@nuvlore/extension-access-pagerduty 0.1.1

package/vendor/extension-sso/README.md

@@ -0,0 +1,35 @@
+# @nuvlore/extension-sso
+
+Okta browser SSO for Workday — log in once in Chrome, reuse cookies across Nuvlore Workday tools.
+
+Workday Okta does not support OIDC device authorization; this extension imports session cookies from Chrome (macOS) and persists them locally.
+
+## Configure
+
+Copy the repo `.env.example` to `.env` and set:
+
+- `WORKDAY_OKTA_DOMAIN` — e.g. `workday.okta.com`
+- `WORKDAY_OKTA_LOGIN_URL` — default `https://<domain>/app/UserHome`
+
+No `WORKDAY_OKTA_CLIENT_ID` is required.
+
+Cookies are stored at `~/.Nuvlore/workday/cookie-jar.json` (mode 600).
+
+This repository vendors the Nuvlore browser SSO and read-only toolkit packages under `vendor/`
+so private-repo CI can install dependencies without organization-wide package registry credentials.
+
+## Tools
+
+| Tool | Purpose |
+|------|---------|
+| `workday_okta_login` | Ensure session (opens Chrome only when needed) |
+| `workday_okta_status` | Session status |
+| `workday_okta_auth_header` | Cookie header for Okta org (legacy tool name) |
+| `workday_sso_cookie_header` | Cookie header for a service host |
+| `workday_service_auth` | Check SSO readiness per service |
+
+## Test
+
+```sh
+npm exec -- Nuvlore-package-test
+```

package/vendor/extension-sso/commands/okta-login.md

@@ -0,0 +1,10 @@
+# okta-login
+
+Log in to Workday Okta SSO once for `$ARGUMENTS`.
+
+Steps:
+
+1. Load the `workday-okta-auth` skill.
+2. Call `workday_okta_status`.
+3. If needed, call `workday_okta_login` and wait for browser SSO completion.
+4. Confirm session with `workday_okta_status`.

package/vendor/extension-sso/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@nuvlore/extension-sso",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Okta browser SSO for Workday services — one Chrome login, shared session cookies.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    "./sso-http-read": "./src/ssoHttpRead.mjs",
+    "./okta-app-access": "./src/oktaAppAccess.mjs",
+    "./okta-app-read": "./src/oktaAppRead.mjs",
+    "./service-reads": "./src/serviceReads.mjs",
+    "./service-operations": "./src/serviceOperations.mjs",
+    "./service-read-search": "./src/serviceReadSearch.mjs",
+    "./html-session-extract": "./src/htmlSessionExtract.mjs",
+    "./auto-auth": "./src/autoAuth.mjs",
+    "./session-auth": "./src/sessionAuth.mjs",
+    "./session-manager": "./src/sessionManager.mjs",
+    "./sso-config": "./src/ssoConfig.mjs"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "tools",
+    "skills",
+    "commands",
+    "src"
+  ],
+  "scripts": {
+    "test": "npm run test:unit && npm run test:integration",
+    "test:unit": "vitest run test/*.test.ts",
+    "test:integration": "vitest run test/integration/*.test.ts"
+  },
+  "agentRuntimeDistribution": {
+    "visibility": "private",
+    "group": "sso",
+    "serviceGrouping": "single-service",
+    "publicService": false,
+    "rationale": "Centralized Okta SSO for Workday Okta-protected services."
+  },
+  "agentRuntimeTools": {
+    "service": "sso"
+  },
+  "dependencies": {
+    "@nuvlore/extension-browser-sso": "file:vendor/extension-browser-sso",
+    "@nuvlore/extension-read-only-toolkit": "file:vendor/extension-read-only-toolkit"
+  },
+  "devDependencies": {
+    "vitest": "^3.1.3"
+  }
+}

package/vendor/extension-sso/skills/workday-okta-auth/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: workday-okta-auth
+description: Use when the user needs Okta SSO login or shared auth for Workday services.
+---
+
+# Workday Okta Auth
+
+## When To Use
+
+Use this skill when accessing Workday Okta-protected systems (Bamboo, Jira, Confluence, Bitbucket, Pharos, Slack) and the user should not manage per-service access tokens manually.
+
+## Procedure
+
+1. Check `workday_okta_status` for an existing browser session.
+2. If unauthenticated, run `workday_okta_login`. Chrome opens only when cookies are missing or expired; if the user is already logged into Okta in Chrome, cookies are imported silently.
+3. For HTTP calls to a specific service, use `workday_sso_cookie_header` with the extension service id (e.g. `jira`, `bitbucket`, `pharos`, `dashboard`, `workday-infra-access`). Run `workday_list_services` to see all extension mappings.
+4. `workday_okta_auth_header` returns the Okta org Cookie header (not a Bearer token).
+5. For Slack, use `workday_okta_open_app({ app: "Slack" })` when Chrome/Okta/Slack needs user-facing authentication, then use `slack_okta_search_messages` / `slack_okta_search_all` for read-only context.
+6. **Read-only by default** — use SSO cookies for GET/browse/investigation. Never create, update, delete, merge, deploy, or mutate any Workday service through this product unless the user explicitly requests a one-off write in the current chat.
+7. For explicit Slack send requests, use `slack_okta_send_message` with a concrete Slack conversation id. Do not print Slack browser-session tokens or cookies.

package/vendor/extension-sso/src/autoAuth.mjs

@@ -0,0 +1,25 @@
+export {
+  isAuthStatusResponse,
+  shouldRetryAuthAfterFailure
+} from "@nuvlore/extension-browser-sso/auto-auth";
+
+import {
+  isAutoAuthEnabled as isBrowserAutoAuthEnabled,
+  resolveAutoAuthOptions as resolveBrowserAutoAuthOptions
+} from "@nuvlore/extension-browser-sso/auto-auth";
+
+/** Map product-specific env aliases onto generic browser-sso flags. */
+function mergeAutoAuthEnv(env = process.env) {
+  const legacyFlag = env.WORKDAY_SSO_AUTO_AUTH?.trim();
+  if (!legacyFlag) return env;
+  return { ...env, BROWSER_SSO_AUTO_AUTH: legacyFlag };
+}
+
+export function isAutoAuthEnabled(env = process.env) {
+  return isBrowserAutoAuthEnabled(mergeAutoAuthEnv(env));
+}
+
+export function resolveAutoAuthOptions(options = {}) {
+  const env = mergeAutoAuthEnv(options.env ?? process.env);
+  return resolveBrowserAutoAuthOptions({ ...options, env });
+}

package/vendor/extension-sso/src/browserLogin.mjs

@@ -0,0 +1 @@
+export * from "@nuvlore/extension-browser-sso/browser-login";

package/vendor/extension-sso/src/chromeCookies.mjs

@@ -0,0 +1 @@
+export * from "@nuvlore/extension-browser-sso/chrome-cookies";

package/vendor/extension-sso/src/cookieJar.mjs

@@ -0,0 +1 @@
+export * from "@nuvlore/extension-browser-sso/cookie-jar";

package/vendor/extension-sso/src/extensionAccess.mjs

@@ -0,0 +1,173 @@
+import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
+import { assertNonHtmlApiResponse } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import { resolveAutoAuthOptions } from "./autoAuth.mjs";
+import { getServiceCookieHeader } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getRequiredServices, getWorkdayService, listWorkdayServices } from "./serviceRegistry.mjs";
+import { ssoReadGet } from "./ssoHttpRead.mjs";
+import { oktaAppReadGet } from "./oktaAppAccess.mjs";
+
+export function assertReadOnlyHttpRequest({ method = "GET", path = "" } = {}) {
+  const normalizedMethod = String(method).toUpperCase();
+  if (normalizedMethod !== "GET") {
+    throw new Error(`Read-only product: HTTP method ${normalizedMethod} is not allowed. Use GET only.`);
+  }
+  const rawPath = String(path || "");
+  if (/^https?:\/\//i.test(rawPath)) {
+    throw new Error("Read-only extension access: use restPath relative to defaultBaseUrl, not an absolute URL.");
+  }
+  if (rawPath.includes("..")) {
+    throw new Error("Read-only extension access: path cannot contain parent directory traversal.");
+  }
+  if (/\/(delete|edit|transition|merge|deploy|apply|update|create)(\/|$)/i.test(rawPath)) {
+    throw new Error(`Read-only product: path appears mutating and is blocked: ${rawPath}`);
+  }
+}
+
+function accessMode(service) {
+  return service.readAccess?.mode ?? "unsupported";
+}
+
+export async function getExtensionReadAccess(serviceId, options = {}) {
+  const service = getWorkdayService(serviceId);
+  const readAccess = service.readAccess ?? { readOnly: true, mode: "unsupported" };
+  const mode = accessMode(service);
+
+  if (mode === "workflow") {
+    return {
+      readOnly: true,
+      methods: readAccess.methods ?? ["GET"],
+      mode,
+      service: serviceId,
+      extension: service.extension,
+      label: service.label,
+      requires: getRequiredServices(serviceId).map((dep) => ({
+        service: dep.id,
+        extension: dep.extension,
+        label: dep.label,
+        readOnly: true,
+        mode: dep.readAccess?.mode ?? "unsupported"
+      })),
+      recommendation: "Workflow extension — call workday_extension_read_access on each required extension service directly."
+    };
+  }
+
+  if (mode === "cli-readonly" || mode === "ssh-readonly" || mode === "local" || mode === "library" || mode === "mcp" || mode === "unsupported") {
+    return {
+      readOnly: true,
+      methods: readAccess.methods ?? [],
+      mode,
+      service: serviceId,
+      extension: service.extension,
+      label: service.label,
+      ready: mode !== "unsupported",
+      platforms: readAccess.platforms,
+      note: readAccess.note ?? `${service.label} uses read-only tools, not browser cookie HTTP.`,
+      recommendation:
+        mode === "local" || mode === "library"
+          ? "No remote SSO needed."
+          : "Use the extension's read-only command-pack tool."
+    };
+  }
+
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const baseUrl = normalizeBaseUrl(
+    authOptions.baseUrl || readAccess.defaultBaseUrl || `https://${service.domains?.[0] || ""}`
+  );
+  const cookieResult =
+    mode === "public-http"
+      ? { ok: true, cookie: "", host: new URL(baseUrl).host, summary: { authenticated: true } }
+      : await getServiceCookieHeader(serviceId, { ...authOptions, config });
+
+  return {
+    readOnly: true,
+    methods: readAccess.methods ?? ["GET"],
+    mode,
+    service: serviceId,
+    extension: service.extension,
+    label: service.label,
+    baseUrl,
+    host: cookieResult.host,
+    restPathPrefix: readAccess.restPathPrefix ?? "",
+    ready: cookieResult.ok || mode === "public-http",
+    headers: {
+      accept: "application/json",
+      ...(cookieResult.cookie ? { cookie: cookieResult.cookie } : {})
+    },
+    userAgent: `Mozilla/5.0 nuvlore/0.1 ${serviceId}-read`,
+    summary: cookieResult.summary,
+    recommendation: cookieResult.ok
+      ? `Read-only GET ${baseUrl}<restPath> via workday_extension_read (service=${serviceId}).`
+      : cookieResult.authUrl
+        ? `Open ${cookieResult.authUrl} in Chrome via Okta to refresh session, then retry.`
+        : "Run workday_okta_login, then retry."
+  };
+}
+
+export async function extensionReadGet(serviceId, input = {}, options = {}) {
+  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || input.path });
+  const authOptions = resolveAutoAuthOptions(options);
+  const service = getWorkdayService(serviceId);
+  if (service.readAccess?.oktaAppName) {
+    return oktaAppReadGet(service.readAccess.oktaAppName, input, authOptions);
+  }
+  const access = await getExtensionReadAccess(serviceId, authOptions);
+  if (access.mode === "workflow") {
+    throw new Error(
+      `Extension ${access.extension} is a workflow bundle. Use workday_extension_read_access and call a required extension service directly.`
+    );
+  }
+  if (access.mode === "cookie-http") {
+    return ssoReadGet(serviceId, input, authOptions);
+  }
+  if (access.mode !== "public-http") {
+    throw new Error(`Extension ${access.extension} does not support read-only HTTP GET (${access.mode}).`);
+  }
+  if (!access.ready) {
+    throw new Error(access.recommendation || `Read access not ready for ${serviceId}.`);
+  }
+
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const restPath = String(input.restPath || input.path || "").trim();
+  if (!restPath) throw new Error("restPath is required for read-only extension GET.");
+  const baseUrl = normalizeBaseUrl(input.baseUrl || access.baseUrl);
+  const url = buildRequestUrl(baseUrl, restPath, input.query);
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: {
+      accept: access.headers.accept,
+      "user-agent": access.userAgent,
+      ...(access.headers.cookie ? { cookie: access.headers.cookie } : {})
+    }
+  });
+  const text = await response.text();
+  assertNonHtmlApiResponse(access.label, text);
+  const data = parseResponseBody(text);
+  if (!response.ok) {
+    throw new Error(`${access.label} read failed with status ${response.status}.`);
+  }
+  return {
+    readOnly: true,
+    method: "GET",
+    service: serviceId,
+    extension: access.extension,
+    baseUrl,
+    restPath,
+    url: url.toString(),
+    status: response.status,
+    data
+  };
+}
+
+export function listExtensionReadAccess() {
+  return listWorkdayServices().map((service) => ({
+    service: service.id,
+    extension: service.extension,
+    label: service.label,
+    auth: service.auth,
+    readOnly: service.readAccess?.readOnly !== false,
+    mode: accessMode(service),
+    requires: service.requires ?? []
+  }));
+}

package/vendor/extension-sso/src/htmlSessionExtract.mjs

@@ -0,0 +1 @@
+export * from "@nuvlore/extension-browser-sso/html-session-extract";

package/vendor/extension-sso/src/oktaAppAccess.mjs

@@ -0,0 +1,133 @@
+import { resolveBestCookieHost } from "./cookieJar.mjs";
+import { getExtensionReadAccess, extensionReadGet } from "./extensionAccess.mjs";
+import { ensureSsoSession, syncAllOktaCatalogCookies } from "./sessionManager.mjs";
+import { resolveAutoAuthOptions } from "./autoAuth.mjs";
+import { ensureOktaAppSession } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getOktaApp, listOktaApps } from "./oktaAppCatalog.mjs";
+import { oktaAppHttpRead } from "./oktaAppRead.mjs";
+import { readServiceDefault } from "./serviceReads.mjs";
+import { probeReadOnlyUrl } from "./sessionValidate.mjs";
+
+export { probeReadOnlyUrl };
+
+export async function getOktaAppReadAccess(appName, options = {}) {
+  const app = getOktaApp(appName);
+  const readOnly = true;
+
+  if (app.serviceId && app.mode !== "cli-readonly") {
+    try {
+      const extensionAccess = await getExtensionReadAccess(app.serviceId, options);
+      return {
+        readOnly,
+        oktaApp: appName,
+        ...extensionAccess,
+        probePath: app.probePath,
+        defaultBaseUrl: app.defaultBaseUrl ?? extensionAccess.baseUrl
+      };
+    } catch {
+      // fall through to cookie probe
+    }
+  }
+
+  if (app.mode === "cli-readonly") {
+    return {
+      readOnly,
+      oktaApp: appName,
+      service: app.serviceId,
+      mode: "cli-readonly",
+      platform: app.platform,
+      ready: true,
+      recommendation: "Read-only CLI tools only — describe/list/get/logs."
+    };
+  }
+
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const { jar } = await ensureOktaAppSession(appName, { ...authOptions, config });
+  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
+  const probe = hasCookies
+    ? await probeReadOnlyUrl(jar, { host, path: app.probePath ?? "/", cookie, fetchImpl: options.fetchImpl })
+    : { ready: false, reason: "no_cookies" };
+
+  return {
+    readOnly,
+    methods: ["GET"],
+    oktaApp: appName,
+    service: app.serviceId,
+    mode: app.mode ?? "cookie-http",
+    baseUrl: app.defaultBaseUrl,
+    host,
+    hasCookies,
+    ready: Boolean(hasCookies && probe.ready),
+    probe,
+    cookiePresent: Boolean(cookie),
+    recommendation: probe.ready
+      ? `Read-only GET ${app.defaultBaseUrl}${app.probePath ?? "/"}`
+      : hasCookies
+        ? "Cookies present but session probe failed — open app in Chrome once."
+        : "Open app in Chrome via Okta, then retry."
+  };
+}
+
+export async function oktaAppReadGet(appName, input = {}, options = {}) {
+  const app = getOktaApp(appName);
+
+  if (app.serviceId && !input.forceCookie) {
+    try {
+      if (input.useDefault) {
+        return readServiceDefault(app.serviceId, options);
+      }
+      return await extensionReadGet(
+        app.serviceId,
+        {
+          restPath: input.restPath || app.probePath,
+          baseUrl: input.baseUrl || app.defaultBaseUrl,
+          query: input.query,
+          followRedirects: input.followRedirects
+        },
+        options
+      );
+    } catch (error) {
+      if (!input.allowCookieFallback) throw error;
+    }
+  }
+
+  return oktaAppHttpRead(appName, input, options);
+}
+
+export async function probeAllOktaApps(options = {}) {
+  const authOptions = resolveAutoAuthOptions(options);
+  if (!authOptions.probeOnly) {
+    await ensureSsoSession({
+      config: authOptions.config ?? getSsoConfig(),
+      openBrowserOnMissing: authOptions.openBrowserOnMissing,
+      forceBrowser: authOptions.forceBrowser === true,
+      onStatus: authOptions.onStatus
+    }).catch(() => {});
+  }
+  await syncAllOktaCatalogCookies(options);
+  const results = [];
+  for (const app of listOktaApps()) {
+    try {
+      const access = await getOktaAppReadAccess(app.name, { ...options, probeOnly: true });
+      results.push({
+        app: app.name,
+        service: app.serviceId,
+        mode: access.mode,
+        ready: access.ready === true,
+        host: access.host,
+        status: access.probe?.status
+      });
+    } catch (error) {
+      results.push({
+        app: app.name,
+        ready: false,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return results;
+}
+
+export { listOktaApps };

package/vendor/extension-sso/src/oktaAppCatalog.mjs

@@ -0,0 +1,118 @@
+/**
+ * All apps visible on https://workday.okta.com/app/UserHome
+ * Read-only access only — probe paths are GET.
+ */
+export const OKTA_USER_HOME_APPS = {
+  Workday: {
+    serviceId: "sso",
+    domains: ["workday.okta.com"],
+    defaultBaseUrl: "https://workday.okta.com",
+    probePath: "/app/UserHome"
+  },
+  JIRA2: { serviceId: "jira", domains: ["jira2.workday.com"], defaultBaseUrl: "https://jira2.workday.com", probePath: "/rest/api/latest/myself" },
+  Bitbucket: { serviceId: "bitbucket", domains: ["bitbucket.workday.com"], defaultBaseUrl: "https://bitbucket.workday.com", probePath: "/" },
+  Confluence: { serviceId: "confluence", domains: ["confluence.workday.com"], defaultBaseUrl: "https://confluence.workday.com", probePath: "/rest/api/user/current" },
+  Pharos: { serviceId: "pharos", domains: ["grafana.produs.us.wdpharos.io"], defaultBaseUrl: "https://grafana.produs.us.wdpharos.io", probePath: "/login" },
+  "GitHub EMU Cloud": { serviceId: "github", domains: ["ghe.megaleo.com"], defaultBaseUrl: "https://ghe.megaleo.com", probePath: "/" },
+  PagerDuty: { serviceId: "pagerduty", domains: ["workday.pagerduty.com"], defaultBaseUrl: "https://workday.pagerduty.com", probePath: "/" },
+  "Amazon Web Services - AWS": { serviceId: "workday-infra-access", platform: "aws", domains: ["signin.aws.amazon.com"], defaultBaseUrl: "https://signin.aws.amazon.com", probePath: "/", mode: "cli-readonly" },
+  Slack: {
+    domains: ["workday.enterprise.slack.com", "workday.slack.com", "workday-dev.slack.com", "slack.com", "app.slack.com"],
+    defaultBaseUrl: "https://workday.enterprise.slack.com",
+    probePath: "/"
+  },
+  Zoom: { domains: ["workday.zoom.us", "zoom.us", "us.telemetry.zoom.us"], defaultBaseUrl: "https://workday.zoom.us", probePath: "/" },
+  Horizon: { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "On Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "People & Purpose on Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "Workday Service Hub": { domains: ["workday.service-now.com"], defaultBaseUrl: "https://workday.service-now.com", probePath: "/" },
+  "Analytics Hub": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Internal Analytics": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Workday - Google Apps Drive": {
+    domains: ["drive.google.com", "accounts.google.com", "google.com"],
+    defaultBaseUrl: "https://drive.google.com",
+    probePath: "/drive/"
+  },
+  Sana: {
+    domains: ["workday.sana.ai", "sana.ai", "sanalabs.com"],
+    defaultBaseUrl: "https://workday.sana.ai",
+    agentsUrl: "https://sana.ai/tPNxyS5GyK1r",
+    agentsWorkspaceId: "tPNxyS5GyK1r",
+    probePath: "/",
+    launchViaUserHome: true
+  },
+  Peakon: { domains: ["workday.peakon.com", "peakon.com"], defaultBaseUrl: "https://workday.peakon.com", probePath: "/" },
+  "Workday Community": { domains: ["community.workday.com"], defaultBaseUrl: "https://community.workday.com", probePath: "/" },
+  Achievers: { domains: ["workday.achievers.com"], defaultBaseUrl: "https://workday.achievers.com", probePath: "/" },
+  Workboard: { domains: ["workboard.com"], defaultBaseUrl: "https://www.workboard.com", probePath: "/" },
+  "Eptura Office Space Tool & Desk Reservations": { domains: ["workday.iofficeconnect.com"], defaultBaseUrl: "https://workday.iofficeconnect.com", probePath: "/" },
+  Miro: { domains: ["miro.com", "www.miro.com"], defaultBaseUrl: "https://miro.com", probePath: "/app/dashboard/" },
+  OneTrust: { domains: ["app.onetrust.com"], defaultBaseUrl: "https://app.onetrust.com", probePath: "/" },
+  "Collibra Data Intelligence Platform": { domains: ["workday.collibra.com"], defaultBaseUrl: "https://workday.collibra.com", probePath: "/" },
+  Snyk: { domains: ["app.snyk.io"], defaultBaseUrl: "https://app.snyk.io", probePath: "/" },
+  Seismic: { domains: ["workday.seismic.com"], defaultBaseUrl: "https://workday.seismic.com", probePath: "/" },
+  Togglr: { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Togglr - Internal": { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Metrics Portal": { domains: ["metrics.workday.com"], defaultBaseUrl: "https://metrics.workday.com", probePath: "/" },
+  "Security Portal": { domains: ["security.workday.com"], defaultBaseUrl: "https://security.workday.com", probePath: "/" },
+  "Microsoft Office 365 Office Portal": { domains: ["office.com"], defaultBaseUrl: "https://www.office.com", probePath: "/" },
+  "Microsoft Outlook": { domains: ["outlook.office.com"], defaultBaseUrl: "https://outlook.office.com", probePath: "/" },
+  Mixpanel: { domains: ["mixpanel.com"], defaultBaseUrl: "https://mixpanel.com", probePath: "/" },
+  "Secure Code Warrior": { domains: ["securecodewarrior.com"], defaultBaseUrl: "https://portal.securecodewarrior.com", probePath: "/" },
+  "Proofpoint Security Education Platform": { domains: ["proofpoint.com"], defaultBaseUrl: "https://www.proofpoint.com", probePath: "/" },
+  "HackerRank For Work": { domains: ["hackerrank.com"], defaultBaseUrl: "https://www.hackerrank.com", probePath: "/" },
+  "Visitor Registration": { domains: ["envoy.com"], defaultBaseUrl: "https://envoy.com", probePath: "/" },
+  "Healthy Working": { domains: ["cardinus.com"], defaultBaseUrl: "https://www.cardinus.com", probePath: "/" },
+  Meetingselect: { domains: ["meetingselect.com"], defaultBaseUrl: "https://www.meetingselect.com", probePath: "/" },
+  EveryoneSocial: { domains: ["everyonesocial.com"], defaultBaseUrl: "https://everyonesocial.com", probePath: "/" },
+  Aperian: { domains: ["aperianglobal.com"], defaultBaseUrl: "https://www.aperianglobal.com", probePath: "/" },
+  "BT diagramming": { domains: ["lucid.co"], defaultBaseUrl: "https://lucid.co", probePath: "/" },
+  "Fragomen Nomadic": { domains: ["fragomen.com"], defaultBaseUrl: "https://www.fragomen.com", probePath: "/" },
+  "6120 Meeting Center Booking": { domains: ["briefingsource.com"], defaultBaseUrl: "https://www.briefingsource.com", probePath: "/" },
+  "WCP Dev Site": { domains: ["workday.com"], defaultBaseUrl: "https://developer.workday.com", probePath: "/" },
+  "Workday Procurement": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Travel Tool - US": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Policies": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Pattern Library": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Canvas Design System": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Global Records Retention Schedule": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Digital Event Library": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Employee Event Registration": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  DevCon: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  WOAH: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "VitalSource eBooks": { domains: ["vitalsource.com"], defaultBaseUrl: "https://www.vitalsource.com", probePath: "/" },
+  "P&T Planner": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "P&T Okta Password Check": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  "INF-IDM": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  ISD: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "SkyLab Portal": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Prod LDAP Password Tool": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "PRM-Wallboard": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  Osprey: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  ArcPrime: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Google Gemini": { domains: ["gemini.google.com"], defaultBaseUrl: "https://gemini.google.com", probePath: "/", mode: "bookmark" },
+  NotebookLM: { domains: ["notebooklm.google.com"], defaultBaseUrl: "https://notebooklm.google.com", probePath: "/", mode: "bookmark" },
+  Lovable: { domains: ["lovable.dev"], defaultBaseUrl: "https://lovable.dev", probePath: "/", mode: "bookmark" }
+};
+
+export function listOktaApps() {
+  return Object.entries(OKTA_USER_HOME_APPS).map(([name, app]) => ({
+    name,
+    readOnly: true,
+    ...app,
+    mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http")
+  }));
+}
+
+export function getOktaApp(name) {
+  const app = OKTA_USER_HOME_APPS[name];
+  if (!app) {
+    throw new Error(`Unknown Okta app: ${name}`);
+  }
+  return { name, readOnly: true, ...app, mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http") };
+}
+
+export function getOktaAppByServiceId(serviceId) {
+  const match = listOktaApps().find((app) => app.serviceId === serviceId);
+  return match ?? null;
+}