@eyepop.ai/eyepop 0.11.0 → 0.13.0

package/dist/index.js

@@ -8944,7 +8944,7 @@ var AbstractJob = class {
     return Promise.reject("abstract class");
   }
   start(done, status) {
-    this._responseStream = new Promise(async (resolve2, reject) => {
+    this._responseStream = new Promise(async (resolve, reject) => {
       try {
         let retries = 1;
         while (true) {
@@ -8973,7 +8973,7 @@ var AbstractJob = class {
               reject(`response body is empty`);
               break;
             } else {
-              resolve2(response.body);
+              resolve(response.body);
               break;
             }
           } catch (error) {
@@ -9083,7 +9083,7 @@ var LoadLiveIngressJob = class extends AbstractJob {
       "Accept": "application/jsonl",
       "Content-Type": "application/json"
     };
-    const patchUrl = `${session.baseUrl.replace(/\/+$/, "")}/pipelines/${session.pipelineId}/source?mode=queue&processing=sync`;
+    const patchUrl = `${session.baseUrl.replace(/\/+$/, "")}/pipelines/${session.pipelineId}/source?mode=preempt&processing=sync`;
     this._requestLogger.debug("before PATCH %s with url %s as source", patchUrl, this._ingressId);
     const response = await this._client.fetch(patchUrl, {
       headers,
@@ -9312,17 +9312,91 @@ function v4(options, buf, offset) {
 }
 var v4_default = v4;
 
-// src/web_rtc_base.ts
-var WebRtcBase = class {
-  constructor(getSession, client, requestLogger) {
-    this._pc = null;
+// src/webrtc_base.ts
+var WebrtcBase = class _WebrtcBase {
+  constructor(getSession, client, ingressId, urlBasePath, requestLogger) {
     this._getSession = getSession;
     this._client = client;
     this._requestLogger = requestLogger;
+    this._ingressId = ingressId;
+    this._urlPath = `${urlBasePath}/${this._ingressId}`;
+    this._pc = null;
     this._eTag = "";
     this._queuedCandidates = [];
     this._offerData = null;
   }
+  async close() {
+    const pc = this._pc;
+    this._pc = null;
+    if (pc) {
+      return pc.close();
+    }
+  }
+  ingressId() {
+    return this._ingressId;
+  }
+  async onLocalOffer(offer) {
+    if (!this._pc) {
+      throw new Error("onLocalOffer no peer connection");
+    }
+    if (!offer.sdp) {
+      throw new Error("onLocalOffer no sdp");
+    }
+    this._offerData = _WebrtcBase.parseOffer(offer.sdp);
+    await this._pc.setLocalDescription(offer);
+    const session = await this._getSession();
+    const ingressUrl = new URL(this._urlPath, session.baseUrl);
+    this._requestLogger.debug("before POST: %s", ingressUrl);
+    const headers = {
+      "Authorization": `Bearer ${session.accessToken}`,
+      "Content-Type": "application/sdp"
+    };
+    const response = await this._client.fetch(ingressUrl, {
+      headers,
+      method: "POST",
+      body: offer.sdp
+    });
+    if (response.status != 201) {
+      return Promise.reject(`unknown status code for POST '${ingressUrl}': ${response.status} (${response.statusText})`);
+    }
+    this._eTag = response.headers.get("ETag") ?? "";
+    return this.onRemoteAnswer(new RTCSessionDescription({
+      type: "answer",
+      sdp: await response.text()
+    }));
+  }
+  async sendLocalCandidates(candidates) {
+    if (!this._offerData) {
+      throw new Error("sendLocalCandidates no offerData");
+    }
+    const session = await this._getSession();
+    const ingressUrl = new URL(this._urlPath, session.baseUrl);
+    this._requestLogger.debug("before PATCH: %s", ingressUrl);
+    const headers = {
+      "Authorization": `Bearer ${session.accessToken}`,
+      "Content-Type": "application/trickle-ice-sdpfrag",
+      "If-Match": this._eTag
+    };
+    const response = await this._client.fetch(ingressUrl, {
+      headers,
+      method: "PATCH",
+      body: _WebrtcBase.generateSdpFragment(this._offerData, candidates)
+    });
+    if (response.status != 204) {
+      return Promise.reject(`unknown status code for PATCH '${ingressUrl}': ${response.status} (${response.statusText})`);
+    }
+    return this;
+  }
+  async onLocalCandidate(evt) {
+    if (evt.candidate !== null) {
+      if (this._eTag === "") {
+        this._queuedCandidates.push(evt.candidate);
+      } else {
+        await this.sendLocalCandidates([evt.candidate]);
+      }
+    }
+    return this;
+  }
   static linkToIceServers(links) {
     const servers = links !== null ? links.split(", ").map((link) => {
       const m = link.match(/^<(.+?)>; rel="ice-server"(; username="(.*?)"; credential="(.*?)"; credential-type="password")?/i);
@@ -9331,8 +9405,8 @@ var WebRtcBase = class {
       }
       const iceServer = {
         urls: [m[1]],
-        username: Whip.unquoteCredential(m[3]),
-        credential: Whip.unquoteCredential(m[4])
+        username: WebrtcWhip.unquoteCredential(m[3]),
+        credential: WebrtcWhip.unquoteCredential(m[4])
         // credentialType: m[3]? "password" : undefined
       };
       return iceServer;
@@ -9346,9 +9420,9 @@ var WebRtcBase = class {
     for (let i = 0; i < sections.length; i++) {
       const section = sections[i];
       if (section.startsWith("video")) {
-        sections[i] = Whip.setVideoBitrate(Whip.setCodec(section, videoCodec), videoBitrate);
+        sections[i] = WebrtcWhip.setVideoBitrate(WebrtcWhip.setCodec(section, videoCodec), videoBitrate);
       } else if (section.startsWith("audio")) {
-        sections[i] = Whip.setAudioBitrate(Whip.setCodec(section, audioCodec), audioBitrate, audioVoice);
+        sections[i] = WebrtcWhip.setAudioBitrate(WebrtcWhip.setCodec(section, audioCodec), audioBitrate, audioVoice);
       }
     }
     return sections.join("m=");
@@ -9470,22 +9544,15 @@ var WebRtcBase = class {
   }
 };
 
-// src/whip.ts
-var Whip = class _Whip extends WebRtcBase {
+// src/webrtc_whip.ts
+var WebrtcWhip = class _WebrtcWhip extends WebrtcBase {
   constructor(stream, getSession, client, requestLogger) {
-    super(getSession, client, requestLogger);
-    this._ingressId = v4_default().toString();
+    super(getSession, client, v4_default().toString(), "/liveIngress/whip", requestLogger);
     this._stream = stream;
   }
-  ingressId() {
-    if (!this._ingressId) {
-      throw new Error("not initialized");
-    }
-    return this._ingressId;
-  }
   async start() {
     const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
+    const ingressUrl = new URL(this._urlPath, session.baseUrl);
     this._requestLogger.debug("before GET: %s", ingressUrl);
     const headers = {
       "Authorization": `Bearer ${session.accessToken}`
@@ -9499,17 +9566,46 @@ var Whip = class _Whip extends WebRtcBase {
     }
     return this.onIceServers(response);
   }
+  async stream() {
+    if (this._stream) {
+      return Promise.resolve(this._stream);
+    } else {
+      return Promise.reject("fetching stream failed");
+    }
+  }
+  async onRemoteAnswer(answer) {
+    if (!this._pc) {
+      throw new Error("onLocalOffer no peer connection");
+    }
+    answer = new RTCSessionDescription({
+      type: "answer",
+      sdp: _WebrtcWhip.editAnswer(
+        answer.sdp,
+        "h264/90000",
+        void 0,
+        5e3,
+        void 0,
+        true
+      )
+    });
+    await this._pc.setRemoteDescription(new RTCSessionDescription(answer));
+    if (this._queuedCandidates.length !== 0) {
+      await this.sendLocalCandidates(this._queuedCandidates);
+      this._queuedCandidates = [];
+    }
+    return this;
+  }
   async onIceServers(response) {
     if (!this._stream) {
       throw new Error("onIceServers no stream");
     }
     const stream = this._stream;
     const pc = new RTCPeerConnection({
-      iceServers: _Whip.linkToIceServers(response.headers.get("Link"))
+      iceServers: WebrtcBase.linkToIceServers(response.headers.get("Link"))
     });
     this._pc = pc;
     pc.onicecandidate = (evt) => this.onLocalCandidate(evt);
-    return new Promise(async (resolve2, reject) => {
+    return new Promise(async (resolve, reject) => {
       pc.oniceconnectionstatechange = () => {
         switch (pc.iceConnectionState) {
           case "failed":
@@ -9517,7 +9613,7 @@ var Whip = class _Whip extends WebRtcBase {
             reject(`peer connection: ${pc.iceConnectionState}`);
             break;
           case "connected":
-            resolve2(this);
+            resolve(this);
             break;
         }
       };
@@ -9532,61 +9628,63 @@ var Whip = class _Whip extends WebRtcBase {
       await this.onLocalOffer(await pc.createOffer());
     });
   }
-  async onLocalCandidate(evt) {
-    if (evt.candidate !== null) {
-      if (this._eTag === "") {
-        this._queuedCandidates.push(evt.candidate);
-      } else {
-        await this.sendLocalCandidates([evt.candidate]);
-      }
+  async close() {
+    const stream = this._stream;
+    this._stream = null;
+    if (stream) {
+      const tracks = stream.getTracks();
+      tracks.forEach((track) => {
+        track.stop();
+      });
     }
-    return this;
+    return super.close();
   }
-  async onLocalOffer(offer) {
-    if (!this._pc) {
-      throw new Error("onLocalOffer no peer connection");
+};
+
+// src/webrtc_whep.ts
+var WebrtcWhep = class extends WebrtcBase {
+  constructor(ingressId, getSession, client, requestLogger) {
+    super(getSession, client, ingressId, "/liveIngress/whep", requestLogger);
+    this._stream = null;
+  }
+  async close() {
+    const stream = this._stream;
+    this._stream = null;
+    if (stream) {
+      const tracks = stream.getTracks();
+      tracks.forEach((track) => {
+        track.stop();
+      });
     }
-    if (!offer.sdp) {
-      throw new Error("onLocalOffer no sdp");
+    return super.close();
+  }
+  async stream() {
+    if (this._stream) {
+      return Promise.resolve(this._stream);
+    } else {
+      return Promise.reject("fetching stream failed");
     }
-    this._offerData = _Whip.parseOffer(offer.sdp);
-    await this._pc.setLocalDescription(offer);
+  }
+  async start() {
     const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
-    this._requestLogger.debug("before GET: %s", ingressUrl);
+    const egressUrl = new URL(this._urlPath, session.baseUrl);
+    this._requestLogger.debug("before GET: %s", egressUrl);
     const headers = {
-      "Authorization": `Bearer ${session.accessToken}`,
-      "Content-Type": "application/sdp"
+      "Authorization": `Bearer ${session.accessToken}`
     };
-    const response = await this._client.fetch(ingressUrl, {
+    const response = await this._client.fetch(egressUrl, {
       headers,
-      method: "POST",
-      body: offer.sdp
+      method: "GET"
     });
-    if (response.status != 201) {
-      return Promise.reject(`unknown status code for POST '${ingressUrl}': ${response.status} (${response.statusText})`);
+    if (response.status >= 300) {
+      return Promise.reject(`unknown status code for GET '${egressUrl}': ${response.status} (${response.statusText})`);
     }
-    this._eTag = response.headers.get("ETag") ?? "";
-    return this.onRemoteAnswer(new RTCSessionDescription({
-      type: "answer",
-      sdp: await response.text()
-    }));
+    return this.onIceServers(response);
   }
   async onRemoteAnswer(answer) {
     if (!this._pc) {
       throw new Error("onLocalOffer no peer connection");
     }
-    answer = new RTCSessionDescription({
-      type: "answer",
-      sdp: _Whip.editAnswer(
-        answer.sdp,
-        "h264/90000",
-        void 0,
-        5e3,
-        void 0,
-        true
-      )
-    });
     await this._pc.setRemoteDescription(new RTCSessionDescription(answer));
     if (this._queuedCandidates.length !== 0) {
       await this.sendLocalCandidates(this._queuedCandidates);
@@ -9594,89 +9692,100 @@ var Whip = class _Whip extends WebRtcBase {
     }
     return this;
   }
-  async sendLocalCandidates(candidates) {
-    if (!this._offerData) {
-      throw new Error("sendLocalCandidates no offerData");
+  async onIceServers(response) {
+    if (this._stream) {
+      throw new Error("onIceServers has stream");
     }
-    const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
-    this._requestLogger.debug("before PATCH: %s", ingressUrl);
-    const headers = {
-      "Authorization": `Bearer ${session.accessToken}`,
-      "Content-Type": "application/trickle-ice-sdpfrag",
-      "If-Match": this._eTag
-    };
-    const response = await this._client.fetch(ingressUrl, {
-      headers,
-      method: "PATCH",
-      body: _Whip.generateSdpFragment(this._offerData, candidates)
+    const pc = new RTCPeerConnection({
+      iceServers: WebrtcBase.linkToIceServers(response.headers.get("Link"))
+    });
+    const direction = "sendrecv";
+    pc.addTransceiver("video", { direction });
+    pc.onicecandidate = (evt) => this.onLocalCandidate(evt);
+    this._pc = pc;
+    this._requestLogger.info("before", pc.iceConnectionState);
+    return new Promise(async (resolve, reject) => {
+      pc.ontrack = (evt) => {
+        this._requestLogger.debug("new track:", evt.track.kind);
+        this._stream = evt.streams[0];
+        resolve(this);
+      };
+      pc.oniceconnectionstatechange = () => {
+        switch (pc.iceConnectionState) {
+          case "failed":
+          case "disconnected":
+            this._requestLogger.debug("disconnected");
+            reject(`peer connection: ${pc.iceConnectionState}`);
+            break;
+          case "connected":
+            this._requestLogger.debug("connected");
+            break;
+        }
+      };
+      await this.onLocalOffer(await pc.createOffer());
     });
-    if (response.status != 204) {
-      return Promise.reject(`unknown status code for PATCH '${ingressUrl}': ${response.status} (${response.statusText})`);
-    }
-    return this;
-  }
-  async close() {
-    const pc = this._pc;
-    const stream = this._stream;
-    this._stream = null;
-    this._pc = null;
-    if (stream) {
-      const tracks = stream.getTracks();
-      tracks.forEach((track) => {
-        track.stop();
-      });
-    }
-    if (pc) {
-      return pc.close();
-    }
   }
 };
 
 // src/shims/local_file.ts
-var resolve;
+var resolvePath;
 if ("document" in globalThis && "implementation" in globalThis.document) {
-  const isFileLike = (value) => value != null && typeof value === "object" && typeof value.name === "string" && typeof value.lastModified === "number";
-  resolve = async (params) => {
-    if (params.file) {
-      if (isFileLike(params.file)) {
-        params = {
-          mimeType: params.file.type,
-          file: params.file
-        };
-        return params;
-      }
-    }
+  resolvePath = async (source) => {
     throw new DOMException("resolving a path to a file is not supported in browser");
   };
 } else {
-  resolve = async (params) => {
-    if (params.file) {
-      return params;
-    }
+  resolvePath = async (source) => {
     const mime = require_mime_types();
-    const fs = require("fs");
-    let mimeType;
-    let stream;
-    if (params.filePath) {
-      if (params.mimeType) {
-        mimeType = params.mimeType;
-      } else {
-        mimeType = mime.lookup(params.filePath) || void 0;
+    const filehandle = require("fs/promises");
+    const fd = await filehandle.open(source.path, "r");
+    const stream = fd.createReadStream();
+    const mimeType = mime.lookup(source.path) || "application/octet-stream";
+    return {
+      stream,
+      mimeType
+    };
+  };
+}
+
+// src/endpoint.ts
+var import_pino = require("pino");
+
+// src/shims/browser_session.ts
+var import_auth0_spa_js = require("@auth0/auth0-spa-js");
+var authenticateBrowserSession;
+if ("document" in globalThis && "implementation" in globalThis.document) {
+  authenticateBrowserSession = async (auth0, eyepopUrl, popId) => {
+    const options = {
+      clientId: auth0.clientId,
+      domain: auth0.domain,
+      authorizationParams: {
+        scope: auth0.scope,
+        audience: auth0.audience
       }
-      stream = fs.createReadStream(params.filePath);
+    };
+    const auth0Client = await (0, import_auth0_spa_js.createAuth0Client)(options);
+    if (!await auth0Client.isAuthenticated()) {
+      await auth0Client.loginWithPopup();
     }
-    params = {
-      filePath: params.filePath,
-      mimeType,
-      file: stream
+    const accessToken = await auth0Client.getTokenSilently();
+    if (!accessToken) {
+      return Promise.reject("auth0 login failed");
+    }
+    const session = {
+      eyepopUrl,
+      popId,
+      accessToken,
+      validUntil: Date.now() + 60 * 60 * 1e3
     };
-    return params;
+    return session;
+  };
+} else {
+  authenticateBrowserSession = (auth0, eyepopUrl, popId) => {
+    return Promise.reject("auth0 login not supported server-side");
   };
 }
 
 // src/endpoint.ts
-var import_pino = require("pino");
 var Endpoint = class {
   constructor(options) {
     this._options = options;
@@ -9700,54 +9809,12 @@ var Endpoint = class {
     this._logger = rootLogger.child({ module: "eyepop" });
     this._requestLogger = this._logger.child({ module: "requests" });
   }
-  onStateChanged(handler) {
-    this._stateChangeHandler = handler;
-    return this;
-  }
-  async startIngressWs() {
-    if (this._ingressEventWs || !this._baseUrl || !this._client) {
-      return;
+  eyepopUrl() {
+    if (this._options.eyepopUrl) {
+      return this._options.eyepopUrl.replace(/\/+$/, "");
+    } else {
+      return "https://api.eyepop.ai";
     }
-    try {
-      const getTokenUrl = `${this._baseUrl}/liveIngress/events/token`;
-      const headers = {
-        "Authorization": await this.authorizationHeader()
-      };
-      this._requestLogger.debug("before GET %s", getTokenUrl);
-      let response = await this._client.fetch(getTokenUrl, { headers });
-      if (response.status == 401) {
-        this._requestLogger.debug("after GET %s: 401, about to retry with fresh access token", getTokenUrl);
-        this._token = null;
-        const headers2 = {
-          "Authorization": await this.authorizationHeader()
-        };
-        this.updateState("FetchConfig" /* FetchConfig */);
-        response = await this._client.fetch(getTokenUrl, { headers: headers2 });
-      }
-      if (response.status != 200) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
-      }
-      const wsAuthToken = await response.json();
-      const wsUrl = this._baseUrl.startsWith("https://") ? `${this._baseUrl.replace("https://", "wss://")}/liveIngress/events/${wsAuthToken.token}` : `${this._baseUrl.replace("http://", "ws://")}/liveIngress/events/${wsAuthToken.token}`;
-      this._ingressEventWs = new WebSocket(wsUrl);
-      this._ingressEventWs.addEventListener("message", (event) => {
-        const ingressEvent = JSON.parse(event.data);
-        if (this._ingressEventHandler) {
-          this._ingressEventHandler(ingressEvent);
-        }
-      });
-    } finally {
-      this.updateState();
-    }
-  }
-  onIngressEvent(handler) {
-    this._ingressEventHandler = handler;
-    this.startIngressWs().then(() => {
-    }).catch((reason) => {
-      this._logger.warn("unexpected error starting the ingress event handler: %s", reason);
-    });
-    return this;
   }
   state() {
     return this._state;
@@ -9761,6 +9828,80 @@ var Endpoint = class {
   popId() {
     return this._options.popId || null;
   }
+  onStateChanged(handler) {
+    this._stateChangeHandler = handler;
+    return this;
+  }
+  onIngressEvent(handler) {
+    this._ingressEventHandler = handler;
+    this.startIngressWs().then(() => {
+    }).catch((reason) => {
+      this._logger.warn("unexpected error starting the ingress event handler: %s", reason);
+    });
+    return this;
+  }
+  async connect() {
+    if (this._client) {
+      this._logger.warn("endpoint already connected");
+      return this;
+    }
+    if (!this._options.eyepopUrl) {
+      return Promise.reject("option eyepopUrl or environment variable EYEPOP_URL is required");
+    }
+    if (!this._options.popId) {
+      return Promise.reject("option popId or environment variable EYEPOP_POP_ID is required");
+    }
+    if (this._options.auth === void 0) {
+      return Promise.reject("cannot connect without defined auth option");
+    }
+    if (this._options.auth.session !== void 0) {
+      this._token = this._options.auth.session.accessToken;
+      this._expire_token_time = this._options.auth.session.validUntil / 1e3;
+    } else if (this._options.auth.oAuth2 !== void 0) {
+    } else if (this._options.auth.secretKey !== void 0) {
+    } else {
+      return Promise.reject("option secretKey or environment variable EYEPOP_SECRET_KEY is required");
+    }
+    this._client = await createHttpClient();
+    let result = await this.reconnect();
+    if (this._baseUrl && this._options.stopJobs) {
+      const stop_url = `${this._baseUrl}/pipelines/${this._pipelineId}/source?mode=preempt&processing=sync`;
+      const body = { "sourceType": "NONE" };
+      const headers = {
+        "Authorization": await this.authorizationHeader(),
+        "Content-Type": "application/json"
+      };
+      this._requestLogger.debug("before PATCH %s", stop_url);
+      let response = await this._client.fetch(stop_url, {
+        method: "PATCH",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (response.status >= 300) {
+        const message = await response.text();
+        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      }
+      this._requestLogger.debug("after PATCH %s", stop_url);
+    }
+    if (!this._ingressEventWs && this._ingressEventHandler) {
+      await this.startIngressWs();
+    }
+    return result;
+  }
+  async disconnect(wait = true) {
+    if (wait && this._limit) {
+      for (let j = 0; j < this._options.jobQueueLength; j++) {
+        await this._limit.acquire();
+      }
+    }
+    this._limit = new Semaphore(this._options.jobQueueLength ?? 1024);
+    if (this._client) {
+      await this._client.close();
+      this._client = null;
+    }
+    this._baseUrl = null;
+    this._pipelineId = null;
+  }
   async session() {
     await this.currentAccessToken();
     if (this._token == null || this._expire_token_time == null) {
@@ -9785,101 +9926,172 @@ var Endpoint = class {
     if (!this._baseUrl || !this._client) {
       return Promise.reject("endpoint not connected, use connect() before ingress()");
     }
-    const job = new Whip(stream, async () => {
+    const whip = new WebrtcWhip(stream, async () => {
       return this.session();
     }, this._client, this._requestLogger);
-    return job.start();
+    return whip.start();
   }
-  async upload(params) {
-    if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
-      return Promise.reject("endpoint not connected, use connect() before upload()");
-    }
-    params = await resolve(params);
-    if (!params.mimeType) {
-      return Promise.reject("upload for streams requires a mimeType");
+  async liveEgress(ingressId) {
+    if (!this._baseUrl || !this._client) {
+      return Promise.reject("endpoint not connected, use connect() before ingress()");
     }
-    await this._limit.acquire();
-    this.updateState();
-    const job = new UploadJob(params.file, params.mimeType, async () => {
+    const whep = new WebrtcWhep(ingressId, async () => {
       return this.session();
     }, this._client, this._requestLogger);
-    return job.start(() => {
-      this.jobDone(job);
-    }, (statusCode) => {
-      this.jobStatus(job, statusCode);
-    });
+    return whep.start();
+  }
+  async process(source) {
+    if (source.file !== void 0) {
+      return this.uploadFile(source);
+    } else if (source.stream !== void 0) {
+      return this.uploadStream(source);
+    } else if (source.path !== void 0) {
+      return this.uploadPath(source);
+    } else if (source.url !== void 0) {
+      return this.loadFrom(source);
+    } else if (source.ingressId !== void 0) {
+      return this.loadLiveIngress(source);
+    } else {
+      return Promise.reject("unknown source type");
+    }
+  }
+  async startIngressWs() {
+    if (this._ingressEventWs || !this._baseUrl || !this._client) {
+      return;
+    }
+    try {
+      const getTokenUrl = `${this._baseUrl}/liveIngress/events/token`;
+      const headers = {
+        "Authorization": await this.authorizationHeader()
+      };
+      this._requestLogger.debug("before GET %s", getTokenUrl);
+      let response = await this._client.fetch(getTokenUrl, { headers });
+      if (response.status == 401) {
+        this._requestLogger.debug("after GET %s: 401, about to retry with fresh access token", getTokenUrl);
+        this._token = null;
+        const headers2 = {
+          "Authorization": await this.authorizationHeader()
+        };
+        this.updateState("FetchConfig" /* FetchConfig */);
+        response = await this._client.fetch(getTokenUrl, { headers: headers2 });
+      }
+      if (response.status != 200) {
+        const message = await response.text();
+        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      }
+      const wsAuthToken = await response.json();
+      const wsUrl = this._baseUrl.startsWith("https://") ? `${this._baseUrl.replace("https://", "wss://")}/liveIngress/events/${wsAuthToken.token}` : `${this._baseUrl.replace("http://", "ws://")}/liveIngress/events/${wsAuthToken.token}`;
+      this._ingressEventWs = new WebSocket(wsUrl);
+      this._ingressEventWs.addEventListener("message", (event) => {
+        const ingressEvent = JSON.parse(event.data);
+        if (this._ingressEventHandler) {
+          this._ingressEventHandler(ingressEvent);
+        }
+      });
+    } finally {
+      this.updateState();
+    }
   }
-  async loadFrom(location) {
+  async uploadFile(source) {
     if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
-      throw new Error("endpoint not connected, use connect() before loadFrom()");
+      return Promise.reject("endpoint not connected, use connect() before upload()");
     }
     await this._limit.acquire();
-    this.updateState();
-    const job = new LoadFromJob(location, async () => {
-      return this.session();
-    }, this._client, this._requestLogger);
-    return job.start(() => {
-      this.jobDone(job);
-    }, (statusCode) => {
-      this.jobStatus(job, statusCode);
-    });
+    try {
+      this.updateState();
+      const job = new UploadJob(source.file, source.file.type, async () => {
+        return this.session();
+      }, this._client, this._requestLogger);
+      return job.start(() => {
+        this.jobDone(job);
+      }, (statusCode) => {
+        this.jobStatus(job, statusCode);
+      });
+    } catch (e) {
+      this._limit.release();
+      throw e;
+    }
   }
-  async loadLiveIngress(ingressId) {
+  async uploadStream(source) {
     if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
-      throw new Error("endpoint not connected, use connect() before loadLiveIngress()");
+      return Promise.reject("endpoint not connected, use connect() before upload()");
     }
     await this._limit.acquire();
-    this.updateState();
-    const job = new LoadLiveIngressJob(ingressId, async () => {
-      return this.session();
-    }, this._client, this._requestLogger);
-    return job.start(() => {
-      this.jobDone(job);
-    }, (statusCode) => {
-      this.jobStatus(job, statusCode);
-    });
+    try {
+      this.updateState();
+      const job = new UploadJob(source.stream, source.mimeType, async () => {
+        return this.session();
+      }, this._client, this._requestLogger);
+      return job.start(() => {
+        this.jobDone(job);
+      }, (statusCode) => {
+        this.jobStatus(job, statusCode);
+      });
+    } catch (e) {
+      this._limit.release();
+      throw e;
+    }
   }
-  // noinspection TypeScriptValidateTypes
-  async connect() {
-    if (this._client) {
-      console.info("endpoint already connected");
-      return this;
+  async uploadPath(source) {
+    if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
+      throw new Error("endpoint not connected, use connect() before process()");
     }
-    if (!this._options.eyepopUrl) {
-      return Promise.reject("option eyepopUrl or environment variable EYEPOP_URL is required");
+    await this._limit.acquire();
+    try {
+      this.updateState();
+      const streamSource = await resolvePath(source);
+      const job = new UploadJob(streamSource.stream, streamSource.mimeType, async () => {
+        return this.session();
+      }, this._client, this._requestLogger);
+      return job.start(() => {
+        this.jobDone(job);
+      }, (statusCode) => {
+        this.jobStatus(job, statusCode);
+      });
+    } catch (e) {
+      this._limit.release();
+      throw e;
     }
-    if (!this._options.popId) {
-      return Promise.reject("option popId or environment variable EYEPOP_POP_ID is required");
+  }
+  async loadFrom(source) {
+    if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
+      throw new Error("endpoint not connected, use connect() before loadFrom()");
     }
-    if (this._options.auth && this._options.auth.session) {
-      this._token = this._options.auth.session.accessToken;
-      this._expire_token_time = this._options.auth.session.validUntil / 1e3;
-    } else {
-      if (!this._options.auth || !this._options.auth.secretKey) {
-        return Promise.reject("option secretKey or environment variable EYEPOP_SECRET_KEY is required");
-      }
+    await this._limit.acquire();
+    try {
+      this.updateState();
+      const job = new LoadFromJob(source.url, async () => {
+        return this.session();
+      }, this._client, this._requestLogger);
+      return job.start(() => {
+        this.jobDone(job);
+      }, (statusCode) => {
+        this.jobStatus(job, statusCode);
+      });
+    } catch (e) {
+      this._limit.release();
+      throw e;
     }
-    this._client = await createHttpClient();
-    let result = await this.reconnect();
-    if (this._baseUrl && this._options.stopJobs) {
-      const stop_url = `${this._baseUrl}/pipelines/${this._pipelineId}/source?mode=preempt&processing=sync`;
-      const body = { "sourceType": "NONE" };
-      const headers = {
-        "Authorization": await this.authorizationHeader(),
-        "Content-Type": "application/json"
-      };
-      this._requestLogger.debug("before PATCH %s", stop_url);
-      let response = await this._client.fetch(stop_url, { method: "PATCH", headers, body: JSON.stringify(body) });
-      if (response.status >= 300) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
-      }
-      this._requestLogger.debug("after PATCH %s", stop_url);
+  }
+  async loadLiveIngress(source) {
+    if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
+      throw new Error("endpoint not connected, use connect() before loadLiveIngress()");
     }
-    if (!this._ingressEventWs && this._ingressEventHandler) {
-      await this.startIngressWs();
+    await this._limit.acquire();
+    try {
+      this.updateState();
+      const job = new LoadLiveIngressJob(source.ingressId, async () => {
+        return this.session();
+      }, this._client, this._requestLogger);
+      return job.start(() => {
+        this.jobDone(job);
+      }, (statusCode) => {
+        this.jobStatus(job, statusCode);
+      });
+    } catch (e) {
+      this._limit.release();
+      throw e;
     }
-    return result;
   }
   jobDone(job) {
     this._limit?.release();
@@ -9967,20 +10179,6 @@ var Endpoint = class {
       return Promise.resolve(this);
     }
   }
-  async disconnect(wait = true) {
-    if (wait && this._limit) {
-      for (let j = 0; j < this._options.jobQueueLength; j++) {
-        await this._limit.acquire();
-      }
-    }
-    this._limit = new Semaphore(this._options.jobQueueLength ?? 1024);
-    if (this._client) {
-      await this._client.close();
-      this._client = null;
-    }
-    this._baseUrl = null;
-    this._pipelineId = null;
-  }
   async authorizationHeader() {
     return `Bearer ${await this.currentAccessToken()}`;
   }
@@ -9988,41 +10186,49 @@ var Endpoint = class {
     const now = Date.now() / 1e3;
     if (!this._token || this._expire_token_time < now) {
       this.updateState("Authenticating" /* Authenticating */);
-      if (!this._client) {
-        return Promise.reject("endpoint not connected");
-      } else if (!this._options.auth || !this._options.auth.secretKey) {
-        return Promise.reject("temporary access token expired");
-      }
-      const body = { "secret_key": this._options.auth.secretKey };
-      const headers = { "Content-Type": "application/json" };
-      const post_url = `${this.eyepopUrl()}/authentication/token`;
-      this._requestLogger.debug("before POST %s", post_url);
-      const response = await this._client.fetch(post_url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
-      if (response.status != 200) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      try {
+        if (!this._client) {
+          return Promise.reject("endpoint not connected");
+        } else if (this._options.auth.session !== void 0) {
+          return Promise.reject("temporary access token expired");
+        } else if (this._options.auth.oAuth2 !== void 0 && this._options.eyepopUrl && this._options.popId) {
+          const session = await authenticateBrowserSession(
+            this._options.auth.oAuth2,
+            this._options.eyepopUrl,
+            this._options.popId
+          );
+          this._token = session.accessToken;
+          this._expire_token_time = session.validUntil / 1e3;
+        } else if (this._options.auth.secretKey !== void 0 && this._options.eyepopUrl) {
+          const secretKeyAuth = this._options.auth;
+          const body = { "secret_key": secretKeyAuth.secretKey };
+          const headers = { "Content-Type": "application/json" };
+          const post_url = `${this.eyepopUrl()}/authentication/token`;
+          this._requestLogger.debug("before POST %s", post_url);
+          const response = await this._client.fetch(post_url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(body)
+          });
+          if (response.status != 200) {
+            const message = await response.text();
+            return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+          }
+          this._requestLogger.debug("after POST %s", post_url);
+          const data = await response.json();
+          const token = data;
+          this._token = token.access_token;
+          this._expire_token_time = now + token.expires_in - 60;
+        } else {
+          return Promise.reject("no valid auth option");
+        }
+      } finally {
+        this.updateState();
       }
-      this._requestLogger.debug("after POST %s", post_url);
-      const data = await response.json();
-      const token = data;
-      this._token = token.access_token;
-      this._expire_token_time = now + token.expires_in - 60;
-      this.updateState();
     }
     this._logger.debug("using access token, valid for at least %d seconds", this._expire_token_time - now);
     return this._token;
   }
-  eyepopUrl() {
-    if (this._options.eyepopUrl) {
-      return this._options.eyepopUrl.replace(/\/+$/, "");
-    } else {
-      return "https://api.eyepop.ai";
-    }
-  }
 };
 
 // src/visualize.ts
@@ -10138,40 +10344,6 @@ _EyePopPlot.colors = {
 };
 var EyePopPlot = _EyePopPlot;
 
-// src/shims/browser_session.ts
-var authenticateBrowserSession;
-if ("document" in globalThis && "implementation" in globalThis.document) {
-  authenticateBrowserSession = (oauthUrl, eyepopUrl, popId) => {
-    const queryString = window.location.search;
-    const urlParams = new URLSearchParams(queryString);
-    let token = urlParams.get("pop_token");
-    if (token) {
-      urlParams.delete("pop_token");
-      const url = `${window.location.pathname}?${urlParams}`;
-      window.history.replaceState({}, document.title, url);
-      return {
-        eyepopUrl,
-        popId,
-        accessToken: token,
-        validUntil: Date.now() + 60 * 60 * 1e3
-      };
-    } else {
-      const url = `${oauthUrl}?url=${encodeURIComponent(window.location.href)}`;
-      window.location.replace(url);
-      return {
-        eyepopUrl,
-        popId,
-        accessToken: "in-progress",
-        validUntil: 0
-      };
-    }
-  };
-} else {
-  authenticateBrowserSession = (oauthUrl, eyepopUrl, popId) => {
-    return null;
-  };
-}
-
 // src/index.ts
 var readEnv = (env) => {
   if (typeof process !== "undefined") {
@@ -10179,7 +10351,7 @@ var readEnv = (env) => {
   }
   return void 0;
 };
-var EyePopSdk = class {
+var _EyePopSdk = class _EyePopSdk {
   static endpoint({
     auth = this.defaultAuth,
     popId = readEnv("EYEPOP_POP_ID"),
@@ -10190,17 +10362,30 @@ var EyePopSdk = class {
     logger,
     ...opts
   } = {}) {
-    if (auth.oAuth && popId) {
-      let oauthUrl = "https://dashboard.eyepop.ai/sdkauth";
-      if (typeof auth.oAuth == "string") {
-        oauthUrl = auth.oAuth;
+    if (auth.oAuth2 !== void 0 && popId) {
+      if (typeof auth.oAuth2 === "boolean") {
+        auth = {
+          oAuth2: {
+            domain: "eyepop.us.auth0.com",
+            clientId: "Lb9ubA9Hf3jlaqWLUx8XgA0zvotgViCl",
+            audience: "https://api.eyepop.ai",
+            scope: "admin:clouds"
+          }
+        };
+      }
+    }
+    if (auth.session !== void 0) {
+      if (auth.session.popId) {
+        popId = auth.session.popId;
+      }
+      if (auth.session.eyepopUrl) {
+        eyepopUrl = auth.session.eyepopUrl;
       }
-      auth.session = authenticateBrowserSession(oauthUrl, eyepopUrl ?? "https://api.eyepop.ai", popId) ?? void 0;
     }
     const options = {
       auth,
-      popId: auth.session ? auth.session.popId : popId,
-      eyepopUrl: auth.session ? auth.session.eyepopUrl : eyepopUrl ?? "https://api.eyepop.ai",
+      popId,
+      eyepopUrl: eyepopUrl ?? "https://api.eyepop.ai",
       autoStart,
       stopJobs,
       jobQueueLength,
@@ -10213,9 +10398,11 @@ var EyePopSdk = class {
     return new EyePopPlot(context);
   }
 };
-EyePopSdk.defaultAuth = {
-  secretKey: readEnv("EYEPOP_SECRET_KEY")
-};
+_EyePopSdk.envSecretKey = readEnv("EYEPOP_SECRET_KEY");
+_EyePopSdk.defaultAuth = _EyePopSdk.envSecretKey ? {
+  secretKey: _EyePopSdk.envSecretKey
+} : void 0;
+var EyePopSdk = _EyePopSdk;
 var src_default = EyePopSdk;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {