tspl-cli 0.0.0-stage → 0.1.1

package/src/api-client.js

@@ -0,0 +1,108 @@
+'use strict'
+
+const {
+  readConfig,
+  readCredentials,
+  writeCredentials,
+} = require('./config-store')
+
+class ApiError extends Error {
+  constructor(message, statusCode) {
+    super(message)
+    this.statusCode = statusCode
+  }
+}
+
+const originOf = url => {
+  try {
+    return new URL(url).origin
+  } catch (err) {
+    return String(url)
+  }
+}
+
+const credentialsFor = apiUrl => {
+  const credentials = readCredentials()
+  if (credentials.apiUrl && originOf(credentials.apiUrl) !== originOf(apiUrl)) {
+    throw new ApiError(`You are logged in to ${originOf(credentials.apiUrl)}, not ${originOf(apiUrl)}. Run: tspl login`, 401)
+  }
+  return credentials
+}
+
+const send = async (apiUrl, method, path, body, accessToken) => {
+  const payload = body === undefined ? undefined : JSON.stringify(body)
+  const attempt = () =>
+    fetch(`${apiUrl}${path}`, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+      },
+      body: payload,
+    })
+  let res
+  try {
+    res = await attempt()
+  } catch (first) {
+    // A kept-alive connection the server already closed (for example after minutes of running tests) fails once;
+    // the request never reached the server, so it is sent again on a fresh connection.
+    try {
+      res = await attempt()
+    } catch (err) {
+      const cause = err.cause ? err.cause.code || err.cause.message : err.message
+      throw new ApiError(`Cannot reach the TSPL API at ${apiUrl}${cause ? ` (${cause})` : ''}`, 0)
+    }
+  }
+
+  const text = await res.text()
+  const data = text ? JSON.parse(text) : null
+  if (!res.ok) {
+    throw new ApiError((data && data.message) || res.statusText, res.status)
+  }
+  return data
+}
+
+const refreshTokens = async apiUrl => {
+  const credentials = credentialsFor(apiUrl)
+  if (!credentials.refreshToken) {
+    throw new ApiError('You are not logged in. Run: tspl login', 401)
+  }
+
+  try {
+    const tokens = await send(apiUrl, 'POST', '/api/v1/auth/refresh', {
+      refreshToken: credentials.refreshToken,
+    })
+    writeCredentials({ ...credentials, ...tokens })
+    return tokens.accessToken
+  } catch (err) {
+    if (err.statusCode === 401) {
+      throw new ApiError('Your session has expired. Run: tspl login', 401)
+    }
+    throw err
+  }
+}
+
+const request = async (method, path, body) => {
+  const { apiUrl } = readConfig()
+  const credentials = credentialsFor(apiUrl)
+  if (!credentials.accessToken) {
+    throw new ApiError('You are not logged in. Run: tspl login', 401)
+  }
+
+  try {
+    return await send(apiUrl, method, path, body, credentials.accessToken)
+  } catch (err) {
+    if (err.statusCode !== 401) {
+      throw err
+    }
+    const accessToken = await refreshTokens(apiUrl)
+    return send(apiUrl, method, path, body, accessToken)
+  }
+}
+
+module.exports = {
+  ApiError,
+  originOf,
+  send,
+  request,
+}

package/src/browser-tests.js

@@ -0,0 +1,209 @@
+'use strict'
+
+const Fs = require('fs')
+const Path = require('path')
+const { spawnSync } = require('child_process')
+
+const PLAYWRIGHT_VERSION = '1.55.1'
+const PLAYWRIGHT_CONFIG = /^playwright\.config\.[cm]?[jt]s$/
+
+const readJson = file => {
+  try {
+    return JSON.parse(Fs.readFileSync(file, 'utf8'))
+  } catch (err) {
+    return null
+  }
+}
+
+const runScript = (manager, script) => (script === 'start' ? `${manager} start` : `${manager} run ${script}`)
+
+/**
+ * How to start this package's web app for browser tests, or null when it is not a web app.
+ * Only frameworks whose dev server port is known by default; anything else is left alone.
+ */
+const webApp = (dir, manager) => {
+  const pkg = readJson(Path.join(dir, 'package.json'))
+  if (!pkg) return null
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies }
+  const scripts = pkg.scripts || {}
+  const has = name => Object.prototype.hasOwnProperty.call(deps, name)
+  if (has('react-native') || has('expo') || has('electron')) return null
+  const script = name => (scripts[name] ? runScript(manager, name) : null)
+  if (has('next')) return { framework: 'Next.js', command: script('dev') || 'npx next dev', port: 3000 }
+  if (has('nuxt')) return { framework: 'Nuxt', command: script('dev') || 'npx nuxi dev', port: 3000 }
+  if (has('@angular/core')) return { framework: 'Angular', command: script('start') || 'npx ng serve', port: 4200 }
+  if (has('react-scripts')) return { framework: 'Create React App', command: script('start') || 'npx react-scripts start', port: 3000 }
+  if (has('@sveltejs/kit') || (has('vite') && (has('react') || has('vue') || has('svelte') || has('solid-js') || has('preact')))) {
+    return { framework: 'Vite', command: script('dev') || 'npx vite', port: 5173 }
+  }
+  return null
+}
+
+const hasDependency = dir => {
+  const pkg = readJson(Path.join(dir, 'package.json')) || {}
+  return !!{ ...pkg.dependencies, ...pkg.devDependencies }['@playwright/test']
+}
+
+/** A Playwright config means the project already chose its browser test setup; tspl never rewrites it. */
+const hasPlaywright = dir => {
+  try {
+    return Fs.readdirSync(dir).some(name => PLAYWRIGHT_CONFIG.test(name))
+  } catch (err) {
+    return false
+  }
+}
+
+const installCommand = manager => {
+  const spec = `@playwright/test@${PLAYWRIGHT_VERSION}`
+  if (manager === 'yarn') return ['yarn', ['add', '-D', spec]]
+  if (manager === 'pnpm') return ['pnpm', ['add', '-D', spec]]
+  if (manager === 'bun') return ['bun', ['add', '-d', spec]]
+  return ['npm', ['install', '-D', spec]]
+}
+
+const configFile = app => `import { defineConfig, devices } from '@playwright/test'
+
+// Set up by tspl init. Name each test after the test case it proves ("TC1: ...") and tspl links its
+// result and screenshots to that case in the test report.
+export default defineConfig({
+  testDir: './e2e',
+  outputDir: './test-results',
+  fullyParallel: true,
+  retries: 0,
+  use: {
+    baseURL: process.env.BASE_URL || 'http://localhost:${app.port}',
+    screenshot: 'on',
+    trace: 'retain-on-failure',
+  },
+  projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
+  webServer: process.env.BASE_URL
+    ? undefined
+    : {
+        command: '${app.command}',
+        url: 'http://localhost:${app.port}',
+        reuseExistingServer: true,
+        timeout: 120000,
+      },
+})
+`
+
+const SMOKE_TEST = `import { expect, test } from '@playwright/test'
+
+// Set up by tspl init: keeps the browser check meaningful before any task adds its own tests.
+test('smoke: the home page loads', async ({ page }) => {
+  await page.goto('/')
+  await expect(page.locator('body')).toBeVisible()
+  await page.screenshot({ path: test.info().outputPath('home.png'), fullPage: true })
+})
+`
+
+const GITIGNORE_LINES = ['/test-results/', '/playwright-report/', '/blob-report/', '/playwright/.cache/']
+
+const ignoreOutputs = dir => {
+  const file = Path.join(dir, '.gitignore')
+  const current = Fs.existsSync(file) ? Fs.readFileSync(file, 'utf8') : ''
+  const lines = new Set(current.split('\n').map(line => line.trim()))
+  const missing = GITIGNORE_LINES.filter(line => !lines.has(line) && !lines.has(line.replace(/^\//, '')))
+  if (!missing.length) return
+  Fs.writeFileSync(file, `${current.trimEnd()}${current.trim() ? '\n\n' : ''}# Playwright (added by tspl init)\n${missing.join('\n')}\n`)
+}
+
+const VITEST_CONFIG = `import { configDefaults, defineConfig } from 'vitest/config'
+
+// Set up by tspl init: browser tests in e2e/ run with Playwright, not with the unit test runner.
+export default defineConfig({
+  test: {
+    exclude: [...configDefaults.exclude, 'e2e/**'],
+  },
+})
+`
+
+const hasFile = (dir, pattern) => {
+  try {
+    return Fs.readdirSync(dir).some(name => pattern.test(name))
+  } catch (err) {
+    return false
+  }
+}
+
+/**
+ * Vitest and Jest both pick up *.spec.ts by default, so they would also run (and fail on) the Playwright tests in e2e/.
+ * Adds the exclusion where tspl can do it without rewriting a config the project wrote itself; otherwise says what to add.
+ */
+const separateUnitTests = (dir, log = console.log) => {
+  if (!Fs.existsSync(Path.join(dir, 'e2e'))) return []
+  const pkgFile = Path.join(dir, 'package.json')
+  const pkg = readJson(pkgFile) || {}
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies }
+  const changed = []
+  if (deps.vitest) {
+    if (hasFile(dir, /^vitest\.config\.[cm]?[jt]s$/) || hasFile(dir, /^vite\.config\.[cm]?[jt]s$/)) {
+      const existing = Fs.readdirSync(dir).find(name => /^vite(st)?\.config\.[cm]?[jt]s$/.test(name))
+      if (!/e2e/.test(Fs.readFileSync(Path.join(dir, existing), 'utf8'))) {
+        log(`  ! Add 'e2e/**' to test.exclude in ${existing} so Vitest does not run the Playwright tests.`)
+      }
+    } else {
+      Fs.writeFileSync(Path.join(dir, 'vitest.config.ts'), VITEST_CONFIG)
+      changed.push('vitest.config.ts')
+    }
+  }
+  if (deps.jest || deps['ts-jest']) {
+    if (hasFile(dir, /^jest\.config\.[cm]?[jt]s(on)?$/)) {
+      const existing = Fs.readdirSync(dir).find(name => /^jest\.config\./.test(name))
+      if (!/e2e/.test(Fs.readFileSync(Path.join(dir, existing), 'utf8'))) {
+        log(`  ! Add '<rootDir>/e2e/' to testPathIgnorePatterns in ${existing} so Jest does not run the Playwright tests.`)
+      }
+    } else {
+      const jest = pkg.jest || {}
+      const ignore = jest.testPathIgnorePatterns || ['/node_modules/']
+      if (!ignore.some(item => /e2e/.test(item))) {
+        pkg.jest = { ...jest, testPathIgnorePatterns: [...ignore, '<rootDir>/e2e/'] }
+        Fs.writeFileSync(pkgFile, `${JSON.stringify(pkg, null, 2)}\n`)
+        changed.push('package.json')
+      }
+    }
+  }
+  return changed
+}
+
+const defaultRun = (cmd, args, cwd) => {
+  const result = spawnSync(cmd, args, { cwd, stdio: 'inherit', shell: process.platform === 'win32' })
+  return result.status === 0
+}
+
+/**
+ * Gives a web app browser tests so test cases get real screenshots: installs Playwright and Chromium,
+ * writes a config that screenshots every test and starts the dev server, and adds one smoke test.
+ * Never touches a package that already has a Playwright config; a half-finished setup (package installed, no config)
+ * is completed. Returns what happened, never throws for a failed install.
+ */
+const ensureBrowserTests = (dir, manager, run = defaultRun, log = console.log) => {
+  if (hasPlaywright(dir)) {
+    const separated = separateUnitTests(dir, log)
+    return separated.length ? { status: 'separated', files: separated } : { status: 'present' }
+  }
+  const app = webApp(dir, manager)
+  if (!app) return { status: 'not-web' }
+  log(`Setting up browser tests (Playwright) for this ${app.framework} app in ${dir}`)
+  const [cmd, args] = installCommand(manager)
+  if (!hasDependency(dir) && !run(cmd, args, dir)) return { status: 'failed', reason: `${cmd} ${args.join(' ')} failed` }
+  if (!run('npx', ['playwright', 'install', 'chromium'], dir)) return { status: 'failed', reason: 'npx playwright install chromium failed' }
+  const config = Path.join(dir, 'playwright.config.ts')
+  if (!Fs.existsSync(config)) Fs.writeFileSync(config, configFile(app))
+  const smoke = Path.join(dir, 'e2e', 'smoke.spec.ts')
+  if (!Fs.existsSync(Path.join(dir, 'e2e'))) {
+    Fs.mkdirSync(Path.dirname(smoke), { recursive: true })
+    Fs.writeFileSync(smoke, SMOKE_TEST)
+  }
+  ignoreOutputs(dir)
+  separateUnitTests(dir, log)
+  return { status: 'installed', framework: app.framework }
+}
+
+module.exports = {
+  ensureBrowserTests,
+  webApp,
+  hasPlaywright,
+  separateUnitTests,
+  PLAYWRIGHT_VERSION,
+}

package/src/commands/analyze.command.js

@@ -0,0 +1,81 @@
+'use strict'
+
+const { setupProject } = require('../workspace')
+const { refreshIndex, describeRepo } = require('../analysis/analyzer')
+
+const LABELS = [
+  ['routes', 'API routes'],
+  ['models', 'models'],
+  ['uiRoutes', 'UI routes'],
+  ['screens', 'app screens'],
+  ['components', 'components'],
+  ['httpCalls', 'API calls'],
+]
+
+const SKIPPED = [
+  ['skipped-secret', 'secret'],
+  ['skipped-binary', 'binary'],
+  ['skipped-generated', 'generated'],
+  ['skipped-large', 'too large'],
+]
+
+const describe = result => {
+  const { stats } = result
+  const found = LABELS.filter(([key]) => stats[key]).map(([key, label]) => `${stats[key]} ${label}`)
+  const skipped = SKIPPED.filter(([key]) => stats.byStatus[key]).map(([key, label]) => `${stats.byStatus[key]} ${label}`)
+  const reused = result.codeFiles - result.newlyAnalyzed
+  return [
+    `${result.branch}@${result.commitSha.slice(0, 7)} (${result.date})`,
+    `${result.codeFiles} code files${reused ? ` (${reused} unchanged, reused)` : ''}`,
+    found.length ? found.join(', ') : 'no structure found',
+    skipped.length ? `skipped: ${skipped.join(', ')}` : null,
+  ]
+    .filter(Boolean)
+    .join('  ·  ')
+}
+
+const analyze = async options => {
+  const setup = await setupProject(process.cwd(), {})
+  if (!setup) {
+    return
+  }
+
+  const { project } = setup
+  const repos = options.repo
+    ? setup.linked.filter(repo => repo.name === options.repo)
+    : setup.linked
+  if (!repos.length) {
+    throw new Error(options.repo ? `"${options.repo}" is not linked in this folder` : 'No linked repos to analyze')
+  }
+
+  const started = Date.now()
+  let failed = 0
+  console.log(`Reading ${repos.length} repo(s) of ${project.name}. No AI is used in this step.\n`)
+  const fail = (repo, err) => {
+    failed += 1
+    const hint = /branch ".*" not found/.test(err.message)
+      ? ` Fix it with: tspl project set-branch ${project.slug} ${repo.name} <branch>`
+      : ''
+    console.log(`  ✗ ${repo.name.padEnd(22)} ${err.message}.${hint}`)
+  }
+  const index = await refreshIndex(project, setup.linked, (repo, repoIndex, err) => {
+    if (err && repos.includes(repo)) fail(repo, err)
+  })
+  repos.filter(repo => index.repos[repo._id]).forEach(repo => {
+    console.log(`  ✓ ${repo.name.padEnd(22)} ${describe(describeRepo(index.repos[repo._id]))}`)
+  })
+
+  const seconds = ((Date.now() - started) / 1000).toFixed(1)
+  console.log(`\nDone in ${seconds}s${failed ? ` (${failed} failed)` : ''}. AI tokens used: 0.`)
+  console.log('The map stays on this computer (~/.tspl/index) and refreshes itself when tspl is used; you rarely need this command.')
+}
+
+module.exports = {
+  register(program) {
+    program
+      .command('analyze')
+      .description('Read the code of the project in this folder (no AI, no tokens)')
+      .option('--repo <name>', 'only this repo')
+      .action(analyze)
+  },
+}

package/src/commands/auth.command.js

@@ -0,0 +1,250 @@
+'use strict'
+
+const Os = require('os')
+const { input, password, select } = require('@inquirer/prompts')
+const { CLIENT_TYPES } = require('../shared')
+
+const { send, request, originOf } = require('../api-client')
+const {
+  readConfig,
+  writeConfig,
+  readCredentials,
+  writeCredentials,
+  clearCredentials,
+  listAccounts,
+  accountFor,
+  saveAccount,
+  forgetAccount,
+} = require('../config-store')
+
+const readStdin = async () => {
+  const chunks = []
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk)
+  }
+  return Buffer.concat(chunks).toString('utf8').replace(/\r?\n$/, '')
+}
+
+const login = async options => {
+  const config = readConfig()
+  const target = options.api ? options.api.replace(/\/+$/, '') : config.apiUrl
+  const moving = originOf(target) !== originOf(config.apiUrl)
+
+  const email = options.email || (await input({ message: 'Email:' }))
+  const secret =
+    options.password ||
+    (options.passwordStdin ? await readStdin() : await password({ message: 'Password:', mask: '*' }))
+
+  const attempt = org =>
+    send(target, 'POST', '/api/v1/auth/login', {
+      email,
+      password: secret,
+      org,
+      client: CLIENT_TYPES.CLI,
+      deviceName: Os.hostname(),
+    })
+  let result
+  try {
+    result = await attempt(options.org)
+  } catch (err) {
+    const listed = /several organizations.*org:\s*(.+)$/i.exec(err.message)
+    if (!listed || options.org || !process.stdin.isTTY) throw err
+    const choices = listed[1].split(',').map(item => item.trim()).filter(Boolean)
+    result = await attempt(await select({ message: 'You belong to several organizations. Log in to which one?', choices: choices.map(value => ({ name: value, value })) }))
+  }
+
+  // Saved logins belong to one API address. They are dropped only once the new address has accepted a login,
+  // so a wrong password never signs you out of the server you were using.
+  if (moving) {
+    clearCredentials()
+    listAccounts().forEach(forgetAccount)
+  }
+  config.apiUrl = target
+  writeConfig(config)
+  const credentials = {
+    apiUrl: config.apiUrl,
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    email: result.user.email,
+    organization: result.organization.slug,
+  }
+  writeCredentials(credentials)
+  saveAccount(credentials)
+
+  console.log(
+    `Logged in as ${result.user.email} (${result.role}) in ${result.organization.name}`,
+  )
+  if (result.user.passwordChangeRequired) {
+    console.log('You are using a temporary password. Set your own now: tspl password')
+  }
+  return result
+}
+
+/** No email is sent: the server sets a random temporary password and tells it to the person asking. */
+const forgotPassword = async options => {
+  const config = readConfig()
+  const target = options.api ? options.api.replace(/\/+$/, '') : config.apiUrl
+  const email = options.email || (await input({ message: 'Email of the account:' }))
+  const result = await send(target, 'POST', '/api/v1/auth/forgot-password', { email })
+  console.log(`Temporary password for ${result.email}: ${result.temporaryPassword}`)
+  console.log('The old password no longer works, and the account was signed out everywhere.')
+  console.log(`Log in with it, then choose your own: tspl login --api ${target} --email ${result.email}`)
+}
+
+const changePassword = async () => {
+  const currentPassword = await password({ message: 'Current password:', mask: '*' })
+  const newPassword = await password({ message: 'New password:', mask: '*' })
+  const repeat = await password({ message: 'New password again:', mask: '*' })
+  if (newPassword !== repeat) {
+    throw new Error('The two new passwords are different')
+  }
+  await request('PUT', '/api/v1/auth/password', { currentPassword, newPassword })
+  console.log('Password changed. Your other sessions were logged out.')
+}
+
+const logout = async (options = {}) => {
+  if (options.all) {
+    for (const account of listAccounts()) {
+      try {
+        await send(account.apiUrl || readConfig().apiUrl, 'POST', '/api/v1/auth/logout', undefined, account.accessToken)
+      } catch (err) {
+        // an expired or unreachable session ends by itself
+      }
+      forgetAccount(account)
+    }
+    clearCredentials()
+    console.log('Logged out of every account on this computer.')
+    return
+  }
+  const credentials = readCredentials()
+  if (credentials.accessToken) {
+    try {
+      await request('POST', '/api/v1/auth/logout')
+    } catch (err) {
+      if (err.statusCode !== 401) {
+        throw err
+      }
+    }
+  }
+  const { email, organization } = readCredentials()
+  clearCredentials()
+  console.log(email ? `Logged out ${email} (${organization}).` : 'Logged out')
+  const others = listAccounts()
+  if (others.length) console.log(`Other saved logins: ${others.map(item => `${item.email} (${item.organization})`).join(', ')}. Switch with: tspl account`)
+}
+
+const whoami = async () => {
+  const me = await request('GET', '/api/v1/auth/me')
+  const { apiUrl } = readConfig()
+  console.log(`${me.user.name} <${me.user.email}>`)
+  console.log(`Organization: ${me.organization.name} (${me.organization.slug})`)
+  console.log(`Role: ${me.role}`)
+  console.log(`API: ${apiUrl}`)
+}
+
+const sameServer = (a, b) => originOf(a || '') === originOf(b || '')
+
+const onThisServer = () => listAccounts().filter(account => sameServer(account.apiUrl, readConfig().apiUrl))
+
+const label = account => `${account.email} · ${account.organization}`
+
+const listOrganizations = () => {
+  const current = readCredentials()
+  const accounts = onThisServer()
+  if (!accounts.length) {
+    console.log('No saved logins. Log in: tspl login')
+    return
+  }
+  accounts.forEach(account => {
+    const using = account.organization === current.organization && account.email === current.email
+    console.log(`${using ? '*' : ' '} ${account.organization.padEnd(24)} ${account.email}`)
+  })
+  console.log('Switch with: tspl account')
+}
+
+const switchTo = account => {
+  writeCredentials(account)
+  console.log(`Now using ${account.email} in ${account.organization}. Project folders of other organizations still use their own login.`)
+}
+
+const useOrganization = target => {
+  const accounts = onThisServer()
+  const account = accounts.find(item => `${item.organization}|${item.email}` === target || item.email === target) || accountFor(target)
+  if (!account || !sameServer(account.apiUrl, readConfig().apiUrl)) {
+    throw new Error(`No saved login for "${target}" on this API. Log in: tspl login`)
+  }
+  switchTo(account)
+}
+
+/** One place to switch account, add one, or log out. */
+const account = async () => {
+  const current = readCredentials()
+  const accounts = onThisServer()
+  const using = item => item.organization === current.organization && item.email === current.email
+  console.log(current.email ? `Using ${label(current)} on ${readConfig().apiUrl}` : `Not logged in (${readConfig().apiUrl})`)
+  const choice = await select({
+    message: 'What do you want to do?',
+    choices: [
+      ...accounts.filter(item => !using(item)).map(item => ({ name: `Switch to ${label(item)}`, value: { switch: item } })),
+      { name: 'Log in with another account', value: 'login' },
+      ...(current.email ? [{ name: `Log out ${label(current)}`, value: 'logout' }] : []),
+      ...(accounts.length > 1 ? [{ name: 'Log out of every account', value: 'logout-all' }] : []),
+      { name: 'Cancel', value: 'cancel' },
+    ],
+  })
+  if (choice === 'cancel') return
+  if (choice === 'login') return login({})
+  if (choice === 'logout') return logout({})
+  if (choice === 'logout-all') return logout({ all: true })
+  switchTo(choice.switch)
+}
+
+module.exports = {
+  login,
+  forgotPassword,
+  register(program) {
+    program
+      .command('login')
+      .description('Log in to the TSPL API')
+      .option('--api <url>', 'TSPL API address, saved for next time')
+      .option('--email <email>', 'your email')
+      .option('--org <slug>', 'organization, if you belong to several')
+      .option('--password-stdin', 'read the password from standard input')
+      .action(login)
+
+    program
+      .command('logout')
+      .description('Log out the account in use (--all: every saved account)')
+      .option('--all', 'log out of every account saved on this computer')
+      .action(logout)
+
+    const accountCommand = program
+      .command('account')
+      .alias('switch')
+      .description('Switch account, log in with another one, or log out')
+      .action(account)
+    accountCommand.command('list').description('Saved logins; * is the one in use').action(listOrganizations)
+    accountCommand.command('use <email-or-organization>').description('Switch without the menu').action(useOrganization)
+
+    program
+      .command('password')
+      .description('Change your password')
+      .action(changePassword)
+
+    program
+      .command('forgot-password')
+      .description('Forgot your password? Get a random temporary one (no email is sent); you choose your own at the next login')
+      .option('--api <url>', 'TSPL API address (default: the one in use)')
+      .option('--email <email>', 'the email of the account')
+      .action(forgotPassword)
+
+    const org = program.command('org').description('Organizations you are logged in to (one person can belong to several)').action(listOrganizations)
+    org.command('list').description('Saved logins; * is the one in use').action(listOrganizations)
+    org.command('use <organization>').description('Switch to another organization you already logged in to').action(useOrganization)
+
+    program
+      .command('whoami')
+      .description('Show who is logged in')
+      .action(whoami)
+  },
+}