@nuvlore/extension-access-pagerduty 0.1.1

package/vendor/extension-sso/src/sessionAuth.mjs

@@ -0,0 +1,339 @@
+import {
+  cookiesForHost,
+  jarSummary,
+  loadCookieJar,
+  mergeCookies,
+  resolveBestCookieHost,
+  saveCookieJar
+} from "./cookieJar.mjs";
+import { openBrowser, waitFor } from "./browserLogin.mjs";
+
+export { openBrowser };
+import {
+  isAutoAuthEnabled,
+  resolveAutoAuthOptions
+} from "./autoAuth.mjs";
+
+export { isAutoAuthEnabled, resolveAutoAuthOptions };
+import {
+  ensureSsoSession,
+  importCookiesFromChrome,
+  syncOktaAppCookies
+} from "./sessionManager.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getServiceDomains, getWorkdayService } from "./serviceRegistry.mjs";
+import { getOktaApp } from "./oktaAppCatalog.mjs";
+import { validateOktaAppHost, validateServiceHost } from "./sessionValidate.mjs";
+
+function hasCookiesForDomains(jar, domains) {
+  if (!domains.length) return true;
+  return domains.some((domain) => cookiesForHost(jar?.cookies ?? [], domain).length > 0);
+}
+
+async function mergeImportedCookies(config, jar, domains) {
+  const imported = await importCookiesFromChrome(config, [config.domain, ...domains]);
+  if (!imported?.cookies?.length) return jar;
+  const next = {
+    ...(jar ?? {}),
+    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+    source: imported.source ?? "chrome"
+  };
+  await saveCookieJar(config.cookieJarPath, next);
+  return next;
+}
+
+export async function waitForChromeCookies(
+  config,
+  domains,
+  { timeoutMs, pollMs = 2000, onStatus, label } = {}
+) {
+  const deadline = Date.now() + (timeoutMs ?? config.loginTimeoutMs);
+  let jar = await loadCookieJar(config.cookieJarPath);
+  while (Date.now() < deadline) {
+    onStatus?.({ phase: "waiting_for_app_cookies", label, domains });
+    jar = await mergeImportedCookies(config, jar, domains);
+    if (hasCookiesForDomains(jar, domains)) {
+      return { jar, ready: true };
+    }
+    await waitFor(pollMs);
+  }
+  return { jar, ready: hasCookiesForDomains(jar, domains) };
+}
+
+async function openAuthPageAndWait(config, { authUrl, domains, label, options }) {
+  options.onStatus?.({ phase: "opening_auth", label, url: authUrl });
+  await openBrowser(authUrl, { chromeProfile: config.chromeProfile });
+  const waited = await waitForChromeCookies(config, domains, {
+    timeoutMs: options.appAuthTimeoutMs,
+    onStatus: options.onStatus,
+    label
+  });
+  return { jar: waited.jar, ready: waited.ready, openedBrowser: true };
+}
+
+export function resolveServiceAuthUrl(serviceId) {
+  const service = getWorkdayService(serviceId);
+  const domains = getServiceDomains(serviceId);
+  return service.readAccess?.authUrl || service.readAccess?.defaultBaseUrl || (domains[0] ? `https://${domains[0]}` : getSsoConfig().loginUrl);
+}
+
+export function resolveOktaAppAuthUrl(appName) {
+  const app = getOktaApp(appName);
+  if (app.mode === "bookmark" || app.mode === "oidc-app") {
+    return getSsoConfig().loginUrl;
+  }
+  return app.agentsUrl || app.defaultBaseUrl || getSsoConfig().loginUrl;
+}
+
+/** Open Chrome at the Okta app URL so the user can sign in (read-only). */
+export async function openOktaAppForAuth(appName, options = {}) {
+  const config = options.config ?? getSsoConfig();
+  const app = getOktaApp(appName);
+  const authUrl = resolveOktaAppAuthUrl(appName);
+  const domains = app.domains ?? [];
+  let openedBrowser = false;
+
+  if (app.launchViaUserHome && options.skipUserHome !== true) {
+    options.onStatus?.({
+      phase: "opening_okta_userhome",
+      oktaApp: appName,
+      url: config.loginUrl,
+      hint:
+        appName === "Sana"
+          ? 'On workday.sana.ai click "Continue with SSO" to finish login'
+          : `Click "${appName}" on UserHome if SSO does not auto-launch`
+    });
+    await openBrowser(config.loginUrl, { chromeProfile: config.chromeProfile });
+    openedBrowser = true;
+    if (options.userHomeDelayMs !== 0) {
+      await waitFor(options.userHomeDelayMs ?? 2500);
+    }
+  }
+
+  const result = await openAuthPageAndWait(config, {
+    authUrl,
+    domains: domains.length ? domains : [config.domain],
+    label: appName,
+    options
+  });
+  return { authUrl, userHomeUrl: app.launchViaUserHome ? config.loginUrl : undefined, openedBrowser: openedBrowser || result.openedBrowser, ...result };
+}
+
+/** Open Chrome at the Workday service URL so the user can sign in via Okta (read-only). */
+export async function openServiceForAuth(serviceId, options = {}) {
+  const config = options.config ?? getSsoConfig();
+  const domains = getServiceDomains(serviceId);
+  const authUrl = resolveServiceAuthUrl(serviceId);
+  const result = await openAuthPageAndWait(config, {
+    authUrl,
+    domains: domains.length ? domains : [config.domain],
+    label: serviceId,
+    options
+  });
+  let serviceReady = false;
+  for (const domain of domains) {
+    if (await validateServiceHost(result.jar, domain).catch(() => false)) {
+      serviceReady = true;
+      break;
+    }
+  }
+  return { authUrl, openedBrowser: true, ...result, ready: serviceReady, serviceReady };
+}
+
+export async function getServiceCookieHeader(serviceId, options = {}) {
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const session = await ensureServiceSession(serviceId, { ...authOptions, config });
+  const domains = getServiceDomains(serviceId);
+  const { host, cookie, hasCookies } = resolveBestCookieHost(session.jar, domains);
+
+  if (!host || !session.jar?.cookies?.length || !hasCookies) {
+    return {
+      ok: false,
+      summary: session.summary,
+      host,
+      domains,
+      serviceReady: session.serviceReady,
+      openedBrowser: session.openedBrowser,
+      authUrl: session.authUrl,
+      message: `No cookies for ${serviceId}. Open ${session.authUrl} in Chrome via Okta, then retry.`
+    };
+  }
+
+  const ready = session.summary.authenticated && Boolean(cookie) && session.serviceReady;
+  return {
+    ok: ready,
+    summary: session.summary,
+    host,
+    cookie,
+    domains,
+    serviceReady: session.serviceReady,
+    openedBrowser: session.openedBrowser,
+    authUrl: session.authUrl
+  };
+}
+
+export async function ensureServiceSession(serviceId, options = {}) {
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const { autoAuth, openBrowserOnMissing } = authOptions;
+  const domains = getServiceDomains(serviceId);
+  const authUrl = resolveServiceAuthUrl(serviceId);
+  let openedBrowser = false;
+
+  let { jar, summary, openedBrowser: oktaOpened } = await ensureSsoSession({
+    config,
+    serviceId,
+    openBrowserOnMissing,
+    forceBrowser: authOptions.forceBrowser === true,
+    onStatus: authOptions.onStatus
+  });
+  summary = summary ?? jarSummary(jar ?? {}, config);
+  openedBrowser = openedBrowser || oktaOpened;
+
+  jar = await mergeImportedCookies(config, jar, domains);
+  let hasServiceCookies = hasCookiesForDomains(jar, domains);
+  let serviceReady = false;
+  if (summary.authenticated && hasServiceCookies) {
+    for (const domain of domains) {
+      if (await validateServiceHost(jar, domain).catch(() => false)) {
+        serviceReady = true;
+        break;
+      }
+    }
+  }
+
+  const needsAuth =
+    openBrowserOnMissing && (!hasServiceCookies || (hasServiceCookies && !serviceReady));
+
+  if (needsAuth) {
+    authOptions.onStatus?.({ phase: "opening_service_auth", service: serviceId, url: authUrl });
+    const auth = await openAuthPageAndWait(config, {
+      authUrl,
+      domains,
+      label: serviceId,
+      options: authOptions
+    });
+    jar = auth.jar;
+    openedBrowser = openedBrowser || auth.openedBrowser;
+    hasServiceCookies = hasCookiesForDomains(jar, domains);
+    if (!auth.ready && !hasServiceCookies) {
+      throw new Error(
+        `Service ${serviceId} auth timed out. Complete login in Chrome at ${authUrl}, then retry.`
+      );
+    }
+    summary = jarSummary(jar, config);
+    serviceReady = false;
+    if (summary.authenticated) {
+      for (const domain of domains) {
+        if (await validateServiceHost(jar, domain).catch(() => false)) {
+          serviceReady = true;
+          break;
+        }
+      }
+    }
+  }
+
+  return {
+    jar,
+    summary,
+    openedBrowser,
+    serviceReady,
+    hasServiceCookies,
+    authUrl
+  };
+}
+
+export async function ensureOktaAppSession(appName, options = {}) {
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const { openBrowserOnMissing } = authOptions;
+  const app = getOktaApp(appName);
+  const domains = app.domains ?? [];
+  const authUrl = resolveOktaAppAuthUrl(appName);
+  let openedBrowser = false;
+
+  if (app.mode === "cli-readonly") {
+    const { jar, summary } = await ensureSsoSession({
+      config,
+      openBrowserOnMissing,
+      onStatus: authOptions.onStatus
+    });
+    return { jar, summary, openedBrowser: false, appReady: true, authUrl };
+  }
+
+  let { jar, summary, openedBrowser: oktaOpened } = await ensureSsoSession({
+    config,
+    openBrowserOnMissing,
+    forceBrowser: authOptions.forceBrowser === true,
+    onStatus: authOptions.onStatus
+  });
+  openedBrowser = openedBrowser || oktaOpened;
+
+  await syncOktaAppCookies(appName, { config });
+  jar = await loadCookieJar(config.cookieJarPath);
+  let hasAppCookies = hasCookiesForDomains(jar, domains);
+  let appValidated =
+    !domains.length ||
+    app.mode === "bookmark" ||
+    app.mode === "oidc-app" ||
+    (hasAppCookies && (await validateOktaAppHost(jar, app, authOptions.fetchImpl).catch(() => false)));
+
+  const needsAuth = openBrowserOnMissing && domains.length > 0 && (!hasAppCookies || !appValidated);
+
+  if (needsAuth) {
+    authOptions.onStatus?.({ phase: "opening_okta_app_auth", oktaApp: appName, url: authUrl });
+    const auth = app.launchViaUserHome
+      ? await openOktaAppForAuth(appName, { ...authOptions, config })
+      : await openAuthPageAndWait(config, {
+          authUrl,
+          domains,
+          label: appName,
+          options: authOptions
+        });
+    jar = auth.jar;
+    openedBrowser = openedBrowser || auth.openedBrowser;
+    hasAppCookies = hasCookiesForDomains(jar, domains);
+    appValidated = hasAppCookies && (await validateOktaAppHost(jar, app, authOptions.fetchImpl).catch(() => false));
+    if (!auth.ready && !hasAppCookies && app.mode !== "bookmark" && app.mode !== "oidc-app") {
+      throw new Error(
+        `Okta app "${appName}" auth timed out. Complete login in Chrome at ${authUrl}, then retry.`
+      );
+    }
+    summary = jarSummary(jar, config);
+  }
+
+  const appReady =
+    appValidated ||
+    app.mode === "bookmark" ||
+    app.mode === "oidc-app" ||
+    (domains.length === 0 && summary.authenticated);
+
+  return {
+    jar,
+    summary,
+    openedBrowser,
+    appReady,
+    hasAppCookies,
+    authUrl
+  };
+}
+
+export async function openAppsForAuth(appNames = [], options = {}) {
+  const config = options.config ?? getSsoConfig();
+  const opened = [];
+  await ensureSsoSession({
+    config,
+    openBrowserOnMissing: true,
+    forceBrowser: options.forceOkta === true,
+    onStatus: options.onStatus
+  });
+  for (const appName of appNames) {
+    const url = resolveOktaAppAuthUrl(appName);
+    options.onStatus?.({ phase: "opening_app", oktaApp: appName, url });
+    await openBrowser(url);
+    opened.push({ app: appName, url });
+    if (options.delayMs) await waitFor(options.delayMs);
+  }
+  return { opened, loginUrl: config.loginUrl };
+}

package/vendor/extension-sso/src/sessionManager.mjs

@@ -0,0 +1,212 @@
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import {
+  buildCookieHeader,
+  cookiesForHost,
+  resolveBestCookieHost,
+  isValidationFresh,
+  jarSummary,
+  loadCookieJar,
+  mergeCookies,
+  saveCookieJar
+} from "./cookieJar.mjs";
+import { hostPatternsForDomains, readChromeCookies, resolveChromeCookiesPath } from "./chromeCookies.mjs";
+import { openBrowser, waitFor } from "./browserLogin.mjs";
+import { validateOktaSession, validateServiceHost } from "./sessionValidate.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getServiceDomains } from "./serviceRegistry.mjs";
+
+export async function importCookiesFromChrome(config = getSsoConfig(), domains = []) {
+  const patterns = hostPatternsForDomains([config.domain, ...domains]);
+  const cookiesPath = resolveChromeCookiesPath(config);
+  let cookies = await readChromeCookies(cookiesPath, patterns);
+  if (!cookies.length) {
+    cookies = await readChromeCookiesFromProfileFallbacks(config, patterns);
+  }
+  if (!cookies.length) return null;
+  return {
+    cookies,
+    authenticated: false,
+    source: "chrome"
+  };
+}
+
+async function readChromeCookiesFromProfileFallbacks(config, patterns) {
+  if (process.env.WORKDAY_CHROME_PROFILE_FALLBACK === "false") return [];
+  for (const cookiesPath of chromeCookieFallbackPaths(config)) {
+    const cookies = await readChromeCookies(cookiesPath, patterns);
+    if (cookies.length) return cookies;
+  }
+  return [];
+}
+
+export function chromeCookieFallbackPaths(config = getSsoConfig(), { readdir = readdirSync, exists = existsSync } = {}) {
+  const primary = config.chromeCookiesPath || resolveChromeCookiesPath(config);
+  const chromeRoot = dirname(dirname(primary));
+  let entries;
+  try {
+    entries = readdir(chromeRoot);
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((entry) => entry === "Default" || /^Profile \d+$/u.test(entry))
+    .map((entry) => join(chromeRoot, entry, "Cookies"))
+    .filter((cookiesPath) => cookiesPath !== primary && exists(cookiesPath));
+}
+
+async function persistValidatedJar(config, jar) {
+  const authenticated = await validateOktaSession(jar, config);
+  const next = {
+    ...jar,
+    authenticated,
+    validatedAt: authenticated ? new Date().toISOString() : jar.validatedAt
+  };
+  await saveCookieJar(config.cookieJarPath, next);
+  return next;
+}
+
+function hasCookiesForDomains(jar, domains) {
+  if (!domains.length) return true;
+  return domains.some((domain) => cookiesForHost(jar?.cookies ?? [], domain).length > 0);
+}
+
+async function importAndMergeJar(config, jar, domains, { validate = true } = {}) {
+  const imported = await importCookiesFromChrome(config, [config.domain, ...domains]);
+  if (!imported) return jar;
+  const next = {
+    ...(jar ?? {}),
+    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+    source: imported.source
+  };
+  if (!validate) {
+    await saveCookieJar(config.cookieJarPath, next);
+    return next;
+  }
+  return persistValidatedJar(config, { ...next, authenticated: false });
+}
+
+export async function ensureSsoSession({
+  config = getSsoConfig(),
+  openBrowserOnMissing = false,
+  forceBrowser = false,
+  serviceId,
+  onStatus
+} = {}) {
+  let jar = await loadCookieJar(config.cookieJarPath);
+  const serviceDomains = serviceId ? getServiceDomains(serviceId) : [];
+  const needsServiceCookies = !hasCookiesForDomains(jar, serviceDomains);
+
+  if (
+    !forceBrowser &&
+    jar &&
+    isValidationFresh(jar, config.validateTtlMs) &&
+    jar.authenticated &&
+    !needsServiceCookies
+  ) {
+    return { jar, summary: jarSummary(jar, config), openedBrowser: false };
+  }
+
+  if (!forceBrowser && jar?.authenticated && needsServiceCookies) {
+    onStatus?.({ phase: "import_service_cookies" });
+    jar = await importAndMergeJar(config, jar, serviceDomains, { validate: false });
+    return { jar, summary: jarSummary(jar, config), openedBrowser: false };
+  }
+
+  if (!forceBrowser) {
+    onStatus?.({ phase: "import_from_chrome" });
+    const imported = await importCookiesFromChrome(config, [config.domain, ...serviceDomains]);
+    if (imported) {
+      jar = {
+        cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+        source: "chrome",
+        authenticated: false
+      };
+      jar = await persistValidatedJar(config, jar);
+      if (jar.authenticated) {
+        return { jar, summary: jarSummary(jar, config), openedBrowser: false };
+      }
+    }
+  }
+
+  if (!openBrowserOnMissing && !forceBrowser) {
+    return {
+      jar,
+      summary: jarSummary(jar, config),
+      openedBrowser: false
+    };
+  }
+
+  onStatus?.({ phase: "browser_opened", url: config.loginUrl });
+  await openBrowser(config.loginUrl, { chromeProfile: config.chromeProfile });
+
+  const deadline = Date.now() + config.loginTimeoutMs;
+  while (Date.now() < deadline) {
+    await waitFor(2000);
+    onStatus?.({ phase: "waiting_for_login" });
+    const imported = await importCookiesFromChrome(config, [config.domain, ...serviceDomains]);
+    if (!imported?.cookies?.length) continue;
+    jar = {
+      cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+      source: "chrome-browser-login",
+      authenticated: false
+    };
+    jar = await persistValidatedJar(config, jar);
+    if (jar.authenticated) {
+      return { jar, summary: jarSummary(jar, config), openedBrowser: true };
+    }
+  }
+
+  throw new Error(
+    `Okta browser login timed out after ${config.loginTimeoutMs}ms. Complete MFA in Chrome, then retry.`
+  );
+}
+
+export function getOktaCookieHeader(jar, config = getSsoConfig()) {
+  if (!jar?.cookies?.length) return "";
+  return buildCookieHeader(jar.cookies, config.domain);
+}
+
+export function getCookiesForService(jar, serviceId) {
+  const domains = getServiceDomains(serviceId);
+  const cookies = domains.flatMap((domain) => cookiesForHost(jar?.cookies ?? [], domain));
+  return { domains, cookies };
+}
+
+export async function syncOktaAppCookies(appName, options = {}) {
+  const { getOktaApp } = await import("./oktaAppCatalog.mjs");
+  const app = getOktaApp(appName);
+  const config = options.config ?? getSsoConfig();
+  const domains = [...new Set([config.domain, ...(app.domains ?? [])])];
+  const imported = await importCookiesFromChrome(config, domains);
+  if (!imported?.cookies?.length) return null;
+  const jar = await loadCookieJar(config.cookieJarPath);
+  const merged = {
+    ...(jar ?? {}),
+    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+    source: "chrome-okta-app-sync"
+  };
+  await saveCookieJar(config.cookieJarPath, merged);
+  return merged;
+}
+
+export async function syncAllOktaCatalogCookies(options = {}) {
+  const { OKTA_USER_HOME_APPS } = await import("./oktaAppCatalog.mjs");
+  const config = options.config ?? getSsoConfig();
+  const domains = new Set([config.domain]);
+  for (const app of Object.values(OKTA_USER_HOME_APPS)) {
+    for (const domain of app.domains ?? []) domains.add(domain);
+  }
+  const imported = await importCookiesFromChrome(config, [...domains]);
+  if (!imported?.cookies?.length) return null;
+  const jar = await loadCookieJar(config.cookieJarPath);
+  const merged = {
+    ...(jar ?? {}),
+    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
+    source: "chrome-okta-catalog-sync"
+  };
+  await saveCookieJar(config.cookieJarPath, merged);
+  return merged;
+}
+
+export { jarSummary, loadCookieJar };

package/vendor/extension-sso/src/sessionValidate.mjs

@@ -0,0 +1,74 @@
+import { buildCookieHeader, resolveBestCookieHost } from "./cookieJar.mjs";
+
+export async function validateOktaSession(jar, config) {
+  if (!jar?.cookies?.length) return false;
+  const cookie = buildCookieHeader(jar.cookies, config.domain);
+  if (!cookie) return false;
+
+  const response = await fetch(config.loginUrl, {
+    method: "GET",
+    redirect: "manual",
+    headers: { cookie }
+  });
+
+  if (response.status === 200) return true;
+  const location = response.headers.get("location") || "";
+  if (response.status >= 300 && response.status < 400) {
+    return !/login|signin|authorize/i.test(location);
+  }
+  return false;
+}
+
+export async function probeReadOnlyUrl(
+  jar,
+  { host, path = "/", cookie, fetchImpl = globalThis.fetch } = {}
+) {
+  if (!host || !cookie) return { ready: false, status: 0, reason: "no_cookies" };
+  const response = await fetchImpl(`https://${host}${path}`, {
+    method: "GET",
+    redirect: "manual",
+    headers: { cookie, accept: "text/html,application/json" }
+  });
+  const location = response.headers.get("location") || "";
+  const loginRedirect = /login|signin|authorize|okta/i.test(location);
+  const contentType = response.headers.get("content-type") || undefined;
+  let loginPage = false;
+  if (response.status === 200 && /text\/html/i.test(contentType ?? "")) {
+    const htmlResponse = typeof response.clone === "function" ? response.clone() : response;
+    const html = typeof htmlResponse.text === "function" ? await htmlResponse.text().catch(() => "") : "";
+    loginPage = /<title[^>]*>\s*(?:log in|login|log into|sign in|signin)\b|data-testid=["']login|name=["']os_username/i.test(html);
+  }
+  return {
+    ready:
+      (response.status === 200 && !loginPage) ||
+      (response.status >= 300 && response.status < 400 && !loginRedirect),
+    status: response.status,
+    location: location || undefined,
+    contentType,
+    loginPage
+  };
+}
+
+export async function validateOktaAppHost(jar, app, fetchImpl = globalThis.fetch) {
+  const domains = app?.domains ?? [];
+  if (!domains.length) return true;
+  if (app.mode === "bookmark" || app.mode === "oidc-app" || app.mode === "cli-readonly") return true;
+  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, domains);
+  if (!hasCookies || !cookie || !host) return false;
+  const probe = await probeReadOnlyUrl(jar, {
+    host,
+    path: app.probePath ?? "/",
+    cookie,
+    fetchImpl
+  });
+  return probe.ready;
+}
+
+export async function validateServiceHost(jar, host) {
+  if (!jar?.cookies?.length || !host) return false;
+  const cookie = buildCookieHeader(jar.cookies, host);
+  if (!cookie) return false;
+
+  const probe = await probeReadOnlyUrl(jar, { host, cookie });
+  return probe.ready;
+}

package/vendor/extension-sso/src/ssoConfig.mjs

@@ -0,0 +1,31 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function getSsoConfig(env = process.env) {
+  const domain = env.WORKDAY_OKTA_DOMAIN?.trim() || "workday.okta.com";
+  const loginUrl = env.WORKDAY_OKTA_LOGIN_URL?.trim() || `https://${domain}/app/UserHome`;
+  const chromeProfileOverride = env.WORKDAY_CHROME_PROFILE?.trim();
+  const chromeProfile = chromeProfileOverride || "Default";
+  const validateTtlMs = Number(env.WORKDAY_SSO_VALIDATE_TTL_MS ?? 900_000);
+  const loginTimeoutMs = Number(env.WORKDAY_SSO_LOGIN_TIMEOUT_MS ?? 300_000);
+  const baseDir = join(homedir(), ".Nuvlore", "workday");
+
+  return {
+    domain,
+    loginUrl,
+    chromeProfile,
+    chromeProfileExplicit: Boolean(chromeProfileOverride),
+    validateTtlMs,
+    loginTimeoutMs,
+    cookieJarPath: join(baseDir, "cookie-jar.json"),
+    chromeCookiesPath: join(
+      homedir(),
+      "Library",
+      "Application Support",
+      "Google",
+      "Chrome",
+      chromeProfile,
+      "Cookies"
+    )
+  };
+}