@mnemom/mnemom 0.8.0 → 0.9.0

package/dist/lib/api.d.ts

@@ -1,4 +1,14 @@
 export declare const API_BASE: string;
+/**
+ * Generate a fresh Idempotency-Key for a mutation request.
+ *
+ * The server's beginIdempotentMutation contract (mnemom-api/src/idempotency.ts)
+ * requires this header on every PUT/POST/DELETE to a mutation endpoint;
+ * without it the server short-circuits with a 400 "Idempotency-Key header is
+ * required". Callers may pass an explicit key (for retries that must hit the
+ * cached reservation) — when omitted, we mint a UUIDv4.
+ */
+export declare function newIdempotencyKey(): string;
 export interface Agent {
     id: string;
     gateway: string;
@@ -7,13 +17,33 @@ export interface Agent {
     email?: string;
     created_at: string;
 }
+/**
+ * Per docs.mnemom.ai/api-reference/openapi.json#components/schemas/IntegrityScore:
+ *
+ *   { agent_id, total_traces, verified_traces, violation_count, integrity_score }
+ *
+ * `integrity_score` is a value in [0, 1].
+ *
+ * Pre-this-fix the CLI's interface declared `score` / `verified` /
+ * `violations` / `last_updated` — none of which exist on the wire. The
+ * `mnemom integrity` command rendered every field as `undefined` (and the
+ * score as `NaN%`) against any agent. Field names now match the docs
+ * verbatim.
+ *
+ * NOTE — API shape divergence (flagged for a follow-up mnemom-api PR):
+ * the RPC path in handleGetIntegrity returns an *array* of one object
+ * (Supabase wraps TABLE-returning RPCs as arrays) without `agent_id`;
+ * the manual fallback returns the *object* with `agent_id`. The docs
+ * canonical is the object shape. We accept both shapes defensively in
+ * getIntegrity below so this CLI works against today's prod API and
+ * keeps working when the API normalizes to a single shape.
+ */
 export interface IntegrityScore {
-    agent_id: string;
-    score: number;
+    agent_id?: string;
     total_traces: number;
-    verified: number;
-    violations: number;
-    last_updated: string;
+    verified_traces: number;
+    violation_count: number;
+    integrity_score: number;
 }
 export interface Trace {
     id: string;
@@ -29,7 +59,9 @@ export interface ApiError {
     error: string;
     message: string;
 }
-export declare function postApi<T>(endpoint: string, body: unknown): Promise<T>;
+export declare function postApi<T>(endpoint: string, body: unknown, opts?: {
+    idempotencyKey?: string;
+}): Promise<T>;
 export declare function verifyBinding(agentId: string, keyHash: string): Promise<{
     bound: boolean;
     key_prefix: string | null;
@@ -53,7 +85,30 @@ export declare function listAgents(): Promise<AgentListItem[]>;
  * Note: capped at 100 agents by listAgents().
  */
 export declare function getAgentByName(name: string): Promise<AgentListItem | null>;
+/**
+ * Fetch the integrity score for an agent.
+ *
+ * `/v1/integrity/:id` is the public-when-agent-is-public, owner-otherwise
+ * data route. The CLI must send the owner's auth header so private claimed
+ * agents (the common case for customers and internal users) return 200
+ * instead of 401. fetchWithAuthRetry inherits the 401-retry-with-refresh
+ * path from PR #200 so a stale local expiresAt heals transparently.
+ */
 export declare function getIntegrity(id: string): Promise<IntegrityScore>;
+/**
+ * Fetch recent traces for an agent.
+ *
+ * The API returns an envelope `{ traces, limit, offset }` (see
+ * mnemom-api/src/index.ts:handleGetTraces). Pre-this-fix the CLI typed
+ * the response as `Trace[]` and downstream code crashed with "traces is
+ * not iterable" because the envelope is not iterable. We unwrap the
+ * envelope here and return the bare array so callers (logs.ts) can keep
+ * the simpler shape.
+ *
+ * Sends auth headers — same reasoning as getIntegrity. The pre-PR-A
+ * `{ traces: [], private: true }` leaky envelope branch is gone, so we
+ * don't need a special case for it.
+ */
 export declare function getTraces(id: string, limit?: number): Promise<Trace[]>;
 export interface AlignmentCard {
     card_id?: string;
@@ -93,11 +148,15 @@ export interface CardResponse {
     updated_at: string;
 }
 export declare function getCard(agentId: string): Promise<CardResponse | null>;
-export declare function updateCard(agentId: string, cardJson: AlignmentCard): Promise<{
+export declare function updateCard(agentId: string, cardJson: AlignmentCard, opts?: {
+    idempotencyKey?: string;
+}): Promise<{
     updated: boolean;
     card_id: string;
 }>;
-export declare function reverifyAgent(agentId: string): Promise<{
+export declare function reverifyAgent(agentId: string, opts?: {
+    idempotencyKey?: string;
+}): Promise<{
     reverified: number;
 }>;
 export interface PolicyResponse {
@@ -114,7 +173,9 @@ export interface PolicyListResponse {
     policy: PolicyResponse | null;
 }
 export declare function getPolicy(agentId: string): Promise<PolicyListResponse | null>;
-export declare function publishPolicy(agentId: string, policyJson: Record<string, unknown>): Promise<{
+export declare function publishPolicy(agentId: string, policyJson: Record<string, unknown>, opts?: {
+    idempotencyKey?: string;
+}): Promise<{
     id: string;
     version: number;
     created: boolean;
@@ -139,14 +200,33 @@ export declare function getAlignmentCard(agentId: string, format?: "yaml" | "jso
     body: string;
     contentType: string;
 }>;
+/** Hard cap enforced by the API on inbound alignment-card bodies (413 otherwise). */
+export declare const ALIGNMENT_CARD_MAX_BYTES: number;
+/**
+ * Shape of a successful PUT response — the canonical card the composer
+ * just wrote, serialized as JSON via mnemom-api/src/composition/response.ts:
+ * respondCard with `_composition` stripped. We type the fields we display;
+ * the rest of the canonical card is allowed (and ignored at this layer).
+ *
+ * Pre-this-fix the typed return was `{ card_id, composed: boolean }` —
+ * a fictional wrapper. The API never returned a `composed` field; the CLI
+ * was rendering "Canonical card recomposed" gated on a value that, on the
+ * real wire, is always undefined. Drop the lie; reflect the actual shape.
+ */
+export interface PublishedCardResponse {
+    card_id?: string;
+    agent_id?: string;
+    card_version?: string;
+    issued_at?: string;
+    [key: string]: unknown;
+}
 /**
  * Publish (create or update) an alignment card.
  * Accepts YAML or JSON body; set contentType accordingly.
  */
-export declare function putAlignmentCard(agentId: string, body: string, contentType?: "text/yaml" | "application/json"): Promise<{
-    card_id: string;
-    composed: boolean;
-}>;
+export declare function putAlignmentCard(agentId: string, body: string, contentType?: "text/yaml" | "application/json", opts?: {
+    idempotencyKey?: string;
+}): Promise<PublishedCardResponse>;
 /**
  * Fetch the canonical protection card as YAML (or JSON fallback).
  */
@@ -154,13 +234,14 @@ export declare function getProtectionCard(agentId: string, format?: "yaml" | "js
     body: string;
     contentType: string;
 }>;
+/** Hard cap enforced by the API on inbound protection-card bodies (413 otherwise). */
+export declare const PROTECTION_CARD_MAX_BYTES: number;
 /**
  * Publish (create or update) a protection card.
  */
-export declare function putProtectionCard(agentId: string, body: string, contentType?: "text/yaml" | "application/json"): Promise<{
-    card_id: string;
-    composed: boolean;
-}>;
+export declare function putProtectionCard(agentId: string, body: string, contentType?: "text/yaml" | "application/json", opts?: {
+    idempotencyKey?: string;
+}): Promise<PublishedCardResponse>;
 /**
  * Resolve an agent name or ID to a server agent ID.
  *

package/dist/lib/api.js

@@ -1,5 +1,6 @@
+import { randomUUID } from "node:crypto";
 import { getApiUrl } from "./config.js";
-import { resolveAuth } from "./auth.js";
+import { forceRefreshAccessToken, resolveAuth } from "./auth.js";
 export const API_BASE = getApiUrl();
 /** Sanitize file-sourced data before use in outbound HTTP requests. */
 function sanitizeForHttp(data) {
@@ -13,6 +14,18 @@ function validateUrl(url) {
     }
     return parsed.href;
 }
+/**
+ * Generate a fresh Idempotency-Key for a mutation request.
+ *
+ * The server's beginIdempotentMutation contract (mnemom-api/src/idempotency.ts)
+ * requires this header on every PUT/POST/DELETE to a mutation endpoint;
+ * without it the server short-circuits with a 400 "Idempotency-Key header is
+ * required". Callers may pass an explicit key (for retries that must hit the
+ * cached reservation) — when omitted, we mint a UUIDv4.
+ */
+export function newIdempotencyKey() {
+    return randomUUID();
+}
 async function fetchApi(endpoint) {
     const url = validateUrl(`${API_BASE}${endpoint}`);
     const response = await fetch(url);
@@ -25,11 +38,12 @@ async function fetchApi(endpoint) {
     }
     return response.json();
 }
-export async function postApi(endpoint, body) {
+export async function postApi(endpoint, body, opts = {}) {
     const url = validateUrl(`${API_BASE}${endpoint}`);
     const cred = await resolveAuth();
     const headers = {
         "Content-Type": "application/json",
+        "Idempotency-Key": opts.idempotencyKey ?? newIdempotencyKey(),
     };
     if (cred.type === "jwt") {
         headers["Authorization"] = `Bearer ${cred.token}`;
@@ -74,12 +88,41 @@ async function authHeaders() {
             return {};
     }
 }
+/**
+ * Issue an authenticated fetch, and on a 401 response transparently force a
+ * token refresh and retry once.
+ *
+ * We hit this in the wild when the locally-stored expiresAt diverges from
+ * the JWT's actual exp claim (e.g. Supabase has been observed reporting
+ * expires_in values longer than the JWT's exp). Without this retry,
+ * `whoami` cheerfully reports a "valid" token while every authenticated
+ * call gets 401 — and the user has no path forward besides
+ * `mnemom logout && mnemom login`. The retry heals stale auth files
+ * transparently for users who haven't re-logged-in since the
+ * computeExpiresAt fix landed.
+ *
+ * `buildInit` is invoked fresh for each attempt so the retry picks up the
+ * new Authorization header from the refreshed token. We do NOT mint a new
+ * Idempotency-Key on the retry — the same key keys back into the same
+ * server-side reservation by design.
+ */
+async function fetchWithAuthRetry(url, buildInit) {
+    const first = await fetch(url, await buildInit());
+    if (first.status !== 401)
+        return first;
+    const refreshed = await forceRefreshAccessToken();
+    if (!refreshed)
+        return first;
+    return fetch(url, await buildInit());
+}
 export async function getAgent(id) {
     return fetchApi(`/v1/agents/${id}`);
 }
 export async function listAgents() {
     const url = validateUrl(`${API_BASE}/v1/agents?limit=100`);
-    const response = await fetch(url, { headers: await authHeaders() });
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: await authHeaders(),
+    }));
     if (!response.ok) {
         if (response.status === 401) {
             throw new Error("Not authenticated. Run `mnemom login` or set MNEMOM_API_KEY.");
@@ -112,11 +155,79 @@ export async function getAgentByName(name) {
     }
     return null;
 }
+/**
+ * Fetch the integrity score for an agent.
+ *
+ * `/v1/integrity/:id` is the public-when-agent-is-public, owner-otherwise
+ * data route. The CLI must send the owner's auth header so private claimed
+ * agents (the common case for customers and internal users) return 200
+ * instead of 401. fetchWithAuthRetry inherits the 401-retry-with-refresh
+ * path from PR #200 so a stale local expiresAt heals transparently.
+ */
 export async function getIntegrity(id) {
-    return fetchApi(`/v1/integrity/${id}`);
+    const url = validateUrl(`${API_BASE}/v1/integrity/${id}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: await authHeaders(),
+    }));
+    if (!response.ok) {
+        const error = (await response.json().catch(() => ({
+            error: "unknown",
+            message: response.statusText,
+        })));
+        throw new Error(error.message || `API request failed: ${response.status}`);
+    }
+    // Accept both the canonical docs shape (object) and the RPC-wrapped shape
+    // (array of one row). The latter is what prod actually returns today on
+    // the RPC path; flagged for a follow-up API normalization.
+    const body = (await response.json());
+    const row = Array.isArray(body) ? (body[0] ?? emptyIntegrityRow(id)) : body;
+    // Fill in agent_id when the API didn't (RPC path) so the field is always
+    // populated for consumers regardless of which API path served the request.
+    if (!row.agent_id)
+        row.agent_id = id;
+    return row;
 }
+function emptyIntegrityRow(agentId) {
+    return {
+        agent_id: agentId,
+        total_traces: 0,
+        verified_traces: 0,
+        violation_count: 0,
+        integrity_score: 1,
+    };
+}
+/**
+ * Fetch recent traces for an agent.
+ *
+ * The API returns an envelope `{ traces, limit, offset }` (see
+ * mnemom-api/src/index.ts:handleGetTraces). Pre-this-fix the CLI typed
+ * the response as `Trace[]` and downstream code crashed with "traces is
+ * not iterable" because the envelope is not iterable. We unwrap the
+ * envelope here and return the bare array so callers (logs.ts) can keep
+ * the simpler shape.
+ *
+ * Sends auth headers — same reasoning as getIntegrity. The pre-PR-A
+ * `{ traces: [], private: true }` leaky envelope branch is gone, so we
+ * don't need a special case for it.
+ */
 export async function getTraces(id, limit = 10) {
-    return fetchApi(`/v1/traces?agent_id=${id}&limit=${limit}`);
+    const url = validateUrl(`${API_BASE}/v1/traces?agent_id=${id}&limit=${limit}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: await authHeaders(),
+    }));
+    if (!response.ok) {
+        const error = (await response.json().catch(() => ({
+            error: "unknown",
+            message: response.statusText,
+        })));
+        throw new Error(error.message || `API request failed: ${response.status}`);
+    }
+    const data = (await response.json());
+    // Accept both the envelope shape (current API) and a bare array (defensive
+    // — staging is mid-deploy when a CLI smoke runs against an older API).
+    if (Array.isArray(data))
+        return data;
+    return data.traces ?? [];
 }
 export async function getCard(agentId) {
     try {
@@ -130,11 +241,15 @@ export async function getCard(agentId) {
         throw error;
     }
 }
-export async function updateCard(agentId, cardJson) {
+export async function updateCard(agentId, cardJson, opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/agents/${agentId}/card`);
     const response = await fetch(url, {
         method: "PATCH",
-        headers: { "Content-Type": "application/json", ...(await authHeaders()) },
+        headers: {
+            "Content-Type": "application/json",
+            "Idempotency-Key": opts.idempotencyKey ?? newIdempotencyKey(),
+            ...(await authHeaders()),
+        },
         body: sanitizeForHttp(JSON.stringify({ card_json: cardJson })),
     });
     if (!response.ok) {
@@ -146,11 +261,15 @@ export async function updateCard(agentId, cardJson) {
     }
     return response.json();
 }
-export async function reverifyAgent(agentId) {
+export async function reverifyAgent(agentId, opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/agents/${agentId}/reverify`);
     const response = await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json", ...(await authHeaders()) },
+        headers: {
+            "Content-Type": "application/json",
+            "Idempotency-Key": opts.idempotencyKey ?? newIdempotencyKey(),
+            ...(await authHeaders()),
+        },
     });
     if (!response.ok) {
         const error = (await response.json().catch(() => ({
@@ -173,11 +292,15 @@ export async function getPolicy(agentId) {
         throw error;
     }
 }
-export async function publishPolicy(agentId, policyJson) {
+export async function publishPolicy(agentId, policyJson, opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/agents/${agentId}/policy`);
     const response = await fetch(url, {
         method: "PUT",
-        headers: { "Content-Type": "application/json", ...(await authHeaders()) },
+        headers: {
+            "Content-Type": "application/json",
+            "Idempotency-Key": opts.idempotencyKey ?? newIdempotencyKey(),
+            ...(await authHeaders()),
+        },
         body: sanitizeForHttp(JSON.stringify({ policy_json: policyJson })),
     });
     if (!response.ok) {
@@ -232,17 +355,37 @@ export async function getAlignmentCard(agentId, format = "yaml") {
     const body = await response.text();
     return { body, contentType: ct };
 }
+/** Hard cap enforced by the API on inbound alignment-card bodies (413 otherwise). */
+export const ALIGNMENT_CARD_MAX_BYTES = 128 * 1024;
 /**
  * Publish (create or update) an alignment card.
  * Accepts YAML or JSON body; set contentType accordingly.
  */
-export async function putAlignmentCard(agentId, body, contentType = "text/yaml") {
+export async function putAlignmentCard(agentId, body, contentType = "text/yaml", opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/agents/${agentId}/alignment-card`);
-    const response = await fetch(url, {
+    // Lock in a single Idempotency-Key for this logical mutation. If the auth
+    // token is stale and the first attempt returns 401, fetchWithAuthRetry
+    // refreshes the token and retries — but the Idempotency-Key must be the
+    // same key on both attempts so the server's reservation table sees them as
+    // a single mutation, not two competing PUTs.
+    const idempotencyKey = opts.idempotencyKey ?? newIdempotencyKey();
+    const sanitizedBody = sanitizeForHttp(body);
+    const response = await fetchWithAuthRetry(url, async () => ({
         method: "PUT",
-        headers: { "Content-Type": contentType, ...(await authHeaders()) },
-        body: sanitizeForHttp(body),
-    });
+        headers: {
+            "Content-Type": contentType,
+            // The API content-negotiates the response body via Accept (see
+            // mnemom-api/src/composition/response.ts:respondYamlJson). We parse the
+            // response as JSON below, so we have to ask for JSON explicitly —
+            // Node's default Accept: */* would otherwise yield a YAML body and
+            // response.json() would crash with "Unexpected token 'a' is not valid
+            // JSON" against the canonical card we just wrote.
+            Accept: "application/json",
+            "Idempotency-Key": idempotencyKey,
+            ...(await authHeaders()),
+        },
+        body: sanitizedBody,
+    }));
     if (!response.ok) {
         const error = (await response.json().catch(() => ({
             error: "unknown",
@@ -275,16 +418,29 @@ export async function getProtectionCard(agentId, format = "yaml") {
     const body = await response.text();
     return { body, contentType: ct };
 }
+/** Hard cap enforced by the API on inbound protection-card bodies (413 otherwise). */
+export const PROTECTION_CARD_MAX_BYTES = 64 * 1024;
 /**
  * Publish (create or update) a protection card.
  */
-export async function putProtectionCard(agentId, body, contentType = "text/yaml") {
+export async function putProtectionCard(agentId, body, contentType = "text/yaml", opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/agents/${agentId}/protection-card`);
-    const response = await fetch(url, {
+    // See putAlignmentCard for why the Idempotency-Key is computed once outside
+    // the retry closure.
+    const idempotencyKey = opts.idempotencyKey ?? newIdempotencyKey();
+    const sanitizedBody = sanitizeForHttp(body);
+    const response = await fetchWithAuthRetry(url, async () => ({
         method: "PUT",
-        headers: { "Content-Type": contentType, ...(await authHeaders()) },
-        body: sanitizeForHttp(body),
-    });
+        headers: {
+            "Content-Type": contentType,
+            // See putAlignmentCard for the rationale — the API negotiates response
+            // body format via Accept and we parse the response as JSON below.
+            Accept: "application/json",
+            "Idempotency-Key": idempotencyKey,
+            ...(await authHeaders()),
+        },
+        body: sanitizedBody,
+    }));
     if (!response.ok) {
         const error = (await response.json().catch(() => ({
             error: "unknown",

package/dist/lib/auth.d.ts

@@ -30,6 +30,12 @@ export type AuthCredential = {
 } | {
     type: "none";
 };
+/**
+ * Compute the effective expiresAt for a freshly issued access token.
+ * Prefers the JWT's own `exp` claim; falls back to `now + expires_in` if the
+ * token can't be parsed (e.g. an opaque token).
+ */
+export declare function computeExpiresAt(accessToken: string, expiresInSeconds: number): number;
 /**
  * Get a valid access token, or null if not authenticated.
  *
@@ -38,6 +44,16 @@ export type AuthCredential = {
  *  2. Stored token from auth store (auto-refreshes if expired)
  */
 export declare function getAccessToken(): Promise<string | null>;
+/**
+ * Force a refresh of the stored access token regardless of local expiry, and
+ * return the new access token (or null if refresh failed).
+ *
+ * Intended as a 401-recovery hook for callers: if an authenticated request
+ * comes back unauthorized despite the local cache claiming a valid token, the
+ * cache is stale (clock skew, divergence between expires_in and the JWT's
+ * actual exp, or server-side revocation). Force a refresh and retry once.
+ */
+export declare function forceRefreshAccessToken(): Promise<string | null>;
 /**
  * Get a valid access token or exit with a helpful message.
  */

package/dist/lib/auth.js

@@ -75,6 +75,37 @@ export function getLicenseJwt() {
 function sanitizeForHttp(data) {
     return String(data).trim();
 }
+/**
+ * Decode a JWT's `exp` claim (unix seconds), or null if the token can't be
+ * parsed. We use the JWT's own exp as the source of truth for expiry rather
+ * than `expires_in` returned by the auth endpoint — the two can disagree
+ * (Supabase has been observed reporting expires_in values longer than the
+ * JWT's actual exp), and a divergence makes `whoami` cheerfully report a
+ * "valid" token while every authenticated API call gets 401.
+ */
+function jwtExpSeconds(accessToken) {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+            return null;
+        }
+        return payload.exp;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compute the effective expiresAt for a freshly issued access token.
+ * Prefers the JWT's own `exp` claim; falls back to `now + expires_in` if the
+ * token can't be parsed (e.g. an opaque token).
+ */
+export function computeExpiresAt(accessToken, expiresInSeconds) {
+    return jwtExpSeconds(accessToken) ?? Math.floor(Date.now() / 1000) + expiresInSeconds;
+}
 /**
  * Get a valid access token, or null if not authenticated.
  *
@@ -100,6 +131,25 @@ export async function getAccessToken() {
         return refreshed.accessToken;
     return null;
 }
+/**
+ * Force a refresh of the stored access token regardless of local expiry, and
+ * return the new access token (or null if refresh failed).
+ *
+ * Intended as a 401-recovery hook for callers: if an authenticated request
+ * comes back unauthorized despite the local cache claiming a valid token, the
+ * cache is stale (clock skew, divergence between expires_in and the JWT's
+ * actual exp, or server-side revocation). Force a refresh and retry once.
+ */
+export async function forceRefreshAccessToken() {
+    const envToken = process.env.MNEMOM_TOKEN;
+    if (envToken)
+        return envToken; // env-supplied tokens are not refreshable
+    const auth = getAuthInfo();
+    if (!auth?.refreshToken)
+        return null;
+    const refreshed = await refreshAccessToken(auth.refreshToken);
+    return refreshed?.accessToken ?? null;
+}
 /**
  * Get a valid access token or exit with a helpful message.
  */
@@ -218,7 +268,7 @@ async function startCallbackServer(expectedState) {
                 const tokens = {
                     accessToken: data.access_token,
                     refreshToken: data.refresh_token,
-                    expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+                    expiresAt: computeExpiresAt(data.access_token, data.expires_in),
                     userId: data.user_id,
                     email: data.user_email,
                 };
@@ -286,7 +336,7 @@ export async function loginWithPassword(email, password) {
     const tokens = {
         accessToken: data.access_token,
         refreshToken: data.refresh_token,
-        expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+        expiresAt: computeExpiresAt(data.access_token, data.expires_in),
         userId: data.user.id,
         email: data.user.email,
     };
@@ -314,7 +364,7 @@ async function refreshAccessToken(refreshToken) {
         const tokens = {
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+            expiresAt: computeExpiresAt(data.access_token, data.expires_in),
             userId: existing?.userId ?? "",
             email: existing?.email ?? "",
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {