Add credential expiry (TTL) support with fail-closed proxy enforcement (#855)

Synced from sferarc/pgbeam@728a7a5

Author: SferaDev

src/generated/types/AgentCredential.ts

@@ -82,6 +82,11 @@ export type AgentCredential = {
      * @type string
     */
     last_used_at?: string | null;
+    /**
+     * @description When the credential expires and becomes unusable. Null means it never expires. Enforcement is fail-closed in the proxy the instant this time passes, before any cleanup sweep runs.
+     * @type string
+    */
+    expires_at?: string | null;
     /**
      * @description When the credential was created.
      * @type string

src/generated/types/AuditLogEntry.ts

@@ -30,7 +30,7 @@ export type AuditLogEntry = {
     */
     region?: string;
     /**
-     * @description Event type (query, blocked, masked, budget_exhausted, truncated, auth_failed).
+     * @description Event type (query, blocked, masked, budget_exhausted, truncated, auth_failed, credential_expired).
      * @type string
     */
     event: string;
@@ -95,7 +95,7 @@ export type AuditLogEntry = {
     */
     session_id?: string;
     /**
-     * @description Statement origin (wire or mcp).
+     * @description Statement origin (wire, mcp, or control for control-plane lifecycle events).
      * @type string | undefined
     */
     source?: string;

src/generated/types/CreateAgentCredentialRequest.ts

@@ -33,4 +33,9 @@ export type CreateAgentCredentialRequest = {
      * @type string | undefined
     */
     principal_type?: CreateAgentCredentialRequestPrincipalTypeEnumKey;
+    /**
+     * @description Optional expiry. When set, the credential becomes unusable at this time (must be in the future). Omit or set null for a credential that never expires.
+     * @type string
+    */
+    expires_at?: string | null;
 };