callkaro-cli-unofficial 0.5.0 → 0.6.0

package/dist/lib/adminAuth.js

@@ -0,0 +1,388 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expiryLabel = void 0;
+exports.cookieJar = cookieJar;
+exports.cookieHeader = cookieHeader;
+exports.adminLogin = adminLogin;
+exports.saveAdmin = saveAdmin;
+exports.adminSession = adminSession;
+exports.adminSessions = adminSessions;
+exports.hasAdmin = hasAdmin;
+exports.forgetAdmin = forgetAdmin;
+exports.requireAdmin = requireAdmin;
+exports.requireAdminFor = requireAdminFor;
+exports.impersonateClient = impersonateClient;
+exports.reImpersonate = reImpersonate;
+exports.adminLoginCommand = adminLoginCommand;
+exports.adminWhoamiCommand = adminWhoamiCommand;
+exports.adminLogoutCommand = adminLogoutCommand;
+const prompts_1 = __importDefault(require("prompts"));
+const ui_1 = require("./ui");
+const config_1 = require("./config");
+const dashboardAuth_1 = require("./dashboardAuth");
+Object.defineProperty(exports, "expiryLabel", { enumerable: true, get: function () { return dashboardAuth_1.expiryLabel; } });
+/**
+ * Sign-in to the internal admin console — `https://intadmin.callkaro.ai`.
+ *
+ * ## The credential
+ *
+ * `POST /monitor/auth/login {email, password}` returns a cookie named
+ * `access_token_monitor`: a JWT with a 24h lifetime and **no refresh endpoint**.
+ * It reaches the `/monitor/*` routes and nothing else — the `ck_` token and the
+ * dashboard JWT are both rejected there, and this one is rejected by theirs.
+ *
+ * So the session is stored like the dashboard session (0600, password optional)
+ * and renews by signing in again, silently, when a password was kept.
+ *
+ * ## The cookie jar
+ *
+ * The login response sets `access_token_monitor` **four times**: three headers
+ * that clear it (empty value, epoch expiry) and then the real one. Taking the
+ * first, or joining the headers naively, produces a cookie header the server
+ * rejects. So the jar keeps the last non-empty value per name.
+ */
+/**
+ * Collect Set-Cookie headers into name→value, keeping the last non-empty value
+ * for each name.
+ *
+ * A response can repeat a cookie to clear it (empty value, past expiry) and
+ * then set it for real. Taking the last non-empty value handles both orders.
+ */
+function cookieJar(headers) {
+    const jar = new Map();
+    const list = typeof headers.getSetCookie === 'function'
+        ? headers.getSetCookie()
+        : [headers.get('set-cookie') || ''];
+    for (const raw of list) {
+        const [pair] = raw.split(';');
+        const i = pair.indexOf('=');
+        if (i < 0)
+            continue;
+        const name = pair.slice(0, i).trim();
+        const value = pair.slice(i + 1).trim();
+        if (value)
+            jar.set(name, value);
+    }
+    return jar;
+}
+/** `name=value; name=value` for a Cookie header. */
+function cookieHeader(jar) {
+    return [...jar].map(([k, v]) => `${k}=${v}`).join('; ');
+}
+/**
+ * Sign in to the admin console with email + password.
+ *
+ * Returns the session without the password; the caller decides whether to keep
+ * it. The admin's own id comes from the same response, because
+ * `GET /monitor/users/:id` — the route that lists the client accounts — is
+ * keyed by it.
+ */
+async function adminLogin(email, password) {
+    const res = await fetch(`${(0, config_1.backendUrl)()}/monitor/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new Error(`Admin login returned a non-JSON response (HTTP ${res.status}).`);
+    }
+    if (!res.ok) {
+        throw new Error(data.msg || `Admin login failed (HTTP ${res.status})`);
+    }
+    const jar = cookieJar(res.headers);
+    const token = jar.get('access_token_monitor');
+    if (!token) {
+        throw new Error('Admin login succeeded but no access_token_monitor cookie came back, so the session is incomplete.\n' +
+            '  Without it, every `cku admin` command will 401.\n' +
+            '  Usually a proxy or browser extension stripping Set-Cookie.');
+    }
+    const payload = (0, dashboardAuth_1.decodeJwt)(token) || {};
+    const user = data.user || payload.user || {};
+    return {
+        email: user.email || data.user?.email || email,
+        token,
+        userId: user._id || data.user?._id || payload.id || '',
+        role: user.role || data.user?.role || payload.role,
+        expiresAt: typeof payload.exp === 'number' ? new Date(payload.exp * 1000).toISOString() : undefined,
+        savedAt: new Date().toISOString(),
+    };
+}
+// --- account binding -------------------------------------------------------
+/** Store on the account, keeping whatever else it holds. */
+function saveAdmin(email, session) {
+    return (0, config_1.saveAdminSession)(email, session);
+}
+function adminSession(email) {
+    if (!email)
+        return undefined;
+    return (0, config_1.loadAccount)((0, config_1.slugFor)(email)).admin;
+}
+/**
+ * Every stored account that holds an admin console session, newest first.
+ *
+ * The admin console session is a *person's* credential, not an account's: one
+ * admin, one session, whichever client account happens to be active. So the
+ * gate looks past the active account when the active account has none.
+ */
+function adminSessions() {
+    return (0, config_1.listAccounts)()
+        .filter((a) => a.admin?.token)
+        .map((a) => ({ email: a.email || '', session: a.admin }));
+}
+/** Does this account hold an admin console session locally? A hint, not a guarantee. */
+function hasAdmin(email) {
+    return Boolean(email && (0, config_1.loadAccount)((0, config_1.slugFor)(email)).admin?.token);
+}
+function forgetAdmin(email) {
+    return (0, config_1.clearAdminSession)(email);
+}
+// --- the auth gate ---------------------------------------------------------
+/**
+ * The restricted-endpoint gate for the `/monitor/*` surface, the counterpart to
+ * `session.ts`'s `requireApi()` and `dashboardAuth.ts`'s `requireDashboard()`.
+ *
+ * Deliberately separate: no `/cli/*` command may depend on this credential, and
+ * no admin command on the `ck_` token.
+ *
+ * The console session has no refresh endpoint, so a lapsed one is re-issued by
+ * signing in again. With a stored password that happens here, silently;
+ * without one this fails with the concrete next command.
+ */
+async function requireAdmin() {
+    const slug = (0, config_1.activeAccount)();
+    const email = slug ? (0, config_1.loadAccount)(slug).email : undefined;
+    // The console session belongs to a *person*, not to a client account: one
+    // admin holds one session, filed on whichever account they signed in with.
+    // So the active account's session is used when it has one, and otherwise the
+    // admin's session is found wherever it was filed — the admin signs in with
+    // their own login, but acts on client accounts they are assigned.
+    if (email && adminSession(email)?.token)
+        return requireAdminFor(email);
+    const others = adminSessions();
+    if (others.length)
+        return requireAdminFor(others[0].email);
+    throw new Error(`No admin console session for ${email || 'the account in effect'}.\n` +
+        '  The /monitor/* routes need an admin console sign-in, not a ck_ token.\n' +
+        '  Run: cku admin login');
+}
+/**
+ * The same gate, for a named account rather than the active one.
+ *
+ * Needed because an impersonated client account renews by impersonating again,
+ * and the admin session that allows that lives on the **admin's** account — not
+ * on the client account that happens to be active while the renewal runs.
+ */
+async function requireAdminFor(email) {
+    const session = adminSession(email);
+    if (!session?.token) {
+        throw new Error(`No admin console session for ${email || 'the account in effect'}.\n` +
+            '  The /monitor/* routes need an admin console sign-in, not a ck_ token.\n' +
+            '  Run: cku admin login');
+    }
+    // Expiry is read off the cookie token. A session stored before the role
+    // fields existed still works; only the token matters here.
+    const left = (0, dashboardAuth_1.msUntilExpiry)(session.token);
+    if (left !== undefined && left <= (session.password ? 60_000 : 0)) {
+        if (!session.password) {
+            const why = `Admin console session for ${email} expired ${new Date(Date.now() + left).toLocaleString('en-US')}.\n` +
+                '  There is no refresh endpoint — the token lives 24h and must be re-issued.';
+            throw new Error(`${why}\n  Run: cku admin login`);
+        }
+        try {
+            const renewed = await adminLogin(session.email || email, session.password);
+            saveAdmin(email, { ...renewed, password: session.password });
+            return { token: renewed.token, email: renewed.email, role: renewed.role, userId: renewed.userId };
+        }
+        catch (err) {
+            throw new Error(`Admin console session for ${email} expired and re-login with the stored password failed: ${err.message}\n` +
+                '  If the password changed, run: cku admin login');
+        }
+    }
+    return { token: session.token, email: session.email, role: session.role, userId: session.userId };
+}
+// --- impersonation ---------------------------------------------------------
+/**
+ * Mint a real `ck_` token for a client account, through the admin console.
+ *
+ * ## Why this is not one call
+ *
+ * The console's "Login as this user" button returns a **dashboard JWT** with an
+ * `actAs` claim — not a `ck_` token. Probed: that JWT gets 401 on
+ * `/cli/auth/me`, and so does the admin cookie. The missing link is
+ * `POST /cli/auth/browser/approve`, which is what the web app's own login page
+ * calls after the browser signs in. The console's browser flow therefore
+ * produces the same thing a normal sign-in does: a `ck_` token.
+ *
+ * The chain, all four hops confirmed live:
+ *
+ *   1. GET  /monitor/clients/:id/impersonate   -> { "auth-token": <JWT> }
+ *   2. POST /auth/apply-admin-session {token}   -> cookie `access_token`
+ *   3. POST /cli/auth/browser/start             -> { code, pollSecret }
+ *      POST /cli/auth/browser/approve {code}    -> 200
+ *   4. GET  /cli/auth/browser/poll?code&secret  -> { status:'approved', token:'ck_…' }
+ *
+ * The resulting token carries the *admin's* identity, so on its own it reaches
+ * no agents; `X-CallKaro-Account-Id` scopes it to the client. That is exactly
+ * the `cku monitor` mechanism, so the caller stores it with `monitoring` set.
+ */
+async function impersonateClient(clientId, opts = {}) {
+    const base = (0, config_1.backendUrl)();
+    // The stored admin console session is the credential for hop 1. It is looked
+    // up on the *admin's* account, which is not the active one when a client
+    // account is renewing itself.
+    const { token: monitorToken, email: adminEmail } = await requireAdminFor(opts.adminEmail);
+    const imp = await fetch(`${base}/monitor/clients/${encodeURIComponent(clientId)}/impersonate`, {
+        headers: { Cookie: `access_token_monitor=${monitorToken}` },
+    });
+    const impText = await imp.text();
+    if (!imp.ok) {
+        const msg = (() => {
+            try {
+                return JSON.parse(impText).msg;
+            }
+            catch {
+                return impText.slice(0, 160);
+            }
+        })();
+        throw new Error(`Could not impersonate ${clientId} (HTTP ${imp.status}): ${msg}\n` +
+            '  The client account must be assigned to your admin user.');
+    }
+    const impersonationToken = (JSON.parse(impText)['auth-token'] || '');
+    if (!impersonationToken)
+        throw new Error('Impersonation returned no auth-token.');
+    // 2. Trade it for a session cookie. This is the dashboard's `access_token`,
+    // not the console's — a different cookie, for the impersonated identity.
+    const apply = await fetch(`${base}/auth/apply-admin-session`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: impersonationToken }),
+    });
+    if (!apply.ok) {
+        throw new Error(`Could not apply the admin session (HTTP ${apply.status}).`);
+    }
+    const sessionJar = cookieJar(apply.headers);
+    const sessionCookie = cookieHeader(sessionJar);
+    if (!sessionJar.has('access_token')) {
+        throw new Error('The admin session was applied but no access_token cookie came back.\n' +
+            '  Without it, the browser-approve exchange cannot be signed.');
+    }
+    const sessionHeaders = { Cookie: sessionCookie };
+    // 3. Start the browser-approval handshake and approve it ourselves.
+    const start = await fetch(`${base}/cli/auth/browser/start`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...sessionHeaders },
+    });
+    const startText = await start.text();
+    if (!start.ok)
+        throw new Error(`Could not start the approval session (HTTP ${start.status}).`);
+    const { code, pollSecret } = JSON.parse(startText);
+    if (!code || !pollSecret)
+        throw new Error('The approval session came back without a code.');
+    const approve = await fetch(`${base}/cli/auth/browser/approve`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...sessionHeaders },
+        body: JSON.stringify({ code }),
+    });
+    if (!approve.ok) {
+        throw new Error(`Could not approve the session (HTTP ${approve.status}).`);
+    }
+    // 4. Poll for the token.
+    const poll = await fetch(`${base}/cli/auth/browser/poll?code=${encodeURIComponent(code)}&secret=${encodeURIComponent(pollSecret)}`, { headers: sessionHeaders });
+    const pollText = await poll.text();
+    if (!poll.ok) {
+        throw new Error(`Could not collect the token (HTTP ${poll.status}): ${pollText.slice(0, 160)}`);
+    }
+    const polled = JSON.parse(pollText);
+    if (polled.status !== 'approved' || !polled.token) {
+        throw new Error(`The approval session ended with status "${polled.status}" instead of an approved token.`);
+    }
+    return { token: polled.token, email: adminEmail };
+}
+/**
+ * Re-mint an impersonated token. Used by the renewal path: an impersonated
+ * account has no password, so it renews by impersonating again.
+ */
+async function reImpersonate(impersonated) {
+    try {
+        const { token } = await impersonateClient(impersonated.clientId, { adminEmail: impersonated.adminEmail });
+        return token;
+    }
+    catch {
+        return undefined;
+    }
+}
+// --- commands --------------------------------------------------------------
+/** `cku admin login` — sign in to the internal admin console. */
+async function adminLoginCommand(opts) {
+    try {
+        (0, ui_1.needTty)('Admin login is interactive; sign in from a terminal.');
+        const answers = await (0, prompts_1.default)([
+            { type: opts.email ? null : 'text', name: 'email', message: 'Admin email' },
+            { type: 'password', name: 'password', message: 'Password' },
+        ], { onCancel: () => process.exit(1) });
+        const email = opts.email || answers.email;
+        const password = answers.password;
+        if (!email || !password)
+            return (0, ui_1.handleError)(new Error('Email and password are required'));
+        const session = await adminLogin(email, password);
+        // Kept by default so the session renews itself every 24h; --no-save-password
+        // opts out and brings back a daily re-login.
+        const keep = opts.savePassword !== false;
+        saveAdmin(email, keep ? { ...session, password } : session);
+        (0, ui_1.success)(`Admin console session stored for ${session.email} (role ${session.role || 'unknown'}).`);
+        if (keep) {
+            (0, ui_1.info)('  Password saved (plain text, mode 0600) so the session renews itself when it lapses.');
+            (0, ui_1.info)('  Remove it with `cku admin logout`, or sign in with --no-save-password.');
+        }
+        else {
+            (0, ui_1.info)('  Password not saved. The session cannot be renewed, so re-run this once it expires.');
+        }
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin whoami` — prove the stored admin session still works. */
+async function adminWhoamiCommand(opts) {
+    try {
+        const { adminApi } = require('./adminApi');
+        const res = await adminApi().getAdmin();
+        if (opts.json)
+            return void console.log(JSON.stringify(res, null, 2));
+        const user = res?.user || res;
+        (0, ui_1.success)(`Signed in to the admin console as ${user?.email || 'unknown'} (role ${user?.role || 'unknown'}).`);
+        if (user?.isSuperAdmin)
+            (0, ui_1.info)('  Super admin — every route is available.');
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin logout` — forget the admin session, keep the ck_ token. */
+async function adminLogoutCommand(opts) {
+    try {
+        // The session may be filed on any account, so find where it actually is.
+        const slug = (0, config_1.activeAccount)();
+        const active = slug ? (0, config_1.loadAccount)(slug).email : undefined;
+        const held = active && hasAdmin(active) ? active : adminSessions()[0]?.email;
+        if (!held)
+            return void (0, ui_1.info)('No admin console session stored.');
+        if (!(await (0, ui_1.confirm)(`Forget the admin console session for ${held}? (your ck_ token is kept)`, opts.yes)))
+            return;
+        if (forgetAdmin(held))
+            (0, ui_1.success)(`Admin console session removed for ${held}.`);
+        else
+            (0, ui_1.fail)('Nothing to remove.');
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}

package/dist/lib/api.js

@@ -12,30 +12,64 @@ const types_1 = require("./types");
  * logic. Public methods map 1:1 to the `/cli/*` endpoints.
  */
 class Api {
-    token;
     monitoringAccountId;
+    renewToken;
     baseUrl;
     callBaseUrl;
-    constructor(baseUrl, callBaseUrl, token, monitoringAccountId) {
-        this.token = token;
+    /** Mutable: a renewed token replaces the rejected one for later requests. */
+    token;
+    constructor(baseUrl, callBaseUrl, token, monitoringAccountId, 
+    /**
+     * Re-issue a rejected token. The `ck_` token is opaque and has no refresh
+     * route, so the only way back in is to sign in again — which needs the
+     * account's password. Returns the new token, or undefined when the account
+     * cannot renew itself.
+     */
+    renewToken) {
         this.monitoringAccountId = monitoringAccountId;
+        this.renewToken = renewToken;
         this.baseUrl = baseUrl.replace(/\/+$/, '');
         this.callBaseUrl = (callBaseUrl || baseUrl).replace(/\/+$/, '');
+        this.token = token;
     }
     request(method, path, body, includeAccount = true) {
         return this.requestTo(this.baseUrl, method, path, body, includeAccount);
     }
     /** Same as request(), but against a specific base URL (e.g. the call cloud). */
     async requestTo(base, method, path, body, includeAccount = true) {
+        let res = await this.send(base, method, path, body, includeAccount, this.token);
+        // A rejected token is not a failure the user can act on by retrying: the
+        // same token gets the same answer. Renew once, silently, when the account
+        // has the means to renew itself. The renewed token then serves the rest of
+        // the command, so one renewal covers every request in it.
+        if (res.status === 401 && this.renewToken) {
+            const fresh = await this.renewToken();
+            if (fresh) {
+                this.token = fresh;
+                res = await this.send(base, method, path, body, includeAccount, fresh);
+            }
+        }
+        const text = await res.text();
+        const data = text ? safeJson(text) : undefined;
+        if (!res.ok) {
+            throw new types_1.ApiError(res.status, res.status === 401
+                ? `${data?.msg || 'Your session is no longer valid'} — the stored token was rejected and could not be renewed.\n` +
+                    '  Run `cku login` to sign in again.'
+                : data?.msg || data?.message || (typeof data?.error === 'string' ? data.error : undefined) ||
+                    `Request failed (${res.status})`, parseErrorDetails(data?.errors ?? data?.data?.errors ?? invalidDetails(data?.invalid)));
+        }
+        return data;
+    }
+    /** One HTTP round trip, with the given bearer token. */
+    async send(base, method, path, body, includeAccount, token) {
         const headers = { 'Content-Type': 'application/json' };
-        if (this.token)
-            headers.Authorization = `Bearer ${this.token}`;
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
         // Monitoring mode: every request, writes included, acts on the client account.
         if (includeAccount && this.monitoringAccountId)
             headers['X-CallKaro-Account-Id'] = this.monitoringAccountId;
-        let res;
         try {
-            res = await fetch(`${base}${path}`, {
+            return await fetch(`${base}${path}`, {
                 method,
                 headers,
                 body: body === undefined ? undefined : JSON.stringify(body),
@@ -44,13 +78,6 @@ class Api {
         catch (err) {
             throw new types_1.ApiError(0, `Cannot reach ${base} (${err.message})`);
         }
-        const text = await res.text();
-        const data = text ? safeJson(text) : undefined;
-        if (!res.ok) {
-            throw new types_1.ApiError(res.status, data?.msg || data?.message || (typeof data?.error === 'string' ? data.error : undefined) ||
-                `Request failed (${res.status})`, parseErrorDetails(data?.errors ?? data?.data?.errors ?? invalidDetails(data?.invalid)));
-        }
-        return data;
     }
     // --- auth endpoints -------------------------------------------------------
     registerStart(email) { return this.request('POST', '/cli/auth/register/start', { email }); }

package/dist/lib/config.js

@@ -23,6 +23,8 @@ exports.loadAccount = loadAccount;
 exports.saveAccount = saveAccount;
 exports.saveDashboardSession = saveDashboardSession;
 exports.clearDashboardSession = clearDashboardSession;
+exports.saveAdminSession = saveAdminSession;
+exports.clearAdminSession = clearAdminSession;
 exports.removeAccount = removeAccount;
 exports.loadConfig = loadConfig;
 exports.clearSession = clearSession;
@@ -30,6 +32,7 @@ exports.saveLogin = saveLogin;
 exports.monitoringAccountId = monitoringAccountId;
 exports.setMonitoring = setMonitoring;
 exports.getClient = getClient;
+exports.renewTokenFor = renewTokenFor;
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -231,15 +234,34 @@ function loadAccount(slug) {
         return {};
     return readJson(accountPath(slug), {});
 }
-/** Store a session for `email` and make it the active account. */
-function saveAccount(email, session) {
+/**
+ * Store a session for `email` and make it the active account.
+ *
+ * `activate: false` stores it without moving the global pointer — what
+ * `cku admin impersonate` needs, since minting a client account's token must
+ * not silently redirect the admin's own commands.
+ */
+function saveAccount(email, session, opts = {}) {
     const slug = slugFor(email);
     // Carry the dashboard session across. `saveLogin` passes only { token, user },
     // so without this a later `cku login` would silently drop a dashboard session
     // the account already holds.
     const dashboard = session.dashboard ?? loadAccount(slug).dashboard;
-    writeJson(accountPath(slug), { ...session, email, savedAt: new Date().toISOString(), ...(dashboard ? { dashboard } : {}) });
-    setActiveAccount(email);
+    // The admin console session is a third credential, carried the same way.
+    const admin = session.admin ?? loadAccount(slug).admin;
+    // The password is the one field carried across a re-login: it is what lets a
+    // rejected token be re-issued without the user signing in again.
+    const password = session.password ?? loadAccount(slug).password;
+    writeJson(accountPath(slug), {
+        ...session,
+        email,
+        savedAt: new Date().toISOString(),
+        ...(dashboard ? { dashboard } : {}),
+        ...(admin ? { admin } : {}),
+        ...(password ? { password } : {}),
+    });
+    if (opts.activate !== false)
+        setActiveAccount(email);
     return slug;
 }
 /**
@@ -275,6 +297,38 @@ function clearDashboardSession(email) {
     writeJson(accountPath(slug), rest);
     return true;
 }
+/**
+ * Store the admin console session on an account, keeping whatever else it holds.
+ * Merging matters: signing in to the console must not disturb a `ck_` token or a
+ * dashboard session the account already holds.
+ */
+function saveAdminSession(email, admin) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    // Built field by field, so stray fields a caller passes are not written to disk.
+    // `password` is the one deliberate exception.
+    const stored = {
+        email: admin.email || email,
+        token: admin.token,
+        savedAt: admin.savedAt || new Date().toISOString(),
+        ...(admin.userId ? { userId: admin.userId } : {}),
+        ...(admin.role ? { role: admin.role } : {}),
+        ...(admin.expiresAt ? { expiresAt: admin.expiresAt } : {}),
+        ...(admin.password ? { password: admin.password } : {}),
+    };
+    writeJson(accountPath(slug), { ...current, email, admin: stored, savedAt: new Date().toISOString() });
+    return slug;
+}
+/** Forget only the admin console session; the `ck_` token is left alone. */
+function clearAdminSession(email) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    if (!current.admin)
+        return false;
+    const { admin, ...rest } = current;
+    writeJson(accountPath(slug), rest);
+    return true;
+}
 function removeAccount(slug) {
     const path = accountPath(slug);
     if (!(0, fs_1.existsSync)(path))
@@ -322,10 +376,18 @@ function clearSession() {
     const path = accountPath(slug);
     if (!(0, fs_1.existsSync)(path))
         return undefined;
-    const { email, savedAt, dashboard } = loadAccount(slug);
-    // Dropping the ck_ token is what logout means. A dashboard session is a
-    // separate credential and is left in place — `cku firebase logout` removes it.
-    writeJson(path, { email, savedAt, ...(dashboard ? { dashboard } : {}) });
+    const { email, savedAt, dashboard, admin } = loadAccount(slug);
+    // Dropping the ck_ token is what logout means. The password goes with it: it
+    // exists only to re-issue that token, so keeping it would let a logged-out
+    // account sign itself back in. A dashboard session is a separate credential
+    // and is left in place — `cku dashboard logout` removes it. Same for the
+    // admin console session — `cku admin logout` removes that.
+    writeJson(path, {
+        email,
+        savedAt,
+        ...(dashboard ? { dashboard } : {}),
+        ...(admin ? { admin } : {}),
+    });
     return email;
 }
 /**
@@ -365,5 +427,77 @@ function setMonitoring(monitoring) {
 /** Build the API client from the endpoint URLs + resolved token. */
 function getClient() {
     const cfg = loadConfig();
-    return { api: new api_1.Api(backendUrl(), callUrl(), cfg.token, monitoringAccountId(cfg)), cfg };
+    return {
+        api: new api_1.Api(backendUrl(), callUrl(), cfg.token, monitoringAccountId(cfg), renewTokenFor(cfg)),
+        cfg,
+    };
+}
+/**
+ * Sign in again for an account that stored its password, and persist the new
+ * token.
+ *
+ * The `ck_` token is opaque and has no refresh route, so a token the server
+ * stops accepting leaves no way back in except a fresh sign-in. An account that
+ * stored its password renews itself; one that did not cannot, and the caller
+ * gets undefined so the error can name `cku login`.
+ *
+ * An account that was *impersonated* has no password: its token was minted by
+ * the admin console. It renews by impersonating again, which needs the admin
+ * console session rather than a password.
+ *
+ * Under CK_TOKEN there is no stored account in effect, so nothing is renewed:
+ * the environment owns the credential.
+ */
+function renewTokenFor(cfg = loadConfig()) {
+    if (process.env.CK_TOKEN)
+        return undefined;
+    const email = cfg.email;
+    const password = cfg.password;
+    const impersonated = cfg.impersonated;
+    if (!email)
+        return undefined;
+    // Persist to the slot the session was read from, not to one derived from the
+    // email: the account file is what every later command resolves. Writing the
+    // new token somewhere else renews the command but leaves the slot dead, and
+    // the next invocation fails exactly as before.
+    const slug = activeAccount() || slugFor(email);
+    if (impersonated) {
+        return async () => {
+            try {
+                // Lazy require: adminAuth imports this module, so a top-level import
+                // would be a cycle. Same pattern as refreshModelCatalog in dashboardAuth.
+                const { reImpersonate } = require('./adminAuth');
+                const fresh = await reImpersonate(impersonated);
+                if (!fresh)
+                    return undefined;
+                const current = loadAccount(slug);
+                writeJson(accountPath(slug), { ...current, email, token: fresh, savedAt: new Date().toISOString() });
+                return fresh;
+            }
+            catch {
+                return undefined;
+            }
+        };
+    }
+    if (!password)
+        return undefined;
+    return async () => {
+        try {
+            const res = await fetch(`${backendUrl()}/cli/auth/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email, password }),
+            });
+            const data = (await res.json().catch(() => ({})));
+            if (!res.ok || !data.token)
+                return undefined;
+            // Persist the new token, keeping everything else the account holds.
+            const current = loadAccount(slug);
+            writeJson(accountPath(slug), { ...current, email, token: data.token, savedAt: new Date().toISOString() });
+            return data.token;
+        }
+        catch {
+            return undefined;
+        }
+    };
 }