurationPhase2IntegrityAlgorithmsItem | (string & {})
+>;
+export const TunnelConfigurationPhase2IntegrityAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationPhase2IntegrityAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationPhase2IntegrityAlgorithmsList>;
+
+/** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+export type TunnelConfigurationPhase2DpdAction = "clear" | "restart";
+export const TunnelConfigurationPhase2DpdAction = S.String;
+
+/** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+export type TunnelConfigurationPhase2StartAction = "none" | "start";
+export const TunnelConfigurationPhase2StartAction = S.String;
+
+export interface TunnelConfigurationPhase2 {
+  /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+  dhGroups?: TunnelConfigurationPhase2DhGroupsList;
+  encryptionAlgorithms: TunnelConfigurationPhase2EncryptionAlgorithmsList;
+  /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+  integrityAlgorithms: TunnelConfigurationPhase2IntegrityAlgorithmsList;
+  /** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+  dpdAction?: TunnelConfigurationPhase2DpdAction | (string & {});
+  /** Time to schedule a Child SA re-keying (in seconds). */
+  rekeyTime?: number;
+  /** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+  startAction?: TunnelConfigurationPhase2StartAction | (string & {});
+}
+export const TunnelConfigurationPhase2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dhGroups: S.optional(TunnelConfigurationPhase2DhGroupsList),
+    encryptionAlgorithms: TunnelConfigurationPhase2EncryptionAlgorithmsList,
+    integrityAlgorithms: TunnelConfigurationPhase2IntegrityAlgorithmsList,
+    dpdAction: S.optional(TunnelConfigurationPhase2DpdAction),
+    rekeyTime: S.optional(S.Number),
+    startAction: S.optional(TunnelConfigurationPhase2StartAction),
+  }),
+).annotate({
+  identifier: "TunnelConfigurationPhase2",
+}) as any as S.Schema<TunnelConfigurationPhase2>;
+
+export interface TunnelConfiguration {
+  bgp?: BGPTunnelConfig;
+  peering?: PeeringConfig;
+  phase1: TunnelConfigurationPhase1;
+  phase2: TunnelConfigurationPhase2;
+  /** A Pre-Shared Key for authentication. Required in create-requests, optional in update-requests and omitted in every response. */
+  preSharedKey?: string;
+  remoteAddress: string;
+}
+export const TunnelConfiguration = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bgp: S.optional(BGPTunnelConfig),
+    peering: S.optional(PeeringConfig),
+    phase1: TunnelConfigurationPhase1,
+    phase2: TunnelConfigurationPhase2,
+    preSharedKey: S.optional(S.String),
+    remoteAddress: S.String,
+  }),
+).annotate({ identifier: "TunnelConfiguration" }) as any as S.Schema<TunnelConfiguration>;
+
+export interface CreateGatewayConnectionRequest {
+  projectId: string;
+  region: CreateGatewayConnectionRequestRegion | (string & {});
+  gatewayId: string;
+  /** A user-friendly name for the connection. */
+  displayName: string;
+  /** This flag decides whether this connection should be enabled or disabled */
+  enabled?: boolean;
+  labels?: Label;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  localSubnets?: CreateGatewayConnectionRequestLocalSubnetsList;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  remoteSubnets?: CreateGatewayConnectionRequestRemoteSubnetsList;
+  /** Optional. Use this for route-based VPN. */
+  staticRoutes?: CreateGatewayConnectionRequestStaticRoutesList;
+  tunnel1: TunnelConfiguration;
+  tunnel2: TunnelConfiguration;
+}
+export const CreateGatewayConnectionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: CreateGatewayConnectionRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    displayName: S.String,
+    enabled: S.optional(S.Boolean),
+    labels: S.optional(Label),
+    localSubnets: S.optional(CreateGatewayConnectionRequestLocalSubnetsList),
+    remoteSubnets: S.optional(CreateGatewayConnectionRequestRemoteSubnetsList),
+    staticRoutes: S.optional(CreateGatewayConnectionRequestStaticRoutesList),
+    tunnel1: TunnelConfiguration,
+    tunnel2: TunnelConfiguration,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateGatewayConnectionRequest",
+}) as any as S.Schema<CreateGatewayConnectionRequest>;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type ConnectionResponseOutputLocalSubnetsList = Array<string>;
+export const ConnectionResponseOutputLocalSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConnectionResponseOutputLocalSubnetsList>;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type ConnectionResponseOutputRemoteSubnetsList = Array<string>;
+export const ConnectionResponseOutputRemoteSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConnectionResponseOutputRemoteSubnetsList>;
+
+/** Optional. Use this for route-based VPN. */
+export type ConnectionResponseOutputStaticRoutesList = Array<string>;
+export const ConnectionResponseOutputStaticRoutesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConnectionResponseOutputStaticRoutesList>;
+
+export type TunnelConfigurationOutputPhase1DhGroupsItem =
+  | "modp1024"
+  | "modp2048"
+  | "ecp256"
+  | "ecp384"
+  | "modp2048s256";
+export const TunnelConfigurationOutputPhase1DhGroupsItem = S.String;
+
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationOutputPhase1DhGroupsList =
+  Array<TunnelConfigurationOutputPhase1DhGroupsItem>;
+export const TunnelConfigurationOutputPhase1DhGroupsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase1DhGroupsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase1DhGroupsList>;
+
+export type TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem =
+  | "aes256"
+  | "aes128gcm16"
+  | "aes256gcm16";
+export const TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem = S.String;
+
+export type TunnelConfigurationOutputPhase1EncryptionAlgorithmsList =
+  Array<TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem>;
+export const TunnelConfigurationOutputPhase1EncryptionAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase1EncryptionAlgorithmsList>;
+
+export type TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem =
+  | "sha1"
+  | "sha2_256"
+  | "sha2_384"
+  | "sha2_512";
+export const TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem = S.String;
+
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationOutputPhase1IntegrityAlgorithmsList =
+  Array<TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem>;
+export const TunnelConfigurationOutputPhase1IntegrityAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase1IntegrityAlgorithmsList>;
+
+export interface TunnelConfigurationOutputPhase1 {
+  /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+  dhGroups?: TunnelConfigurationOutputPhase1DhGroupsList;
+  encryptionAlgorithms: TunnelConfigurationOutputPhase1EncryptionAlgorithmsList;
+  /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+  integrityAlgorithms: TunnelConfigurationOutputPhase1IntegrityAlgorithmsList;
+  /** Time to schedule a IKE re-keying (in seconds). */
+  rekeyTime?: number;
+}
+export const TunnelConfigurationOutputPhase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dhGroups: S.optional(TunnelConfigurationOutputPhase1DhGroupsList),
+    encryptionAlgorithms: TunnelConfigurationOutputPhase1EncryptionAlgorithmsList,
+    integrityAlgorithms: TunnelConfigurationOutputPhase1IntegrityAlgorithmsList,
+    rekeyTime: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "TunnelConfigurationOutputPhase1",
+}) as any as S.Schema<TunnelConfigurationOutputPhase1>;
+
+export type TunnelConfigurationOutputPhase2DhGroupsItem =
+  | "modp1024"
+  | "modp2048"
+  | "ecp256"
+  | "ecp384"
+  | "modp2048s256";
+export const TunnelConfigurationOutputPhase2DhGroupsItem = S.String;
+
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationOutputPhase2DhGroupsList =
+  Array<TunnelConfigurationOutputPhase2DhGroupsItem>;
+export const TunnelConfigurationOutputPhase2DhGroupsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase2DhGroupsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase2DhGroupsList>;
+
+export type TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem =
+  | "aes256"
+  | "aes128gcm16"
+  | "aes256gcm16";
+export const TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem = S.String;
+
+export type TunnelConfigurationOutputPhase2EncryptionAlgorithmsList =
+  Array<TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem>;
+export const TunnelConfigurationOutputPhase2EncryptionAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase2EncryptionAlgorithmsList>;
+
+export type TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem =
+  | "sha1"
+  | "sha2_256"
+  | "sha2_384"
+  | "sha2_512";
+export const TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem = S.String;
+
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationOutputPhase2IntegrityAlgorithmsList =
+  Array<TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem>;
+export const TunnelConfigurationOutputPhase2IntegrityAlgorithmsList = /*@__PURE__*/ S.Array(
+  TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem,
+) as any as S.Schema<TunnelConfigurationOutputPhase2IntegrityAlgorithmsList>;
+
+/** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+export type TunnelConfigurationOutputPhase2DpdAction = "clear" | "restart";
+export const TunnelConfigurationOutputPhase2DpdAction = S.String;
+
+/** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+export type TunnelConfigurationOutputPhase2StartAction = "none" | "start";
+export const TunnelConfigurationOutputPhase2StartAction = S.String;
+
+export interface TunnelConfigurationOutputPhase2 {
+  /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+  dhGroups?: TunnelConfigurationOutputPhase2DhGroupsList;
+  encryptionAlgorithms: TunnelConfigurationOutputPhase2EncryptionAlgorithmsList;
+  /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+  integrityAlgorithms: TunnelConfigurationOutputPhase2IntegrityAlgorithmsList;
+  /** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+  dpdAction?: TunnelConfigurationOutputPhase2DpdAction;
+  /** Time to schedule a Child SA re-keying (in seconds). */
+  rekeyTime?: number;
+  /** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+  startAction?: TunnelConfigurationOutputPhase2StartAction;
+}
+export const TunnelConfigurationOutputPhase2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dhGroups: S.optional(TunnelConfigurationOutputPhase2DhGroupsList),
+    encryptionAlgorithms: TunnelConfigurationOutputPhase2EncryptionAlgorithmsList,
+    integrityAlgorithms: TunnelConfigurationOutputPhase2IntegrityAlgorithmsList,
+    dpdAction: S.optional(TunnelConfigurationOutputPhase2DpdAction),
+    rekeyTime: S.optional(S.Number),
+    startAction: S.optional(TunnelConfigurationOutputPhase2StartAction),
+  }),
+).annotate({
+  identifier: "TunnelConfigurationOutputPhase2",
+}) as any as S.Schema<TunnelConfigurationOutputPhase2>;
+
+export interface TunnelConfigurationOutput {
+  bgp?: BGPTunnelConfig;
+  peering?: PeeringConfig;
+  phase1: TunnelConfigurationOutputPhase1;
+  phase2: TunnelConfigurationOutputPhase2;
+  remoteAddress: string;
+}
+export const TunnelConfigurationOutput = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bgp: S.optional(BGPTunnelConfig),
+    peering: S.optional(PeeringConfig),
+    phase1: TunnelConfigurationOutputPhase1,
+    phase2: TunnelConfigurationOutputPhase2,
+    remoteAddress: S.String,
+  }),
+).annotate({
+  identifier: "TunnelConfigurationOutput",
+}) as any as S.Schema<TunnelConfigurationOutput>;
+
+export interface ConnectionResponseOutput {
+  /** A user-friendly name for the connection. */
+  displayName: string;
+  /** This flag decides whether this connection should be enabled or disabled */
+  enabled?: boolean;
+  /** UUID of the Gateway instance. */
+  id?: string;
+  labels?: Label;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  localSubnets?: ConnectionResponseOutputLocalSubnetsList;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  remoteSubnets?: ConnectionResponseOutputRemoteSubnetsList;
+  /** Optional. Use this for route-based VPN. */
+  staticRoutes?: ConnectionResponseOutputStaticRoutesList;
+  tunnel1: TunnelConfigurationOutput;
+  tunnel2: TunnelConfigurationOutput;
+}
+export const ConnectionResponseOutput = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    displayName: S.String,
+    enabled: S.optional(S.Boolean),
+    id: S.optional(S.String),
+    labels: S.optional(Label),
+    localSubnets: S.optional(ConnectionResponseOutputLocalSubnetsList),
+    remoteSubnets: S.optional(ConnectionResponseOutputRemoteSubnetsList),
+    staticRoutes: S.optional(ConnectionResponseOutputStaticRoutesList),
+    tunnel1: TunnelConfigurationOutput,
+    tunnel2: TunnelConfigurationOutput,
+  }),
+).annotate({ identifier: "ConnectionResponseOutput" }) as any as S.Schema<ConnectionResponseOutput>;
+
+/** The region in which the resource is located. */
+export type DeleteGatewayRequestRegion = "eu01" | "eu02";
+export const DeleteGatewayRequestRegion = S.String;
+
+export interface DeleteGatewayRequest {
+  projectId: string;
+  region: DeleteGatewayRequestRegion | (string & {});
+  gatewayId: string;
+}
+export const DeleteGatewayRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: DeleteGatewayRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "DeleteGatewayRequest" }) as any as S.Schema<DeleteGatewayRequest>;
+
+export interface DeleteGatewayResponse {}
+export const DeleteGatewayResponse = /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+  identifier: "DeleteGatewayResponse",
+}) as any as S.Schema<DeleteGatewayResponse>;
+
+/** The region in which the resource is located. */
+export type DeleteGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export const DeleteGatewayBGPFilterRequestRegion = S.String;
+
+export interface DeleteGatewayBGPFilterRequest {
+  projectId: string;
+  region: DeleteGatewayBGPFilterRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+}
+export const DeleteGatewayBGPFilterRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: DeleteGatewayBGPFilterRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteGatewayBGPFilterRequest",
+}) as any as S.Schema<DeleteGatewayBGPFilterRequest>;
+
+export interface DeleteGatewayBGPFilterResponse {}
+export const DeleteGatewayBGPFilterResponse = /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+  identifier: "DeleteGatewayBGPFilterResponse",
+}) as any as S.Schema<DeleteGatewayBGPFilterResponse>;
+
+/** The region in which the resource is located. */
+export type DeleteGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export const DeleteGatewayBGPFilterRuleRequestRegion = S.String;
+
+export interface DeleteGatewayBGPFilterRuleRequest {
+  projectId: string;
+  region: DeleteGatewayBGPFilterRuleRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+  ruleId: string;
+}
+export const DeleteGatewayBGPFilterRuleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: DeleteGatewayBGPFilterRuleRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+    ruleId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}/rules/{ruleId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteGatewayBGPFilterRuleRequest",
+}) as any as S.Schema<DeleteGatewayBGPFilterRuleRequest>;
+
+export interface DeleteGatewayBGPFilterRuleResponse {}
+export const DeleteGatewayBGPFilterRuleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteGatewayBGPFilterRuleResponse",
+}) as any as S.Schema<DeleteGatewayBGPFilterRuleResponse>;
+
+/** The region in which the resource is located. */
+export type DeleteGatewayConnectionRequestRegion = "eu01" | "eu02";
+export const DeleteGatewayConnectionRequestRegion = S.String;
+
+export interface DeleteGatewayConnectionRequest {
+  projectId: string;
+  region: DeleteGatewayConnectionRequestRegion | (string & {});
+  gatewayId: string;
+  connectionId: string;
+}
+export const DeleteGatewayConnectionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: DeleteGatewayConnectionRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    connectionId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections/{connectionId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteGatewayConnectionRequest",
+}) as any as S.Schema<DeleteGatewayConnectionRequest>;
+
+export interface DeleteGatewayConnectionResponse {}
+export const DeleteGatewayConnectionResponse = /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate(
+  { identifier: "DeleteGatewayConnectionResponse" },
+) as any as S.Schema<DeleteGatewayConnectionResponse>;
+
+/** The region in which the resource is located. */
+export type GetGatewayRequestRegion = "eu01" | "eu02";
+export const GetGatewayRequestRegion = S.String;
+
+export interface GetGatewayRequest {
+  projectId: string;
+  region: GetGatewayRequestRegion | (string & {});
+  gatewayId: string;
+}
+export const GetGatewayRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "GetGatewayRequest" }) as any as S.Schema<GetGatewayRequest>;
+
+export type GetGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export const GetGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+
+export interface GetGatewayResponse {
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType;
+  /** The server-generated UUID of the VPN gateway. */
+  id?: string;
+  state?: GatewayStatus;
+}
+export const GetGatewayResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+    id: S.optional(S.String),
+    state: S.optional(GatewayStatus),
+  }),
+).annotate({ identifier: "GetGatewayResponse" }) as any as S.Schema<GetGatewayResponse>;
+
+/** The region in which the resource is located. */
+export type GetGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export const GetGatewayBGPFilterRequestRegion = S.String;
+
+export interface GetGatewayBGPFilterRequest {
+  projectId: string;
+  region: GetGatewayBGPFilterRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+}
+export const GetGatewayBGPFilterRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayBGPFilterRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetGatewayBGPFilterRequest",
+}) as any as S.Schema<GetGatewayBGPFilterRequest>;
+
+/** The region in which the resource is located. */
+export type GetGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export const GetGatewayBGPFilterRuleRequestRegion = S.String;
+
+export interface GetGatewayBGPFilterRuleRequest {
+  projectId: string;
+  region: GetGatewayBGPFilterRuleRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+  ruleId: string;
+}
+export const GetGatewayBGPFilterRuleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayBGPFilterRuleRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+    ruleId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}/rules/{ruleId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetGatewayBGPFilterRuleRequest",
+}) as any as S.Schema<GetGatewayBGPFilterRuleRequest>;
+
+/** The region in which the resource is located. */
+export type GetGatewayConnectionRequestRegion = "eu01" | "eu02";
+export const GetGatewayConnectionRequestRegion = S.String;
+
+export interface GetGatewayConnectionRequest {
+  projectId: string;
+  region: GetGatewayConnectionRequestRegion | (string & {});
+  gatewayId: string;
+  connectionId: string;
+}
+export const GetGatewayConnectionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayConnectionRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    connectionId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections/{connectionId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetGatewayConnectionRequest",
+}) as any as S.Schema<GetGatewayConnectionRequest>;
+
+/** The region in which the resource is located. */
+export type GetGatewayConnectionStatusRequestRegion = "eu01" | "eu02";
+export const GetGatewayConnectionStatusRequestRegion = S.String;
+
+export interface GetGatewayConnectionStatusRequest {
+  projectId: string;
+  region: GetGatewayConnectionStatusRequestRegion | (string & {});
+  gatewayId: string;
+  connectionId: string;
+}
+export const GetGatewayConnectionStatusRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayConnectionStatusRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    connectionId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections/{connectionId}/status",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetGatewayConnectionStatusRequest",
+}) as any as S.Schema<GetGatewayConnectionStatusRequest>;
+
+export type TunnelStatusName = "tunnel1" | "tunnel2";
+export const TunnelStatusName = S.String;
+
+export interface Phase1Status {
+  /** The negotiated Diffie-Hellman Group */
+  dhGroup?: string;
+  /** The negotiated encryption algorithm. */
+  encryptionAlgorithm?: string;
+  /** The negotiated integrity algorithm or pseudo-random-function. */
+  integrityAlgorithm?: string;
+  state?: string;
+}
+export const Phase1Status = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dhGroup: S.optional(S.String),
+    encryptionAlgorithm: S.optional(S.String),
+    integrityAlgorithm: S.optional(S.String),
+    state: S.optional(S.String),
+  }),
+).annotate({ identifier: "Phase1Status" }) as any as S.Schema<Phase1Status>;
+
+export interface Phase2Status {
+  /** The total data volume received through this Security Association, measured in bytes. */
+  bytesIn?: string;
+  /** The total data volume sent through this Security Association, measured in bytes. */
+  bytesOut?: string;
+  /** The negotiated Diffie-Hellman Group */
+  dhGroup?: string;
+  /** Indicates whether NAT traversal encapsulation is active for the connection. */
+  encap?: string;
+  /** The negotiated encryption algorithm. */
+  encryptionAlgorithm?: string;
+  /** The negotiated integrity algorithm or pseudo-random-function. */
+  integrityAlgorithm?: string;
+  /** The total number of packets received through this IPsec Security Association. */
+  packetsIn?: string;
+  /** The total number of packets sent through this IPsec Security Association */
+  packetsOut?: string;
+  /** The security protocol used for the tunnel, typically `ESP` (Encapsulating Security Payload). */
+  protocol?: string;
+  state?: string;
+}
+export const Phase2Status = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bytesIn: S.optional(S.String),
+    bytesOut: S.optional(S.String),
+    dhGroup: S.optional(S.String),
+    encap: S.optional(S.String),
+    encryptionAlgorithm: S.optional(S.String),
+    integrityAlgorithm: S.optional(S.String),
+    packetsIn: S.optional(S.String),
+    packetsOut: S.optional(S.String),
+    protocol: S.optional(S.String),
+    state: S.optional(S.String),
+  }),
+).annotate({ identifier: "Phase2Status" }) as any as S.Schema<Phase2Status>;
+
+/** Describes the status of the VPN itself. */
+export interface TunnelStatus {
+  established?: boolean;
+  name?: TunnelStatusName;
+  phase1?: Phase1Status;
+  phase2?: Phase2Status;
+}
+export const TunnelStatus = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    established: S.optional(S.Boolean),
+    name: S.optional(TunnelStatusName),
+    phase1: S.optional(Phase1Status),
+    phase2: S.optional(Phase2Status),
+  }),
+).annotate({ identifier: "TunnelStatus" }) as any as S.Schema<TunnelStatus>;
+
+export type ConnectionStatusResponseTunnelsList = Array<TunnelStatus>;
+export const ConnectionStatusResponseTunnelsList = /*@__PURE__*/ S.Array(
+  TunnelStatus,
+) as any as S.Schema<ConnectionStatusResponseTunnelsList>;
+
+export interface ConnectionStatusResponse {
+  /** The name of the connection. */
+  displayName?: string;
+  enabled?: boolean;
+  /** UUID of the connection. */
+  id?: string;
+  tunnels?: ConnectionStatusResponseTunnelsList;
+}
+export const ConnectionStatusResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    displayName: S.optional(S.String),
+    enabled: S.optional(S.Boolean),
+    id: S.optional(S.String),
+    tunnels: S.optional(ConnectionStatusResponseTunnelsList),
+  }),
+).annotate({ identifier: "ConnectionStatusResponse" }) as any as S.Schema<ConnectionStatusResponse>;
+
+/** The region in which the resource is located. */
+export type GetGatewayStatusRequestRegion = "eu01" | "eu02";
+export const GetGatewayStatusRequestRegion = S.String;
+
+export interface GetGatewayStatusRequest {
+  projectId: string;
+  region: GetGatewayStatusRequestRegion | (string & {});
+  gatewayId: string;
+}
+export const GetGatewayStatusRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: GetGatewayStatusRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/status",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "GetGatewayStatusRequest" }) as any as S.Schema<GetGatewayStatusRequest>;
+
+export type GatewayStatusResponseConnectionsList = Array<ConnectionStatusResponse>;
+export const GatewayStatusResponseConnectionsList = /*@__PURE__*/ S.Array(
+  ConnectionStatusResponse,
+) as any as S.Schema<GatewayStatusResponseConnectionsList>;
+
+export interface BGPStatusPeers {
+  /** The ASN of the local STACKIT gateway. */
+  localAs: number;
+  /** Duration the session has been established */
+  peerUptime: string;
+  /** Count of prefixes received from the neighbor. */
+  pfxRcd: number;
+  /** Count of prefixes advertised to the neighbor. */
+  pfxSnt: number;
+  /** The ASN of the remote neighbor. */
+  remoteAs: number;
+  /** The IP address of the remote BGP neighbor. */
+  remoteIP: string;
+  /** The current BGP session state. */
+  state: string;
+}
+export const BGPStatusPeers = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    localAs: S.Number,
+    peerUptime: S.String,
+    pfxRcd: S.Number,
+    pfxSnt: S.Number,
+    remoteAs: S.Number,
+    remoteIP: S.String,
+    state: S.String,
+  }),
+).annotate({ identifier: "BGPStatusPeers" }) as any as S.Schema<BGPStatusPeers>;
+
+export type BGPStatusPeersList = Array<BGPStatusPeers>;
+export const BGPStatusPeersList = /*@__PURE__*/ S.Array(
+  BGPStatusPeers,
+) as any as S.Schema<BGPStatusPeersList>;
+
+export interface BGPStatusRoutes {
+  /** The destination network */
+  network: string;
+  origin: string;
+  /** The AS-PATH */
+  path: string;
+  /** BGP Router ID of the neighbor that advertised this route */
+  peerId: string;
+  weight: number;
+}
+export const BGPStatusRoutes = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    network: S.String,
+    origin: S.String,
+    path: S.String,
+    peerId: S.String,
+    weight: S.Number,
+  }),
+).annotate({ identifier: "BGPStatusRoutes" }) as any as S.Schema<BGPStatusRoutes>;
+
+export type BGPStatusRoutesList = Array<BGPStatusRoutes>;
+export const BGPStatusRoutesList = /*@__PURE__*/ S.Array(
+  BGPStatusRoutes,
+) as any as S.Schema<BGPStatusRoutesList>;
+
+export interface BGPStatus {
+  peers?: BGPStatusPeersList;
+  routes?: BGPStatusRoutesList;
+}
+export const BGPStatus = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    peers: S.optional(BGPStatusPeersList),
+    routes: S.optional(BGPStatusRoutesList),
+  }),
+).annotate({ identifier: "BGPStatus" }) as any as S.Schema<BGPStatus>;
+
+export type VPNTunnelsName = "tunnel1" | "tunnel2";
+export const VPNTunnelsName = S.String;
+
+/** Status of the underlying tunnel instances. */
+export interface VPNTunnels {
+  bgpStatus?: BGPStatus | null;
+  instanceState?: GatewayStatus;
+  /** The IPv4 address of the endpoint in the SNA. */
+  internalNextHopIP?: string;
+  name?: VPNTunnelsName;
+  /** The public IPv4 address of this endpoint. */
+  publicIP?: string;
+}
+export const VPNTunnels = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bgpStatus: S.optional(S.NullOr(BGPStatus)),
+    instanceState: S.optional(GatewayStatus),
+    internalNextHopIP: S.optional(S.String),
+    name: S.optional(VPNTunnelsName),
+    publicIP: S.optional(S.String),
+  }),
+).annotate({ identifier: "VPNTunnels" }) as any as S.Schema<VPNTunnels>;
+
+export type GatewayStatusResponseTunnelsList = Array<VPNTunnels>;
+export const GatewayStatusResponseTunnelsList = /*@__PURE__*/ S.Array(
+  VPNTunnels,
+) as any as S.Schema<GatewayStatusResponseTunnelsList>;
+
+export interface GatewayStatusResponse {
+  connections?: GatewayStatusResponseConnectionsList;
+  /** Name of the Gateway instance. */
+  displayName?: string;
+  /** A descriptive message provided when the gateway is in an error state. */
+  errorMessage?: string;
+  gatewayStatus?: GatewayStatus;
+  /** UUID of the Gateway instance. */
+  id?: string;
+  tunnels?: GatewayStatusResponseTunnelsList;
+}
+export const GatewayStatusResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    connections: S.optional(GatewayStatusResponseConnectionsList),
+    displayName: S.optional(S.String),
+    errorMessage: S.optional(S.String),
+    gatewayStatus: S.optional(GatewayStatus),
+    id: S.optional(S.String),
+    tunnels: S.optional(GatewayStatusResponseTunnelsList),
+  }),
+).annotate({ identifier: "GatewayStatusResponse" }) as any as S.Schema<GatewayStatusResponse>;
+
+/** The region in which the resource is located. */
+export type ListGatewayBGPFilterRulesRequestRegion = "eu01" | "eu02";
+export const ListGatewayBGPFilterRulesRequestRegion = S.String;
+
+export interface ListGatewayBGPFilterRulesRequest {
+  projectId: string;
+  region: ListGatewayBGPFilterRulesRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+}
+export const ListGatewayBGPFilterRulesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: ListGatewayBGPFilterRulesRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}/rules",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListGatewayBGPFilterRulesRequest",
+}) as any as S.Schema<ListGatewayBGPFilterRulesRequest>;
+
+export type BGPFilterRuleListRulesList = Array<BGPFilterRule>;
+export const BGPFilterRuleListRulesList = /*@__PURE__*/ S.Array(
+  BGPFilterRule,
+) as any as S.Schema<BGPFilterRuleListRulesList>;
+
+/** Response wrapper for listing rules within a BGP filter. */
+export interface BGPFilterRuleList {
+  rules: BGPFilterRuleListRulesList;
+}
+export const BGPFilterRuleList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    rules: BGPFilterRuleListRulesList,
+  }),
+).annotate({ identifier: "BGPFilterRuleList" }) as any as S.Schema<BGPFilterRuleList>;
+
+/** The region in which the resource is located. */
+export type ListGatewayBGPFiltersRequestRegion = "eu01" | "eu02";
+export const ListGatewayBGPFiltersRequestRegion = S.String;
+
+export interface ListGatewayBGPFiltersRequest {
+  projectId: string;
+  region: ListGatewayBGPFiltersRequestRegion | (string & {});
+  gatewayId: string;
+}
+export const ListGatewayBGPFiltersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: ListGatewayBGPFiltersRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListGatewayBGPFiltersRequest",
+}) as any as S.Schema<ListGatewayBGPFiltersRequest>;
+
+export type BGPFilterListBgpFiltersList = Array<BGPFilter>;
+export const BGPFilterListBgpFiltersList = /*@__PURE__*/ S.Array(
+  BGPFilter,
+) as any as S.Schema<BGPFilterListBgpFiltersList>;
+
+/** Response wrapper for listing BGP filters. */
+export interface BGPFilterList {
+  bgpFilters: BGPFilterListBgpFiltersList;
+}
+export const BGPFilterList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bgpFilters: BGPFilterListBgpFiltersList,
+  }),
+).annotate({ identifier: "BGPFilterList" }) as any as S.Schema<BGPFilterList>;
+
+/** The region in which the resource is located. */
+export type ListGatewayConnectionsRequestRegion = "eu01" | "eu02";
+export const ListGatewayConnectionsRequestRegion = S.String;
+
+/** Filter resources by labels. */
+export type LabelSelector = { [key: string]: string | undefined };
+export const LabelSelector = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<LabelSelector>;
+
+export interface ListGatewayConnectionsRequest {
+  projectId: string;
+  region: ListGatewayConnectionsRequestRegion | (string & {});
+  gatewayId: string;
+  /** Filter resources by labels. */
+  label_selector?: LabelSelector;
+}
+export const ListGatewayConnectionsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: ListGatewayConnectionsRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    label_selector: S.optional(LabelSelector.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListGatewayConnectionsRequest",
+}) as any as S.Schema<ListGatewayConnectionsRequest>;
+
+export type ConnectionListOutputConnectionsList = Array<ConnectionResponseOutput>;
+export const ConnectionListOutputConnectionsList = /*@__PURE__*/ S.Array(
+  ConnectionResponseOutput,
+) as any as S.Schema<ConnectionListOutputConnectionsList>;
+
+export interface ConnectionListOutput {
+  connections: ConnectionListOutputConnectionsList;
+}
+export const ConnectionListOutput = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    connections: ConnectionListOutputConnectionsList,
+  }),
+).annotate({ identifier: "ConnectionListOutput" }) as any as S.Schema<ConnectionListOutput>;
+
+/** The region in which the resource is located. */
+export type ListGatewaysRequestRegion = "eu01" | "eu02";
+export const ListGatewaysRequestRegion = S.String;
+
+export interface ListGatewaysRequest {
+  projectId: string;
+  region: ListGatewaysRequestRegion | (string & {});
+  /** Filter resources by labels. */
+  label_selector?: LabelSelector;
+}
+export const ListGatewaysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: ListGatewaysRequestRegion.pipe(T.Label()),
+    label_selector: S.optional(LabelSelector.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "ListGatewaysRequest" }) as any as S.Schema<ListGatewaysRequest>;
+
+export type GatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export const GatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+
+export interface GatewayResponse {
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType;
+  /** The server-generated UUID of the VPN gateway. */
+  id?: string;
+  state?: GatewayStatus;
+}
+export const GatewayResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+    id: S.optional(S.String),
+    state: S.optional(GatewayStatus),
+  }),
+).annotate({ identifier: "GatewayResponse" }) as any as S.Schema<GatewayResponse>;
+
+export type GatewayListGatewaysList = Array<GatewayResponse>;
+export const GatewayListGatewaysList = /*@__PURE__*/ S.Array(
+  GatewayResponse,
+) as any as S.Schema<GatewayListGatewaysList>;
+
+export interface GatewayList {
+  gateways: GatewayListGatewaysList;
+}
+export const GatewayList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    gateways: GatewayListGatewaysList,
+  }),
+).annotate({ identifier: "GatewayList" }) as any as S.Schema<GatewayList>;
+
+/** The region in which the resource is located. */
+export type ListPlansRequestRegion = "eu01" | "eu02";
+export const ListPlansRequestRegion = S.String;
+
+export interface ListPlansRequest {
+  region: ListPlansRequestRegion | (string & {});
+}
+export const ListPlansRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    region: ListPlansRequestRegion.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/regions/{region}/plans",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "ListPlansRequest" }) as any as S.Schema<ListPlansRequest>;
+
+export interface Plan {
+  /** The maximum throughput supported by the gateway in each direction, measured in MBit/s */
+  maxBandwidth?: number;
+  /** The maximum number of connections supported by the VPN Gateway. */
+  maxConnections?: number;
+  /** The name of the service plan. */
+  name?: string;
+  planId?: string;
+  /** The SKU identifier used for billing. */
+  sku?: string;
+}
+export const Plan = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    maxBandwidth: S.optional(S.Number),
+    maxConnections: S.optional(S.Number),
+    name: S.optional(S.String),
+    planId: S.optional(S.String),
+    sku: S.optional(S.String),
+  }),
+).annotate({ identifier: "Plan" }) as any as S.Schema<Plan>;
+
+export type PlanListPlansList = Array<Plan>;
+export const PlanListPlansList = /*@__PURE__*/ S.Array(Plan) as any as S.Schema<PlanListPlansList>;
+
+export interface PlanList {
+  defaultPlanId?: string;
+  plans?: PlanListPlansList;
+}
+export const PlanList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    defaultPlanId: S.optional(S.String),
+    plans: S.optional(PlanListPlansList),
+  }),
+).annotate({ identifier: "PlanList" }) as any as S.Schema<PlanList>;
+
+/** The region in which the resource is located. */
+export type ListQuotasRequestRegion = "eu01" | "eu02";
+export const ListQuotasRequestRegion = S.String;
+
+export interface ListQuotasRequest {
+  projectId: string;
+  region: ListQuotasRequestRegion | (string & {});
+}
+export const ListQuotasRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: ListQuotasRequestRegion.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/quotas",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "ListQuotasRequest" }) as any as S.Schema<ListQuotasRequest>;
+
+export interface Quota {
+  limit: number;
+  usage: number;
+}
+export const Quota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.Number,
+    usage: S.Number,
+  }),
+).annotate({ identifier: "Quota" }) as any as S.Schema<Quota>;
+
+export interface QuotaList {
+  /** Current limit and usage for VPN gateways. */
+  gateways: Quota;
+}
+export const QuotaList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    gateways: Quota,
+  }),
+).annotate({ identifier: "QuotaList" }) as any as S.Schema<QuotaList>;
+
+export interface QuotaListResponse {
+  quotas: QuotaList;
+}
+export const QuotaListResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    quotas: QuotaList,
+  }),
+).annotate({ identifier: "QuotaListResponse" }) as any as S.Schema<QuotaListResponse>;
+
+/** The region in which the resource is located. */
+export type UpdateGatewayRequestRegion = "eu01" | "eu02";
+export const UpdateGatewayRequestRegion = S.String;
+
+export type UpdateGatewayRequestAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export const UpdateGatewayRequestAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+
+export interface UpdateGatewayRequest {
+  projectId: string;
+  region: UpdateGatewayRequestRegion | (string & {});
+  gatewayId: string;
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType | (string & {});
+}
+export const UpdateGatewayRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: UpdateGatewayRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "UpdateGatewayRequest" }) as any as S.Schema<UpdateGatewayRequest>;
+
+export type UpdateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export const UpdateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+
+export interface UpdateGatewayResponse {
+  availabilityZones: CreateGatewayRequestAvailabilityZones;
+  bgp?: BGPGatewayConfig;
+  /** A user-friendly name for the VPN gateway. */
+  displayName: string;
+  labels?: Label;
+  networkConfig?: NetworkConfig;
+  /** The service plan identifier. */
+  planId: string;
+  routingType: RoutingType;
+  /** The server-generated UUID of the VPN gateway. */
+  id?: string;
+  state?: GatewayStatus;
+}
+export const UpdateGatewayResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    availabilityZones: CreateGatewayRequestAvailabilityZones,
+    bgp: S.optional(BGPGatewayConfig),
+    displayName: S.String,
+    labels: S.optional(Label),
+    networkConfig: S.optional(NetworkConfig),
+    planId: S.String,
+    routingType: RoutingType,
+    id: S.optional(S.String),
+    state: S.optional(GatewayStatus),
+  }),
+).annotate({ identifier: "UpdateGatewayResponse" }) as any as S.Schema<UpdateGatewayResponse>;
+
+/** The region in which the resource is located. */
+export type UpdateGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export const UpdateGatewayBGPFilterRequestRegion = S.String;
+
+export interface UpdateGatewayBGPFilterRequest {
+  projectId: string;
+  region: UpdateGatewayBGPFilterRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+  /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+  displayName: string;
+}
+export const UpdateGatewayBGPFilterRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: UpdateGatewayBGPFilterRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+    displayName: S.String,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateGatewayBGPFilterRequest",
+}) as any as S.Schema<UpdateGatewayBGPFilterRequest>;
+
+/** The region in which the resource is located. */
+export type UpdateGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export const UpdateGatewayBGPFilterRuleRequestRegion = S.String;
+
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type UpdateGatewayBGPFilterRuleRequestAction = "PERMIT" | "DENY";
+export const UpdateGatewayBGPFilterRuleRequestAction = S.String;
+
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = Array<number>;
+export const UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList>;
+
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList = Array<string>;
+export const UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList>;
+
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type UpdateGatewayBGPFilterRuleRequestMatchPrefixesList = Array<string>;
+export const UpdateGatewayBGPFilterRuleRequestMatchPrefixesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateGatewayBGPFilterRuleRequestMatchPrefixesList>;
+
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface UpdateGatewayBGPFilterRuleRequestMatch {
+  /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+  asPathContainsAny?: UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList;
+  /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+  communities?: UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList;
+  /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+  firstASN?: number;
+  /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+  maxPrefixLength?: number;
+  /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+  minPrefixLength?: number;
+  /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+  peer?: string;
+  /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+  prefixes?: UpdateGatewayBGPFilterRuleRequestMatchPrefixesList;
+}
+export const UpdateGatewayBGPFilterRuleRequestMatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    asPathContainsAny: S.optional(UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList),
+    communities: S.optional(UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList),
+    firstASN: S.optional(S.Number),
+    maxPrefixLength: S.optional(S.Number),
+    minPrefixLength: S.optional(S.Number),
+    peer: S.optional(S.String),
+    prefixes: S.optional(UpdateGatewayBGPFilterRuleRequestMatchPrefixesList),
+  }),
+).annotate({
+  identifier: "UpdateGatewayBGPFilterRuleRequestMatch",
+}) as any as S.Schema<UpdateGatewayBGPFilterRuleRequestMatch>;
+
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export type UpdateGatewayBGPFilterRuleRequestSet = CreateGatewayBGPFilterRuleRequestSet;
+export const UpdateGatewayBGPFilterRuleRequestSet = CreateGatewayBGPFilterRuleRequestSet;
+
+export interface UpdateGatewayBGPFilterRuleRequest {
+  projectId: string;
+  region: UpdateGatewayBGPFilterRuleRequestRegion | (string & {});
+  gatewayId: string;
+  filterId: string;
+  ruleId: string;
+  /** The action to take if the route matches all criteria. Case-sensitive. */
+  action: UpdateGatewayBGPFilterRuleRequestAction | (string & {});
+  /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+  match?: UpdateGatewayBGPFilterRuleRequestMatch;
+  /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+  sequence?: number;
+  /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+  set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export const UpdateGatewayBGPFilterRuleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: UpdateGatewayBGPFilterRuleRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    filterId: S.String.pipe(T.Label()),
+    ruleId: S.String.pipe(T.Label()),
+    action: UpdateGatewayBGPFilterRuleRequestAction,
+    match: S.optional(UpdateGatewayBGPFilterRuleRequestMatch),
+    sequence: S.optional(S.Number),
+    set: S.optional(CreateGatewayBGPFilterRuleRequestSet),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/bgp-filters/{filterId}/rules/{ruleId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateGatewayBGPFilterRuleRequest",
+}) as any as S.Schema<UpdateGatewayBGPFilterRuleRequest>;
+
+/** The region in which the resource is located. */
+export type UpdateGatewayConnectionRequestRegion = "eu01" | "eu02";
+export const UpdateGatewayConnectionRequestRegion = S.String;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type UpdateGatewayConnectionRequestLocalSubnetsList = Array<string>;
+export const UpdateGatewayConnectionRequestLocalSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateGatewayConnectionRequestLocalSubnetsList>;
+
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type UpdateGatewayConnectionRequestRemoteSubnetsList = Array<string>;
+export const UpdateGatewayConnectionRequestRemoteSubnetsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateGatewayConnectionRequestRemoteSubnetsList>;
+
+/** Optional. Use this for route-based VPN. */
+export type UpdateGatewayConnectionRequestStaticRoutesList = Array<string>;
+export const UpdateGatewayConnectionRequestStaticRoutesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateGatewayConnectionRequestStaticRoutesList>;
+
+export interface UpdateGatewayConnectionRequest {
+  projectId: string;
+  region: UpdateGatewayConnectionRequestRegion | (string & {});
+  gatewayId: string;
+  connectionId: string;
+  /** A user-friendly name for the connection. */
+  displayName: string;
+  /** This flag decides whether this connection should be enabled or disabled */
+  enabled?: boolean;
+  labels?: Label;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  localSubnets?: UpdateGatewayConnectionRequestLocalSubnetsList;
+  /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+  remoteSubnets?: UpdateGatewayConnectionRequestRemoteSubnetsList;
+  /** Optional. Use this for route-based VPN. */
+  staticRoutes?: UpdateGatewayConnectionRequestStaticRoutesList;
+  tunnel1: TunnelConfiguration;
+  tunnel2: TunnelConfiguration;
+}
+export const UpdateGatewayConnectionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: UpdateGatewayConnectionRequestRegion.pipe(T.Label()),
+    gatewayId: S.String.pipe(T.Label()),
+    connectionId: S.String.pipe(T.Label()),
+    displayName: S.String,
+    enabled: S.optional(S.Boolean),
+    labels: S.optional(Label),
+    localSubnets: S.optional(UpdateGatewayConnectionRequestLocalSubnetsList),
+    remoteSubnets: S.optional(UpdateGatewayConnectionRequestRemoteSubnetsList),
+    staticRoutes: S.optional(UpdateGatewayConnectionRequestStaticRoutesList),
+    tunnel1: TunnelConfiguration,
+    tunnel2: TunnelConfiguration,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/gateways/{gatewayId}/connections/{connectionId}",
+      code: 200,
+      baseUrl: "https://vpn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateGatewayConnectionRequest",
+}) as any as S.Schema<UpdateGatewayConnectionRequest>;
+
+export type CreateGatewayError = BadRequest | Forbidden | Conflict | StackitOpError;
+/** Create a VPN gateway in a project. Provision a new VPN gateway. */
+export const createGateway: API.OperationMethod<
+  CreateGatewayRequest,
+  CreateGatewayResponse,
+  CreateGatewayError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateGatewayRequest,
+  output: CreateGatewayResponse,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateGatewayBGPFilterError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | StackitOpError;
+/** Create a new empty BGP filter. Creates the filter metadata. Rules are managed via the nested /rules sub-resource. NOTE: an empty filter attached to a tunnel denies all incoming routes (implicit DENY). */
+export const createGatewayBGPFilter: API.OperationMethod<
+  CreateGatewayBGPFilterRequest,
+  BGPFilter,
+  CreateGatewayBGPFilterError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateGatewayBGPFilterRequest,
+  output: BGPFilter,
+  errors: [BadRequest, Forbidden, NotFound, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateGatewayBGPFilterRuleError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | StackitOpError;
+/** Add a new rule to a BGP filter. */
+export const createGatewayBGPFilterRule: API.OperationMethod<
+  CreateGatewayBGPFilterRuleRequest,
+  BGPFilterRule,
+  CreateGatewayBGPFilterRuleError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateGatewayBGPFilterRuleRequest,
+  output: BGPFilterRule,
+  errors: [BadRequest, Forbidden, NotFound, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Create a new connection on an existing VPN gateway. Create a new connection on an existing VPN gateway. */
+export const createGatewayConnection: API.OperationMethod<
+  CreateGatewayConnectionRequest,
+  ConnectionResponseOutput,
+  CreateGatewayConnectionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateGatewayConnectionRequest,
+  output: ConnectionResponseOutput,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteGatewayError = BadRequest | Forbidden | StackitOpError;
+/** Delete a existing VPN gateway in a project. Permanently remove a VPN gateway and all its associated connections. This operation is irreversible. */
+export const deleteGateway: API.OperationMethod<
+  DeleteGatewayRequest,
+  DeleteGatewayResponse,
+  DeleteGatewayError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteGatewayRequest,
+  output: DeleteGatewayResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteGatewayBGPFilterError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | StackitOpError;
+/** Delete a BGP filter. Fails with 409 Conflict if the filter is referenced by any connection's tunnel.bgp.inboundFilterId. The error response body's details[] contains one entry per referencing connection with metadata { connectionId, displayName, tunnel: 'tunnel1'|'tunnel2' } and reason RESOURCE_IN_USE so the caller can detach them first. */
+export const deleteGatewayBGPFilter: API.OperationMethod<
+  DeleteGatewayBGPFilterRequest,
+  DeleteGatewayBGPFilterResponse,
+  DeleteGatewayBGPFilterError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteGatewayBGPFilterRequest,
+  output: DeleteGatewayBGPFilterResponse,
+  errors: [BadRequest, Forbidden, NotFound, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Delete a specific rule. */
+export const deleteGatewayBGPFilterRule: API.OperationMethod<
+  DeleteGatewayBGPFilterRuleRequest,
+  DeleteGatewayBGPFilterRuleResponse,
+  DeleteGatewayBGPFilterRuleError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteGatewayBGPFilterRuleRequest,
+  output: DeleteGatewayBGPFilterRuleResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Delete a certain connection from an existing VPN gateway. Delete a certain connection from an existing VPN gateway. */
+export const deleteGatewayConnection: API.OperationMethod<
+  DeleteGatewayConnectionRequest,
+  DeleteGatewayConnectionResponse,
+  DeleteGatewayConnectionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteGatewayConnectionRequest,
+  output: DeleteGatewayConnectionResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get details of a VPN Gateway in a project. Get details of a VPN Gateway in a project. */
+export const getGateway: API.OperationMethod<
+  GetGatewayRequest,
+  GetGatewayResponse,
+  GetGatewayError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayRequest,
+  output: GetGatewayResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayBGPFilterError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get BGP filter metadata. */
+export const getGatewayBGPFilter: API.OperationMethod<
+  GetGatewayBGPFilterRequest,
+  BGPFilter,
+  GetGatewayBGPFilterError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayBGPFilterRequest,
+  output: BGPFilter,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get a specific rule from a BGP filter. */
+export const getGatewayBGPFilterRule: API.OperationMethod<
+  GetGatewayBGPFilterRuleRequest,
+  BGPFilterRule,
+  GetGatewayBGPFilterRuleError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayBGPFilterRuleRequest,
+  output: BGPFilterRule,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get a certain connection for an existing VPN gateway. Get a certain connection for an existing VPN gateway. */
+export const getGatewayConnection: API.OperationMethod<
+  GetGatewayConnectionRequest,
+  ConnectionResponseOutput,
+  GetGatewayConnectionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayConnectionRequest,
+  output: ConnectionResponseOutput,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayConnectionStatusError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Gets the status for a specific connection. Get the status for a specific connection. */
+export const getGatewayConnectionStatus: API.OperationMethod<
+  GetGatewayConnectionStatusRequest,
+  ConnectionStatusResponse,
+  GetGatewayConnectionStatusError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayConnectionStatusRequest,
+  output: ConnectionStatusResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetGatewayStatusError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get the status of a VPN gateway in a project. Get the status of a VPN gateway in a project. */
+export const getGatewayStatus: API.OperationMethod<
+  GetGatewayStatusRequest,
+  GatewayStatusResponse,
+  GetGatewayStatusError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetGatewayStatusRequest,
+  output: GatewayStatusResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListGatewayBGPFilterRulesError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List all rules inside a specific BGP filter. */
+export const listGatewayBGPFilterRules: API.OperationMethod<
+  ListGatewayBGPFilterRulesRequest,
+  BGPFilterRuleList,
+  ListGatewayBGPFilterRulesError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListGatewayBGPFilterRulesRequest,
+  output: BGPFilterRuleList,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListGatewayBGPFiltersError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List BGP filters for a gateway. */
+export const listGatewayBGPFilters: API.OperationMethod<
+  ListGatewayBGPFiltersRequest,
+  BGPFilterList,
+  ListGatewayBGPFiltersError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListGatewayBGPFiltersRequest,
+  output: BGPFilterList,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListGatewayConnectionsError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List connections for an existing VPN gateway. List connections for an existing VPN gateway. */
+export const listGatewayConnections: API.OperationMethod<
+  ListGatewayConnectionsRequest,
+  ConnectionListOutput,
+  ListGatewayConnectionsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListGatewayConnectionsRequest,
+  output: ConnectionListOutput,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListGatewaysError = BadRequest | Forbidden | StackitOpError;
+/** List VPN gateways in a project with label filtering Retrieve a list of all VPN gateways in a project. Filter the results using the `label_selector` query parameter. */
+export const listGateways: API.OperationMethod<
+  ListGatewaysRequest,
+  GatewayList,
+  ListGatewaysError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListGatewaysRequest,
+  output: GatewayList,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListPlansError = BadRequest | StackitOpError;
+/** List available service plans for a project. Retrieve a list of available service plans available for provisioning a VPN in a specific `region`. Use this to identify the `planId` required for gateway creation. */
+export const listPlans: API.OperationMethod<
+  ListPlansRequest,
+  PlanList,
+  ListPlansError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListPlansRequest,
+  output: PlanList,
+  errors: [BadRequest, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListQuotasError = BadRequest | StackitOpError;
+/** List project quotas. Retrieve the resource quotas and current usage for STACKIT VPN within a specific project and region. */
+export const listQuotas: API.OperationMethod<
+  ListQuotasRequest,
+  QuotaListResponse,
+  ListQuotasError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListQuotasRequest,
+  output: QuotaListResponse,
+  errors: [BadRequest, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateGatewayError = BadRequest | Forbidden | Conflict | StackitOpError;
+/** Update a VPN gateway in a project. Modify the configuration of an existing VPN gateway. Certain changes may trigger infrastructure updates or temporary connection re-negotiations. */
+export const updateGateway: API.OperationMethod<
+  UpdateGatewayRequest,
+  UpdateGatewayResponse,
+  UpdateGatewayError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateGatewayRequest,
+  output: UpdateGatewayResponse,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateGatewayBGPFilterError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | StackitOpError;
+/** Update BGP filter metadata (name, description). Rules are managed via the nested /rules sub-resource and are not modified by this endpoint. */
+export const updateGatewayBGPFilter: API.OperationMethod<
+  UpdateGatewayBGPFilterRequest,
+  BGPFilter,
+  UpdateGatewayBGPFilterError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateGatewayBGPFilterRequest,
+  output: BGPFilter,
+  errors: [BadRequest, Forbidden, NotFound, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateGatewayBGPFilterRuleError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | StackitOpError;
+/** Update a specific rule. */
+export const updateGatewayBGPFilterRule: API.OperationMethod<
+  UpdateGatewayBGPFilterRuleRequest,
+  BGPFilterRule,
+  UpdateGatewayBGPFilterRuleError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateGatewayBGPFilterRuleRequest,
+  output: BGPFilterRule,
+  errors: [BadRequest, Forbidden, NotFound, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Update a connection on an existing VPN gateway. Updating the configuration of an existing connection. */
+export const updateGatewayConnection: API.OperationMethod<
+  UpdateGatewayConnectionRequest,
+  ConnectionResponseOutput,
+  UpdateGatewayConnectionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateGatewayConnectionRequest,
+  output: ConnectionResponseOutput,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));