@oya-ai/browser 1.0.96 → 1.0.97

package/dist/index.cjs

@@ -142,6 +142,14 @@ var Browser = class {
   async pressKey(key) {
     await this.command("press_key", { key });
   }
+  /**
+   * Answer a native dialog holding the page. alert() and beforeunload are
+   * answered for you; a confirm() or prompt() waits for this, and every other
+   * command fails fast with the dialog's text until it is answered.
+   */
+  async handleDialog(accept, promptText) {
+    return this.command("handle_dialog", { accept, prompt_text: promptText });
+  }
   /** `at` aims the wheel at an inner scroller (a results panel, a chat pane) instead of the page. */
   async scroll(direction, amount, at) {
     await this.command("scroll", at ? { direction, amount: amount ?? 500, ...at, smooth: false } : { direction, amount });
@@ -557,8 +565,21 @@ var Oya = class {
     },
     /** Store the second factor for this identity. Sealed at rest, never read back. */
     setMfa: (id, config) => this.http.request("PUT", `/api/personas/${id}/mfa`, config),
-    clearMfa: async (id) => {
-      await this.http.request("DELETE", `/api/personas/${id}/mfa`);
+    clearMfa: async (id, domain) => {
+      await this.http.request("DELETE", `/api/personas/${id}/mfa${domain ? `?domain=${encodeURIComponent(domain)}` : ""}`);
+    },
+    /**
+     * Store a site login for this identity. Sealed at rest, never read back.
+     *
+     * Signing in once on the desktop and inheriting the cookies is still the
+     * better path. This is for portals that expire a session server-side
+     * between runs, where an unattended run has nothing else to recover with.
+     */
+    setCredentials: (id, config) => this.http.request("PUT", `/api/personas/${id}/credentials`, config),
+    /** Which sites this identity can sign in to. Usernames only. */
+    credentials: (id) => this.http.request("GET", `/api/personas/${id}/credentials`),
+    clearCredentials: async (id, domain) => {
+      await this.http.request("DELETE", `/api/personas/${id}/credentials?domain=${encodeURIComponent(domain)}`);
     }
   };
   /**

package/dist/index.d.cts

@@ -163,8 +163,8 @@ interface FileValue {
 type RunData = Record<string, string | number | FileValue>;
 interface AttentionRequest {
     id: string;
-    /** captcha / mfa: finish it in the live view. agent: the agent's question. heal_failed: replay and the agent both gave up. */
-    reason: 'captcha' | 'mfa' | 'agent' | 'heal_failed';
+    /** captcha / login / mfa: finish it in the live view. agent: the agent's question. heal_failed: replay and the agent both gave up. */
+    reason: 'captcha' | 'login' | 'mfa' | 'agent' | 'heal_failed';
     message: string;
     liveViewUrl?: string;
     at: number;
@@ -324,6 +324,18 @@ interface PersonaInfo {
     mfa: {
         configured: boolean;
         type?: string;
+        domain?: string;
+    };
+    /** Per-site factors and stored logins. Usernames and types only, never secrets. */
+    sites: {
+        mfa: {
+            domain: string;
+            type: string;
+        }[];
+        credentials: {
+            domain: string;
+            username: string;
+        }[];
     };
     login: {
         cookies: number;
@@ -349,7 +361,22 @@ interface StopResult {
     sandboxRemoved?: boolean | null;
     error?: string;
 }
+/**
+ * A second factor. `domain` files it against one site, because a persona driving
+ * several portals meets several kinds of factor; without it the record is the
+ * persona-wide default.
+ *
+ * `gmail` and `graph` read the code straight out of a mailbox. `email` and `sms`
+ * poll an endpoint you host — set `x-oya-received-at` on its response (epoch ms)
+ * and a code from a previous run will never be reused.
+ *
+ * The code is pulled out of the message by your own configured LLM, because
+ * portals rewrite these templates constantly and the code is not always digits.
+ * `pattern` is only the fallback for when no LLM key is set or the call fails.
+ */
 type MfaConfig = {
+    domain?: string;
+} & ({
     type: 'totp';
     secret: string;
 } | {
@@ -358,7 +385,22 @@ type MfaConfig = {
     headers?: Record<string, string>;
     pattern?: string;
     timeoutMs?: number;
-};
+} | {
+    type: 'gmail' | 'graph';
+    refreshToken: string;
+    clientId: string;
+    clientSecret?: string;
+    tenant?: string;
+    query?: string;
+    pattern?: string;
+    timeoutMs?: number;
+});
+/** A site login. The password is write-only: no API ever reads it back. */
+interface SiteCredentials {
+    domain: string;
+    username: string;
+    password: string;
+}
 interface BrowserInfo {
     id: string;
     name: string;
@@ -477,6 +519,16 @@ declare class Browser {
     }>;
     private elementId;
     pressKey(key: string): Promise<void>;
+    /**
+     * Answer a native dialog holding the page. alert() and beforeunload are
+     * answered for you; a confirm() or prompt() waits for this, and every other
+     * command fails fast with the dialog's text until it is answered.
+     */
+    handleDialog(accept: boolean, promptText?: string): Promise<{
+        type: string;
+        message: string;
+        accepted: boolean;
+    }>;
     /** `at` aims the wheel at an inner scroller (a results panel, a chat pane) instead of the page. */
     scroll(direction: 'up' | 'down' | 'top' | 'bottom', amount?: number, at?: {
         x: number;
@@ -787,7 +839,27 @@ declare class Oya {
             configured: boolean;
             type: string;
         }>;
-        clearMfa: (id: string) => Promise<void>;
+        clearMfa: (id: string, domain?: string) => Promise<void>;
+        /**
+         * Store a site login for this identity. Sealed at rest, never read back.
+         *
+         * Signing in once on the desktop and inheriting the cookies is still the
+         * better path. This is for portals that expire a session server-side
+         * between runs, where an unattended run has nothing else to recover with.
+         */
+        setCredentials: (id: string, config: SiteCredentials) => Promise<{
+            configured: boolean;
+            domain: string;
+            username: string;
+        }>;
+        /** Which sites this identity can sign in to. Usernames only. */
+        credentials: (id: string) => Promise<{
+            credentials: {
+                domain: string;
+                username: string;
+            }[];
+        }>;
+        clearCredentials: (id: string, domain: string) => Promise<void>;
     };
     /**
      * This key's settings: LLM credentials, browser provider, solver.
@@ -854,10 +926,30 @@ declare class Oya {
             configured: boolean;
             type: string;
         }>;
-        clearMfa: (id: string) => Promise<void>;
+        clearMfa: (id: string, domain?: string) => Promise<void>;
+        /**
+         * Store a site login for this identity. Sealed at rest, never read back.
+         *
+         * Signing in once on the desktop and inheriting the cookies is still the
+         * better path. This is for portals that expire a session server-side
+         * between runs, where an unattended run has nothing else to recover with.
+         */
+        setCredentials: (id: string, config: SiteCredentials) => Promise<{
+            configured: boolean;
+            domain: string;
+            username: string;
+        }>;
+        /** Which sites this identity can sign in to. Usernames only. */
+        credentials: (id: string) => Promise<{
+            credentials: {
+                domain: string;
+                username: string;
+            }[];
+        }>;
+        clearCredentials: (id: string, domain: string) => Promise<void>;
     };
     usage(): Promise<unknown>;
     private waitUntilConnected;
 }
 
-export { type Activity, type Analysis, type AttentionRequest, Browser, type BrowserDetail, type BrowserInfo, type CaptchaResult, type CaptchaSolver, type Config, type ConfigUpdate, type ControlCredential, type ControlEvent, type ControlOverview, type ControlRole, type ControlSession, type Element, type FileValue, type Fingerprint, type Health, type HumanInputAction, type LlmProvider, MAX_FILE_BYTES, type MfaConfig, type MfaResult, Oya, OyaError, type OyaOptions, type PersonaInfo, type PersonaPrefs, type PlayResult, type Playbook, type PlaybookSummary, type ProjectSettings, type Provider, type ProxyCreate, type ProxyInfo, Run, type RunData, type RunInfo, type RunResult, type StartOptions, type StartResult, type StopResult, type SubmitOptions, Oya as default, file };
+export { type Activity, type Analysis, type AttentionRequest, Browser, type BrowserDetail, type BrowserInfo, type CaptchaResult, type CaptchaSolver, type Config, type ConfigUpdate, type ControlCredential, type ControlEvent, type ControlOverview, type ControlRole, type ControlSession, type Element, type FileValue, type Fingerprint, type Health, type HumanInputAction, type LlmProvider, MAX_FILE_BYTES, type MfaConfig, type MfaResult, Oya, OyaError, type OyaOptions, type PersonaInfo, type PersonaPrefs, type PlayResult, type Playbook, type PlaybookSummary, type ProjectSettings, type Provider, type ProxyCreate, type ProxyInfo, Run, type RunData, type RunInfo, type RunResult, type SiteCredentials, type StartOptions, type StartResult, type StopResult, type SubmitOptions, Oya as default, file };

package/dist/index.d.ts

@@ -163,8 +163,8 @@ interface FileValue {
 type RunData = Record<string, string | number | FileValue>;
 interface AttentionRequest {
     id: string;
-    /** captcha / mfa: finish it in the live view. agent: the agent's question. heal_failed: replay and the agent both gave up. */
-    reason: 'captcha' | 'mfa' | 'agent' | 'heal_failed';
+    /** captcha / login / mfa: finish it in the live view. agent: the agent's question. heal_failed: replay and the agent both gave up. */
+    reason: 'captcha' | 'login' | 'mfa' | 'agent' | 'heal_failed';
     message: string;
     liveViewUrl?: string;
     at: number;
@@ -324,6 +324,18 @@ interface PersonaInfo {
     mfa: {
         configured: boolean;
         type?: string;
+        domain?: string;
+    };
+    /** Per-site factors and stored logins. Usernames and types only, never secrets. */
+    sites: {
+        mfa: {
+            domain: string;
+            type: string;
+        }[];
+        credentials: {
+            domain: string;
+            username: string;
+        }[];
     };
     login: {
         cookies: number;
@@ -349,7 +361,22 @@ interface StopResult {
     sandboxRemoved?: boolean | null;
     error?: string;
 }
+/**
+ * A second factor. `domain` files it against one site, because a persona driving
+ * several portals meets several kinds of factor; without it the record is the
+ * persona-wide default.
+ *
+ * `gmail` and `graph` read the code straight out of a mailbox. `email` and `sms`
+ * poll an endpoint you host — set `x-oya-received-at` on its response (epoch ms)
+ * and a code from a previous run will never be reused.
+ *
+ * The code is pulled out of the message by your own configured LLM, because
+ * portals rewrite these templates constantly and the code is not always digits.
+ * `pattern` is only the fallback for when no LLM key is set or the call fails.
+ */
 type MfaConfig = {
+    domain?: string;
+} & ({
     type: 'totp';
     secret: string;
 } | {
@@ -358,7 +385,22 @@ type MfaConfig = {
     headers?: Record<string, string>;
     pattern?: string;
     timeoutMs?: number;
-};
+} | {
+    type: 'gmail' | 'graph';
+    refreshToken: string;
+    clientId: string;
+    clientSecret?: string;
+    tenant?: string;
+    query?: string;
+    pattern?: string;
+    timeoutMs?: number;
+});
+/** A site login. The password is write-only: no API ever reads it back. */
+interface SiteCredentials {
+    domain: string;
+    username: string;
+    password: string;
+}
 interface BrowserInfo {
     id: string;
     name: string;
@@ -477,6 +519,16 @@ declare class Browser {
     }>;
     private elementId;
     pressKey(key: string): Promise<void>;
+    /**
+     * Answer a native dialog holding the page. alert() and beforeunload are
+     * answered for you; a confirm() or prompt() waits for this, and every other
+     * command fails fast with the dialog's text until it is answered.
+     */
+    handleDialog(accept: boolean, promptText?: string): Promise<{
+        type: string;
+        message: string;
+        accepted: boolean;
+    }>;
     /** `at` aims the wheel at an inner scroller (a results panel, a chat pane) instead of the page. */
     scroll(direction: 'up' | 'down' | 'top' | 'bottom', amount?: number, at?: {
         x: number;
@@ -787,7 +839,27 @@ declare class Oya {
             configured: boolean;
             type: string;
         }>;
-        clearMfa: (id: string) => Promise<void>;
+        clearMfa: (id: string, domain?: string) => Promise<void>;
+        /**
+         * Store a site login for this identity. Sealed at rest, never read back.
+         *
+         * Signing in once on the desktop and inheriting the cookies is still the
+         * better path. This is for portals that expire a session server-side
+         * between runs, where an unattended run has nothing else to recover with.
+         */
+        setCredentials: (id: string, config: SiteCredentials) => Promise<{
+            configured: boolean;
+            domain: string;
+            username: string;
+        }>;
+        /** Which sites this identity can sign in to. Usernames only. */
+        credentials: (id: string) => Promise<{
+            credentials: {
+                domain: string;
+                username: string;
+            }[];
+        }>;
+        clearCredentials: (id: string, domain: string) => Promise<void>;
     };
     /**
      * This key's settings: LLM credentials, browser provider, solver.
@@ -854,10 +926,30 @@ declare class Oya {
             configured: boolean;
             type: string;
         }>;
-        clearMfa: (id: string) => Promise<void>;
+        clearMfa: (id: string, domain?: string) => Promise<void>;
+        /**
+         * Store a site login for this identity. Sealed at rest, never read back.
+         *
+         * Signing in once on the desktop and inheriting the cookies is still the
+         * better path. This is for portals that expire a session server-side
+         * between runs, where an unattended run has nothing else to recover with.
+         */
+        setCredentials: (id: string, config: SiteCredentials) => Promise<{
+            configured: boolean;
+            domain: string;
+            username: string;
+        }>;
+        /** Which sites this identity can sign in to. Usernames only. */
+        credentials: (id: string) => Promise<{
+            credentials: {
+                domain: string;
+                username: string;
+            }[];
+        }>;
+        clearCredentials: (id: string, domain: string) => Promise<void>;
     };
     usage(): Promise<unknown>;
     private waitUntilConnected;
 }
 
-export { type Activity, type Analysis, type AttentionRequest, Browser, type BrowserDetail, type BrowserInfo, type CaptchaResult, type CaptchaSolver, type Config, type ConfigUpdate, type ControlCredential, type ControlEvent, type ControlOverview, type ControlRole, type ControlSession, type Element, type FileValue, type Fingerprint, type Health, type HumanInputAction, type LlmProvider, MAX_FILE_BYTES, type MfaConfig, type MfaResult, Oya, OyaError, type OyaOptions, type PersonaInfo, type PersonaPrefs, type PlayResult, type Playbook, type PlaybookSummary, type ProjectSettings, type Provider, type ProxyCreate, type ProxyInfo, Run, type RunData, type RunInfo, type RunResult, type StartOptions, type StartResult, type StopResult, type SubmitOptions, Oya as default, file };
+export { type Activity, type Analysis, type AttentionRequest, Browser, type BrowserDetail, type BrowserInfo, type CaptchaResult, type CaptchaSolver, type Config, type ConfigUpdate, type ControlCredential, type ControlEvent, type ControlOverview, type ControlRole, type ControlSession, type Element, type FileValue, type Fingerprint, type Health, type HumanInputAction, type LlmProvider, MAX_FILE_BYTES, type MfaConfig, type MfaResult, Oya, OyaError, type OyaOptions, type PersonaInfo, type PersonaPrefs, type PlayResult, type Playbook, type PlaybookSummary, type ProjectSettings, type Provider, type ProxyCreate, type ProxyInfo, Run, type RunData, type RunInfo, type RunResult, type SiteCredentials, type StartOptions, type StartResult, type StopResult, type SubmitOptions, Oya as default, file };

package/dist/index.js

@@ -110,6 +110,14 @@ var Browser = class {
   async pressKey(key) {
     await this.command("press_key", { key });
   }
+  /**
+   * Answer a native dialog holding the page. alert() and beforeunload are
+   * answered for you; a confirm() or prompt() waits for this, and every other
+   * command fails fast with the dialog's text until it is answered.
+   */
+  async handleDialog(accept, promptText) {
+    return this.command("handle_dialog", { accept, prompt_text: promptText });
+  }
   /** `at` aims the wheel at an inner scroller (a results panel, a chat pane) instead of the page. */
   async scroll(direction, amount, at) {
     await this.command("scroll", at ? { direction, amount: amount ?? 500, ...at, smooth: false } : { direction, amount });
@@ -525,8 +533,21 @@ var Oya = class {
     },
     /** Store the second factor for this identity. Sealed at rest, never read back. */
     setMfa: (id, config) => this.http.request("PUT", `/api/personas/${id}/mfa`, config),
-    clearMfa: async (id) => {
-      await this.http.request("DELETE", `/api/personas/${id}/mfa`);
+    clearMfa: async (id, domain) => {
+      await this.http.request("DELETE", `/api/personas/${id}/mfa${domain ? `?domain=${encodeURIComponent(domain)}` : ""}`);
+    },
+    /**
+     * Store a site login for this identity. Sealed at rest, never read back.
+     *
+     * Signing in once on the desktop and inheriting the cookies is still the
+     * better path. This is for portals that expire a session server-side
+     * between runs, where an unattended run has nothing else to recover with.
+     */
+    setCredentials: (id, config) => this.http.request("PUT", `/api/personas/${id}/credentials`, config),
+    /** Which sites this identity can sign in to. Usernames only. */
+    credentials: (id) => this.http.request("GET", `/api/personas/${id}/credentials`),
+    clearCredentials: async (id, domain) => {
+      await this.http.request("DELETE", `/api/personas/${id}/credentials?domain=${encodeURIComponent(domain)}`);
     }
   };
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oya-ai/browser",
-  "version": "1.0.96",
+  "version": "1.0.97",
   "description": "Rotate thousands of browsers behind one API — personas, proxies, stealth, CAPTCHA and MFA.",
   "license": "MIT",
   "homepage": "https://browser.getoya.ai",