switch-profile 2.4.0 → 2.5.0

package/README.md

@@ -21,7 +21,7 @@ npx switch-profile
 │  ○ globex-dev      ReadOnly  333333333333  us-east-1
 │  ○ initech-dev     Admin     444444444444  eu-west-1
 │
-│  [Log in] [Add] [Rename] [Remove] [Log out] [Settings]
+│  [Log in] [Add] [Portals] [Rename] [Remove] [Log out] [Settings]
 └  ↑↓ choose · enter switch · tab actions · esc quit
 ```
 
@@ -100,8 +100,9 @@ No profiles yet? `switch-profile` starts the **Add profiles** flow. To import ev
 Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 
 - **Type and press Enter** to switch. That's the whole path for everyday use.
-- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Rename**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
+- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Portals**, **Rename**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
 - **Every action opens as a page and comes back** to the home screen when it's done. **Esc** goes back from a page, and quits from the home screen.
+- **When something fails, it stops and tells you.** An error screen says what failed, what AWS answered, why, and which SSO portal (start URL and region) was involved. Then it asks what to do: fix the portal's region in one step, edit the portal, try again, or go back.
 - A switch ends the session, which is what lets `sp` set `AWS_PROFILE` in your terminal.
 
 ## Commands
@@ -117,6 +118,7 @@ Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 | `add --from-sso [session]` | Imports or re-syncs every account and role of an `[sso-session]`. Options: `--region`, `--prefix`, `--prune`, `--yes`. |
 | `rename [profile] [new-name]` | Renames a profile (alias `mv`), for example an imported `acme-prod-workloads-administratoraccess` to `acme-prod`. Also updates `source_profile` references, the default profile and the home screen order. SSO logins are kept. Scripts, terminals and tools that use the old name need the new one. |
 | `remove [profiles...] [--yes]` | Removes profiles (alias `rm`). The current default cannot be removed. |
+| `portals [name]` | Lists your SSO portals (`[sso-session]`) and edits one in place: start URL and SSO region (alias `portal`). Flags a portal whose region differs from the one its portal page names, and fixes it in one step. `--region` / `--start-url` edit without prompting; `--json` lists them (`--check` adds the region read from each portal). |
 | `settings` | Per-terminal switching, SSO login mode, legacy SSO upgrade. |
 
 Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. Every run, AWS CLI call and error is logged to `~/.switch-profile/switch-profile.log` (secrets redacted). In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
@@ -242,6 +244,8 @@ The SSO region is wrong. It must be the region of your IAM Identity Center insta
 
 The start URL is usually fine: AWS sends this error when the **SSO region** is wrong. Use the region where IAM Identity Center lives (Identity Center console › Settings), not where you deploy. If the portal is already set up, type its existing session name instead (`sp add` lists them with their regions).
 
+When importing from a portal (`sp add` > Accounts from an SSO portal) or switching to one of its profiles, the same mistake shows as `Invalid request` during the login. `switch-profile` reads the portal's real region from its start page and offers to fix the saved portal. You can also check and fix every portal any time with `sp portals` (or **Portals** on the home screen).
+
 ### Something failed and the message is not enough
 
 Open `~/.switch-profile/switch-profile.log`. It has every run, every AWS CLI call with its exit code and output, and every error with its full chain. Secrets are redacted, so you can share it.

package/dist/cli.js

@@ -5419,7 +5419,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.4.0",
+      version: "2.5.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5777,9 +5777,17 @@ var require_transforms = __commonJS({
       ["sso_region", region],
       ["sso_registration_scopes", SSO_SCOPES],
       [VERSION_KEY, version]
-    ]);
+    ]), updateSsoSession = (configStr, { name, startUrl, region, version }) => {
+      let section = `sso-session ${name}`;
+      return ini.getSection(configStr, section) ? ini.setKeys(configStr, section, {
+        ...startUrl ? { sso_start_url: startUrl } : {},
+        ...region ? { sso_region: region } : {},
+        [VERSION_KEY]: version
+      }) : configStr;
+    };
     module2.exports = {
       GENERATED_KEY,
+      updateSsoSession,
       ACCOUNT_NAME_KEY,
       generatedProfileName,
       populateSsoProfiles,
@@ -5817,13 +5825,22 @@ var require_login = __commonJS({
       text2 = text2 || "";
       let urls = text2.match(URL_REGEX) || [], code = (text2.match(CODE_REGEX) || [])[1] || null, completeUrl = urls.find((u5) => /user_code=/.test(u5)) || null;
       return { url: urls.find((u5) => u5 !== completeUrl) || completeUrl || null, code, completeUrl };
-    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, configureSsoFailure = (output, sessions) => {
+    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, isWrongSsoRegion = (output) => WRONG_REGION.test(output || ""), PORTAL_REGION = /portal\.sso\.([a-z]{2}(?:-[a-z]+)+-\d+)\.amazonaws\.com/, portalRegionFromHeaders = (values) => {
+      for (let v of values || []) {
+        let m3 = (v || "").match(PORTAL_REGION);
+        if (m3)
+          return m3[1];
+      }
+      return null;
+    }, configureSsoFailure = (output, sessions) => {
       let lines = (output || "").split(`
 `).map((l2) => l2.trim()).filter(Boolean), detail = (lines.filter((l2) => /error/i.test(l2)).slice(-1)[0] || lines.slice(-1)[0] || "").replace(/^aws:\s*\[ERROR\]:\s*/i, ""), description = ((output || "").match(/error_description:\s*(.+)/) || [])[1], known = (sessions || []).filter((s) => s.sso_region).map((s) => `${s.name} (${s.sso_region}, ${s.sso_start_url})`), reuse = known.length ? ` Portals already set up here: ${known.join(", ")}. Type one of these names as the session name to reuse it.` : "", message = `aws configure sso failed${description || detail ? `: ${(description || detail).trim()}` : "."}`;
-      return WRONG_REGION.test(output || "") ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
+      return isWrongSsoRegion(output) ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
     };
     module2.exports = {
       configureSsoFailure,
+      isWrongSsoRegion,
+      portalRegionFromHeaders,
       isRemoteSession,
       resolveLoginMode,
       loginFlags,
@@ -5944,7 +5961,7 @@ var require_regions = __commonJS({
 // src/aws/index.js
 var require_aws = __commonJS({
   "src/aws/index.js"(exports2, module2) {
-    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
+    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast, portalRegionFromHeaders } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
 ` : EOL, AWS_CONFIG_FILE = join2(homedir(), ".aws", "config"), AWS_CREDS_FILE = join2(homedir(), ".aws", "credentials"), AWS_SSO_FOLDER = join2(homedir(), ".aws", "sso", "cache"), awsExists = isCommandExist("aws"), _awsCliVersion = null, whichAws = () => exec2(`${process.platform == "win32" ? "where" : "which"} aws`).then((out) => (out || "").split(/\r?\n/)[0].trim(), () => null), getAwsCliVersion = async () => {
       if (_awsCliVersion)
         return _awsCliVersion;
@@ -6047,6 +6064,18 @@ var require_aws = __commonJS({
     }, readSsoToken = async ({ ssoSession, startUrl }) => {
       let key = crypto.createHash("sha1").update(ssoSession || startUrl).digest("hex"), token = await fs.promises.readFile(join2(AWS_SSO_FOLDER, `${key}.json`), "utf8").then(JSON.parse).catch(() => null);
       return !token || !token.accessToken || new Date(token.expiresAt).getTime() < Date.now() + 60 * 1e3 ? null : token;
+    }, detectSsoRegion = async (startUrl, { timeoutMs = 5e3 } = {}) => {
+      let started = Date.now();
+      try {
+        let url = new URL(startUrl);
+        url.hash = "";
+        let res = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(timeoutMs) });
+        await res.body?.cancel();
+        let region = portalRegionFromHeaders([res.headers.get("link"), res.headers.get("content-security-policy")]);
+        return log3.info(`SSO region of ${url} \u2192 ${region || "not found"} (HTTP ${res.status} in ${Date.now() - started}ms)`), region;
+      } catch (err) {
+        return log3.tolerated(`SSO region lookup of ${startUrl}`, null)(err);
+      }
     }, listSsoAccounts = async (accessToken, region) => {
       let data = await run2("aws", ["sso", "list-accounts", "--access-token", accessToken, "--region", region, "--output", "json"]);
       return (JSON.parse(data).accountList || []).map((a2) => ({ accountId: a2.accountId, accountName: a2.accountName }));
@@ -6156,6 +6185,7 @@ var require_aws = __commonJS({
       awsLogin,
       logoutAll,
       readSsoToken,
+      detectSsoRegion,
       listSsoAccounts,
       listSsoRoles,
       getSsoLoginStatus,
@@ -6180,7 +6210,7 @@ var require_aws = __commonJS({
 // src/shell.js
 var require_shell = __commonJS({
   "src/shell.js"(exports2, module2) {
-    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use", "rename"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use", "rename", "portals"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
 	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
@@ -6496,9 +6526,15 @@ var require_common = __commonJS({
         return { text: null, needsLogin: !1 };
       let [, login] = await aws.getSsoLoginStatus(profile.sso_start_url), at = (state && state.settings.logins || {})[loginKey(profile)], since = at ? ui2.dim(`logged in ${ui2.ago(at)}`) : null, s = login ? login.state : "none";
       return s == "refreshable" ? { text: ui2.join([ui2.ok(`SSO ${ui2.sym.ok}`) + " auto-refresh", since]), needsLogin: !1 } : s == "active" ? { text: ui2.join([ui2.ok(`SSO ${ui2.sym.ok}`) + ` ${Math.round((login.expiresAt - Date.now()) / 6e4)} min left`, since]), needsLogin: !1 } : { text: ui2.warn(s == "expired" ? "SSO login expired" : "not logged in"), needsLogin: !0 };
-    };
+    }, chooseRegion = async (message, initialValue) => ask(p4.autocomplete({
+      message,
+      maxItems: 8,
+      initialValue,
+      options: aws.regions.map((r2) => ({ value: r2.code, label: r2.code, hint: r2.name }))
+    }));
     module2.exports = {
       CancelError: CancelError2,
+      chooseRegion,
       ask,
       preflight,
       upgradeLegacySso,
@@ -7513,7 +7549,7 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast, isWrongSsoRegion } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
@@ -7571,12 +7607,12 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
       spin && spin.error("Login did not complete");
       let lines = output.trim().split(`
 `).map((l2) => l2.trim()).filter(Boolean), detail = lines.filter((l2) => /error|exception|denied|invalid|expired|unable/i.test(l2)).slice(-2).join(`
-`) || lines.slice(-1)[0] || "";
-      throw new ui2.CliError(`SSO login for ${label} failed.${detail ? `
+`) || lines.slice(-1)[0] || "", wrongRegion = isWrongSsoRegion(output), error = new ui2.CliError(`SSO login for ${label} failed.${detail ? `
 ${detail}` : ""}`, {
         cause: Object.assign(new Error(`aws ${args.join(" ")} exited with code ${code}`), { output }),
-        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
+        hint: wrongRegion ? "The SSO region is most likely wrong: it must be the region where IAM Identity Center lives, not where you deploy. Check and fix it with: sp portals" : /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
       });
+      throw error.wrongRegion = wrongRegion, error.target = target, error;
     }, plainLogin = async (args, label) => {
       console.error(`Logging in to ${label}. Approve the request using the URL and code below.`), await new Promise((resolve, reject) => {
         let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
@@ -7597,6 +7633,93 @@ ${detail}` : ""}`, {
   }
 });
 
+// src/commands/portals.js
+var require_portals = __commonJS({
+  "src/commands/portals.js"(exports2, module2) {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), ui2 = require_ui(), { ask, chooseRegion } = require_common(), { ssoLogin } = require_login_flow(), validateStartUrl = (v) => /^https:\/\/\S+$/.test(v || "") ? void 0 : "Enter the https:// start URL of the portal.", validateRegion = (v) => aws.regions.some((r2) => r2.code == v) ? void 0 : `Unknown region ${v}.`, readConfig = async () => {
+      let [errors, configStr] = await aws.getConfigFile();
+      if (errors)
+        throw ui2.cliErrorFrom(errors);
+      return configStr;
+    }, listPortals = async (state, { detect } = {}) => {
+      let portals = transforms.listSsoSessions(await readConfig()).map((s) => ({
+        name: s.name,
+        startUrl: s.sso_start_url || null,
+        region: s.sso_region || null,
+        profiles: state.profiles.filter((x2) => x2.sso_session == s.name).map((x2) => x2.name)
+      }));
+      return detect && await Promise.all(portals.map(async (x2) => {
+        x2.detectedRegion = x2.startUrl ? await aws.detectSsoRegion(x2.startUrl, { timeoutMs: 4e3 }) : null;
+      })), portals;
+    }, findPortal = async (state, name) => {
+      let portal = (await listPortals(state)).find((x2) => x2.name == name);
+      if (!portal)
+        throw new ui2.CliError(`There is no SSO portal named ${name}.`, { code: 3, hint: "List them with: switch-profile portals" });
+      return portal;
+    }, regionMismatch = (region, detectedRegion) => !!(detectedRegion && region && detectedRegion != region), regionNote = ({ region, detectedRegion }) => regionMismatch(region, detectedRegion) ? ui2.join([region, ui2.warn(`${ui2.sym.warn} its portal is in ${detectedRegion}`)]) : detectedRegion ? ui2.join([region, ui2.dim("matches the portal")]) : region || ui2.warn("no region"), portalHint = (x2) => ui2.join([regionNote(x2), `${x2.profiles.length} profile${x2.profiles.length == 1 ? "" : "s"}`, x2.startUrl]), updatePortal = async (name, { startUrl, region }) => {
+      let configStr = await readConfig();
+      await aws.writeAwsFile(aws.AWS_CONFIG_FILE, transforms.updateSsoSession(configStr, { name, startUrl, region, version: settings2.CLI_VERSION }));
+    }, editPortal = async (name, state, { offerLogin = !0, detectedRegion } = {}) => {
+      let changed = !1, detected = detectedRegion;
+      for (; ; ) {
+        let portal = await findPortal(state, name);
+        detected === void 0 && (detected = portal.startUrl ? await aws.detectSsoRegion(portal.startUrl) : null);
+        let mismatch = regionMismatch(portal.region, detected);
+        p4.log.info([
+          ui2.strong(`Portal ${name}`),
+          `${ui2.dim("Start URL ")}  ${portal.startUrl || ui2.warn("missing")}`,
+          `${ui2.dim("SSO region")}  ${regionNote({ region: portal.region, detectedRegion: detected })}`,
+          detected ? null : ui2.dim("            (could not read the region from the portal page)"),
+          `${ui2.dim("Profiles  ")}  ${portal.profiles.length ? `${portal.profiles.slice(0, 4).join(", ")}${portal.profiles.length > 4 ? `, +${portal.profiles.length - 4} more` : ""}` : "none"}`
+        ].filter(Boolean).join(`
+`));
+        let choice = await ask(p4.select({
+          message: `Edit ${name}`,
+          options: [
+            ...mismatch ? [{ value: "fix", label: `Change the SSO region to ${detected}`, hint: "what the portal page says" }] : [],
+            { value: "url", label: "Start URL", hint: portal.startUrl || void 0 },
+            { value: "region", label: "SSO region", hint: portal.region || void 0 },
+            { value: "done", label: changed ? "Done" : "Back" }
+          ]
+        }));
+        if (choice == "done")
+          break;
+        if (choice == "fix")
+          await updatePortal(name, { region: detected }), p4.log.success(`${name} now uses the SSO region ${ui2.accent(detected)}`);
+        else if (choice == "url") {
+          let startUrl = (await ask(p4.text({ message: `Start URL of ${name}`, initialValue: portal.startUrl || "", validate: validateStartUrl }))).trim();
+          if (startUrl == portal.startUrl)
+            continue;
+          await updatePortal(name, { startUrl }), detected = void 0, p4.log.success(`${name} now uses ${ui2.accent(startUrl)}`);
+        } else {
+          let region = await chooseRegion(`SSO region of ${name} ${ui2.dim("(where IAM Identity Center lives)")}`, detected || portal.region);
+          if (region == portal.region)
+            continue;
+          await updatePortal(name, { region }), p4.log.success(`${name} now uses the SSO region ${ui2.accent(region)}`);
+        }
+        changed = !0;
+      }
+      return changed && offerLogin && await ask(p4.confirm({ message: `Log in to ${name} now to check it works?` })) && await ssoLogin({ ssoSession: name }, { label: name, loginKey: name, interactive: !0 }), { changed };
+    }, fixSsoRegion = async (session, loginError) => {
+      let current = session.sso_region, detected = await aws.detectSsoRegion(session.sso_start_url), region = null;
+      if (detected && detected != current ? (p4.log.warn(`${session.name} is set to the SSO region ${current}, but its portal is in ${detected}.`), await ask(p4.confirm({ message: `Change ${session.name} to ${detected} and log in again?` })) && (region = detected)) : p4.log.warn(`AWS rejected the SSO region of ${session.name} (${current}). Pick the region where IAM Identity Center lives (Identity Center console \u203A Settings).`), region || (region = await chooseRegion(`SSO region of ${session.name} ${ui2.dim("(where IAM Identity Center lives)")}`, detected || current)), region == current)
+        throw loginError;
+      return await updatePortal(session.name, { region }), region;
+    };
+    module2.exports = {
+      validateStartUrl,
+      validateRegion,
+      listPortals,
+      findPortal,
+      regionMismatch,
+      portalHint,
+      updatePortal,
+      editPortal,
+      fixSsoRegion
+    };
+  }
+});
+
 // src/home.js
 var require_home = __commonJS({
   "src/home.js"(exports2, module2) {
@@ -7661,10 +7784,63 @@ ${gray(S_BAR2)}`;
   }
 });
 
+// src/commands/recovery.js
+var require_recovery = __commonJS({
+  "src/commands/recovery.js"(exports2, module2) {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), portals = require_portals(), portalOfError = (err, profiles, sessions) => {
+      let target = err && err.target || {}, name = target.ssoSession || target.profile && ((profiles || []).find((x2) => x2.name == target.profile) || {}).sso_session, session = name && (sessions || []).find((s) => s.name == name);
+      return session ? { name: session.name, startUrl: session.sso_start_url || null, region: session.sso_region || null } : null;
+    }, recoveryOptions = ({ portal, wrongRegion, detectedRegion }) => [
+      portal && wrongRegion && portals.regionMismatch(portal.region, detectedRegion) ? { value: "fix-region", label: `Change the SSO region of ${portal.name} to ${detectedRegion}`, hint: `currently ${portal.region}` } : null,
+      portal ? { value: "edit-portal", label: `Edit the portal ${portal.name}`, hint: "start URL and SSO region" } : null,
+      { value: "retry", label: "Try again" },
+      { value: "back", label: "Back to the home screen" }
+    ].filter(Boolean), errorLines = (err, { portal, detectedRegion }) => [
+      ui2.strong(err.message || String(err)),
+      err.hint ? `
+${err.hint}` : null,
+      portal ? `
+${ui2.dim("Portal    ")}  ${portal.name}  ${ui2.dim(portal.startUrl || "")}` : null,
+      portal ? `${ui2.dim("SSO region")}  ${portal.region || "?"}${portals.regionMismatch(portal.region, detectedRegion) ? `  ${ui2.warn(`${ui2.sym.warn} its portal page says ${detectedRegion}`)}` : detectedRegion ? `  ${ui2.dim("(matches its portal page)")}` : ""}` : null,
+      `
+${ui2.dim(`Details: ${log3.displayPath()}`)}`
+    ].filter((v) => v !== null).join(`
+`), recover = async (err, state, what) => {
+      log3.error(`${what} failed (error screen)`, err);
+      let [, configStr] = await aws.getConfigFile(), portal = portalOfError(err, state.profiles, transforms.listSsoSessions(configStr || "")), detectedRegion = portal && err.wrongRegion && portal.startUrl ? await aws.detectSsoRegion(portal.startUrl) : null;
+      p4.log.error(errorLines(err, { portal, detectedRegion }));
+      let choice = await p4.select({ message: "What now?", options: recoveryOptions({ portal, wrongRegion: err.wrongRegion, detectedRegion }) });
+      if (p4.isCancel(choice) || choice == "back")
+        return "back";
+      try {
+        if (choice == "fix-region")
+          await portals.updatePortal(portal.name, { region: detectedRegion }), p4.log.success(`${portal.name} now uses the SSO region ${ui2.accent(detectedRegion)}. Trying again\u2026`);
+        else if (choice == "edit-portal") {
+          let { changed } = await portals.editPortal(portal.name, state, { offerLogin: !1, detectedRegion: err.wrongRegion ? detectedRegion : void 0 });
+          if (!changed)
+            return "back";
+        }
+      } catch (e) {
+        if (e instanceof CancelError2)
+          return "back";
+        if (!(e instanceof ui2.CliError))
+          throw e;
+        return log3.error("fixing the portal failed", e), ui2.printError(e), "back";
+      }
+      return "retry";
+    };
+    module2.exports = {
+      portalOfError,
+      recoveryOptions,
+      recover
+    };
+  }
+});
+
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), { recover } = require_recovery(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7690,6 +7866,7 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
     }, ACTIONS = [
       { key: "login", label: "Log in" },
       { key: "add", label: "Add" },
+      { key: "portals", label: "Portals" },
       { key: "rename", label: "Rename" },
       { key: "remove", label: "Remove" },
       { key: "logout", label: "Log out" },
@@ -7787,35 +7964,51 @@ ${ui2.dim("Tip: enable per-terminal switching in Settings.")}` : ""}`);
 ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned"));
     }, runAction = async (key, state, opts) => {
       let commands2 = require_commands();
-      return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : key == "rename" ? commands2.rename(null, null, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
+      return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : key == "rename" ? commands2.rename(null, null, { ...opts, fromPicker: !0 }) : key == "portals" ? commands2.portals(null, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
     }, routeChoice = (choice) => {
       if (p4.isCancel(choice))
         return { type: "quit" };
       let value = String(choice);
       return value.startsWith(ACTION_PREFIX) ? { type: "page", key: value.slice(ACTION_PREFIX.length) } : { type: "switch", name: value };
-    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", homeLoop = async (state, opts, initialQuery) => {
-      let first = !0;
+    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", findOrFail = (state, name) => {
+      let profile = state.profiles.find((x2) => x2.name == name);
+      if (!profile)
+        throw new ui2.CliError(`There is no profile named ${name} any more.`, { code: 3 });
+      return profile;
+    }, withRecovery = async (run2, state, what, { exitOnCancel } = {}) => {
       for (; ; ) {
-        await header(state, { warnings: first });
-        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
-        if (first = !1, route.type == "quit") {
-          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
-          return;
-        }
-        if (route.type == "switch")
-          return switchTo(state.profiles.find((x2) => x2.name == route.name), state, opts);
         let result, error;
         try {
-          result = await runAction(route.key, state, opts);
+          result = await run2(state);
         } catch (err) {
           error = err;
         }
         let next = afterPage(result, error);
-        if (next == "exit")
+        if (next == "exit" || next == "home")
           return result;
-        if (next == "throw")
+        if (next == "throw" || next == "back" && exitOnCancel)
           throw error;
-        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && (log3.error(`${route.key} failed (back to the home screen)`, error), ui2.printError(error)), state = await loadState();
+        if (next == "back") {
+          p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`));
+          return;
+        }
+        if (state = await loadState(), await recover(error, state, what) != "retry")
+          return;
+        state = await loadState();
+      }
+    }, homeLoop = async (state, opts, initialQuery) => {
+      let first = !0;
+      for (; ; ) {
+        await header(state, { warnings: first });
+        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
+        if (first = !1, route.type == "quit") {
+          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
+          return;
+        }
+        let result = route.type == "switch" ? await withRecovery((s) => switchTo(findOrFail(s, route.name), s, opts), state, `switch to ${route.name}`, { exitOnCancel: !0 }) : await withRecovery((s) => runAction(route.key, s, opts), state, route.key);
+        if (afterPage(result) == "exit")
+          return result;
+        state = await loadState();
       }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
@@ -7828,8 +8021,13 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
       }
       if (query) {
         let { profile, candidates } = rank.resolveQuery(state.profiles, query, { usage: state.settings.usage, current: state.defaultName });
-        if (profile)
-          return !opts.json && interactive && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`), switchTo(profile, state, { ...opts, interactive });
+        if (profile) {
+          if (!interactive || opts.json)
+            return switchTo(profile, state, { ...opts, interactive });
+          p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
+          let result = await withRecovery((s) => switchTo(findOrFail(s, profile.name), s, { ...opts, interactive }), state, `switch to ${profile.name}`, { exitOnCancel: !0 });
+          return result || homeLoop(await loadState(), { ...opts, interactive });
+        }
         if (!interactive)
           throw new ui2.CliError(candidates.length ? `"${query}" matches ${candidates.length} profiles.` : `No profile matches "${query}".`, {
             code: 3,
@@ -7854,7 +8052,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut, exportHint } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso, chooseRegion } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), portals = require_portals(), { switchCommand, switchTo, connect, enableShortcut, exportHint } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7909,12 +8107,7 @@ var require_commands = __commonJS({
           return p4.outro(ui2.dim("Nothing changed."));
       }
       await aws.logoutAll(), await settings2.update({ logins: {} }), p4.outro(`${ui2.ok(ui2.sym.ok)} Logged out ${ui2.unicode ? "\u{1F44B}" : ""}${isRemoteSession(process.env, process.platform) ? ui2.dim(" This machine no longer has AWS access.") : ""}`);
-    }, chooseRegion = async (message, initialValue) => ask(p4.autocomplete({
-      message,
-      maxItems: 8,
-      initialValue,
-      options: aws.regions.map((r2) => ({ value: r2.code, label: r2.code, hint: r2.name }))
-    })), validateProfileName = (taken) => (value) => {
+    }, validateProfileName = (taken) => (value) => {
       if (!value)
         return "A name is required.";
       if (!/^[a-z0-9][a-z0-9_-]+$/.test(value))
@@ -8004,7 +8197,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
           ]
         })) : "__new__";
         if (choice == "__new__") {
-          let startUrl = await ask(p4.text({ message: "SSO start URL", placeholder: "https://acme.awsapps.com/start", validate: (v) => /^https:\/\/\S+$/.test(v || "") ? void 0 : "Enter the https:// start URL of the portal." })), region2 = await chooseRegion(`SSO region ${ui2.dim("(where IAM Identity Center lives)")}`, "us-east-1"), suggested = transforms.sessionNameFromUrl(startUrl).replace(/[^a-zA-Z0-9_-]/g, "-");
+          let startUrl = (await ask(p4.text({ message: "SSO start URL", placeholder: "https://acme.awsapps.com/start", validate: portals.validateStartUrl }))).trim(), detected = await aws.detectSsoRegion(startUrl), region2 = await chooseRegion(`SSO region ${ui2.dim(detected ? `(where IAM Identity Center lives: ${detected}, read from the portal)` : "(where IAM Identity Center lives)")}`, detected || "us-east-1"), suggested = transforms.sessionNameFromUrl(startUrl).replace(/[^a-zA-Z0-9_-]/g, "-");
           sessionName = await ask(p4.text({ message: `Short name for this portal ${ui2.dim("(usually the client)")}`, initialValue: suggested, validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v || "") ? sessions.some((s) => s.name == v) ? `${v} already exists.` : void 0 : "Letters, numbers, - and _ only." })), configStr = transforms.addSsoSession(configStr, { name: sessionName, startUrl, region: region2, version: settings2.CLI_VERSION }), await aws.writeAwsFile(aws.AWS_CONFIG_FILE, configStr);
         } else
           sessionName = choice;
@@ -8013,7 +8206,17 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       if (!token) {
         if (!interactive)
           throw new ui2.CliError(`Not logged in to ${sessionName}.`, { code: 2, hint: `Run: aws sso login --sso-session ${sessionName}` });
-        if (await ssoLogin({ ssoSession: sessionName }, { label: sessionName, loginKey: sessionName, interactive }), token = await aws.readSsoToken({ ssoSession: sessionName }), !token)
+        for (; ; )
+          try {
+            await ssoLogin({ ssoSession: sessionName }, { label: sessionName, loginKey: sessionName, interactive });
+            break;
+          } catch (err) {
+            if (!err.wrongRegion)
+              throw err;
+            let region2 = await portals.fixSsoRegion(session, err);
+            configStr = (await aws.getConfigFile())[1] || configStr, session = { ...session, sso_region: region2 };
+          }
+        if (token = await aws.readSsoToken({ ssoSession: sessionName }), !token)
           throw new ui2.CliError(`Logged in, but no token was found for ${sessionName}.`);
       }
       let spin = opts.json ? null : ui2.spinner();
@@ -8137,6 +8340,43 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       p4.log.success([`Renamed ${ui2.accent(from)} to ${ui2.accent(to)}`, ...lines].join(`
 `)), result.processes.length && p4.log.warn(`The credential_process of ${result.processes.join(", ")} still uses --profile ${from}. Update ${result.processes.length == 1 ? "it" : "them"} in ~/.aws/config.`), inTerminal && !terminal && p4.log.warn(`This terminal still uses ${from}. Run:
    ${ui2.accent(exportHint(to))}`), p4.outro(ui2.dim(`Other terminals, scripts and tools that use ${from} (AWS_PROFILE or --profile) need the new name.`));
+    }, portalsCommand = async (name, opts) => {
+      let interactive = await begin(opts), state = await loadState();
+      if (opts.region || opts.startUrl) {
+        if (!name)
+          throw new ui2.CliError("Which portal?", { code: 3, hint: "Run: switch-profile portals <name> --region <region>" });
+        let invalid = opts.region && portals.validateRegion(opts.region) || opts.startUrl && portals.validateStartUrl(opts.startUrl);
+        if (invalid)
+          throw new ui2.CliError(invalid, { code: 3 });
+        await portals.findPortal(state, name), await portals.updatePortal(name, { region: opts.region, startUrl: opts.startUrl });
+        let portal = await portals.findPortal(state, name);
+        return opts.json ? void process.stdout.write(JSON.stringify(portal) + `
+`) : (p4.log.success(`Saved ${ui2.accent(name)}: ${ui2.join([portal.startUrl, portal.region])}`), p4.outro(ui2.dim(`Log in again: switch-profile login <a ${name} profile>`)));
+      }
+      if (!interactive || opts.json) {
+        let list = await portals.listPortals(state, { detect: !!opts.check }), selected = name ? list.filter((x2) => x2.name == name) : list;
+        if (name && !selected.length && await portals.findPortal(state, name), opts.json)
+          return void process.stdout.write(JSON.stringify({ portals: selected }) + `
+`);
+        for (let x2 of selected)
+          console.log(`${x2.name}	${x2.region || "-"}	${x2.startUrl || "-"}	${x2.profiles.length} profiles${opts.check ? `	portal says ${x2.detectedRegion || "?"}` : ""}`);
+        return;
+      }
+      if (!name) {
+        let spin = ui2.spinner();
+        spin.start("Reading the portals");
+        let list = await portals.listPortals(state, { detect: !0 });
+        if (spin.stop(`${list.length} SSO portal${list.length == 1 ? "" : "s"}`), !list.length)
+          return p4.outro(ui2.dim("No SSO portals yet. Add one with Add \u203A Accounts from an SSO portal."));
+        let picked = await ask(p4.select({
+          message: "Which portal?",
+          options: list.map((x2) => ({ value: x2.name, label: x2.name, hint: portals.portalHint(x2) }))
+        })), { changed: changed2 } = await portals.editPortal(picked, state, { detectedRegion: list.find((x2) => x2.name == picked).detectedRegion });
+        return p4.outro(ui2.dim(changed2 ? "Saved." : "Nothing changed."));
+      }
+      await portals.findPortal(state, name);
+      let { changed } = await portals.editPortal(name, state);
+      p4.outro(ui2.dim(changed ? "Saved." : "Nothing changed."));
     }, LOGIN_MODE_LABELS = {
       auto: "Auto: device code over SSH, browser otherwise",
       device: "Always device code (approve from any device)",
@@ -8189,6 +8429,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       add,
       remove,
       rename,
+      portals: portalsCommand,
       settings: settingsCommand
     };
   }
@@ -8205,6 +8446,7 @@ Examples:
   $ sp login                    log in again now (device code over SSH)
   $ sp add                      import every account of an SSO portal
   $ sp rename <profile> <new>   give a profile a friendlier name
+  $ sp portals                  check or fix an SSO portal's start URL and region
   $ switch-profile status --json
 
 'sp' is the shortcut switch-profile installs on first use (or from Settings). It also
@@ -8234,6 +8476,6 @@ Exit codes: 0 ok \xB7 1 error \xB7 2 login required \xB7 3 bad input \xB7 130 ca
 }, main = (argv) => {
   log2.start({ version: CLI_VERSION, argv }), process.on("uncaughtException", crashed), process.on("unhandledRejection", crashed), process.on("exit", (code) => log2.info(`exit ${code}`));
   let program = new Command();
-  return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("rename").alias("mv").argument("[profile]").argument("[new-name]").description("rename a profile").action(run(commands.rename)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
+  return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("rename").alias("mv").argument("[profile]").argument("[new-name]").description("rename a profile").action(run(commands.rename)), program.command("portals").alias("portal").argument("[name]", "the [sso-session] to edit").description("list SSO portals, check their region, and edit the start URL or region").option("--region <region>", "set the SSO region (where IAM Identity Center lives)").option("--start-url <url>", "set the start URL").option("--check", "with --json or no terminal: also read each portal's region from its start page").action(run(commands.portals)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
 };
 module.exports = { main };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"