switch-profile 2.3.1 → 2.5.0

package/README.md

@@ -21,7 +21,7 @@ npx switch-profile
 │  ○ globex-dev      ReadOnly  333333333333  us-east-1
 │  ○ initech-dev     Admin     444444444444  eu-west-1
 │
-│  [Log in] [Add] [Remove] [Log out] [Settings]
+│  [Log in] [Add] [Portals] [Rename] [Remove] [Log out] [Settings]
 └  ↑↓ choose · enter switch · tab actions · esc quit
 ```
 
@@ -100,8 +100,9 @@ No profiles yet? `switch-profile` starts the **Add profiles** flow. To import ev
 Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 
 - **Type and press Enter** to switch. That's the whole path for everyday use.
-- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
+- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Portals**, **Rename**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
 - **Every action opens as a page and comes back** to the home screen when it's done. **Esc** goes back from a page, and quits from the home screen.
+- **When something fails, it stops and tells you.** An error screen says what failed, what AWS answered, why, and which SSO portal (start URL and region) was involved. Then it asks what to do: fix the portal's region in one step, edit the portal, try again, or go back.
 - A switch ends the session, which is what lets `sp` set `AWS_PROFILE` in your terminal.
 
 ## Commands
@@ -115,7 +116,9 @@ Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 | `logout [--yes]` | Ends every SSO session on this machine (`aws sso logout`, plus `aws logout --all` on AWS CLI 2.32+). |
 | `add` | Adds profiles: import accounts from an SSO portal (recommended), a single SSO profile, a console sign-in profile, or access keys. |
 | `add --from-sso [session]` | Imports or re-syncs every account and role of an `[sso-session]`. Options: `--region`, `--prefix`, `--prune`, `--yes`. |
+| `rename [profile] [new-name]` | Renames a profile (alias `mv`), for example an imported `acme-prod-workloads-administratoraccess` to `acme-prod`. Also updates `source_profile` references, the default profile and the home screen order. SSO logins are kept. Scripts, terminals and tools that use the old name need the new one. |
 | `remove [profiles...] [--yes]` | Removes profiles (alias `rm`). The current default cannot be removed. |
+| `portals [name]` | Lists your SSO portals (`[sso-session]`) and edits one in place: start URL and SSO region (alias `portal`). Flags a portal whose region differs from the one its portal page names, and fixes it in one step. `--region` / `--start-url` edit without prompting; `--json` lists them (`--check` adds the region read from each portal). |
 | `settings` | Per-terminal switching, SSO login mode, legacy SSO upgrade. |
 
 Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. Every run, AWS CLI call and error is logged to `~/.switch-profile/switch-profile.log` (secrets redacted). In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
@@ -155,7 +158,7 @@ sp add          # then choose "Accounts from an SSO portal"
 
 1. Pick an existing `[sso-session]` or create one: start URL (e.g. `https://acme.awsapps.com/start`), SSO region (where Identity Center lives, not where you deploy), and a short name, usually the client.
 2. Log in if needed.
-3. `switch-profile` lists every account and role you can access, then asks for a default region and a name prefix. Profiles are named `<prefix>-<account-name>-<role>`, for example `acme-prod-workloads-admin`.
+3. `switch-profile` lists every account and role you can access, then asks for a default region and a name prefix. Profiles are named `<prefix>-<account-name>-<role>`, for example `acme-prod-workloads-admin`. Rename any of them later with `sp rename` (re-imports still recognize them).
 4. A preview shows the new profiles, the ones already set up, and the ones that no longer exist. Then pick the new profiles to add: all are selected, so press Enter to add everything, or untick the ones you don't want (type to search by name, account or role).
 
 Run it again later to pick up new accounts. Account/role pairs that already have a profile are never duplicated, whatever its name. Generated profiles that no longer exist can be pruned (after a backup); profiles you wrote by hand are never pruned.
@@ -241,6 +244,8 @@ The SSO region is wrong. It must be the region of your IAM Identity Center insta
 
 The start URL is usually fine: AWS sends this error when the **SSO region** is wrong. Use the region where IAM Identity Center lives (Identity Center console › Settings), not where you deploy. If the portal is already set up, type its existing session name instead (`sp add` lists them with their regions).
 
+When importing from a portal (`sp add` > Accounts from an SSO portal) or switching to one of its profiles, the same mistake shows as `Invalid request` during the login. `switch-profile` reads the portal's real region from its start page and offers to fix the saved portal. You can also check and fix every portal any time with `sp portals` (or **Portals** on the home screen).
+
 ### Something failed and the message is not enough
 
 Open `~/.switch-profile/switch-profile.log`. It has every run, every AWS CLI call with its exit code and output, and every error with its full chain. Secrets are redacted, so you can share it.

package/dist/cli.js

@@ -5419,7 +5419,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.3.1",
+      version: "2.5.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5602,6 +5602,9 @@ var require_ini = __commonJS({
         return str;
       let newline = detectNewline(str);
       return tidy(stringify(blocks.filter((b3) => b3.name !== name), newline), newline);
+    }, renameSection = (str, name, newName) => {
+      let blocks = parse(str), block2 = findBlock(blocks, name);
+      return block2 ? (block2.lines[0] = `[${newName}]`, stringify(blocks, detectNewline(str))) : str;
     }, setKeys = (str, name, changes) => {
       let blocks = parse(str), block2 = findBlock(blocks, name);
       if (!block2)
@@ -5636,6 +5639,7 @@ var require_ini = __commonJS({
       getSection,
       setSection,
       removeSection,
+      renameSection,
       setKeys
     };
   }
@@ -5755,14 +5759,35 @@ var require_transforms = __commonJS({
         for (let name of stale)
           config = ini.removeSection(config, configSectionName(config, name)), removed.push(name);
       return { config, added, addedEntries, existing, stale, removed };
+    }, escapeRegex = (text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), renameProfile = (configStr, credsStr, from, to) => {
+      let section = from == "default" ? null : configSectionName(configStr, from);
+      if (!section)
+        throw new Error(`Profile ${from} not found in ~/.aws/config.`);
+      if (to == "default" || configSectionName(configStr, to) || ini.getSection(credsStr, to))
+        throw new Error(`Profile ${to} already exists.`);
+      let config = ini.renameSection(configStr, section, `profile ${to}`), creds = ini.renameSection(credsStr, from, to), sources = [], processes = [], mentions = new RegExp(`--profile[\\s=]+["']?${escapeRegex(from)}(?=["'\\s]|$)`);
+      for (let s of ini.listSections(config).filter((s2) => s2 != "default" && !s2.startsWith("sso-session "))) {
+        let params = ini.getSection(config, s), name = s.replace(/^profile\s+/, "");
+        params.source_profile == from && (config = ini.setKeys(config, s, { source_profile: to }), sources.push(name)), params.credential_process && mentions.test(params.credential_process) && processes.push(name);
+      }
+      let defaults = ini.getSection(config, "default") || {}, wasDefault = defaults[NAME_KEY] == from;
+      return wasDefault && (config = ini.setKeys(config, "default", { [NAME_KEY]: to, ...defaults.source_profile == from ? { source_profile: to } : {} })), { config, creds, sources, wasDefault, processes };
     }, listSsoSessions = (configStr) => ini.listSections(configStr).filter((s) => s.startsWith("sso-session ")).map((s) => ({ name: s.replace(/^sso-session\s+/, ""), ...ini.getSection(configStr, s) })), addSsoSession = (configStr, { name, startUrl, region, version }) => ini.getSection(configStr, `sso-session ${name}`) ? configStr : ini.setSection(configStr, `sso-session ${name}`, [
       ["sso_start_url", startUrl],
       ["sso_region", region],
       ["sso_registration_scopes", SSO_SCOPES],
       [VERSION_KEY, version]
-    ]);
+    ]), updateSsoSession = (configStr, { name, startUrl, region, version }) => {
+      let section = `sso-session ${name}`;
+      return ini.getSection(configStr, section) ? ini.setKeys(configStr, section, {
+        ...startUrl ? { sso_start_url: startUrl } : {},
+        ...region ? { sso_region: region } : {},
+        [VERSION_KEY]: version
+      }) : configStr;
+    };
     module2.exports = {
       GENERATED_KEY,
+      updateSsoSession,
       ACCOUNT_NAME_KEY,
       generatedProfileName,
       populateSsoProfiles,
@@ -5781,7 +5806,8 @@ var require_transforms = __commonJS({
       sessionNameFromUrl,
       upgradeLegacySsoProfiles,
       stampProfile,
-      listProfiles
+      listProfiles,
+      renameProfile
     };
   }
 });
@@ -5799,13 +5825,22 @@ var require_login = __commonJS({
       text2 = text2 || "";
       let urls = text2.match(URL_REGEX) || [], code = (text2.match(CODE_REGEX) || [])[1] || null, completeUrl = urls.find((u5) => /user_code=/.test(u5)) || null;
       return { url: urls.find((u5) => u5 !== completeUrl) || completeUrl || null, code, completeUrl };
-    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, configureSsoFailure = (output, sessions) => {
+    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, isWrongSsoRegion = (output) => WRONG_REGION.test(output || ""), PORTAL_REGION = /portal\.sso\.([a-z]{2}(?:-[a-z]+)+-\d+)\.amazonaws\.com/, portalRegionFromHeaders = (values) => {
+      for (let v of values || []) {
+        let m3 = (v || "").match(PORTAL_REGION);
+        if (m3)
+          return m3[1];
+      }
+      return null;
+    }, configureSsoFailure = (output, sessions) => {
       let lines = (output || "").split(`
 `).map((l2) => l2.trim()).filter(Boolean), detail = (lines.filter((l2) => /error/i.test(l2)).slice(-1)[0] || lines.slice(-1)[0] || "").replace(/^aws:\s*\[ERROR\]:\s*/i, ""), description = ((output || "").match(/error_description:\s*(.+)/) || [])[1], known = (sessions || []).filter((s) => s.sso_region).map((s) => `${s.name} (${s.sso_region}, ${s.sso_start_url})`), reuse = known.length ? ` Portals already set up here: ${known.join(", ")}. Type one of these names as the session name to reuse it.` : "", message = `aws configure sso failed${description || detail ? `: ${(description || detail).trim()}` : "."}`;
-      return WRONG_REGION.test(output || "") ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
+      return isWrongSsoRegion(output) ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
     };
     module2.exports = {
       configureSsoFailure,
+      isWrongSsoRegion,
+      portalRegionFromHeaders,
       isRemoteSession,
       resolveLoginMode,
       loginFlags,
@@ -5926,7 +5961,7 @@ var require_regions = __commonJS({
 // src/aws/index.js
 var require_aws = __commonJS({
   "src/aws/index.js"(exports2, module2) {
-    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
+    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast, portalRegionFromHeaders } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
 ` : EOL, AWS_CONFIG_FILE = join2(homedir(), ".aws", "config"), AWS_CREDS_FILE = join2(homedir(), ".aws", "credentials"), AWS_SSO_FOLDER = join2(homedir(), ".aws", "sso", "cache"), awsExists = isCommandExist("aws"), _awsCliVersion = null, whichAws = () => exec2(`${process.platform == "win32" ? "where" : "which"} aws`).then((out) => (out || "").split(/\r?\n/)[0].trim(), () => null), getAwsCliVersion = async () => {
       if (_awsCliVersion)
         return _awsCliVersion;
@@ -6029,6 +6064,18 @@ var require_aws = __commonJS({
     }, readSsoToken = async ({ ssoSession, startUrl }) => {
       let key = crypto.createHash("sha1").update(ssoSession || startUrl).digest("hex"), token = await fs.promises.readFile(join2(AWS_SSO_FOLDER, `${key}.json`), "utf8").then(JSON.parse).catch(() => null);
       return !token || !token.accessToken || new Date(token.expiresAt).getTime() < Date.now() + 60 * 1e3 ? null : token;
+    }, detectSsoRegion = async (startUrl, { timeoutMs = 5e3 } = {}) => {
+      let started = Date.now();
+      try {
+        let url = new URL(startUrl);
+        url.hash = "";
+        let res = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(timeoutMs) });
+        await res.body?.cancel();
+        let region = portalRegionFromHeaders([res.headers.get("link"), res.headers.get("content-security-policy")]);
+        return log3.info(`SSO region of ${url} \u2192 ${region || "not found"} (HTTP ${res.status} in ${Date.now() - started}ms)`), region;
+      } catch (err) {
+        return log3.tolerated(`SSO region lookup of ${startUrl}`, null)(err);
+      }
     }, listSsoAccounts = async (accessToken, region) => {
       let data = await run2("aws", ["sso", "list-accounts", "--access-token", accessToken, "--region", region, "--output", "json"]);
       return (JSON.parse(data).accountList || []).map((a2) => ({ accountId: a2.accountId, accountName: a2.accountName }));
@@ -6078,6 +6125,16 @@ var require_aws = __commonJS({
         configStr = deleteProfileFromConfig(profile, configStr), credsStr = deleteProfileFromCreds(profile, credsStr);
       }
       updateConfig && await writeAwsFile(AWS_CONFIG_FILE, configStr), updateCreds && await writeAwsFile(AWS_CREDS_FILE, credsStr);
+    })()), renameProfile = (from, to) => catchErrors((async () => {
+      let errMsg = `Fail to rename profile ${from} to ${to}`, [configStrErrors, configStr] = await getConfigFile(), [credsStrErrors, credsStr] = await getCredsFile();
+      if (configStrErrors || credsStrErrors)
+        throw wrapErrors(errMsg, configStrErrors || credsStrErrors);
+      try {
+        let { config, creds, sources, wasDefault, processes } = transforms.renameProfile(configStr, credsStr, from, to);
+        return await writeAwsFiles({ config, creds }), { sources, wasDefault, processes };
+      } catch (err) {
+        throw wrapErrors(errMsg, [err]);
+      }
     })()), createProfile = ({ name, aws_access_key_id, aws_secret_access_key, region }) => catchErrors((async () => {
       await awsCliV2Exists();
       let errMsg = "Fail to create AWS profile";
@@ -6128,6 +6185,7 @@ var require_aws = __commonJS({
       awsLogin,
       logoutAll,
       readSsoToken,
+      detectSsoRegion,
       listSsoAccounts,
       listSsoRoles,
       getSsoLoginStatus,
@@ -6135,6 +6193,7 @@ var require_aws = __commonJS({
       getDefaultProfile,
       setDefaultProfile,
       deleteProfiles,
+      renameProfile,
       createProfile,
       createSsoProfile,
       backupAwsFiles,
@@ -6151,7 +6210,7 @@ var require_aws = __commonJS({
 // src/shell.js
 var require_shell = __commonJS({
   "src/shell.js"(exports2, module2) {
-    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use", "rename", "portals"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
 	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
@@ -6171,7 +6230,7 @@ var require_shell = __commonJS({
 	items=(\${(f)"$(${PROFILES_SED} "\${AWS_CONFIG_FILE:-$HOME/.aws/config}" 2>/dev/null)"})
 	if (( CURRENT == 2 )); then
 		compadd -- $items ${SUBCOMMANDS.join(" ")}
-	elif [[ $words[2] == (remove|rm) ]] || { (( CURRENT == 3 )) && [[ $words[2] == (use|login) ]] }; then
+	elif [[ $words[2] == (remove|rm) ]] || { (( CURRENT == 3 )) && [[ $words[2] == (use|login|rename|mv) ]] }; then
 		compadd -- $items
 	fi
 }
@@ -6182,7 +6241,7 @@ fi`, BASH_COMPLETION = `_switch_profile_complete() {
 	items="$(${PROFILES_SED} "\${AWS_CONFIG_FILE:-$HOME/.aws/config}" 2>/dev/null)"
 	if [ "$COMP_CWORD" -eq 1 ]; then
 		items="$items ${SUBCOMMANDS.join(" ")}"
-	elif [ "$COMP_CWORD" -lt 2 ] || ! case "\${COMP_WORDS[1]}" in use|login|remove|rm) true ;; *) false ;; esac; then
+	elif [ "$COMP_CWORD" -lt 2 ] || ! case "\${COMP_WORDS[1]}" in use|login|rename|mv|remove|rm) true ;; *) false ;; esac; then
 		return 0
 	elif [ "$COMP_CWORD" -gt 2 ] && [ "\${COMP_WORDS[1]}" != remove ] && [ "\${COMP_WORDS[1]}" != rm ]; then
 		return 0
@@ -6211,7 +6270,7 @@ function __switch_profile_profiles
 end
 for __sp_cmd in ${FUNCTION_NAME} switch-profile
 	complete -c $__sp_cmd -f -n 'test (count (commandline -opc)) -eq 1' -a '(__switch_profile_profiles) ${SUBCOMMANDS.join(" ")}'
-	complete -c $__sp_cmd -f -n 'test (count (commandline -opc)) -eq 2; and __fish_seen_subcommand_from use login' -a '(__switch_profile_profiles)'
+	complete -c $__sp_cmd -f -n 'test (count (commandline -opc)) -eq 2; and __fish_seen_subcommand_from use login rename mv' -a '(__switch_profile_profiles)'
 	complete -c $__sp_cmd -f -n '__fish_seen_subcommand_from remove rm' -a '(__switch_profile_profiles)'
 end`, POWERSHELL_FUNCTION = `function ${FUNCTION_NAME} {
 	param([Parameter(ValueFromRemainingArguments = $true)] [string[]] $Rest)
@@ -6467,9 +6526,15 @@ var require_common = __commonJS({
         return { text: null, needsLogin: !1 };
       let [, login] = await aws.getSsoLoginStatus(profile.sso_start_url), at = (state && state.settings.logins || {})[loginKey(profile)], since = at ? ui2.dim(`logged in ${ui2.ago(at)}`) : null, s = login ? login.state : "none";
       return s == "refreshable" ? { text: ui2.join([ui2.ok(`SSO ${ui2.sym.ok}`) + " auto-refresh", since]), needsLogin: !1 } : s == "active" ? { text: ui2.join([ui2.ok(`SSO ${ui2.sym.ok}`) + ` ${Math.round((login.expiresAt - Date.now()) / 6e4)} min left`, since]), needsLogin: !1 } : { text: ui2.warn(s == "expired" ? "SSO login expired" : "not logged in"), needsLogin: !0 };
-    };
+    }, chooseRegion = async (message, initialValue) => ask(p4.autocomplete({
+      message,
+      maxItems: 8,
+      initialValue,
+      options: aws.regions.map((r2) => ({ value: r2.code, label: r2.code, hint: r2.name }))
+    }));
     module2.exports = {
       CancelError: CancelError2,
+      chooseRegion,
       ask,
       preflight,
       upgradeLegacySso,
@@ -7484,7 +7549,7 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast, isWrongSsoRegion } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
@@ -7542,12 +7607,12 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
       spin && spin.error("Login did not complete");
       let lines = output.trim().split(`
 `).map((l2) => l2.trim()).filter(Boolean), detail = lines.filter((l2) => /error|exception|denied|invalid|expired|unable/i.test(l2)).slice(-2).join(`
-`) || lines.slice(-1)[0] || "";
-      throw new ui2.CliError(`SSO login for ${label} failed.${detail ? `
+`) || lines.slice(-1)[0] || "", wrongRegion = isWrongSsoRegion(output), error = new ui2.CliError(`SSO login for ${label} failed.${detail ? `
 ${detail}` : ""}`, {
         cause: Object.assign(new Error(`aws ${args.join(" ")} exited with code ${code}`), { output }),
-        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
+        hint: wrongRegion ? "The SSO region is most likely wrong: it must be the region where IAM Identity Center lives, not where you deploy. Check and fix it with: sp portals" : /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
       });
+      throw error.wrongRegion = wrongRegion, error.target = target, error;
     }, plainLogin = async (args, label) => {
       console.error(`Logging in to ${label}. Approve the request using the URL and code below.`), await new Promise((resolve, reject) => {
         let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
@@ -7568,6 +7633,93 @@ ${detail}` : ""}`, {
   }
 });
 
+// src/commands/portals.js
+var require_portals = __commonJS({
+  "src/commands/portals.js"(exports2, module2) {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), ui2 = require_ui(), { ask, chooseRegion } = require_common(), { ssoLogin } = require_login_flow(), validateStartUrl = (v) => /^https:\/\/\S+$/.test(v || "") ? void 0 : "Enter the https:// start URL of the portal.", validateRegion = (v) => aws.regions.some((r2) => r2.code == v) ? void 0 : `Unknown region ${v}.`, readConfig = async () => {
+      let [errors, configStr] = await aws.getConfigFile();
+      if (errors)
+        throw ui2.cliErrorFrom(errors);
+      return configStr;
+    }, listPortals = async (state, { detect } = {}) => {
+      let portals = transforms.listSsoSessions(await readConfig()).map((s) => ({
+        name: s.name,
+        startUrl: s.sso_start_url || null,
+        region: s.sso_region || null,
+        profiles: state.profiles.filter((x2) => x2.sso_session == s.name).map((x2) => x2.name)
+      }));
+      return detect && await Promise.all(portals.map(async (x2) => {
+        x2.detectedRegion = x2.startUrl ? await aws.detectSsoRegion(x2.startUrl, { timeoutMs: 4e3 }) : null;
+      })), portals;
+    }, findPortal = async (state, name) => {
+      let portal = (await listPortals(state)).find((x2) => x2.name == name);
+      if (!portal)
+        throw new ui2.CliError(`There is no SSO portal named ${name}.`, { code: 3, hint: "List them with: switch-profile portals" });
+      return portal;
+    }, regionMismatch = (region, detectedRegion) => !!(detectedRegion && region && detectedRegion != region), regionNote = ({ region, detectedRegion }) => regionMismatch(region, detectedRegion) ? ui2.join([region, ui2.warn(`${ui2.sym.warn} its portal is in ${detectedRegion}`)]) : detectedRegion ? ui2.join([region, ui2.dim("matches the portal")]) : region || ui2.warn("no region"), portalHint = (x2) => ui2.join([regionNote(x2), `${x2.profiles.length} profile${x2.profiles.length == 1 ? "" : "s"}`, x2.startUrl]), updatePortal = async (name, { startUrl, region }) => {
+      let configStr = await readConfig();
+      await aws.writeAwsFile(aws.AWS_CONFIG_FILE, transforms.updateSsoSession(configStr, { name, startUrl, region, version: settings2.CLI_VERSION }));
+    }, editPortal = async (name, state, { offerLogin = !0, detectedRegion } = {}) => {
+      let changed = !1, detected = detectedRegion;
+      for (; ; ) {
+        let portal = await findPortal(state, name);
+        detected === void 0 && (detected = portal.startUrl ? await aws.detectSsoRegion(portal.startUrl) : null);
+        let mismatch = regionMismatch(portal.region, detected);
+        p4.log.info([
+          ui2.strong(`Portal ${name}`),
+          `${ui2.dim("Start URL ")}  ${portal.startUrl || ui2.warn("missing")}`,
+          `${ui2.dim("SSO region")}  ${regionNote({ region: portal.region, detectedRegion: detected })}`,
+          detected ? null : ui2.dim("            (could not read the region from the portal page)"),
+          `${ui2.dim("Profiles  ")}  ${portal.profiles.length ? `${portal.profiles.slice(0, 4).join(", ")}${portal.profiles.length > 4 ? `, +${portal.profiles.length - 4} more` : ""}` : "none"}`
+        ].filter(Boolean).join(`
+`));
+        let choice = await ask(p4.select({
+          message: `Edit ${name}`,
+          options: [
+            ...mismatch ? [{ value: "fix", label: `Change the SSO region to ${detected}`, hint: "what the portal page says" }] : [],
+            { value: "url", label: "Start URL", hint: portal.startUrl || void 0 },
+            { value: "region", label: "SSO region", hint: portal.region || void 0 },
+            { value: "done", label: changed ? "Done" : "Back" }
+          ]
+        }));
+        if (choice == "done")
+          break;
+        if (choice == "fix")
+          await updatePortal(name, { region: detected }), p4.log.success(`${name} now uses the SSO region ${ui2.accent(detected)}`);
+        else if (choice == "url") {
+          let startUrl = (await ask(p4.text({ message: `Start URL of ${name}`, initialValue: portal.startUrl || "", validate: validateStartUrl }))).trim();
+          if (startUrl == portal.startUrl)
+            continue;
+          await updatePortal(name, { startUrl }), detected = void 0, p4.log.success(`${name} now uses ${ui2.accent(startUrl)}`);
+        } else {
+          let region = await chooseRegion(`SSO region of ${name} ${ui2.dim("(where IAM Identity Center lives)")}`, detected || portal.region);
+          if (region == portal.region)
+            continue;
+          await updatePortal(name, { region }), p4.log.success(`${name} now uses the SSO region ${ui2.accent(region)}`);
+        }
+        changed = !0;
+      }
+      return changed && offerLogin && await ask(p4.confirm({ message: `Log in to ${name} now to check it works?` })) && await ssoLogin({ ssoSession: name }, { label: name, loginKey: name, interactive: !0 }), { changed };
+    }, fixSsoRegion = async (session, loginError) => {
+      let current = session.sso_region, detected = await aws.detectSsoRegion(session.sso_start_url), region = null;
+      if (detected && detected != current ? (p4.log.warn(`${session.name} is set to the SSO region ${current}, but its portal is in ${detected}.`), await ask(p4.confirm({ message: `Change ${session.name} to ${detected} and log in again?` })) && (region = detected)) : p4.log.warn(`AWS rejected the SSO region of ${session.name} (${current}). Pick the region where IAM Identity Center lives (Identity Center console \u203A Settings).`), region || (region = await chooseRegion(`SSO region of ${session.name} ${ui2.dim("(where IAM Identity Center lives)")}`, detected || current)), region == current)
+        throw loginError;
+      return await updatePortal(session.name, { region }), region;
+    };
+    module2.exports = {
+      validateStartUrl,
+      validateRegion,
+      listPortals,
+      findPortal,
+      regionMismatch,
+      portalHint,
+      updatePortal,
+      editPortal,
+      fixSsoRegion
+    };
+  }
+});
+
 // src/home.js
 var require_home = __commonJS({
   "src/home.js"(exports2, module2) {
@@ -7632,10 +7784,63 @@ ${gray(S_BAR2)}`;
   }
 });
 
+// src/commands/recovery.js
+var require_recovery = __commonJS({
+  "src/commands/recovery.js"(exports2, module2) {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), portals = require_portals(), portalOfError = (err, profiles, sessions) => {
+      let target = err && err.target || {}, name = target.ssoSession || target.profile && ((profiles || []).find((x2) => x2.name == target.profile) || {}).sso_session, session = name && (sessions || []).find((s) => s.name == name);
+      return session ? { name: session.name, startUrl: session.sso_start_url || null, region: session.sso_region || null } : null;
+    }, recoveryOptions = ({ portal, wrongRegion, detectedRegion }) => [
+      portal && wrongRegion && portals.regionMismatch(portal.region, detectedRegion) ? { value: "fix-region", label: `Change the SSO region of ${portal.name} to ${detectedRegion}`, hint: `currently ${portal.region}` } : null,
+      portal ? { value: "edit-portal", label: `Edit the portal ${portal.name}`, hint: "start URL and SSO region" } : null,
+      { value: "retry", label: "Try again" },
+      { value: "back", label: "Back to the home screen" }
+    ].filter(Boolean), errorLines = (err, { portal, detectedRegion }) => [
+      ui2.strong(err.message || String(err)),
+      err.hint ? `
+${err.hint}` : null,
+      portal ? `
+${ui2.dim("Portal    ")}  ${portal.name}  ${ui2.dim(portal.startUrl || "")}` : null,
+      portal ? `${ui2.dim("SSO region")}  ${portal.region || "?"}${portals.regionMismatch(portal.region, detectedRegion) ? `  ${ui2.warn(`${ui2.sym.warn} its portal page says ${detectedRegion}`)}` : detectedRegion ? `  ${ui2.dim("(matches its portal page)")}` : ""}` : null,
+      `
+${ui2.dim(`Details: ${log3.displayPath()}`)}`
+    ].filter((v) => v !== null).join(`
+`), recover = async (err, state, what) => {
+      log3.error(`${what} failed (error screen)`, err);
+      let [, configStr] = await aws.getConfigFile(), portal = portalOfError(err, state.profiles, transforms.listSsoSessions(configStr || "")), detectedRegion = portal && err.wrongRegion && portal.startUrl ? await aws.detectSsoRegion(portal.startUrl) : null;
+      p4.log.error(errorLines(err, { portal, detectedRegion }));
+      let choice = await p4.select({ message: "What now?", options: recoveryOptions({ portal, wrongRegion: err.wrongRegion, detectedRegion }) });
+      if (p4.isCancel(choice) || choice == "back")
+        return "back";
+      try {
+        if (choice == "fix-region")
+          await portals.updatePortal(portal.name, { region: detectedRegion }), p4.log.success(`${portal.name} now uses the SSO region ${ui2.accent(detectedRegion)}. Trying again\u2026`);
+        else if (choice == "edit-portal") {
+          let { changed } = await portals.editPortal(portal.name, state, { offerLogin: !1, detectedRegion: err.wrongRegion ? detectedRegion : void 0 });
+          if (!changed)
+            return "back";
+        }
+      } catch (e) {
+        if (e instanceof CancelError2)
+          return "back";
+        if (!(e instanceof ui2.CliError))
+          throw e;
+        return log3.error("fixing the portal failed", e), ui2.printError(e), "back";
+      }
+      return "retry";
+    };
+    module2.exports = {
+      portalOfError,
+      recoveryOptions,
+      recover
+    };
+  }
+});
+
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), { recover } = require_recovery(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7661,6 +7866,8 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
     }, ACTIONS = [
       { key: "login", label: "Log in" },
       { key: "add", label: "Add" },
+      { key: "portals", label: "Portals" },
+      { key: "rename", label: "Rename" },
       { key: "remove", label: "Remove" },
       { key: "logout", label: "Log out" },
       { key: "settings", label: "Settings" }
@@ -7757,35 +7964,51 @@ ${ui2.dim("Tip: enable per-terminal switching in Settings.")}` : ""}`);
 ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned"));
     }, runAction = async (key, state, opts) => {
       let commands2 = require_commands();
-      return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
+      return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : key == "rename" ? commands2.rename(null, null, { ...opts, fromPicker: !0 }) : key == "portals" ? commands2.portals(null, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
     }, routeChoice = (choice) => {
       if (p4.isCancel(choice))
         return { type: "quit" };
       let value = String(choice);
       return value.startsWith(ACTION_PREFIX) ? { type: "page", key: value.slice(ACTION_PREFIX.length) } : { type: "switch", name: value };
-    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", homeLoop = async (state, opts, initialQuery) => {
-      let first = !0;
+    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", findOrFail = (state, name) => {
+      let profile = state.profiles.find((x2) => x2.name == name);
+      if (!profile)
+        throw new ui2.CliError(`There is no profile named ${name} any more.`, { code: 3 });
+      return profile;
+    }, withRecovery = async (run2, state, what, { exitOnCancel } = {}) => {
       for (; ; ) {
-        await header(state, { warnings: first });
-        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
-        if (first = !1, route.type == "quit") {
-          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
-          return;
-        }
-        if (route.type == "switch")
-          return switchTo(state.profiles.find((x2) => x2.name == route.name), state, opts);
         let result, error;
         try {
-          result = await runAction(route.key, state, opts);
+          result = await run2(state);
         } catch (err) {
           error = err;
         }
         let next = afterPage(result, error);
-        if (next == "exit")
+        if (next == "exit" || next == "home")
           return result;
-        if (next == "throw")
+        if (next == "throw" || next == "back" && exitOnCancel)
           throw error;
-        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && (log3.error(`${route.key} failed (back to the home screen)`, error), ui2.printError(error)), state = await loadState();
+        if (next == "back") {
+          p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`));
+          return;
+        }
+        if (state = await loadState(), await recover(error, state, what) != "retry")
+          return;
+        state = await loadState();
+      }
+    }, homeLoop = async (state, opts, initialQuery) => {
+      let first = !0;
+      for (; ; ) {
+        await header(state, { warnings: first });
+        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
+        if (first = !1, route.type == "quit") {
+          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
+          return;
+        }
+        let result = route.type == "switch" ? await withRecovery((s) => switchTo(findOrFail(s, route.name), s, opts), state, `switch to ${route.name}`, { exitOnCancel: !0 }) : await withRecovery((s) => runAction(route.key, s, opts), state, route.key);
+        if (afterPage(result) == "exit")
+          return result;
+        state = await loadState();
       }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
@@ -7798,8 +8021,13 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
       }
       if (query) {
         let { profile, candidates } = rank.resolveQuery(state.profiles, query, { usage: state.settings.usage, current: state.defaultName });
-        if (profile)
-          return !opts.json && interactive && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`), switchTo(profile, state, { ...opts, interactive });
+        if (profile) {
+          if (!interactive || opts.json)
+            return switchTo(profile, state, { ...opts, interactive });
+          p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
+          let result = await withRecovery((s) => switchTo(findOrFail(s, profile.name), s, { ...opts, interactive }), state, `switch to ${profile.name}`, { exitOnCancel: !0 });
+          return result || homeLoop(await loadState(), { ...opts, interactive });
+        }
         if (!interactive)
           throw new ui2.CliError(candidates.length ? `"${query}" matches ${candidates.length} profiles.` : `No profile matches "${query}".`, {
             code: 3,
@@ -7824,7 +8052,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso, chooseRegion } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), portals = require_portals(), { switchCommand, switchTo, connect, enableShortcut, exportHint } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7879,12 +8107,7 @@ var require_commands = __commonJS({
           return p4.outro(ui2.dim("Nothing changed."));
       }
       await aws.logoutAll(), await settings2.update({ logins: {} }), p4.outro(`${ui2.ok(ui2.sym.ok)} Logged out ${ui2.unicode ? "\u{1F44B}" : ""}${isRemoteSession(process.env, process.platform) ? ui2.dim(" This machine no longer has AWS access.") : ""}`);
-    }, chooseRegion = async (message, initialValue) => ask(p4.autocomplete({
-      message,
-      maxItems: 8,
-      initialValue,
-      options: aws.regions.map((r2) => ({ value: r2.code, label: r2.code, hint: r2.name }))
-    })), validateProfileName = (taken) => (value) => {
+    }, validateProfileName = (taken) => (value) => {
       if (!value)
         return "A name is required.";
       if (!/^[a-z0-9][a-z0-9_-]+$/.test(value))
@@ -7974,7 +8197,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
           ]
         })) : "__new__";
         if (choice == "__new__") {
-          let startUrl = await ask(p4.text({ message: "SSO start URL", placeholder: "https://acme.awsapps.com/start", validate: (v) => /^https:\/\/\S+$/.test(v || "") ? void 0 : "Enter the https:// start URL of the portal." })), region2 = await chooseRegion(`SSO region ${ui2.dim("(where IAM Identity Center lives)")}`, "us-east-1"), suggested = transforms.sessionNameFromUrl(startUrl).replace(/[^a-zA-Z0-9_-]/g, "-");
+          let startUrl = (await ask(p4.text({ message: "SSO start URL", placeholder: "https://acme.awsapps.com/start", validate: portals.validateStartUrl }))).trim(), detected = await aws.detectSsoRegion(startUrl), region2 = await chooseRegion(`SSO region ${ui2.dim(detected ? `(where IAM Identity Center lives: ${detected}, read from the portal)` : "(where IAM Identity Center lives)")}`, detected || "us-east-1"), suggested = transforms.sessionNameFromUrl(startUrl).replace(/[^a-zA-Z0-9_-]/g, "-");
           sessionName = await ask(p4.text({ message: `Short name for this portal ${ui2.dim("(usually the client)")}`, initialValue: suggested, validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v || "") ? sessions.some((s) => s.name == v) ? `${v} already exists.` : void 0 : "Letters, numbers, - and _ only." })), configStr = transforms.addSsoSession(configStr, { name: sessionName, startUrl, region: region2, version: settings2.CLI_VERSION }), await aws.writeAwsFile(aws.AWS_CONFIG_FILE, configStr);
         } else
           sessionName = choice;
@@ -7983,7 +8206,17 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       if (!token) {
         if (!interactive)
           throw new ui2.CliError(`Not logged in to ${sessionName}.`, { code: 2, hint: `Run: aws sso login --sso-session ${sessionName}` });
-        if (await ssoLogin({ ssoSession: sessionName }, { label: sessionName, loginKey: sessionName, interactive }), token = await aws.readSsoToken({ ssoSession: sessionName }), !token)
+        for (; ; )
+          try {
+            await ssoLogin({ ssoSession: sessionName }, { label: sessionName, loginKey: sessionName, interactive });
+            break;
+          } catch (err) {
+            if (!err.wrongRegion)
+              throw err;
+            let region2 = await portals.fixSsoRegion(session, err);
+            configStr = (await aws.getConfigFile())[1] || configStr, session = { ...session, sso_region: region2 };
+          }
+        if (token = await aws.readSsoToken({ ssoSession: sessionName }), !token)
           throw new ui2.CliError(`Logged in, but no token was found for ${sessionName}.`);
       }
       let spin = opts.json ? null : ui2.spinner();
@@ -8060,6 +8293,90 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       if (errors)
         throw ui2.cliErrorFrom(errors);
       p4.outro(`${ui2.ok(ui2.sym.ok)} Removed ${names.join(", ")}`);
+    }, moveKey = (obj, from, to) => {
+      if (!obj || !(from in obj))
+        return obj;
+      let { [from]: value, ...rest } = obj;
+      return { ...rest, [to]: value };
+    }, rename = async (from, to, opts) => {
+      let interactive = await begin(opts), state = await loadState();
+      if (!from) {
+        if (!interactive)
+          throw new ui2.CliError("Which profile?", { code: 3, hint: "Run: switch-profile rename <profile> <new-name>" });
+        from = await ask(p4.autocomplete({
+          message: "Rename which profile?",
+          maxItems: 12,
+          options: state.profiles.map((x2) => ({ value: x2.name, label: x2.name, hint: describe(x2) }))
+        }));
+      }
+      let profile = findProfile(state, from), taken = [...state.profiles.map((x2) => x2.name).filter((n3) => n3 != from), "default"], validate = (v) => v == from ? "That is already its name." : validateProfileName(taken)(v);
+      if (!to) {
+        if (!interactive)
+          throw new ui2.CliError("What is the new name?", { code: 3, hint: `Run: switch-profile rename ${from} <new-name>` });
+        to = await ask(p4.text({ message: `New name for ${from}`, initialValue: from, validate }));
+      }
+      let invalid = validate(to);
+      if (invalid)
+        throw new ui2.CliError(invalid, { code: 3 });
+      let [errors, result] = await aws.renameProfile(from, to);
+      if (errors)
+        throw ui2.cliErrorFrom(errors);
+      let current = await settings2.read();
+      await settings2.update({
+        usage: moveKey(current.usage, from, to),
+        ...loginKey(profile) == from ? { logins: moveKey(current.logins, from, to) } : {}
+      });
+      let inTerminal = process.env.AWS_PROFILE == from, terminal = inTerminal ? await shell.exportProfile(to).catch(log3.tolerated("handing the profile to sp", !1)) : !1;
+      if (opts.json) {
+        process.stdout.write(JSON.stringify({ from, to, default: result.wasDefault, sources: result.sources, processes: result.processes, terminal }) + `
+`);
+        return;
+      }
+      let lines = [
+        result.wasDefault ? ui2.dim("still the default profile") : null,
+        result.sources.length ? ui2.dim(`source_profile updated in ${result.sources.join(", ")}`) : null,
+        terminal ? ui2.dim("this terminal now uses the new name") : null
+      ].filter(Boolean);
+      p4.log.success([`Renamed ${ui2.accent(from)} to ${ui2.accent(to)}`, ...lines].join(`
+`)), result.processes.length && p4.log.warn(`The credential_process of ${result.processes.join(", ")} still uses --profile ${from}. Update ${result.processes.length == 1 ? "it" : "them"} in ~/.aws/config.`), inTerminal && !terminal && p4.log.warn(`This terminal still uses ${from}. Run:
+   ${ui2.accent(exportHint(to))}`), p4.outro(ui2.dim(`Other terminals, scripts and tools that use ${from} (AWS_PROFILE or --profile) need the new name.`));
+    }, portalsCommand = async (name, opts) => {
+      let interactive = await begin(opts), state = await loadState();
+      if (opts.region || opts.startUrl) {
+        if (!name)
+          throw new ui2.CliError("Which portal?", { code: 3, hint: "Run: switch-profile portals <name> --region <region>" });
+        let invalid = opts.region && portals.validateRegion(opts.region) || opts.startUrl && portals.validateStartUrl(opts.startUrl);
+        if (invalid)
+          throw new ui2.CliError(invalid, { code: 3 });
+        await portals.findPortal(state, name), await portals.updatePortal(name, { region: opts.region, startUrl: opts.startUrl });
+        let portal = await portals.findPortal(state, name);
+        return opts.json ? void process.stdout.write(JSON.stringify(portal) + `
+`) : (p4.log.success(`Saved ${ui2.accent(name)}: ${ui2.join([portal.startUrl, portal.region])}`), p4.outro(ui2.dim(`Log in again: switch-profile login <a ${name} profile>`)));
+      }
+      if (!interactive || opts.json) {
+        let list = await portals.listPortals(state, { detect: !!opts.check }), selected = name ? list.filter((x2) => x2.name == name) : list;
+        if (name && !selected.length && await portals.findPortal(state, name), opts.json)
+          return void process.stdout.write(JSON.stringify({ portals: selected }) + `
+`);
+        for (let x2 of selected)
+          console.log(`${x2.name}	${x2.region || "-"}	${x2.startUrl || "-"}	${x2.profiles.length} profiles${opts.check ? `	portal says ${x2.detectedRegion || "?"}` : ""}`);
+        return;
+      }
+      if (!name) {
+        let spin = ui2.spinner();
+        spin.start("Reading the portals");
+        let list = await portals.listPortals(state, { detect: !0 });
+        if (spin.stop(`${list.length} SSO portal${list.length == 1 ? "" : "s"}`), !list.length)
+          return p4.outro(ui2.dim("No SSO portals yet. Add one with Add \u203A Accounts from an SSO portal."));
+        let picked = await ask(p4.select({
+          message: "Which portal?",
+          options: list.map((x2) => ({ value: x2.name, label: x2.name, hint: portals.portalHint(x2) }))
+        })), { changed: changed2 } = await portals.editPortal(picked, state, { detectedRegion: list.find((x2) => x2.name == picked).detectedRegion });
+        return p4.outro(ui2.dim(changed2 ? "Saved." : "Nothing changed."));
+      }
+      await portals.findPortal(state, name);
+      let { changed } = await portals.editPortal(name, state);
+      p4.outro(ui2.dim(changed ? "Saved." : "Nothing changed."));
     }, LOGIN_MODE_LABELS = {
       auto: "Auto: device code over SSH, browser otherwise",
       device: "Always device code (approve from any device)",
@@ -8111,6 +8428,8 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       logout,
       add,
       remove,
+      rename,
+      portals: portalsCommand,
       settings: settingsCommand
     };
   }
@@ -8126,6 +8445,8 @@ Examples:
   $ sp acme prod                fuzzy match: switches if only one profile matches
   $ sp login                    log in again now (device code over SSH)
   $ sp add                      import every account of an SSO portal
+  $ sp rename <profile> <new>   give a profile a friendlier name
+  $ sp portals                  check or fix an SSO portal's start URL and region
   $ switch-profile status --json
 
 'sp' is the shortcut switch-profile installs on first use (or from Settings). It also
@@ -8155,6 +8476,6 @@ Exit codes: 0 ok \xB7 1 error \xB7 2 login required \xB7 3 bad input \xB7 130 ca
 }, main = (argv) => {
   log2.start({ version: CLI_VERSION, argv }), process.on("uncaughtException", crashed), process.on("unhandledRejection", crashed), process.on("exit", (code) => log2.info(`exit ${code}`));
   let program = new Command();
-  return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
+  return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("rename").alias("mv").argument("[profile]").argument("[new-name]").description("rename a profile").action(run(commands.rename)), program.command("portals").alias("portal").argument("[name]", "the [sso-session] to edit").description("list SSO portals, check their region, and edit the start URL or region").option("--region <region>", "set the SSO region (where IAM Identity Center lives)").option("--start-url <url>", "set the start URL").option("--check", "with --json or no terminal: also read each portal's region from its start page").action(run(commands.portals)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
 };
 module.exports = { main };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.3.1",
+  "version": "2.5.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"