@eyepop.ai/eyepop 0.12.0 → 0.14.0

package/dist/index.mjs

@@ -8599,11 +8599,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path) {
-      if (!path || typeof path !== "string") {
+    function lookup(path2) {
+      if (!path2 || typeof path2 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path).toLowerCase().substr(1);
+      var extension2 = extname("x." + path2).toLowerCase().substr(1);
       if (!extension2) {
         return false;
       }
@@ -9054,7 +9054,7 @@ var LoadLiveIngressJob = class extends AbstractJob {
       "Accept": "application/jsonl",
       "Content-Type": "application/json"
     };
-    const patchUrl = `${session.baseUrl.replace(/\/+$/, "")}/pipelines/${session.pipelineId}/source?mode=queue&processing=sync`;
+    const patchUrl = `${session.baseUrl.replace(/\/+$/, "")}/pipelines/${session.pipelineId}/source?mode=preempt&processing=sync`;
     this._requestLogger.debug("before PATCH %s with url %s as source", patchUrl, this._ingressId);
     const response = await this._client.fetch(patchUrl, {
       headers,
@@ -9283,17 +9283,100 @@ function v4(options, buf, offset) {
 }
 var v4_default = v4;
 
-// src/web_rtc_base.ts
-var WebRtcBase = class {
-  constructor(getSession, client, requestLogger) {
-    this._pc = null;
+// src/webrtc_base.ts
+import path from "path";
+var WebrtcBase = class _WebrtcBase {
+  constructor(getSession, client, ingressId, urlBasePath, requestLogger) {
     this._getSession = getSession;
     this._client = client;
     this._requestLogger = requestLogger;
+    this._ingressId = ingressId;
+    this._urlPath = `${urlBasePath}/${this._ingressId}`;
+    this._pc = null;
     this._eTag = "";
+    this._location = null;
     this._queuedCandidates = [];
     this._offerData = null;
   }
+  async close() {
+    const pc = this._pc;
+    this._pc = null;
+    if (pc) {
+      return pc.close();
+    }
+  }
+  ingressId() {
+    return this._ingressId;
+  }
+  async onLocalOffer(offer) {
+    if (!this._pc) {
+      throw new Error("onLocalOffer no peer connection");
+    }
+    if (!offer.sdp) {
+      throw new Error("onLocalOffer no sdp");
+    }
+    this._offerData = _WebrtcBase.parseOffer(offer.sdp);
+    await this._pc.setLocalDescription(offer);
+    const session = await this._getSession();
+    const ingressUrl = new URL(this._urlPath, session.baseUrl);
+    this._requestLogger.debug("before POST: %s", ingressUrl);
+    const headers = {
+      "Authorization": `Bearer ${session.accessToken}`,
+      "Content-Type": "application/sdp"
+    };
+    const response = await this._client.fetch(ingressUrl, {
+      headers,
+      method: "POST",
+      body: offer.sdp
+    });
+    if (response.status != 201) {
+      return Promise.reject(`unknown status code for POST '${ingressUrl}': ${response.status} (${response.statusText})`);
+    }
+    this._eTag = response.headers.get("ETag") ?? "";
+    this._location = response.headers.get("Location");
+    return this.onRemoteAnswer(new RTCSessionDescription({
+      type: "answer",
+      sdp: await response.text()
+    }));
+  }
+  async sendLocalCandidates(candidates) {
+    if (!this._offerData) {
+      throw new Error("sendLocalCandidates no offerData");
+    }
+    let urlPath = void 0;
+    const session = await this._getSession();
+    if (this._location) {
+      urlPath = path.join(this._urlPath, this._location);
+    } else {
+      urlPath = this._urlPath;
+    }
+    const ingressUrl = new URL(urlPath, session.baseUrl);
+    this._requestLogger.debug("before PATCH: %s", ingressUrl);
+    const headers = {
+      "Authorization": `Bearer ${session.accessToken}`,
+      "Content-Type": "application/trickle-ice-sdpfrag",
+      "If-Match": this._eTag
+    };
+    const response = await this._client.fetch(ingressUrl, {
+      headers,
+      method: "PATCH",
+      body: _WebrtcBase.generateSdpFragment(this._offerData, candidates)
+    });
+    if (response.status != 204) {
+      return Promise.reject(`unknown status code for PATCH '${ingressUrl}': ${response.status} (${response.statusText})`);
+    }
+    return this;
+  }
+  async onLocalCandidate(evt) {
+    if (evt.candidate !== null) {
+      if (this._eTag === "") {
+        this._queuedCandidates.push(evt.candidate);
+      } else {
+        await this.sendLocalCandidates([evt.candidate]);
+      }
+    }
+    return this;
+  }
   static linkToIceServers(links) {
     const servers = links !== null ? links.split(", ").map((link) => {
       const m = link.match(/^<(.+?)>; rel="ice-server"(; username="(.*?)"; credential="(.*?)"; credential-type="password")?/i);
@@ -9302,8 +9385,8 @@ var WebRtcBase = class {
       }
       const iceServer = {
         urls: [m[1]],
-        username: Whip.unquoteCredential(m[3]),
-        credential: Whip.unquoteCredential(m[4])
+        username: WebrtcWhip.unquoteCredential(m[3]),
+        credential: WebrtcWhip.unquoteCredential(m[4])
         // credentialType: m[3]? "password" : undefined
       };
       return iceServer;
@@ -9317,9 +9400,9 @@ var WebRtcBase = class {
     for (let i = 0; i < sections.length; i++) {
       const section = sections[i];
       if (section.startsWith("video")) {
-        sections[i] = Whip.setVideoBitrate(Whip.setCodec(section, videoCodec), videoBitrate);
+        sections[i] = WebrtcWhip.setVideoBitrate(WebrtcWhip.setCodec(section, videoCodec), videoBitrate);
       } else if (section.startsWith("audio")) {
-        sections[i] = Whip.setAudioBitrate(Whip.setCodec(section, audioCodec), audioBitrate, audioVoice);
+        sections[i] = WebrtcWhip.setAudioBitrate(WebrtcWhip.setCodec(section, audioCodec), audioBitrate, audioVoice);
       }
     }
     return sections.join("m=");
@@ -9441,22 +9524,15 @@ var WebRtcBase = class {
   }
 };
 
-// src/whip.ts
-var Whip = class _Whip extends WebRtcBase {
+// src/webrtc_whip.ts
+var WebrtcWhip = class _WebrtcWhip extends WebrtcBase {
   constructor(stream, getSession, client, requestLogger) {
-    super(getSession, client, requestLogger);
-    this._ingressId = v4_default().toString();
+    super(getSession, client, v4_default().toString(), "/liveIngress/whip", requestLogger);
     this._stream = stream;
   }
-  ingressId() {
-    if (!this._ingressId) {
-      throw new Error("not initialized");
-    }
-    return this._ingressId;
-  }
   async start() {
     const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
+    const ingressUrl = new URL(this._urlPath, session.baseUrl);
     this._requestLogger.debug("before GET: %s", ingressUrl);
     const headers = {
       "Authorization": `Bearer ${session.accessToken}`
@@ -9470,13 +9546,42 @@ var Whip = class _Whip extends WebRtcBase {
     }
     return this.onIceServers(response);
   }
+  async stream() {
+    if (this._stream) {
+      return Promise.resolve(this._stream);
+    } else {
+      return Promise.reject("fetching stream failed");
+    }
+  }
+  async onRemoteAnswer(answer) {
+    if (!this._pc) {
+      throw new Error("onLocalOffer no peer connection");
+    }
+    answer = new RTCSessionDescription({
+      type: "answer",
+      sdp: _WebrtcWhip.editAnswer(
+        answer.sdp,
+        "h264/90000",
+        void 0,
+        5e3,
+        void 0,
+        true
+      )
+    });
+    await this._pc.setRemoteDescription(new RTCSessionDescription(answer));
+    if (this._queuedCandidates.length !== 0) {
+      await this.sendLocalCandidates(this._queuedCandidates);
+      this._queuedCandidates = [];
+    }
+    return this;
+  }
   async onIceServers(response) {
     if (!this._stream) {
       throw new Error("onIceServers no stream");
     }
     const stream = this._stream;
     const pc = new RTCPeerConnection({
-      iceServers: _Whip.linkToIceServers(response.headers.get("Link"))
+      iceServers: WebrtcBase.linkToIceServers(response.headers.get("Link"))
     });
     this._pc = pc;
     pc.onicecandidate = (evt) => this.onLocalCandidate(evt);
@@ -9503,61 +9608,63 @@ var Whip = class _Whip extends WebRtcBase {
       await this.onLocalOffer(await pc.createOffer());
     });
   }
-  async onLocalCandidate(evt) {
-    if (evt.candidate !== null) {
-      if (this._eTag === "") {
-        this._queuedCandidates.push(evt.candidate);
-      } else {
-        await this.sendLocalCandidates([evt.candidate]);
-      }
+  async close() {
+    const stream = this._stream;
+    this._stream = null;
+    if (stream) {
+      const tracks = stream.getTracks();
+      tracks.forEach((track) => {
+        track.stop();
+      });
     }
-    return this;
+    return super.close();
   }
-  async onLocalOffer(offer) {
-    if (!this._pc) {
-      throw new Error("onLocalOffer no peer connection");
+};
+
+// src/webrtc_whep.ts
+var WebrtcWhep = class extends WebrtcBase {
+  constructor(ingressId, getSession, client, requestLogger) {
+    super(getSession, client, ingressId, "/liveIngress/whep", requestLogger);
+    this._stream = null;
+  }
+  async close() {
+    const stream = this._stream;
+    this._stream = null;
+    if (stream) {
+      const tracks = stream.getTracks();
+      tracks.forEach((track) => {
+        track.stop();
+      });
     }
-    if (!offer.sdp) {
-      throw new Error("onLocalOffer no sdp");
+    return super.close();
+  }
+  async stream() {
+    if (this._stream) {
+      return Promise.resolve(this._stream);
+    } else {
+      return Promise.reject("fetching stream failed");
     }
-    this._offerData = _Whip.parseOffer(offer.sdp);
-    await this._pc.setLocalDescription(offer);
+  }
+  async start() {
     const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
-    this._requestLogger.debug("before GET: %s", ingressUrl);
+    const egressUrl = new URL(this._urlPath, session.baseUrl);
+    this._requestLogger.debug("before GET: %s", egressUrl);
     const headers = {
-      "Authorization": `Bearer ${session.accessToken}`,
-      "Content-Type": "application/sdp"
+      "Authorization": `Bearer ${session.accessToken}`
     };
-    const response = await this._client.fetch(ingressUrl, {
+    const response = await this._client.fetch(egressUrl, {
       headers,
-      method: "POST",
-      body: offer.sdp
+      method: "GET"
     });
-    if (response.status != 201) {
-      return Promise.reject(`unknown status code for POST '${ingressUrl}': ${response.status} (${response.statusText})`);
+    if (response.status >= 300) {
+      return Promise.reject(`unknown status code for GET '${egressUrl}': ${response.status} (${response.statusText})`);
     }
-    this._eTag = response.headers.get("ETag") ?? "";
-    return this.onRemoteAnswer(new RTCSessionDescription({
-      type: "answer",
-      sdp: await response.text()
-    }));
+    return this.onIceServers(response);
   }
   async onRemoteAnswer(answer) {
     if (!this._pc) {
       throw new Error("onLocalOffer no peer connection");
     }
-    answer = new RTCSessionDescription({
-      type: "answer",
-      sdp: _Whip.editAnswer(
-        answer.sdp,
-        "h264/90000",
-        void 0,
-        5e3,
-        void 0,
-        true
-      )
-    });
     await this._pc.setRemoteDescription(new RTCSessionDescription(answer));
     if (this._queuedCandidates.length !== 0) {
       await this.sendLocalCandidates(this._queuedCandidates);
@@ -9565,42 +9672,38 @@ var Whip = class _Whip extends WebRtcBase {
     }
     return this;
   }
-  async sendLocalCandidates(candidates) {
-    if (!this._offerData) {
-      throw new Error("sendLocalCandidates no offerData");
+  async onIceServers(response) {
+    if (this._stream) {
+      throw new Error("onIceServers has stream");
     }
-    const session = await this._getSession();
-    const ingressUrl = new URL("/liveIngress/whip/" + this._ingressId, session.baseUrl);
-    this._requestLogger.debug("before PATCH: %s", ingressUrl);
-    const headers = {
-      "Authorization": `Bearer ${session.accessToken}`,
-      "Content-Type": "application/trickle-ice-sdpfrag",
-      "If-Match": this._eTag
-    };
-    const response = await this._client.fetch(ingressUrl, {
-      headers,
-      method: "PATCH",
-      body: _Whip.generateSdpFragment(this._offerData, candidates)
+    const pc = new RTCPeerConnection({
+      iceServers: WebrtcBase.linkToIceServers(response.headers.get("Link"))
+    });
+    const direction = "sendrecv";
+    pc.addTransceiver("video", { direction });
+    pc.onicecandidate = (evt) => this.onLocalCandidate(evt);
+    this._pc = pc;
+    this._requestLogger.info("before", pc.iceConnectionState);
+    return new Promise(async (resolve, reject) => {
+      pc.ontrack = (evt) => {
+        this._requestLogger.debug("new track:", evt.track.kind);
+        this._stream = evt.streams[0];
+        resolve(this);
+      };
+      pc.oniceconnectionstatechange = () => {
+        switch (pc.iceConnectionState) {
+          case "failed":
+          case "disconnected":
+            this._requestLogger.debug("disconnected");
+            reject(`peer connection: ${pc.iceConnectionState}`);
+            break;
+          case "connected":
+            this._requestLogger.debug("connected");
+            break;
+        }
+      };
+      await this.onLocalOffer(await pc.createOffer());
     });
-    if (response.status != 204) {
-      return Promise.reject(`unknown status code for PATCH '${ingressUrl}': ${response.status} (${response.statusText})`);
-    }
-    return this;
-  }
-  async close() {
-    const pc = this._pc;
-    const stream = this._stream;
-    this._stream = null;
-    this._pc = null;
-    if (stream) {
-      const tracks = stream.getTracks();
-      tracks.forEach((track) => {
-        track.stop();
-      });
-    }
-    if (pc) {
-      return pc.close();
-    }
   }
 };
 
@@ -9626,6 +9729,43 @@ if ("document" in globalThis && "implementation" in globalThis.document) {
 
 // src/endpoint.ts
 import { pino } from "pino";
+
+// src/shims/browser_session.ts
+import { createAuth0Client } from "@auth0/auth0-spa-js";
+var authenticateBrowserSession;
+if ("document" in globalThis && "implementation" in globalThis.document) {
+  authenticateBrowserSession = async (auth0, eyepopUrl, popId) => {
+    const options = {
+      clientId: auth0.clientId,
+      domain: auth0.domain,
+      authorizationParams: {
+        scope: auth0.scope,
+        audience: auth0.audience
+      }
+    };
+    const auth0Client = await createAuth0Client(options);
+    if (!await auth0Client.isAuthenticated()) {
+      await auth0Client.loginWithPopup();
+    }
+    const accessToken = await auth0Client.getTokenSilently();
+    if (!accessToken) {
+      return Promise.reject("auth0 login failed");
+    }
+    const session = {
+      eyepopUrl,
+      popId,
+      accessToken,
+      validUntil: Date.now() + 60 * 60 * 1e3
+    };
+    return session;
+  };
+} else {
+  authenticateBrowserSession = (auth0, eyepopUrl, popId) => {
+    return Promise.reject("auth0 login not supported server-side");
+  };
+}
+
+// src/endpoint.ts
 var Endpoint = class {
   constructor(options) {
     this._options = options;
@@ -9649,55 +9789,13 @@ var Endpoint = class {
     this._logger = rootLogger.child({ module: "eyepop" });
     this._requestLogger = this._logger.child({ module: "requests" });
   }
-  onStateChanged(handler) {
-    this._stateChangeHandler = handler;
-    return this;
-  }
-  async startIngressWs() {
-    if (this._ingressEventWs || !this._baseUrl || !this._client) {
-      return;
-    }
-    try {
-      const getTokenUrl = `${this._baseUrl}/liveIngress/events/token`;
-      const headers = {
-        "Authorization": await this.authorizationHeader()
-      };
-      this._requestLogger.debug("before GET %s", getTokenUrl);
-      let response = await this._client.fetch(getTokenUrl, { headers });
-      if (response.status == 401) {
-        this._requestLogger.debug("after GET %s: 401, about to retry with fresh access token", getTokenUrl);
-        this._token = null;
-        const headers2 = {
-          "Authorization": await this.authorizationHeader()
-        };
-        this.updateState("FetchConfig" /* FetchConfig */);
-        response = await this._client.fetch(getTokenUrl, { headers: headers2 });
-      }
-      if (response.status != 200) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
-      }
-      const wsAuthToken = await response.json();
-      const wsUrl = this._baseUrl.startsWith("https://") ? `${this._baseUrl.replace("https://", "wss://")}/liveIngress/events/${wsAuthToken.token}` : `${this._baseUrl.replace("http://", "ws://")}/liveIngress/events/${wsAuthToken.token}`;
-      this._ingressEventWs = new WebSocket(wsUrl);
-      this._ingressEventWs.addEventListener("message", (event) => {
-        const ingressEvent = JSON.parse(event.data);
-        if (this._ingressEventHandler) {
-          this._ingressEventHandler(ingressEvent);
-        }
-      });
-    } finally {
-      this.updateState();
+  eyepopUrl() {
+    if (this._options.eyepopUrl) {
+      return this._options.eyepopUrl.replace(/\/+$/, "");
+    } else {
+      return "https://api.eyepop.ai";
     }
   }
-  onIngressEvent(handler) {
-    this._ingressEventHandler = handler;
-    this.startIngressWs().then(() => {
-    }).catch((reason) => {
-      this._logger.warn("unexpected error starting the ingress event handler: %s", reason);
-    });
-    return this;
-  }
   state() {
     return this._state;
   }
@@ -9710,6 +9808,80 @@ var Endpoint = class {
   popId() {
     return this._options.popId || null;
   }
+  onStateChanged(handler) {
+    this._stateChangeHandler = handler;
+    return this;
+  }
+  onIngressEvent(handler) {
+    this._ingressEventHandler = handler;
+    this.startIngressWs().then(() => {
+    }).catch((reason) => {
+      this._logger.warn("unexpected error starting the ingress event handler: %s", reason);
+    });
+    return this;
+  }
+  async connect() {
+    if (this._client) {
+      this._logger.warn("endpoint already connected");
+      return this;
+    }
+    if (!this._options.eyepopUrl) {
+      return Promise.reject("option eyepopUrl or environment variable EYEPOP_URL is required");
+    }
+    if (!this._options.popId) {
+      return Promise.reject("option popId or environment variable EYEPOP_POP_ID is required");
+    }
+    if (this._options.auth === void 0) {
+      return Promise.reject("cannot connect without defined auth option");
+    }
+    if (this._options.auth.session !== void 0) {
+      this._token = this._options.auth.session.accessToken;
+      this._expire_token_time = this._options.auth.session.validUntil / 1e3;
+    } else if (this._options.auth.oAuth2 !== void 0) {
+    } else if (this._options.auth.secretKey !== void 0) {
+    } else {
+      return Promise.reject("option secretKey or environment variable EYEPOP_SECRET_KEY is required");
+    }
+    this._client = await createHttpClient();
+    let result = await this.reconnect();
+    if (this._baseUrl && this._options.stopJobs) {
+      const stop_url = `${this._baseUrl}/pipelines/${this._pipelineId}/source?mode=preempt&processing=sync`;
+      const body = { "sourceType": "NONE" };
+      const headers = {
+        "Authorization": await this.authorizationHeader(),
+        "Content-Type": "application/json"
+      };
+      this._requestLogger.debug("before PATCH %s", stop_url);
+      let response = await this._client.fetch(stop_url, {
+        method: "PATCH",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (response.status >= 300) {
+        const message = await response.text();
+        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      }
+      this._requestLogger.debug("after PATCH %s", stop_url);
+    }
+    if (!this._ingressEventWs && this._ingressEventHandler) {
+      await this.startIngressWs();
+    }
+    return result;
+  }
+  async disconnect(wait = true) {
+    if (wait && this._limit) {
+      for (let j = 0; j < this._options.jobQueueLength; j++) {
+        await this._limit.acquire();
+      }
+    }
+    this._limit = new Semaphore(this._options.jobQueueLength ?? 1024);
+    if (this._client) {
+      await this._client.close();
+      this._client = null;
+    }
+    this._baseUrl = null;
+    this._pipelineId = null;
+  }
   async session() {
     await this.currentAccessToken();
     if (this._token == null || this._expire_token_time == null) {
@@ -9734,11 +9906,20 @@ var Endpoint = class {
     if (!this._baseUrl || !this._client) {
       return Promise.reject("endpoint not connected, use connect() before ingress()");
     }
-    const whip = new Whip(stream, async () => {
+    const whip = new WebrtcWhip(stream, async () => {
       return this.session();
     }, this._client, this._requestLogger);
     return whip.start();
   }
+  async liveEgress(ingressId) {
+    if (!this._baseUrl || !this._client) {
+      return Promise.reject("endpoint not connected, use connect() before ingress()");
+    }
+    const whep = new WebrtcWhep(ingressId, async () => {
+      return this.session();
+    }, this._client, this._requestLogger);
+    return whep.start();
+  }
   async process(source) {
     if (source.file !== void 0) {
       return this.uploadFile(source);
@@ -9754,6 +9935,43 @@ var Endpoint = class {
       return Promise.reject("unknown source type");
     }
   }
+  async startIngressWs() {
+    if (this._ingressEventWs || !this._baseUrl || !this._client) {
+      return;
+    }
+    try {
+      const getTokenUrl = `${this._baseUrl}/liveIngress/events/token`;
+      const headers = {
+        "Authorization": await this.authorizationHeader()
+      };
+      this._requestLogger.debug("before GET %s", getTokenUrl);
+      let response = await this._client.fetch(getTokenUrl, { headers });
+      if (response.status == 401) {
+        this._requestLogger.debug("after GET %s: 401, about to retry with fresh access token", getTokenUrl);
+        this._token = null;
+        const headers2 = {
+          "Authorization": await this.authorizationHeader()
+        };
+        this.updateState("FetchConfig" /* FetchConfig */);
+        response = await this._client.fetch(getTokenUrl, { headers: headers2 });
+      }
+      if (response.status != 200) {
+        const message = await response.text();
+        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      }
+      const wsAuthToken = await response.json();
+      const wsUrl = this._baseUrl.startsWith("https://") ? `${this._baseUrl.replace("https://", "wss://")}/liveIngress/events/${wsAuthToken.token}` : `${this._baseUrl.replace("http://", "ws://")}/liveIngress/events/${wsAuthToken.token}`;
+      this._ingressEventWs = new WebSocket(wsUrl);
+      this._ingressEventWs.addEventListener("message", (event) => {
+        const ingressEvent = JSON.parse(event.data);
+        if (this._ingressEventHandler) {
+          this._ingressEventHandler(ingressEvent);
+        }
+      });
+    } finally {
+      this.updateState();
+    }
+  }
   async uploadFile(source) {
     if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
       return Promise.reject("endpoint not connected, use connect() before upload()");
@@ -9796,6 +10014,7 @@ var Endpoint = class {
   }
   async uploadPath(source) {
     if (!this._baseUrl || !this._pipelineId || !this._client || !this._limit) {
+      console.log(this);
       throw new Error("endpoint not connected, use connect() before process()");
     }
     await this._limit.acquire();
@@ -9855,48 +10074,6 @@ var Endpoint = class {
       throw e;
     }
   }
-  // noinspection TypeScriptValidateTypes
-  async connect() {
-    if (this._client) {
-      console.info("endpoint already connected");
-      return this;
-    }
-    if (!this._options.eyepopUrl) {
-      return Promise.reject("option eyepopUrl or environment variable EYEPOP_URL is required");
-    }
-    if (!this._options.popId) {
-      return Promise.reject("option popId or environment variable EYEPOP_POP_ID is required");
-    }
-    if (this._options.auth && this._options.auth.session) {
-      this._token = this._options.auth.session.accessToken;
-      this._expire_token_time = this._options.auth.session.validUntil / 1e3;
-    } else {
-      if (!this._options.auth || !this._options.auth.secretKey) {
-        return Promise.reject("option secretKey or environment variable EYEPOP_SECRET_KEY is required");
-      }
-    }
-    this._client = await createHttpClient();
-    let result = await this.reconnect();
-    if (this._baseUrl && this._options.stopJobs) {
-      const stop_url = `${this._baseUrl}/pipelines/${this._pipelineId}/source?mode=preempt&processing=sync`;
-      const body = { "sourceType": "NONE" };
-      const headers = {
-        "Authorization": await this.authorizationHeader(),
-        "Content-Type": "application/json"
-      };
-      this._requestLogger.debug("before PATCH %s", stop_url);
-      let response = await this._client.fetch(stop_url, { method: "PATCH", headers, body: JSON.stringify(body) });
-      if (response.status >= 300) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
-      }
-      this._requestLogger.debug("after PATCH %s", stop_url);
-    }
-    if (!this._ingressEventWs && this._ingressEventHandler) {
-      await this.startIngressWs();
-    }
-    return result;
-  }
   jobDone(job) {
     this._limit?.release();
     this.updateState();
@@ -9971,7 +10148,8 @@ var Endpoint = class {
         }
         config = await response.json();
       }
-      this._baseUrl = config.base_url;
+      const baseUrl = new URL(config.base_url, this.eyepopUrl());
+      this._baseUrl = baseUrl.toString();
       this._pipelineId = config.pipeline_id;
       this._popName = config.name;
       this._requestLogger.debug("after GET %s: %s / %s", config_url, this._baseUrl, this._pipelineId);
@@ -9983,20 +10161,6 @@ var Endpoint = class {
       return Promise.resolve(this);
     }
   }
-  async disconnect(wait = true) {
-    if (wait && this._limit) {
-      for (let j = 0; j < this._options.jobQueueLength; j++) {
-        await this._limit.acquire();
-      }
-    }
-    this._limit = new Semaphore(this._options.jobQueueLength ?? 1024);
-    if (this._client) {
-      await this._client.close();
-      this._client = null;
-    }
-    this._baseUrl = null;
-    this._pipelineId = null;
-  }
   async authorizationHeader() {
     return `Bearer ${await this.currentAccessToken()}`;
   }
@@ -10004,41 +10168,49 @@ var Endpoint = class {
     const now = Date.now() / 1e3;
     if (!this._token || this._expire_token_time < now) {
       this.updateState("Authenticating" /* Authenticating */);
-      if (!this._client) {
-        return Promise.reject("endpoint not connected");
-      } else if (!this._options.auth || !this._options.auth.secretKey) {
-        return Promise.reject("temporary access token expired");
-      }
-      const body = { "secret_key": this._options.auth.secretKey };
-      const headers = { "Content-Type": "application/json" };
-      const post_url = `${this.eyepopUrl()}/authentication/token`;
-      this._requestLogger.debug("before POST %s", post_url);
-      const response = await this._client.fetch(post_url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
-      if (response.status != 200) {
-        const message = await response.text();
-        return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+      try {
+        if (!this._client) {
+          return Promise.reject("endpoint not connected");
+        } else if (this._options.auth.session !== void 0) {
+          return Promise.reject("temporary access token expired");
+        } else if (this._options.auth.oAuth2 !== void 0 && this._options.eyepopUrl && this._options.popId) {
+          const session = await authenticateBrowserSession(
+            this._options.auth.oAuth2,
+            this._options.eyepopUrl,
+            this._options.popId
+          );
+          this._token = session.accessToken;
+          this._expire_token_time = session.validUntil / 1e3;
+        } else if (this._options.auth.secretKey !== void 0 && this._options.eyepopUrl) {
+          const secretKeyAuth = this._options.auth;
+          const body = { "secret_key": secretKeyAuth.secretKey };
+          const headers = { "Content-Type": "application/json" };
+          const post_url = `${this.eyepopUrl()}/authentication/token`;
+          this._requestLogger.debug("before POST %s", post_url);
+          const response = await this._client.fetch(post_url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(body)
+          });
+          if (response.status != 200) {
+            const message = await response.text();
+            return Promise.reject(`Unexpected status ${response.status}: ${message}`);
+          }
+          this._requestLogger.debug("after POST %s", post_url);
+          const data = await response.json();
+          const token = data;
+          this._token = token.access_token;
+          this._expire_token_time = now + token.expires_in - 60;
+        } else {
+          return Promise.reject("no valid auth option");
+        }
+      } finally {
+        this.updateState();
       }
-      this._requestLogger.debug("after POST %s", post_url);
-      const data = await response.json();
-      const token = data;
-      this._token = token.access_token;
-      this._expire_token_time = now + token.expires_in - 60;
-      this.updateState();
     }
     this._logger.debug("using access token, valid for at least %d seconds", this._expire_token_time - now);
     return this._token;
   }
-  eyepopUrl() {
-    if (this._options.eyepopUrl) {
-      return this._options.eyepopUrl.replace(/\/+$/, "");
-    } else {
-      return "https://api.eyepop.ai";
-    }
-  }
 };
 
 // src/visualize.ts
@@ -10154,40 +10326,6 @@ _EyePopPlot.colors = {
 };
 var EyePopPlot = _EyePopPlot;
 
-// src/shims/browser_session.ts
-var authenticateBrowserSession;
-if ("document" in globalThis && "implementation" in globalThis.document) {
-  authenticateBrowserSession = (oauthUrl, eyepopUrl, popId) => {
-    const queryString = window.location.search;
-    const urlParams = new URLSearchParams(queryString);
-    let token = urlParams.get("pop_token");
-    if (token) {
-      urlParams.delete("pop_token");
-      const url = `${window.location.pathname}?${urlParams}`;
-      window.history.replaceState({}, document.title, url);
-      return {
-        eyepopUrl,
-        popId,
-        accessToken: token,
-        validUntil: Date.now() + 60 * 60 * 1e3
-      };
-    } else {
-      const url = `${oauthUrl}?url=${encodeURIComponent(window.location.href)}`;
-      window.location.replace(url);
-      return {
-        eyepopUrl,
-        popId,
-        accessToken: "in-progress",
-        validUntil: 0
-      };
-    }
-  };
-} else {
-  authenticateBrowserSession = (oauthUrl, eyepopUrl, popId) => {
-    return null;
-  };
-}
-
 // src/index.ts
 var readEnv = (env) => {
   if (typeof process !== "undefined") {
@@ -10195,43 +10333,72 @@ var readEnv = (env) => {
   }
   return void 0;
 };
-var EyePopSdk = class {
-  static endpoint({
-    auth = this.defaultAuth,
-    popId = readEnv("EYEPOP_POP_ID"),
-    eyepopUrl = readEnv("EYEPOP_URL"),
-    autoStart = true,
-    stopJobs = true,
-    jobQueueLength = 1024,
-    logger,
-    ...opts
-  } = {}) {
-    if (auth.oAuth && popId) {
-      let oauthUrl = "https://dashboard.eyepop.ai/sdkauth";
-      if (typeof auth.oAuth == "string") {
-        oauthUrl = auth.oAuth;
+var _EyePopSdk = class _EyePopSdk {
+  static endpoint(opts = {}) {
+    if (typeof opts.auth == "undefined") {
+      if (typeof _EyePopSdk.defaultAuth == "undefined") {
+        throw new Error("auth option or EYEPOP_SECRET_KEY environment variable is required");
       }
-      auth.session = authenticateBrowserSession(oauthUrl, eyepopUrl ?? "https://api.eyepop.ai", popId) ?? void 0;
+      opts.auth = _EyePopSdk.defaultAuth;
     }
-    const options = {
-      auth,
-      popId: auth.session ? auth.session.popId : popId,
-      eyepopUrl: auth.session ? auth.session.eyepopUrl : eyepopUrl ?? "https://api.eyepop.ai",
-      autoStart,
-      stopJobs,
-      jobQueueLength,
-      logger
-    };
-    const endpoint = new Endpoint(options);
+    if (typeof opts.popId == "undefined") {
+      opts.popId = readEnv("EYEPOP_POP_ID");
+    }
+    if (typeof opts.eyepopUrl == "undefined") {
+      opts.eyepopUrl = readEnv("EYEPOP_URL") || "https://api.eyepop.ai";
+    }
+    if (typeof opts.autoStart == "undefined") {
+      opts.autoStart = true;
+    }
+    if (typeof opts.stopJobs == "undefined") {
+      opts.stopJobs = true;
+    }
+    if (typeof opts.jobQueueLength == "undefined") {
+      opts.jobQueueLength = 1024;
+    }
+    if (typeof opts.auth.oAuth2 != "undefined" && opts.popId) {
+      if (typeof opts.auth.oAuth2 === "boolean") {
+        if (opts.eyepopUrl.startsWith("https://staging-api.eyepop.ai")) {
+          opts.auth = {
+            oAuth2: {
+              domain: "dev-eyepop.us.auth0.com",
+              clientId: "jktx3YO2UnbkNPvr05PQWf26t1kNTJyg",
+              audience: "https://dev-app.eyepop.ai",
+              scope: "admin:clouds"
+            }
+          };
+        } else {
+          opts.auth = {
+            oAuth2: {
+              domain: "eyepop.us.auth0.com",
+              clientId: "Lb9ubA9Hf3jlaqWLUx8XgA0zvotgViCl",
+              audience: "https://api.eyepop.ai",
+              scope: "admin:clouds"
+            }
+          };
+        }
+      }
+    }
+    if (opts.auth.session !== void 0) {
+      if (opts.auth.session.popId) {
+        opts.popId = opts.auth.session.popId;
+      }
+      if (opts.auth.session.eyepopUrl) {
+        opts.eyepopUrl = opts.auth.session.eyepopUrl;
+      }
+    }
+    const endpoint = new Endpoint(opts);
     return endpoint;
   }
   static plot(context) {
     return new EyePopPlot(context);
   }
 };
-EyePopSdk.defaultAuth = {
-  secretKey: readEnv("EYEPOP_SECRET_KEY")
-};
+_EyePopSdk.envSecretKey = readEnv("EYEPOP_SECRET_KEY");
+_EyePopSdk.defaultAuth = _EyePopSdk.envSecretKey ? {
+  secretKey: _EyePopSdk.envSecretKey
+} : void 0;
+var EyePopSdk = _EyePopSdk;
 var src_default = EyePopSdk;
 export {
   EndpointState,