@opengeni/api-router 0.22.2 → 0.26.1

package/src/routes/skills.ts

@@ -0,0 +1,174 @@
+import {
+  InstallSkillRequest,
+  InstalledSkill,
+  PreviewSkillImportRequest,
+  SkillImportPreview,
+  SkillUninstallPreview,
+  UninstallSkillRequest,
+  UninstallSkillResult,
+} from "@opengeni/contracts";
+import {
+  portableSkillCapabilityId,
+  portableSkillPluginKey,
+  requireAccessGrant,
+  resolveSkillImport,
+  type ApiRouteDeps,
+  type GitHubSkillSourceClient,
+} from "@opengeni/core";
+import {
+  getPortableSkillUninstallPreview,
+  installPortableSkill,
+  PortableSkillInstallationVersionConflictError,
+  PortableSkillInstallationVersionRequiredError,
+  uninstallPortableSkill,
+} from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+import type { Hono } from "hono";
+
+import { createGitHubSkillSourceClient } from "../integrations/github-skill-source";
+
+export type SkillRouteOverrides = Readonly<{
+  github?: GitHubSkillSourceClient;
+}>;
+
+export function registerSkillRoutes(
+  app: Hono,
+  deps: ApiRouteDeps,
+  overrides: SkillRouteOverrides = {},
+): void {
+  const github = overrides.github ?? createGitHubSkillSourceClient(deps.settings);
+
+  app.post("/v1/workspaces/:workspaceId/skills/preview", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const payload = PreviewSkillImportRequest.parse(await c.req.json());
+    const resolved = await resolveForRoute(payload.url, github);
+    const installed = await getPortableSkillUninstallPreview(
+      deps.db,
+      workspaceId,
+      portableSkillCapabilityId(resolved.preview),
+    );
+    return c.json(
+      SkillImportPreview.parse({
+        ...resolved.preview,
+        installed: installed.installed,
+        installationVersion: installed.installationVersion,
+      }),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/skills/install", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = InstallSkillRequest.parse(await c.req.json());
+    const resolved = await resolveForRoute(payload.url, github);
+    if (
+      resolved.preview.sourceCommit !== payload.expectedSourceCommit ||
+      resolved.preview.contentSha256 !== payload.expectedContentSha256
+    ) {
+      throw new HTTPException(409, {
+        message:
+          "The Skill source changed after preview. Review the new commit and contents before installing.",
+      });
+    }
+    const fileSummaryByPath = new Map(
+      resolved.preview.files.map((file) => [file.path, file] as const),
+    );
+    try {
+      const installed = await installPortableSkill(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        capabilityId: portableSkillCapabilityId(resolved.preview),
+        pluginKey: portableSkillPluginKey(resolved.preview),
+        source: resolved.preview.source,
+        sourceUrl: resolved.preview.sourceUrl,
+        repositoryUrl: resolved.preview.repositoryUrl,
+        sourceCommit: resolved.preview.sourceCommit,
+        sourcePath: resolved.preview.sourcePath,
+        name: resolved.preview.name,
+        description: resolved.preview.description,
+        contentSha256: resolved.preview.contentSha256,
+        totalBytes: resolved.preview.totalBytes,
+        ...(payload.expectedInstallationVersion !== undefined
+          ? { expectedInstallationVersion: payload.expectedInstallationVersion }
+          : {}),
+        files: resolved.files.map((file) => {
+          const summary = fileSummaryByPath.get(file.path);
+          if (!summary) throw new Error(`Skill preview omitted ${file.path}`);
+          return {
+            path: file.path,
+            content: file.content,
+            byteSize: summary.byteSize,
+            contentSha256: summary.contentSha256,
+          };
+        }),
+      });
+      return c.json(
+        InstalledSkill.parse({ ...installed, status: "installed" }),
+        payload.expectedInstallationVersion === undefined ? 201 : 200,
+      );
+    } catch (error) {
+      if (error instanceof PortableSkillInstallationVersionRequiredError) {
+        throw new HTTPException(400, { message: error.message });
+      }
+      if (error instanceof PortableSkillInstallationVersionConflictError) {
+        throw new HTTPException(409, {
+          message: "The Skill changed after preview. Review the current installation again.",
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/skills/:capabilityId/uninstall-preview", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
+    return c.json(
+      SkillUninstallPreview.parse(
+        await getPortableSkillUninstallPreview(deps.db, workspaceId, capabilityId),
+      ),
+    );
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/skills/:capabilityId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
+    const payload = UninstallSkillRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        UninstallSkillResult.parse(
+          await uninstallPortableSkill(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            capabilityId,
+            expectedInstallationVersion: payload.expectedInstallationVersion,
+          }),
+        ),
+      );
+    } catch (error) {
+      if (error instanceof PortableSkillInstallationVersionConflictError) {
+        throw new HTTPException(409, {
+          message: "The Skill changed after preview. Review uninstall impact again.",
+        });
+      }
+      throw error;
+    }
+  });
+}
+
+async function resolveForRoute(
+  url: string,
+  github: Parameters<typeof resolveSkillImport>[1],
+): ReturnType<typeof resolveSkillImport> {
+  try {
+    return await resolveSkillImport(url, github);
+  } catch (error) {
+    if (error instanceof HTTPException) throw error;
+    throw new HTTPException(502, {
+      message: error instanceof Error ? error.message : "The Skill source could not be read",
+    });
+  }
+}

package/src/routes/transcription-recordings.ts

@@ -35,14 +35,17 @@ import {
   markTranscriptionRecordingObjectsCleaned,
   reserveTranscriptionRecordingChunk,
   reserveTranscriptionRecordingSegment,
+  runIdempotentPersistenceTransaction,
   startTranscriptionRecordingSegmentProviderCall,
   transcriptionRecordingObjectKeys,
   TranscriptionRecordingConflictError,
   TranscriptionRecordingNotFoundError,
   TranscriptionRecordingStateError,
+  isSessionEventPersistenceError,
 } from "@opengeni/db";
 import { getWorkspace } from "@opengeni/db";
 import type { Context, Hono } from "hono";
+import { ApiHttpError } from "../http/api-error";
 import { TranscriptionSegmenterError } from "../transcription/segmenter";
 
 const CHUNK_SHA256_HEADER = "x-opengeni-chunk-sha256";
@@ -153,17 +156,26 @@ export function registerResumableTranscriptionRoutes(app: Hono, deps: ApiRouteDe
         ) {
           return c.json({ code: "not_supported" }, 415);
         }
-        const reservation = await reserveTranscriptionRecordingChunk(deps.db, {
-          ...authority,
-          recordingId: existing.recording.id,
-          chunkNumber,
-          byteLength: body.byteLength,
-          sha256,
-          startMilliseconds,
-          durationMilliseconds,
-          maxTotalBytes: deps.settings.voiceInputResumableMaxSizeBytes,
-          maxDurationMilliseconds: deps.settings.voiceInputResumableMaxDurationSeconds * 1_000,
-        });
+        const persistenceCorrelationId = correlationId(c);
+        const reservation = await runIdempotentPersistenceTransaction(
+          {
+            stage: "transcription_recording_chunk_reservation",
+            eventTypes: ["transcription_recording_chunk"],
+            correlationId: persistenceCorrelationId,
+          },
+          () =>
+            reserveTranscriptionRecordingChunk(deps.db, {
+              ...authority,
+              recordingId: existing.recording.id,
+              chunkNumber,
+              byteLength: body.byteLength,
+              sha256,
+              startMilliseconds,
+              durationMilliseconds,
+              maxTotalBytes: deps.settings.voiceInputResumableMaxSizeBytes,
+              maxDurationMilliseconds: deps.settings.voiceInputResumableMaxDurationSeconds * 1_000,
+            }),
+        );
         if (!reservation.deduplicated) {
           try {
             // A concurrent same-hash retry may still observe the row while it is
@@ -180,12 +192,20 @@ export function registerResumableTranscriptionRoutes(app: Hono, deps: ApiRouteDe
             throw new RecordingProcessingError("Chunk upload failed", "network", true);
           }
         }
-        const completed = await completeTranscriptionRecordingChunk(deps.db, {
-          workspaceId: authority.workspaceId,
-          subjectId: authority.subjectId,
-          recordingId: existing.recording.id,
-          chunkNumber,
-        });
+        const completed = await runIdempotentPersistenceTransaction(
+          {
+            stage: "transcription_recording_chunk_completion",
+            eventTypes: ["transcription_recording_chunk"],
+            correlationId: persistenceCorrelationId,
+          },
+          () =>
+            completeTranscriptionRecordingChunk(deps.db, {
+              workspaceId: authority.workspaceId,
+              subjectId: authority.subjectId,
+              recordingId: existing.recording.id,
+              chunkNumber,
+            }),
+        );
         const response: UploadTranscriptionRecordingChunkResponse = {
           recording: completed.recording.recording,
           chunk: {
@@ -620,9 +640,25 @@ function routeError(c: Context, error: unknown): Response | Promise<Response> {
               : error.code === "unavailable"
                 ? 503
                 : 502;
+    if (error.retryable) {
+      throw new ApiHttpError(status, {
+        code: "upstream_unavailable",
+        message: "Transcription is temporarily unavailable.",
+        retryable: true,
+        details: { transcriptionCode: error.code },
+      });
+    }
     return c.json({ code: error.code }, status as never);
   }
-  return c.json({ code: "unknown" }, 500);
+  if (isSessionEventPersistenceError(error)) {
+    throw new ApiHttpError(503, {
+      code: "upstream_unavailable",
+      message: "Transcription is temporarily unavailable.",
+      retryable: true,
+      details: { persistenceCode: error.code },
+    });
+  }
+  throw error;
 }
 
 async function jsonBody(c: Context): Promise<unknown> {
@@ -688,22 +724,18 @@ async function readBoundedBody(request: Request, maxBytes: number): Promise<Uint
   const reader = request.body.getReader();
   const chunks: Uint8Array[] = [];
   let total = 0;
-  try {
-    for (;;) {
-      if (request.signal.aborted) {
-        throw new RecordingProcessingError("Chunk upload was cancelled", "cancelled", true);
-      }
-      const next = await reader.read();
-      if (next.done) break;
-      total += next.value.byteLength;
-      if (total > maxBytes) {
-        await reader.cancel();
-        throw new RecordingProcessingError("Chunk is too large", "too_large", false);
-      }
-      chunks.push(next.value);
+  for (;;) {
+    if (request.signal.aborted) {
+      throw new RecordingProcessingError("Chunk upload was cancelled", "cancelled", true);
+    }
+    const next = await reader.read();
+    if (next.done) break;
+    total += next.value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new RecordingProcessingError("Chunk is too large", "too_large", false);
     }
-  } finally {
-    reader.releaseLock();
+    chunks.push(next.value);
   }
   if (total === 0) {
     throw new RecordingProcessingError("Chunk is required", "invalid_audio", false);

package/src/routes/video-generation.ts

@@ -0,0 +1,132 @@
+import {
+  UpdateVideoGenerationPolicyRequest,
+  VideoGenerationOperationSummary,
+  VideoGenerationPolicy,
+  WorkspaceVideoGenerationSettings,
+} from "@opengeni/contracts";
+import {
+  getVideoGenerationOperationSummary,
+  getWorkspaceVercelAiGatewayConnectionMetadata,
+  getWorkspaceVideoGenerationPolicy,
+  updateWorkspaceVideoGenerationPolicy,
+  VideoGenerationConflictError,
+} from "@opengeni/db";
+import {
+  requireAccessGrant,
+  VIDEO_GENERATION_MODEL_CATALOG,
+  videoGenerationCapabilitiesForPolicy,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const [policy, connection] = await Promise.all([
+      getWorkspaceVideoGenerationPolicy(deps.db, workspaceId),
+      getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
+    ]);
+    const fundingOptions = videoGenerationFundingOptions({
+      managedConfigured: managedVideoGenerationConfigured(deps),
+      workspaceGatewayConfigured: connection !== null,
+    });
+    const selectedFunding = fundingOptions.find((option) => option.source === policy.fundingSource);
+    const capabilities =
+      selectedFunding?.available && policy.defaultModelId && policy.enabledModelIds.length > 0
+        ? videoGenerationCapabilitiesForPolicy({
+            policy,
+            credentialVersion:
+              policy.fundingSource === "workspace_gateway" ? (connection?.version ?? 0) : 1,
+          })
+        : null;
+    return c.json(
+      WorkspaceVideoGenerationSettings.parse({
+        schemaVersion: 1,
+        policy,
+        fundingOptions,
+        availableModels: VIDEO_GENERATION_MODEL_CATALOG,
+        capabilities,
+      }),
+    );
+  });
+
+  app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
+    const connection = await getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId);
+    const fundingOptions = videoGenerationFundingOptions({
+      managedConfigured: managedVideoGenerationConfigured(deps),
+      workspaceGatewayConfigured: connection !== null,
+    });
+    const selectedFunding = fundingOptions.find(
+      (option) => option.source === payload.fundingSource,
+    );
+    if (payload.enabledModelIds.length > 0 && !selectedFunding?.available) {
+      throw new HTTPException(422, {
+        message: selectedFunding?.unavailableReason ?? "Video generation funding is unavailable",
+      });
+    }
+    try {
+      const policy = await updateWorkspaceVideoGenerationPolicy(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        ...payload,
+      });
+      return c.json(VideoGenerationPolicy.parse(policy));
+    } catch (error) {
+      if (error instanceof VideoGenerationConflictError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      if (error instanceof Error && error.message.startsWith("Unknown video generation model:")) {
+        throw new HTTPException(422, { message: error.message });
+      }
+      throw error;
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const summary = await getVideoGenerationOperationSummary(
+      deps.db,
+      workspaceId,
+      c.req.param("operationId"),
+    );
+    if (!summary) throw new HTTPException(404, { message: "video generation operation not found" });
+    return c.json(VideoGenerationOperationSummary.parse(summary));
+  });
+}
+
+function managedVideoGenerationConfigured(deps: ApiRouteDeps): boolean {
+  return Boolean(deps.settings.vercelAiGatewayApiKey && deps.settings.environmentsEncryptionKey);
+}
+
+function videoGenerationFundingOptions(input: {
+  managedConfigured: boolean;
+  workspaceGatewayConfigured: boolean;
+}) {
+  return [
+    {
+      source: "opengeni_credits" as const,
+      label: "OpenGeni",
+      description: "Uses OpenGeni credits through the managed Gateway route.",
+      available: input.managedConfigured,
+      unavailableReason: input.managedConfigured
+        ? null
+        : "OpenGeni-managed video generation is not configured.",
+    },
+    {
+      source: "workspace_gateway" as const,
+      label: "Your Gateway",
+      description: "Uses your workspace Vercel AI Gateway key.",
+      available: input.workspaceGatewayConfigured,
+      unavailableReason: input.workspaceGatewayConfigured
+        ? null
+        : "Connect a workspace Vercel AI Gateway key first.",
+    },
+  ];
+}

package/src/routes/workspaces.ts

@@ -19,14 +19,11 @@ import {
 } from "@opengeni/contracts";
 import {
   allWorkspacePermissions,
-  countActiveSessionsForWorkspace,
-  countWorkspacesForAccount,
   createWorkspace,
-  deleteWorkspace,
+  deleteWorkspaceIfQuiescent,
   getManagedUserByEmail,
   getWorkspaceModelPolicy,
   grantWorkspaceAccess,
-  listScheduledTasks,
   listWorkspaceMembers,
   listWorkspaceControlEvents,
   listWorkspacesForSubject,
@@ -47,7 +44,6 @@ import { hasPermission, requireAccessContext, requireAccessGrant } from "@openge
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
-  assertWorkspaceDeletable,
   assertWorkspaceMemberRemovable,
   controlHumanWorkspace,
   resolveMemberSubjectId,
@@ -55,6 +51,7 @@ import {
 import { boundedLimit } from "../http/common";
 import { sseWorkspaceControlStream } from "../http/sse";
 import { buildWorkspaceModelCatalog } from "../model-catalog";
+import { processTemporalScheduleCleanupClaims } from "../temporal-schedule-cleanup";
 import {
   AI_GATEWAY_REALTIME_MODELS,
   CODEX_REALTIME_MODEL_ID,
@@ -330,26 +327,51 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.delete("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    // Refuse before any external/DB mutation: never delete the account's only
-    // workspace, and never delete while a session could still be running in
-    // Temporal (there is no clean per-session terminate to call, so deleting
-    // the row would orphan the workflow — the operator must stop them first).
-    const [workspaceCountForAccount, activeSessionCount] = await Promise.all([
-      countWorkspacesForAccount(deps.db, grant.accountId),
-      countActiveSessionsForWorkspace(deps.db, workspaceId),
-    ]);
-    assertWorkspaceDeletable({ workspaceCountForAccount, activeSessionCount });
-    // Clean external Temporal state the FK cascade can't reach: every scheduled
-    // task's schedule (best-effort, mirroring the scheduled-task delete path).
-    const tasks = await listScheduledTasks(deps.db, workspaceId, 1000);
-    await Promise.all(
-      tasks.map((task) =>
-        deps.workflowClient
-          .deleteScheduledTaskSchedule({ temporalScheduleId: task.temporalScheduleId })
-          .catch(() => undefined),
-      ),
+    // The DB transaction locks the account/workspace and every existing
+    // session/lease before checking runtime quiescence, then returns the exact
+    // external schedules removed by the cascade. A racing cold->warm transition
+    // can therefore never erase the only provider/capture ownership receipt.
+    const deleted = await deleteWorkspaceIfQuiescent(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+    });
+    if (deleted.status === "not_found") {
+      throw new HTTPException(404, { message: "workspace not found" });
+    }
+    if (deleted.status === "only_workspace") {
+      throw new HTTPException(409, { message: "cannot delete the account's only workspace" });
+    }
+    if (deleted.status === "active_sessions") {
+      throw new HTTPException(409, {
+        message: "stop the workspace's running sessions before deleting it",
+      });
+    }
+    if (deleted.status === "active_video_generations") {
+      throw new HTTPException(409, {
+        message: "wait for the workspace's active video generations to finish before deleting it",
+      });
+    }
+    if (deleted.status === "live_sandboxes") {
+      throw new HTTPException(409, {
+        message: "wait for the workspace's active sandboxes to finish draining before deleting it",
+      });
+    }
+    if (deleted.status !== "deleted") {
+      throw new Error(`Unhandled workspace deletion outcome: ${deleted.status}`);
+    }
+    // The cleanup claims were inserted in the same transaction as the cascade.
+    // Try them immediately; failures are released to the replica-safe outbox
+    // pump, so a process crash or Temporal outage cannot orphan the schedules.
+    await processTemporalScheduleCleanupClaims(
+      {
+        db: deps.db,
+        deleteSchedule: async (temporalScheduleId) => {
+          await deps.workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId });
+        },
+        ...(deps.observability ? { observability: deps.observability } : {}),
+      },
+      deleted.temporalScheduleCleanups,
     );
-    await deleteWorkspace(deps.db, workspaceId);
     return c.body(null, 204);
   });
 

package/src/sandbox/auth-callout.ts

@@ -10,8 +10,8 @@
 //      to, the `server_id` for the response `aud`, and the presented `auth_token`);
 //   2. VALIDATES the bearer with verifyEnrollmentBearer (HMAC, via
 //      resolveEnrollmentSigningSecret) — an invalid/expired/forged bearer is denied;
-//   3. confirms the enrollment is still ACTIVE in the DB (a revoked machine is
-//      denied even with a still-unexpired bearer);
+//   3. confirms the enrollment is still ACTIVE in the DB at the exact credential
+//      generation (a revoked or re-enrolled machine denies an old bearer);
 //   4. signs a NATS user JWT granting pub/sub ONLY `agent.<ws>.>` + `_INBOX.>`
 //      (deny-all-else by an allow-list) and returns it inside a signed
 //      authorization-response JWT.
@@ -48,6 +48,8 @@ import { observabilityEventLogger } from "../observability";
 
 /** The NATS subject nats-server publishes authorization requests on (ADR-26). */
 export const AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
+/** Keep live NATS credentials short-lived while never outliving the bearer. */
+export const NATS_USER_JWT_TTL_SECONDS = 5 * 60;
 
 export interface AuthCalloutDeps {
   db: Database;
@@ -123,13 +125,23 @@ export async function handleAuthorizationRequest(
   // Belt-and-braces: the bearer's agentId/enrollmentId must match the row we found.
   // (verifyEnrollmentBearer already binds them; this guards a future schema where
   // agentId != enrollmentId.)
-  if (enrollment.id !== claims.enrollmentId) {
+  if (
+    enrollment.workspaceId !== claims.workspaceId ||
+    enrollment.id !== claims.enrollmentId ||
+    enrollment.id !== claims.agentId ||
+    claims.agentId !== claims.enrollmentId ||
+    claims.subjectPrefix !== `agent.${claims.workspaceId}.${claims.agentId}`
+  ) {
     return deny("enrollment identity mismatch");
   }
+  if (enrollment.credentialGeneration !== claims.credentialGeneration) {
+    return deny("enrollment credential generation mismatch");
+  }
 
   // GRANT: a user JWT scoped to ONLY this workspace's agent subtree + the reply
   // inbox. This allow-list IS the per-workspace isolation boundary.
   const permissions = workspaceAgentPermissions(claims.workspaceId);
+  const nowSeconds = Math.floor(Date.now() / 1000);
   const userJwt = mintUserJwt({
     userPublicKey: decoded.userNkey,
     accountSeed: deps.callout.accountSeed,
@@ -142,7 +154,7 @@ export async function handleAuthorizationRequest(
     audienceAccount: deps.callout.accountName,
     // Tie the credential's life to the bearer's remaining life: a revoked/expired
     // enrollment cannot outlive its bearer at the NATS layer either.
-    expiresAtSeconds: claims.exp,
+    expiresAtSeconds: Math.min(claims.exp, nowSeconds + NATS_USER_JWT_TTL_SECONDS),
   });
   const response = mintAuthResponse({
     userPublicKey: decoded.userNkey,