@pulumi/databricks 1.99.0-alpha.1783234126 → 1.99.0

package/types/output.d.ts

@@ -155,8 +155,8 @@ export interface AccountNetworkPolicyEgressNetworkAccessPolicyEnforcement {
 export interface AccountNetworkPolicyIngress {
     crossWorkspaceAccess?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccess;
     /**
-     * The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.AccountNetworkPolicyIngressPrivateAccess;
     /**
@@ -194,12 +194,19 @@ export interface AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleAuthent
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAppsRuntime;
@@ -267,12 +274,19 @@ export interface AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleAuthenti
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAppsRuntime;
@@ -319,8 +333,8 @@ export interface AccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleOriginSe
 export interface AccountNetworkPolicyIngressDryRun {
     crossWorkspaceAccess?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccess;
     /**
-     * The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccess;
     /**
@@ -358,12 +372,19 @@ export interface AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleA
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAppsRuntime;
@@ -431,12 +452,19 @@ export interface AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleAu
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAppsRuntime;
@@ -509,12 +537,19 @@ export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthenti
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime;
@@ -546,12 +581,33 @@ export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinat
     allDestinations?: boolean;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin {
+    /**
+     * Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     allPrivateAccess?: boolean;
+    /**
+     * Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
+     */
     allRegisteredEndpoints?: boolean;
+    /**
+     * Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     azureWorkspacePrivateLink?: boolean;
+    /**
+     * Matches requests arriving through any of the specified registered endpoints
+     */
     endpoints?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
+    /**
+     * The IDs of the registered endpoints. Must contain at least one endpoint ID
+     */
     endpointIds?: string[];
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRule {
@@ -578,12 +634,19 @@ export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthentic
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime;
@@ -615,12 +678,33 @@ export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinati
     allDestinations?: boolean;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin {
+    /**
+     * Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     allPrivateAccess?: boolean;
+    /**
+     * Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
+     */
     allRegisteredEndpoints?: boolean;
+    /**
+     * Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     azureWorkspacePrivateLink?: boolean;
+    /**
+     * Matches requests arriving through any of the specified registered endpoints
+     */
     endpoints?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * The IDs of the registered endpoints. Must contain at least one endpoint ID
+     */
     endpointIds?: string[];
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccess {
@@ -652,12 +736,19 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentic
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime;
@@ -738,12 +829,19 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentica
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime;
@@ -829,12 +927,19 @@ export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleAuthentication
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAppsRuntime;
@@ -866,12 +971,33 @@ export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWor
     allDestinations?: boolean;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin {
+    /**
+     * Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     allPrivateAccess?: boolean;
+    /**
+     * Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
+     */
     allRegisteredEndpoints?: boolean;
+    /**
+     * Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     azureWorkspacePrivateLink?: boolean;
+    /**
+     * Matches requests arriving through any of the specified registered endpoints
+     */
     endpoints?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints {
+    /**
+     * The IDs of the registered endpoints. Must contain at least one endpoint ID
+     */
     endpointIds?: string[];
 }
 export interface AccountNetworkPolicyIngressPrivateAccessDenyRule {
@@ -898,12 +1024,19 @@ export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticationI
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAppsRuntime;
@@ -935,12 +1068,33 @@ export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWork
     allDestinations?: boolean;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin {
+    /**
+     * Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     allPrivateAccess?: boolean;
+    /**
+     * Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
+     */
     allRegisteredEndpoints?: boolean;
+    /**
+     * Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
+     */
     azureWorkspacePrivateLink?: boolean;
+    /**
+     * Matches requests arriving through any of the specified registered endpoints
+     */
     endpoints?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * The IDs of the registered endpoints. Must contain at least one endpoint ID
+     */
     endpointIds?: string[];
 }
 export interface AccountNetworkPolicyIngressPublicAccess {
@@ -972,12 +1126,19 @@ export interface AccountNetworkPolicyIngressPublicAccessAllowRuleAuthenticationI
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAppsRuntime;
@@ -1058,12 +1219,19 @@ export interface AccountNetworkPolicyIngressPublicAccessDenyRuleAuthenticationId
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestination {
+    /**
+     * Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
+     */
     accountApi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
+     */
     accountUi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
     appsRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAppsRuntime;
@@ -3021,6 +3189,12 @@ export interface DataClassificationCatalogConfigAutoTagConfig {
      */
     classificationTag: string;
 }
+export interface DataClassificationCatalogConfigExcludedSchemas {
+    /**
+     * Schema names, each relative to the parent catalog. Must not be empty
+     */
+    names: string[];
+}
 export interface DataClassificationCatalogConfigIncludedSchemas {
     /**
      * Schema names, each relative to the parent catalog. Must not be empty
@@ -3566,7 +3740,7 @@ export interface DatabaseSyncedDatabaseTableSpecTypeOverride {
     pgType: string;
     /**
      * Size parameter for the target type. Required when pgType is PG_SPECIFIC_TYPE_VECTOR
-     * (specifies the vector dimension, e.g., 1024)
+     * or PG_SPECIFIC_TYPE_HALFVEC (specifies the vector dimension, e.g., 1024)
      */
     size?: number;
 }
@@ -3978,7 +4152,11 @@ export interface FeatureEngineeringFeatureFunctionAggregationFunction {
     avg?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionAvg;
     countFunction?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionCountFunction;
     first?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionFirst;
+    firstDistinct?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionFirstDistinct;
+    firstN?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionFirstN;
     last?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionLast;
+    lastDistinct?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionLastDistinct;
+    lastN?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionLastN;
     max?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionMax;
     min?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionMin;
     stddevPop?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionStddevPop;
@@ -4019,9 +4197,25 @@ export interface FeatureEngineeringFeatureFunctionAggregationFunctionCountFuncti
 export interface FeatureEngineeringFeatureFunctionAggregationFunctionFirst {
     input: string;
 }
+export interface FeatureEngineeringFeatureFunctionAggregationFunctionFirstDistinct {
+    input: string;
+    n: number;
+}
+export interface FeatureEngineeringFeatureFunctionAggregationFunctionFirstN {
+    input: string;
+    n: number;
+}
 export interface FeatureEngineeringFeatureFunctionAggregationFunctionLast {
     input: string;
 }
+export interface FeatureEngineeringFeatureFunctionAggregationFunctionLastDistinct {
+    input: string;
+    n: number;
+}
+export interface FeatureEngineeringFeatureFunctionAggregationFunctionLastN {
+    input: string;
+    n: number;
+}
 export interface FeatureEngineeringFeatureFunctionAggregationFunctionMax {
     input: string;
 }
@@ -4039,6 +4233,10 @@ export interface FeatureEngineeringFeatureFunctionAggregationFunctionSum {
 }
 export interface FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindow {
     continuous?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous;
+    /**
+     * A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowLongRolling;
     rolling?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowRolling;
     sliding?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowSliding;
     tumbling?: outputs.FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowTumbling;
@@ -4050,11 +4248,11 @@ export interface FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowC
     offset?: string;
     windowDuration: string;
 }
+export interface FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowLongRolling {
+    delay?: string;
+    windowDuration: string;
+}
 export interface FeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowRolling {
-    /**
-     * The delay applied to the end of the rolling window (must be non-negative).
-     * For example, delay=1d shifts the window end 1 day before the evaluation time
-     */
     delay?: string;
     windowDuration: string;
 }
@@ -4240,6 +4438,10 @@ export interface FeatureEngineeringFeatureSourceStreamSource {
 }
 export interface FeatureEngineeringFeatureTimeWindow {
     continuous?: outputs.FeatureEngineeringFeatureTimeWindowContinuous;
+    /**
+     * A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.FeatureEngineeringFeatureTimeWindowLongRolling;
     rolling?: outputs.FeatureEngineeringFeatureTimeWindowRolling;
     sliding?: outputs.FeatureEngineeringFeatureTimeWindowSliding;
     tumbling?: outputs.FeatureEngineeringFeatureTimeWindowTumbling;
@@ -4251,11 +4453,11 @@ export interface FeatureEngineeringFeatureTimeWindowContinuous {
     offset?: string;
     windowDuration: string;
 }
+export interface FeatureEngineeringFeatureTimeWindowLongRolling {
+    delay?: string;
+    windowDuration: string;
+}
 export interface FeatureEngineeringFeatureTimeWindowRolling {
-    /**
-     * The delay applied to the end of the rolling window (must be non-negative).
-     * For example, delay=1d shifts the window end 1 day before the evaluation time
-     */
     delay?: string;
     windowDuration: string;
 }
@@ -4473,10 +4675,32 @@ export interface FeatureEngineeringKafkaConfigIngestionConfigIngestionDestinatio
     deltaTableName?: string;
 }
 export interface FeatureEngineeringKafkaConfigKeySchema {
+    /**
+     * Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.FeatureEngineeringKafkaConfigKeySchemaProtoSchema;
+}
+export interface FeatureEngineeringKafkaConfigKeySchemaProtoSchema {
+    /**
+     * The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface FeatureEngineeringKafkaConfigProviderConfig {
     /**
@@ -4500,10 +4724,32 @@ export interface FeatureEngineeringKafkaConfigSubscriptionMode {
     subscribePattern?: string;
 }
 export interface FeatureEngineeringKafkaConfigValueSchema {
+    /**
+     * Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.FeatureEngineeringKafkaConfigValueSchemaProtoSchema;
+}
+export interface FeatureEngineeringKafkaConfigValueSchemaProtoSchema {
+    /**
+     * The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface FeatureEngineeringMaterializedFeatureCronScheduleTrigger {
     /**
@@ -4532,6 +4778,11 @@ export interface FeatureEngineeringMaterializedFeatureProviderConfig {
     workspaceId: string;
 }
 export interface FeatureEngineeringMaterializedFeatureStreamingMode {
+    /**
+     * The desired data freshness for feature materialization, expressed as a
+     * duration string (e.g. "1 minute")
+     */
+    freshnessTarget?: string;
     /**
      * The type of streaming mode used by the materialization pipeline. Possible values are: `STREAMING_MODE_TYPE_MBM`, `STREAMING_MODE_TYPE_RTM`
      */
@@ -4794,8 +5045,8 @@ export interface GetAccountNetworkPoliciesItemIngress {
      */
     crossWorkspaceAccess?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccess;
     /**
-     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccess;
     /**
@@ -4858,16 +5109,17 @@ export interface GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessAllowRu
 }
 export interface GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     /**
@@ -4997,16 +5249,17 @@ export interface GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessDenyRul
 }
 export interface GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     /**
@@ -5102,8 +5355,8 @@ export interface GetAccountNetworkPoliciesItemIngressDryRun {
      */
     crossWorkspaceAccess?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccess;
     /**
-     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccess;
     /**
@@ -5166,16 +5419,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessA
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     /**
@@ -5305,16 +5559,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessD
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     /**
@@ -5458,16 +5713,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRul
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
     /**
@@ -5543,25 +5799,31 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRul
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -5605,16 +5867,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRule
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
     /**
@@ -5690,25 +5953,31 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRule
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -5766,16 +6035,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
     /**
@@ -5915,16 +6185,17 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleA
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
     /**
@@ -6078,16 +6349,17 @@ export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleAuthe
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountUi;
     /**
@@ -6163,25 +6435,31 @@ export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDesti
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -6225,16 +6503,17 @@ export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleAuthen
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountUi;
     /**
@@ -6310,25 +6589,31 @@ export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestin
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -6386,16 +6671,17 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthen
 }
 export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountUi;
     /**
@@ -6535,16 +6821,17 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthent
 }
 export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountUi;
     /**
@@ -6746,8 +7033,8 @@ export interface GetAccountNetworkPolicyIngress {
      */
     crossWorkspaceAccess?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccess;
     /**
-     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.GetAccountNetworkPolicyIngressPrivateAccess;
     /**
@@ -6810,16 +7097,17 @@ export interface GetAccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleAuth
 }
 export interface GetAccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     /**
@@ -6949,16 +7237,17 @@ export interface GetAccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleAuthe
 }
 export interface GetAccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     /**
@@ -7054,8 +7343,8 @@ export interface GetAccountNetworkPolicyIngressDryRun {
      */
     crossWorkspaceAccess?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccess;
     /**
-     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access.
+     * Configures how requests arriving over private connectivity are governed
      */
     privateAccess?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccess;
     /**
@@ -7118,16 +7407,17 @@ export interface GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRu
 }
 export interface GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessAllowRuleDestinationAccountUi;
     /**
@@ -7257,16 +7547,17 @@ export interface GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRul
 }
 export interface GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunCrossWorkspaceAccessDenyRuleDestinationAccountUi;
     /**
@@ -7410,16 +7701,17 @@ export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthe
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
     /**
@@ -7495,25 +7787,31 @@ export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDesti
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -7557,16 +7855,17 @@ export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthen
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
     /**
@@ -7642,25 +7941,31 @@ export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestin
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -7718,16 +8023,17 @@ export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthen
 }
 export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
     /**
@@ -7867,16 +8173,17 @@ export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthent
 }
 export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
     /**
@@ -8030,16 +8337,17 @@ export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleAuthenticat
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi;
     /**
@@ -8115,25 +8423,31 @@ export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestination
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -8177,16 +8491,17 @@ export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticati
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi;
     /**
@@ -8262,25 +8577,31 @@ export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationW
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin {
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving over any private connectivity, including registered
+     * endpoints and the workspace's Azure Private Link (ui-api) endpoints.
+     * Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     allPrivateAccess?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through any endpoint registered to the account.
+     * Must be set to true when specified
      */
     allRegisteredEndpoints?: boolean;
     /**
-     * (boolean)
+     * (boolean) - Matches requests arriving through the workspace's Azure Private Link (ui-api)
+     * endpoints. Can only be used in deny rules of workspace-level network policies.
+     * Must be set to true when specified
      */
     azureWorkspacePrivateLink?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     * (CustomerFacingIngressNetworkPolicyEndpoints) - Matches requests arriving through any of the specified registered endpoints
      */
     endpoints?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints;
 }
 export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints {
     /**
-     * (list of string)
+     * (list of string) - The IDs of the registered endpoints. Must contain at least one endpoint ID
      */
     endpointIds?: string[];
 }
@@ -8338,16 +8659,17 @@ export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleAuthenticati
 }
 export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi;
     /**
@@ -8487,16 +8809,17 @@ export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleAuthenticatio
 }
 export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination) - Matches requests to account-level APIs.
+     * Can only be used in the account-level network policy
      */
     accountApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination) - Account DatabricksOne destination is not supported
      */
     accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
     /**
-     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination) - Matches requests to the account console UI.
+     * Can only be used in the account-level network policy
      */
     accountUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi;
     /**
@@ -12469,6 +12792,12 @@ export interface GetDataClassificationCatalogConfigAutoTagConfig {
      */
     classificationTag: string;
 }
+export interface GetDataClassificationCatalogConfigExcludedSchemas {
+    /**
+     * (list of string) - Schema names, each relative to the parent catalog. Must not be empty
+     */
+    names: string[];
+}
 export interface GetDataClassificationCatalogConfigIncludedSchemas {
     /**
      * (list of string) - Schema names, each relative to the parent catalog. Must not be empty
@@ -13601,7 +13930,7 @@ export interface GetDatabaseSyncedDatabaseTableSpecTypeOverride {
     pgType: string;
     /**
      * (integer) - Size parameter for the target type. Required when pgType is PG_SPECIFIC_TYPE_VECTOR
-     * (specifies the vector dimension, e.g., 1024)
+     * or PG_SPECIFIC_TYPE_HALFVEC (specifies the vector dimension, e.g., 1024)
      */
     size?: number;
 }
@@ -13926,7 +14255,7 @@ export interface GetDatabaseSyncedDatabaseTablesSyncedTableSpecTypeOverride {
     pgType: string;
     /**
      * (integer) - Size parameter for the target type. Required when pgType is PG_SPECIFIC_TYPE_VECTOR
-     * (specifies the vector dimension, e.g., 1024)
+     * or PG_SPECIFIC_TYPE_HALFVEC (specifies the vector dimension, e.g., 1024)
      */
     size?: number;
 }
@@ -14693,10 +15022,26 @@ export interface GetFeatureEngineeringFeatureFunctionAggregationFunction {
      * (FirstFunction)
      */
     first?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionFirst;
+    /**
+     * (FirstDistinctFunction)
+     */
+    firstDistinct?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionFirstDistinct;
+    /**
+     * (FirstNFunction)
+     */
+    firstN?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionFirstN;
     /**
      * (LastFunction)
      */
     last?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionLast;
+    /**
+     * (LastDistinctFunction)
+     */
+    lastDistinct?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionLastDistinct;
+    /**
+     * (LastNFunction)
+     */
+    lastN?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionLastN;
     /**
      * (MaxFunction)
      */
@@ -14772,12 +15117,52 @@ export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionFirst {
      */
     input: string;
 }
+export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionFirstDistinct {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
+export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionFirstN {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
 export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionLast {
     /**
      * (string) - The input column from which the sample variance is computed
      */
     input: string;
 }
+export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionLastDistinct {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
+export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionLastN {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
 export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionMax {
     /**
      * (string) - The input column from which the sample variance is computed
@@ -14813,6 +15198,10 @@ export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWind
      * (ContinuousWindow, deprecated)
      */
     continuous?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous;
+    /**
+     * (LongRollingWindow) - A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowLongRolling;
     /**
      * (RollingWindow)
      */
@@ -14836,6 +15225,17 @@ export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWind
      */
     windowDuration: string;
 }
+export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowLongRolling {
+    /**
+     * (string) - The delay applied to the end of the rolling window (must be non-negative).
+     * For example, delay=1d shifts the window end 1 day before the evaluation time
+     */
+    delay?: string;
+    /**
+     * (string) - The duration of each tumbling window (non-overlapping, fixed-duration windows)
+     */
+    windowDuration: string;
+}
 export interface GetFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowRolling {
     /**
      * (string) - The delay applied to the end of the rolling window (must be non-negative).
@@ -15052,6 +15452,10 @@ export interface GetFeatureEngineeringFeatureTimeWindow {
      * (ContinuousWindow, deprecated)
      */
     continuous?: outputs.GetFeatureEngineeringFeatureTimeWindowContinuous;
+    /**
+     * (LongRollingWindow) - A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.GetFeatureEngineeringFeatureTimeWindowLongRolling;
     /**
      * (RollingWindow)
      */
@@ -15075,6 +15479,17 @@ export interface GetFeatureEngineeringFeatureTimeWindowContinuous {
      */
     windowDuration: string;
 }
+export interface GetFeatureEngineeringFeatureTimeWindowLongRolling {
+    /**
+     * (string) - The delay applied to the end of the rolling window (must be non-negative).
+     * For example, delay=1d shifts the window end 1 day before the evaluation time
+     */
+    delay?: string;
+    /**
+     * (string) - The duration of each tumbling window (non-overlapping, fixed-duration windows)
+     */
+    windowDuration: string;
+}
 export interface GetFeatureEngineeringFeatureTimeWindowRolling {
     /**
      * (string) - The delay applied to the end of the rolling window (must be non-negative).
@@ -15242,10 +15657,26 @@ export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunction
      * (FirstFunction)
      */
     first?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionFirst;
+    /**
+     * (FirstDistinctFunction)
+     */
+    firstDistinct?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionFirstDistinct;
+    /**
+     * (FirstNFunction)
+     */
+    firstN?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionFirstN;
     /**
      * (LastFunction)
      */
     last?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLast;
+    /**
+     * (LastDistinctFunction)
+     */
+    lastDistinct?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLastDistinct;
+    /**
+     * (LastNFunction)
+     */
+    lastN?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLastN;
     /**
      * (MaxFunction)
      */
@@ -15321,12 +15752,52 @@ export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunction
      */
     input: string;
 }
+export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionFirstDistinct {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
+export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionFirstN {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
 export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLast {
     /**
      * (string) - The input column from which the sample variance is computed
      */
     input: string;
 }
+export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLastDistinct {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
+export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionLastN {
+    /**
+     * (string) - The input column from which the sample variance is computed
+     */
+    input: string;
+    /**
+     * (integer) - The number of values to return
+     */
+    n: number;
+}
 export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionMax {
     /**
      * (string) - The input column from which the sample variance is computed
@@ -15362,6 +15833,10 @@ export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunction
      * (ContinuousWindow, deprecated)
      */
     continuous?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionTimeWindowContinuous;
+    /**
+     * (LongRollingWindow) - A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionTimeWindowLongRolling;
     /**
      * (RollingWindow)
      */
@@ -15385,6 +15860,17 @@ export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunction
      */
     windowDuration: string;
 }
+export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionTimeWindowLongRolling {
+    /**
+     * (string) - The delay applied to the end of the rolling window (must be non-negative).
+     * For example, delay=1d shifts the window end 1 day before the evaluation time
+     */
+    delay?: string;
+    /**
+     * (string) - The duration of each tumbling window (non-overlapping, fixed-duration windows)
+     */
+    windowDuration: string;
+}
 export interface GetFeatureEngineeringFeaturesFeatureFunctionAggregationFunctionTimeWindowRolling {
     /**
      * (string) - The delay applied to the end of the rolling window (must be non-negative).
@@ -15597,6 +16083,10 @@ export interface GetFeatureEngineeringFeaturesFeatureTimeWindow {
      * (ContinuousWindow, deprecated)
      */
     continuous?: outputs.GetFeatureEngineeringFeaturesFeatureTimeWindowContinuous;
+    /**
+     * (LongRollingWindow) - A long (multi-day) rolling window served via the hybrid batch + streaming path
+     */
+    longRolling?: outputs.GetFeatureEngineeringFeaturesFeatureTimeWindowLongRolling;
     /**
      * (RollingWindow)
      */
@@ -15620,6 +16110,17 @@ export interface GetFeatureEngineeringFeaturesFeatureTimeWindowContinuous {
      */
     windowDuration: string;
 }
+export interface GetFeatureEngineeringFeaturesFeatureTimeWindowLongRolling {
+    /**
+     * (string) - The delay applied to the end of the rolling window (must be non-negative).
+     * For example, delay=1d shifts the window end 1 day before the evaluation time
+     */
+    delay?: string;
+    /**
+     * (string) - The duration of each tumbling window (non-overlapping, fixed-duration windows)
+     */
+    windowDuration: string;
+}
 export interface GetFeatureEngineeringFeaturesFeatureTimeWindowRolling {
     /**
      * (string) - The delay applied to the end of the rolling window (must be non-negative).
@@ -15868,10 +16369,32 @@ export interface GetFeatureEngineeringKafkaConfigIngestionConfigIngestionDestina
     deltaTableName?: string;
 }
 export interface GetFeatureEngineeringKafkaConfigKeySchema {
+    /**
+     * (string) - Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * (string) - Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * (ProtoSchemaSpec) - Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.GetFeatureEngineeringKafkaConfigKeySchemaProtoSchema;
+}
+export interface GetFeatureEngineeringKafkaConfigKeySchemaProtoSchema {
+    /**
+     * (string) - The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * (string) - The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface GetFeatureEngineeringKafkaConfigProviderConfig {
     /**
@@ -15895,10 +16418,32 @@ export interface GetFeatureEngineeringKafkaConfigSubscriptionMode {
     subscribePattern?: string;
 }
 export interface GetFeatureEngineeringKafkaConfigValueSchema {
+    /**
+     * (string) - Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * (string) - Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * (ProtoSchemaSpec) - Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.GetFeatureEngineeringKafkaConfigValueSchemaProtoSchema;
+}
+export interface GetFeatureEngineeringKafkaConfigValueSchemaProtoSchema {
+    /**
+     * (string) - The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * (string) - The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface GetFeatureEngineeringKafkaConfigsKafkaConfig {
     /**
@@ -16152,10 +16697,32 @@ export interface GetFeatureEngineeringKafkaConfigsKafkaConfigIngestionConfigInge
     deltaTableName?: string;
 }
 export interface GetFeatureEngineeringKafkaConfigsKafkaConfigKeySchema {
+    /**
+     * (string) - Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * (string) - Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * (ProtoSchemaSpec) - Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.GetFeatureEngineeringKafkaConfigsKafkaConfigKeySchemaProtoSchema;
+}
+export interface GetFeatureEngineeringKafkaConfigsKafkaConfigKeySchemaProtoSchema {
+    /**
+     * (string) - The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * (string) - The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface GetFeatureEngineeringKafkaConfigsKafkaConfigProviderConfig {
     /**
@@ -16179,10 +16746,32 @@ export interface GetFeatureEngineeringKafkaConfigsKafkaConfigSubscriptionMode {
     subscribePattern?: string;
 }
 export interface GetFeatureEngineeringKafkaConfigsKafkaConfigValueSchema {
+    /**
+     * (string) - Avro schema in JSON format (https://avro.apache.org/docs/current/specification/)
+     */
+    avroSchema?: string;
     /**
      * (string) - Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/)
      */
     jsonSchema?: string;
+    /**
+     * (ProtoSchemaSpec) - Protocol Buffer schema with its payload message name
+     */
+    protoSchema?: outputs.GetFeatureEngineeringKafkaConfigsKafkaConfigValueSchemaProtoSchema;
+}
+export interface GetFeatureEngineeringKafkaConfigsKafkaConfigValueSchemaProtoSchema {
+    /**
+     * (string) - The fully-qualified name of the message within schemaText that describes the Kafka payload
+     * (e.g. "Event" or "com.example.Event" if schemaText declares a package). Identifies which
+     * message is used to decode each Kafka record — a .proto file may declare multiple messages
+     * but only one represents the payload. Must not be empty
+     */
+    messageName: string;
+    /**
+     * (string) - The raw .proto file text (proto2 and proto3 syntax supported, see
+     * https://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/)
+     */
+    schemaText: string;
 }
 export interface GetFeatureEngineeringKafkaConfigsProviderConfig {
     /**
@@ -16241,6 +16830,11 @@ export interface GetFeatureEngineeringMaterializedFeatureProviderConfig {
     workspaceId: string;
 }
 export interface GetFeatureEngineeringMaterializedFeatureStreamingMode {
+    /**
+     * (string) - The desired data freshness for feature materialization, expressed as a
+     * duration string (e.g. "1 minute")
+     */
+    freshnessTarget?: string;
     /**
      * (string) - The type of streaming mode used by the materialization pipeline. Possible values are: `STREAMING_MODE_TYPE_MBM`, `STREAMING_MODE_TYPE_RTM`
      */
@@ -16358,6 +16952,11 @@ export interface GetFeatureEngineeringMaterializedFeaturesMaterializedFeaturePro
     workspaceId: string;
 }
 export interface GetFeatureEngineeringMaterializedFeaturesMaterializedFeatureStreamingMode {
+    /**
+     * (string) - The desired data freshness for feature materialization, expressed as a
+     * duration string (e.g. "1 minute")
+     */
+    freshnessTarget?: string;
     /**
      * (string) - The type of streaming mode used by the materialization pipeline. Possible values are: `STREAMING_MODE_TYPE_MBM`, `STREAMING_MODE_TYPE_RTM`
      */
@@ -19549,6 +20148,10 @@ export interface GetPostgresEndpointStatus {
      * (EndpointHosts) - Contains host information for connecting to the endpoint
      */
     hosts: outputs.GetPostgresEndpointStatusHosts;
+    /**
+     * (string) - A timestamp indicating when the compute endpoint was last active
+     */
+    lastActiveTime: string;
     /**
      * (string) - Possible values are: `ACTIVE`, `DEGRADED`, `IDLE`, `INIT`
      */
@@ -19592,6 +20195,15 @@ export interface GetPostgresEndpointStatusHosts {
      * if the enclosing endpoint is a group with greater than 1 computes configured, and has readable secondaries enabled
      */
     readOnlyHost: string;
+    /**
+     * (string) - The read-only hostname of the compute endpoint, with pooling. This attribute is always defined for read-only endpoints,
+     * and may be defined for read-write endpoints if configured with read replicas and allow read-only connections
+     */
+    readOnlyPooledHost: string;
+    /**
+     * (string) - The read-write hostname of the compute endpoint, with pooling. This attribute is only defined for read-write endpoints
+     */
+    readWritePooledHost: string;
 }
 export interface GetPostgresEndpointStatusSettings {
     /**
@@ -19750,6 +20362,10 @@ export interface GetPostgresEndpointsEndpointStatus {
      * (EndpointHosts) - Contains host information for connecting to the endpoint
      */
     hosts: outputs.GetPostgresEndpointsEndpointStatusHosts;
+    /**
+     * (string) - A timestamp indicating when the compute endpoint was last active
+     */
+    lastActiveTime: string;
     /**
      * (string) - Possible values are: `ACTIVE`, `DEGRADED`, `IDLE`, `INIT`
      */
@@ -19793,6 +20409,15 @@ export interface GetPostgresEndpointsEndpointStatusHosts {
      * if the enclosing endpoint is a group with greater than 1 computes configured, and has readable secondaries enabled
      */
     readOnlyHost: string;
+    /**
+     * (string) - The read-only hostname of the compute endpoint, with pooling. This attribute is always defined for read-only endpoints,
+     * and may be defined for read-write endpoints if configured with read replicas and allow read-only connections
+     */
+    readOnlyPooledHost: string;
+    /**
+     * (string) - The read-write hostname of the compute endpoint, with pooling. This attribute is only defined for read-write endpoints
+     */
+    readWritePooledHost: string;
 }
 export interface GetPostgresEndpointsEndpointStatusSettings {
     /**
@@ -20604,7 +21229,7 @@ export interface GetPostgresSyncedTableSpecTypeOverride {
     pgType: string;
     /**
      * (integer) - Size parameter for the target type. Required when pgType is PG_SPECIFIC_TYPE_VECTOR
-     * (specifies the vector dimension, e.g., 1024)
+     * or PG_SPECIFIC_TYPE_HALFVEC (specifies the vector dimension, e.g., 1024)
      */
     size?: number;
 }
@@ -21241,11 +21866,6 @@ export interface GetSecretUcsProviderConfig {
     workspaceId: string;
 }
 export interface GetSecretUcsSecret {
-    /**
-     * (boolean) - Indicates whether the principal is limited to retrieving metadata for the associated object
-     * through the **BROWSE** privilege when **include_browse** is enabled in the request
-     */
-    browseOnly: boolean;
     /**
      * The name of the catalog under which to list secrets. Both **catalog_name** and
      * **schema_name** must be specified together
@@ -21279,10 +21899,6 @@ export interface GetSecretUcsSecret {
      * does not trigger any automatic actions or affect the secret's lifecycle
      */
     expireTime: string;
-    /**
-     * (string)
-     */
-    externalSecretId: string;
     /**
      * (string) - The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**
      */
@@ -23926,11 +24542,17 @@ export interface JobSchedule {
      * A [Cron expression using Quartz syntax](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) that describes the schedule for a job. This field is required.
      */
     quartzCronExpression: string;
+    sqlCondition?: outputs.JobScheduleSqlCondition;
     /**
      * A Java timezone ID. The schedule for a job will be resolved with respect to this timezone. See Java TimeZone for details. This field is required.
      */
     timezoneId: string;
 }
+export interface JobScheduleSqlCondition {
+    sqlQueryId: string;
+    triggerMode?: string;
+    warehouseId: string;
+}
 export interface JobSparkJarTask {
     jarUri?: string;
     /**
@@ -26064,6 +26686,7 @@ export interface JobTrigger {
      * configuration block to define a trigger for Periodic Triggers consisting of the following attributes:
      */
     periodic?: outputs.JobTriggerPeriodic;
+    sqlCondition?: outputs.JobTriggerSqlCondition;
     /**
      * configuration block to define a trigger for [Table Updates](https://docs.databricks.com/aws/en/jobs/trigger-table-update) consisting of following attributes:
      */
@@ -26103,6 +26726,11 @@ export interface JobTriggerPeriodic {
      */
     unit: string;
 }
+export interface JobTriggerSqlCondition {
+    sqlQueryId: string;
+    triggerMode?: string;
+    warehouseId: string;
+}
 export interface JobTriggerTableUpdate {
     /**
      * The table(s) condition based on which to trigger a job run.  Possible values are `ANY_UPDATED`, `ALL_UPDATED`.
@@ -27300,7 +27928,7 @@ export interface MwsCustomerManagedKeysGcpKeyInfo {
     kmsKeyId: string;
 }
 export interface MwsNccPrivateEndpointRuleGcpEndpoint {
-    pscEndpointUri?: string;
+    pscEndpointUri: string;
     serviceAttachment?: string;
 }
 export interface MwsNetworkConnectivityConfigEgressConfig {
@@ -27411,11 +28039,11 @@ export interface MwsNetworksGcpNetworkInfo {
      */
     networkProjectId: string;
     /**
-     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.120.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.121.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     podIpRangeName?: string;
     /**
-     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.120.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.121.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     serviceIpRangeName?: string;
     /**
@@ -27476,11 +28104,11 @@ export interface MwsWorkspacesExternalCustomerInfo {
 }
 export interface MwsWorkspacesGcpManagedNetworkConfig {
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.120.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.121.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterPodIpRange?: string;
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.120.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.121.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterServiceIpRange?: string;
     subnetCidr: string;
@@ -28978,6 +29606,10 @@ export interface PostgresEndpointStatus {
      * (EndpointHosts) - Contains host information for connecting to the endpoint
      */
     hosts: outputs.PostgresEndpointStatusHosts;
+    /**
+     * (string) - A timestamp indicating when the compute endpoint was last active
+     */
+    lastActiveTime: string;
     /**
      * (string) - Possible values are: `ACTIVE`, `DEGRADED`, `IDLE`, `INIT`
      */
@@ -29012,6 +29644,15 @@ export interface PostgresEndpointStatusHosts {
      * if the enclosing endpoint is a group with greater than 1 computes configured, and has readable secondaries enabled
      */
     readOnlyHost: string;
+    /**
+     * (string) - The read-only hostname of the compute endpoint, with pooling. This attribute is always defined for read-only endpoints,
+     * and may be defined for read-write endpoints if configured with read replicas and allow read-only connections
+     */
+    readOnlyPooledHost: string;
+    /**
+     * (string) - The read-write hostname of the compute endpoint, with pooling. This attribute is only defined for read-write endpoints
+     */
+    readWritePooledHost: string;
 }
 export interface PostgresEndpointStatusSettings {
     /**
@@ -29331,7 +29972,7 @@ export interface PostgresSyncedTableSpecTypeOverride {
     pgType: string;
     /**
      * Size parameter for the target type. Required when pgType is PG_SPECIFIC_TYPE_VECTOR
-     * (specifies the vector dimension, e.g., 1024)
+     * or PG_SPECIFIC_TYPE_HALFVEC (specifies the vector dimension, e.g., 1024)
      */
     size?: number;
 }