@oya-ai/browser 1.0.61 → 1.0.64

package/dist/index.cjs

@@ -196,12 +196,32 @@ var Browser = class {
     return res.text;
   }
   /**
-   * Watch it work: an SSE stream of JPEG frames. EventSource cannot set
-   * headers, so the key travels as a query parameter — treat the URL itself as
-   * a credential.
+   * Watch it work: the console, opened on this browser.
+   *
+   * This used to return the raw frame stream with the project's API key in the
+   * query string — a permanent credential in browser history, Referer headers
+   * and every proxy log on the way, and a URL that renders as a wall of
+   * text/event-stream if a person actually opens it. It is the console deep
+   * link now, the same one the server hands back from `completeMfa()`, and it
+   * carries no credential at all.
+   *
+   * For the frames themselves, use `liveStreamUrl()`.
    */
   liveViewUrl() {
-    return `${this.http.baseUrl}/api/live/${this.id}?key=${encodeURIComponent(this.http.apiKey)}`;
+    return `${this.http.baseUrl}/dashboard/?browser=${encodeURIComponent(this.id)}`;
+  }
+  /**
+   * The SSE stream of JPEG frames, for embedding in your own UI. EventSource
+   * cannot set headers, so the URL carries a connection ticket: single use,
+   * 60 seconds. Mint one per viewer — the first connection spends it.
+   */
+  async liveStreamUrl() {
+    const { ticket } = await this.http.request(
+      "POST",
+      `/api/control/sessions/${encodeURIComponent(this.id)}/ticket`,
+      {}
+    );
+    return `${this.http.baseUrl}/api/live/${this.id}?ticket=${encodeURIComponent(ticket)}`;
   }
   /** Counters, health and the last 50 things this browser did. */
   status() {

package/dist/index.d.cts

@@ -331,11 +331,24 @@ declare class Browser {
     /** Natural-language control, using this key's configured model. */
     ask(prompt: string): Promise<string>;
     /**
-     * Watch it work: an SSE stream of JPEG frames. EventSource cannot set
-     * headers, so the key travels as a query parameter — treat the URL itself as
-     * a credential.
+     * Watch it work: the console, opened on this browser.
+     *
+     * This used to return the raw frame stream with the project's API key in the
+     * query string — a permanent credential in browser history, Referer headers
+     * and every proxy log on the way, and a URL that renders as a wall of
+     * text/event-stream if a person actually opens it. It is the console deep
+     * link now, the same one the server hands back from `completeMfa()`, and it
+     * carries no credential at all.
+     *
+     * For the frames themselves, use `liveStreamUrl()`.
      */
     liveViewUrl(): string;
+    /**
+     * The SSE stream of JPEG frames, for embedding in your own UI. EventSource
+     * cannot set headers, so the URL carries a connection ticket: single use,
+     * 60 seconds. Mint one per viewer — the first connection spends it.
+     */
+    liveStreamUrl(): Promise<string>;
     /** Counters, health and the last 50 things this browser did. */
     status(): Promise<BrowserDetail>;
     /**

package/dist/index.d.ts

@@ -331,11 +331,24 @@ declare class Browser {
     /** Natural-language control, using this key's configured model. */
     ask(prompt: string): Promise<string>;
     /**
-     * Watch it work: an SSE stream of JPEG frames. EventSource cannot set
-     * headers, so the key travels as a query parameter — treat the URL itself as
-     * a credential.
+     * Watch it work: the console, opened on this browser.
+     *
+     * This used to return the raw frame stream with the project's API key in the
+     * query string — a permanent credential in browser history, Referer headers
+     * and every proxy log on the way, and a URL that renders as a wall of
+     * text/event-stream if a person actually opens it. It is the console deep
+     * link now, the same one the server hands back from `completeMfa()`, and it
+     * carries no credential at all.
+     *
+     * For the frames themselves, use `liveStreamUrl()`.
      */
     liveViewUrl(): string;
+    /**
+     * The SSE stream of JPEG frames, for embedding in your own UI. EventSource
+     * cannot set headers, so the URL carries a connection ticket: single use,
+     * 60 seconds. Mint one per viewer — the first connection spends it.
+     */
+    liveStreamUrl(): Promise<string>;
     /** Counters, health and the last 50 things this browser did. */
     status(): Promise<BrowserDetail>;
     /**

package/dist/index.js

@@ -167,12 +167,32 @@ var Browser = class {
     return res.text;
   }
   /**
-   * Watch it work: an SSE stream of JPEG frames. EventSource cannot set
-   * headers, so the key travels as a query parameter — treat the URL itself as
-   * a credential.
+   * Watch it work: the console, opened on this browser.
+   *
+   * This used to return the raw frame stream with the project's API key in the
+   * query string — a permanent credential in browser history, Referer headers
+   * and every proxy log on the way, and a URL that renders as a wall of
+   * text/event-stream if a person actually opens it. It is the console deep
+   * link now, the same one the server hands back from `completeMfa()`, and it
+   * carries no credential at all.
+   *
+   * For the frames themselves, use `liveStreamUrl()`.
    */
   liveViewUrl() {
-    return `${this.http.baseUrl}/api/live/${this.id}?key=${encodeURIComponent(this.http.apiKey)}`;
+    return `${this.http.baseUrl}/dashboard/?browser=${encodeURIComponent(this.id)}`;
+  }
+  /**
+   * The SSE stream of JPEG frames, for embedding in your own UI. EventSource
+   * cannot set headers, so the URL carries a connection ticket: single use,
+   * 60 seconds. Mint one per viewer — the first connection spends it.
+   */
+  async liveStreamUrl() {
+    const { ticket } = await this.http.request(
+      "POST",
+      `/api/control/sessions/${encodeURIComponent(this.id)}/ticket`,
+      {}
+    );
+    return `${this.http.baseUrl}/api/live/${this.id}?ticket=${encodeURIComponent(ticket)}`;
   }
   /** Counters, health and the last 50 things this browser did. */
   status() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oya-ai/browser",
-  "version": "1.0.61",
+  "version": "1.0.64",
   "description": "Rotate thousands of browsers behind one API — personas, proxies, stealth, CAPTCHA and MFA.",
   "license": "MIT",
   "homepage": "https://browser.getoya.ai",
@@ -52,5 +52,6 @@
   "devDependencies": {
     "tsup": "^8.0.0",
     "typescript": "^5.4.0"
-  }
+  },
+  "author": "mk@getoya.ai"
 }