@nuvlore/extension-access-okta-slack 0.1.1

package/vendor/extension-sso/src/extensionAccess.mjs

@@ -0,0 +1,173 @@
+import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
+import { assertNonHtmlApiResponse } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import { resolveAutoAuthOptions } from "./autoAuth.mjs";
+import { getServiceCookieHeader } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getRequiredServices, getWorkdayService, listWorkdayServices } from "./serviceRegistry.mjs";
+import { ssoReadGet } from "./ssoHttpRead.mjs";
+import { oktaAppReadGet } from "./oktaAppAccess.mjs";
+
+export function assertReadOnlyHttpRequest({ method = "GET", path = "" } = {}) {
+  const normalizedMethod = String(method).toUpperCase();
+  if (normalizedMethod !== "GET") {
+    throw new Error(`Read-only product: HTTP method ${normalizedMethod} is not allowed. Use GET only.`);
+  }
+  const rawPath = String(path || "");
+  if (/^https?:\/\//i.test(rawPath)) {
+    throw new Error("Read-only extension access: use restPath relative to defaultBaseUrl, not an absolute URL.");
+  }
+  if (rawPath.includes("..")) {
+    throw new Error("Read-only extension access: path cannot contain parent directory traversal.");
+  }
+  if (/\/(delete|edit|transition|merge|deploy|apply|update|create)(\/|$)/i.test(rawPath)) {
+    throw new Error(`Read-only product: path appears mutating and is blocked: ${rawPath}`);
+  }
+}
+
+function accessMode(service) {
+  return service.readAccess?.mode ?? "unsupported";
+}
+
+export async function getExtensionReadAccess(serviceId, options = {}) {
+  const service = getWorkdayService(serviceId);
+  const readAccess = service.readAccess ?? { readOnly: true, mode: "unsupported" };
+  const mode = accessMode(service);
+
+  if (mode === "workflow") {
+    return {
+      readOnly: true,
+      methods: readAccess.methods ?? ["GET"],
+      mode,
+      service: serviceId,
+      extension: service.extension,
+      label: service.label,
+      requires: getRequiredServices(serviceId).map((dep) => ({
+        service: dep.id,
+        extension: dep.extension,
+        label: dep.label,
+        readOnly: true,
+        mode: dep.readAccess?.mode ?? "unsupported"
+      })),
+      recommendation: "Workflow extension — call workday_extension_read_access on each required extension service directly."
+    };
+  }
+
+  if (mode === "cli-readonly" || mode === "ssh-readonly" || mode === "local" || mode === "library" || mode === "mcp" || mode === "unsupported") {
+    return {
+      readOnly: true,
+      methods: readAccess.methods ?? [],
+      mode,
+      service: serviceId,
+      extension: service.extension,
+      label: service.label,
+      ready: mode !== "unsupported",
+      platforms: readAccess.platforms,
+      note: readAccess.note ?? `${service.label} uses read-only tools, not browser cookie HTTP.`,
+      recommendation:
+        mode === "local" || mode === "library"
+          ? "No remote SSO needed."
+          : "Use the extension's read-only command-pack tool."
+    };
+  }
+
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const baseUrl = normalizeBaseUrl(
+    authOptions.baseUrl || readAccess.defaultBaseUrl || `https://${service.domains?.[0] || ""}`
+  );
+  const cookieResult =
+    mode === "public-http"
+      ? { ok: true, cookie: "", host: new URL(baseUrl).host, summary: { authenticated: true } }
+      : await getServiceCookieHeader(serviceId, { ...authOptions, config });
+
+  return {
+    readOnly: true,
+    methods: readAccess.methods ?? ["GET"],
+    mode,
+    service: serviceId,
+    extension: service.extension,
+    label: service.label,
+    baseUrl,
+    host: cookieResult.host,
+    restPathPrefix: readAccess.restPathPrefix ?? "",
+    ready: cookieResult.ok || mode === "public-http",
+    headers: {
+      accept: "application/json",
+      ...(cookieResult.cookie ? { cookie: cookieResult.cookie } : {})
+    },
+    userAgent: `Mozilla/5.0 nuvlore/0.1 ${serviceId}-read`,
+    summary: cookieResult.summary,
+    recommendation: cookieResult.ok
+      ? `Read-only GET ${baseUrl}<restPath> via workday_extension_read (service=${serviceId}).`
+      : cookieResult.authUrl
+        ? `Open ${cookieResult.authUrl} in Chrome via Okta to refresh session, then retry.`
+        : "Run workday_okta_login, then retry."
+  };
+}
+
+export async function extensionReadGet(serviceId, input = {}, options = {}) {
+  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || input.path });
+  const authOptions = resolveAutoAuthOptions(options);
+  const service = getWorkdayService(serviceId);
+  if (service.readAccess?.oktaAppName) {
+    return oktaAppReadGet(service.readAccess.oktaAppName, input, authOptions);
+  }
+  const access = await getExtensionReadAccess(serviceId, authOptions);
+  if (access.mode === "workflow") {
+    throw new Error(
+      `Extension ${access.extension} is a workflow bundle. Use workday_extension_read_access and call a required extension service directly.`
+    );
+  }
+  if (access.mode === "cookie-http") {
+    return ssoReadGet(serviceId, input, authOptions);
+  }
+  if (access.mode !== "public-http") {
+    throw new Error(`Extension ${access.extension} does not support read-only HTTP GET (${access.mode}).`);
+  }
+  if (!access.ready) {
+    throw new Error(access.recommendation || `Read access not ready for ${serviceId}.`);
+  }
+
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const restPath = String(input.restPath || input.path || "").trim();
+  if (!restPath) throw new Error("restPath is required for read-only extension GET.");
+  const baseUrl = normalizeBaseUrl(input.baseUrl || access.baseUrl);
+  const url = buildRequestUrl(baseUrl, restPath, input.query);
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: {
+      accept: access.headers.accept,
+      "user-agent": access.userAgent,
+      ...(access.headers.cookie ? { cookie: access.headers.cookie } : {})
+    }
+  });
+  const text = await response.text();
+  assertNonHtmlApiResponse(access.label, text);
+  const data = parseResponseBody(text);
+  if (!response.ok) {
+    throw new Error(`${access.label} read failed with status ${response.status}.`);
+  }
+  return {
+    readOnly: true,
+    method: "GET",
+    service: serviceId,
+    extension: access.extension,
+    baseUrl,
+    restPath,
+    url: url.toString(),
+    status: response.status,
+    data
+  };
+}
+
+export function listExtensionReadAccess() {
+  return listWorkdayServices().map((service) => ({
+    service: service.id,
+    extension: service.extension,
+    label: service.label,
+    auth: service.auth,
+    readOnly: service.readAccess?.readOnly !== false,
+    mode: accessMode(service),
+    requires: service.requires ?? []
+  }));
+}

package/vendor/extension-sso/src/htmlSessionExtract.mjs

@@ -0,0 +1 @@
+export * from "@nuvlore/extension-browser-sso/html-session-extract";

package/vendor/extension-sso/src/oktaAppAccess.mjs

@@ -0,0 +1,133 @@
+import { resolveBestCookieHost } from "./cookieJar.mjs";
+import { getExtensionReadAccess, extensionReadGet } from "./extensionAccess.mjs";
+import { ensureSsoSession, syncAllOktaCatalogCookies } from "./sessionManager.mjs";
+import { resolveAutoAuthOptions } from "./autoAuth.mjs";
+import { ensureOktaAppSession } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getOktaApp, listOktaApps } from "./oktaAppCatalog.mjs";
+import { oktaAppHttpRead } from "./oktaAppRead.mjs";
+import { readServiceDefault } from "./serviceReads.mjs";
+import { probeReadOnlyUrl } from "./sessionValidate.mjs";
+
+export { probeReadOnlyUrl };
+
+export async function getOktaAppReadAccess(appName, options = {}) {
+  const app = getOktaApp(appName);
+  const readOnly = true;
+
+  if (app.serviceId && app.mode !== "cli-readonly") {
+    try {
+      const extensionAccess = await getExtensionReadAccess(app.serviceId, options);
+      return {
+        readOnly,
+        oktaApp: appName,
+        ...extensionAccess,
+        probePath: app.probePath,
+        defaultBaseUrl: app.defaultBaseUrl ?? extensionAccess.baseUrl
+      };
+    } catch {
+      // fall through to cookie probe
+    }
+  }
+
+  if (app.mode === "cli-readonly") {
+    return {
+      readOnly,
+      oktaApp: appName,
+      service: app.serviceId,
+      mode: "cli-readonly",
+      platform: app.platform,
+      ready: true,
+      recommendation: "Read-only CLI tools only — describe/list/get/logs."
+    };
+  }
+
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const { jar } = await ensureOktaAppSession(appName, { ...authOptions, config });
+  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
+  const probe = hasCookies
+    ? await probeReadOnlyUrl(jar, { host, path: app.probePath ?? "/", cookie, fetchImpl: options.fetchImpl })
+    : { ready: false, reason: "no_cookies" };
+
+  return {
+    readOnly,
+    methods: ["GET"],
+    oktaApp: appName,
+    service: app.serviceId,
+    mode: app.mode ?? "cookie-http",
+    baseUrl: app.defaultBaseUrl,
+    host,
+    hasCookies,
+    ready: Boolean(hasCookies && probe.ready),
+    probe,
+    cookiePresent: Boolean(cookie),
+    recommendation: probe.ready
+      ? `Read-only GET ${app.defaultBaseUrl}${app.probePath ?? "/"}`
+      : hasCookies
+        ? "Cookies present but session probe failed — open app in Chrome once."
+        : "Open app in Chrome via Okta, then retry."
+  };
+}
+
+export async function oktaAppReadGet(appName, input = {}, options = {}) {
+  const app = getOktaApp(appName);
+
+  if (app.serviceId && !input.forceCookie) {
+    try {
+      if (input.useDefault) {
+        return readServiceDefault(app.serviceId, options);
+      }
+      return await extensionReadGet(
+        app.serviceId,
+        {
+          restPath: input.restPath || app.probePath,
+          baseUrl: input.baseUrl || app.defaultBaseUrl,
+          query: input.query,
+          followRedirects: input.followRedirects
+        },
+        options
+      );
+    } catch (error) {
+      if (!input.allowCookieFallback) throw error;
+    }
+  }
+
+  return oktaAppHttpRead(appName, input, options);
+}
+
+export async function probeAllOktaApps(options = {}) {
+  const authOptions = resolveAutoAuthOptions(options);
+  if (!authOptions.probeOnly) {
+    await ensureSsoSession({
+      config: authOptions.config ?? getSsoConfig(),
+      openBrowserOnMissing: authOptions.openBrowserOnMissing,
+      forceBrowser: authOptions.forceBrowser === true,
+      onStatus: authOptions.onStatus
+    }).catch(() => {});
+  }
+  await syncAllOktaCatalogCookies(options);
+  const results = [];
+  for (const app of listOktaApps()) {
+    try {
+      const access = await getOktaAppReadAccess(app.name, { ...options, probeOnly: true });
+      results.push({
+        app: app.name,
+        service: app.serviceId,
+        mode: access.mode,
+        ready: access.ready === true,
+        host: access.host,
+        status: access.probe?.status
+      });
+    } catch (error) {
+      results.push({
+        app: app.name,
+        ready: false,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return results;
+}
+
+export { listOktaApps };

package/vendor/extension-sso/src/oktaAppCatalog.mjs

@@ -0,0 +1,118 @@
+/**
+ * All apps visible on https://workday.okta.com/app/UserHome
+ * Read-only access only — probe paths are GET.
+ */
+export const OKTA_USER_HOME_APPS = {
+  Workday: {
+    serviceId: "sso",
+    domains: ["workday.okta.com"],
+    defaultBaseUrl: "https://workday.okta.com",
+    probePath: "/app/UserHome"
+  },
+  JIRA2: { serviceId: "jira", domains: ["jira2.workday.com"], defaultBaseUrl: "https://jira2.workday.com", probePath: "/rest/api/latest/myself" },
+  Bitbucket: { serviceId: "bitbucket", domains: ["bitbucket.workday.com"], defaultBaseUrl: "https://bitbucket.workday.com", probePath: "/" },
+  Confluence: { serviceId: "confluence", domains: ["confluence.workday.com"], defaultBaseUrl: "https://confluence.workday.com", probePath: "/rest/api/user/current" },
+  Pharos: { serviceId: "pharos", domains: ["grafana.produs.us.wdpharos.io"], defaultBaseUrl: "https://grafana.produs.us.wdpharos.io", probePath: "/login" },
+  "GitHub EMU Cloud": { serviceId: "github", domains: ["ghe.megaleo.com"], defaultBaseUrl: "https://ghe.megaleo.com", probePath: "/" },
+  PagerDuty: { serviceId: "pagerduty", domains: ["workday.pagerduty.com"], defaultBaseUrl: "https://workday.pagerduty.com", probePath: "/" },
+  "Amazon Web Services - AWS": { serviceId: "workday-infra-access", platform: "aws", domains: ["signin.aws.amazon.com"], defaultBaseUrl: "https://signin.aws.amazon.com", probePath: "/", mode: "cli-readonly" },
+  Slack: {
+    domains: ["workday.enterprise.slack.com", "workday.slack.com", "workday-dev.slack.com", "slack.com", "app.slack.com"],
+    defaultBaseUrl: "https://workday.enterprise.slack.com",
+    probePath: "/"
+  },
+  Zoom: { domains: ["workday.zoom.us", "zoom.us", "us.telemetry.zoom.us"], defaultBaseUrl: "https://workday.zoom.us", probePath: "/" },
+  Horizon: { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "On Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "People & Purpose on Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "Workday Service Hub": { domains: ["workday.service-now.com"], defaultBaseUrl: "https://workday.service-now.com", probePath: "/" },
+  "Analytics Hub": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Internal Analytics": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Workday - Google Apps Drive": {
+    domains: ["drive.google.com", "accounts.google.com", "google.com"],
+    defaultBaseUrl: "https://drive.google.com",
+    probePath: "/drive/"
+  },
+  Sana: {
+    domains: ["workday.sana.ai", "sana.ai", "sanalabs.com"],
+    defaultBaseUrl: "https://workday.sana.ai",
+    agentsUrl: "https://sana.ai/tPNxyS5GyK1r",
+    agentsWorkspaceId: "tPNxyS5GyK1r",
+    probePath: "/",
+    launchViaUserHome: true
+  },
+  Peakon: { domains: ["workday.peakon.com", "peakon.com"], defaultBaseUrl: "https://workday.peakon.com", probePath: "/" },
+  "Workday Community": { domains: ["community.workday.com"], defaultBaseUrl: "https://community.workday.com", probePath: "/" },
+  Achievers: { domains: ["workday.achievers.com"], defaultBaseUrl: "https://workday.achievers.com", probePath: "/" },
+  Workboard: { domains: ["workboard.com"], defaultBaseUrl: "https://www.workboard.com", probePath: "/" },
+  "Eptura Office Space Tool & Desk Reservations": { domains: ["workday.iofficeconnect.com"], defaultBaseUrl: "https://workday.iofficeconnect.com", probePath: "/" },
+  Miro: { domains: ["miro.com", "www.miro.com"], defaultBaseUrl: "https://miro.com", probePath: "/app/dashboard/" },
+  OneTrust: { domains: ["app.onetrust.com"], defaultBaseUrl: "https://app.onetrust.com", probePath: "/" },
+  "Collibra Data Intelligence Platform": { domains: ["workday.collibra.com"], defaultBaseUrl: "https://workday.collibra.com", probePath: "/" },
+  Snyk: { domains: ["app.snyk.io"], defaultBaseUrl: "https://app.snyk.io", probePath: "/" },
+  Seismic: { domains: ["workday.seismic.com"], defaultBaseUrl: "https://workday.seismic.com", probePath: "/" },
+  Togglr: { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Togglr - Internal": { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Metrics Portal": { domains: ["metrics.workday.com"], defaultBaseUrl: "https://metrics.workday.com", probePath: "/" },
+  "Security Portal": { domains: ["security.workday.com"], defaultBaseUrl: "https://security.workday.com", probePath: "/" },
+  "Microsoft Office 365 Office Portal": { domains: ["office.com"], defaultBaseUrl: "https://www.office.com", probePath: "/" },
+  "Microsoft Outlook": { domains: ["outlook.office.com"], defaultBaseUrl: "https://outlook.office.com", probePath: "/" },
+  Mixpanel: { domains: ["mixpanel.com"], defaultBaseUrl: "https://mixpanel.com", probePath: "/" },
+  "Secure Code Warrior": { domains: ["securecodewarrior.com"], defaultBaseUrl: "https://portal.securecodewarrior.com", probePath: "/" },
+  "Proofpoint Security Education Platform": { domains: ["proofpoint.com"], defaultBaseUrl: "https://www.proofpoint.com", probePath: "/" },
+  "HackerRank For Work": { domains: ["hackerrank.com"], defaultBaseUrl: "https://www.hackerrank.com", probePath: "/" },
+  "Visitor Registration": { domains: ["envoy.com"], defaultBaseUrl: "https://envoy.com", probePath: "/" },
+  "Healthy Working": { domains: ["cardinus.com"], defaultBaseUrl: "https://www.cardinus.com", probePath: "/" },
+  Meetingselect: { domains: ["meetingselect.com"], defaultBaseUrl: "https://www.meetingselect.com", probePath: "/" },
+  EveryoneSocial: { domains: ["everyonesocial.com"], defaultBaseUrl: "https://everyonesocial.com", probePath: "/" },
+  Aperian: { domains: ["aperianglobal.com"], defaultBaseUrl: "https://www.aperianglobal.com", probePath: "/" },
+  "BT diagramming": { domains: ["lucid.co"], defaultBaseUrl: "https://lucid.co", probePath: "/" },
+  "Fragomen Nomadic": { domains: ["fragomen.com"], defaultBaseUrl: "https://www.fragomen.com", probePath: "/" },
+  "6120 Meeting Center Booking": { domains: ["briefingsource.com"], defaultBaseUrl: "https://www.briefingsource.com", probePath: "/" },
+  "WCP Dev Site": { domains: ["workday.com"], defaultBaseUrl: "https://developer.workday.com", probePath: "/" },
+  "Workday Procurement": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Travel Tool - US": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Policies": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Pattern Library": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Canvas Design System": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Global Records Retention Schedule": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Digital Event Library": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Employee Event Registration": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  DevCon: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  WOAH: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "VitalSource eBooks": { domains: ["vitalsource.com"], defaultBaseUrl: "https://www.vitalsource.com", probePath: "/" },
+  "P&T Planner": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "P&T Okta Password Check": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  "INF-IDM": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  ISD: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "SkyLab Portal": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Prod LDAP Password Tool": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "PRM-Wallboard": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  Osprey: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  ArcPrime: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Google Gemini": { domains: ["gemini.google.com"], defaultBaseUrl: "https://gemini.google.com", probePath: "/", mode: "bookmark" },
+  NotebookLM: { domains: ["notebooklm.google.com"], defaultBaseUrl: "https://notebooklm.google.com", probePath: "/", mode: "bookmark" },
+  Lovable: { domains: ["lovable.dev"], defaultBaseUrl: "https://lovable.dev", probePath: "/", mode: "bookmark" }
+};
+
+export function listOktaApps() {
+  return Object.entries(OKTA_USER_HOME_APPS).map(([name, app]) => ({
+    name,
+    readOnly: true,
+    ...app,
+    mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http")
+  }));
+}
+
+export function getOktaApp(name) {
+  const app = OKTA_USER_HOME_APPS[name];
+  if (!app) {
+    throw new Error(`Unknown Okta app: ${name}`);
+  }
+  return { name, readOnly: true, ...app, mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http") };
+}
+
+export function getOktaAppByServiceId(serviceId) {
+  const match = listOktaApps().find((app) => app.serviceId === serviceId);
+  return match ?? null;
+}

package/vendor/extension-sso/src/oktaAppRead.mjs

@@ -0,0 +1,119 @@
+import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
+import { assertReadOnlyHttpRequest } from "./extensionAccess.mjs";
+import { resolveBestCookieHost } from "./cookieJar.mjs";
+import { isAuthStatusResponse, resolveAutoAuthOptions, shouldRetryAuthAfterFailure } from "./autoAuth.mjs";
+import { ensureOktaAppSession } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getOktaApp } from "./oktaAppCatalog.mjs";
+import { extractHtmlSession, extractEmbeddedJson } from "./htmlSessionExtract.mjs";
+
+/** Default read targets for Okta-only apps (GET, read-only). */
+export const OKTA_APP_READ_TARGETS = {
+  Slack: {
+    defaultPath: "/messages",
+    extract: "generic",
+    extraHeaders: { accept: "text/html,application/json" }
+  },
+  Zoom: { defaultPath: "/", extract: "generic" },
+  Horizon: { defaultPath: "/", extract: "generic" },
+  "Workday Service Hub": {
+    defaultPath: "/api/now/table/sys_user?sysparm_limit=1&sysparm_fields=user_name,name",
+    accept: "application/json"
+  },
+  "Workday - Google Apps Drive": { defaultPath: "/drive/home", extract: "generic" },
+  Sana: { defaultPath: "/", extract: "generic" },
+  Peakon: { defaultPath: "/", extract: "generic" },
+  Miro: { defaultPath: "/app/dashboard/", extract: "generic" },
+  "Microsoft Outlook": { defaultPath: "/mail/", extract: "generic" }
+};
+
+export async function oktaAppHttpRead(appName, input = {}, options = {}) {
+  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || "/" });
+  const app = getOktaApp(appName);
+  const target = OKTA_APP_READ_TARGETS[appName] ?? {};
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const session = await ensureOktaAppSession(appName, { ...authOptions, config });
+  const { jar } = session;
+  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
+  if (!hasCookies || !cookie) {
+    if (session.openedBrowser) {
+      throw new Error(
+        `Okta app "${appName}" auth incomplete. Finish login in Chrome (${session.authUrl}), then retry.`
+      );
+    }
+    throw new Error(
+      `No SSO cookies for Okta app "${appName}". Set WORKDAY_SSO_AUTO_AUTH=true or run workday_okta_login.`
+    );
+  }
+
+  const baseUrl = normalizeBaseUrl(input.baseUrl || app.defaultBaseUrl || `https://${host}`);
+  const restPath = String(input.restPath || target.defaultPath || app.probePath || "/").trim();
+  const url = buildRequestUrl(baseUrl, restPath, input.query);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const follow = input.followRedirects ?? target.followRedirects ?? true;
+
+  const response = await fetchImpl(url.toString(), {
+    method: "GET",
+    redirect: follow ? "follow" : "manual",
+    headers: {
+      accept: target.accept ?? input.accept ?? "application/json,text/html",
+      cookie,
+      "user-agent": `Mozilla/5.0 nuvlore/0.1 okta-${appName.replace(/\s+/g, "-").toLowerCase()}-read`,
+      ...(target.extraHeaders ?? {}),
+      ...(input.headers ?? {})
+    }
+  });
+
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") || "";
+  const isJson = contentType.includes("json") || (text.trim().startsWith("{") || text.trim().startsWith("["));
+
+  let data = isJson ? parseResponseBody(text) : null;
+  let extracted = null;
+  if (!isJson || input.extractHtml) {
+    const extractKind = input.extract || target.extract || "generic";
+    extracted = extractHtmlSession(extractKind, text, { url: response.url || url.toString() });
+    if (target.embeddedJsonMarker) {
+      const embedded = extractEmbeddedJson(text, target.embeddedJsonMarker);
+      if (embedded) extracted = { ...extracted, embedded };
+    }
+  }
+
+  if (
+    !response.ok &&
+    !extracted?.authenticated &&
+    isAuthStatusResponse(response.status) &&
+    shouldRetryAuthAfterFailure({ status: response.status }, authOptions)
+  ) {
+    await ensureOktaAppSession(appName, {
+      ...authOptions,
+      config,
+      forceBrowser: true,
+      openBrowserOnMissing: true
+    });
+    return oktaAppHttpRead(appName, input, { ...authOptions, _retriedAuth: true });
+  }
+
+  if (!response.ok && !extracted?.authenticated) {
+    throw new Error(
+      `Okta app "${appName}" read failed (${response.status}) at ${restPath}. Open ${session.authUrl} in Chrome to refresh login.`
+    );
+  }
+
+  return {
+    readOnly: true,
+    method: "GET",
+    oktaApp: appName,
+    service: app.serviceId,
+    baseUrl,
+    host,
+    restPath,
+    url: (response.url || url).toString(),
+    status: response.status,
+    contentType,
+    data: data ?? (extracted ? undefined : text.slice(0, 4000)),
+    extracted,
+    bodyLength: text.length
+  };
+}

package/vendor/extension-sso/src/oktaConfig.mjs

@@ -0,0 +1,12 @@
+import { getSsoConfig } from "./ssoConfig.mjs";
+
+/** @deprecated Use getSsoConfig — kept for backward compatibility. */
+export function getOktaConfig(env = process.env) {
+  return getSsoConfig(env);
+}
+
+export function assertOktaConfig(config = getSsoConfig()) {
+  if (!config.domain) {
+    throw new Error("Missing WORKDAY_OKTA_DOMAIN. Copy .env.example to .env and set your Okta org domain.");
+  }
+}

package/vendor/extension-sso/src/oktaSession.mjs

@@ -0,0 +1,32 @@
+import {
+  buildCookieHeader,
+  isValidationFresh,
+  jarSummary,
+  loadCookieJar,
+  saveCookieJar
+} from "./cookieJar.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+
+/** @deprecated Use loadCookieJar — session is now a browser cookie jar. */
+export async function loadSession(sessionPath) {
+  const config = getSsoConfig();
+  return loadCookieJar(sessionPath ?? config.cookieJarPath);
+}
+
+/** @deprecated Use saveCookieJar */
+export async function saveSession(sessionPath, session) {
+  return saveCookieJar(sessionPath, session);
+}
+
+/** @deprecated Use jar validation via sessionManager */
+export function isSessionValid(jar, now = Date.now()) {
+  if (!jar?.cookies?.length) return false;
+  const config = getSsoConfig();
+  if (jar.authenticated && isValidationFresh(jar, config.validateTtlMs, now)) return true;
+  return Boolean(buildCookieHeader(jar.cookies, config.domain));
+}
+
+/** @deprecated Use jarSummary */
+export function sessionSummary(jar, config) {
+  return jarSummary(jar, config ?? getSsoConfig());
+}